From 723cb7fac6c054963077cd3ca713d8ae99f0f2f8 Mon Sep 17 00:00:00 2001
From: Fred Thiele <8555720+f3rdy@users.noreply.github.com>
Date: Tue, 28 Apr 2026 11:07:52 +0200
Subject: [PATCH] docs(manual): add docs/manual.pdf user manual in book form
(#59)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Hand-written end-to-end manual covering installation, daily use,
configuration, metadata, schema validation, schema lifecycle, type
detection, troubleshooting, and a command reference appendix.
Tooling: pandoc + xelatex (both already installed; nothing exotic).
Fonts pulled from system: Noto Serif body, Noto Sans headings, DejaVu
Sans Mono for code — all common Linux distribution defaults, all
selected for screen readability and clean copy-paste.
23 pages A4, scrbook class for proper book typography (running
headers, numbered sections, page numbers, generous margins). Tango
syntax highlighting on code blocks with subtle background tint.
Files:
- docs/manual.md — markdown source, single file with YAML metadata
- docs/manual.pdf — committed artifact so readers don't need pandoc
- docs/build_manual.sh — single-command rebuild
- README link added
Closes #59.
---
README.md | 2 +
docs/build_manual.sh | 27 ++
docs/manual.md | 680 +++++++++++++++++++++++++++++++++++++++++++
docs/manual.pdf | Bin 0 -> 128815 bytes
4 files changed, 709 insertions(+)
create mode 100755 docs/build_manual.sh
create mode 100644 docs/manual.md
create mode 100644 docs/manual.pdf
diff --git a/README.md b/README.md
index b2fdf25..7c340e4 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,8 @@
A CLI for managing Ansible Vault secrets — with metadata tracking, expiry monitoring, type detection, and self-updating standalone binaries.
+For the full read-it-end-to-end book: [docs/manual.pdf](docs/manual.pdf) (23 pages).
+
## Install
```bash
diff --git a/docs/build_manual.sh b/docs/build_manual.sh
new file mode 100755
index 0000000..7c7b212
--- /dev/null
+++ b/docs/build_manual.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Build docs/manual.pdf from docs/manual.md.
+#
+# Tooling: pandoc + xelatex. Both are available on most Linux distributions
+# via the system package manager (`pandoc`, `texlive-xetex`, plus the Noto and
+# DejaVu font packages). All settings (fonts, layout, classoptions) live in
+# the YAML metadata block at the top of manual.md — no separate template.
+
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+if ! command -v pandoc >/dev/null 2>&1; then
+ echo "Error: pandoc is not on PATH." >&2
+ exit 1
+fi
+if ! command -v xelatex >/dev/null 2>&1; then
+ echo "Error: xelatex is not on PATH (install texlive-xetex)." >&2
+ exit 1
+fi
+
+pandoc manual.md \
+ --pdf-engine=xelatex \
+ --highlight-style=tango \
+ --output=manual.pdf
+
+echo "Built: $(pwd)/manual.pdf"
diff --git a/docs/manual.md b/docs/manual.md
new file mode 100644
index 0000000..a7ec37f
--- /dev/null
+++ b/docs/manual.md
@@ -0,0 +1,680 @@
+---
+title: "vaultctl"
+subtitle: "User Manual"
+author: "cdds-ab"
+date: "April 2026"
+lang: en
+documentclass: scrbook
+classoption:
+ - paper=a4
+ - fontsize=11pt
+ - DIV=12
+ - parskip=half-
+ - twoside=false
+ - cleardoublepage=plain
+ - bibliography=totoc
+geometry:
+ - margin=2.5cm
+ - top=2.8cm
+ - bottom=2.8cm
+mainfont: "Noto Serif"
+sansfont: "Noto Sans"
+monofont: "DejaVu Sans Mono"
+mainfontoptions:
+ - Numbers=OldStyle
+colorlinks: true
+linkcolor: black
+urlcolor: NavyBlue
+toccolor: black
+toc: true
+toc-depth: 2
+numbersections: true
+header-includes:
+ - \usepackage{microtype}
+ - \usepackage{fancyhdr}
+ - \usepackage{xcolor}
+ - \definecolor{codebg}{HTML}{F4F4F2}
+ - \usepackage{fvextra}
+ - \DefineVerbatimEnvironment{Highlighting}{Verbatim}{breaklines,commandchars=\\\{\}}
+ - \fvset{breaklines=true,breaknonspaceingroup=true,breakanywhere=true}
+ - \renewcommand{\sfdefault}{\familydefault}
+ - \addtokomafont{disposition}{\rmfamily}
+ - \setkomafont{descriptionlabel}{\rmfamily\bfseries}
+---
+
+# Introduction
+
+\noindent
+**vaultctl** is a command-line interface for managing Ansible Vault secrets with structured metadata. It wraps the standard `ansible-vault` tool in a workflow built around three ideas:
+
+1. **Secrets and metadata are separate.** The encrypted file holds values; an unencrypted sibling file holds descriptions, rotation schedules, expiry dates, and consumers. The metadata is reviewable and version-controllable on its own.
+2. **Schemas are first-class.** Optional CUE schemas describe the shape of valid vault content. Validation and drift detection turn structural changes into deliberate, auditable steps.
+3. **Local by default.** All operations run on the developer's machine. There is no cloud backend, no analytics, no telemetry.
+
+This manual is a guided tour of the tool. The README on GitHub gives the quick reference; this document is meant to be read end to end.
+
+## When to Use vaultctl
+
+vaultctl earns its keep on projects where:
+
+- Ansible Vault is already the encryption-at-rest format and changing that isn't on the table.
+- More than a handful of secrets exist, and tracking why each one matters is a real concern.
+- Rotation or expiry timelines need to be visible to humans and to CI alike.
+- A schema-driven gate on what counts as valid vault content is desirable.
+
+It is **not** a replacement for HashiCorp Vault, AWS Secrets Manager, or any online secret broker. vaultctl is a local CLI on top of files.
+
+## What This Manual Covers
+
+The chapters that follow walk through installation, daily use, configuration, metadata management, schema validation, and the schema lifecycle. Troubleshooting and a command reference appendix close the document.
+
+For security architecture — trust boundaries, redaction, AI-assisted detection — see `docs/SECURITY.md`. That document is intentionally separate; it answers "what guarantees does this give me?", while this manual answers "how do I use it?".
+
+\clearpage
+
+# Installation
+
+vaultctl ships as a standalone binary, as a Python package, and as source. Pick the path that matches how the project's environment is managed.
+
+## Standalone Binary
+
+The simplest install. One file, no Python runtime needed:
+
+```bash
+curl -fsSL \
+ https://github.com/cdds-ab/vaultctl/releases/latest/download/vaultctl-linux-amd64 \
+ -o /usr/local/bin/vaultctl
+chmod +x /usr/local/bin/vaultctl
+vaultctl --version
+```
+
+The macOS arm64 build is published under the name `vaultctl-macos-arm64` at the same release URL pattern. Releases also include a `checksums.sha256` file for verification.
+
+## From Source
+
+If a project already manages Python tooling with `uv`:
+
+```bash
+uv tool install \
+ --from git+https://github.com/cdds-ab/vaultctl.git vaultctl
+```
+
+Or, for development:
+
+```bash
+git clone https://github.com/cdds-ab/vaultctl.git
+cd vaultctl
+uv sync
+uv run vaultctl --help
+```
+
+vaultctl requires Python 3.13 or newer when installed from source.
+
+## Required External Tools
+
+vaultctl orchestrates two external command-line tools. Both must be on `PATH`.
+
+`ansible-vault`
+: Performs the actual encryption and decryption. Install via your distribution's package manager or `pip install ansible-core`. Without it, vaultctl exits with a clear error on any operation that touches `vault.yml`.
+
+`cue` *(optional, for schema features)*
+: Enables `vaultctl validate` and the `vaultctl schema` subcommands. When `cue` is missing, schema features degrade gracefully — `validate` still runs the cross-file consistency check, and the schema commands report a clear setup instruction. Install from .
+
+## Self-Update
+
+Standalone binaries can update themselves:
+
+```bash
+vaultctl self-update
+```
+
+Updates verify SHA-256 checksums from the GitHub release, refuse downgrades, and refuse releases without published checksums. Source installs use their respective package manager — `self-update` reports an error and exits.
+
+\clearpage
+
+# First Steps
+
+The shortest useful tour: create a new vaultctl project, add a secret, and read it back.
+
+## Initialise a New Project
+
+In an empty directory:
+
+```bash
+vaultctl init
+```
+
+This creates two files and prompts for a vault password:
+
+```
+.vaultctl/
+└── config.yml # vaultctl's own configuration
+vault.yml # encrypted secrets (empty)
+vault-keys.yml # secret metadata (empty)
+```
+
+Open `.vaultctl/config.yml`. The defaults assume the vault and keys files live next to it; for an Ansible project, you'll typically point them into `inventory/group_vars/`. See **Configuration** for details.
+
+## Add and Read a Secret
+
+```bash
+vaultctl set api_token "abc123-secret"
+vaultctl get api_token
+# → abc123-secret
+```
+
+For longer values, read from a file:
+
+```bash
+vaultctl set ssh_key --file ~/.ssh/deploy_id_rsa
+```
+
+Or interactively (the value never appears in shell history):
+
+```bash
+vaultctl set db_password --prompt
+```
+
+`vaultctl list` shows every key with a one-line summary including type tags for structured entries:
+
+```
+api_token abc123-secret...
+db_password ********
+ssh_key [sshKey] -----BEGIN OPENSSH...
+```
+
+## Import an Existing Vault
+
+Already have an Ansible Vault? Point `init` at it:
+
+```bash
+vaultctl init --vault-file inventory/group_vars/all/vault.yml
+```
+
+vaultctl decrypts the existing file locally, generates the metadata skeleton, and offers to auto-detect entry types. No secrets leave the process during this scan.
+
+\clearpage
+
+# Configuration
+
+vaultctl's configuration lives in `.vaultctl/config.yml`, a small YAML file at the project root. The directory `.vaultctl/` is reserved for vaultctl's own files (config and CUE schemas); secrets and metadata stay where Ansible expects them.
+
+## Discovery
+
+When you run any `vaultctl` command, the configuration is located by the first match in this order:
+
+1. The `$VAULTCTL_CONFIG` environment variable, if set, points to a config file directly.
+2. Walking upward from the current directory to the git root, the first `.vaultctl/config.yml` encountered wins.
+3. The user-global fallback at `~/.config/vaultctl/config.yml` is tried last.
+
+Most projects use option 2 — drop a `.vaultctl/` directory at the repo root and forget about it.
+
+## Anatomy of `config.yml`
+
+```yaml
+# .vaultctl/config.yml
+vault_file: inventory/group_vars/all/vault.yml
+keys_file: inventory/group_vars/all/vault-keys.yml
+
+password:
+ env: VAULT_PASS # tried first
+ file: ~/.ansible-vault-pass # then file
+ cmd: pass show project/vault # then command
+
+# Optional, for AI-assisted type detection.
+ai:
+ endpoint: https://api.openai.com/v1/chat/completions
+ model: gpt-4o-mini
+ api_key_cmd: pass show openai/api-key
+ consent: true
+```
+
+`vault_file` and `keys_file` are paths resolved relative to the project root — the parent of `.vaultctl/` — not relative to `.vaultctl/` itself. This convention keeps secret files at their natural location next to the inventory data.
+
+## Password Resolution Chain
+
+The vault password is resolved by trying each configured source in order. The first non-empty result wins:
+
+1. `password.env` — read from the named environment variable.
+2. `password.file` — read from the file at the given path. `~` expands to the home directory.
+3. `password.cmd` — execute the command in a shell and use the trimmed standard output.
+
+If all configured sources are empty or unset, vaultctl exits with an error listing exactly which sources were tried. The resolved password lives only in process memory and is never written to disk by vaultctl itself.
+
+\clearpage
+
+# Daily Use
+
+The commands you'll reach for every day.
+
+## Reading
+
+```bash
+vaultctl list # all keys with descriptions
+vaultctl list -f api # filter by regex on names + metadata
+vaultctl get db_password # print a single value
+vaultctl describe db_password # show metadata: rotate, consumers, expiry
+```
+
+For structured entries (a key whose value is a dict, e.g. a username/password pair):
+
+```bash
+vaultctl get db_creds # YAML-formatted full entry
+vaultctl get db_creds --field username # one field, raw
+```
+
+## Writing
+
+```bash
+vaultctl set api_token "abc123"
+vaultctl set ssh_key --file id_rsa
+vaultctl set db_password --prompt
+vaultctl set legacy_token --base64 dGVzdA==
+```
+
+By default, overwriting an existing key prompts for confirmation and saves the previous value to `_previous`. Two flags control that:
+
+`--force`
+: Skip the confirmation prompt. Useful in scripts.
+
+`--no-backup`
+: Don't keep the previous value as `_previous`. Use when you don't want a snapshot of the old secret hanging around.
+
+`--expires YYYY-MM-DD` writes the expiry into `vault-keys.yml` alongside the secret update.
+
+## Restoring and Editing
+
+`vaultctl restore ` swaps a key's current value with its `_previous` backup — useful if a rotation went wrong. `vaultctl edit` opens the decrypted vault in `$EDITOR` via `ansible-vault edit`; on save the file is re-encrypted in place.
+
+## Searching
+
+`vaultctl search ` runs a regex across both metadata and decrypted values:
+
+```bash
+vaultctl search 'admin' # matches descriptions, key names, values
+vaultctl search 'admin' --context # show parent objects of matches
+```
+
+Search is local; nothing is sent anywhere.
+
+## Deleting
+
+```bash
+vaultctl delete obsolete_key
+```
+
+A confirmation prompt asks before removing. With `--force`, the deletion is silent.
+
+\clearpage
+
+# Metadata and Expiry
+
+Secret values live in `vault.yml`. Their *metadata* — the human-readable context — lives in a sibling file `vault-keys.yml`.
+
+## Anatomy of `vault-keys.yml`
+
+```yaml
+vault_keys:
+ api_token:
+ description: "API token for service X"
+ type: secretText
+ rotate: "365d"
+ expires: "2026-12-01"
+ consumers: ["host01", "host02"]
+ rotate_cmd: "Web UI → Settings → Regenerate"
+
+ db_creds:
+ description: "Database credentials, primary cluster"
+ type: usernamePassword
+ rotate: "90d"
+ consumers: ["app01", "app02"]
+```
+
+Every field is optional. The minimum useful entry is a one-line `description`. The metadata file is not encrypted — review it like any other config file in the repository.
+
+## Recognised Fields
+
+`description`
+: Free-form text, ideally one sentence about what this secret is for.
+
+`type`
+: One of `usernamePassword`, `sshKey`, `certificate`, `secretText`. Drives display formatting and is enforced by the bundled CUE schema.
+
+`rotate`
+: Recommended rotation period. Any string; common forms are `30d`, `90d`, `365d`, `never`.
+
+`expires`
+: Either a date (`YYYY-MM-DD`) or a full RFC 3339 timestamp. Used by `vaultctl check`.
+
+`consumers`
+: List of hosts or services that read this secret. Helps when planning rotation.
+
+`rotate_cmd`
+: Free-form note about how to rotate the secret. A URL, an internal-tool name, or a shell snippet.
+
+## Checking Expiry
+
+`vaultctl check` reads `vault-keys.yml` and reports any keys that are expired or expiring within a window:
+
+```bash
+vaultctl check # default: 30 days warning, exit 1 if any expired
+vaultctl check --warn-days 60
+vaultctl check --json # machine-readable output for CI integration
+vaultctl check --quiet # exit code only; no output
+```
+
+The exit code is `1` if any key is expired or within the warning window, `0` otherwise. That makes the command suitable as a cron or CI gate.
+
+## Updating Metadata
+
+`vaultctl set --expires` adjusts the `expires` field along with a value update. For other fields, edit `vault-keys.yml` directly — it's plain YAML.
+
+`vaultctl describe ` is the read counterpart:
+
+```
+api_token
+ description: API token for service X
+ type: secretText
+ rotate: 365d
+ expires: 2026-12-01 (in 217 days)
+ consumers: host01, host02
+ rotate_cmd: Web UI → Settings → Regenerate
+```
+
+\clearpage
+
+# Schema Validation
+
+Schemas catch typos, wrong types, and structural inconsistencies before they reach production. vaultctl uses CUE — the same language Kubernetes, Tekton, and other tooling chose for similar problems.
+
+When the `cue` binary is on `PATH`, four classes of check are available:
+
+- **Config** — `.vaultctl/config.yml` against the bundled `#Config` schema. Catches typos like `pasword:`.
+- **Metadata** — `vault-keys.yml` against the bundled `#KeysFile` schema. Rejects unknown fields, unknown `type` values, malformed `expires` dates.
+- **Content** — `vault.yml` against either the bundled `#VaultFile` schema (permissive) or a project-local override.
+- **Cross-consistency** — every key in `vault.yml` has metadata in `vault-keys.yml` and vice versa. Pure-Python; runs even without `cue`.
+
+## The Validate Command
+
+```bash
+vaultctl validate # all four checks
+vaultctl validate --skip-content # don't decrypt vault; just check structure
+```
+
+Exit codes:
+
+- `0` — all checks passed.
+- `1` — at least one violation; specifics are printed to stderr with the source file in brackets.
+
+When `cue` is missing, schema checks are skipped with a clear warning and the cross-consistency check still runs. The exit code reflects the cross-check outcome.
+
+## Bundled vs Custom Schemas
+
+Bundled schemas under the `vaultctl` package cover the universal cases (config and metadata structure). The default content schema is permissive — any string, any structured object — because vault content varies wildly across projects.
+
+Drop your own CUE files into `.vaultctl/` to override the defaults:
+
+```
+.vaultctl/
+├── config.yml
+├── vault.cue # overrides #VaultFile
+├── vault.constraints.cue # additional rules; CUE merges with vault.cue
+└── keys.cue # overrides #KeysFile
+```
+
+The override is automatically picked up by the next `vaultctl validate` run. CUE's package merging means sibling `.cue` files in the same directory are unified at validation time — useful for the **baseline plus constraints** pattern explained in the next chapter.
+
+## Example: Enforce a Minimum Password Length
+
+A `vault.constraints.cue` file in `.vaultctl/`:
+
+```cue
+package vaultctl
+
+#VaultFile: {
+ db_password: =~"^.{12,}$"
+}
+```
+
+Now any vault entry called `db_password` shorter than twelve characters fails validation. Combine with the auto-generated baseline (next chapter) and you get both structure and content rules in one place.
+
+\clearpage
+
+# Schema Lifecycle
+
+A schema written by hand is hard to keep in sync with a real vault. vaultctl ships a small lifecycle around CUE schemas: derive a baseline from the current vault, detect drift, and react to structural changes during normal `set` operations.
+
+## Bootstrap: `schema infer`
+
+```bash
+vaultctl schema infer
+```
+
+Decrypts the vault, walks its content, and writes a closed `#VaultFile` definition to `.vaultctl/vault.cue`. The output covers exactly the keys and shapes present at the moment of the inference. Adding a new key without updating the schema makes `vaultctl validate` fail — that's the value: structural change becomes a deliberate, reviewable step.
+
+The generated file carries a header comment marking it as auto-managed:
+
+```cue
+// AUTO-GENERATED by `vaultctl schema infer` — do not hand-edit.
+// Project-specific constraints belong in vault.constraints.cue.
+```
+
+`--force` overwrites an existing baseline. `--output PATH` writes elsewhere (useful in CI for ephemeral comparison).
+
+## Drift Detection: `schema sync`
+
+```bash
+vaultctl schema sync # diff-only; exit 1 on drift
+vaultctl schema sync --apply # rewrite the baseline
+```
+
+`schema sync` re-derives the schema from the current vault and compares to the existing `.vaultctl/vault.cue`. The exit codes:
+
+- `0` — baseline matches the vault.
+- `1` — drift detected (or fresh schema written with `--apply`).
+- `2` — no baseline exists; suggests `vaultctl schema infer` first.
+
+Without `--apply`, the command prints a unified diff. That's the format CI pipelines can flag back to a developer in a code review:
+
+```diff
+--- /home/.../vault.cue (current)
++++ /home/.../vault.cue (inferred)
+@@ -3,4 +3,5 @@
+ #VaultFile: {
+ existing_key: string
++ new_key: int
+ }
+```
+
+## Schema-Aware `set`
+
+When a baseline exists, `vaultctl set` checks the new vault content before encrypting. If a value introduces a structure the schema doesn't cover, you see the diff and decide:
+
+```
+$ vaultctl set new_token "abc123"
+Schema does not cover this change:
+[unified diff omitted]
+
+Extend .vaultctl/vault.cue with this change? [y/N]:
+```
+
+Three flags control this for non-interactive use:
+
+`--extend-schema`
+: Rewrite the baseline silently and continue. Useful in scripted bulk updates where every new key is expected to extend the schema.
+
+`--no-extend-schema`
+: Skip the prompt and proceed with drift. The schema diff is still printed to stderr so it shows up in CI logs. `vaultctl validate` will flag the drift later.
+
+`--force` *(without either of the above)*
+: Behaves as `--no-extend-schema`. Safer non-interactive default — the operator opts in to schema changes explicitly.
+
+## Baseline Plus Constraints
+
+The auto-managed baseline (`vault.cue`) and the hand-edited constraints (`vault.constraints.cue`) coexist by design. CUE merges all `.cue` files in the same package at validation time, so:
+
+- `schema infer` and `schema sync --apply` rewrite *only* `vault.cue`.
+- Hand-edits in `vault.constraints.cue` survive baseline regeneration unchanged.
+- The effective schema at validation time is the unification of both files.
+
+Use this split to keep regex constraints, value ranges, and required-field rules separate from the structural baseline.
+
+\clearpage
+
+# Type Detection
+
+Structured vault entries fall into a small set of recognisable shapes:
+
+`usernamePassword`
+: A dict with `username` and `password` (and possibly `host`, `port`, etc.).
+
+`sshKey`
+: A string starting with an OpenSSH header, or a dict containing one.
+
+`certificate`
+: A PEM-encoded certificate or chain.
+
+`secretText`
+: The catch-all for free-form scalar secrets — API tokens, passphrases, opaque strings.
+
+`vaultctl detect-types` infers a likely type for each entry by inspecting key names, dict field names, and the first few bytes of values. Results are presented as suggestions, not changes:
+
+```bash
+vaultctl detect-types # dry-run summary
+vaultctl detect-types --apply # write detected types into vault-keys.yml
+vaultctl detect-types --confidence high # show only high-confidence matches
+vaultctl detect-types --json # machine-readable output
+```
+
+## Local vs AI-Assisted
+
+By default, detection runs a local heuristic. For nuanced cases — entries the heuristic can't classify — there's an opt-in AI mode:
+
+```bash
+vaultctl detect-types --ai --yes
+```
+
+This sends a **redacted** view of the vault to a configured AI endpoint. Three independent layers prevent secret leakage:
+
+1. **Redaction** replaces every leaf value with `***REDACTED***` before any payload is built.
+2. **Explicit field extraction** sends only key names, field names, explicit `type` markers, and Phase 1 heuristic results — never the redacted dict as-is.
+3. **Consent dialog** lists exactly what will be sent, the target endpoint, the model, and a SHA-256 hash of the payload.
+
+`vaultctl detect-types --show-payload` decrypts, redacts, builds the payload, prints it (with hash), and exits without sending.
+
+For the full security architecture — trust boundaries, transport enforcement, what is never sent — see `docs/SECURITY.md`. AI-assisted detection is documented there at depth.
+
+\clearpage
+
+# Troubleshooting
+
+## "No `.vaultctl/config.yml` found"
+
+vaultctl walks upward from the current directory looking for a config file. If you're outside the project, it won't find one.
+
+Fix: `cd` into a directory inside the project, run `vaultctl init` to create one, or set `VAULTCTL_CONFIG=/absolute/path/to/config.yml`.
+
+## "Decryption failed (no vault secrets were found that could decrypt)"
+
+The vault password didn't resolve to anything that `ansible-vault` accepts. Check `.vaultctl/config.yml`:
+
+```yaml
+password:
+ env: VAULT_PASS # this env var must be set
+ file: ~/.ansible-vault-pass # this file must exist and be readable
+ cmd: pass show project/vault # this command must succeed
+```
+
+At least one source must produce the password. The chain is tried top to bottom — first non-empty result wins. The error message lists exactly which sources were tried.
+
+## "cue binary not found on PATH"
+
+Schema features (`validate`, `schema infer`, `schema sync`, schema-aware `set`) all need `cue`. Install from .
+
+When `cue` is missing, `vaultctl validate` still runs the cross-file consistency check. The other schema commands print a setup hint and exit.
+
+## `vaultctl init` Overwrote My Password Config
+
+`init` writes a fresh `.vaultctl/config.yml` with default password sources. If you re-run it on an existing project, the existing config is replaced. Pass `--force` to confirm the intent.
+
+To avoid the overwrite, edit `.vaultctl/config.yml` directly instead of re-running `init`.
+
+## `self-update` Says "Only Available for Standalone Binaries"
+
+You installed via `pip` or `uv tool install`, not the GitHub Releases binary. Update through the package manager:
+
+```bash
+uv tool install --force \
+ --from git+https://github.com/cdds-ab/vaultctl.git vaultctl
+```
+
+\clearpage
+
+# Command Reference
+
+A condensed alphabetical table. Run `vaultctl --help` for full option lists.
+
+| Command | Purpose |
+|---|---|
+| `vaultctl init` | New project or import an existing vault |
+| `vaultctl list [-f REGEX]` | List keys with descriptions; optional filter |
+| `vaultctl get KEY [--field F]` | Print a key's value (full or single field) |
+| `vaultctl set KEY [VALUE]` | Add/update a key (`--prompt`, `--file`, `--base64`) |
+| `vaultctl delete KEY` | Remove a key (`--force` skips confirmation) |
+| `vaultctl describe KEY` | Show metadata for a key |
+| `vaultctl restore KEY` | Swap current value with `_previous` backup |
+| `vaultctl edit` | Open vault in `$EDITOR` |
+| `vaultctl check` | Report expired or expiring keys |
+| `vaultctl search PATTERN` | Regex search across keys, values, metadata |
+| `vaultctl detect-types` | Auto-detect entry types (`--apply`, `--ai`) |
+| `vaultctl validate` | Run all schema and cross-file checks |
+| `vaultctl schema infer` | Generate a CUE schema baseline |
+| `vaultctl schema sync` | Detect drift; `--apply` to update baseline |
+| `vaultctl self-update` | Update standalone binary to latest release |
+| `vaultctl completion SHELL` | Print shell completion script |
+
+## Universal Flags
+
+`--config PATH`
+: Override config file discovery.
+
+`--vault-file PATH`
+: Override the vault path from config (one-shot override).
+
+`--version`
+: Print version and exit.
+
+`--help`
+: Print help for any command or subcommand.
+
+## Configuration Reference
+
+A complete `.vaultctl/config.yml`:
+
+```yaml
+vault_file: inventory/group_vars/all/vault.yml
+keys_file: inventory/group_vars/all/vault-keys.yml
+
+password:
+ env: VAULT_PASS
+ file: ~/.ansible-vault-pass
+ cmd: pass show project/vault
+
+ai:
+ endpoint: https://api.openai.com/v1/chat/completions
+ model: gpt-4o-mini
+ api_key_cmd: pass show openai/api-key
+ consent: true
+```
+
+All fields are optional except — pragmatically — at least one entry under `password`.
+
+## Where to Go Next
+
+For security architecture and trust boundaries, read `docs/SECURITY.md`. The `cdds-ab/vaultctl` repository on GitHub is where issues, releases, and source live. Contributions are welcome.
+
+\vfill
+\noindent\rule{\textwidth}{0.4pt}
+
+\noindent
+This manual was generated with `pandoc --pdf-engine=xelatex` from `docs/manual.md`. Rebuild with `bash docs/build_manual.sh` after editing.
diff --git a/docs/manual.pdf b/docs/manual.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..1412f52b88e99be86da736bf184f793901e5f470
GIT binary patch
literal 128815
zcma&NQ*>@ymo*&Q#*S^Yto#a1N?f+VTG6Y2jjVslF(oc$^<9)>KE$QUr8#{3QijS`p
zoPk;aq2ma;{s5c2?cS+s^f
z-XEnkiR?6bbq_y)p4E(v{b|i-KID0^>~7}F>X6V___k}z{NP24ew)gdS3DQ#vu?Z+
zY~%L=$#38Xe66PI3u9()`v1S#KTrR46l{$D=1iD4xY+*ZpZL^ZLTvPFMc`~97D4BOb>4TN9%
zG6_BjR!_y^iTPRfRK+=)MrWNQV5ufB^2BHm
zNEOl^c<_I|f@Rp(7V&HPrJY3Sv!?*FENW$e&`GShZz9t}iK%r=!rLoXtMdbt
zaz86kg!Yulty#S
zRvx0m2_&+pFFWB>063;Q~JvWS$}meH5z
zIB>+
zTf~MSmC;=KyAmWF={fR{0+)>^v1>2U<05R`D}-iYs6w%fVcI!sG{v+FSKJF6b<_ea
zmK7rJ-BZA3n(!fDz9tuhbzi*YD&I2N+K?Mlbb#7%Yv>FYg#j1h=RxhmDEW8`(S+7W
zl^d7b5a`*R@T9@diOIk?M!2WqGNHJ+@h4%y-p~5=c27ddIK=i%NDUczUFqJ9Udc1J
zN-FdM&%Csud^MpHL&bFmDCQUpjupaR9QZPz=!I?z*&?=RI0~gfC3|@|`p@a1aFMfw
zX-)X=Pm(IOA)s0JSpdv3e$fQF!;X1Tq>kq^l7!$F=V#K$YoiWMpcC;GTyEt%wVB?}
zSx6bqLBQ!@|Kgh;B=43Lc0ELHsC}@oSBCCJ%?u667GcW;7=xMs^(Vr^4Pl9U^96;N
zCP*u|*^U*^Qj^cM3t;2#egQ(>&sC4X^&8%vq)>T!;$T&y(1lXQ7ZVJki{fKoa@ord
z9tDk%jRbL}@X!vB!)0j_zo;BKePh)-&?t;C0iLluuVjMhHesrV
z!R%|3)b$S(5j5j+x>LyYZJ6xwb%5*-lLJ+HH1Qm<$_tPTMf8c?^t0u50n=KxhzUNN
z?D3_Wp}mE@GW9?)CD~4L2UW8QD^o{634|wi4U0)t8(pSz>qar-pRe$N66dzq6K=RE
znD%oe$R;m)ax>=+DcQxZaj&bFZ#A>M2K7!2k>g!A%~}y-u>GW#gk=2knCS*on)r-TzE3x~$)iS?pZD
zW)HhT@I=T~oH|7P<{d_ie(^N<8!cnu!ZJL%k<8feW#O6vWNewST3t#sDFU_l*mf?Y
z<%%Q?Hjze+ldV`IEp|9Dt-SQfeweF3?#9cfIeq8}aNGo`$mx?`a0}{3B65?N1J_7Y
zF`=e3m?w{Y!Hq`LF*ux{LY=oSYk;T4*3b)(aYGxctiS_r1P`Fzy#<%-*pyQPMY?d+
zA5Zh4OCF32FTB8JYoB6fULcEV6*s?(ylrl%k>yKz9u2$93bOx1~$#*c5dPo>!^P@1VeK#OZ@W+OPKBa8cNoyW30}blIMaSCkj-?Kz
zu7NA>|NTG!UE&JzzloHc?-4hDSKVv8)1zi&ZT?B
z{MWpK%DY2as=bzYkZ;cBh`U=2uv+aNN3Fg&#+yzxfW0vAm(8_tTOFYV3vx5^7^nR2
z=d@Ze%JF>E1EWnhL5dRL{sSUkNHuOo9@kzXJau>7vlCY+;-jglGAc4fr+y*kH>@YH
z18R>~?kN*q!R84VW2&Uk4JH-gn;}8C@%?PnzkSm0DPqxov5>gSUPT;Dr+S?JbnJJR
zZB#TGd-8H?y33rZm`jPuJH8z|wV
zw5j${6S1OVN*#_xD(w|vA47Cj!#K|$e5QJ>uXVG@sa8*2HC97yW7WKN;@*F)(t5zo
zL4TZk0S3I+34&9KQ80|~@A>HCSn4Ht<1AN=4(ZLf97L;}$M#
z3nDNWx@>tixSZ}iyNm=zS+GL^m53NeH^gEiZN5?xVYFgN;oI38Dr7VzS3Ky*kCrn)
zdr%Z_p0!iHu?)jO!6>{F6>39cuf!c@oh5bY6imG@UDz*fl3Es#qo~iQE_F`7DRF;F
zKr1ww&Cv__K`dl}EmvuN#>8<;#%FfHW2I%t$cAuqsZPXa2E(n9Ypp@9
zH#P0s&D=jXyQTAVkD^x+*|Jg-*SSX{IIGh~Y`gYH>$D_S=fORq$E}yB=TBwu{FcXw0XDPGD-mOoY)
z%i}$2PHy#yfA4cRbhkN_@A>-r9zAY*&B#t79xvwPDyfMmNc>HIEJthm5hCaGXtDjY
z=`q;Wpr4M$65A?t+~23yqI^8Qz=4=O{!$^T$`hCrn;wd~Az8JSVP|{V+Hbs`I4xV>
zH<%bGo#AhRc4L-GuN;a!)7G{E%+TB<>*O84m5k*UF#G5$)-p(PcQVD7i|*2xGtl$fE^
z(EPfI_~Wpv*8r8*Opj3zghGFAj}lI7U%9)vH8E3&`G;$xc|tlElQ(g_)Br%eg2{%j
z4Z29cyl}xYQ(qn)YlY>0{;l4k5-P|O+%IX-a4y?L83X@&;o`<{(ruR(<=N!CYH&XV
zWv8-R%aPbctf8RtT}5G)-y4vrF5_a{F|vlM;f3v#hl4jm{20-UV2N&GWGWwM#x~TJ2Wx;`%#Up%qV&0Mw76*6)8}9UOjG<94iT7
zT7rJBFUb(H|Hl;4q8s3^!wDO$>o($<*=g>DLtwvsa)GnNQ6}eAG@ZC!BuiaJI(eFT
zqZQ_Isl-Cdz{j)QYk}t#z-CJc%`Jv?ZLB?M*Es!}Moi`=z
z{T@`&rj>lNf#X^PHW7{VeVweiq3w>QnJ50;u5F!UDuHL%kIFB@T~0mXgw?)+M7V6k
zsRcn&lP$?@%n0zK!-B8UVKjyi9q)3)K0s5wkaPn|PKMPJri|pii3f>h7P4G#N}jjz
zuoMF77(@9@{#ce6opa8>Dd5OIslZ~sli+wNF}q-EKkrpYfl;X)l(8$D@f>Ag07k|K
zO#iksCz`&eSk{h!z&%4>RRkWHfQCY@Giipd>AZ1m?LeY=(L7_Mroau)oQ}JQ=jU9c$){yW
zpu$q1~ZrJP~qJA?TwHf&3!r~?_fY@QB7nBW1s#xcEYGQy$&IX4})
z6`6T-DTQyoC-av`%acRvd3c1BdMU4`6R4L&7t!t08ALJ1R!w7R=Jg+*Sxuu*kTF|l
zn^CNH&&4E@QlOFb7}yBeb7-Zx6*C*(*~yKnZSBz#!@%85DS=I#^q=-cQS6b-kD5XlKYJMwq#tX>1>jVvI6VzxGiC^087o~nahv@=A*Fv%=BU3Hp;cLr&
z0uW*X=D$ou;^9DVl#wnq)}$I6Ez>2O+G?CZTb+E>MwQra5|-N`S$+=REL?z3*&I@^
z%0eGRo`-o@PiC^UYNT+%K%9VlPwCPY=W;We=pQjya+yC`_z^gH$2Xr9y+Tl$t|_%u
znh--{feluwL)xDpXAigl+Yqt4r)#gqOjlxz??dY31$0O9bOQVa6**A!vNW?gf(zL#
z0mUcov~+`FMP{wKYwoyzRsFOFX4nF*Ez>UGZ3t15#SNFA1aj$J4
zgC&`Q@X|?j>V;PzE&4-}J1Lx#Mwo8P$mu(d)s4Jzk;eql+gN(tbOQ++U@u7@eFI@0
zi~(_p%aw|>Byd5b{2X9oAQMrMHASCZqb{Hs)!M~sIE!jU75+S8p~5w^Fr3DU*)1vc
zC98N!@~kzv(~x@q+u)t{
z&Xn~LU2$7P06_82-}6GtgQMFubEnx6Zm!4=JjUW`;JhLlo};m6p>4)u?=^Y$0I1f*`~F^ds0qcqOzg_hqtrZ?>nYAPDUpj
zRV9OjYYu0Dk+D7k9%fT?#<3@J~CH`;6Ec9V~=sMrwSEDJK~)Alv8
zlzq}UFsfjMQZp1ZG6FbTtAN3kNCoL9=P+_cSM?xMQ)$sf(D|{Dl@}+5wIxt}|71KJB=6_H`2umiPyy9MAWf
zcAgIEmRi2Yc@z-orbe&g#CIEOvV3L(I(t*wj@@F{9R<7NI3J#yqw#{n`#o1k2vups
z7fj;U4HDYa>xil7#c;~g`C{VnusDmx{NR}RB^^l9bcDR!=zYEMr$*uWz-}6IO1();
za5t4+K{h`B%Kf?wWp-St9~%A
z?=PZ^5B8QTHwST8GebX3`CBsR9
z&voagzF2g;@lZBNs*DnZqJb_F?LF}?<+Dg2^Aj+-(r|*?#Kl_)=vbIaV%2Jdwi-~zPV?ruhtO07g+~vc0>sV)i3lMea&8Gq|@+b
zwb&=@d8G4AF=wCtS1#i4!i)Ku=_4Jdok4HElXnLF1}gyvS@lEJ%vto`Wo~oFlae!G|;s
z>TcRj?WuC8Tw-^BeAYeRKCZ(O1(s&41gqRvxbfzxPMcmN>lwufss@o%a4!%2Dk7U(Ta>`mim8d+H5
z=G*`&n00RKj-f0Pkbtm$IYg5elis``w8aE;&FivtQ8IolK4tg=-+oejqyQ-3(sKBX
zCPgY1%+2Lgj2)xqWH_^~`-TJVTma5^pLK!T_z@<2ZexAkIJQS|0Ox=uq8d`Xne0GS^6zvS1D
z&c?ESt*$~@hs8da3tVa!(lm%*vMa4F>^Bu=gz;wjco`5Esou?wX&Um#hLV=$r
z`VX9IznO5*OZ{@GU8aSeeE0a&6yly11q9vJSr;teLbtDi=2^h**`J)5UUV({JB
z;e|E{sl2w`P@a7AAa2K3z=y=>ie!a=|}lo;yN>*uG+Yzp-73F_c$bVV1$!B)pU9UE)*j5+T$
z8>m>vZkPsAUVbp=lmUp^gA~GOE4TVYiC$qqH&jksxt3Ar7G3>ZlK9
z4hSmcxh{vM6T3<1FWt+PwJw?rW#>Y1i){y2>tW+-iD#^k@;yAUuD%!DzFcJ(k2`yN
zvX7=qO<_OwM=9Fm&lv;^tCAeDkI{|}EKO0K@i3biF`Z3f5)Q8oT#6S5yihvX=q0lD
zV)w+2v#XP)Qx_VauS5T0El(|Pv~E=3>xV3v?7lf)i3po0Cr&zTQC;Nm5o^;setCr0mmrNZ;{p|O^H35@VKiYtpKk^;Op`J^kHJQDVlh#6w7`7aDVtUR<+?qc}8v&&!6U|>8?CsepeX!{C
zhgjbrI+*oa$d?X>z$sHP`=DlEhigVL>xV(|7;|F!)
zI7rOmGTPMb!*Lvp7iCIw=ViUs^qXP5cj|RkWPE}L9P|sIV-=vBtk~uGjtg_EtDVwi
zG}854m616GdQj6&&S5aLebFj;y*Vt~lv3&RPv-!fjLb72n&h4*;UJ|83-bj9*4s=i
zk>8D$Q0^q@3i%o7SAt}VUgB6GpP?bikgDC0H)HCHriiL%=Qoy!vfC)jgE;DJ1__2%
zBp~$ILmn+t8D{WX2wayqF3z=T>B}Oyyzv0#ytbBB2fkTp8fWkxX?JR`9A@&^2yDAj
z`zGoRiJjhANmrN}-2G!khj*SK5*qvDrKQ}L6e+I*-qrlVxfl?+=rvbgydG)k!3hua
zYE`CHzc52`Dc#+&mZ_nEW(t`iF%@MO_yegW0%7Shqb_E8NoFsK4kFYd}h_=*Q(QetH(SV@FL@+J(7K!(Y)-81HAZIP^L
zCmWwsQ_A7#j8T^nw*k^74e{gGy5C{Jv_ti5Us~2VZl!36Q5%PLHZV18&)di@tEyr=
zLIrP^VSC9-p-CL`ko(Nf
zW745pR1p_;9>$bHO@HLuFF6-m;Jt3O!^bvX*2`AaUp%Egp+A(YzF3t!97olxC(6)0
zQ`b7!>1-~T&P}(Teh<}eJ5N{5PStw7G??Jva^M?v4P5n_FF*+4zT;rgZ%fCT`0kd-
zJTI(l%9>@Qi7{CdvP^A6tjVBGW#Phd@hxV78x`j)N_&A)wERZyAj{L6eG^#{EM
zh8^K~K_TRcoHbajw{E8teJFo6m|egjES$OglXs2du*tS<(M)Mvu4bP|(^@DGMSqp$
zsjesc?XM(VsQ)_Q#+v~K8gIfU8O2SC*y3YgnD~TKzQUk3vOpZ($_VM%c!Hn(m_0m6aI|&Rv7*-o7SYBz~xV*6N`
ziaEp8SB#vO;I&C?m|8#<1Dwm4KKH@--#Ba)lEljs^h%4nbP5j$jp?;Jq^D
z@SMe04$RHQ42>`>HxnJKUO$>jQ~i717HYMqP@UD)6Nj)v-H
z>l#|capwj0OYL%Uy4FM5)dBEI_GN0lnH|P0neGNaW@qh(IjAOj1Y~gCTLq7>3mQ`F@}RYoU&}!hgXQFg5SzTv4zh(e
zgXb6>zi}?uz08j{8{(NXH)!T=u&!E|HBFmfX*i4~K%cU$Om^|)8c$lo{3#7srJ*Sr
z9>j{yU-$#)3SS4(N7sxisPRhr=^@kxed+YCQ^i7}>Yoy+H@6YHXKcYq>CtkSacE>%
zOdAsg{Y7li>}s<)vKU!Hx0d+AHjonTurm1jM)}AA!dYhsW8c`~QNf1x^jJc2BViDn
za6M%4@0WP>eVa##82dWEG3B{`bsZ%RzHXqu9cVR?9b2V1#KYCh_s*+__oAPT$if4!F#sQD~E=Jkri&gvUbVa@#cbG22wtsTkI(42(yL>UHebP|u{shK>
z-nFy6F(yeSLRETXCL-Z5v~WX2XM0#@+B$HJ8;DJZhd)9;UHWpik_-CMEai6~5-Y~Q
z8@fFzQ6NSvf4u%ODpPkDQ+vZF+RZ{ePC(yYvra~R>Odn<;W@Q^8iC&4mTG>u$JuMv
z=%&ML6UrK$P;;_+YWrd#>h2eYPaJdzyIreAb9s34(GIAvY51#Fm3=DeagBfCld`~;
zR`F*j=cT2`Y)R97`>n(JYLj9&zLZx{;j*>4SL;BN=Mf^IBX-JOc3ZrF#H!*JrV&@)
zu>e|zDi!uUr>$xK2F>Y2lOx-mIG@@VWGm_JIqe6?Vo)dQe*-!f)4vhuo}%x@#Bw3%pUE#
zo&MgF2TC=p=}w(95Om)Gx;Fc+r&kHaJuRYXcCH`~MH=Zv5C32YHwpagbUHiDcGf*yA7|!oS!c(2@
z&t$wxvRV1L^3S~e3>TscD#FpF1!8NDZR00&Scjmb;|zyO;si6r8Z$x?A>K(W5_6Z;
z{{@&z^*5RPje}A*#@6PxkA)d(KBmOwqmGb=jq|DTon*sx!&S1hPOW9&m=+gHisHIp
z0TB{TKirM}9c5qhLx{1u7v{Cdr2CM_v4^BQ2ex{H3_C$+q?_dI8YA(nRyhQEw5BMX
zAwN-VMBf*e$!63BExDRC987@=(~qOhx?p|rJ^ay031G>d~~(Dv>rZw$X?d<#(nn6tjdMfEAg^S$r{+Z
zKotzxlafFeC79t{$Phglw}jn#>FYdarLvZ`pXM3-#+XwED?U}nOSXxrP?(9FKSTT#
zprZ|cxrqXbY#MO={D|1355x9U`M9nns;w
z@e8VN5zeV@+!b%CLi&-2mO{HNHRXjO^0v^fYZyx+&G&9p(2+x6ko79f#5eKK9ijh;r)@S?5+;|SH}>+AKQIuKAauNKNrG%eKEMW_UZe&1hE-fh99|6>MO
z|IG|CGchv%&mkPfnY2G-zuT#sLrkB{i#zT`!`7?55XTuMKTYbkv^v<8|M)&mz$QtwxgeYr9n*%r%Ad&K)
zT<@MPm!9taTT%VvrjsS8=B2F?_z8OoEWRXXbNNre0(WfWX5;)$nQxzF2lEyQ5D!zW
zL8yY@`gN>DcFRM7f43!*GctnI&cZD{+-emzQ=lR^z0y7cAtHa#FB_`j4d!k!Fa~e{)jq!-eE`GFU#khEl2FeBKb8fpQpGK4@
zBo9-_ZW%&lR&ZlVFZnbk!b&=zP4}~?t-Lw;4l-Oo!HA^UO!;NMw+e+
zK%r(QK8=U37~-6TYPhh}Fc;f5cZF5rC~rm>ZT!vi@G)9l32jYL&CF1nprCVMz%*ZN
zUpp1AUJV8ELCfe!TEExSUkSbe$0}2LuJ$W!2+5PkxBg)bD^Zbh%E?y3N<1EPMmSfPpwmvmTJK!SYGJ
zSz~l~j9q%3mE;@>-$+F+Z$7KxNyC#q4pvkoL=RRWII7et~l$XeBZKz>ao-?FXNJIwX?@1<9wM~jDd&agWypA>UO
zh{fa}D(!0?s0AkYXyfcUFImlCMJ~5+rn7qTzdLrzWvgNHMoy}kaqd>bg)K}tv3X_v
zrs?G~`dZ*bwkmwOAA6}-Gr*kbdSC}1CuY-Hb!~-^$IM0lu@oO?E?#8`LjWYpgz?^_
z5b`k>!+1~WS|&F!Ksm#1mRPJYqL*~fO?(er-RCEx?u3act7B;af0jvwp8HgsGDUdjH+nV
zU8U?BT{*(WG9_N5u37^o(5kvoS`%p73ujyxYQYZFjEIGORJ&?Y+m0Exxi-BzNGo{W
zN7Q+vXbvokM0TV#aO>WRZXotK{Jr+rc)+A$4|rd%2D|JK{yQv>qpoww_)6*)DH!P1d<7w2A!3{&!bY$6A^CwsB~5~5px&sBpz
z;fRRj%{=V{o87N@fxIB&jHF1#UAaCUWXdEPvFmsh29b7OL2Q}qVSRZX~1
zM4>BQ$4uJ2EbI-;B7dkm;j^hw;m3z|=$YJ=&V{J@B^=N?SvFYFFibnR8tk+sUHpC`
zBqwP_BO*AMj!;Riq;ucULx(sM*>}GG%gU1{BX9Kt*Htwga9hs)m2q0m?2tC8e^ICy
zlJx7eTl(gVvT75nbzM&b;tZAxlgqJ;u#NWOECt}m(|=vd0eVw+F+KeIJm-#DC}mCT
zw_#}N25pFrIZ}L1W>ng@GJYgK4}NaYFA-NO_NURUoY@>1l449AF%Z5*g;mHKb0%M(oq5p}&;*Md=BnV;C;$!Dznag)D~mE
zF0u#h$N>9}?VUz~g0f19mLs5c=AZ*jnIgk)+3#QsO1)FpDDG0}7Mey@Kf${fES^AE
zT6fGzps(6B-|=5*r95cGc~tVQ1K4d&(wbc$-knR%XN>lrJN<(dI3&x;VoCw{2+yg~CtY4|$=WtW2_1Lv{e<
zBqz}Emmt-nCvLew9zhpPvZ1#C^uiY(4(Y@l%emfHr$lvK1-wN?fQZp`?jv@
zJCT{V+zhmWA@^Zi_L}}BHg|YAd&xs?I(HhDlg|uZy`%Ct?3=8X!5W^fy6Uvi?Zole
zwyCsZ>o+-M@t3Qkss)5zmca!|$Zg*j;(-u3@&BPc{?%@mi}gS9oD_|oxJ^d5oli7B
z;Hu(pa4>9`X7En*F?H9mclsRer>`_+G^$DdQ|Ivh1iD1xzIe1@*&p)k06$JLo)S%2
z`o)Jd^4`VA)8)5gX5a5raxj(rJ=YF7%irU<5Gp}=^s{~Piuy=EiQ?slUU5hYKr=bM
z1@izv{4tW_bn
zL9U>H}gswHMR{f_tKW_u*jX?5)qY
z1R}gr@YO(%c8hQ8Mela>p9i0tMoST0*nttqmMMMuo}+}dv=DX+P^>eGW5`wSbl6$H|>&02Kr8-_T;SL+uBT6Cq9RvU7!~!
zvB7d}W}mGpC*cb2kVUb$DY0|mTfj>hXO<&&5?B)HalyZS}3r(#ZvBrD$}ZNa35RXoNxhg
zIc5SM!E=S0(5ZjX{~8)W*hx|bq8^j-X-?p||#kxRiNwd*%%
zDH^>KW>l`_-S{K+B31_T7xXdkVXE3R`DYFY)Nrxn9!ii~HhD^bP4*|LuRC%&9utom
zbp4Is=F%|#^CpwY34bblvih^P|qNl)UFt-mx%A+-T3lNZIAhG#;_yITK^JI_ch#Z0*nDI2>SuAxA%2HWUgEBd6
zP8#IAGyEyoaDQ_vND^cFJr-FaBA-b@Tz8m;m;&U?jeyZ`YA(oNKJf?>u$B)?YQ!RO45QKl(CL6SOahB=SU#>x_fEUjxW7u
zZpe%aKkO8PMbW?tbm#q(xXJO%7oD|q&gDCsmHFz;XV;fvs*;dL76k0h@NRFy*iud%`hW)g#oOy*N=iqVI^2+u|68yT+^eRH=EhcR1JsXUEN
zYqm4k7>At-i=%=bixSR|i$HZn$d@>qpu|~Cbxj2w)=7iZ5Zi=mL0$PfRLgjf3eL|0
zN(-P2ImLDe4d+9PcJ5MfUt8WHfHngmhY51zO%d%>gYDfTCT+ZT-T*gYodM*z0Ygg8
zgzjoXA@~8E9b^m&#Y-fwGS4dFQck%F@ROdc^Ygg5clDPfT5%carhb-f>R)c2XA6|
z@+A?~@QGF3MV9L$kFUDE^ZO{NYLFJd6|;NJ7h{Qu{_ZXAOpeK~Xg;~E6@u*Kr^R&V
z!JtT63kBBmE6he6*33u|(NU+#LigMSBzWR0$Rs`N^?;-vnpE*%;09
z3%N7B{h&IYSZXNUcxn61w}(+AazHv8wn>I=N?yssSZLV<)?z3Dlrzz}#c
zA&wRg4@GJBV_bVnYO+r4)V*a7u-8H0Yn?>I3sg+jnos6FP@M`Nob6Ug`Q?;Mo^)&K
zKiv(NQ&ny`;sCB=^=0aY!>(M55Bh6Clk4nOecSPPgpgBrNSZKh(p84>vBl`$dPEth
zL*g7+=Vn)2F@n0WZ`x#eVNn%z-g+w9t0DA3CTy!sU<~W=E?=Z0(tvgIe1B2Z~t+eAyIl75g9BbY7IxU`?jeGJ#dgdF}0R@b9
zUDvM4hj01}emeR1lzxAH0TH5Zm=H8tCf%Q1g1D0(+_(lftJ$A_ii&!}bH4MPkXVW<
zEX>-}t+CZG^TZ8X7+L(NKm@4HXAm4}iHF^LD;eFYV$D#W&I3e^kX8p|2}Lf!C(viI
zar(s?9?QtCl02hfZ_#x8M*LtI4z5K3pQBodcCOZs&zEmK)%BTn(DN0;^?eYT}
zGG?hF8V4qy>;mf5X9XMPRcPvO*qqOI4DRWsHU8qkYj)6q2a^Yv1xdR<;18HE&7>T;
zUV7Dh`m(|z`YL!bkPH5G6){WnA-R@j#^T>P+EM$UL*25?peI{T<{ZBP728l`Ye{K!
zogsb6*kTH^Z9N0uV9ctqNR+KvVVk%XK^C(`t^zB=ONpvPYd3cYuluKw$oQlO^M7&I
zzw4$jGyX?6Wm@C^-SBt*YbgTlFK
zR7-wq=Tkli2P!y243XH^OD2kX^w542&U5gXHHbf0v|tb%FDH&TlnY>Lh6KxxS&2A2
zp5;KVD@Oz3Qv={*lx<}xZ%~H@=H37?eZ4@co=5(@kyXe)1!&HZL$h`tSPhe{Hxuwp
zei+RfjP4FQjK&wB%9FG>rROsc3gH64tb79fjLtCKG@(!j*^5`WKN6&6P}pk{tz{~w
zwfnILX+U)kwN?O&mgMLMU&FQG$ciojr_~Z~ZZsm0PiULoJL#Ls=kJ
zs-D6KgXiee;<3nGuwEIaDK=>`b|e)|-e9AFWBw@Qd4L{k-AY@thn<*YwYLpzDHNcU?SI(GI3=i9@ifa`T_*
z(@kfwK!)Uupga0WaFq8(aG!k4_zX&ORp&`HQ7q_$VUuu==IZKi0vQ$0=JGS^$?$?~
z^{C9jwH1OeqhUV2)iO6J&(K2KC;UgWLb*sQJ(*Km$ynmR+8rfxx>#?sZ(4d;r>MLo
zZvt1t;aAePW7yYNH8F*m;3e|))x0!F(hyB<12U>Nm+@Nn=^MTn?XP3P#G2xi^$W-^
za~V&4;>go3;^qoa091T~o_IR%s7G+@k}(P^(qlqRD$mDu#3xrkwRZ>ASAw3BOY~z{
zoezyu%(~h~g~AK(I?%tVY!l0u-r7!{CNS(d3r_P@_-eqiGRB|a%szh0cpNR}QeN3P
z>>>%;ZE4%iq*(A+)8!!2v&At3`2PMJPMY3-ZNerAl)sSWW58O|P*sIAC~1QkWxHAq
zf2wT_t!lW=lBZg&D1n*Q-_eTsC%Z3;WJ(Hie^72Ay};hGu;xc_RXn*nE^RatT0o?w
zbP~)L%bnU}CHI%QX;N7m%|-8(tiA&D*wozKHKM$2u0lC|Wqv35md^INT&75gt8ugz
zR9J(qlx}2@_8nU;q4dvo4l?d66__Y+D|uQq$Bo+?a~EcUM?QFJKVP1ERSG{bXTJ4G
zWdhI8NP$+EkD(^h>dFpI=+-Q=g5I={gLkNO&~K5k$+wh!XHoHJUqeXbVGV0*xSf93
zmmju`H4T&$DeabdrAGXd^yZ}0IjgsNWyeTwaETPm+cx;k{WWhAm6tKi5dL1}CKKF^
zDqU@GVs`5K)85r+$C0|_w=%=<^1LomMH%bzxehvc6s
z4VAx0{v)v2hOZJ|N;Tdm%4>d7RzK@A>Bb{%$I%^EZjcAUKVc0!M8d5+%ON`mBR5?(
zLh7YHV-gE+G^$#($7@x!5)$!Cr7^F9+tkDV{}}tH?##k1S{SV)6(<$jwr$(CDzYNC#UxQF3w)9t&8;w=FM#V>0@+^j*c((z>|f#j-8fBJUD%iP8qox%B0%G
zwz@4mD8uIrN8_nsMIl*-tNVBWxgPH`TBLjLO%@BqnPY3{*+;iN9yoHm&8YyjF4^B<
z#kT7?NIl;-tTK3L*#8E8tpA%{!1SNQ9djb)fc?5#Zx1g_bWw|6J`}VCYjuPAyk%90
zGJDee&(@Ex`nf=OLbh@-C6j3DL=1Hz@(yzIr?!6lD;#Pq>P-QJJ;zTt$j;sS!SPpa
z?S$>lKNALf>E*r0|1n`?9>L#UKi$6{^oU{jo~8yS-;)=oC}!XnKe@5FEqT6uImpva
zjT6Of&xc9wbnXTJn#8z)n9kAretEw+(yJxn@BpGHi0T~!G8VoK#xB<(=x+lqgAXdR
z5;Qg>xr&&{?{+?;!JaT9#h-$*W{&13J!!RNMc6G+4F46UDtuU8)duMi;za`uE*{xO
z#c-mT4>M7xD{PGg@0S|L%1J|VcU4VG_E79|{dTerjgr4$rw5_+8Xqly^ovBrP<3EO
z{Z17%HC~xx|7X}NW_ERa_S+dToKnwtmDp9!lzy|2yde(p>{S&K=T~q|FiSlxAfn71
zokv4$n?-Y41Kjk5(uhovb6~Zm0l356wDf~
z?Y=DI$=K=6i-1bmNKfT7{oo#SpFs=7fu3)#EIgTcG^{9*!IEXSqL0sT$x5Kj#R=o{
z#<$xR=G(*Qc;-kyE*8^vHz=qL9V=L6%$&jihPsD#!ujnB;V@cTypVDqPpcG;s7GA1
z7bPU9s0mS^oeP`U;&?a1Fqg2;Jl`ox!VfPO=to5HSCAM1c9OlIr_`_opi)j7pTv68
z&(xj}>SQa*2TfK#$U#5xBZ9DE7}6miW~kC}Pj)$;iDQz?o>hu@Lk3^WYUI?fOiV!}`&t%EGnH&YEA
zc!r?x03L7BQX(3a-1BoS)-sR@qOY_0VI4U+&7AC3&~ckt3tns6EOL-5-RK8zG*fAj
zl$KLk?Ze_=;|hMMTVH{4j)Lvx-g(-*KfztlRq;_g)kgTlXzBwY`b&sHZ=O`uq}c?`
zWHrq)%Bh9G$$A-gY0nT7Hnf3KnYD*)V@c0b#=v2-JQsQzDbZy)x+yYLkV-1jT7fJ~
zQq8R4e0pRR<$PFNIV5pLQoG;N4%Wi$rAvQ;4n20Y5wo_WSOS?vPh7^|#4bOMKZ$7M
zrr*SN=bxzn1`WgC~U{A
zXGg8bSS+LRNmZ_J4qM9W7atuSskHVetIzxaO(+ItR4uk76aJQ`v?-e=b>s=II!r9d
z-2@z`Nwwya(e0lig|v&hh_=(#E&ELlf|=Wv-t^6x#Jj~1qp$TR9-$mn`A{Mxvtph=
zEiQziIA85YQ<+hV1;pJ+tR(VwmN(_&c7qBn4ZRsB#m1U>v#c0bo~0)Xe)R*jpRB3#
z=+rXntLqP1SArAkbLJymg69Z%RS%ET6#bF&M
z9@qcSs<${-Ti}Sd?2^Vv4ZUhnJ1|YdDqFKcRzH^oA5S!oulKoSdTj^c&uuAsG<1xz
zQ-O~)(R?KAxrzmd#C1Xuo#E*$lx
z9?@wNzi0P{i$Xr1ti5b`V>_TG&`#3#mz!R}-b5i~QtRt*h5o?afY2-Msi{mGwg-M~
z=&0l?fqFBgmB%#ycl@Z}(DRYze9R``#sF4u
z7%GjNUy~vwBBHL)zAvZDQjO6=@5`?Rg2U@BfY5rLb;BJA^PQzB>9)?Isf&Y*d4!uP
zehrKQzGs{)EQxfmDyWXB!;*sTGsXFK!lxR9eM!#VhmK!+41Pizj?iTd{h6e=9Nn)cajoeHEJHRw2Iz?mE%l%#Yp&6l!kov$rj0s8PflRV9Gb0GbLW~
zwIfXBnHGjO6XWQLb|@JW467^VTj_d5eefF|dr<*O=cz46mykN$${#TokHh}MpY+&qS$p9>nLKZxs3zRTD!JX-=eupKy}Zw
z5{6N!4CYvb&eGI&(Ux2zf|YtiZe){g)dp5+emdnbY*tp9i4w4??YTkqi{u7_OG#K2
zeU*MpggX+BBCp=)8(O;KYU3AWh+s`9UCS5@azXm;`<{jV)GL(A~c9U}?4xE5p
z6$SnK#Nda~?AX9u6H^nD6Z|od&E=aUb`a78=1~39fzpO_P+w_qTe#$Z_me`mmx05p
zLR))*5m*mO!SE)Ia`Aej%FJ*9FPu;6gXt4rFPNU{z$f317dUmV-vf1S?>aBv*s;Z{_`uD}?S`Asrz#KiV#M$5qmh$VkPpKq5R`7%p1v~b4k46r;TtzZ@lUkIGw-G)
z7H8V1Xm!#3(k26?D~O=tfUZs(e*1d+@SRXp$Dv=sIW|bfhs4dcV+Rb3U%*HW3NN`t
zlEiDhTYU)@v3cCeSSPRa8+>g>gdwBeu%Y5Bek7t>_9{jh+q6T$bCm1we8+OIk6THI
zHxD}jQWhaE`(^qHOQ%$&4rf|Vt)wVfKgE^C)3@RA@Xo>HStHab*i=}W%
zGb4fKe6WQd*IgDU`9`c_)GZ2Axv7>A{|p?M#%;vECMm;?*q6K#NFr;&zEq~Zle%m6
zAjoh<^J=n6^yKFX!eQ;BDl-i#7UVS{mABVh6p+-~G#xHImC?Xxrj=Q~ge03T?<*R8se=u?5{?dvE
z&T+w6!wv~QK72TqS!4JdKRQm>{Mnf|O7~#1-fKLgQ5pS0O%zo1Q5gonL_9XqN;Okj
zb~$G6Ie($n2uM?uHBfUuJG;goLENS7Ct*pjQC9&!QS6ulxFPo
z75(YfO=OZ$`!=ixJoLFN^g}|Lb8W`*bcbGs%7SOEprbb|fB`XK+-g&T%GxY%r=+dcsXIJ!(nE83xg`Kr-kDk+(y@Wc1zV}!
znbA$#SKG0h^P67{7q0C4G&eodzM;KL7eu`^?cGVyZXay@5($lF1YVh#zl#)P(Q_bHgB<=ra~Pb=#!ftCsk%b(XP={`Ny16h#Pv)EuA
zxAc+VF>{oJBYRH!eUWC&Y~&YG@7OvIPpQ7Y8Zm#1{TIk*VEkVopOJz2Kf0KjHK$_!
zFXU4kgI0+z^66jZ^CRW8B70JK+cSAZ7T{rSJss3f^{icqgyZR*NPPb_11=KnX1
zx+rEmcJ3h+4Jw%1p=#$u)3M?%K=7)0O~1b0Z@u4d0rQ?8<*x9h^683+J{A;(F;Y&4
z0TTt#MOk&?^5Hb-_s5%DT-=W{C#Fdfu`=X^LuMtbWi?Yy<=oaM^AvGSo!)bS13qh-
zwp*WK%;s(K?c#gLG(QReeu%+*3F^qzMK7f~_v{KMYzrCG%kpyBFO9~7!s`USCuC-b
zT&;7GhHXU&FpWXtsFEfs63RiS%fgC5cL#d_lX&4SY&%|SWC{NKRUsA0@4*90NHN5y
z3$b}dNK_h03v7S>3x2`u3vde}m8*uBlI%uURnY7(IHm9FCOZnru}0z~FE0__4~08T
z63Q#Rh*PAcU}b5<)5dHtM4g1C*zCxDXjZX
zFja9l^d~b@4Hn*|1Z!dlvz*lD7t`}&CP-PK22XsnPEaAh1
z_HopZH%=r#2YGETNXKzP_4?6XT{VDymY$uVno#G^Tq
zt7bSc9S@nruGO+s42`J&jjG<*E}A^wqUlh&+`M&wA9g02z-W3O2sftOxpa1xtPG*g
zU-T&ii^9}BmqUNzr)W0P=&ibqN@uhdi94?M2T}T-Y*QkXNG~qB!VJN~a1c)SY@Ufp
z*4ePfbzhE&p7miqKv{v;$jbKd7}su>eb=6Xhg58ya0(u<;~
zr1l_4|Fvc$qn|H&IoV{|Rx5l%nXC1l9!2k|J~PdxKW+|y><4o-#9L$S#|%66qQbZ~
zp`RW97*7OdyF5;K_9hyh#vxWrQwJxAbrx0o+Ql^Jh5gW8*54vrGSyB|`lFC!XnIi^
z8bQLifwaxo)xmjm+(
z5Vz=XxiN{g+k8tG(j8OE)>(wkM$BvE;PXl}M1tw4n8lt4C8aUyDJIP8+l+Nd@fRml
zbxd};<}ZYU84tL>{x(%>EoJv~+-o1<0Eg}=L-_g6fS@QyXlL_%&b!-T0fzl^Qy~U6
z^4@ypG%fIQoBI5bv%$Z(h6;sCN7Y4j)UuBOM)Iu|mU4zL7RA%dC4NKW^u5#lvLgP*
z_e5@?KK>9yKoZNS^O#hzkFpl>#xjEs#Vi%<6>BS5P$~#CzT(RUiZoG--?!wta6dm!
z){L)rljC?3eGs6SeDb`CAw#R=)MeVtba<&p059L;DeaWNh79UJ1PIq_bza-`w)v)T
zR}zgQVmqxSh^orpB`1^n^!EzR+?w(C=qv_P=}u2qS5wis&M2~lY%0!yjM|a0B*=mE
z^WTV&(v-i+qGo|i6AHflbOW!&=FvT-x9^J+ziEcf7Z%(
zvv?O28;w~?^`IRgMp8w8wmZVCRyI;3!O$oz@{{zE0j?b_fx~UhgG11P&5mFRf`#+5
zmdRnxdcGbX;c0hu95&MYLXaqU@NRT_8Llae-Fs!9;n(o0iT&l^WnN9c`)NUnl|3|T
zpv1*YRtsO+Dnf0YM?-8fy04m#y8DsPr+y2+T{D3j2Pvj=j3dfcAQ%NN6Uc_~HN`mV
zimk)j(yJMw`%f&u^B+
zx>RsA)wrI%Ku68jMJD^S_q~;?kzAMbT9W~){UU~`Eha<9NXDk;PYsB+8#-zjn4{eQ
z`;KhE`6gm<#~=Ie`d>w3Dyo~;zNO-u>}o=f(z^FH;atIoZK1crRRnL%f)1N?a_F@szArH+P3lGzF0GkAZ8l$jb3Mdg)EO~zFz0wifMMdcMZ-i
zmUVq~ez^DMuo*bX$;A^uv;#=MXIK}l8y_z3-P)qe>g&ES31jJDm>=!XB^&Ed%(Z)b
zx7?dKtw-H~7-L*9>uOy+$h@sNw^ffCaE=L{Qh&wgt>_9XWs00gO-o{Jc>P@Y`h=fg
z|2LY#^1sj&21a)F|JP+-t@i&;riw|-z%Y1F%s?Je^{oZq8RX$jFy@;z7NA_KHWT3J>Ar~yd$7h60Cjq4tlQzz4&`a%ku+cYm|JMYU6kVbxPb)Wa1oO<=CP;N8aM0`FW6}REu
zqRKlz3nX(n_Ec`PlO2x@u!6Z1+6Qh3_{fsJ8fyrHXABQ~@E+OG-e~VXjviMgZYFH$
zZ1)@c#!RyW1t-~Ydi{uWRS)P<@)*UJ8}kP%+)>4;R~zx60Qa{12o`S@OgWDh5!0lk
zdt?WZVqJqRZYGlH6omq&DE&89giKxuYtogI;z5U9D(C`ECe8jBsDV~yF!Jg2^)E*V
z(FNBml9}F&2%$?Mo=C1`_rl(Mb2;FW;HP}NBnf@Uv(#Q9KEE@F^N9&^
zgdxhlWjDni7m%Uq#VG3Zza^tja<2eVi3`m={C8f>Ulm^@xs>Rc75ysX`0d9bFOg$s
zbsk*u;V3Ba7DvcVe){Zl0BqQks(fX)zP!+Skv|aSfT(Jt8mY;?eb#3v3uT3c7stL|
z@h0JU=8`AUd*D#@zarS4Y~(+@T2*dj>w@@61>nvk7H{PHmiQ%~`YHFXdB!6VMa-03
z?C$f3RhTGsDk*iNp@rn%5n0D`DOD2lWA;8o$Y6zzsAFvAcc6n+r>YPTJC3R-%@Nl*}jN)R)h>20d$dz36T
z6G%4(v;kLln+9L(zOgIgnjJ4&sYZ)(Ov#9JT)5dHv4WOZTccYca#At^P|13U1-kGI
zjFb(c#@L}Y6i7r34QE;JDulME;8d*=V=TVs3tKUYL2w=_mFYb+m$WbZL^BO)`tlh_
zWU)fpukGBYK~`2nMl*utBSN0X(vLc}|8lGOf!uGe6J~`@X|&f3AH3TfeZ>-uQ15SA
zP*)`;EcAA^1Z`1FUNO3@Cbg28&SWEMli~Q%FpJj0st+`-9{=F!k!JFBfBimsIqJQ_
z#c_q7u!n?p|K8{S*0m?Se~$gXf$peNI58)uPYmRoQ+eCiaiN)|cxaB)`Sp@wQ_<}N
z5z0f-sM*X>`}XQy#YRW*J^6r=HwK5nDll~kM&M|0R(OY;lfjP2jOAfzCC*-DuezW9
zpPS-5c7LQT`RptH=(wDnW9CyN~rQQIV9ZmDVG0KeuG>R
zgiyMY=}F5yo3Ac38MxO#kv_mdS#tCnaG-<
zdzg~kIXB?EFa!Emu2Yz1_tu3Sh9JNBFqRz2Tj@wnt?6(^_EbB5x0!~3#~acmnox0e
zZCSl7I~S5ExBrzAsoYR}y6)_nXGZ?C-{AjbN2wWrfoMwR^m=&11Q;qs7h+@Z>E${x|h~{|HfpCy`G@;n;Qv?7CIQzoNdyH+tzU67J<{
z2IvOJ5tbN#funZ!p4<%F=;@`%U;Hd@M<@=1&ikwt?s#4r&Z%CFHJ>b6n5iXa%&E$!>
zp}=+id)X+x++f*73)S7gF<3)8;3AO@)+NS^G{qJqBN5$tqhv_KBD-Y#9UV~
z@ohM>;`{{bv`nBx603w<6i=qmSd-gQKcQ1}`hk?FFmLgMa7DGqeZC7QWh7a7Tzd$f
z
zlIu)Cx@+Gt*r3SeAyG34W!Pg1sYnv&wJe3;!90DL%2-mypl~i`s#_XNNwAeN9}4Tt
zc-$%pnAb+xo$SheEg|_l^^cphho3us=EKj=YeVDf^XT-=#28fZ6!4vX(2{vQEo5na
zj+;S|=621*#r+e)_U5_J@3^IA(D}Z2m22WQi)`18Yj1~{rK)k9W{8OEqT`iK0}gs*
zvKg|A%_I}MBm8i7^YS41fNlrLYV2o}8A86>pdpI;hA>2F(3EQ~#pW!Zc=<+Ttmo?%
zg?Mnlq`R+}Og8$CO=$Kmneji1@((8L-)-)YLt>o~)}p^sLHQUt|J_IR*s&#>fi9j#YkW|Q>E^~3I!
znH}-JJGLaz?aDv5lUI8qxhU8@VuZ0c59e=ofRmBB&R5dOtCDLV@mo_ke^|`4%Pr1w
ztziW>xz>r>Bq&46c!(s>`UCyS99F@F2d6kw9^IqfTLxNs`okp8F2Q;S6KXC{1R}2n
z_{83r8U**yN%8pehRB8ZohZ|vev?m{MFzRk3Ua$$Po;QpqPF>cdKDZVEBO5tobY=D
z^d(hq6v@+8Ft5%~#HXJ)`Hf31FY3I&TXaQaKahh@boPo#h$`eOo6fiGb&l8#an+?I
z>k6A(FZTU+lqB%wFO@SeE*@uB*3X`@@*;bfLRwon|@
zJ1&gVEs2&3v{0sg770&0{-pLB7P)U_?H==vHe$GlWmsfC)mSZprlf=sBF#!!!
zZ8c8hyw3q?>@4+E(~1O`E*sD$rMdCo?q=o_MM^@RLy$zBw`IwZsCmB4xKW0&u-yh#`p)0h8rBLh-Q^
zr47gMIrHvzq6lQ@CL$)4!KK5oLsS2Zob~!I1qE&p!ZcM2R#0Bo-HY}y>h2&1gFb;%
z6rVVk7QYVKv=ns1EZ11G%`jE7meaN$n|pByZo*!BX9Dm$KOjX_)|NPp4gbQxP}zD4
z1_S}CODncq##WoQUoiKA~D_YUekXeO>V(~;cIO0;!g1SiSD}DGZL0Omc_Ma
zyyUX2AQgZ{(O?l!LiW9sJ*fwjxgYvbiP?Ht_~ep3f-Bp|o?fKO7_~NjUc~`4#8?4I
zKp*kat@-`i{7}|hQ35{G?2^4EtnmR*>}>vBxO%MBNb8kvJ8-abd#}iv>%Y+M4x@u2
z{Glw}yK+03{R9$A5*5>VP!ebJ{d*Xd_{(p)h%h%s>4(Zs=rl#Ca5`H*>^=E`>gT&h
za6gS`(PCE*;D=U;kcF;%)=22E9#cvPc7x>zWAvDJyk<6B>R!q{>5_X9r>*NA1;)~_
zz`*IN;Hp=^x4=b+I393c?h+N-#WvNr)hTm(1{5A^t*_a2p_d-y+5Hw-QV|gCM8IU|K)XN
z{GVd|j7F
zhAFKFLe^>`LHzDL{{HACvfb>JDbB{@L)(?C7`F%`};#ARcm$~-EHaV=?T->Yi?bn+S;3UckC9UyBXJ{X=O$IJnLnp
zOz*u7+IjoJcl#SsSf)(bu)alsMZtYn-8I1b0$^;h@bleryeTnVD@tO$OG0G|ZT(o&
zywmgtQrCY*e{bxG>7Jo}FHq9OP61944{j2C10I;rYV?pHOwXt&k
zdR|%a{_QelFAx*Bn|8)bw3cw?>6v)aY-Zd?TQgj~s}R`E0FwC0
zMQzz~2oke+#D-~2*uXvV&=F)bp%?~#wXTGa>kgfDbt5lFHpsZdKtNL==prd*+0}6UsSNesRowK
z74^wm!65Pm+ni?i^-s%lpyirj0DwhWC=Ek_FY0JJ!}O24QAaGePS{jPesz=tZKBM&
zF5($Bt&vdt{t~ebUA?=6960wIqq;fudl#LNtCav{b>`rHHrGWowC#C6sO{0CI(CH!;gm{im?`0E^-Y
z2!U7<%_gB0tyt3=B|7#kFoW>Hukuf|5v^Z5Nfq@PB512F>$rX7dW>W+e`4X>F(LQd
z_dF`4N%s|g{BN7ayWoF!I`B?|)9ez%<8fNO3a{QmD*W31t7~iU0Rk7={+l4s+Wizq
zWoI&LSC9yNGZhSNSDa;}@sj>2Tih5DiTZTVh|C_CLB)|DD$6Wzlq1Wiv}m{ywFNc9
zv1&G?UKjF3pg!|7Do=ir4=$2tX@>)*-&(e^+$tOnsk&1yaZy2KBUi#i|~fH
zf!i=NyNvuY*yb4a>2h-cpS2D%2y}QkD>G_s*-TzvDpx}53a5TceK;+`kvI>Es1_U%
z0VoM9d@zO(b#^mO^d1A5w4Sg|6NASwDK0WfSvuH=e3Um(c#30piCNAZor#&g0ih`w
z=HoN1-XAU$0u<5sdDW-oPNO$V#YsIxpf?oC0Y6w^n&4liHq?;W8*?pqlE0u6R&1DB
zB#z-RTPB(Vh)K
zqYMPB@zdG>45CcmU08S1#FEf7aXuIbXqfHnHc(oGAy(y0=Qnc6`BkjMv}VR!P_r|x
zc6Po-%?EZqHvUCr<2WfQi%OgTyDE9LpnF#aT7@FLk96_?!TzT465&k11-sEbHkZ`XwEk+(`GbIA9W#OMbjM=K$iFfW3WK^uo5L)8$!
zT*vIOwmYHT0f3!IGR2JU-kc5r`2!$yPh@SBMDsf*&NBQWXfRXNafSCf5XH1qNbrD(
z^DL>86lUfQM`C%N_)W*m4B&D)ty@OXz#=}0WMoZsag>u)jKe4#Hg#@m=8kdF+~xW#
zU9vCA7*D39dP`Psa>7=K%NLk(jOB7|K%LrEocQp?T-hpL(6@o(9vWA@0eq_W(N%qc
zpCPiT=)eQ=WJ`9zGx-98RD#jb7ReQ^S+?eIo^st7Z(ZECA_0cef$-Xk(3D=E;Z?cz
zj*}_uN6`NVyk_0_KzP387U?S6NQK9H!m$JU&{g}W2dO9H%UaX;6p3Z@mg|!LNxKgf
z03x&et~$l5gNNKB)D5$;`k~f7?T5dRch4))>B#-G8^Rsh@-)v0=+2U&#HqahprsV}
zc6dMPxQ1eJy0y0da$VvlXMu~6tL2yIbn#vFB1+L`7_PH
zuMR>!+41F1BY+UVBjTct#Nn%*uC_Q1a58iLfy}?w*8@^~$5#d!J_U7KTd&YQ0a+Db
ziogeUq%S0bX?T}HA7q)T08~dbtp6b)Y|BiX+T=Gm6+sc_l9Fq1A$Ev|FI9cWdX=3J
z2}z<#^GvX!fDtxm!Pz{#@7+-C!pSSKn*7*~$={Cost}oPbF@i13N)nxLP=c*o}Yff
zpJ8@Ccb;c)gDCI`-KAmzqf;F130;yyWAuS&J4V!g8WND{0Gq>`$cc@m3?0$Q)uCy+
zEss;SHwdb+=8TJ<3^|+qHa6ukZ{t)6XLQea>pthW>ZSCg_50n+TYU1{F0Z}dC8{?H
zdfbSLWVt}HY;N!sL*~|dCO;GW_&fvR?iTijlgu`~tiWyL))=By4XJj?uexRzvwsfQ
zQ;O}H`7_8<_3tEMg%1f(W-``F;#b41Po9Lq*i}5KgEX2;hUi=WOf2fbEv9=4ZPzV|
zXujz3oww^3Zu={
z>N|~EkffvXC}2l36;*nb}IG
zKA>*@VBL8gIOJ~EN;o-~*596(K8Y`fi%Cswg|3b}9-co~-grAogFndbIx^T)e|s$4
zZzDJD6F~~9-Jh!&cM04d%&~sB(EA1tW)NuqZ%pccD`#P5{SS3}NmDA8s2#TZL~RkT
zPW1*{|B-;-#eb9aR4Xn}XKP#O57*BRyd)usB+15Ax>0>!uVJesB1OdKYsJ-zj5XqS
zIn61}EAij;XWxNdy4$y_>wonMt+_s`nJN9AS1m6aE{cK}9od9l;Ei3rpAXavp}t%k
z6f^(FZN0H)Sk!cPRpgDkMDPPz_-f7bJaRY*wpq9MHfYEB8OKmu2CgGPBG(c>(z<$
zkU|}ON3b&ro<%9+6OnXyVKs!T$x*jOiZqH&w~24oJ#$9fu?UFJ2}VelXJXlHnZW4$
zG^cL~5xkK{IX+w)r&{vB;2*kk65@);{DCno@o_>!iH_TdXrpCti)%`OZoIU3<9(UV
z%C^_2EiP&Q75x%BoHIYz7Z$Z
z2usl&Hiez~>hGgb4gXveI18_p-CG@W90u114PCgaO;FAh7)&uc?z$H;TQ%wkv@+gr
zYYAAvPeEdWYJ)UnDS-Y4aU5phpE2M$lXqJ7Ne%T
z`K%Kh3QG?>X)AHID&-9{`x!A;^a1G+xwWr0y@kLdZGCOY0k#QUznys-7a0|wt6c>a
zH`BM~LC=`ZoT|wUtlifGrX_V~+QMUm{$F?hEN&BjZ#Qh|CO>gzLHfC8F%N!S
zByLj+WB=LjR-gL%XIa?r@eXDU^=x$@<#Y>Mo{sfQjL{?Nu35~Zs
zd>ZauBaO$G&1Fx{aa5YZ;pmm789S;Y>DDu46P;Zm3;+*OZJ)#u{
z23`6yq1ki`Gv{CH5yd1d`>%;3?aIVD0{Qi6L-&E?8Cqo)vB_bcN5-yRn2&TOIDGn8
zhLroX`%PLSf5%a2q6g=wm?81Cw>Y_kZJ65O#RcSw_~6`bPr;)7lYgsCDh;~(*F0?<
z*S$C38u#%p#sHg3a{XO-c8f8tT8R=5Z(~&hOce@x(u%&`7~7WP(IlE!7KZVvOsbu?
zg^C#K8te-WUu9-n0*9r%UgW9DPn2)8xy~mEGwbiqRUXFiLZyx{@t#QK*?w^E*rbgc
z_r;seSPXzw$(2#fOj>(dOChgXn*n4k>?b6@EKN^YzWhnhv3KP1;5n|D;97fX-rg^(
zz`@;~3WCjh3^zPX38vJ`Hr2wF{*xhfZbI&4>JuaJ+59~a}>
zGos=1b0}$KihCfe9>VMBcj(
zhu(^hY(|n!l{{xsNO&a9hpz`8Z}-!Fx4H`EYMZ01K#yqewe~caVGMsHpdvD!;>ku4
zDP?QP>VtucFb&v*%-}?`NA*|>xg6GCD0Yx}V{S=!Ux{!znZWG~I>_^CpoR6kt|Wd&
zK@0})e$G77=2P9Pe{{Pvp{>u&sxg?d3ugxkx{6A+P)6{J83@}sa_bhqwl(%Eb!W+Q
zwQ3`n&z}oK@0LXTiYW}#CDH^3{XnM;6`E3bw1f<)2YqFz{4orSZVG7QTW8Z9d5U!fAY0PCxA8@kTJDwl
z&b2ApNRf_r9Yzihsi7t9tK9T~w)f8HV`OQoQX&#q7%vNEtO8WJt;63rA!4XUM1Tzy
zgXp8KFS}A1Eg;b@vdVGrH#+waKOiXXg56gDH;L@~d(%qCaU8moJ`9-1n?_7sTiTk>
zOO?G9Fr{Zg10yi3|Lie5-QR`FoS(BApK4m+Er&*QCV$#0M0SOeVMofuJRY5?U?x~-
zpG(4F4V^?DD_i!X$8LK!M>HB&i1G60v-m6N+%EjPF*>@;HM{GH
z0wL{Vat>By$&c~?DgTmG`=qc}?%>xtQe?(FzFKkE3dMSl0x$btSzm<a97pv3
z4dWL%&w0oJgw!RJ`W(s0~#f8;!hJKaIAI5vrr0>_EA
zNKg@;XIsfUsd4=P^4I>iq&Aqx$j$J)t5ntrDQMQISG;&?msjB-&QnQ~)Yq^>hONsf|-$~ISURXM?C0USWh^5>{E#mkmVNR^4&C}}<
zSb*S(DirS{9hLXhnJj=)G@p-RvE}sQOG6{8J9MiDhrSsX^k4-E-}7i%d)&?Yz9YfL
zc?WA=E$j^JQ$UODy$n+F9X)H#+BXXf9IaLZqW60c+pKI!)4YWzW%GH%N04gYJJD4c
zFMz74Pu#Iy>OmpOIQw_0Q9TZcabZ=jf3ib>JUILvK^c7sd|-f|FdVX*yagK
zOQXAvJ?HrfnLkSzpm{ffXEvPm+m-rLx}5FfPJat;iRG|4;{Rp;c}&LiDqw=xiD;jo
z-J7oB0e7|E#FH<;=FR)AV!y?K%Q?XvBi44|oy6=F^3xT_6pT-V%U*(fl96|DbWR^m
zlrT_9!Apty5l$G%3NQq_^D#Pq$UiA&FPLWwZ`Y@prjuO5(}f3O35!3hbFNF_tv@cj
zkH?Irktb_M+`~3
zt6bLK0I_%ofx}h12YTf>$CG~(Bk<3grCjNf>j{&8d_Vq=;CB_1y^{(;Zio|+S$I!D
zv)gzNfgoTA1T(R5;h@vK?Z~#$62|^ILnu!nw^5qR21dzLo*g$1w0v8x=6&P&1E~7;
zRP&@p=|8r}|KS?_5mKcm5Q9kx99T!gZk(^2{KOB>Rwx^OV)2#Rm)yQNcP!{m^^=-+
zj#-wvht>My)$9A`K+t@FJxvwhmpMLc(sL|e$O-8|SvE~G)})eewmrgd^ASF8V$KUWrt0Ur;3g!+vg#gGa?{&>RC
z@=Pfh&53Reh~{`g$8Aw=rrv?-r{@0M&;Mlyo)A;u>)%&t&0=FK;a-czBNScMEB6pH
z=p?Gi3UxNpZtjr4SLI^{P%4$R;mmXkx?_BATy8!(sM~F8p68nQrokD?>X-4f?&*tF
zFx{y%uU+b_m9g?#5z8bc>Bu2X&p!*8LOEz6Kbq-kOx&7mN#vetOsXJ)z`{8@I3@cy
zoN=Yp+(ZzMEIqqa*{{7+=HeXK#D##AB}&Q2Hp1(Cs*3&Ctwy=YgyX-byp#r~)szKy
zd#7mH6;Xru+rQTKH*;9-@nXTKubpg^MKl*UcKd3g)bpA$kxj$E$?gq9SejUrs&j^G
zy8AEw($fs!MV<`P6V|W=%3&R5ZdHJNYCg-d^x?sTFt66L)h(!QPUHh?UZ04J%qiX5
z_+}kF+2^!*$^GrT&eQmLEcf|UT9yRMRCJ;GOu!z7sif}Der2h@tg?x&}sR_;~qSEZ#l
zvp$*aSh}%g+T4Ub?tdd3u$Pk&hX*?aK#!ti
zJ#pt1+*X-SZcUt-+4K#%D@dviJ;pCu8~CBCGnX!t{I^D%zgl}-aF-u0bELF)9vXZd
zvf)Z`ZP_w=kSIZQ=>`AHi9}&gA%1|`#J{}{==rdv_WzeRm+5~JsTdgk^N4fTzY>o_
z*8lHJt15ZKA~5p#zZQ?)P0}*0I3Z^m$8m%AAGmyC$rPRInrnOr%%uk7@PEysXfk|c
zT>hVH6uZb?j0`fVJ;wW$pFZ4CJ=rCCJwamu5^eAD7BcnQ6Yg24m-4L_h5+v+LsnCi?9~CeACmz)G_x;&x|BG
zXq7mR1^sHAptgQGXtcVX`*0e8?=cnb72~rSFQ!9zuQnr?7xI(&$sAirsWu^)qHqA_
zhu82-CzS;yiMS^lKk>&%s;pt!;_j3A=SPg-Il+1}Q3HCANTF;4$tlETM`2n{*HhkP
zHcsZwb*(vX_lXZ(C$Rwl!@(v=TX4UVN{|!F=0in+wSXezH{{u)_}TN3B86)8d6B~s
z*;+z~<+IlCQu`~sr01h!e~3Q#x4;+5{r+hq53K_I_MdR#Lm8aUXbw>JQ+Zl^lvGIv
zwm(b7o#9isCht|whOB=}>IiO}XfA??2J+7Z>i>o6C=3wSQ|AL-Z4m&CD+D;7yV<$VJ+%rDSjf3bK!)O*3ruaNv|-r5?3!yp~%&_2#Kn>EpZpZq6~N&CYPZw6FZ}_1aGN`nnHK
z<}FQ+N?u?zgy%F&3sY=2410tBeDcV=S$vtz`f73&HrG)sg88tB>@nW$u=fr02Fct4
zL{ECMP)pXF?z%BI>d!c{uUtrkHR#&=>@-~eecD>u@!?CfEsJ
zInbXVz0Z#UgAd6H6Q0Lg+I`>50#y84&H0SF$dYjm6GROo6fy3vw6X#zl~3MV-JyH7
z+U+hpFRsC@w*9L4I*IuW@Bp4L`@GwD_k$+u$?acuZ#LCf*ne|#|0#k@&%*MLlGtwb
z>6k;7za_DMbMf;RKVaxba(SA0t-_9!9%2mlIvt_h&(D(LNkZ!m2S%om{`=w7l1HKs
zgu>Fhr1bW$NQsGwjs9ousAm|(xorG
zJ8o?|2hLpRGrMf5DUO8u2X6})H$XQxZho$G0{w>9`;c!ocdi)5hd-mevc6Ki*&h5$
zL~Kx8;K)PZP^{(YuIlhK&-Zu&S^{YJ3j@|3hW6&Fq5*CmA*_%$XrJ1^5xP3^WlS|*
z$va8$jyTjq_jyGkAkrH2m>QeQgeTYAGAQz~hBPu*a_M!fs%NLsCr|
z{7@Z{Yzjm1T)N_!45b3%9Pq&qQ|QXX;h^G=nGrH(4hYxABb9rJ@in_sugK0}uJ{q+
zy|Q|==Ow
z5M+eGh%`A
z!O06`xhK?Q#H-(KWwXH;lSuA@bhVOujIUz(!9p9Z`n0bS2xUUIv6v-sTR74{HR(j~
z4KL&~_nJQHNZVvAh+WIQQ1`BTs?_=`mxgz_hk*?PgjdR8<#e3Y5AH)UtgB%Klc{lI
z@sPRa2U;M@)KEz;p9}){YHBJg#*vM34HZO8L_CCPust$;r}GpczbjQEm146fS7}L9
zbJWXmq+rKk832eHcp@$+K<5QA`7MqNQYkQP4w(}-x=|Zr+)8Xwwch4()ToLPL>WOa
z#B1FHAEnCan3Tl%i>S1~%dn9fi_#)~*#@atzk^>0O%^pkeTt>09k85N-VAF4@6mXK_wbXKPo>G~?t-jy<8Jk4)Esh7Um)MONx1mGRM|KZw)NI$~biAau+_FrTrPg9n
zp0)`DcML3(p7fPv2QZ*Hdr(3DN
zqOc_4KIXAdPqsnfZyALg>;_$~i8)g3_7`-zf^qt55x*(EvpJxE?`+i|9QpErEFQ;Dbz`^2rjnU?l_a{FFsu!oozn@?m^TC+Q?S
zgF@8Sno>7d7cgF|)`tpk=6BrCup!_J@E`4Ei_$12Tg!$7WnsvnW@b-NDeB9$^qN*H
zm1PSf67$uYN0UbINDIv
zhx}dEYJ|*cn9cZNO|tX0aV*VY!CQ@}3mNHj4Dc}7sGo5AtqJ0WXh?ADW!AzYlGbSU
zPg=vqdbx@l0FPzLk`CTDZmNpZ>T{LrH%x~gZ?{iL3GeQc4%)*HC-wIozjM7-ws_ID
zfoz2OQ%1i7vE=W%ICg4ubTA|$36d~4%wOY2cjS`jZl6JnfqP2p;YE>e9_IQF
z3F9WA<)C)l`ToP=iebIv_&o$IRAc?0E+exsUUeZOgm`KQckG5XQTJA5l(Py9
zlINplJkRd3V~yQaC2+aflUX+#!e?dx?WGv6#5-XkPE}Z57%pfI3^lo3j4t^mQGZjL
z<@a(w(4`#0a`~q;+SMa}*tNVY$>XM~Ma(1G*$sq2>ELLR_
zcJwOEML?eEEbXun1Rg4Y7%ck8V4OyaNxi}n;b3_7gGu|N_OB)a=yxhfVWtKUo>xQD
z*=rnP*paV^UxbpV&0L~E{8qq3rsS6FX?@s1J~(YQh;HF9ZWOz7h*@)Dk3DH`>CGa~
zFI(C)RSy&m&FYJR%4e@axDv;*t85tM%%-9qw~qO;^C(By#ya7@7(;xRw%WsWe5`(w
zl^KQaC|jJWS9;bKzqlqn0`5sAplM&jO4)yMB@XtyX>;1n_wpsmiig7M;|boZAq&S0
zU2@^a9QUy`unQ;fK^-Wld&tCH(l9(I|yToNHbT
zmh}**C-0q7Xztvgwn!D`eNN4orXFcHT)1zsZQ^ZZ>}oGu5=iX=USUZ
zp7^~@oJ`&3($e90@qI3>Fn%P;WCz#HHOP!{{M6Ap`EHDc8il&{U@g)ZGyT(BNy8_w
z$H|`s3!tVUz-$Gg!-+f6qa4P;UjDrJRvfiJ-IX>NLoQKTSG406Xawa;sY8ivB&z#rK&tqn+)p*T
zH!zt&J+{-szhL)=kyodO&T4sQ#JiAqMa*(VkI*wCeY#&#;aT6N?a0&Srf);;cA(hT
zv*tyA6_VO6GwTdx08ZAJ%7JDGQ&-ap3e3GkYLzpu41xqaK{UsT%HZ$IQ0C-&*
zoSEC~2y4D8nj{gHd9@{J%x=ZKm2s+P*1M)Zt9?{uFZuCX7hL>-PAke`gt7%0bG5#&
zI`iNH!i$j9xmlneqEauMDLfC-gi7f6-CM19TLBz29O1x==*gxz)I=Q4w$lXt{kxT>
zu1^G-wSh|x&)1aa*4LwnhDzRIWVxz2I8uYds!n1`rHn5wGnN5_u1@Mx4XJ^vEkAk%
zWDlfFMMH-4TyO{(EzwTSGccPeN}m_a=tgXTkRE&y-q>yQPoqm!z-!0dB$Yh&b`!Xr
ztfI{Bp1F22rEw7yL-GHB1eeNGJz62Oj(_<`G{-efUXX}#xNkOmCXXKP(980ELLrX4
zvj2;}|6knTO73>Xw6X>kicZ$FGI$JhbhIMo4vtQEf8#QYf4f#r#tyV1R{BoHLdJ%+
zM#i*K#x|x-W_V1D|BTygYihOh%u~zMGxhq
zs8TxJ0W1zmDto_J)+a%#lW7BMlPQ)JK^j99+Svy)x4jOq
zPk{%+wG9yvX(_}TQ83*U#RQKq8GGjg3VLb*jtOZ|=ZR@y_wDgYDfb^_0E~4Gz$*+X
z0|qSx&jSGJjQ|8C2iF7a+Yck6*@Kkf*~0*UU_i@}22y^Dr$W-m1FHJXL8$sQ;jLr%
z^$|eLbPb}A3HB}j5_$+8t_ChdRYZwXqjA>L(l@t*2S_o%*4Ynu(TZ?}eIx`4dV{#*
zuSj$|M@b2Qt%VZh=pxSwuImCJgNInj9yOAclSknJ0)B;4OHH5#;uG5o$H)U9)$sG9
zBji)3%f8#;HyZ~84$7wEJp(X?M+Gh!eSy*#N*<_Y7-a6
z^Mrhdf*qnfqi`dW12hXu01aS=cu<^^Pl8VhQ0U{VCJB%W6XTDX_wxo}7fwx%Veg+0
z<7-OF1EV7O?QR%Z#AQ1cdkhmbaR`oP^47T5NfUrKD91
zA$x|q2)%;IKGht>{Q!GifU7@0g~??x%;LK>UUH6-utqc~bv%~I4dIodd@2h9X<s9tC?%L=*P9*4LjJ*^8?iZ)2JEDF7i@VQBM
zR!mI&kcK`GAxD^MjvY)xbnFeg>dv)SvupE~LMIMCj`weuG5Bj>*qex_8SDi$IXWVt#|kO&+@^?;%J1d@6MHv#;3lo
zT52d9BHeLpq_1w5?&p1A1+Gu5@hmQrvIRj60R^
zG$cDjayost{lXmZYlJkGk8C;YA$oAJ)k`v`n65skNZ|p*y1ViF3mzR~;j#J+C=ra>
zM7wzzDwAzA#)p=%{+-|Y>8Zs?;AcpUm0$)Tt>JtxDe`VXK&eT6o#Xd^hNH~z9PXgx
zg#iE)fu&S>MnRV#EL5UH8P$=}{oif(Sruxc~5ObKL
zU<3$o2%Z8r!_%36Wi~)`JXLi!>#g4;fwo#Wba`hA*r2fg#&<#=)Zln3xh{y9~I0@#Ho>N`@hERz|;Od
z^_P<#6Ae{Yyid{TO~8q>Lsw0#>hFEW{b>3d6Fdb14q2;-9@_~Hfy}CqeetWrIeWI2}iHFyjjPFYEh%b_IwsE@1>hsdr_=9~_$V=lQEctr|ek*r(OwM(XzZwI`1Gl?C
z@Ybplug^$CH(M!C@}(s&6P)k((v6EU{@$uWt|W5I8+I@Hs#@Lzgw=U2%=?-mvdvs8
zFysd~r5=jcPMF}F)BnsVKZTG@ZJwmz
ziD>$9buN}IuUX#wkxrDz1=JRM{8`+>@9Spk_+ic)-)~!+xT2nHP+;vr=^np4xGxZ3
z?dsB&MW(t%zdX$L{YtBwtzVp*bk2YA7k;`z+9YVf?@898d`ruTsXu%SYX|~s(N!?T
zsGm&mY1SmQKmKlY#6f+PZ`Pp88hpCv2yV%ci-b3wC89?#pFF5@Y8Eg8a!DU-+y_0j
z4vDh)ApF>aVYh*Z3f>@HU++tV=y~5Fk;RVu`+vFMWV>YxLNc?$x+A;+4D=6H8HRM&
z-Es3oT-b@TS$%0yj#8;_j=cRaZX6sk;ZWSVjqwe4Y@{wI@o=tsgZmJ#`Dh~}BIaMaFUG57A4U6tRF{tDpjKp@~bgzSacerdS4nsR_Un<{TmLKG%Z+29V3Ex9-(R|f;QqTmsIsvhs
zp_vcy^Zv*ms5|Gd*Kp2a%$9hc6k6j>M~#N+;9N(UvfQl^GQxGNZ#%SB{fV7@{QCNQ
zd}yjZ;Z2?uz5i^p9=9oZ0A7Gn<2|G=N*$#;RR7zu9s2)mnGVZ|cxYBH-yB+Va3_du
zPRIh_h>PSYOC%>PdOLT$CYOSe5VYff|P-<^Pqr6nA)Rfzh0ii2nj#c-F`!;!bR!BgvlRA~zgP=UCzHn_PmSr=y
zOWofd7fCHn;v;F(N+qt>+vSaZ(D)V4#%J+D4!)Ygs(4gZ~Vl6oN
z>bb4w0@%8=x_fQlQUocZ-=BzmTkba#Ih9r_RqkI}rn?rWvwT4*Ga&EW3QDsZ2gMXq9fH(Z@gAkwUz09pI~GbGlw-+TiYs8%Ix
zD*9>uDy5v%uiMT@kC3894A26=*v7dcWd!$A+seP
zQ)s4!Jt8qIhKTz8<5PC7RH>oMzif5Scw)^JHNW$FrXMB|$FIUVR9TIE80)sTQY%lF
zTe8kec5Fd;2;*ujwJ%B@Y}e;prlLARLugr7b^nt5%sa>0*`KJcDvunWl58^pqU8oS
zEkbH}mCQ>E+TBA4vs(8LzrbuWfuR{$nA+3}1JSP*_tS8ieen+Gp2R~nL#_QX>hDY?
zOianB=*q!4p^V1M2y9${SQ5vBfn(4?>Oec;=J5OF-ZUnlWx9`q3
z`!_G4%U~JHx8K~$4~HpVi-6i7Vrn)ooh6E!Nn<+Y5KrCo$V1NY9;)`?bi?&7*;MX!Cw~7b?h_v1xRuyF-?nj
z-#~gL<-@i8Ob%3l-tJ_sWJ+s}v$JD-tNArDI%nwFCKnbtfn*wV@8+>CH>Z%lnr&wE
zq8M!Dy(5`FQp!COKPxA^sx!ksBPUb~yx|gHrS-R-)JtxTA7~jg#iRkZj>x=c)XUS~
z3ohX*)=|G_f8K8c!0-h0o6y1lIu~6&2uCd2okjvzfr6zNbpo%TJ%58#U2W7o@~>SM
zVw7JP+hbF73_`~Lyq5{>yLi{bh>3n1x6QW5O5h3WV8h;@Sd<1msoHxU2ib;#F-+?6
z*T80`x#1mE#dD}>Esxo4{Vn`?Z;Mu|)rj8w_6Q8Ztbn@WEy
z>_=-!xqP+cmr13imw@^AK>eNC!W<`$hTC
zMjs*m$q#~{Vcj3vY}f+l+2r9OAWfv9_VY2!so4Tr;5GZ<<8VJC{Ya&HJ+=i`SP3Mu
z(p14hcUD>Mm%X<|Au6WQy39uDrJ}vgY4fi0r?cVLi4W@Acct6rxjdTQhDrU~Z|U}x
zR1bSDE8#H->u;ofvcf
z_=AlXv@^cwC{FPJHhvJ5j*xs>O1ff>KqSXbL{!^r2`sti#TP%V(vo)?7?WCSmQ#oH
zJPC2(GGNl=c*G)>A_k=$NZEAv@9b|fk#{448rnI^)}v>#G=n*)o4#`tG3a+AxG|iF
zH@X2&S=V^32J-|cV2K`r;APstIQabS`Q40R$7%Tp)kp>hx6j@DMcV9=eR}BSW%NyS
ztlw5|OW7*@h7}&$vNT)0toLow|7M^6B*VeT`VYjgcEYAbARm0lt#?GX6*<2vH&X!k
zI7WX;2^i8@_53`fee$x_(RC#wiFsq)#0w|m&lN|BRDsa)FGgOc%u>3#29@BD9`19j
zHNXmu-&%DAGok5s>8$FeX%EzwE$Y9fw!BMgX>(;aUCb2coZDXmE}W*G40-FWCSPdwO0&P_VaB>2&R>g`3<
zJ>dR8Sgxz~6;1ozXYyKIpOn>zP4q*GU}T9Ftlr}o(%zI-Z}SE0IGUdMH}n0cj20u)
zKSWft73M7h>5#o&C?D47Lr7GF;q#YKshl)TJ43sR?>E>@pyhGjUl>_yFk#M)v1ZwK
zjz*>Pl4|i98cIca;wgEfgIexbq&LDGJz-h*bp%nr<7LwB+T}9P1zyKY%~zksklbt2L^x=wReR
zzY$i=!*s`wR8%2QjFIpbgmS>kNi0DZwYDv&%v06!J9z+-Igq9#9(U0w|JBg(F;jJ^
z6)9U2&B0_b8~K2Y&}_7cf&5$ABs65$s^zdzDFwew-fyjBwv9lP%z8_0}J(|?SU
z%K92w5~Kb3wW9%C0vt)XaT-dHTnM}(dscFCeV06RU-~{@u1ph^YdwvXK}sx7i>qm~
z({SN9dyHV3hg*00%4`CIdy=XR#1H6Cd}DV4nORvTF`NU?R6m%e&&X!2T&5_i
zlvJx}=K`Ck?iP@**@}@W{P|abq^M{2i2K_VQm#glJ@7J1Z@KcUOI1EsM#kF{!T8mR
z#InpJmGGz;is%F)*c61Cvdn~$5xNnE#qJT!oAC&aBa-Z8nnvmrD~5eXJZ16KgNkCt
z%%Q{2OAbO}cJPPsiN{EH%RfvHo&B+ETItn6;2d5)w$^SH(Nqmb@b|X+?mNVt5N}pR
zDX(4jAHihsYcc-KB>#!opMm)w^oiPX(w0GV$X%zZU56ncmbCLY8ILoHl8u#
zi!fE1m}gbS{kozt#$>s!dWI2ALN!P@?Wa)}WI)qjNXpN5
z;7b^`aTuduW#=FN=`O9TxLi-h81*5KiOD7rj^}*xaCElmdDswC
zGC=E%hkvhAqOwsr@b)X_)9w0S=8^q>rB?pW*%L;_f1ts%6Z&le>7YYyxrAe~OCZJa
zw~2z52GZD^vPC*QGty$piRAqRcYX94Wi*QLyiZ!cM#FQH-ODp`-fm~cAU#xAHQ3Ll
z_K4~jwJ@%Ov&u#OFz&0i40!mop#70<>iZnrZ}O(baePJ16(n|QW!<21J*h}3HAJXM
z56E~L%>)@SrFpzqd7ew@V4)J{8u^T^_gd}5)U--w9~?yHWCN+0M{8j-MiHs#-=J*D
z^F(zsk2n@!Ad3!|frOAbgK`t6t4SgrZc~73dVk@~TAXSAM1(!=l*a-7Bp03t%ZVSr
zGH(_>Ku|zNl-Ch*{|q(@ZPLIW2AmHeBOoxAnjpiQ2xmi3&*c{BjroyL%cCM6mf*5r$&Vv!cLN?>KW;9Er=?z{hCcQhJ#&(45fV
zPjLtMR^2UXJb_J2mNWIjFaRU;Fn9MKFE7(7>M-{nMlBBRn{*^aTS(J_xMDgqOY6!@
z1^Jr5-~2=QA{XKN;#k44`kDDVwfm+q5KrSM2C{&7KBdeKnHH-UVm^V4m>@Yx$v{Co
z)h3{R^{V#KaE{Hz++JcGe_3JHNQB=an+RE}-4G|bqloGAXm4SV$cM4Sm%_A|QQxgr
z7Dy2=Y{9V`QAC7>K|p!N#(XAEgw1
zX4+so?{Hm}fW11~6-@uZIPQY`LhkkWlE2rmNnW1v@v!s>UB}gB>?BQ5Mt^)=__-PB%%5>5~rw|uFVe>t5_)sjrHZ^N;f2`NPwYh*75>8Sv%k(&pyjuV`U!MR4=3`xr2HRaXydu
zNd1Nkq3ork4<`nw5P+=l5En4lk?9SLrs~Vv1MP;76W3nenCQ3{m&bS
z&qR~{zZvL1{fYc@eN_JNLXQ3V0YJ@VSNgXh|JUaE|4kUv<1sR_(lP&EGRpMyEcDF(
zo1FLB8^TU&)LHL^_jF|I<=*sr3oWLf8BYwFzKuU_FM1vX8axh|R*sA6qE1S@1Xf~6
ze>{PBT_Q_JN0Z%!Pq^hknZn^Jy8B_nzSxS?UO{JAyeheHZAO2+hRWZ2`v;Cjpdnjg
zc}3-p*Yx}HW_A1aX7wwSXaF3ayCY0(smapTa1!Ynju(Wvw%_z(4s1qzv$*dPT%Xsg
zAygKZoqfBk7Y^S996xb?EPNAgH@)*6KWOR$-opLy%*vUB=`;8XJXtgUFD-u=T@*_f
z#4(aw3=X&Z%|NNFg-6~e8?r4sy>A&u|Ew28J|VBjmIWe-EGd8k`Z%~2@`
zZaMmGtO$)t0t#Y*a**i=7+cMj@Tu?`9V5r6Kalt|p@ws}t9sBwZRxCIS7Cxb2&>9%
zlVwsPMq6}+sc$C>ol;)s+r+mLn+u&)!S;gL>2IjPhQK1Zp`AezQ>bT~txt=|4CVeE
z)J3Qlwt<~~kgsGOp69EnSx;|U36AYNL4uZNujvvH>5_R(YxC-DiDcoSsXBh&yM>2W
z+8&^}BD{X}Q_n6Zm9IP})FqIFK1pu~J&|t+jG^3Th0ICG7G^&}zQPG2y22&fh0OZ5
zFi6cRy433F98}snyz+(y%e-@VFdR-|Ie&r&nU%`(8@60g^p$chrkCwnNTji6meZ=R
zQU=>GGLuboOs-*Vq6@rOIJfchTE^Nm0
z4=7w#oj!x_cS{ysOrDTxRv1i|5I)W$mL1j*|mjDJ}Y*bVw#k
zhQxde6R=2t3#(Fus7S8#o?9R=p-AqbTiP`1=I->XI{rd}Qn73gsqAK!3~9qk
zQ@IuR^~Nx$3d6~dW@Y7N;2#F}dfg3;5n?`lUI)E>Q73Cos@<0;E)Bx=8~7b8-=(@?
zM=%%){=_&=wLPRodl+5On!UjckpAm~#6qQA^`bVt?=y-aO{{)!m~3ipt%i5em!wy#b2L{k;(i$Q`r+
ziohMT5enl0+8C|rD1Cgw`E50bJg$lA*z(onfVy47MY+(i{a&S*zO{nBXUk2*JgK2<
zCC*)z$G=<^Sp_1u@(t>jFX9{u;P;p!==Wbe%g=aI=vTs7wmZ=rh`m^@#6Dd259Z2sOL~}%bk&{`0ePXN6H3K