From bbbc3e14d0ad455e0d46ba46d30b06498be635be Mon Sep 17 00:00:00 2001
From: John Sandoval <jsandoval81@users.noreply.github.com>
Date: Fri, 20 Dec 2024 07:55:59 -0700
Subject: [PATCH 01/18] Frontend/vue i18n update (#380)

---
 webroot/package.json                          |  2 +-
 webroot/src/models/Compact/Compact.model.ts   | 26 +-----------
 webroot/src/models/License/License.model.ts   | 13 +-----
 webroot/src/models/Licensee/Licensee.model.ts | 13 +-----
 webroot/src/models/State/State.model.ts       | 13 +-----
 webroot/vue.config.js                         | 13 ------
 webroot/yarn.lock                             | 42 +++++++++----------
 7 files changed, 27 insertions(+), 95 deletions(-)

diff --git a/webroot/package.json b/webroot/package.json
index 2d4bb68a6..eed3011fd 100644
--- a/webroot/package.json
+++ b/webroot/package.json
@@ -32,7 +32,7 @@
     "uuid": "^8.3.2",
     "vue": "^3.1.0",
     "vue-facing-decorator": "^3.0.4",
-    "vue-i18n": "^9.13.1",
+    "vue-i18n": "^10.0.5",
     "vue-responsiveness": "^0.2.0",
     "vue-router": "^4.3.0",
     "vue3-lazyload": "^0.3.8",
diff --git a/webroot/src/models/Compact/Compact.model.ts b/webroot/src/models/Compact/Compact.model.ts
index 2811af28b..0ffc3cb3f 100644
--- a/webroot/src/models/Compact/Compact.model.ts
+++ b/webroot/src/models/Compact/Compact.model.ts
@@ -60,18 +60,7 @@ export class Compact implements InterfaceCompactCreate {
 
     // Helper methods
     public name(): string {
-        let compacts = this.$tm('compacts') || [];
-
-        /* istanbul ignore next */ // i18n translations are not functions in the test runner environment, so this block won't be traversed
-        if (typeof compacts[0]?.key === 'function') {
-            const normalize = ([value]) => value;
-
-            compacts = compacts.map((translate) => ({
-                key: translate.key({ normalize }),
-                name: translate.name({ normalize }),
-            }));
-        }
-
+        const compacts = this.$tm('compacts') || [];
         const compact = compacts.find((translate) => translate.key === this.type);
         const compactName = compact?.name || '';
 
@@ -79,18 +68,7 @@ export class Compact implements InterfaceCompactCreate {
     }
 
     public abbrev(): string {
-        let compacts = this.$tm('compacts') || [];
-
-        /* istanbul ignore next */ // i18n translations are not functions in the test runner environment, so this block won't be traversed
-        if (typeof compacts[0]?.key === 'function') {
-            const normalize = ([value]) => value;
-
-            compacts = compacts.map((translate) => ({
-                key: translate.key({ normalize }),
-                abbrev: translate.abbrev({ normalize }),
-            }));
-        }
-
+        const compacts = this.$tm('compacts') || [];
         const compact = compacts.find((translate) => translate.key === this.type);
         const compactAbbrev = compact?.abbrev || '';
 
diff --git a/webroot/src/models/License/License.model.ts b/webroot/src/models/License/License.model.ts
index a1643787e..80a5495d9 100644
--- a/webroot/src/models/License/License.model.ts
+++ b/webroot/src/models/License/License.model.ts
@@ -97,18 +97,7 @@ export class License implements InterfaceLicense {
     }
 
     public occupationName(): string {
-        let occupations = this.$tm('licensing.occupations') || [];
-
-        /* istanbul ignore next */ // i18n translations are not functions in the test runner environment, so this block won't be traversed
-        if (typeof occupations[0]?.key === 'function') {
-            const normalize = ([value]) => value;
-
-            occupations = occupations.map((translate) => ({
-                key: translate.key({ normalize }),
-                name: translate.name({ normalize }),
-            }));
-        }
-
+        const occupations = this.$tm('licensing.occupations') || [];
         const occupation = occupations.find((translate) => translate.key === this.occupation);
         const occupationName = occupation?.name || '';
 
diff --git a/webroot/src/models/Licensee/Licensee.model.ts b/webroot/src/models/Licensee/Licensee.model.ts
index 48f696118..21a9915fd 100644
--- a/webroot/src/models/Licensee/Licensee.model.ts
+++ b/webroot/src/models/Licensee/Licensee.model.ts
@@ -176,18 +176,7 @@ export class Licensee implements InterfaceLicensee {
     }
 
     public occupationName(): string {
-        let occupations = this.$tm('licensing.occupations') || [];
-
-        /* istanbul ignore next */ // i18n translations are not functions in the test runner environment, so this block won't be traversed
-        if (typeof occupations[0]?.key === 'function') {
-            const normalize = ([value]) => value;
-
-            occupations = occupations.map((translate) => ({
-                key: translate.key({ normalize }),
-                name: translate.name({ normalize }),
-            }));
-        }
-
+        const occupations = this.$tm('licensing.occupations') || [];
         const occupation = occupations.find((translate) => translate.key === this.occupation);
         const occupationName = occupation?.name || '';
 
diff --git a/webroot/src/models/State/State.model.ts b/webroot/src/models/State/State.model.ts
index 30f66112c..91c6462c3 100644
--- a/webroot/src/models/State/State.model.ts
+++ b/webroot/src/models/State/State.model.ts
@@ -40,18 +40,7 @@ export class State implements InterfaceStateCreate {
     // Helper methods
     public name(): string {
         const abbrev = (this.abbrev || '').toUpperCase() || '';
-        let states = this.$tm('common.states') || [];
-
-        /* istanbul ignore next */ // i18n translations are not functions in the test runner environment, so this block won't be traversed
-        if (typeof states[0]?.abbrev === 'function') {
-            const normalize = ([value]) => value;
-
-            states = states.map((st) => ({
-                abbrev: st.abbrev({ normalize }),
-                full: st.full({ normalize }),
-            }));
-        }
-
+        const states = this.$tm('common.states') || [];
         const state = states.find((st) => st.abbrev === abbrev);
         const stateName = state?.full || this.$t('common.stateUnknown');
 
diff --git a/webroot/vue.config.js b/webroot/vue.config.js
index c667af4b6..8c4a00d26 100644
--- a/webroot/vue.config.js
+++ b/webroot/vue.config.js
@@ -13,7 +13,6 @@ const path = require('path');
 const fs = require('fs');
 const FaviconsWebpackPlugin = require('favicons-webpack-plugin');
 const StyleLintPlugin = require('stylelint-webpack-plugin');
-const VueI18nPlugin = require('@intlify/unplugin-vue-i18n/lib/webpack.cjs');
 
 const env = process.env.NODE_ENV;
 const ENV_PRODUCTION = 'production';
@@ -147,15 +146,6 @@ const stylelintPlugin = new StyleLintPlugin({
     files: 'src/**/*.less',
 });
 
-/**
- * vue-i18n advanced configuration (https://vue-i18n.intlify.dev/guide/advanced/optimization#configure-plugin-for-webpack)
- * @intlify/unplugin-vue-i18n configuration (https://github.com/intlify/bundle-tools/tree/main/packages/unplugin-vue-i18n#intlifyunplugin-vue-i18n)
- * @type {VueI18nPlugin}
- */
-const vueI18nPlugin = VueI18nPlugin({
-    include: path.resolve(__dirname, './src/locales/*.json'),
-});
-
 /**
  * Inject common style resources into a module rule.
  * @param {WebpackModuleRule} rule The webpack module rule.
@@ -306,9 +296,6 @@ module.exports = {
         plugins: [
             faviconsPlugin,
             stylelintPlugin,
-            // The runtime-only version of vue-i18n conflicts with test-runner, but is required for built server versions due to CSP.
-            // Conditionally adding the runtime-ify plugin with a linter exception for the automated test context.
-            ... (env !== ENV_TEST) ? [vueI18nPlugin] : [], // eslint-disable-line rest-spread-spacing
         ],
         resolve: {
             alias: {
diff --git a/webroot/yarn.lock b/webroot/yarn.lock
index 37040f53d..d9b789b13 100644
--- a/webroot/yarn.lock
+++ b/webroot/yarn.lock
@@ -2320,20 +2320,20 @@
     source-map "0.6.1"
     yaml-eslint-parser "^0.3.2"
 
-"@intlify/core-base@9.14.2":
-  version "9.14.2"
-  resolved "https://registry.yarnpkg.com/@intlify/core-base/-/core-base-9.14.2.tgz#2c074506ea72425e937f911c95c0d845b43f7fdf"
-  integrity sha512-DZyQ4Hk22sC81MP4qiCDuU+LdaYW91A6lCjq8AWPvY3+mGMzhGDfOCzvyR6YBQxtlPjFqMoFk9ylnNYRAQwXtQ==
+"@intlify/core-base@10.0.5":
+  version "10.0.5"
+  resolved "https://registry.yarnpkg.com/@intlify/core-base/-/core-base-10.0.5.tgz#c4d992381f8c3a50c79faf67be3404b399c3be28"
+  integrity sha512-F3snDTQs0MdvnnyzTDTVkOYVAZOE/MHwRvF7mn7Jw1yuih4NrFYLNYIymGlLmq4HU2iIdzYsZ7f47bOcwY73XQ==
   dependencies:
-    "@intlify/message-compiler" "9.14.2"
-    "@intlify/shared" "9.14.2"
+    "@intlify/message-compiler" "10.0.5"
+    "@intlify/shared" "10.0.5"
 
-"@intlify/message-compiler@9.14.2":
-  version "9.14.2"
-  resolved "https://registry.yarnpkg.com/@intlify/message-compiler/-/message-compiler-9.14.2.tgz#7217842ea1875d80bbf0f708e9b3ef5ad7c57a03"
-  integrity sha512-YsKKuV4Qv4wrLNsvgWbTf0E40uRv+Qiw1BeLQ0LAxifQuhiMe+hfTIzOMdWj/ZpnTDj4RSZtkXjJM7JDiiB5LQ==
+"@intlify/message-compiler@10.0.5":
+  version "10.0.5"
+  resolved "https://registry.yarnpkg.com/@intlify/message-compiler/-/message-compiler-10.0.5.tgz#4eeace9f4560020d5e5d77f32bed7755e71d8efd"
+  integrity sha512-6GT1BJ852gZ0gItNZN2krX5QAmea+cmdjMvsWohArAZ3GmHdnNANEcF9JjPXAMRtQ6Ux5E269ymamg/+WU6tQA==
   dependencies:
-    "@intlify/shared" "9.14.2"
+    "@intlify/shared" "10.0.5"
     source-map-js "^1.0.2"
 
 "@intlify/message-compiler@next":
@@ -2349,10 +2349,10 @@
   resolved "https://registry.yarnpkg.com/@intlify/shared/-/shared-10.0.0-beta.5.tgz#4b87237ba2091f53275368a7ecacc321b37cf258"
   integrity sha512-g9bq5Y1bOcC9qxtNk4UWtF3sXm6Wh0fGISb7vD5aLyF7yQv7ZFjxQjJzBP2GqG/9+PAGYutqjP1GGadNqFtyAQ==
 
-"@intlify/shared@9.14.2":
-  version "9.14.2"
-  resolved "https://registry.yarnpkg.com/@intlify/shared/-/shared-9.14.2.tgz#f7dceea32db44c9253e3f965745a42a5cb3a1883"
-  integrity sha512-uRAHAxYPeF+G5DBIboKpPgC/Waecd4Jz8ihtkpJQD5ycb5PwXp0k/+hBGl5dAjwF7w+l74kz/PKA8r8OK//RUw==
+"@intlify/shared@10.0.5":
+  version "10.0.5"
+  resolved "https://registry.yarnpkg.com/@intlify/shared/-/shared-10.0.5.tgz#1b46ca8b541f03508fe28da8f34e4bb85506d6bc"
+  integrity sha512-bmsP4L2HqBF6i6uaMqJMcFBONVjKt+siGluRq4Ca4C0q7W2eMaVZr8iCgF9dKbcVXutftkC7D6z2SaSMmLiDyA==
 
 "@intlify/unplugin-vue-i18n@^0.6.2":
   version "0.6.2"
@@ -12339,13 +12339,13 @@ vue-hot-reload-api@^2.3.0:
   resolved "https://registry.yarnpkg.com/vue-hot-reload-api/-/vue-hot-reload-api-2.3.4.tgz#532955cc1eb208a3d990b3a9f9a70574657e08f2"
   integrity sha512-BXq3jwIagosjgNVae6tkHzzIk6a8MHFtzAdwhnV5VlvPTFxDCvIttgSiHWjdGoTJvXtmRu5HacExfdarRcFhog==
 
-vue-i18n@^9.13.1:
-  version "9.14.2"
-  resolved "https://registry.yarnpkg.com/vue-i18n/-/vue-i18n-9.14.2.tgz#e7f657664fcb3ccf99ecea684fc56e0f8e5335ce"
-  integrity sha512-JK9Pm80OqssGJU2Y6F7DcM8RFHqVG4WkuCqOZTVsXkEzZME7ABejAUqUdA931zEBedc4thBgSUWxeQh4uocJAQ==
+vue-i18n@^10.0.5:
+  version "10.0.5"
+  resolved "https://registry.yarnpkg.com/vue-i18n/-/vue-i18n-10.0.5.tgz#fdf4e6c7b669e80cfa3a12ed9625e2b46671cdf0"
+  integrity sha512-9/gmDlCblz3i8ypu/afiIc/SUIfTTE1mr0mZhb9pk70xo2csHAM9mp2gdQ3KD2O0AM3Hz/5ypb+FycTj/lHlPQ==
   dependencies:
-    "@intlify/core-base" "9.14.2"
-    "@intlify/shared" "9.14.2"
+    "@intlify/core-base" "10.0.5"
+    "@intlify/shared" "10.0.5"
     "@vue/devtools-api" "^6.5.0"
 
 vue-loader@^17.0.0:

From dd33c7896e035bbf407e1bbc7baaa6437604bcdf Mon Sep 17 00:00:00 2001
From: John Sandoval <jsandoval81@users.noreply.github.com>
Date: Fri, 20 Dec 2024 07:56:24 -0700
Subject: [PATCH 02/18] Frontend/Fix search paging case (#384)

---
 .../LicenseeList/LicenseeList.spec.ts         |  3 +-
 .../Licensee/LicenseeList/LicenseeList.ts     | 18 ++++--
 .../Licensee/LicenseeSearch/LicenseeSearch.ts |  4 +-
 webroot/src/store/license/license.actions.ts  |  6 ++
 .../src/store/license/license.mutations.ts    | 20 ++++++
 webroot/src/store/license/license.spec.ts     | 61 +++++++++++++++++++
 webroot/src/store/license/license.state.ts    |  8 +++
 7 files changed, 112 insertions(+), 8 deletions(-)

diff --git a/webroot/src/components/Licensee/LicenseeList/LicenseeList.spec.ts b/webroot/src/components/Licensee/LicenseeList/LicenseeList.spec.ts
index 0543c5c6f..f1c92a722 100644
--- a/webroot/src/components/Licensee/LicenseeList/LicenseeList.spec.ts
+++ b/webroot/src/components/Licensee/LicenseeList/LicenseeList.spec.ts
@@ -132,8 +132,9 @@ describe('LicenseeList component', async () => {
         };
 
         await component.$store.dispatch('user/setCurrentCompact', new Compact({ type: CompactType.ASLP }));
+        await component.$store.dispatch('license/setStoreSearch', testParams);
 
-        const requestConfig = await component.fetchListData(testParams);
+        const requestConfig = await component.fetchListData();
 
         expect(requestConfig).to.matchPattern({
             compact: CompactType.ASLP,
diff --git a/webroot/src/components/Licensee/LicenseeList/LicenseeList.ts b/webroot/src/components/Licensee/LicenseeList/LicenseeList.ts
index e094909ee..7635e1fa3 100644
--- a/webroot/src/components/Licensee/LicenseeList/LicenseeList.ts
+++ b/webroot/src/components/Licensee/LicenseeList/LicenseeList.ts
@@ -38,7 +38,6 @@ class LicenseeList extends Vue {
     //
     hasSearched = false;
     shouldShowSearchModal = false;
-    searchParams: LicenseSearch = {};
     isInitialFetchCompleted = false;
     prevKey = '';
     nextKey = '';
@@ -78,6 +77,10 @@ class LicenseeList extends Vue {
         return this.$store.state.license;
     }
 
+    get searchParams(): LicenseSearch {
+        return this.licenseStore.search;
+    }
+
     get searchDisplayFirstName(): string {
         return this.searchParams.firstName || '';
     }
@@ -164,8 +167,12 @@ class LicenseeList extends Vue {
     }
 
     handleSearch(params: LicenseSearch): void {
-        this.fetchListData(params);
-        this.searchParams = params;
+        this.$store.dispatch('license/setStoreSearch', params);
+        this.$store.dispatch('pagination/updatePaginationPage', {
+            paginationId: this.listId,
+            newPage: 1,
+        });
+        this.fetchListData();
 
         if (!this.hasSearched) {
             this.hasSearched = true;
@@ -175,7 +182,7 @@ class LicenseeList extends Vue {
     }
 
     resetSearch(): void {
-        this.searchParams = {};
+        this.$store.dispatch('license/resetStoreSearch');
         this.toggleSearch();
     }
 
@@ -223,7 +230,8 @@ class LicenseeList extends Vue {
         }
     }
 
-    async fetchListData(searchParams?: LicenseSearch) {
+    async fetchListData() {
+        const { searchParams } = this;
         const sorting = this.sortingStore.sortingMap[this.listId];
         const { option, direction } = sorting || {};
         const pagination = this.paginationStore.paginationMap[this.listId];
diff --git a/webroot/src/components/Licensee/LicenseeSearch/LicenseeSearch.ts b/webroot/src/components/Licensee/LicenseeSearch/LicenseeSearch.ts
index 12c5cd379..8e5565da1 100644
--- a/webroot/src/components/Licensee/LicenseeSearch/LicenseeSearch.ts
+++ b/webroot/src/components/Licensee/LicenseeSearch/LicenseeSearch.ts
@@ -24,8 +24,8 @@ import Joi from 'joi';
 export interface LicenseSearch {
     firstName?: string;
     lastName?: string;
-    ssn?: string,
-    state?: string,
+    ssn?: string;
+    state?: string;
 }
 
 @Component({
diff --git a/webroot/src/store/license/license.actions.ts b/webroot/src/store/license/license.actions.ts
index 1c0205d40..053fe4f43 100644
--- a/webroot/src/store/license/license.actions.ts
+++ b/webroot/src/store/license/license.actions.ts
@@ -75,6 +75,12 @@ export default {
     setStoreLicensee: ({ commit }, licensee) => {
         commit(MutationTypes.STORE_UPDATE_LICENSEE, licensee);
     },
+    setStoreSearch: ({ commit }, search) => {
+        commit(MutationTypes.STORE_UPDATE_SEARCH, search);
+    },
+    resetStoreSearch: ({ commit }) => {
+        commit(MutationTypes.STORE_RESET_SEARCH);
+    },
     // RESET LICENSEES STORE STATE
     resetStoreLicense: ({ commit }) => {
         commit(MutationTypes.STORE_RESET_LICENSE);
diff --git a/webroot/src/store/license/license.mutations.ts b/webroot/src/store/license/license.mutations.ts
index 20989d0a9..2099e90b5 100644
--- a/webroot/src/store/license/license.mutations.ts
+++ b/webroot/src/store/license/license.mutations.ts
@@ -4,6 +4,7 @@
 //
 //  Created by InspiringApps on 7/2/24.
 //
+import { LicenseSearch } from '@components/Licensee/LicenseeSearch/LicenseeSearch.vue';
 
 export enum MutationTypes {
     GET_LICENSEES_REQUEST = '[License] Get Licensees Request',
@@ -18,6 +19,8 @@ export enum MutationTypes {
     GET_LICENSEE_SUCCESS = '[License] Get Licensee Success',
     STORE_UPDATE_LICENSEE = '[License] Updated Licensee in store',
     STORE_REMOVE_LICENSEE = '[License] Remove Licensee from store',
+    STORE_UPDATE_SEARCH = '[License] Update search params',
+    STORE_RESET_SEARCH = '[License] Reset search params',
     STORE_RESET_LICENSE = '[License] Reset license store',
 }
 
@@ -91,10 +94,27 @@ export default {
             console.warn('Cannot remove Licensee with null ID from the store:');
         }
     },
+    [MutationTypes.STORE_UPDATE_SEARCH]: (state: any, search: LicenseSearch) => {
+        state.search = search;
+    },
+    [MutationTypes.STORE_RESET_SEARCH]: (state: any) => {
+        state.search = {
+            firstName: '',
+            lastName: '',
+            ssn: '',
+            state: '',
+        };
+    },
     [MutationTypes.STORE_RESET_LICENSE]: (state: any) => {
         state.model = null;
         state.total = 0;
         state.isLoading = false;
         state.error = null;
+        state.search = {
+            firstName: '',
+            lastName: '',
+            ssn: '',
+            state: '',
+        };
     },
 };
diff --git a/webroot/src/store/license/license.spec.ts b/webroot/src/store/license/license.spec.ts
index 42c3d59be..93b5444b0 100644
--- a/webroot/src/store/license/license.spec.ts
+++ b/webroot/src/store/license/license.spec.ts
@@ -137,12 +137,50 @@ describe('License Store Mutations', () => {
 
         expect(state.model).to.matchPattern([]);
     });
+    it('should successfully update license search values', () => {
+        const state = {};
+        const search = {
+            firstName: 'test',
+            lastName: 'test',
+            ssn: 'test',
+            state: 'test',
+        };
+
+        mutations[MutationTypes.STORE_UPDATE_SEARCH](state, search);
+
+        expect(state.search).to.matchPattern(search);
+    });
+    it('should successfully reset license search values', () => {
+        const state = {
+            search: {
+                firstName: 'test',
+                lastName: 'test',
+                ssn: 'test',
+                state: 'test',
+            },
+        };
+
+        mutations[MutationTypes.STORE_RESET_SEARCH](state);
+
+        expect(state.search).to.matchPattern({
+            firstName: '',
+            lastName: '',
+            ssn: '',
+            state: '',
+        });
+    });
     it('should successfully reset license store', () => {
         const state = {
             model: [{ id: 1 }],
             total: 1,
             isLoading: true,
             error: new Error(),
+            search: {
+                firstName: 'test',
+                lastName: 'test',
+                ssn: 'test',
+                state: 'test',
+            },
         };
 
         mutations[MutationTypes.STORE_RESET_LICENSE](state);
@@ -152,6 +190,12 @@ describe('License Store Mutations', () => {
             total: 0,
             isLoading: false,
             error: null,
+            search: {
+                firstName: '',
+                lastName: '',
+                ssn: '',
+                state: '',
+            },
         });
     });
 });
@@ -269,6 +313,23 @@ describe('License Store Actions', async () => {
         expect(commit.calledOnce).to.equal(true);
         expect(commit.firstCall.args).to.matchPattern([MutationTypes.STORE_UPDATE_LICENSEE, licensee]);
     });
+    it('should successfully update search', () => {
+        const commit = sinon.spy();
+        const search = { firstName: 'test' };
+
+        actions.setStoreSearch({ commit }, search);
+
+        expect(commit.calledOnce).to.equal(true);
+        expect(commit.firstCall.args).to.matchPattern([MutationTypes.STORE_UPDATE_SEARCH, search]);
+    });
+    it('should successfully reset search', () => {
+        const commit = sinon.spy();
+
+        actions.resetStoreSearch({ commit });
+
+        expect(commit.calledOnce).to.equal(true);
+        expect(commit.firstCall.args).to.matchPattern([MutationTypes.STORE_RESET_SEARCH]);
+    });
     it('should successfully reset store', () => {
         const commit = sinon.spy();
 
diff --git a/webroot/src/store/license/license.state.ts b/webroot/src/store/license/license.state.ts
index a0d91f6f7..4a292cb19 100644
--- a/webroot/src/store/license/license.state.ts
+++ b/webroot/src/store/license/license.state.ts
@@ -4,6 +4,7 @@
 //
 //  Created by InspiringApps on 7/2/24.
 //
+import { LicenseSearch } from '@components/Licensee/LicenseeSearch/LicenseeSearch.vue';
 
 export interface State {
     model: Array<any> | null;
@@ -12,6 +13,7 @@ export interface State {
     lastKey: string | null;
     isLoading: boolean;
     error: any | null;
+    search: LicenseSearch;
 }
 
 export const state: State = {
@@ -21,4 +23,10 @@ export const state: State = {
     lastKey: null,
     isLoading: false,
     error: null,
+    search: {
+        firstName: '',
+        lastName: '',
+        ssn: '',
+        state: '',
+    },
 };

From 5977b089daf6be818ac486f9caa5570e007d7e5f Mon Sep 17 00:00:00 2001
From: Dana Stiefel <35410938+ChiefStief@users.noreply.github.com>
Date: Fri, 20 Dec 2024 12:58:36 -0700
Subject: [PATCH 03/18] Feat/auth tweaks (#388)

### Requirements List
- Python 3.12+
- A working sandbox account, once you have access you can get it set up
by:
0) Create AWS CLI profile that has access to your sandbox and login as
that
1) Follow the modified readme in compact-connect
2) Run the create_staff_user.py script
3) Validate emails to your ia account in ses so that you can get your
temp passwords for your licensee user.
4) Manually create a licensee user in the relevant user pool and
associated db records (licensee and license). I can help with this when
needed.
5) You may need to do your initial deploy twice as there is a race
condition that fails the first time but is met the second time

### Description List
- Added mock login support
- Added route guarding based on role
- Modified logout flow to hit both hosted logout pages by hopping to and
from logout page that will handle logout cases
- Fixed 401 interceptor handler to actually fully logout

### Testing List
- `yarn test:unit:all` should run without errors or warnings
- `yarn serve` should run without errors or warnings
- `yarn build` should run without errors or warnings
- For API configuration changes: CDK tests back/bin/run_tests.sh
- Code review
- Try logging in as a licensee, staff, both and logout and verify
logging out logs out all users
- Try the mockAPI flow in the same way
- Produce a 401 error by modifying your access or id token (staff and
licensee respectively) and refreshing and confirm the 401 causes the
user to totally logout
- Try going to routes that should not be available to a logged in user
(both staff and licensee) and confirm they are redirected to their part
of the site

Closes #321

---------

Co-authored-by: Dana Stiefel <dana@inspiringapps.com>
Co-authored-by: Joshua Kravitz <jlkravitz@gmail.com>
---
 backend/compact-connect/README.md             |  4 +-
 .../compact-connect/bin/create_staff_user.py  |  1 +
 .../common_constructs/user_pool.py            | 37 +++++++++-
 .../python/common/requirements-dev.txt        | 12 ++--
 .../lambdas/python/common/requirements.txt    |  6 +-
 .../custom-resources/requirements-dev.txt     | 12 ++--
 .../python/data-events/requirements-dev.in    |  2 +-
 .../python/data-events/requirements-dev.txt   | 16 +++--
 .../provider-data-v1/requirements-dev.txt     | 12 ++--
 .../python/purchases/requirements-dev.txt     | 12 ++--
 .../lambdas/python/purchases/requirements.txt |  2 +-
 .../staff-user-pre-token/requirements-dev.txt | 12 ++--
 .../python/staff-users/requirements-dev.txt   | 14 ++--
 backend/compact-connect/requirements-dev.txt  | 12 ++--
 backend/compact-connect/requirements.txt      | 12 ++--
 .../stacks/persistent_stack/provider_users.py | 17 +----
 .../stacks/persistent_stack/staff_users.py    | 17 +----
 backend/multi-account/requirements-dev.txt    |  2 +-
 backend/multi-account/requirements.txt        |  8 +--
 webroot/README.md                             | 24 +++++++
 webroot/src/app.config.ts                     |  3 +-
 webroot/src/components/App/App.ts             | 18 +++--
 .../Page/PageMainNav/PageMainNav.ts           | 16 ++++-
 webroot/src/main.ts                           |  4 +-
 webroot/src/network/data.api.ts               | 12 ++--
 .../src/network/exampleApi/interceptors.ts    |  9 ++-
 .../src/network/licenseApi/interceptors.ts    |  6 +-
 webroot/src/network/stateApi/interceptors.ts  |  6 +-
 webroot/src/network/userApi/interceptors.ts   |  6 +-
 .../src/pages/AuthCallback/AuthCallback.ts    |  8 +--
 webroot/src/pages/Home/Home.ts                |  4 +-
 webroot/src/pages/Login/Login.ts              | 39 ++++++++++-
 webroot/src/pages/Login/Login.vue             | 16 ++++-
 webroot/src/pages/Logout/Logout.ts            | 68 +++++++++++--------
 webroot/src/router/index.ts                   |  9 ++-
 webroot/src/router/routes.ts                  | 24 +++----
 webroot/src/store/user/user.actions.ts        | 36 ++++++++--
 webroot/src/store/user/user.getters.ts        | 12 ----
 webroot/src/store/user/user.mutations.ts      |  5 +-
 webroot/src/store/user/user.spec.ts           | 57 +++++-----------
 webroot/src/store/user/user.state.ts          | 11 ++-
 41 files changed, 366 insertions(+), 237 deletions(-)

diff --git a/backend/compact-connect/README.md b/backend/compact-connect/README.md
index d52f9d80a..52eaf0201 100644
--- a/backend/compact-connect/README.md
+++ b/backend/compact-connect/README.md
@@ -63,7 +63,7 @@ $ cdk synth
 ```
 
 For development work there are additional requirements in `requirements-dev.txt` to install with
-`pip install -r requirements.txt`.
+`pip install -r requirements-dev.txt`.
 
 To add additional dependencies, for example other CDK libraries, just add them to the `requirements.in` file and rerun
 `pip-compile requirements.in`, then `pip install -r requirements.txt` command.
@@ -118,7 +118,7 @@ its environment:
    your app. See [About Route53 Hosted Zones](#about-route53-hosted-zones) for more. Note: Without this step, you will
    not be able to log in to the UI hosted in CloudFront. The Oauth2 authentication process requires a predictable
    callback url to be pre-configured, which the domain name provides. You can still run a local UI against this app,
-   so long as you leave the `allow_local_ui` context value set to `true` in your environment's context. 
+   so long as you leave the `allow_local_ui` context value set to `true` and remove the `domain_name` param in your environment's context.
 2) *Optional if testing SES email notifications with custom domain:* By default, AWS does not allow sending emails to unverified email
    addresses. If you need to test SES email notifications and do not want to request AWS to remove your account from
    the SES sandbox, you will need to set up a verified SES email identity for each address you want to send emails to.
diff --git a/backend/compact-connect/bin/create_staff_user.py b/backend/compact-connect/bin/create_staff_user.py
index 499721bcc..fe547068e 100755
--- a/backend/compact-connect/bin/create_staff_user.py
+++ b/backend/compact-connect/bin/create_staff_user.py
@@ -17,6 +17,7 @@
 
 provider_data_path = os.path.join('lambdas', 'python', 'staff-users')
 common_lib_path = os.path.join('lambdas', 'python', 'common')
+
 sys.path.append(provider_data_path)
 sys.path.append(common_lib_path)
 
diff --git a/backend/compact-connect/common_constructs/user_pool.py b/backend/compact-connect/common_constructs/user_pool.py
index 3a6545b19..88b547b99 100644
--- a/backend/compact-connect/common_constructs/user_pool.py
+++ b/backend/compact-connect/common_constructs/user_pool.py
@@ -117,7 +117,8 @@ def __init__(  # pylint: disable=too-many-arguments
 
     def add_ui_client(
         self,
-        callback_urls: list[str],
+        ui_domain_name: str,
+        environment_context: dict,
         read_attributes: ClientAttributes,
         write_attributes: ClientAttributes,
         ui_scopes: list[OAuthScope] = None,
@@ -125,11 +126,42 @@ def add_ui_client(
         """
         Creates an app client for the UI to authenticate with the user pool.
 
-        :param callback_urls: The URLs that Cognito allows the UI to redirect to after authentication.
+        :param ui_domain_name: The ui domain name used to determine acceptable redirects.
+        :param environment_context: The environment context used to determine acceptable redirects.
         :param read_attributes: The attributes that the UI can read.
         :param write_attributes: The attributes that the UI can write.
         :param ui_scopes: OAuth scopes that are allowed with this client
         """
+        callback_urls = []
+        if ui_domain_name is not None:
+            callback_urls.append(f'https://{ui_domain_name}/auth/callback')
+        # This toggle will allow front-end devs to point their local UI at this environment's user pool to support
+        # authenticated actions.
+        if environment_context.get('allow_local_ui', False):
+            local_ui_port = environment_context.get('local_ui_port', '3018')
+            callback_urls.append(f'http://localhost:{local_ui_port}/auth/callback')
+        if not callback_urls:
+            raise ValueError(
+                "This app requires a callback url for its authentication path. Either provide 'domain_name' or set "
+                "'allow_local_ui' to true in this environment's context."
+            )
+
+        logout_urls = []
+        if ui_domain_name is not None:
+            logout_urls.append(f'https://{ui_domain_name}/Login')
+            logout_urls.append(f'https://{ui_domain_name}/Logout')
+        # This toggle will allow front-end devs to point their local UI at this environment's user pool to support
+        # authenticated actions.
+        if environment_context.get('allow_local_ui', False):
+            local_ui_port = environment_context.get('local_ui_port', '3018')
+            logout_urls.append(f'http://localhost:{local_ui_port}/Login')
+            logout_urls.append(f'http://localhost:{local_ui_port}/Logout')
+        if not logout_urls:
+            raise ValueError(
+                "This app requires a logout url for its logout function. Either provide 'domain_name' or set "
+                "'allow_local_ui' to true in this environment's context."
+            )
+
         return self.add_client(
             'UIClient',
             auth_flows=AuthFlow(
@@ -140,6 +172,7 @@ def add_ui_client(
             ),
             o_auth=OAuthSettings(
                 callback_urls=callback_urls,
+                logout_urls=logout_urls,
                 flows=OAuthFlows(authorization_code_grant=True, implicit_code_grant=False),
                 scopes=ui_scopes,
             ),
diff --git a/backend/compact-connect/lambdas/python/common/requirements-dev.txt b/backend/compact-connect/lambdas/python/common/requirements-dev.txt
index 4cbcd70e7..dfa088cee 100644
--- a/backend/compact-connect/lambdas/python/common/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/common/requirements-dev.txt
@@ -4,20 +4,20 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/common/requirements-dev.in
 #
-boto3==1.35.67
+boto3==1.35.81
     # via moto
-botocore==1.35.67
+botocore==1.35.81
     # via
     #   boto3
     #   moto
     #   s3transfer
-certifi==2024.8.30
+certifi==2024.12.14
     # via requests
 cffi==1.17.1
     # via cryptography
 charset-normalizer==3.4.0
     # via requests
-cryptography==43.0.3
+cryptography==44.0.0
     # via moto
 docker==7.1.0
     # via moto
@@ -35,7 +35,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.21
+moto[dynamodb,s3]==5.0.23
     # via -r compact-connect/lambdas/python/common/requirements-dev.in
 py-partiql-parser==0.5.6
     # via moto
@@ -59,7 +59,7 @@ responses==0.25.3
     # via moto
 s3transfer==0.10.4
     # via boto3
-six==1.16.0
+six==1.17.0
     # via python-dateutil
 urllib3==2.2.3
     # via
diff --git a/backend/compact-connect/lambdas/python/common/requirements.txt b/backend/compact-connect/lambdas/python/common/requirements.txt
index e263dd643..a55f9c346 100644
--- a/backend/compact-connect/lambdas/python/common/requirements.txt
+++ b/backend/compact-connect/lambdas/python/common/requirements.txt
@@ -6,9 +6,9 @@
 #
 aws-lambda-powertools==2.43.1
     # via -r compact-connect/lambdas/python/common/requirements.in
-boto3==1.35.67
+boto3==1.35.81
     # via -r compact-connect/lambdas/python/common/requirements.in
-botocore==1.35.67
+botocore==1.35.81
     # via
     #   boto3
     #   s3transfer
@@ -25,7 +25,7 @@ python-dateutil==2.9.0.post0
     # via botocore
 s3transfer==0.10.4
     # via boto3
-six==1.16.0
+six==1.17.0
     # via python-dateutil
 typing-extensions==4.12.2
     # via aws-lambda-powertools
diff --git a/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt b/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt
index c16ab1663..b6b4b61ae 100644
--- a/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt
@@ -4,20 +4,20 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/custom-resources/requirements-dev.in
 #
-boto3==1.35.67
+boto3==1.35.81
     # via moto
-botocore==1.35.67
+botocore==1.35.81
     # via
     #   boto3
     #   moto
     #   s3transfer
-certifi==2024.8.30
+certifi==2024.12.14
     # via requests
 cffi==1.17.1
     # via cryptography
 charset-normalizer==3.4.0
     # via requests
-cryptography==43.0.3
+cryptography==44.0.0
     # via moto
 docker==7.1.0
     # via moto
@@ -33,7 +33,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.21
+moto[dynamodb,s3]==5.0.23
     # via -r compact-connect/lambdas/python/custom-resources/requirements-dev.in
 py-partiql-parser==0.5.6
     # via moto
@@ -56,7 +56,7 @@ responses==0.25.3
     # via moto
 s3transfer==0.10.4
     # via boto3
-six==1.16.0
+six==1.17.0
     # via python-dateutil
 urllib3==2.2.3
     # via
diff --git a/backend/compact-connect/lambdas/python/data-events/requirements-dev.in b/backend/compact-connect/lambdas/python/data-events/requirements-dev.in
index 17377230b..5a61b7b0d 100644
--- a/backend/compact-connect/lambdas/python/data-events/requirements-dev.in
+++ b/backend/compact-connect/lambdas/python/data-events/requirements-dev.in
@@ -1 +1 @@
-moto[s3]>=5.0.12, <6
+moto[dynamodb, s3]>=5.0.12, <6
diff --git a/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt b/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt
index 30fea6d15..023b473c1 100644
--- a/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt
@@ -4,20 +4,22 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/data-events/requirements-dev.in
 #
-boto3==1.35.67
+boto3==1.35.81
     # via moto
-botocore==1.35.67
+botocore==1.35.81
     # via
     #   boto3
     #   moto
     #   s3transfer
-certifi==2024.8.30
+certifi==2024.12.14
     # via requests
 cffi==1.17.1
     # via cryptography
 charset-normalizer==3.4.0
     # via requests
-cryptography==43.0.3
+cryptography==44.0.0
+    # via moto
+docker==7.1.0
     # via moto
 idna==3.10
     # via requests
@@ -31,7 +33,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[s3]==5.0.21
+moto[dynamodb,s3]==5.0.23
     # via -r compact-connect/lambdas/python/data-events/requirements-dev.in
 py-partiql-parser==0.5.6
     # via moto
@@ -47,17 +49,19 @@ pyyaml==6.0.2
     #   responses
 requests==2.32.3
     # via
+    #   docker
     #   moto
     #   responses
 responses==0.25.3
     # via moto
 s3transfer==0.10.4
     # via boto3
-six==1.16.0
+six==1.17.0
     # via python-dateutil
 urllib3==2.2.3
     # via
     #   botocore
+    #   docker
     #   requests
     #   responses
 werkzeug==3.1.3
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt b/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt
index f1962dc4e..b2ec3256b 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt
@@ -4,20 +4,20 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/provider-data-v1/requirements-dev.in
 #
-boto3==1.35.67
+boto3==1.35.81
     # via moto
-botocore==1.35.67
+botocore==1.35.81
     # via
     #   boto3
     #   moto
     #   s3transfer
-certifi==2024.8.30
+certifi==2024.12.14
     # via requests
 cffi==1.17.1
     # via cryptography
 charset-normalizer==3.4.0
     # via requests
-cryptography==43.0.3
+cryptography==44.0.0
     # via moto
 docker==7.1.0
     # via moto
@@ -35,7 +35,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.21
+moto[dynamodb,s3]==5.0.23
     # via -r compact-connect/lambdas/python/provider-data-v1/requirements-dev.in
 py-partiql-parser==0.5.6
     # via moto
@@ -59,7 +59,7 @@ responses==0.25.3
     # via moto
 s3transfer==0.10.4
     # via boto3
-six==1.16.0
+six==1.17.0
     # via python-dateutil
 urllib3==2.2.3
     # via
diff --git a/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt b/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
index 9fac71ffd..e2434f27e 100644
--- a/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
@@ -4,20 +4,20 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/purchases/requirements-dev.in
 #
-boto3==1.35.67
+boto3==1.35.81
     # via moto
-botocore==1.35.67
+botocore==1.35.81
     # via
     #   boto3
     #   moto
     #   s3transfer
-certifi==2024.8.30
+certifi==2024.12.14
     # via requests
 cffi==1.17.1
     # via cryptography
 charset-normalizer==3.4.0
     # via requests
-cryptography==43.0.3
+cryptography==44.0.0
     # via moto
 docker==7.1.0
     # via moto
@@ -33,7 +33,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.21
+moto[dynamodb,s3]==5.0.23
     # via -r compact-connect/lambdas/python/purchases/requirements-dev.in
 py-partiql-parser==0.5.6
     # via moto
@@ -56,7 +56,7 @@ responses==0.25.3
     # via moto
 s3transfer==0.10.4
     # via boto3
-six==1.16.0
+six==1.17.0
     # via python-dateutil
 urllib3==2.2.3
     # via
diff --git a/backend/compact-connect/lambdas/python/purchases/requirements.txt b/backend/compact-connect/lambdas/python/purchases/requirements.txt
index 81c409b26..9ee3bb9df 100644
--- a/backend/compact-connect/lambdas/python/purchases/requirements.txt
+++ b/backend/compact-connect/lambdas/python/purchases/requirements.txt
@@ -6,7 +6,7 @@
 #
 authorizenet==1.1.5
     # via -r compact-connect/lambdas/python/purchases/requirements.in
-certifi==2024.8.30
+certifi==2024.12.14
     # via requests
 charset-normalizer==3.4.0
     # via requests
diff --git a/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt b/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt
index 4f112aff9..34d076ebf 100644
--- a/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt
@@ -4,20 +4,20 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.in
 #
-boto3==1.35.67
+boto3==1.35.81
     # via moto
-botocore==1.35.67
+botocore==1.35.81
     # via
     #   boto3
     #   moto
     #   s3transfer
-certifi==2024.8.30
+certifi==2024.12.14
     # via requests
 cffi==1.17.1
     # via cryptography
 charset-normalizer==3.4.0
     # via requests
-cryptography==43.0.3
+cryptography==44.0.0
     # via moto
 docker==7.1.0
     # via moto
@@ -33,7 +33,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.21
+moto[dynamodb,s3]==5.0.23
     # via -r compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.in
 py-partiql-parser==0.5.6
     # via moto
@@ -56,7 +56,7 @@ responses==0.25.3
     # via moto
 s3transfer==0.10.4
     # via boto3
-six==1.16.0
+six==1.17.0
     # via python-dateutil
 urllib3==2.2.3
     # via
diff --git a/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt b/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt
index a43c369b8..6d965cef9 100644
--- a/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt
@@ -4,20 +4,20 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/staff-users/requirements-dev.in
 #
-boto3==1.35.67
+boto3==1.35.81
     # via moto
-botocore==1.35.67
+botocore==1.35.81
     # via
     #   boto3
     #   moto
     #   s3transfer
-certifi==2024.8.30
+certifi==2024.12.14
     # via requests
 cffi==1.17.1
     # via cryptography
 charset-normalizer==3.4.0
     # via requests
-cryptography==43.0.3
+cryptography==44.0.0
     # via
     #   joserfc
     #   moto
@@ -33,13 +33,13 @@ jmespath==1.0.1
     # via
     #   boto3
     #   botocore
-joserfc==1.0.0
+joserfc==1.0.1
     # via moto
 markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[cognitoidp,dynamodb,s3]==5.0.21
+moto[cognitoidp,dynamodb,s3]==5.0.23
     # via -r compact-connect/lambdas/python/staff-users/requirements-dev.in
 py-partiql-parser==0.5.6
     # via moto
@@ -63,7 +63,7 @@ responses==0.25.3
     # via moto
 s3transfer==0.10.4
     # via boto3
-six==1.16.0
+six==1.17.0
     # via python-dateutil
 urllib3==2.2.3
     # via
diff --git a/backend/compact-connect/requirements-dev.txt b/backend/compact-connect/requirements-dev.txt
index a4dbea512..8ac650471 100644
--- a/backend/compact-connect/requirements-dev.txt
+++ b/backend/compact-connect/requirements-dev.txt
@@ -12,13 +12,13 @@ cachecontrol[filecache]==0.14.1
     # via
     #   cachecontrol
     #   pip-audit
-certifi==2024.8.30
+certifi==2024.12.14
     # via requests
 charset-normalizer==3.4.0
     # via requests
 click==8.1.7
     # via pip-tools
-coverage[toml]==7.6.7
+coverage[toml]==7.6.9
     # via
     #   -r compact-connect/requirements-dev.in
     #   pytest-cov
@@ -72,7 +72,7 @@ pyproject-hooks==1.2.0
     # via
     #   build
     #   pip-tools
-pytest==8.3.3
+pytest==8.3.4
     # via
     #   -r compact-connect/requirements-dev.in
     #   pytest-cov
@@ -86,9 +86,9 @@ requests==2.32.3
     #   pip-audit
 rich==13.9.4
     # via pip-audit
-ruff==0.7.4
+ruff==0.8.3
     # via -r compact-connect/requirements-dev.in
-six==1.16.0
+six==1.17.0
     # via
     #   html5lib
     #   python-dateutil
@@ -100,7 +100,7 @@ urllib3==2.2.3
     # via requests
 webencodings==0.5.1
     # via html5lib
-wheel==0.45.0
+wheel==0.45.1
     # via pip-tools
 
 # The following packages are considered to be unsafe in a requirements file:
diff --git a/backend/compact-connect/requirements.txt b/backend/compact-connect/requirements.txt
index dc3d575f6..974b1c450 100644
--- a/backend/compact-connect/requirements.txt
+++ b/backend/compact-connect/requirements.txt
@@ -4,28 +4,28 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/requirements.in
 #
-attrs==24.2.0
+attrs==24.3.0
     # via
     #   cattrs
     #   jsii
-aws-cdk-asset-awscli-v1==2.2.212
+aws-cdk-asset-awscli-v1==2.2.215
     # via aws-cdk-lib
 aws-cdk-asset-kubectl-v20==2.1.3
     # via aws-cdk-lib
 aws-cdk-asset-node-proxy-agent-v6==2.1.0
     # via aws-cdk-lib
-aws-cdk-aws-lambda-python-alpha==2.169.0a0
+aws-cdk-aws-lambda-python-alpha==2.173.1a0
     # via -r compact-connect/requirements.in
 aws-cdk-cloud-assembly-schema==38.0.1
     # via aws-cdk-lib
-aws-cdk-lib==2.169.0
+aws-cdk-lib==2.173.1
     # via
     #   -r compact-connect/requirements.in
     #   aws-cdk-aws-lambda-python-alpha
     #   cdk-nag
 cattrs==24.1.2
     # via jsii
-cdk-nag==2.34.3
+cdk-nag==2.34.23
     # via -r compact-connect/requirements.in
 constructs==10.4.2
     # via
@@ -60,7 +60,7 @@ python-dateutil==2.9.0.post0
     # via jsii
 pyyaml==6.0.2
     # via -r compact-connect/requirements.in
-six==1.16.0
+six==1.17.0
     # via python-dateutil
 typeguard==2.13.3
     # via
diff --git a/backend/compact-connect/stacks/persistent_stack/provider_users.py b/backend/compact-connect/stacks/persistent_stack/provider_users.py
index eef3444a5..7ddc5d618 100644
--- a/backend/compact-connect/stacks/persistent_stack/provider_users.py
+++ b/backend/compact-connect/stacks/persistent_stack/provider_users.py
@@ -46,23 +46,10 @@ def __init__(
         )
         stack: ps.PersistentStack = ps.PersistentStack.of(self)
 
-        callback_urls = []
-        if stack.ui_domain_name is not None:
-            callback_urls.append(f'https://{stack.ui_domain_name}/auth/callback')
-        # This toggle will allow front-end devs to point their local UI at this environment's user pool to support
-        # authenticated actions.
-        if environment_context.get('allow_local_ui', False):
-            local_ui_port = environment_context.get('local_ui_port', '3018')
-            callback_urls.append(f'http://localhost:{local_ui_port}/auth/callback')
-        if not callback_urls:
-            raise ValueError(
-                "This app requires a callback url for its authentication path. Either provide 'domain_name' or set "
-                "'allow_local_ui' to true in this environment's context."
-            )
-
         # Create an app client to allow the front-end to authenticate.
         self.ui_client = self.add_ui_client(
-            callback_urls=callback_urls,
+            ui_domain_name=stack.ui_domain_name,
+            environment_context=environment_context,
             # For now, we are allowing the user to read and update their email, given name, and family name.
             # we only allow the user to be able to see their providerId and compact, which are custom attributes.
             # If we ever want other attributes to be read or written, they must be added here.
diff --git a/backend/compact-connect/stacks/persistent_stack/staff_users.py b/backend/compact-connect/stacks/persistent_stack/staff_users.py
index d83671b7b..21ea338bb 100644
--- a/backend/compact-connect/stacks/persistent_stack/staff_users.py
+++ b/backend/compact-connect/stacks/persistent_stack/staff_users.py
@@ -57,24 +57,11 @@ def __init__(
         self._add_resource_servers()
         self._add_scope_customization(persistent_stack=stack)
 
-        callback_urls = []
-        if stack.ui_domain_name is not None:
-            callback_urls.append(f'https://{stack.ui_domain_name}/auth/callback')
-        # This toggle will allow front-end devs to point their local UI at this environment's user pool to support
-        # authenticated actions.
-        if environment_context.get('allow_local_ui', False):
-            local_ui_port = environment_context.get('local_ui_port', '3018')
-            callback_urls.append(f'http://localhost:{local_ui_port}/auth/callback')
-        if not callback_urls:
-            raise ValueError(
-                "This app requires a callback url for its authentication path. Either provide 'domain_name' or set "
-                "'allow_local_ui' to true in this environment's context.",
-            )
-
         # Do not allow resource server scopes via the client - they are assigned via token customization
         # to allow for user attribute-based access
         self.ui_client = self.add_ui_client(
-            callback_urls=callback_urls,
+            ui_domain_name=stack.ui_domain_name,
+            environment_context=environment_context,
             # We have to provide one True value or CFn will make every attribute writeable
             write_attributes=ClientAttributes().with_standard_attributes(email=True),
             # We want to limit the attributes that this app can read and write so only email is visible.
diff --git a/backend/multi-account/requirements-dev.txt b/backend/multi-account/requirements-dev.txt
index cc40e19bf..ca859d020 100644
--- a/backend/multi-account/requirements-dev.txt
+++ b/backend/multi-account/requirements-dev.txt
@@ -10,5 +10,5 @@ packaging==24.2
     # via pytest
 pluggy==1.5.0
     # via pytest
-pytest==8.3.3
+pytest==8.3.4
     # via -r multi-account/requirements-dev.in
diff --git a/backend/multi-account/requirements.txt b/backend/multi-account/requirements.txt
index 129b5370c..8095cd239 100644
--- a/backend/multi-account/requirements.txt
+++ b/backend/multi-account/requirements.txt
@@ -4,11 +4,11 @@
 #
 #    pip-compile --no-emit-index-url multi-account/requirements.in
 #
-attrs==24.2.0
+attrs==24.3.0
     # via
     #   cattrs
     #   jsii
-aws-cdk-asset-awscli-v1==2.2.212
+aws-cdk-asset-awscli-v1==2.2.215
     # via aws-cdk-lib
 aws-cdk-asset-kubectl-v20==2.1.3
     # via aws-cdk-lib
@@ -16,7 +16,7 @@ aws-cdk-asset-node-proxy-agent-v6==2.1.0
     # via aws-cdk-lib
 aws-cdk-cloud-assembly-schema==38.0.1
     # via aws-cdk-lib
-aws-cdk-lib==2.169.0
+aws-cdk-lib==2.173.1
     # via -r multi-account/requirements.in
 cattrs==24.1.2
     # via jsii
@@ -45,7 +45,7 @@ publication==0.0.3
     #   jsii
 python-dateutil==2.9.0.post0
     # via jsii
-six==1.16.0
+six==1.17.0
     # via python-dateutil
 typeguard==2.13.3
     # via
diff --git a/webroot/README.md b/webroot/README.md
index 07089c8ad..51fe3adde 100644
--- a/webroot/README.md
+++ b/webroot/README.md
@@ -8,6 +8,7 @@
 - **[Local Development](#local-development)**
 - **[Tests](#tests)**
 - **[Build](#build)**
+- **[Auth](#auth)**
 
 ---
 ## Key
@@ -227,3 +228,26 @@ Note that testing the **built** app locally will require a running web server; f
     - _Otherwise the PWA will get cached and testing a clean state or volatile in-progress work will require lots of manual cache storage clearing._
 
 ---
+## Auth
+- We use two cognito user pools with hosted login pages to authenticate users as Provider users and Staff users respectively
+- Cognito's somewhat opinionated functionality combined with this set up introduces some complexity to make the app function in a secure and expected way
+
+- **Cognito's functionality:**
+    - When a user logs in to Cognito, it saves an http only cookie allowing the user to log back in without entering credentials for an hour
+    - Cognito has no way to totally log a user out except for visiting the hosted logout url in the browser
+        - Using the token revocation endpoint, the user can invalidate their reresh token, but the http only cookie is not removed so if
+        they logged in within the last hour they are not totally logged out
+
+- **Two user pools with their own hosted login pages:**
+    - If a user is logged in to one user pool, they can still log in to the second as they are not aware of each other
+    - The downstream effect of this point is that the app needs to handle users being logged in to both user pools in an expected and secure way:
+        - When a user logs out they must be logged out from all user pools they are logged into
+        - When a user logs in to the second user pool, the app must treat them as only logged into the second user pool
+
+- **How the app handles this situation:**
+    - Firstly, the user being logged into both pools is very unlikely as there is not natural way to do this within the app, they would need to manually visit the
+    second hosted login page after logging in normally to the first
+    - When the user logs in as to the second user pool we record that the app should treat them as the second user type and save the initial access token
+        - When the user logs out we check the existence of the access tokens to see which user pools we need to log out, and then chain logout redirects
+        to visit all necessary logout pages
+---
\ No newline at end of file
diff --git a/webroot/src/app.config.ts b/webroot/src/app.config.ts
index 5b9c358de..ced45d5d5 100644
--- a/webroot/src/app.config.ts
+++ b/webroot/src/app.config.ts
@@ -28,7 +28,6 @@ export enum FeeTypes {
 export const authStorage = sessionStorage;
 export const tokens = {
     staff: {
-        AUTH_TYPE: 'auth_type',
         AUTH_TOKEN: 'auth_token_staff',
         AUTH_TOKEN_TYPE: 'auth_token_type_staff',
         AUTH_TOKEN_EXPIRY: 'auth_token_expiry_staff',
@@ -36,7 +35,6 @@ export const tokens = {
         REFRESH_TOKEN: 'refresh_token_staff',
     },
     licensee: {
-        AUTH_TYPE: 'auth_type',
         AUTH_TOKEN: 'auth_token_licensee',
         AUTH_TOKEN_TYPE: 'auth_token_type_licensee',
         AUTH_TOKEN_EXPIRY: 'auth_token_expiry_licensee',
@@ -45,6 +43,7 @@ export const tokens = {
     },
 };
 export const AUTH_LOGIN_GOTO_PATH = 'login_goto';
+export const AUTH_TYPE = 'auth_type';
 
 // ====================
 // =  User Languages  =
diff --git a/webroot/src/components/App/App.ts b/webroot/src/components/App/App.ts
index d9a92079b..47718cfda 100644
--- a/webroot/src/components/App/App.ts
+++ b/webroot/src/components/App/App.ts
@@ -16,7 +16,7 @@ import {
     authStorage,
     AuthTypes,
     relativeTimeFormats,
-    tokens
+    AUTH_TYPE
 } from '@/app.config';
 import { CompactType } from '@models/Compact/Compact.model';
 import PageContainer from '@components/Page/PageContainer/PageContainer.vue';
@@ -97,9 +97,9 @@ class App extends Vue {
     setAuthType() {
         let authType: AuthTypes;
 
-        if (authStorage.getItem(tokens?.staff?.AUTH_TOKEN)) {
+        if (authStorage.getItem(AUTH_TYPE) === AuthTypes.STAFF) {
             authType = AuthTypes.STAFF;
-        } else if (authStorage.getItem(tokens?.licensee?.AUTH_TOKEN)) {
+        } else if (authStorage.getItem(AUTH_TYPE) === AuthTypes.LICENSEE) {
             authType = AuthTypes.LICENSEE;
         } else {
             authType = AuthTypes.PUBLIC;
@@ -171,10 +171,18 @@ class App extends Vue {
         this.body.style.overflow = (this.globalStore.isModalOpen) ? 'hidden' : 'visible';
     }
 
-    @Watch('userStore.isLoggedIn') async loginState() {
+    @Watch('userStore.isLoggedInAsLicensee') async handleLicenseeLogin() {
         if (!this.userStore.isLoggedIn) {
             this.$router.push({ name: 'Logout' });
-        } else {
+        } else if (this.userStore.isLoggedInAsLicensee) {
+            await this.handleAuth();
+        }
+    }
+
+    @Watch('userStore.isLoggedInAsStaff') async handleStaffLogin() {
+        if (!this.userStore.isLoggedIn) {
+            this.$router.push({ name: 'Logout' });
+        } else if (this.userStore.isLoggedInAsStaff) {
             await this.handleAuth();
         }
     }
diff --git a/webroot/src/components/Page/PageMainNav/PageMainNav.ts b/webroot/src/components/Page/PageMainNav/PageMainNav.ts
index 1e2e4ca15..f98b2a5ea 100644
--- a/webroot/src/components/Page/PageMainNav/PageMainNav.ts
+++ b/webroot/src/components/Page/PageMainNav/PageMainNav.ts
@@ -31,6 +31,14 @@ class PageMainNav extends Vue {
         return !this.isDesktop;
     }
 
+    get globalStore(): any {
+        return this.$store.state;
+    }
+
+    get authType(): string {
+        return this.globalStore.authType;
+    }
+
     get isMainNavVisible(): boolean {
         return this.isDesktop || this.isMainNavToggled;
     }
@@ -48,7 +56,11 @@ class PageMainNav extends Vue {
     }
 
     get isLoggedInAsStaff(): boolean {
-        return this.isLoggedIn && this.$store.getters['user/highestPermissionAuthType']() === AuthTypes.STAFF;
+        return this.authType === AuthTypes.STAFF;
+    }
+
+    get isLoggedInAsLicensee(): boolean {
+        return this.authType === AuthTypes.LICENSEE;
     }
 
     get staffPermission(): CompactPermission | null {
@@ -120,7 +132,7 @@ class PageMainNav extends Vue {
                 to: 'LicenseeDashboard',
                 params: { compact: this.currentCompact?.type },
                 label: computed(() => this.$t('navigation.dashboard')),
-                isEnabled: Boolean(this.currentCompact) && !this.isLoggedInAsStaff,
+                isEnabled: Boolean(this.currentCompact) && this.isLoggedInAsLicensee,
                 isExternal: false,
                 isExactActive: false,
             },
diff --git a/webroot/src/main.ts b/webroot/src/main.ts
index 4eda9a9d4..f031a5e9c 100644
--- a/webroot/src/main.ts
+++ b/webroot/src/main.ts
@@ -26,8 +26,8 @@ const app = createApp(App);
 // Enable vue-devtools. Can make environment-specific if needed.
 app.config.performance = true;
 
-// Inject store into API interceptors (avoids circular dependency)
-network.dataApi.initInterceptors(store);
+// Inject router into API interceptors (avoids circular dependency)
+network.dataApi.initInterceptors(router);
 
 //
 // INJECT PLUGINS
diff --git a/webroot/src/network/data.api.ts b/webroot/src/network/data.api.ts
index 572a6b07d..1ebff2bd1 100644
--- a/webroot/src/network/data.api.ts
+++ b/webroot/src/network/data.api.ts
@@ -14,13 +14,13 @@ import { PaymentProcessorConfig } from '@models/Compact/Compact.model';
 export class DataApi {
     /**
      * Initialize API Axios interceptors with injected store context.
-     * @param {Store} store
+     * @param {Router} router
      */
-    public initInterceptors(store) {
-        stateDataApi.initInterceptors(store);
-        licenseDataApi.initInterceptors(store);
-        userDataApi.initInterceptors(store);
-        exampleDataApi.initInterceptors(store);
+    public initInterceptors(router) {
+        stateDataApi.initInterceptors(router);
+        licenseDataApi.initInterceptors(router);
+        userDataApi.initInterceptors(router);
+        exampleDataApi.initInterceptors(router);
     }
 
     // ========================================================================
diff --git a/webroot/src/network/exampleApi/interceptors.ts b/webroot/src/network/exampleApi/interceptors.ts
index 5f5bbb145..cbd3af6c4 100644
--- a/webroot/src/network/exampleApi/interceptors.ts
+++ b/webroot/src/network/exampleApi/interceptors.ts
@@ -6,7 +6,6 @@
 //
 
 import { config } from '@plugins/EnvConfig/envConfig.plugin';
-import { createResponseMessage } from '@network/helpers';
 
 // ============================================================================
 // =                           REQUEST INTERCEPTORS                           =
@@ -49,10 +48,10 @@ export const responseSuccess = () => (response) => {
 
 /**
  * Get Axios API response error interceptor.
- * @param  {Store} store      The app store context.
+ * @param  {Router} router      The vue router
  * @return {AxiosInterceptor} Function that extracts the incoming server API response (from within the Axios response wrapper).
  */
-export const responseError = (store) => (error) => {
+export const responseError = (router) => (error) => {
     const axiosResponse = error.response;
     let serverResponse = (axiosResponse) ? axiosResponse.data : null;
 
@@ -62,7 +61,7 @@ export const responseError = (store) => (error) => {
 
         switch (axiosResponse.status) {
         case 401:
-            store.dispatch('user/logoutRequest');
+            router.push({ name: 'Logout' });
             break;
         case 404: // Endpoint / object not found
             // Continue
@@ -70,7 +69,7 @@ export const responseError = (store) => (error) => {
             // We won't dispatch a UI alert, just let the components handle missing store data as appropriate
             break;
         default:
-            store.dispatch('addMessage', createResponseMessage(axiosResponse));
+            // Continue
         }
     } else {
         // API unavailable
diff --git a/webroot/src/network/licenseApi/interceptors.ts b/webroot/src/network/licenseApi/interceptors.ts
index 19d8731f0..130e448b5 100644
--- a/webroot/src/network/licenseApi/interceptors.ts
+++ b/webroot/src/network/licenseApi/interceptors.ts
@@ -46,10 +46,10 @@ export const responseSuccess = () => (response) => {
 
 /**
  * Get Axios API response error interceptor.
- * @param  {Store} store      The app store context.
+ * @param  {Router} router      The vue router
  * @return {AxiosInterceptor} Function that extracts the incoming server API response (from within the Axios response wrapper).
  */
-export const responseError = (store) => (error) => {
+export const responseError = (router) => (error) => {
     const axiosResponse = error.response;
     let serverResponse = (axiosResponse) ? axiosResponse.data : null;
 
@@ -59,7 +59,7 @@ export const responseError = (store) => (error) => {
 
         switch (axiosResponse.status) {
         case 401:
-            store.dispatch('user/logoutRequest');
+            router.push({ name: 'Logout' });
             break;
         default:
             // Continue
diff --git a/webroot/src/network/stateApi/interceptors.ts b/webroot/src/network/stateApi/interceptors.ts
index 19d8731f0..130e448b5 100644
--- a/webroot/src/network/stateApi/interceptors.ts
+++ b/webroot/src/network/stateApi/interceptors.ts
@@ -46,10 +46,10 @@ export const responseSuccess = () => (response) => {
 
 /**
  * Get Axios API response error interceptor.
- * @param  {Store} store      The app store context.
+ * @param  {Router} router      The vue router
  * @return {AxiosInterceptor} Function that extracts the incoming server API response (from within the Axios response wrapper).
  */
-export const responseError = (store) => (error) => {
+export const responseError = (router) => (error) => {
     const axiosResponse = error.response;
     let serverResponse = (axiosResponse) ? axiosResponse.data : null;
 
@@ -59,7 +59,7 @@ export const responseError = (store) => (error) => {
 
         switch (axiosResponse.status) {
         case 401:
-            store.dispatch('user/logoutRequest');
+            router.push({ name: 'Logout' });
             break;
         default:
             // Continue
diff --git a/webroot/src/network/userApi/interceptors.ts b/webroot/src/network/userApi/interceptors.ts
index 98aac622f..89fb80646 100644
--- a/webroot/src/network/userApi/interceptors.ts
+++ b/webroot/src/network/userApi/interceptors.ts
@@ -61,10 +61,10 @@ export const responseSuccess = () => (response) => {
 
 /**
  * Get Axios API response error interceptor.
- * @param  {Store} store      The app store context.
+ * @param  {Router} router      The vue router
  * @return {AxiosInterceptor} Function that extracts the incoming server API response (from within the Axios response wrapper).
  */
-export const responseError = (store) => (error) => {
+export const responseError = (router) => (error) => {
     const axiosResponse = error.response;
     let serverResponse;
 
@@ -74,7 +74,7 @@ export const responseError = (store) => (error) => {
 
         switch (axiosResponse.status) {
         case 401:
-            store.dispatch('user/logoutRequest');
+            router.push({ name: 'Logout' });
             break;
         default:
             // Continue
diff --git a/webroot/src/pages/AuthCallback/AuthCallback.ts b/webroot/src/pages/AuthCallback/AuthCallback.ts
index fa4c7dccd..5e7905626 100644
--- a/webroot/src/pages/AuthCallback/AuthCallback.ts
+++ b/webroot/src/pages/AuthCallback/AuthCallback.ts
@@ -103,8 +103,8 @@ export default class AuthCallback extends Vue {
 
         const { data } = await axios.post(`${cognitoAuthDomainStaff}/oauth2/token`, params);
 
-        await this.$store.dispatch('user/storeAuthTokens', { tokenResponse: data, authType: AuthTypes.STAFF });
-        await this.$store.dispatch('user/loginSuccess');
+        await this.$store.dispatch('user/updateAuthTokens', { tokenResponse: data, authType: AuthTypes.STAFF });
+        await this.$store.dispatch('user/loginSuccess', AuthTypes.STAFF);
     }
 
     async getTokensLicensee(): Promise<void> {
@@ -118,8 +118,8 @@ export default class AuthCallback extends Vue {
 
         const { data } = await axios.post(`${cognitoAuthDomainLicensee}/oauth2/token`, params);
 
-        await this.$store.dispatch('user/storeAuthTokens', { tokenResponse: data, authType: AuthTypes.LICENSEE });
-        await this.$store.dispatch('user/loginSuccess');
+        await this.$store.dispatch('user/updateAuthTokens', { tokenResponse: data, authType: AuthTypes.LICENSEE });
+        await this.$store.dispatch('user/loginSuccess', AuthTypes.LICENSEE);
     }
 
     async redirectUser(): Promise<void> {
diff --git a/webroot/src/pages/Home/Home.ts b/webroot/src/pages/Home/Home.ts
index dbbda23d6..aaa550999 100644
--- a/webroot/src/pages/Home/Home.ts
+++ b/webroot/src/pages/Home/Home.ts
@@ -12,7 +12,7 @@ import {
     toNative
 } from 'vue-facing-decorator';
 import { Compact } from '@models/Compact/Compact.model';
-import { AuthTypes } from '@/app.config';
+import { AuthTypes, authStorage, AUTH_TYPE } from '@/app.config';
 
 @Component({
     name: 'HomePage',
@@ -41,7 +41,7 @@ class Home extends Vue {
 
         if (currentCompact) {
             const compactType = currentCompact.type;
-            const authType = this.$store.getters['user/highestPermissionAuthType']();
+            const authType = authStorage.getItem(AUTH_TYPE);
 
             if (authType === AuthTypes.STAFF) {
                 this.$router.push({ name: 'Licensing', params: { compact: compactType }});
diff --git a/webroot/src/pages/Login/Login.ts b/webroot/src/pages/Login/Login.ts
index bf36b7ed2..c981e2be2 100644
--- a/webroot/src/pages/Login/Login.ts
+++ b/webroot/src/pages/Login/Login.ts
@@ -7,10 +7,13 @@
 
 import { Component, Vue } from 'vue-facing-decorator';
 import { AuthTypes } from '@/app.config';
+import InputButton from '@components/Forms/InputButton/InputButton.vue';
 
 @Component({
     name: 'Login',
-    components: {}
+    components: {
+        InputButton
+    }
 })
 export default class Login extends Vue {
     //
@@ -58,10 +61,44 @@ export default class Login extends Vue {
         return loginUri;
     }
 
+    get isUsingMockApi(): boolean {
+        return this.$envConfig.isUsingMockApi || false;
+    }
+
     //
     // Methods
     //
     redirectToHostedLogin(): void {
         window.location.replace(this.hostedLoginUriStaff);
     }
+
+    async mockStaffLogin(): Promise<void> {
+        const data = {
+            access_token: 'mock_access_token',
+            token_type: 'Bearer',
+            expires_in: '100000000',
+            id_token: 'mock_id_token',
+            refresh_token: 'mock_refresh_token'
+        };
+
+        await this.$store.dispatch('user/updateAuthTokens', { tokenResponse: data, authType: AuthTypes.STAFF });
+        this.$store.dispatch('user/loginSuccess', AuthTypes.STAFF);
+
+        this.$router.push({ name: 'Home' });
+    }
+
+    async mockLicenseeLogin(): Promise<void> {
+        const data = {
+            access_token: 'mock_access_token',
+            token_type: 'Bearer',
+            expires_in: '100000000',
+            id_token: 'mock_id_token',
+            refresh_token: 'mock_refresh_token'
+        };
+
+        await this.$store.dispatch('user/updateAuthTokens', { tokenResponse: data, authType: AuthTypes.LICENSEE });
+        this.$store.dispatch('user/loginSuccess', AuthTypes.LICENSEE);
+
+        this.$router.push({ name: 'Home' });
+    }
 }
diff --git a/webroot/src/pages/Login/Login.vue b/webroot/src/pages/Login/Login.vue
index 6d5152a32..e90953cd7 100644
--- a/webroot/src/pages/Login/Login.vue
+++ b/webroot/src/pages/Login/Login.vue
@@ -6,7 +6,7 @@
 -->
 
 <template>
-    <div class="login-container">
+    <div v-if="!isUsingMockApi" class="login-container">
         <a
             :href="hostedLoginUriStaff"
             class="login-link"
@@ -20,6 +20,20 @@
             Login as Provider
         </a>
     </div>
+    <div v-else class="login-container">
+        <InputButton
+            label="Mock Staff Login"
+            aria-label="Mock Login"
+            :isTextLike="true"
+            @click="mockStaffLogin"
+        />
+        <InputButton
+            label="Mock Licensee Login"
+            aria-label="Mock Licensee Login"
+            :isTextLike="true"
+            @click="mockLicenseeLogin"
+        />
+    </div>
 </template>
 
 <script lang="ts" src="./Login.ts"></script>
diff --git a/webroot/src/pages/Logout/Logout.ts b/webroot/src/pages/Logout/Logout.ts
index 613e0c864..6b867e400 100644
--- a/webroot/src/pages/Logout/Logout.ts
+++ b/webroot/src/pages/Logout/Logout.ts
@@ -6,7 +6,12 @@
 //
 
 import { Component, Vue } from 'vue-facing-decorator';
-import { authStorage, AuthTypes, AUTH_LOGIN_GOTO_PATH } from '@/app.config';
+import {
+    authStorage,
+    AUTH_LOGIN_GOTO_PATH,
+    AuthTypes,
+    tokens
+} from '@/app.config';
 
 @Component({
     name: 'Logout',
@@ -33,54 +38,59 @@ export default class Logout extends Vue {
 
     get hostedLogoutUriStaff(): string {
         const { domain, cognitoAuthDomainStaff, cognitoClientIdStaff } = this.$envConfig;
-        const loginScopes = 'email openid phone profile aws.cognito.signin.user.admin';
-        const loginResponseType = 'code';
-        const loginRedirectPath = '/auth/callback';
-        const loginUriQuery = [
+        const logoutLink = encodeURIComponent(`${(domain as string)}/Logout`);
+        const logoutUriQuery = [
             `?client_id=${cognitoClientIdStaff}`,
-            `&response_type=${loginResponseType}`,
-            `&scope=${encodeURIComponent(loginScopes)}`,
-            `&state=${AuthTypes.STAFF}`,
-            `&redirect_uri=${encodeURIComponent(`${domain}${loginRedirectPath}`)}`,
+            `&logout_uri=${logoutLink}`
         ].join('');
         const idpPath = '/logout';
-        const loginUri = `${cognitoAuthDomainStaff}${idpPath}${loginUriQuery}`;
+        const logoutUri = `${cognitoAuthDomainStaff}${idpPath}${logoutUriQuery}`;
 
-        return loginUri;
+        return logoutUri;
+    }
+
+    get loginURL(): string {
+        const { domain } = this.$envConfig;
+
+        return `${(domain as string)}/Login`;
     }
 
     get hostedLogoutUriLicensee(): string {
-        const { domain, cognitoAuthDomainLicensee, cognitoClientIdLicensee } = this.$envConfig;
-        const loginScopes = 'email openid phone profile aws.cognito.signin.user.admin';
-        const loginResponseType = 'code';
-        const loginRedirectPath = '/auth/callback';
-        const loginUriQuery = [
+        const { cognitoAuthDomainLicensee, cognitoClientIdLicensee } = this.$envConfig;
+        const logoutUriQuery = [
             `?client_id=${cognitoClientIdLicensee}`,
-            `&response_type=${loginResponseType}`,
-            `&scope=${encodeURIComponent(loginScopes)}`,
-            `&state=${AuthTypes.LICENSEE}`,
-            `&redirect_uri=${encodeURIComponent(`${domain}${loginRedirectPath}`)}`,
+            `&logout_uri=${encodeURIComponent(this.loginURL)}`
         ].join('');
         const idpPath = '/logout';
-        const loginUri = `${cognitoAuthDomainLicensee}${idpPath}${loginUriQuery}`;
+        const logoutUri = `${cognitoAuthDomainLicensee}${idpPath}${logoutUriQuery}`;
 
-        return loginUri;
+        return logoutUri;
+    }
+
+    get isLoggedIn(): boolean {
+        return this.userStore.isLoggedIn;
     }
 
     //
     // Methods
     //
     async logout(): Promise<void> {
-        const isLoggedInAsLicenseeOnly = this.$store.getters['user/highestPermissionAuthType']() === AuthTypes.LICENSEE;
+        if (this.isLoggedIn) {
+            const isRemoteLoggedInAsLicenseeOnly = !authStorage.getItem(tokens.staff.AUTH_TOKEN);
 
-        await this.logoutChecklist();
-        this.redirectToHighestPermissionHostedLogout(isLoggedInAsLicenseeOnly);
+            await this.logoutChecklist(isRemoteLoggedInAsLicenseeOnly);
+            this.beginLogoutRedirectChain(isRemoteLoggedInAsLicenseeOnly);
+        } else {
+            window.location.replace(this.loginURL);
+        }
     }
 
-    async logoutChecklist(): Promise<void> {
+    async logoutChecklist(isRemoteLoggedInAsLicenseeOnly): Promise<void> {
+        const authType = isRemoteLoggedInAsLicenseeOnly ? AuthTypes.LICENSEE : AuthTypes.STAFF;
+
         this.$store.dispatch('user/clearRefreshTokenTimeout');
         this.stashWorkingUri();
-        await this.$store.dispatch('user/logoutRequest', this.$store.getters['user/highestPermissionAuthType']());
+        await this.$store.dispatch('user/logoutRequest', authType);
     }
 
     stashWorkingUri(): void {
@@ -91,10 +101,10 @@ export default class Logout extends Vue {
         }
     }
 
-    redirectToHighestPermissionHostedLogout(isLoggedInAsLicenseeOnly): void {
+    beginLogoutRedirectChain(isRemoteLoggedInAsLicenseeOnly): void {
         let logOutUrl = this.hostedLogoutUriStaff;
 
-        if (isLoggedInAsLicenseeOnly) {
+        if (isRemoteLoggedInAsLicenseeOnly) {
             logOutUrl = this.hostedLogoutUriLicensee;
         }
 
diff --git a/webroot/src/router/index.ts b/webroot/src/router/index.ts
index bc7e17e21..a23234c38 100644
--- a/webroot/src/router/index.ts
+++ b/webroot/src/router/index.ts
@@ -8,6 +8,7 @@
 import { createRouter, createWebHistory, RouteLocationNormalized as Route } from 'vue-router';
 import routes from '@router/routes';
 import store from '@/store';
+import { authStorage, AUTH_TYPE, AuthTypes } from '@/app.config';
 import { CompactSerializer } from '@models/Compact/Compact.model';
 
 const router = createRouter({
@@ -29,6 +30,8 @@ const router = createRouter({
 
 router.beforeEach(async (to, from, next) => {
     const isAuthGuardedRoute = to.matched.some((route) => route.meta.requiresAuth);
+    const isLicenseeRoute = to.matched.some((route) => route.meta.licenseeAccess);
+    const isStaffRoute = to.matched.some((route) => route.meta.staffAccess);
     const routeParamCompactType = to.params?.compact;
 
     // If the store does not have the requested compact, set it from the route (e.g. page refreshes)
@@ -46,8 +49,12 @@ router.beforeEach(async (to, from, next) => {
 
         if (!isLoggedIn) {
             next({ name: 'Logout' });
-        } else {
+        } else if ((isLicenseeRoute && isStaffRoute)
+        || (isLicenseeRoute && authStorage.getItem(AUTH_TYPE) === AuthTypes.LICENSEE)
+        || (isStaffRoute && authStorage.getItem(AUTH_TYPE) === AuthTypes.STAFF)) {
             next();
+        } else {
+            next({ name: 'Home' });
         }
     } else {
         next();
diff --git a/webroot/src/router/routes.ts b/webroot/src/router/routes.ts
index b16d3c4ab..42b873db5 100644
--- a/webroot/src/router/routes.ts
+++ b/webroot/src/router/routes.ts
@@ -36,73 +36,73 @@ const routes: Array<RouteConfig> = [
         path: '/Home',
         name: 'Home',
         component: () => import(/* webpackChunkName: "home" */ '@pages/Home/Home.vue'),
-        meta: { requiresAuth: true },
+        meta: { requiresAuth: true, licenseeAccess: true, staffAccess: true },
     },
     {
         path: '/Account',
         name: 'Account',
         component: () => import(/* webpackChunkName: "home" */ '@pages/Account/Account.vue'),
-        meta: { requiresAuth: true },
+        meta: { requiresAuth: true, licenseeAccess: true, staffAccess: true },
     },
     {
         path: '/:compact/Licensing',
         name: 'Licensing',
         component: () => import(/* webpackChunkName: "licensing" */ '@pages/LicensingList/LicensingList.vue'),
-        meta: { requiresAuth: true },
+        meta: { requiresAuth: true, staffAccess: true },
     },
     {
         path: '/:compact/Licensing/:licenseeId',
         name: 'LicensingDetail',
         component: () => import(/* webpackChunkName: "licensing" */ '@pages/LicensingDetail/LicensingDetail.vue'),
-        meta: { requiresAuth: true },
+        meta: { requiresAuth: true, staffAccess: true },
     },
     {
         path: '/:compact/Settings',
         name: 'CompactSettings',
         component: () => import(/* webpackChunkName: "licensing" */ '@pages/CompactSettings/CompactSettings.vue'),
-        meta: { requiresAuth: true },
+        meta: { requiresAuth: true, staffAccess: true },
     },
     {
         path: '/:compact/StateUpload',
         name: 'StateUpload',
         component: () => import(/* webpackChunkName: "upload" */ '@pages/StateUpload/StateUpload.vue'),
-        meta: { requiresAuth: true },
+        meta: { requiresAuth: true, staffAccess: true },
     },
     {
         path: '/:compact/Users',
         name: 'Users',
         component: () => import(/* webpackChunkName: "users" */ '@pages/UserList/UserList.vue'),
-        meta: { requiresAuth: true },
+        meta: { requiresAuth: true, staffAccess: true },
     },
     {
         path: '/:compact/LicenseeDashboard',
         name: 'LicenseeDashboard',
         component: () => import(/* webpackChunkName: "licenseeDashboard" */ '@pages/LicenseeDashboard/LicenseeDashboard.vue'),
-        meta: { requiresAuth: true },
+        meta: { requiresAuth: true, licenseeAccess: true, },
     },
     {
         path: '/:compact/Privileges/SelectPrivileges',
         name: 'SelectPrivileges',
         component: () => import(/* webpackChunkName: "privilegePurchase" */ '@pages/SelectPrivileges/SelectPrivileges.vue'),
-        meta: { requiresAuth: true },
+        meta: { requiresAuth: true, licenseeAccess: true, },
     },
     {
         path: '/:compact/Privileges/FinalizePurchase',
         name: 'FinalizePrivilegePurchase',
         component: () => import(/* webpackChunkName: "privilegePurchase" */ '@pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.vue'),
-        meta: { requiresAuth: true },
+        meta: { requiresAuth: true, licenseeAccess: true, },
     },
     {
         path: '/:compact/Privileges/PurchaseSuccessful',
         name: 'PurchaseSuccessful',
         component: () => import(/* webpackChunkName: "privilegePurchase" */ '@pages/PurchaseSuccessful/PurchaseSuccessful.vue'),
-        meta: { requiresAuth: true },
+        meta: { requiresAuth: true, licenseeAccess: true, },
     },
     {
         path: '/:compact/Privileges/Attestation',
         name: 'PrivilegePurchaseAttestation',
         component: () => import(/* webpackChunkName: "privilegePurchase" */ '@pages/PrivilegePurchaseAttestation/PrivilegePurchaseAttestation.vue'),
-        meta: { requiresAuth: true },
+        meta: { requiresAuth: true, licenseeAccess: true, },
     },
     {
         path: '/styleguide',
diff --git a/webroot/src/store/user/user.actions.ts b/webroot/src/store/user/user.actions.ts
index 1ecd28cb0..e07cf3960 100644
--- a/webroot/src/store/user/user.actions.ts
+++ b/webroot/src/store/user/user.actions.ts
@@ -7,7 +7,12 @@
 
 import { dataApi } from '@network/data.api';
 import { config } from '@plugins/EnvConfig/envConfig.plugin';
-import { authStorage, AuthTypes, tokens } from '@/app.config';
+import {
+    authStorage,
+    AuthTypes,
+    tokens,
+    AUTH_TYPE
+} from '@/app.config';
 import localStorage from '@store/local.storage';
 import { Compact } from '@models/Compact/Compact.model';
 import moment from 'moment';
@@ -25,8 +30,8 @@ export default {
     loginRequest: ({ commit }) => {
         commit(MutationTypes.LOGIN_REQUEST);
     },
-    loginSuccess: async ({ commit }) => {
-        commit(MutationTypes.LOGIN_SUCCESS);
+    loginSuccess: async ({ commit }, authType) => {
+        commit(MutationTypes.LOGIN_SUCCESS, authType);
     },
     loginFailure: async ({ commit }, error: Error) => {
         commit(MutationTypes.LOGIN_FAILURE, error);
@@ -99,6 +104,10 @@ export default {
     resetStoreUser: ({ commit }) => {
         commit(MutationTypes.STORE_RESET_USER);
     },
+    updateAuthTokens: ({ dispatch }, { tokenResponse, authType }) => {
+        dispatch('clearAllNonAccessTokens');
+        dispatch('storeAuthTokens', { tokenResponse, authType });
+    },
     storeAuthTokens: ({ dispatch }, { tokenResponse, authType }) => {
         const {
             access_token: accessToken,
@@ -108,7 +117,7 @@ export default {
             refresh_token: refreshToken,
         } = tokenResponse || {};
 
-        authStorage.setItem(tokens[authType].AUTH_TYPE, authType);
+        authStorage.setItem(AUTH_TYPE, authType);
 
         if (accessToken) {
             authStorage.setItem(tokens[authType].AUTH_TOKEN, accessToken);
@@ -192,7 +201,26 @@ export default {
         dispatch('sorting/resetStoreSorting', null, { root: true });
         dispatch('reset', null, { root: true });
     },
+    clearAllNonAccessTokens: () => {
+        authStorage.removeItem(AUTH_TYPE);
+
+        /* istanbul ignore next */
+        Object.keys(tokens[AuthTypes.STAFF]).forEach((key) => {
+            if (key !== 'AUTH_TOKEN') {
+                authStorage.removeItem(tokens[AuthTypes.STAFF][key]);
+            }
+        });
+
+        /* istanbul ignore next */
+        Object.keys(tokens[AuthTypes.LICENSEE]).forEach((key) => {
+            if (key !== 'AUTH_TOKEN') {
+                authStorage.removeItem(tokens[AuthTypes.LICENSEE][key]);
+            }
+        });
+    },
     clearAuthToken: (def, authType) => {
+        authStorage.removeItem(AUTH_TYPE);
+
         /* istanbul ignore next */
         Object.keys(tokens[authType]).forEach((key) => {
             authStorage.removeItem(tokens[authType][key]);
diff --git a/webroot/src/store/user/user.getters.ts b/webroot/src/store/user/user.getters.ts
index 61d06560e..745e1d4b6 100644
--- a/webroot/src/store/user/user.getters.ts
+++ b/webroot/src/store/user/user.getters.ts
@@ -4,20 +4,8 @@
 //
 //  Created by InspiringApps on 4/12/20.
 //
-import { authStorage, AuthTypes, tokens } from '@/app.config';
 
 export default {
     state: (state: any) => state,
     currentCompact: (state: any) => state.currentCompact,
-    highestPermissionAuthType: () => () => {
-        let loggedInAsType = '';
-
-        if (authStorage.getItem(tokens[AuthTypes.STAFF]?.AUTH_TOKEN)) {
-            loggedInAsType = AuthTypes.STAFF;
-        } else if (authStorage.getItem(tokens[AuthTypes.LICENSEE]?.AUTH_TOKEN)) {
-            loggedInAsType = AuthTypes.LICENSEE;
-        }
-
-        return loggedInAsType;
-    },
 };
diff --git a/webroot/src/store/user/user.mutations.ts b/webroot/src/store/user/user.mutations.ts
index 82b3ebe6e..dff6846a7 100644
--- a/webroot/src/store/user/user.mutations.ts
+++ b/webroot/src/store/user/user.mutations.ts
@@ -7,6 +7,7 @@
 import { Compact } from '@models/Compact/Compact.model';
 import { LicenseeUser } from '@/models/LicenseeUser/LicenseeUser.model';
 import { StaffUser } from '@/models/StaffUser/StaffUser.model';
+import { AuthTypes } from '@/app.config';
 
 export enum MutationTypes {
     LOGIN_REQUEST = '[User] Login Request',
@@ -45,8 +46,10 @@ export default {
         state.isLoadingAccount = false;
         state.error = error;
     },
-    [MutationTypes.LOGIN_SUCCESS]: (state: any) => {
+    [MutationTypes.LOGIN_SUCCESS]: (state: any, authType: AuthTypes) => {
         state.isLoggedIn = true;
+        state.isLoggedInAsLicensee = Boolean(authType === AuthTypes.LICENSEE);
+        state.isLoggedInAsStaff = Boolean(authType === AuthTypes.STAFF);
         state.isLoadingAccount = false;
         state.error = null;
     },
diff --git a/webroot/src/store/user/user.spec.ts b/webroot/src/store/user/user.spec.ts
index e204963f1..18fc38519 100644
--- a/webroot/src/store/user/user.spec.ts
+++ b/webroot/src/store/user/user.spec.ts
@@ -5,7 +5,12 @@
 //  Created by InspiringApps on 6/12/24.
 //
 
-import { authStorage, tokens, FeeTypes } from '@/app.config';
+import {
+    authStorage,
+    tokens,
+    FeeTypes,
+    AuthTypes
+} from '@/app.config';
 import chaiMatchPattern from 'chai-match-pattern';
 import chai from 'chai';
 import { Compact } from '@models/Compact/Compact.model';
@@ -13,7 +18,6 @@ import { PrivilegePurchaseOption } from '@models/PrivilegePurchaseOption/Privile
 import { State } from '@models/State/State.model';
 import mutations, { MutationTypes } from './user.mutations';
 import actions from './user.actions';
-import getters from './user.getters';
 
 chai.use(chaiMatchPattern);
 const sinon = require('sinon');
@@ -41,10 +45,12 @@ describe('Use Store Mutations', () => {
     it('should successfully get login success', () => {
         const state = {};
 
-        mutations[MutationTypes.LOGIN_SUCCESS](state);
+        mutations[MutationTypes.LOGIN_SUCCESS](state, AuthTypes.LICENSEE);
 
         expect(state.isLoadingAccount).to.equal(false);
         expect(state.isLoggedIn).to.equal(true);
+        expect(state.isLoggedInAsLicensee).to.equal(true);
+        expect(state.isLoggedInAsStaff).to.equal(false);
         expect(state.error).to.equal(null);
     });
     it('should successfully get login reset', () => {
@@ -169,10 +175,10 @@ describe('User Store Actions', async () => {
         const commit = sinon.spy();
         const dispatch = sinon.spy();
 
-        await actions.loginSuccess({ commit, dispatch });
+        await actions.loginSuccess({ commit, dispatch }, AuthTypes.LICENSEE);
 
         expect(commit.calledOnce).to.equal(true);
-        expect(commit.firstCall.args).to.matchPattern([MutationTypes.LOGIN_SUCCESS]);
+        expect(commit.firstCall.args).to.matchPattern([MutationTypes.LOGIN_SUCCESS, AuthTypes.LICENSEE]);
         expect(dispatch.calledOnce).to.equal(false);
     });
     it('should successfully start login failure', () => {
@@ -349,19 +355,9 @@ describe('User Store Actions', async () => {
         expect(commit.calledOnce).to.equal(true);
         expect(commit.firstCall.args).to.matchPattern([MutationTypes.SET_REFRESH_TIMEOUT_ID, null]);
     });
-    it('should successfully clear session stores', () => {
-        const dispatch = sinon.spy();
-
-        actions.clearSessionStores({ dispatch });
-
-        expect(dispatch.callCount).to.equal(5);
-    });
-    it('should successfully use the authType getter for licensee auth', () => {
+    it('should successfully clear and update auth tokens by clearing existing ones except for auth token, then storing', () => {
         const dispatch = sinon.spy();
-
-        authStorage.removeItem(tokens.staff.AUTH_TOKEN);
-
-        const authType = 'licensee';
+        const authType = 'staff';
 
         const tokenResponse = {
             access_token: 'test_access_token',
@@ -371,34 +367,17 @@ describe('User Store Actions', async () => {
             refresh_token: 'test_refresh_token',
         };
 
-        actions.storeAuthTokens({ dispatch }, { tokenResponse, authType });
+        actions.updateAuthTokens({ dispatch }, { tokenResponse, authType });
 
-        const authTypeReturned = getters.highestPermissionAuthType()();
-
-        expect(authTypeReturned).to.equal('licensee');
+        expect(dispatch.callCount).to.equal(2);
     });
-    it('should successfully use the authType getter for staff auth', () => {
+    it('should successfully clear session stores', () => {
         const dispatch = sinon.spy();
 
-        const authType = 'staff';
-
-        authStorage.removeItem(tokens.licensee.AUTH_TOKEN);
-
-        const tokenResponse = {
-            access_token: 'test_access_token',
-            token_type: 'test_token_type',
-            expires_in: 1,
-            id_token: 'test_id_token',
-            refresh_token: 'test_refresh_token',
-        };
-
-        actions.storeAuthTokens({ dispatch }, { tokenResponse, authType });
-
-        const authTypeReturned = getters.highestPermissionAuthType()();
+        actions.clearSessionStores({ dispatch });
 
-        expect(authTypeReturned).to.equal('staff');
+        expect(dispatch.callCount).to.equal(5);
     });
-
     it('should successfully start get privilege purchase information request', () => {
         const commit = sinon.spy();
         const dispatch = sinon.spy();
diff --git a/webroot/src/store/user/user.state.ts b/webroot/src/store/user/user.state.ts
index 85f52d87e..0fb510518 100644
--- a/webroot/src/store/user/user.state.ts
+++ b/webroot/src/store/user/user.state.ts
@@ -8,11 +8,18 @@
 import { LicenseeUser } from '@models/LicenseeUser/LicenseeUser.model';
 import { StaffUser } from '@models/StaffUser/StaffUser.model';
 import { Compact } from '@models/Compact/Compact.model';
-import { authStorage, tokens } from '@/app.config';
+import {
+    authStorage,
+    tokens,
+    AuthTypes,
+    AUTH_TYPE
+} from '@/app.config';
 
 export interface State {
     model: StaffUser | LicenseeUser | null;
     isLoggedIn: boolean;
+    isLoggedInAsLicensee: boolean;
+    isLoggedInAsStaff: boolean;
     isLoadingAccount: boolean;
     isLoadingPrivilegePurchaseOptions: boolean;
     refreshTokenTimeoutId: number | null;
@@ -25,6 +32,8 @@ export interface State {
 export const state: State = {
     model: null,
     isLoggedIn: (!!authStorage.getItem(tokens.staff.AUTH_TOKEN) || !!authStorage.getItem(tokens.licensee.AUTH_TOKEN)),
+    isLoggedInAsLicensee: Boolean(authStorage.getItem(AUTH_TYPE) === AuthTypes.LICENSEE),
+    isLoggedInAsStaff: Boolean(authStorage.getItem(AUTH_TYPE) === AuthTypes.STAFF),
     isLoadingAccount: false,
     isLoadingPrivilegePurchaseOptions: false,
     arePurchaseAttestationsAccepted: false,

From 8ff3a188dcc049892e4ce843f096dc0832d940b8 Mon Sep 17 00:00:00 2001
From: Justin Frahm <justin@inspiringapps.com>
Date: Thu, 26 Dec 2024 09:34:26 -0700
Subject: [PATCH 04/18] Feat/ssn table (#411)

---
 .../common_constructs/nodejs_function.py      |   8 +-
 .../common_constructs/python_function.py      |  43 +++--
 .../queued_lambda_processor.py                |  50 ++++-
 .../lambdas/nodejs/lib/lambda.ts              |   4 +-
 .../nodejs/lib/models/event-records.ts        |  10 +-
 .../lambdas/nodejs/lib/report-emailer.ts      |  30 +--
 .../lambdas/python/common/cc_common/config.py |  12 ++
 .../common/cc_common/data_model/client.py     |   6 +-
 .../lambdas/python/common/cc_common/utils.py  |   1 +
 .../python/common/requirements-dev.txt        |  10 +-
 .../lambdas/python/common/requirements.txt    |   8 +-
 .../custom-resources/requirements-dev.txt     |  10 +-
 .../python/data-events/requirements-dev.txt   |  10 +-
 .../provider-data-v1/requirements-dev.txt     |  10 +-
 .../python/provider-data-v1/tests/__init__.py |   2 +
 .../tests/function/__init__.py                |  28 ++-
 .../function/test_data_model/test_client.py   |   2 +-
 .../test_provider_transformations.py          |   2 +-
 .../python/purchases/requirements-dev.txt     |  10 +-
 .../lambdas/python/purchases/requirements.txt |   2 +-
 .../staff-user-pre-token/requirements-dev.txt |  10 +-
 .../python/staff-users/requirements-dev.txt   |  10 +-
 backend/compact-connect/requirements-dev.txt  |   6 +-
 backend/compact-connect/requirements.txt      |   8 +-
 .../stacks/api_stack/cc_api.py                |  17 +-
 .../stacks/api_stack/v1_api/api.py            |   1 +
 .../api_stack/v1_api/query_providers.py       |  24 ++-
 .../compact-connect/stacks/ingest_stack.py    |  38 +++-
 .../stacks/persistent_stack/__init__.py       |   3 +
 .../persistent_stack/bulk_uploads_bucket.py   |   4 +-
 .../compact_configuration_upload.py           |   4 +-
 .../persistent_stack/data_event_table.py      |  25 ++-
 .../persistent_stack/provider_users_bucket.py |   4 +-
 .../stacks/persistent_stack/ssn_table.py      | 172 ++++++++++++++++++
 .../stacks/ui_stack/distribution.py           |   2 +-
 backend/compact-connect/tests/app/base.py     |  67 +++++++
 .../snapshots/SSN_TABLE_RESOURCE_POLICY.json  |  22 +++
 backend/multi-account/requirements.txt        |   6 +-
 webroot/README.md                             |   2 +-
 39 files changed, 550 insertions(+), 133 deletions(-)
 create mode 100644 backend/compact-connect/stacks/persistent_stack/ssn_table.py
 create mode 100644 backend/compact-connect/tests/resources/snapshots/SSN_TABLE_RESOURCE_POLICY.json

diff --git a/backend/compact-connect/common_constructs/nodejs_function.py b/backend/compact-connect/common_constructs/nodejs_function.py
index 65cf82408..aec44de91 100644
--- a/backend/compact-connect/common_constructs/nodejs_function.py
+++ b/backend/compact-connect/common_constructs/nodejs_function.py
@@ -71,7 +71,7 @@ def __init__(
             suppressions=[
                 {
                     'id': 'AwsSolutions-IAM4',
-                    'applies_to': [
+                    'appliesTo': [
                         'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
                     ],
                     'reason': 'The BasicExecutionRole policy is appropriate for these lambdas',
@@ -84,7 +84,9 @@ def __init__(
             suppressions=[
                 {
                     'id': 'AwsSolutions-IAM4',
-                    'applies_to': 'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',  # noqa: E501 line-too-long
+                    'appliesTo': [
+                        'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
+                    ],  # noqa: E501 line-too-long
                     'reason': 'This policy is appropriate for the log retention lambda',
                 },
             ],
@@ -95,7 +97,7 @@ def __init__(
             suppressions=[
                 {
                     'id': 'AwsSolutions-IAM5',
-                    'applies_to': ['Resource::*'],
+                    'appliesTo': ['Resource::*'],
                     'reason': 'This lambda needs to be able to configure log groups across the account, though the'
                     ' actions it is allowed are scoped specifically for this task.',
                 },
diff --git a/backend/compact-connect/common_constructs/python_function.py b/backend/compact-connect/common_constructs/python_function.py
index 5839ba156..0038d9a07 100644
--- a/backend/compact-connect/common_constructs/python_function.py
+++ b/backend/compact-connect/common_constructs/python_function.py
@@ -2,10 +2,10 @@
 
 import os
 
-import stacks.persistent_stack as ps
 from aws_cdk import Duration, Stack
 from aws_cdk.aws_cloudwatch import Alarm, ComparisonOperator, Stats, TreatMissingData
 from aws_cdk.aws_cloudwatch_actions import SnsAction
+from aws_cdk.aws_iam import IRole
 from aws_cdk.aws_lambda import ILayerVersion, Runtime
 from aws_cdk.aws_lambda_python_alpha import PythonFunction as CdkPythonFunction
 from aws_cdk.aws_lambda_python_alpha import PythonLayerVersion
@@ -14,6 +14,7 @@
 from aws_cdk.aws_ssm import StringParameter
 from cdk_nag import NagSuppressions
 from constructs import Construct
+from stacks import persistent_stack as ps
 
 COMMON_PYTHON_LAMBDA_LAYER_SSM_PARAMETER_NAME = '/deployment/lambda/layers/common-python-layer-arn'
 
@@ -31,8 +32,9 @@ def __init__(
         construct_id: str,
         *,
         lambda_dir: str,
-        log_retention: RetentionDays = RetentionDays.ONE_MONTH,
+        log_retention: RetentionDays = RetentionDays.INFINITE,
         alarm_topic: ITopic = None,
+        role: IRole = None,
         **kwargs,
     ):
         defaults = {
@@ -46,6 +48,7 @@ def __init__(
             entry=os.path.join('lambdas', 'python', lambda_dir),
             runtime=Runtime.PYTHON_3_12,
             log_retention=log_retention,
+            role=role,
             **defaults,
         )
         self.add_layers(self._get_common_layer())
@@ -72,26 +75,32 @@ def __init__(
                 },
             ],
         )
-        NagSuppressions.add_resource_suppressions_by_path(
-            stack,
-            path=f'{self.node.path}/ServiceRole/Resource',
-            suppressions=[
-                {
-                    'id': 'AwsSolutions-IAM4',
-                    'applies_to': [
-                        'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
-                    ],
-                    'reason': 'The BasicExecutionRole policy is appropriate for these lambdas',
-                },
-            ],
-        )
+
+        # If a role is provided from elsewhere for this lambda (role is not None), we don't need to run suppressions for
+        # the role that this construct normally creates.
+        if role is None:
+            NagSuppressions.add_resource_suppressions_by_path(
+                stack,
+                path=f'{self.node.path}/ServiceRole/Resource',
+                suppressions=[
+                    {
+                        'id': 'AwsSolutions-IAM4',
+                        'appliesTo': [
+                            'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
+                        ],
+                        'reason': 'The BasicExecutionRole policy is appropriate for these lambdas',
+                    },
+                ],
+            )
         NagSuppressions.add_resource_suppressions_by_path(
             stack,
             path=f'{stack.node.path}/LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8a/ServiceRole/Resource',
             suppressions=[
                 {
                     'id': 'AwsSolutions-IAM4',
-                    'applies_to': 'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',  # noqa: E501 line-too-long
+                    'appliesTo': [
+                        'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
+                    ],  # noqa: E501 line-too-long
                     'reason': 'This policy is appropriate for the log retention lambda',
                 },
             ],
@@ -102,7 +111,7 @@ def __init__(
             suppressions=[
                 {
                     'id': 'AwsSolutions-IAM5',
-                    'applies_to': ['Resource::*'],
+                    'appliesTo': ['Resource::*'],
                     'reason': 'This lambda needs to be able to configure log groups across the account, though the'
                     ' actions it is allowed are scoped specifically for this task.',
                 },
diff --git a/backend/compact-connect/common_constructs/queued_lambda_processor.py b/backend/compact-connect/common_constructs/queued_lambda_processor.py
index 02645a5de..4630f77f2 100644
--- a/backend/compact-connect/common_constructs/queued_lambda_processor.py
+++ b/backend/compact-connect/common_constructs/queued_lambda_processor.py
@@ -1,9 +1,9 @@
-from aws_cdk import Duration
+from aws_cdk import Duration, Names
 from aws_cdk.aws_cloudwatch import Alarm, ComparisonOperator, TreatMissingData
 from aws_cdk.aws_cloudwatch_actions import SnsAction
+from aws_cdk.aws_iam import Effect, PolicyStatement
 from aws_cdk.aws_kms import IKey
 from aws_cdk.aws_lambda import IFunction
-from aws_cdk.aws_lambda_event_sources import SqsEventSource
 from aws_cdk.aws_logs import QueryDefinition, QueryString
 from aws_cdk.aws_sns import ITopic
 from aws_cdk.aws_sqs import DeadLetterQueue, IQueue, Queue, QueueEncryption
@@ -51,14 +51,46 @@ def __init__(
             dead_letter_queue=DeadLetterQueue(max_receive_count=max_receive_count, queue=self.dlq),
         )
 
-        process_function.add_event_source(
-            SqsEventSource(
-                self.queue,
-                batch_size=batch_size,
-                max_batching_window=max_batching_window,
-                report_batch_item_failures=True,
-            ),
+        # The following section of code is equivalent to:
+        # process_function.add_event_source(
+        #     SqsEventSource(
+        #         self.queue,
+        #         batch_size=batch_size,
+        #         max_batching_window=max_batching_window,
+        #         report_batch_item_failures=True,
+        #     ),
+        # )
+        #
+        # Except that we are granting the lambda permission to consume SQS messages via resource policy
+        # on the queue, rather than the more conventional approach of principal policy on the IAM role.
+        #
+        # We use a lower-level add_event_source_mapping method here so that we can control how those
+        # permissions are granted. In this case, we need to grant permissions via resource policy on
+        # the Queue rather than principal policy on the role to avoid creating a dependency from the
+        # role on the queue. In some cases, adding the dependency on the role can cause a circular
+        # dependency.
+        process_function.add_event_source_mapping(
+            f'SqsEventSource:{Names.node_unique_id(self.queue.node)}',
+            batch_size=batch_size,
+            max_batching_window=max_batching_window,
+            report_batch_item_failures=True,
+            event_source_arn=self.queue.queue_arn,
+        )
+        self.queue.add_to_resource_policy(
+            PolicyStatement(
+                effect=Effect.ALLOW,
+                principals=[process_function.role],
+                actions=[
+                    'sqs:ReceiveMessage',
+                    'sqs:ChangeMessageVisibility',
+                    'sqs:GetQueueUrl',
+                    'sqs:DeleteMessage',
+                    'sqs:GetQueueAttributes',
+                ],
+                resources=[self.queue.queue_arn],
+            )
         )
+
         self._add_queue_alarms(
             retention_period=retention_period, queue=self.queue, dlq=self.dlq, alarm_topic=alarm_topic
         )
diff --git a/backend/compact-connect/lambdas/nodejs/lib/lambda.ts b/backend/compact-connect/lambdas/nodejs/lib/lambda.ts
index cee91529c..4b5c43d22 100644
--- a/backend/compact-connect/lambdas/nodejs/lib/lambda.ts
+++ b/backend/compact-connect/lambdas/nodejs/lib/lambda.ts
@@ -97,8 +97,8 @@ export class Lambda implements LambdaInterface {
                         );
 
                         // verify that the jurisdiction uploaded licenses within the last week without any errors
-                        if (!weeklyIngestEvents.ingestFailures.length 
-                            && !weeklyIngestEvents.validationErrors.length 
+                        if (!weeklyIngestEvents.ingestFailures.length
+                            && !weeklyIngestEvents.validationErrors.length
                             && weeklyIngestEvents.ingestSuccesses.length
                         ) {
                             const messageId = await this.reportEmailer.sendAllsWellEmail(
diff --git a/backend/compact-connect/lambdas/nodejs/lib/models/event-records.ts b/backend/compact-connect/lambdas/nodejs/lib/models/event-records.ts
index 960761c92..3e15b58fb 100644
--- a/backend/compact-connect/lambdas/nodejs/lib/models/event-records.ts
+++ b/backend/compact-connect/lambdas/nodejs/lib/models/event-records.ts
@@ -34,11 +34,11 @@ export interface IIngestSuccessEventRecord {
     sk: string,
     eventType: string,
     eventTime: string;
-    compact: string; 
-    jurisdiction: string; 
-    licenseType: string; 
-    status: 'active' | 'inactive'; 
+    compact: string;
+    jurisdiction: string;
+    licenseType: string;
+    status: 'active' | 'inactive';
     dateOfIssuance: string;
     dateOfRenewal: string;
-    dateOfExpiration: string; 
+    dateOfExpiration: string;
 }
diff --git a/backend/compact-connect/lambdas/nodejs/lib/report-emailer.ts b/backend/compact-connect/lambdas/nodejs/lib/report-emailer.ts
index b0109ad82..833d9d9b6 100644
--- a/backend/compact-connect/lambdas/nodejs/lib/report-emailer.ts
+++ b/backend/compact-connect/lambdas/nodejs/lib/report-emailer.ts
@@ -86,11 +86,11 @@ export class ReportEmailer {
         // Generate the HTML report
         const htmlContent = this.generateReport(events, compact, jurisdiction);
 
-        return this.sendEmail({ 
-            htmlContent, 
-            subject: `License Data Error Summary: ${compact} / ${jurisdiction}`, 
-            recipients, 
-            errorMessage: 'Error sending report email' 
+        return this.sendEmail({
+            htmlContent,
+            subject: `License Data Error Summary: ${compact} / ${jurisdiction}`,
+            recipients,
+            errorMessage: 'Error sending report email'
         });
     }
 
@@ -107,11 +107,11 @@ export class ReportEmailer {
 
         const htmlContent = renderToStaticMarkup(report, { rootBlockId: 'root' });
 
-        return this.sendEmail({ 
-            htmlContent, 
-            subject: `License Data Summary: ${compact} / ${jurisdiction}`, 
-            recipients, 
-            errorMessage: 'Error sending alls well email' 
+        return this.sendEmail({
+            htmlContent,
+            subject: `License Data Summary: ${compact} / ${jurisdiction}`,
+            recipients,
+            errorMessage: 'Error sending alls well email'
         });
     }
 
@@ -128,11 +128,11 @@ export class ReportEmailer {
 
         const htmlContent = renderToStaticMarkup(report, { rootBlockId: 'root' });
 
-        return this.sendEmail({ 
-            htmlContent, 
-            subject: `No License Updates for Last 7 Days: ${compact} / ${jurisdiction}`, 
-            recipients, 
-            errorMessage: 'Error sending no license updates email' 
+        return this.sendEmail({
+            htmlContent,
+            subject: `No License Updates for Last 7 Days: ${compact} / ${jurisdiction}`,
+            recipients,
+            errorMessage: 'Error sending no license updates email'
         });
     }
 
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/config.py b/backend/compact-connect/lambdas/python/common/cc_common/config.py
index 59bce70ee..4bc9c43ef 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/config.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/config.py
@@ -65,6 +65,10 @@ def event_bus_name(self):
     def provider_table(self):
         return boto3.resource('dynamodb').Table(self.provider_table_name)
 
+    @cached_property
+    def ssn_table(self):
+        return boto3.resource('dynamodb').Table(self.ssn_table_name)
+
     @property
     def compact_configuration_table_name(self):
         return os.environ['COMPACT_CONFIGURATION_TABLE_NAME']
@@ -92,6 +96,10 @@ def license_types_for_compact(self, compact):
     def provider_table_name(self):
         return os.environ['PROVIDER_TABLE_NAME']
 
+    @property
+    def ssn_table_name(self):
+        return os.environ['SSN_TABLE_NAME']
+
     @property
     def fam_giv_mid_index_name(self):
         return os.environ['PROV_FAM_GIV_MID_INDEX_NAME']
@@ -100,6 +108,10 @@ def fam_giv_mid_index_name(self):
     def date_of_update_index_name(self):
         return os.environ['PROV_DATE_OF_UPDATE_INDEX_NAME']
 
+    @property
+    def ssn_inverted_index_name(self):
+        return os.environ['SSN_INVERTED_INDEX_NAME']
+
     @property
     def bulk_bucket_name(self):
         return os.environ['BULK_BUCKET_NAME']
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/client.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/client.py
index bb4bb80fa..f2564807a 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/client.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/client.py
@@ -29,7 +29,7 @@ def get_provider_id(self, *, compact: str, ssn: str) -> str:
         """Get all records associated with a given SSN."""
         logger.info('Getting provider id by ssn')
         try:
-            resp = self.config.provider_table.get_item(
+            resp = self.config.ssn_table.get_item(
                 Key={'pk': f'{compact}#SSN#{ssn}', 'sk': f'{compact}#SSN#{ssn}'},
                 ConsistentRead=True,
             )['Item']
@@ -44,7 +44,7 @@ def get_or_create_provider_id(self, *, compact: str, ssn: str) -> str:
         # This is an 'ask forgiveness' approach to provider id assignment:
         # Try to create a new provider, conditional on it not already existing
         try:
-            self.config.provider_table.put_item(
+            self.config.ssn_table.put_item(
                 Item={
                     'pk': f'{compact}#SSN#{ssn}',
                     'sk': f'{compact}#SSN#{ssn}',
@@ -61,6 +61,8 @@ def get_or_create_provider_id(self, *, compact: str, ssn: str) -> str:
                 # The provider already exists, so grab their providerId
                 provider_id = TypeDeserializer().deserialize(e.response['Item']['providerId'])
                 logger.info('Found existing provider', provider_id=provider_id)
+            else:
+                raise
         return provider_id
 
     @paginated_query
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/utils.py b/backend/compact-connect/lambdas/python/common/cc_common/utils.py
index be1f19fec..1702efadb 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/utils.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/utils.py
@@ -61,6 +61,7 @@ def caught_handler(event, context: LambdaContext):
             'Incoming request',
             method=event['httpMethod'],
             path=event['requestContext']['resourcePath'],
+            identity={'user': event['requestContext'].get('authorizer', {}).get('claims', {}).get('sub')},
             query_params=event['queryStringParameters'],
             username=event['requestContext'].get('authorizer', {}).get('claims', {}).get('cognito:username'),
             context=context,
diff --git a/backend/compact-connect/lambdas/python/common/requirements-dev.txt b/backend/compact-connect/lambdas/python/common/requirements-dev.txt
index dfa088cee..4038df16e 100644
--- a/backend/compact-connect/lambdas/python/common/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/common/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/common/requirements-dev.in
 #
-boto3==1.35.81
+boto3==1.35.87
     # via moto
-botocore==1.35.81
+botocore==1.35.87
     # via
     #   boto3
     #   moto
@@ -25,7 +25,7 @@ faker==28.4.1
     # via -r compact-connect/lambdas/python/common/requirements-dev.in
 idna==3.10
     # via requests
-jinja2==3.1.4
+jinja2==3.1.5
     # via moto
 jmespath==1.0.1
     # via
@@ -35,7 +35,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.23
+moto[dynamodb,s3]==5.0.24
     # via -r compact-connect/lambdas/python/common/requirements-dev.in
 py-partiql-parser==0.5.6
     # via moto
@@ -61,7 +61,7 @@ s3transfer==0.10.4
     # via boto3
 six==1.17.0
     # via python-dateutil
-urllib3==2.2.3
+urllib3==2.3.0
     # via
     #   botocore
     #   docker
diff --git a/backend/compact-connect/lambdas/python/common/requirements.txt b/backend/compact-connect/lambdas/python/common/requirements.txt
index a55f9c346..62ebc0fb5 100644
--- a/backend/compact-connect/lambdas/python/common/requirements.txt
+++ b/backend/compact-connect/lambdas/python/common/requirements.txt
@@ -6,9 +6,9 @@
 #
 aws-lambda-powertools==2.43.1
     # via -r compact-connect/lambdas/python/common/requirements.in
-boto3==1.35.81
+boto3==1.35.87
     # via -r compact-connect/lambdas/python/common/requirements.in
-botocore==1.35.81
+botocore==1.35.87
     # via
     #   boto3
     #   s3transfer
@@ -17,7 +17,7 @@ jmespath==1.0.1
     #   aws-lambda-powertools
     #   boto3
     #   botocore
-marshmallow==3.23.1
+marshmallow==3.23.2
     # via -r compact-connect/lambdas/python/common/requirements.in
 packaging==24.2
     # via marshmallow
@@ -29,5 +29,5 @@ six==1.17.0
     # via python-dateutil
 typing-extensions==4.12.2
     # via aws-lambda-powertools
-urllib3==2.2.3
+urllib3==2.3.0
     # via botocore
diff --git a/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt b/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt
index b6b4b61ae..9e4cc12e5 100644
--- a/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/custom-resources/requirements-dev.in
 #
-boto3==1.35.81
+boto3==1.35.87
     # via moto
-botocore==1.35.81
+botocore==1.35.87
     # via
     #   boto3
     #   moto
@@ -23,7 +23,7 @@ docker==7.1.0
     # via moto
 idna==3.10
     # via requests
-jinja2==3.1.4
+jinja2==3.1.5
     # via moto
 jmespath==1.0.1
     # via
@@ -33,7 +33,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.23
+moto[dynamodb,s3]==5.0.24
     # via -r compact-connect/lambdas/python/custom-resources/requirements-dev.in
 py-partiql-parser==0.5.6
     # via moto
@@ -58,7 +58,7 @@ s3transfer==0.10.4
     # via boto3
 six==1.17.0
     # via python-dateutil
-urllib3==2.2.3
+urllib3==2.3.0
     # via
     #   botocore
     #   docker
diff --git a/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt b/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt
index 023b473c1..ac473bbde 100644
--- a/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/data-events/requirements-dev.in
 #
-boto3==1.35.81
+boto3==1.35.87
     # via moto
-botocore==1.35.81
+botocore==1.35.87
     # via
     #   boto3
     #   moto
@@ -23,7 +23,7 @@ docker==7.1.0
     # via moto
 idna==3.10
     # via requests
-jinja2==3.1.4
+jinja2==3.1.5
     # via moto
 jmespath==1.0.1
     # via
@@ -33,7 +33,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.23
+moto[dynamodb,s3]==5.0.24
     # via -r compact-connect/lambdas/python/data-events/requirements-dev.in
 py-partiql-parser==0.5.6
     # via moto
@@ -58,7 +58,7 @@ s3transfer==0.10.4
     # via boto3
 six==1.17.0
     # via python-dateutil
-urllib3==2.2.3
+urllib3==2.3.0
     # via
     #   botocore
     #   docker
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt b/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt
index b2ec3256b..88ac77aa2 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/provider-data-v1/requirements-dev.in
 #
-boto3==1.35.81
+boto3==1.35.87
     # via moto
-botocore==1.35.81
+botocore==1.35.87
     # via
     #   boto3
     #   moto
@@ -25,7 +25,7 @@ faker==28.4.1
     # via -r compact-connect/lambdas/python/provider-data-v1/requirements-dev.in
 idna==3.10
     # via requests
-jinja2==3.1.4
+jinja2==3.1.5
     # via moto
 jmespath==1.0.1
     # via
@@ -35,7 +35,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.23
+moto[dynamodb,s3]==5.0.24
     # via -r compact-connect/lambdas/python/provider-data-v1/requirements-dev.in
 py-partiql-parser==0.5.6
     # via moto
@@ -61,7 +61,7 @@ s3transfer==0.10.4
     # via boto3
 six==1.17.0
     # via python-dateutil
-urllib3==2.2.3
+urllib3==2.3.0
     # via
     #   botocore
     #   docker
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/__init__.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/__init__.py
index c3fdec1ac..cb119513e 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/__init__.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/__init__.py
@@ -17,6 +17,7 @@ def setUpClass(cls):
                 'BULK_BUCKET_NAME': 'cc-license-data-bulk-bucket',
                 'EVENT_BUS_NAME': 'license-data-events',
                 'PROVIDER_TABLE_NAME': 'provider-table',
+                'SSN_TABLE_NAME': 'ssn-table',
                 'COMPACT_CONFIGURATION_TABLE_NAME': 'compact-configuration-table',
                 'ENVIRONMENT_NAME': 'test',
                 'PROV_FAM_GIV_MID_INDEX_NAME': 'providerFamGivMid',
@@ -24,6 +25,7 @@ def setUpClass(cls):
                 'USER_POOL_ID': 'us-east-1-12345',
                 'USERS_TABLE_NAME': 'provider-table',
                 'PROV_DATE_OF_UPDATE_INDEX_NAME': 'providerDateOfUpdate',
+                'SSN_INVERTED_INDEX_NAME': 'inverted',
                 'PROVIDER_USER_BUCKET_NAME': 'provider-user-bucket',
                 'COMPACTS': '["aslp", "octp", "coun"]',
                 'JURISDICTIONS': '["ne", "oh", "ky"]',
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py
index b66aea92e..e458d3122 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py
@@ -37,6 +37,7 @@ def setUp(self):  # noqa: N801 invalid-name
     def build_resources(self):
         self._bucket = boto3.resource('s3').create_bucket(Bucket=os.environ['BULK_BUCKET_NAME'])
         self.create_provider_table()
+        self.create_ssn_table()
 
         boto3.client('events').create_event_bus(Name=os.environ['EVENT_BUS_NAME'])
 
@@ -71,10 +72,32 @@ def create_provider_table(self):
             ],
         )
 
+    def create_ssn_table(self):
+        self._ssn_table = boto3.resource('dynamodb').create_table(
+            AttributeDefinitions=[
+                {'AttributeName': 'pk', 'AttributeType': 'S'},
+                {'AttributeName': 'sk', 'AttributeType': 'S'},
+            ],
+            TableName=os.environ['SSN_TABLE_NAME'],
+            KeySchema=[{'AttributeName': 'pk', 'KeyType': 'HASH'}, {'AttributeName': 'sk', 'KeyType': 'RANGE'}],
+            BillingMode='PAY_PER_REQUEST',
+            GlobalSecondaryIndexes=[
+                {
+                    'IndexName': os.environ['SSN_INVERTED_INDEX_NAME'],
+                    'KeySchema': [
+                        {'AttributeName': 'sk', 'KeyType': 'HASH'},
+                        {'AttributeName': 'pk', 'KeyType': 'RANGE'},
+                    ],
+                    'Projection': {'ProjectionType': 'ALL'},
+                },
+            ],
+        )
+
     def delete_resources(self):
         self._bucket.objects.delete()
         self._bucket.delete()
         self._provider_table.delete()
+        self._ssn_table.delete()
         boto3.client('events').delete_event_bus(Name=os.environ['EVENT_BUS_NAME'])
 
     def _load_provider_data(self):
@@ -91,7 +114,10 @@ def privilege_jurisdictions_to_set(obj: dict):
                 record = json.load(f, object_hook=privilege_jurisdictions_to_set, parse_float=Decimal)
 
             logger.debug('Loading resource, %s: %s', resource, str(record))
-            self._provider_table.put_item(Item=record)
+            if record['type'] == 'provider-ssn':
+                self._ssn_table.put_item(Item=record)
+            else:
+                self._provider_table.put_item(Item=record)
 
     def _generate_providers(self, *, home: str, privilege: str, start_serial: int, names: tuple[tuple[str, str]] = ()):
         """Generate 10 providers with one license and one privilege
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_client.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_client.py
index 9f705943b..bf4ee30ef 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_client.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_client.py
@@ -17,7 +17,7 @@ def test_get_provider_id(self):
         provider_ssn = record['ssn']
         expected_provider_id = record['providerId']
 
-        self._provider_table.put_item(
+        self._ssn_table.put_item(
             # We'll use the schema/serializer to populate index fields for us
             Item=record,
         )
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py
index bfcfa26b1..19df93cff 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py
@@ -21,7 +21,7 @@ def test_transformations(self):
         with open('../common/tests/resources/dynamo/provider-ssn.json') as f:
             provider_ssn = json.load(f)
 
-        self._provider_table.put_item(Item=provider_ssn)
+        self._ssn_table.put_item(Item=provider_ssn)
         expected_provider_id = provider_ssn['providerId']
 
         # license data as it comes in from a board, in this case, as POSTed through the API
diff --git a/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt b/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
index e2434f27e..c716f9f9b 100644
--- a/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/purchases/requirements-dev.in
 #
-boto3==1.35.81
+boto3==1.35.87
     # via moto
-botocore==1.35.81
+botocore==1.35.87
     # via
     #   boto3
     #   moto
@@ -23,7 +23,7 @@ docker==7.1.0
     # via moto
 idna==3.10
     # via requests
-jinja2==3.1.4
+jinja2==3.1.5
     # via moto
 jmespath==1.0.1
     # via
@@ -33,7 +33,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.23
+moto[dynamodb,s3]==5.0.24
     # via -r compact-connect/lambdas/python/purchases/requirements-dev.in
 py-partiql-parser==0.5.6
     # via moto
@@ -58,7 +58,7 @@ s3transfer==0.10.4
     # via boto3
 six==1.17.0
     # via python-dateutil
-urllib3==2.2.3
+urllib3==2.3.0
     # via
     #   botocore
     #   docker
diff --git a/backend/compact-connect/lambdas/python/purchases/requirements.txt b/backend/compact-connect/lambdas/python/purchases/requirements.txt
index 9ee3bb9df..b88fcce33 100644
--- a/backend/compact-connect/lambdas/python/purchases/requirements.txt
+++ b/backend/compact-connect/lambdas/python/purchases/requirements.txt
@@ -18,5 +18,5 @@ pyxb-x==1.2.6.2
     # via authorizenet
 requests==2.32.3
     # via authorizenet
-urllib3==2.2.3
+urllib3==2.3.0
     # via requests
diff --git a/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt b/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt
index 34d076ebf..98494f3b7 100644
--- a/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.in
 #
-boto3==1.35.81
+boto3==1.35.87
     # via moto
-botocore==1.35.81
+botocore==1.35.87
     # via
     #   boto3
     #   moto
@@ -23,7 +23,7 @@ docker==7.1.0
     # via moto
 idna==3.10
     # via requests
-jinja2==3.1.4
+jinja2==3.1.5
     # via moto
 jmespath==1.0.1
     # via
@@ -33,7 +33,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.23
+moto[dynamodb,s3]==5.0.24
     # via -r compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.in
 py-partiql-parser==0.5.6
     # via moto
@@ -58,7 +58,7 @@ s3transfer==0.10.4
     # via boto3
 six==1.17.0
     # via python-dateutil
-urllib3==2.2.3
+urllib3==2.3.0
     # via
     #   botocore
     #   docker
diff --git a/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt b/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt
index 6d965cef9..94812d8a0 100644
--- a/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/staff-users/requirements-dev.in
 #
-boto3==1.35.81
+boto3==1.35.87
     # via moto
-botocore==1.35.81
+botocore==1.35.87
     # via
     #   boto3
     #   moto
@@ -27,7 +27,7 @@ faker==28.4.1
     # via -r compact-connect/lambdas/python/staff-users/requirements-dev.in
 idna==3.10
     # via requests
-jinja2==3.1.4
+jinja2==3.1.5
     # via moto
 jmespath==1.0.1
     # via
@@ -39,7 +39,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[cognitoidp,dynamodb,s3]==5.0.23
+moto[cognitoidp,dynamodb,s3]==5.0.24
     # via -r compact-connect/lambdas/python/staff-users/requirements-dev.in
 py-partiql-parser==0.5.6
     # via moto
@@ -65,7 +65,7 @@ s3transfer==0.10.4
     # via boto3
 six==1.17.0
     # via python-dateutil
-urllib3==2.2.3
+urllib3==2.3.0
     # via
     #   botocore
     #   docker
diff --git a/backend/compact-connect/requirements-dev.txt b/backend/compact-connect/requirements-dev.txt
index 8ac650471..8f285a0ad 100644
--- a/backend/compact-connect/requirements-dev.txt
+++ b/backend/compact-connect/requirements-dev.txt
@@ -16,7 +16,7 @@ certifi==2024.12.14
     # via requests
 charset-normalizer==3.4.0
     # via requests
-click==8.1.7
+click==8.1.8
     # via pip-tools
 coverage[toml]==7.6.9
     # via
@@ -86,7 +86,7 @@ requests==2.32.3
     #   pip-audit
 rich==13.9.4
     # via pip-audit
-ruff==0.8.3
+ruff==0.8.4
     # via -r compact-connect/requirements-dev.in
 six==1.17.0
     # via
@@ -96,7 +96,7 @@ sortedcontainers==2.4.0
     # via cyclonedx-python-lib
 toml==0.10.2
     # via pip-audit
-urllib3==2.2.3
+urllib3==2.3.0
     # via requests
 webencodings==0.5.1
     # via html5lib
diff --git a/backend/compact-connect/requirements.txt b/backend/compact-connect/requirements.txt
index 974b1c450..5ea2259a4 100644
--- a/backend/compact-connect/requirements.txt
+++ b/backend/compact-connect/requirements.txt
@@ -8,17 +8,17 @@ attrs==24.3.0
     # via
     #   cattrs
     #   jsii
-aws-cdk-asset-awscli-v1==2.2.215
+aws-cdk-asset-awscli-v1==2.2.216
     # via aws-cdk-lib
 aws-cdk-asset-kubectl-v20==2.1.3
     # via aws-cdk-lib
 aws-cdk-asset-node-proxy-agent-v6==2.1.0
     # via aws-cdk-lib
-aws-cdk-aws-lambda-python-alpha==2.173.1a0
+aws-cdk-aws-lambda-python-alpha==2.173.2a0
     # via -r compact-connect/requirements.in
 aws-cdk-cloud-assembly-schema==38.0.1
     # via aws-cdk-lib
-aws-cdk-lib==2.173.1
+aws-cdk-lib==2.173.2
     # via
     #   -r compact-connect/requirements.in
     #   aws-cdk-aws-lambda-python-alpha
@@ -35,7 +35,7 @@ constructs==10.4.2
     #   cdk-nag
 importlib-resources==6.4.5
     # via jsii
-jsii==1.105.0
+jsii==1.106.0
     # via
     #   aws-cdk-asset-awscli-v1
     #   aws-cdk-asset-kubectl-v20
diff --git a/backend/compact-connect/stacks/api_stack/cc_api.py b/backend/compact-connect/stacks/api_stack/cc_api.py
index c507fb3d7..da28471a8 100644
--- a/backend/compact-connect/stacks/api_stack/cc_api.py
+++ b/backend/compact-connect/stacks/api_stack/cc_api.py
@@ -116,14 +116,13 @@ def __init__(
                         {
                             'source_ip': '$context.identity.sourceIp',
                             'identity': {
-                                'caller': '$context.identity.caller',
-                                'user': '$context.identity.user',
+                                'user': '$context.authorizer.claims.sub',
                                 'user_agent': '$context.identity.userAgent',
                             },
                             'level': 'INFO',
                             'message': 'API Access log',
                             'request_time': '[$context.requestTime]',
-                            'http_method': '$context.httpMethod',
+                            'method': '$context.httpMethod',
                             'domain_name': '$context.domainName',
                             'resource_path': '$context.resourcePath',
                             'path': '$context.path',
@@ -131,6 +130,9 @@ def __init__(
                             'status': '$context.status',
                             'response_length': '$context.responseLength',
                             'request_id': '$context.requestId',
+                            'xray_trace_id': '$context.xrayTraceId',
+                            'waf_evaluation': '$context.wafResponseCode',
+                            'waf_status': '$context.waf.status',
                         }
                     )
                 ),
@@ -195,7 +197,7 @@ def __init__(
             'RuntimeQuery',
             query_definition_name=f'{construct_id}/Lambdas',
             query_string=QueryString(
-                fields=['@timestamp', '@log', 'level', 'status', 'message', 'http_method', 'path', '@message'],
+                fields=['@timestamp', '@log', 'level', 'status', 'message', 'method', 'path', '@message'],
                 filter_statements=['level in ["INFO", "WARNING", "ERROR"]'],
                 sort='@timestamp desc',
             ),
@@ -209,7 +211,7 @@ def __init__(
             suppressions=[
                 {
                     'id': 'AwsSolutions-IAM4',
-                    'applies_to': [
+                    'appliesTo': [
                         'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs'
                     ],
                     'reason': 'This policy is crafted specifically for the account-level role created here.',
@@ -234,7 +236,10 @@ def __init__(
     @cached_property
     def staff_users_authorizer(self):
         return CognitoUserPoolsAuthorizer(
-            self, 'StaffPoolsAuthorizer', cognito_user_pools=[self._persistent_stack.staff_users]
+            self,
+            'StaffPoolsAuthorizer',
+            cognito_user_pools=[self._persistent_stack.staff_users],
+            results_cache_ttl=Duration.minutes(5),  # Default ttl is 5 minutes. We're setting this just to be explicit
         )
 
     @cached_property
diff --git a/backend/compact-connect/stacks/api_stack/v1_api/api.py b/backend/compact-connect/stacks/api_stack/v1_api/api.py
index 456655634..81fb8554f 100644
--- a/backend/compact-connect/stacks/api_stack/v1_api/api.py
+++ b/backend/compact-connect/stacks/api_stack/v1_api/api.py
@@ -89,6 +89,7 @@ def __init__(self, root: IResource, persistent_stack: ps.PersistentStack):
             method_options=read_auth_method_options,
             data_encryption_key=persistent_stack.shared_encryption_key,
             provider_data_table=persistent_stack.provider_table,
+            ssn_table=persistent_stack.ssn_table,
             api_model=self.api_model,
         )
 
diff --git a/backend/compact-connect/stacks/api_stack/v1_api/query_providers.py b/backend/compact-connect/stacks/api_stack/v1_api/query_providers.py
index 67d3aa0ae..6557d62b1 100644
--- a/backend/compact-connect/stacks/api_stack/v1_api/query_providers.py
+++ b/backend/compact-connect/stacks/api_stack/v1_api/query_providers.py
@@ -11,7 +11,7 @@
 
 # Importing module level to allow lazy loading for typing
 from stacks.api_stack import cc_api
-from stacks.persistent_stack import ProviderTable
+from stacks.persistent_stack import ProviderTable, SSNTable
 
 from .api_model import ApiModel
 
@@ -23,6 +23,7 @@ def __init__(
         resource: Resource,
         method_options: MethodOptions,
         data_encryption_key: IKey,
+        ssn_table: SSNTable,
         provider_data_table: ProviderTable,
         api_model: ApiModel,
     ):
@@ -35,8 +36,10 @@ def __init__(
         stack: Stack = Stack.of(resource)
         lambda_environment = {
             'PROVIDER_TABLE_NAME': provider_data_table.table_name,
-            'PROV_FAM_GIV_MID_INDEX_NAME': 'providerFamGivMid',
-            'PROV_DATE_OF_UPDATE_INDEX_NAME': 'providerDateOfUpdate',
+            'PROV_FAM_GIV_MID_INDEX_NAME': provider_data_table.provider_fam_giv_mid_index_name,
+            'PROV_DATE_OF_UPDATE_INDEX_NAME': provider_data_table.provider_date_of_update_index_name,
+            'SSN_TABLE_NAME': ssn_table.table_name,
+            'SSN_INVERTED_INDEX_NAME': ssn_table.inverted_index_name,
             **stack.common_env_vars,
         }
 
@@ -44,6 +47,7 @@ def __init__(
             method_options=method_options,
             data_encryption_key=data_encryption_key,
             provider_data_table=provider_data_table,
+            ssn_table=ssn_table,
             lambda_environment=lambda_environment,
         )
         self._add_get_provider(
@@ -88,6 +92,7 @@ def _add_query_providers(
         method_options: MethodOptions,
         data_encryption_key: IKey,
         provider_data_table: ProviderTable,
+        ssn_table: SSNTable,
         lambda_environment: dict,
     ):
         query_resource = self.resource.add_resource('query')
@@ -95,6 +100,7 @@ def _add_query_providers(
         handler = self._query_providers_handler(
             data_encryption_key=data_encryption_key,
             provider_data_table=provider_data_table,
+            ssn_table=ssn_table,
             lambda_environment=lambda_environment,
         )
         self.api.log_groups.append(handler.log_group)
@@ -153,13 +159,14 @@ def _query_providers_handler(
         self,
         data_encryption_key: IKey,
         provider_data_table: ProviderTable,
+        ssn_table: SSNTable,
         lambda_environment: dict,
     ) -> PythonFunction:
-        stack = Stack.of(self.api)
         handler = PythonFunction(
             self.resource,
             'QueryProvidersHandler',
             description='Query providers handler',
+            role=ssn_table.api_query_role,
             lambda_dir='provider-data-v1',
             index=os.path.join('handlers', 'providers.py'),
             handler='query_providers',
@@ -170,11 +177,16 @@ def _query_providers_handler(
         provider_data_table.grant_read_data(handler)
 
         NagSuppressions.add_resource_suppressions_by_path(
-            stack,
-            path=f'{handler.node.path}/ServiceRole/DefaultPolicy/Resource',
+            Stack.of(handler.role),
+            path=f'{handler.role.node.path}/DefaultPolicy/Resource',
             suppressions=[
                 {
                     'id': 'AwsSolutions-IAM5',
+                    'appliesTo': [
+                        'Action::kms:GenerateDataKey*',
+                        'Action::kms:ReEncrypt*',
+                        'Resource::<ProviderTableEC5D0597.Arn>/index/*',
+                    ],
                     'reason': 'The actions in this policy are specifically what this lambda needs to read '
                     'and is scoped to one table and encryption key.',
                 },
diff --git a/backend/compact-connect/stacks/ingest_stack.py b/backend/compact-connect/stacks/ingest_stack.py
index 9f9dc1314..ac73f4676 100644
--- a/backend/compact-connect/stacks/ingest_stack.py
+++ b/backend/compact-connect/stacks/ingest_stack.py
@@ -3,14 +3,14 @@
 import os
 
 from aws_cdk import Duration
-from aws_cdk.aws_cloudwatch import Alarm, ComparisonOperator, Stats, TreatMissingData
+from aws_cdk.aws_cloudwatch import Alarm, ComparisonOperator, Metric, Stats, TreatMissingData
 from aws_cdk.aws_cloudwatch_actions import SnsAction
 from aws_cdk.aws_events import EventPattern, Rule
 from aws_cdk.aws_events_targets import SqsQueue
 from cdk_nag import NagSuppressions
 from common_constructs.python_function import PythonFunction
 from common_constructs.queued_lambda_processor import QueuedLambdaProcessor
-from common_constructs.stack import AppStack
+from common_constructs.stack import AppStack, Stack
 from constructs import Construct
 
 from stacks import persistent_stack as ps
@@ -29,18 +29,21 @@ def _add_v1_ingest_chain(self, persistent_stack: ps.PersistentStack):
             lambda_dir='provider-data-v1',
             index=os.path.join('handlers', 'ingest.py'),
             handler='ingest_license_message',
+            role=persistent_stack.ssn_table.ingest_role,
             timeout=Duration.minutes(1),
             environment={
                 'EVENT_BUS_NAME': persistent_stack.data_event_bus.event_bus_name,
                 'PROVIDER_TABLE_NAME': persistent_stack.provider_table.table_name,
+                'SSN_TABLE_NAME': persistent_stack.ssn_table.table_name,
+                'SSN_INVERTED_INDEX_NAME': persistent_stack.ssn_table.inverted_index_name,
                 **self.common_env_vars,
             },
             alarm_topic=persistent_stack.alarm_topic,
         )
         persistent_stack.provider_table.grant_read_write_data(ingest_handler)
         NagSuppressions.add_resource_suppressions_by_path(
-            self,
-            f'{ingest_handler.node.path}/ServiceRole/DefaultPolicy/Resource',
+            Stack.of(ingest_handler.role),
+            f'{ingest_handler.role.node.path}/DefaultPolicy/Resource',
             suppressions=[
                 {
                     'id': 'AwsSolutions-IAM5',
@@ -73,14 +76,37 @@ def _add_v1_ingest_chain(self, persistent_stack: ps.PersistentStack):
             max_batching_window=Duration.minutes(5),
             max_receive_count=3,
             batch_size=50,
-            encryption_key=persistent_stack.shared_encryption_key,
+            # Note that we're using the ssn key here, which has a much more restrictive policy.
+            # The messages on this queue include SSN, so we want it just as locked down as our
+            # permanent storage of SSN data.
+            encryption_key=persistent_stack.ssn_table.key,
             alarm_topic=persistent_stack.alarm_topic,
         )
 
-        Rule(
+        ingest_rule = Rule(
             self,
             'V1IngestEventRule',
             event_bus=persistent_stack.data_event_bus,
             event_pattern=EventPattern(detail_type=['license.ingest']),
             targets=[SqsQueue(processor.queue, dead_letter_queue=processor.dlq)],
         )
+
+        # We will want to alert on failure of this rule to deliver events to the ingest queue
+        Alarm(
+            self,
+            'V1IngestRuleFailedInvocations',
+            metric=Metric(
+                namespace='AWS/Events',
+                metric_name='FailedInvocations',
+                dimensions_map={
+                    'EventBusName': persistent_stack.data_event_bus.event_bus_name,
+                    'RuleName': ingest_rule.rule_name,
+                },
+                period=Duration.minutes(5),
+                statistic='Sum',
+            ),
+            evaluation_periods=1,
+            threshold=1,
+            comparison_operator=ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+            treat_missing_data=TreatMissingData.NOT_BREACHING,
+        ).add_alarm_action(SnsAction(persistent_stack.alarm_topic))
diff --git a/backend/compact-connect/stacks/persistent_stack/__init__.py b/backend/compact-connect/stacks/persistent_stack/__init__.py
index 22a9862a9..1d091dc23 100644
--- a/backend/compact-connect/stacks/persistent_stack/__init__.py
+++ b/backend/compact-connect/stacks/persistent_stack/__init__.py
@@ -21,6 +21,7 @@
 from stacks.persistent_stack.provider_table import ProviderTable
 from stacks.persistent_stack.provider_users import ProviderUsers
 from stacks.persistent_stack.provider_users_bucket import ProviderUsersBucket
+from stacks.persistent_stack.ssn_table import SSNTable
 from stacks.persistent_stack.staff_users import StaffUsers
 from stacks.persistent_stack.user_email_notifications import UserEmailNotifications
 
@@ -220,6 +221,8 @@ def _add_data_resources(self, removal_policy: RemovalPolicy):
             self, 'ProviderTable', encryption_key=self.shared_encryption_key, removal_policy=removal_policy
         )
 
+        self.ssn_table = SSNTable(self, 'SSNTable', removal_policy=removal_policy)
+
         self.data_event_table = DataEventTable(
             self,
             'DataEventTable',
diff --git a/backend/compact-connect/stacks/persistent_stack/bulk_uploads_bucket.py b/backend/compact-connect/stacks/persistent_stack/bulk_uploads_bucket.py
index 0dae0b499..6b31a363e 100644
--- a/backend/compact-connect/stacks/persistent_stack/bulk_uploads_bucket.py
+++ b/backend/compact-connect/stacks/persistent_stack/bulk_uploads_bucket.py
@@ -132,7 +132,7 @@ def _add_v1_ingest_object_events(self, event_bus: EventBus):
             suppressions=[
                 {
                     'id': 'AwsSolutions-IAM5',
-                    'applies_to': ['Resource::*'],
+                    'appliesTo': ['Resource::*'],
                     'reason': """
                     The lambda policy is scoped specifically to the PutBucketNotification action, which
                     suits its purpose.
@@ -146,7 +146,7 @@ def _add_v1_ingest_object_events(self, event_bus: EventBus):
             suppressions=[
                 {
                     'id': 'AwsSolutions-IAM4',
-                    'applies_to': [
+                    'appliesTo': [
                         'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
                     ],
                     'reason': 'The BasicExecutionRole policy is appropriate for this lambda',
diff --git a/backend/compact-connect/stacks/persistent_stack/compact_configuration_upload.py b/backend/compact-connect/stacks/persistent_stack/compact_configuration_upload.py
index b44ebcb13..0656fb110 100644
--- a/backend/compact-connect/stacks/persistent_stack/compact_configuration_upload.py
+++ b/backend/compact-connect/stacks/persistent_stack/compact_configuration_upload.py
@@ -106,7 +106,9 @@ def __init__(
             suppressions=[
                 {
                     'id': 'AwsSolutions-IAM4',
-                    'applies_to': 'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',  # noqa: E501 line-too-long
+                    'appliesTo': [
+                        'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
+                    ],  # noqa: E501 line-too-long
                     'reason': 'This policy is appropriate for the log retention lambda',
                 },
             ],
diff --git a/backend/compact-connect/stacks/persistent_stack/data_event_table.py b/backend/compact-connect/stacks/persistent_stack/data_event_table.py
index 0e8987bdd..13ecd2d52 100644
--- a/backend/compact-connect/stacks/persistent_stack/data_event_table.py
+++ b/backend/compact-connect/stacks/persistent_stack/data_event_table.py
@@ -3,7 +3,7 @@
 import os
 
 from aws_cdk import Duration, RemovalPolicy
-from aws_cdk.aws_cloudwatch import Alarm, ComparisonOperator, Stats, TreatMissingData
+from aws_cdk.aws_cloudwatch import Alarm, ComparisonOperator, Metric, Stats, TreatMissingData
 from aws_cdk.aws_cloudwatch_actions import SnsAction
 from aws_cdk.aws_dynamodb import Attribute, AttributeType, BillingMode, Table, TableEncryption
 from aws_cdk.aws_events import EventPattern, IEventBus, Match, Rule
@@ -98,7 +98,7 @@ def __init__(
             alarm_topic=alarm_topic,
         )
 
-        Rule(
+        event_receiver_rule = Rule(
             self,
             'EventReceiverRule',
             event_bus=event_bus,
@@ -107,6 +107,27 @@ def __init__(
             event_pattern=EventPattern(detail_type=Match.prefix('')),
             targets=[SqsQueue(self.event_processor.queue, dead_letter_queue=self.event_processor.dlq)],
         )
+
+        # We will want to alert on failure of this rule to deliver events to the data events queue
+        Alarm(
+            self,
+            'DataSourceRuleFailedInvocations',
+            metric=Metric(
+                namespace='AWS/Events',
+                metric_name='FailedInvocations',
+                dimensions_map={
+                    'EventBusName': stack.data_event_bus.event_bus_name,
+                    'RuleName': event_receiver_rule.rule_name,
+                },
+                period=Duration.minutes(5),
+                statistic='Sum',
+            ),
+            evaluation_periods=1,
+            threshold=1,
+            comparison_operator=ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+            treat_missing_data=TreatMissingData.NOT_BREACHING,
+        ).add_alarm_action(SnsAction(stack.alarm_topic))
+
         NagSuppressions.add_resource_suppressions(
             self,
             suppressions=[
diff --git a/backend/compact-connect/stacks/persistent_stack/provider_users_bucket.py b/backend/compact-connect/stacks/persistent_stack/provider_users_bucket.py
index 68f255d65..17b896039 100644
--- a/backend/compact-connect/stacks/persistent_stack/provider_users_bucket.py
+++ b/backend/compact-connect/stacks/persistent_stack/provider_users_bucket.py
@@ -131,7 +131,7 @@ def _add_v1_object_events(self, provider_table: Table, encryption_key: IKey):
             suppressions=[
                 {
                     'id': 'AwsSolutions-IAM5',
-                    'applies_to': ['Resource::*'],
+                    'appliesTo': ['Resource::*'],
                     'reason': """
                     The lambda policy is scoped specifically to the PutBucketNotification action, which
                     suits its purpose.
@@ -145,7 +145,7 @@ def _add_v1_object_events(self, provider_table: Table, encryption_key: IKey):
             suppressions=[
                 {
                     'id': 'AwsSolutions-IAM4',
-                    'applies_to': [
+                    'appliesTo': [
                         'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
                     ],
                     'reason': 'The BasicExecutionRole policy is appropriate for this lambda',
diff --git a/backend/compact-connect/stacks/persistent_stack/ssn_table.py b/backend/compact-connect/stacks/persistent_stack/ssn_table.py
new file mode 100644
index 000000000..c8348374f
--- /dev/null
+++ b/backend/compact-connect/stacks/persistent_stack/ssn_table.py
@@ -0,0 +1,172 @@
+from aws_cdk import RemovalPolicy
+from aws_cdk.aws_dynamodb import Attribute, AttributeType, BillingMode, ProjectionType, Table, TableEncryption
+from aws_cdk.aws_iam import (
+    Effect,
+    ManagedPolicy,
+    PolicyDocument,
+    PolicyStatement,
+    Role,
+    ServicePrincipal,
+    StarPrincipal,
+)
+from aws_cdk.aws_kms import Key
+from cdk_nag import NagSuppressions
+from common_constructs.stack import Stack
+from constructs import Construct
+
+
+class SSNTable(Table):
+    """DynamoDB table to house provider Social Security Numbers"""
+
+    def __init__(
+        self,
+        scope: Construct,
+        construct_id: str,
+        *,
+        removal_policy: RemovalPolicy,
+        **kwargs,
+    ):
+        self.key = Key(
+            scope,
+            'SSNKey',
+            enable_key_rotation=True,
+            alias='ssn-key',
+            removal_policy=removal_policy,
+        )
+
+        super().__init__(
+            scope,
+            construct_id,
+            # Forcing this resource name to comply with a naming-pattern-based CloudTrail log, to be
+            # implemented in issue https://github.com/csg-org/CompactConnect/issues/397
+            table_name='ssn-table-DataEventsLog',
+            encryption=TableEncryption.CUSTOMER_MANAGED,
+            encryption_key=self.key,
+            billing_mode=BillingMode.PAY_PER_REQUEST,
+            removal_policy=removal_policy,
+            point_in_time_recovery=True,
+            partition_key=Attribute(name='pk', type=AttributeType.STRING),
+            sort_key=Attribute(name='sk', type=AttributeType.STRING),
+            resource_policy=PolicyDocument(
+                statements=[
+                    PolicyStatement(
+                        # No actions that involve reading/writing more than one record at a time. In the event of a
+                        # compromise, this slows down a potential data extraction, since each record would need to be
+                        # pulled, one at a time
+                        effect=Effect.DENY,
+                        actions=[
+                            'dynamodb:BatchGetItem',
+                            'dynamodb:BatchWriteItem',
+                            'dynamodb:PartiQL*',
+                            'dynamodb:Query',
+                            'dynamodb:Scan',
+                        ],
+                        principals=[StarPrincipal()],
+                        resources=['*'],
+                        conditions={
+                            'StringNotEquals': {
+                                # We will allow DynamoDB itself, so it can do internal operations like backups
+                                'aws:PrincipalServiceName': 'dynamodb.amazonaws.com',
+                            }
+                        },
+                    )
+                ]
+            ),
+            **kwargs,
+        )
+
+        # We create a GSI here in anticipation of a future change, where we will need to facilitate a lookup
+        # of provider_id -> ssn, in addition to our current ssn -> provider_id pattern.
+        self.inverted_index_name = 'inverted'
+        self.add_global_secondary_index(
+            index_name=self.inverted_index_name,
+            partition_key=Attribute(name='sk', type=AttributeType.STRING),
+            sort_key=Attribute(name='pk', type=AttributeType.STRING),
+            projection_type=ProjectionType.ALL,
+        )
+
+        NagSuppressions.add_resource_suppressions(
+            self,
+            suppressions=[
+                {
+                    'id': 'HIPAA.Security-DynamoDBInBackupPlan',
+                    'reason': 'We will implement data back-ups after we better understand regulatory data deletion'
+                    ' requirements',
+                },
+            ],
+        )
+
+        self._configure_access()
+
+    def _configure_access(self):
+        self.ingest_role = Role(
+            self,
+            'LicenseIngestRole',
+            assumed_by=ServicePrincipal('lambda.amazonaws.com'),
+            description='Dedicated role for license ingest, with access to full SSNs',
+            managed_policies=[ManagedPolicy.from_aws_managed_policy_name('service-role/AWSLambdaBasicExecutionRole')],
+        )
+        self.grant_read_write_data(self.ingest_role)
+        self._role_suppressions(self.ingest_role)
+
+        # This role is to be removed, once full SSN access is removed from the /query API endpoint
+        # (https://github.com/csg-org/CompactConnect/issues/391). In the meantime, we will need to have a role the
+        # corresponding lambda can use.
+        self.api_query_role = Role(
+            self,
+            'ProviderQueryRole',
+            assumed_by=ServicePrincipal('lambda.amazonaws.com'),
+            description='Dedicated role for API provider queries, with access to full SSNs',
+            managed_policies=[ManagedPolicy.from_aws_managed_policy_name('service-role/AWSLambdaBasicExecutionRole')],
+        )
+        self.grant_read_data(self.api_query_role)
+        self._role_suppressions(self.api_query_role)
+
+        # This explicitly blocks any principals (including account admins) from reading data
+        # encrypted with this key other than our IAM roles declared here and dynamodb itself
+        self.key.add_to_resource_policy(
+            PolicyStatement(
+                effect=Effect.DENY,
+                actions=['kms:Decrypt', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'],
+                principals=[StarPrincipal()],
+                resources=['*'],
+                conditions={
+                    'StringNotEquals': {
+                        'aws:PrincipalArn': [self.ingest_role.role_arn, self.api_query_role.role_arn],
+                        'aws:PrincipalServiceName': ['dynamodb.amazonaws.com', 'events.amazonaws.com'],
+                    }
+                },
+            )
+        )
+        self.key.grant_decrypt(self.api_query_role)
+        self.key.grant_encrypt_decrypt(self.ingest_role)
+
+    def _role_suppressions(self, role: Role):
+        stack = Stack.of(role)
+        NagSuppressions.add_resource_suppressions_by_path(
+            stack,
+            f'{role.node.path}/Resource',
+            suppressions=[
+                {
+                    'id': 'AwsSolutions-IAM4',
+                    'appliesTo': [
+                        'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
+                    ],
+                    'reason': 'The BasicExecutionRole policy is appropriate for these lambdas',
+                },
+            ],
+        )
+        NagSuppressions.add_resource_suppressions_by_path(
+            stack,
+            f'{role.node.path}/DefaultPolicy/Resource',
+            suppressions=[
+                {
+                    'id': 'AwsSolutions-IAM5',
+                    'appliesTo': [f'Resource::<{stack.get_logical_id(self.node.default_child)}.Arn>/index/*'],
+                    'reason': """
+                    This policy contains wild-carded actions and resources but they are scoped to the
+                    specific actions, KMS key and Table that this lambda specifically needs access to.
+                    """,
+                },
+            ],
+        )
diff --git a/backend/compact-connect/stacks/ui_stack/distribution.py b/backend/compact-connect/stacks/ui_stack/distribution.py
index def326097..8e6333b86 100644
--- a/backend/compact-connect/stacks/ui_stack/distribution.py
+++ b/backend/compact-connect/stacks/ui_stack/distribution.py
@@ -84,7 +84,7 @@ def __init__(
             suppressions=[
                 {
                     'id': 'AwsSolutions-IAM4',
-                    'applies_to': [
+                    'appliesTo': [
                         'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
                     ],
                     'reason': 'This policy enables CloudWatch logging and is appropriate for this lambda',
diff --git a/backend/compact-connect/tests/app/base.py b/backend/compact-connect/tests/app/base.py
index 44632eec1..b8ff8b373 100644
--- a/backend/compact-connect/tests/app/base.py
+++ b/backend/compact-connect/tests/app/base.py
@@ -12,6 +12,7 @@
 from aws_cdk.aws_cognito import CfnUserPool, CfnUserPoolClient
 from aws_cdk.aws_dynamodb import CfnTable
 from aws_cdk.aws_events import CfnRule
+from aws_cdk.aws_kms import CfnKey
 from aws_cdk.aws_lambda import CfnEventSourceMapping
 from aws_cdk.aws_s3 import CfnBucket
 from aws_cdk.aws_sqs import CfnQueue
@@ -144,6 +145,72 @@ def _inspect_persistent_stack(
                 provider_users_user_pool_app_client['WriteAttributes'], ['email', 'family_name', 'given_name']
             )
             self._inspect_data_events_table(persistent_stack, persistent_stack_template)
+            self._inspect_ssn_table(persistent_stack, persistent_stack_template)
+
+    def _inspect_ssn_table(self, persistent_stack: PersistentStack, persistent_stack_template: Template):
+        ssn_key_logical_id = persistent_stack.get_logical_id(persistent_stack.ssn_table.key.node.default_child)
+        ingest_role_logical_id = persistent_stack.get_logical_id(
+            persistent_stack.ssn_table.ingest_role.node.default_child
+        )
+        api_query_role_logical_id = persistent_stack.get_logical_id(
+            persistent_stack.ssn_table.api_query_role.node.default_child
+        )
+        ssn_table_template = self.get_resource_properties_by_logical_id(
+            persistent_stack.get_logical_id(persistent_stack.ssn_table.node.default_child),
+            persistent_stack_template.find_resources(CfnTable.CFN_RESOURCE_TYPE_NAME),
+        )
+        ssn_key_template = self.get_resource_properties_by_logical_id(
+            ssn_key_logical_id, persistent_stack_template.find_resources(CfnKey.CFN_RESOURCE_TYPE_NAME)
+        )
+        # This naming convention is important for opting into future CloudTrail organization access logging
+        self.assertTrue(ssn_table_template['TableName'].endswith('-DataEventsLog'))
+        # Ensure our SSN Key is locked down by resource policy
+        self.assertEqual(
+            ssn_key_template['KeyPolicy'],
+            {
+                'Statement': [
+                    {
+                        'Action': 'kms:*',
+                        'Effect': 'Allow',
+                        'Principal': {'AWS': f'arn:aws:iam::{persistent_stack.account}:root'},
+                        'Resource': '*',
+                    },
+                    {
+                        'Action': ['kms:Decrypt', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'],
+                        'Condition': {
+                            'StringNotEquals': {
+                                'aws:PrincipalArn': [
+                                    {'Fn::GetAtt': [ingest_role_logical_id, 'Arn']},
+                                    {'Fn::GetAtt': [api_query_role_logical_id, 'Arn']},
+                                ],
+                                'aws:PrincipalServiceName': ['dynamodb.amazonaws.com', 'events.amazonaws.com'],
+                            }
+                        },
+                        'Effect': 'Deny',
+                        'Principal': '*',
+                        'Resource': '*',
+                    },
+                    {
+                        'Action': ['kms:Decrypt', 'kms:Encrypt', 'kms:GenerateDataKey*', 'kms:ReEncrypt*'],
+                        'Condition': {'StringEquals': {'aws:SourceAccount': persistent_stack.account}},
+                        'Effect': 'Allow',
+                        'Principal': {'Service': 'events.amazonaws.com'},
+                        'Resource': '*',
+                    },
+                ],
+                'Version': '2012-10-17',
+            },
+        )
+        # Ensure we're using our locked down KMS key for encryption
+        self.assertEqual(
+            ssn_table_template['SSESpecification'],
+            {'KMSMasterKeyId': {'Fn::GetAtt': [ssn_key_logical_id, 'Arn']}, 'SSEEnabled': True, 'SSEType': 'KMS'},
+        )
+        self.compare_snapshot(
+            ssn_table_template['ResourcePolicy']['PolicyDocument'],
+            'SSN_TABLE_RESOURCE_POLICY',
+            overwrite_snapshot=False,
+        )
 
     def _inspect_data_events_table(self, persistent_stack: PersistentStack, persistent_stack_template: Template):
         # Ensure our DataEventTable and queues are created
diff --git a/backend/compact-connect/tests/resources/snapshots/SSN_TABLE_RESOURCE_POLICY.json b/backend/compact-connect/tests/resources/snapshots/SSN_TABLE_RESOURCE_POLICY.json
new file mode 100644
index 000000000..90e49f531
--- /dev/null
+++ b/backend/compact-connect/tests/resources/snapshots/SSN_TABLE_RESOURCE_POLICY.json
@@ -0,0 +1,22 @@
+{
+  "Statement": [
+    {
+      "Action": [
+        "dynamodb:BatchGetItem",
+        "dynamodb:BatchWriteItem",
+        "dynamodb:PartiQL*",
+        "dynamodb:Query",
+        "dynamodb:Scan"
+      ],
+      "Condition": {
+        "StringNotEquals": {
+          "aws:PrincipalServiceName": "dynamodb.amazonaws.com"
+        }
+      },
+      "Effect": "Deny",
+      "Principal": "*",
+      "Resource": "*"
+    }
+  ],
+  "Version": "2012-10-17"
+}
diff --git a/backend/multi-account/requirements.txt b/backend/multi-account/requirements.txt
index 8095cd239..ff90a86db 100644
--- a/backend/multi-account/requirements.txt
+++ b/backend/multi-account/requirements.txt
@@ -8,7 +8,7 @@ attrs==24.3.0
     # via
     #   cattrs
     #   jsii
-aws-cdk-asset-awscli-v1==2.2.215
+aws-cdk-asset-awscli-v1==2.2.216
     # via aws-cdk-lib
 aws-cdk-asset-kubectl-v20==2.1.3
     # via aws-cdk-lib
@@ -16,7 +16,7 @@ aws-cdk-asset-node-proxy-agent-v6==2.1.0
     # via aws-cdk-lib
 aws-cdk-cloud-assembly-schema==38.0.1
     # via aws-cdk-lib
-aws-cdk-lib==2.173.1
+aws-cdk-lib==2.173.2
     # via -r multi-account/requirements.in
 cattrs==24.1.2
     # via jsii
@@ -26,7 +26,7 @@ constructs==10.4.2
     #   aws-cdk-lib
 importlib-resources==6.4.5
     # via jsii
-jsii==1.105.0
+jsii==1.106.0
     # via
     #   aws-cdk-asset-awscli-v1
     #   aws-cdk-asset-kubectl-v20
diff --git a/webroot/README.md b/webroot/README.md
index 51fe3adde..4e89d4955 100644
--- a/webroot/README.md
+++ b/webroot/README.md
@@ -250,4 +250,4 @@ Note that testing the **built** app locally will require a running web server; f
     - When the user logs in as to the second user pool we record that the app should treat them as the second user type and save the initial access token
         - When the user logs out we check the existence of the access tokens to see which user pools we need to log out, and then chain logout redirects
         to visit all necessary logout pages
----
\ No newline at end of file
+---

From fb49f60c476ac7cb3d5b8d03fba30ea29f0bc97c Mon Sep 17 00:00:00 2001
From: landonshumway-ia <landon@inspiringapps.com>
Date: Fri, 27 Dec 2024 12:21:50 -0600
Subject: [PATCH 05/18] Feat/read access updates (#387)

---
 .../common_constructs/user_pool.py            |   3 +-
 backend/compact-connect/docs/design/README.md |  81 ++++---
 .../cc_common/data_model/schema/license.py    |  28 ++-
 .../data_model/schema/military_affiliation.py |  17 ++
 .../cc_common/data_model/schema/privilege.py  |  17 +-
 .../cc_common/data_model/schema/provider.py   |  61 ++++-
 .../cc_common/data_model/user_client.py       |   4 +-
 .../lambdas/python/common/cc_common/utils.py  |  82 ++++++-
 .../resources/api/provider-response.json      |   2 -
 .../test_authorize_compact_jurisdiction.py    |  12 +-
 .../tests/unit/test_sanitize_provider_data.py |  74 +++++++
 .../python/delete-objects/tests/__init__.py   |   0
 .../provider-data-v1/handlers/bulk_upload.py  |  14 +-
 .../provider-data-v1/handlers/providers.py    |  28 ++-
 .../test_provider_transformations.py          |   2 +-
 .../function/test_handlers/test_ingest.py     |  13 +-
 .../function/test_handlers/test_licenses.py   |   8 +-
 .../function/test_handlers/test_providers.py  |  69 ++++--
 .../staff-user-pre-token/tests/test_main.py   |   3 +-
 .../tests/test_user_scopes.py                 |  42 ++--
 .../staff-user-pre-token/user_scopes.py       |  25 ++-
 .../function/test_data_model/test_client.py   |   4 +-
 .../function/test_handlers/test_patch_user.py |  53 ++++-
 .../function/test_handlers/test_post_user.py  |   4 +-
 .../tests/resources/api/user-post.json        |   2 +-
 .../tests/resources/api/user-response.json    |   2 +-
 .../tests/resources/dynamo/user.json          |   2 +-
 .../tests/unit/test_authorize_compact.py      |  12 +-
 .../tests/unit/test_collect_changes.py        |   8 +-
 .../stacks/api_stack/v1_api/api.py            |  12 +-
 .../stacks/api_stack/v1_api/api_model.py      |   6 +-
 .../stacks/api_stack/v1_api/staff_users.py    |  14 +-
 .../stacks/persistent_stack/staff_users.py    |  15 +-
 .../tests/app/test_api/test_purchases_api.py  |   8 +-
 .../app/test_api/test_staff_users_api.py      | 194 ++++++++++++++++
 .../tests/app/test_pipeline.py                |  30 ++-
 .../PATCH_STAFF_USERS_REQUEST_SCHEMA.json     |  53 +++++
 .../PATCH_STAFF_USERS_RESPONSE_SCHEMA.json    |  87 ++++++++
 .../POST_STAFF_USERS_REQUEST_SCHEMA.json      |  83 +++++++
 .../POST_STAFF_USERS_RESPONSE_SCHEMA.json     |  87 ++++++++
 backend/compact-connect/tests/smoke/config.py |  67 ++++++
 .../tests/smoke/license_upload_smoke_tests.py |  24 +-
 .../smoke/military_affiliation_smoke_tests.py |   9 +-
 .../purchasing_privileges_smoke_tests.py      |  28 ++-
 .../tests/smoke/query_provider_smoke_tests.py | 209 ++++++++++++++++++
 .../tests/smoke/smoke_common.py               | 150 ++++++++++++-
 .../tests/smoke/smoke_tests_env_example.json  |   9 +-
 47 files changed, 1574 insertions(+), 183 deletions(-)
 create mode 100644 backend/compact-connect/lambdas/python/common/tests/unit/test_sanitize_provider_data.py
 delete mode 100644 backend/compact-connect/lambdas/python/delete-objects/tests/__init__.py
 create mode 100644 backend/compact-connect/tests/app/test_api/test_staff_users_api.py
 create mode 100644 backend/compact-connect/tests/resources/snapshots/PATCH_STAFF_USERS_REQUEST_SCHEMA.json
 create mode 100644 backend/compact-connect/tests/resources/snapshots/PATCH_STAFF_USERS_RESPONSE_SCHEMA.json
 create mode 100644 backend/compact-connect/tests/resources/snapshots/POST_STAFF_USERS_REQUEST_SCHEMA.json
 create mode 100644 backend/compact-connect/tests/resources/snapshots/POST_STAFF_USERS_RESPONSE_SCHEMA.json
 create mode 100644 backend/compact-connect/tests/smoke/config.py
 create mode 100644 backend/compact-connect/tests/smoke/query_provider_smoke_tests.py

diff --git a/backend/compact-connect/common_constructs/user_pool.py b/backend/compact-connect/common_constructs/user_pool.py
index 88b547b99..b77366346 100644
--- a/backend/compact-connect/common_constructs/user_pool.py
+++ b/backend/compact-connect/common_constructs/user_pool.py
@@ -165,7 +165,8 @@ def add_ui_client(
         return self.add_client(
             'UIClient',
             auth_flows=AuthFlow(
-                admin_user_password=False,
+                # we allow this in test environments for automated testing
+                admin_user_password=self.security_profile == SecurityProfile.VULNERABLE,
                 custom=False,
                 user_srp=self.security_profile == SecurityProfile.VULNERABLE,
                 user_password=False,
diff --git a/backend/compact-connect/docs/design/README.md b/backend/compact-connect/docs/design/README.md
index e66ab6639..afe7b56b7 100644
--- a/backend/compact-connect/docs/design/README.md
+++ b/backend/compact-connect/docs/design/README.md
@@ -72,29 +72,49 @@ the accompanying [architecture diagram](./users-arch-diagram.pdf) for an illustr
 
 ### Staff Users
 
-Staff users come with a variety of different permissions, depending on their role. There are Compact Executive
-Directors, Compact ED Staff, Board Executive Directors, Board ED Staff, and CSG Admins, each with different levels
-of ability to read and write data, and to administrate users. Read permissions are granted to a user for an entire
-compact or not at all. Data writing and user administration permissions can each be granted to a user per
-compact/jurisdiction combination. All of a compact user's permissions are stored in a DynamoDB record that is associated
-with their own Cognito user id. That record will be used to generate scopes in the Oauth2 token issued to them on login.
-See [Implementation of scopes](#implementation-of-scopes) for a detailed explanation of the design for exactly how
-permissions will be represented by scopes in an access token. See
+Staff users will be granted a variety of different permissions, depending on their role. Read permissions are granted 
+to a user for an entire compact or not at all. Data writing and user administration permissions can each be granted to 
+a user per compact/jurisdiction combination. All of a compact user's permissions are stored in a DynamoDB record that is
+associated with their own Cognito user id. That record will be used to generate scopes in the Oauth2 token issued to them
+on login. See [Implementation of scopes](#implementation-of-scopes) for a detailed explanation of the design for exactly
+how permissions will be represented by scopes in an access token. See 
 [Implementation of permissions](#implementation-of-permissions) for a detailed explanation of the design for exactly
 how permissions are stored and translated into scopes.
 
-#### Compact Executive Directors and Staff
+#### Common Staff User Types
+The system permissions are designed around several common types of staff users. It is important to note that these user
+types are an abstraction which do not correlate directly to specific roles or access within the system. All access is
+controlled by the specific permissions associated with a user. Still, these abstractions are useful for understanding
+the system's design.
 
-Compact ED level staff can have permission to read all compact data as well as to create and manage users and their
-permissions. They can grant other users the ability to write data for a particular jurisdiction and to create more
-users associated with a particular jurisdiction. They can also delete any user within their compact, so long as that
-user does not have permissions associated with a different compact.
+##### Compact Executive Directors and Staff
 
-#### Board Executive Directors and Staff
+Compact ED level staff will typically be granted the following permissions at the compact level:
 
-Board ED level staff can have permission to read all compact data, write data to for their own jurisdiction, and to
-create more users that have permissions within their own jurisdiction. They can also delete any user within their
-jurisdiction, so long as that user does not have permissions associated with a different compact or jurisdiction.
+- `admin` - grants access to administrative functions for the compact, such as creating and managing users and their
+  permissions.
+- `readPrivate` - grants access to view all data for any licensee within the compact.
+
+With the `admin` permission, they can grant other users the ability to write data for a particular
+jurisdiction and to create more users associated with a particular jurisdiction. They can also delete any user within 
+their compact, so long as that user does not have permissions associated with a different compact, in which case the
+permissions from the other compact would have to be removed first.
+
+Users granted any of these permissions will also be implicitly granted the `readGeneral` scope for the associated compact,
+which allows them to read any licensee data within that compact that is not considered private.
+
+##### Board Executive Directors and Staff
+
+Board ED level staff may be granted the following permissions at a jurisdiction level:
+
+- `admin` - grants access to administrative functions for the jurisdiction, such as creating and managing users and 
+their permissions.
+- `write` - grants access to write data for their particular jurisdiction (ie uploading license information).
+- `readPrivate` - grants access to view all information for any licensee that has either a license or privilege
+within their jurisdiction. 
+
+Users granted any of these permissions will also be implicitly granted the `readGeneral` scope for the associated compact,
+which allows them to read any licensee data that is not considered private.
 
 #### Implementation of Scopes
 
@@ -109,17 +129,22 @@ require more than 100 scopes per resource server.
 
 To design around the 100 scope limit, we will have to split authorization into two layers: coarse- and fine-grained.
 We can rely on the Cognito authorizers to protect our API endpoints based on fewer coarse-grained scopes, then
-protect the more fine-grained access within the API endpoint logic. The Staff User pool resource servers will are
-configured with `read`, `write`, and `admin` scopes. `read` scopes indicate that the user is allowed to read the
-entire compact's licensee data. `write` and `admin` scopes, however, indicate only that the user is allowed to write
-or administrate _something_ in the compact respectively, thus giving them access to the write or administrative
-API endpoints. We will then rely on the API endpoint logic to refine their access based on the more fine-grained
-access scopes.
-
-To compliment each of the `write` and `admin` scopes, there will be at least one, more specific, scope, to indicate
-_what_ within the compact they are allowed to write or administrate, respectively. In the case of `write` scopes,
-a jurisdiction-specific scope will control what jurisdiction they are able to write data for (i.e. `al.write` grants
-permission to write data for the Alabama jurisdiction). Similarly, `admin` scopes can have a jurisdiction-specific
+protect the more fine-grained access within the API endpoint logic. The Staff User pool resource servers are
+configured with `readGeneral`, `write`, and `admin` scopes. The `readGeneral` scope is implicitly granted to all users in
+the system, and is used to indicate that the user is allowed to read any compact's licensee data that is not considered
+private. The `write` and `admin` scopes, however, indicate only that the user is allowed to write or administrate 
+_something_ in the compact respectively, thus giving them access to the write or administrative API endpoints. We will 
+then rely on the API endpoint logic to refine their access based on the more fine-grained access scopes.
+
+In addition to the `readGeneral` scope, there is a `readPrivate` scope, which can be granted at both compact and 
+jurisdiction levels. This permission indicates the user can read all of a compact's provider data (licenses and privileges),
+so long as the provider has at least one license or privilege within their jurisdiction or the user has compact-wide 
+permissions.
+
+To compliment each of the `write` and `admin` scopes, there will be at least one, more specific, scope, 
+to indicate _what_ within the compact they are allowed to write or administrate, respectively. In the case of `write` 
+scopes, a jurisdiction-specific scope will control what jurisdiction they are able to write data for (i.e. `al.write` 
+grants permission to write data for the Alabama jurisdiction). Similarly, `admin` scopes can have a jurisdiction-specific
 scope like `al.admin` and can also have a compact-wide scope like `aslp.admin`, which grants permission for a compact
 executive director to perform the administrative functions for the Audiology and Speech Language Pathology compact.
 
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license.py
index 08f492f41..56a0dd410 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license.py
@@ -14,21 +14,41 @@
 )
 
 
-class LicensePublicSchema(ForgivingSchema):
-    """Schema for license data that can be shared with the public"""
+class LicenseReadGeneralSchema(ForgivingSchema):
+    """
+    License fields available for staff users with the 'readGeneral' permission.
+
+    This schema is explicitly separated from the common schema to ensure we know what
+    fields are being returned for users with this permission.
+    """
 
-    birthMonthDay = String(required=False, allow_none=False, validate=Regexp('^[0-1]{1}[0-9]{1}-[0-3]{1}[0-9]{1}'))
+    providerId = UUID(required=True, allow_none=False)
+    type = String(required=True, allow_none=False)
+    dateOfUpdate = DateTime(required=True, allow_none=False)
     compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
     jurisdiction = String(required=True, allow_none=False, validate=OneOf(config.jurisdictions))
     licenseType = String(required=True, allow_none=False)
-    status = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
+    jurisdictionStatus = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
+    npi = String(required=False, allow_none=False, validate=Regexp('^[0-9]{10}$'))
     givenName = String(required=True, allow_none=False, validate=Length(1, 100))
     middleName = String(required=False, allow_none=False, validate=Length(1, 100))
     familyName = String(required=True, allow_none=False, validate=Length(1, 100))
     suffix = String(required=False, allow_none=False, validate=Length(1, 100))
+    # These date values are determined by the license records uploaded by a state
+    # they do not include a timestamp, so we use the Date field type
     dateOfIssuance = Date(required=True, allow_none=False)
     dateOfRenewal = Date(required=True, allow_none=False)
     dateOfExpiration = Date(required=True, allow_none=False)
+    homeAddressStreet1 = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressStreet2 = String(required=False, allow_none=False, validate=Length(1, 100))
+    homeAddressCity = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressState = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressPostalCode = String(required=True, allow_none=False, validate=Length(5, 7))
+    emailAddress = Email(required=False, allow_none=False, validate=Length(1, 100))
+    phoneNumber = ITUTE164PhoneNumber(required=False, allow_none=False)
+    status = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
+
+    militaryWaiver = Boolean(required=False, allow_none=False)
 
 
 class LicenseCommonSchema(ForgivingSchema):
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation.py
index acd5a18b3..10b41b767 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation.py
@@ -68,3 +68,20 @@ class PostMilitaryAffiliationResponseSchema(ForgivingSchema):
     documentUploadFields = List(
         Nested(S3PresignedPostSchema(), required=True, allow_none=False), required=True, allow_none=False
     )
+
+
+class MilitaryAffiliationGeneralResponseSchema(ForgivingSchema):
+    """
+    Schema defining fields available to all staff users with the 'readGeneral' permission.
+    """
+
+    type = String(required=True, allow_none=False)
+    dateOfUpdate = DateTime(required=True, allow_none=False)
+    providerId = UUID(required=True, allow_none=False)
+    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
+    fileNames = List(String(required=True, allow_none=False), required=True, allow_none=False)
+    affiliationType = String(
+        required=True, allow_none=False, validate=OneOf([e.value for e in MilitaryAffiliationType])
+    )
+    dateOfUpload = DateTime(required=True, allow_none=False)
+    status = String(required=True, allow_none=False, validate=OneOf([e.value for e in MilitaryAffiliationStatus]))
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege.py
index 6b54ecfb4..a60dae34a 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege.py
@@ -5,7 +5,7 @@
 from marshmallow.validate import Length, OneOf
 
 from cc_common.config import config
-from cc_common.data_model.schema.base_record import BaseRecordSchema, CalculatedStatusRecordSchema
+from cc_common.data_model.schema.base_record import BaseRecordSchema, CalculatedStatusRecordSchema, ForgivingSchema
 from cc_common.data_model.schema.common import ensure_value_is_datetime
 
 
@@ -50,3 +50,18 @@ def _enforce_datetimes(self, in_data, **kwargs):
         in_data['dateOfIssuance'] = ensure_value_is_datetime(in_data['dateOfIssuance'])
 
         return in_data
+
+
+class PrivilegeGeneralResponseSchema(ForgivingSchema):
+    type = String(required=True, allow_none=False)
+    dateOfUpdate = DateTime(required=True, allow_none=False)
+    providerId = UUID(required=True, allow_none=False)
+    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
+    jurisdiction = String(required=True, allow_none=False, validate=OneOf(config.jurisdictions))
+    dateOfIssuance = DateTime(required=True, allow_none=False)
+    dateOfRenewal = DateTime(required=True, allow_none=False)
+    # this is determined by the license expiration date, which is a date field, so this is also a date field
+    dateOfExpiration = Date(required=True, allow_none=False)
+    # the id of the transaction that was made when the user purchased the privilege
+    compactTransactionId = String(required=False, allow_none=False)
+    status = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider.py
index 8307a10e0..e5a6ee567 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider.py
@@ -2,7 +2,7 @@
 from urllib.parse import quote
 
 from marshmallow import ValidationError, post_load, pre_dump, pre_load, validates_schema
-from marshmallow.fields import UUID, Boolean, Date, DateTime, Email, String
+from marshmallow.fields import UUID, Boolean, Date, DateTime, Email, List, Nested, String
 from marshmallow.validate import Length, OneOf, Regexp
 
 from cc_common.config import config
@@ -15,10 +15,14 @@
     SocialSecurityNumber,
 )
 from cc_common.data_model.schema.common import ensure_value_is_datetime
+from cc_common.data_model.schema.license import LicenseReadGeneralSchema
+from cc_common.data_model.schema.military_affiliation import MilitaryAffiliationGeneralResponseSchema
+from cc_common.data_model.schema.privilege import PrivilegeGeneralResponseSchema
 
 
-class ProviderPublicSchema(ForgivingSchema):
-    """Schema for license data that can be shared with the public"""
+class ProviderPrivateSchema(ForgivingSchema):
+    """Schema for provider data that can be shared with the staff users with the appropriate permissions, as well as
+    the provider themselves"""
 
     # Provided fields
     providerId = UUID(required=True, allow_none=False)
@@ -57,7 +61,7 @@ def validate_license_type(self, data, **kwargs):  # noqa: ARG001 unused-argument
 
 
 @BaseRecordSchema.register_schema('provider')
-class ProviderRecordSchema(CalculatedStatusRecordSchema, ProviderPublicSchema):
+class ProviderRecordSchema(CalculatedStatusRecordSchema, ProviderPrivateSchema):
     """Schema for license records in the license data table"""
 
     _record_type = 'provider'
@@ -105,3 +109,52 @@ def populate_fam_giv_mid(self, in_data, **kwargs):  # noqa: ARG001 unused-argume
     def drop_fam_giv_mid(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
         del in_data['providerFamGivMid']
         return in_data
+
+
+class SanitizedProviderReadGeneralSchema(ForgivingSchema):
+    """
+    Provider record fields that are sanitized for users with the 'readGeneral' permission.
+
+    This schema is intended to be used to dump records from the database in order to remove all fields not defined here.
+    It should NEVER be used to load data into the database. Use the ProviderRecordSchema for that.
+
+    This schema should be used by any endpoint that returns provider information to staff users (ie the query provider
+    and GET provider endpoints).
+    """
+
+    providerId = UUID(required=True, allow_none=False)
+    type = String(required=True, allow_none=False)
+
+    dateOfUpdate = DateTime(required=True, allow_none=False)
+    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
+    licenseJurisdiction = String(required=True, allow_none=False, validate=OneOf(config.jurisdictions))
+    npi = String(required=False, allow_none=False, validate=Regexp('^[0-9]{10}$'))
+    licenseType = String(required=True, allow_none=False)
+    jurisdictionStatus = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
+    givenName = String(required=True, allow_none=False, validate=Length(1, 100))
+    middleName = String(required=False, allow_none=False, validate=Length(1, 100))
+    familyName = String(required=True, allow_none=False, validate=Length(1, 100))
+    suffix = String(required=False, allow_none=False, validate=Length(1, 100))
+    # This date is determined by the license records uploaded by a state
+    # they do not include a timestamp, so we use the Date field type
+    dateOfExpiration = Date(required=True, allow_none=False)
+    homeAddressStreet1 = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressStreet2 = String(required=False, allow_none=False, validate=Length(1, 100))
+    homeAddressCity = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressState = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressPostalCode = String(required=True, allow_none=False, validate=Length(5, 7))
+    emailAddress = Email(required=False, allow_none=False, validate=Length(1, 100))
+    phoneNumber = ITUTE164PhoneNumber(required=False, allow_none=False)
+    status = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
+    militaryWaiver = Boolean(required=False, allow_none=False)
+
+    privilegeJurisdictions = Set(String, required=False, allow_none=False, load_default=set())
+    providerFamGivMid = String(required=False, allow_none=False, validate=Length(2, 400))
+    providerDateOfUpdate = DateTime(required=False, allow_none=False)
+    birthMonthDay = String(required=False, allow_none=False, validate=Regexp('^[0-1]{1}[0-9]{1}-[0-3]{1}[0-9]{1}'))
+
+    # these records are present when getting provider information from the GET endpoint
+    # so we check for them here and sanitize them if they are present
+    licenses = List(Nested(LicenseReadGeneralSchema(), required=False, allow_none=False))
+    privileges = List(Nested(PrivilegeGeneralResponseSchema(), required=False, allow_none=False))
+    militaryAffiliations = List(Nested(MilitaryAffiliationGeneralResponseSchema(), required=False, allow_none=False))
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/user_client.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/user_client.py
index ca1264bdf..3e59e83aa 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/user_client.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/user_client.py
@@ -96,10 +96,10 @@ def update_user_permissions(
         ```json
         {
           "permissions": {
-            "actions": { "admin" }
+            "actions": { "admin", "readPrivate" },
             "jurisdictions": {
               "oh": {
-                "actions": { "admin", "write" }
+                "actions": { "admin", "write", "readPrivate" }
               }
             }
           }
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/utils.py b/backend/compact-connect/lambdas/python/common/cc_common/utils.py
index 1702efadb..ff1e9ee84 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/utils.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/utils.py
@@ -11,6 +11,7 @@
 from botocore.exceptions import ClientError
 
 from cc_common.config import logger
+from cc_common.data_model.schema.provider import SanitizedProviderReadGeneralSchema
 from cc_common.exceptions import (
     CCAccessDeniedException,
     CCInvalidRequestException,
@@ -120,7 +121,7 @@ def caught_handler(event, context: LambdaContext):
 
 
 class authorize_compact:  # noqa: N801 invalid-name
-    """Authorize endpoint by matching path parameter compact to the expected scope, (i.e. aslp/read)"""
+    """Authorize endpoint by matching path parameter compact to the expected scope, (i.e. aslp/readGeneral)"""
 
     def __init__(self, action: str):
         super().__init__()
@@ -165,8 +166,9 @@ def _authorize_compact_with_scope(event: dict, resource_parameter: str, scope_pa
     For each of these actions, specific rules apply to the scope required to perform the action, which are
     as follows:
 
-    Read - granted at compact level, allows read access to all jurisdictions within the compact.
-    i.e. aslp/read would allow read access to all jurisdictions within the aslp compact.
+    ReadGeneral - granted at compact level, allows read access to all generally available (not private) jurisdiction
+    data within the compact.
+    i.e. aslp/readGeneral would allow read access to all generally available jurisdiction data within the aslp compact.
 
     Write - granted at jurisdiction level, allows write access to a specific jurisdiction within the compact.
     i.e. aslp/oh.write would allow write access to the ohio jurisdiction within the aslp compact.
@@ -309,6 +311,12 @@ def get_allowed_jurisdictions(*, compact: str, scopes: set[str]) -> list[str] |
 
 
 def get_event_scopes(event: dict):
+    """
+    Get the scopes from the event object and return them as a list.
+
+    :param dict event: The event object passed to the lambda function.
+    :return: The scopes from the event object.
+    """
     return set(event['requestContext']['authorizer']['claims']['scope'].split(' '))
 
 
@@ -345,6 +353,13 @@ def collect_and_authorize_changes(*, path_compact: str, scopes: set, compact_cha
     for action, value in compact_changes.get('actions', {}).items():
         if action == 'admin' and f'{path_compact}/{path_compact}.admin' not in scopes:
             raise CCAccessDeniedException('Only compact admins can affect compact-level admin permissions')
+        if action == 'readPrivate' and f'{path_compact}/{path_compact}.admin' not in scopes:
+            raise CCAccessDeniedException('Only compact admins can affect compact-level access to private information')
+
+        # dropping the read action as this is now implicitly granted to all users
+        if action == 'read':
+            logger.info('Dropping "read" action as this is implicitly granted to all users')
+            continue
         # Any admin in the compact can affect read permissions, so no read-specific check is necessary here
         if value:
             compact_action_additions.add(action)
@@ -360,6 +375,11 @@ def collect_and_authorize_changes(*, path_compact: str, scopes: set, compact_cha
             )
 
         for action, value in jurisdiction_changes.get('actions', {}).items():
+            # dropping the read action as this is now implicitly granted to all users
+            if action == 'read':
+                logger.info('Dropping "read" action as this is implicitly granted to all users')
+                continue
+
             if value:
                 jurisdiction_action_additions.setdefault(jurisdiction, set()).add(action)
             else:
@@ -378,3 +398,59 @@ def get_sub_from_user_attributes(attributes: list):
         if attribute['Name'] == 'sub':
             return attribute['Value']
     raise ValueError('Failed to find user sub!')
+
+
+def _user_has_private_read_access_for_provider(compact: str, provider_information: dict, scopes: set[str]) -> bool:
+    if f'{compact}/{compact}.readPrivate' in scopes:
+        logger.debug(
+            'User has readPrivate permission at compact level',
+            compact=compact,
+            provider_id=provider_information['providerId'],
+        )
+        return True
+
+    # iterate through the users privileges and licenses and create a set out of all the jurisdictions
+    relevant_provider_jurisdictions = set()
+    for privilege in provider_information.get('privileges', []):
+        relevant_provider_jurisdictions.add(privilege['jurisdiction'])
+    for license_record in provider_information.get('licenses', []):
+        relevant_provider_jurisdictions.add(license_record['jurisdiction'])
+
+    for jurisdiction in relevant_provider_jurisdictions:
+        if f'{compact}/{jurisdiction}.readPrivate' in scopes:
+            logger.debug(
+                'User has readPrivate permission at jurisdiction level',
+                compact=compact,
+                provider_id=provider_information['providerId'],
+                jurisdiction=jurisdiction,
+            )
+            return True
+
+    logger.debug(
+        'Caller does not have readPrivate permission at compact or jurisdiction level',
+        provider_id=provider_information['providerId'],
+    )
+    return False
+
+
+def sanitize_provider_data_based_on_caller_scopes(compact: str, provider: dict, scopes: set[str]) -> dict:
+    """
+    Take a provider and a set of user scopes, then return a provider, with information sanitized based on what
+    the user is authorized to view.
+
+    :param str compact: The compact the user is trying to access.
+    :param dict provider: The provider record to be sanitized.
+    :param set scopes: The user's scopes from the request.
+    :return: The provider record, sanitized based on the user's scopes.
+    """
+    if _user_has_private_read_access_for_provider(compact=compact, provider_information=provider, scopes=scopes):
+        # return full object since caller has 'readPrivate' access for provider
+        return provider
+
+    logger.debug(
+        'Caller does not have readPrivate at compact or jurisdiction level, removing private information',
+        provider_id=provider['providerId'],
+    )
+    provider_read_general_schema = SanitizedProviderReadGeneralSchema()
+    # we dump the record to ensure that the schema is applied to the record to remove private fields
+    return provider_read_general_schema.dump(provider)
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-response.json b/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-response.json
index 0b7b95072..7919bf431 100644
--- a/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-response.json
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-response.json
@@ -1,7 +1,6 @@
 {
   "type": "provider",
   "providerId": "89a6377e-c3a5-40e5-bca5-317ec854c570",
-  "ssn": "123-12-1234",
   "npi": "0608337260",
   "givenName": "Björk",
   "middleName": "Gunnar",
@@ -20,7 +19,6 @@
   "militaryWaiver": false,
   "emailAddress": "björk@example.com",
   "phoneNumber": "+13213214321",
-  "dateOfBirth": "2024-06-06",
   "dateOfUpdate": "2024-07-08T23:59:59+00:00",
   "dateOfExpiration": "2050-06-06",
   "birthMonthDay": "06-06"
diff --git a/backend/compact-connect/lambdas/python/common/tests/unit/test_authorize_compact_jurisdiction.py b/backend/compact-connect/lambdas/python/common/tests/unit/test_authorize_compact_jurisdiction.py
index da0d68269..6d0709c86 100644
--- a/backend/compact-connect/lambdas/python/common/tests/unit/test_authorize_compact_jurisdiction.py
+++ b/backend/compact-connect/lambdas/python/common/tests/unit/test_authorize_compact_jurisdiction.py
@@ -83,14 +83,14 @@ class TestAuthorizeCompact(TstLambdas):
     def test_authorize_compact(self):
         from cc_common.utils import authorize_compact
 
-        @authorize_compact(action='read')
+        @authorize_compact(action='readGeneral')
         def example_entrypoint(event: dict, context: LambdaContext):  # noqa: ARG001 unused-argument
             return {'body': 'Hurray!'}
 
         with open('tests/resources/api-event.json') as f:
             event = json.load(f)
 
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/readGeneral'
         event['pathParameters'] = {
             'compact': 'aslp',
         }
@@ -101,13 +101,13 @@ def test_no_path_param(self):
         from cc_common.exceptions import CCInvalidRequestException
         from cc_common.utils import authorize_compact
 
-        @authorize_compact(action='read')
+        @authorize_compact(action='readGeneral')
         def example_entrypoint(event: dict, context: LambdaContext):  # noqa: ARG001 unused-argument
             return {'body': 'Hurray!'}
 
         with open('tests/resources/api-event.json') as f:
             event = json.load(f)
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/readGeneral'
         event['pathParameters'] = {}
 
         with self.assertRaises(CCInvalidRequestException):
@@ -117,7 +117,7 @@ def test_no_authorizer(self):
         from cc_common.exceptions import CCUnauthorizedException
         from cc_common.utils import authorize_compact
 
-        @authorize_compact(action='read')
+        @authorize_compact(action='readGeneral')
         def example_entrypoint(event: dict, context: LambdaContext):  # noqa: ARG001 unused-argument
             return {'body': 'Hurray!'}
 
@@ -133,7 +133,7 @@ def test_missing_scope(self):
         from cc_common.exceptions import CCAccessDeniedException
         from cc_common.utils import authorize_compact
 
-        @authorize_compact(action='read')
+        @authorize_compact(action='readGeneral')
         def example_entrypoint(event: dict, context: LambdaContext):  # noqa: ARG001 unused-argument
             return {'body': 'Hurray!'}
 
diff --git a/backend/compact-connect/lambdas/python/common/tests/unit/test_sanitize_provider_data.py b/backend/compact-connect/lambdas/python/common/tests/unit/test_sanitize_provider_data.py
new file mode 100644
index 000000000..b0b05969a
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/tests/unit/test_sanitize_provider_data.py
@@ -0,0 +1,74 @@
+import json
+
+from tests import TstLambdas
+
+
+class TestSanitizeProviderData(TstLambdas):
+    def when_expecting_full_provider_record_returned(self, scopes: set[str]):
+        from cc_common.utils import sanitize_provider_data_based_on_caller_scopes
+
+        with open('tests/resources/api/provider-detail-response.json') as f:
+            expected_provider = json.load(f)
+
+        test_provider = expected_provider.copy()
+
+        resp = sanitize_provider_data_based_on_caller_scopes(compact='aslp', provider=test_provider, scopes=scopes)
+
+        self.assertEqual(resp, expected_provider)
+
+    def test_full_provider_record_returned_if_caller_has_compact_read_private_permissions(self):
+        self.when_expecting_full_provider_record_returned(
+            scopes={'openid', 'email', 'aslp/readGeneral', 'aslp/aslp.readPrivate'}
+        )
+
+    def test_full_provider_record_returned_if_caller_has_read_private_permissions_for_license_jurisdiction(self):
+        self.when_expecting_full_provider_record_returned(
+            scopes={'openid', 'email', 'aslp/readGeneral', 'aslp/oh.readPrivate'}
+        )
+
+    def test_full_provider_record_returned_if_caller_has_read_private_permissions_for_privileges_jurisdiction(self):
+        self.when_expecting_full_provider_record_returned(
+            scopes={'openid', 'email', 'aslp/readGeneral', 'aslp/ne.readPrivate'}
+        )
+
+    def when_testing_general_provider_info_returned(self, scopes: set[str]):
+        from cc_common.data_model.schema.provider import SanitizedProviderReadGeneralSchema
+        from cc_common.utils import sanitize_provider_data_based_on_caller_scopes
+
+        with open('tests/resources/api/provider-detail-response.json') as f:
+            full_provider = json.load(f)
+            expected_provider = full_provider.copy()
+            mock_ssn = full_provider['ssn']
+            mock_dob = full_provider['dateOfBirth']
+            mock_doc_keys = full_provider['militaryAffiliations'][0]['documentKeys']
+            # simplest way to set up mock test user as returned from the db
+            loaded_provider = SanitizedProviderReadGeneralSchema().load(full_provider)
+            loaded_provider['ssn'] = mock_ssn
+            loaded_provider['dateOfBirth'] = mock_dob
+            loaded_provider['militaryAffiliations'][0]['documentKeys'] = mock_doc_keys
+            loaded_provider['licenses'][0]['ssn'] = mock_ssn
+            loaded_provider['licenses'][0]['dateOfBirth'] = mock_dob
+
+        # test provider has a license in oh and privilege in ne
+        resp = sanitize_provider_data_based_on_caller_scopes(compact='aslp', provider=loaded_provider, scopes=scopes)
+
+        # now create expected provider record with the ssn and dob removed
+        expected_provider.pop('ssn')
+        expected_provider.pop('dateOfBirth')
+        # we do not return the military affiliation document keys if the caller does not have read private scope
+        expected_provider['militaryAffiliations'][0].pop('documentKeys')
+        # also remove the ssn from the license record
+        expected_provider['licenses'][0].pop('ssn')
+        expected_provider['licenses'][0].pop('dateOfBirth')
+        # cast to set to match schema
+        expected_provider['privilegeJurisdictions'] = set(expected_provider['privilegeJurisdictions'])
+
+        self.assertEqual(expected_provider, resp)
+
+    def test_sanitized_provider_record_returned_if_caller_does_not_have_read_private_permissions_for_jurisdiction(self):
+        self.when_testing_general_provider_info_returned(
+            scopes={'openid', 'email', 'aslp/readGeneral', 'aslp/az.readPrivate'}
+        )
+
+    def test_sanitized_provider_record_returned_if_caller_does_not_have_any_read_private_permissions(self):
+        self.when_testing_general_provider_info_returned(scopes={'openid', 'email', 'aslp/readGeneral'})
diff --git a/backend/compact-connect/lambdas/python/delete-objects/tests/__init__.py b/backend/compact-connect/lambdas/python/delete-objects/tests/__init__.py
deleted file mode 100644
index e69de29bb..000000000
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/bulk_upload.py b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/bulk_upload.py
index 05f03db38..943d5b1e5 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/bulk_upload.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/bulk_upload.py
@@ -7,7 +7,7 @@
 from botocore.exceptions import ClientError
 from botocore.response import StreamingBody
 from cc_common.config import config, logger
-from cc_common.data_model.schema.license import LicensePostSchema, LicensePublicSchema
+from cc_common.data_model.schema.license import LicensePostSchema, LicenseReadGeneralSchema
 from cc_common.exceptions import CCInternalException
 from cc_common.utils import ResponseEncoder, api_handler, authorize_compact_jurisdiction
 from event_batch_writer import EventBatchWriter
@@ -114,7 +114,7 @@ def process_bulk_upload_file(
     """
     Stream each line of the new CSV file, validating it then publishing an ingest event for each line.
     """
-    public_schema = LicensePublicSchema()
+    general_schema = LicenseReadGeneralSchema()
     schema = LicensePostSchema()
     reader = LicenseCSVReader()
 
@@ -127,16 +127,16 @@ def process_bulk_upload_file(
             except ValidationError as e:
                 # This CSV line has failed validation. We will carefully collect what information we can
                 # and publish it as a failure event. Because this data may eventually be sent back over
-                # an email, we will only include the public values that we can still validate.
+                # an email, we will only include the generally available values that we can still validate.
                 try:
-                    public_license_data = public_schema.load(raw_license)
+                    general_license_data = general_schema.load(raw_license)
                 except ValidationError as exc_second_try:
-                    public_license_data = exc_second_try.valid_data
+                    general_license_data = exc_second_try.valid_data
                 logger.info(
                     'Invalid license in line %s uploaded: %s',
                     i + 1,
                     str(e),
-                    valid_data=public_license_data,
+                    valid_data=general_license_data,
                     exc_info=e,
                 )
                 event_writer.put_event(
@@ -149,7 +149,7 @@ def process_bulk_upload_file(
                                 'compact': compact,
                                 'jurisdiction': jurisdiction,
                                 'recordNumber': i + 1,
-                                'validData': public_license_data,
+                                'validData': general_license_data,
                                 'errors': e.messages,
                             },
                             cls=ResponseEncoder,
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/providers.py b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/providers.py
index caeb3635b..f0dda366d 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/providers.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/providers.py
@@ -2,14 +2,20 @@
 
 from aws_lambda_powertools.utilities.typing import LambdaContext
 from cc_common.config import config, logger
+from cc_common.data_model.schema.provider import SanitizedProviderReadGeneralSchema
 from cc_common.exceptions import CCInvalidRequestException
-from cc_common.utils import api_handler, authorize_compact
+from cc_common.utils import (
+    api_handler,
+    authorize_compact,
+    get_event_scopes,
+    sanitize_provider_data_based_on_caller_scopes,
+)
 
 from . import get_provider_information
 
 
 @api_handler
-@authorize_compact(action='read')
+@authorize_compact(action='readGeneral')
 def query_providers(event: dict, context: LambdaContext):  # noqa: ARG001 unused-argument
     """Query providers data
     :param event: Standard API Gateway event, API schema documented in the CDK ApiStack
@@ -84,13 +90,19 @@ def query_providers(event: dict, context: LambdaContext):  # noqa: ARG001 unused
             case _:
                 # This shouldn't happen unless our api validation gets misconfigured
                 raise CCInvalidRequestException(f"Invalid sort key: '{sorting_key}'")
-    # Convert generic field to more specific one for this API
-    resp['providers'] = resp.pop('items', [])
+    # Convert generic field to more specific one for this API and sanitize data
+    pre_sanitized_providers = resp.pop('items', [])
+    # for the query endpoint, we only return generally available data, regardless of the caller's scopes
+    general_schema = SanitizedProviderReadGeneralSchema()
+    sanitized_providers = [general_schema.dump(provider) for provider in pre_sanitized_providers]
+
+    resp['providers'] = sanitized_providers
+
     return resp
 
 
 @api_handler
-@authorize_compact(action='read')
+@authorize_compact(action='readGeneral')
 def get_provider(event: dict, context: LambdaContext):  # noqa: ARG001 unused-argument
     """Return one provider's data
     :param event: Standard API Gateway event, API schema documented in the CDK ApiStack
@@ -104,4 +116,8 @@ def get_provider(event: dict, context: LambdaContext):  # noqa: ARG001 unused-ar
         logger.error(f'Missing parameter: {e}')
         raise CCInvalidRequestException('Missing required field') from e
 
-    return get_provider_information(compact=compact, provider_id=provider_id)
+    provider_information = get_provider_information(compact=compact, provider_id=provider_id)
+
+    return sanitize_provider_data_based_on_caller_scopes(
+        compact=compact, provider=provider_information, scopes=get_event_scopes(event)
+    )
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py
index 19df93cff..7adb549c1 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py
@@ -165,7 +165,7 @@ def test_transformations(self):
             event = json.load(f)
 
         event['pathParameters'] = {'compact': 'aslp', 'providerId': provider_id}
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/readGeneral aslp/aslp.readPrivate'
 
         resp = get_provider(event, self.mock_context)
 
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_ingest.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_ingest.py
index 765bb2470..190ca6d93 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_ingest.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_ingest.py
@@ -26,13 +26,14 @@ def test_new_provider_ingest(self):
             event = json.load(f)
 
         event['pathParameters'] = {'compact': 'aslp'}
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/readGeneral'
         event['body'] = json.dumps({'query': {'ssn': '123-12-1234'}})
         resp = query_providers(event, self.mock_context)
         self.assertEqual(resp['statusCode'], 200)
 
         with open('../common/tests/resources/api/provider-response.json') as f:
             expected_provider = json.load(f)
+
         # The canned response resource assumes that the provider will be given a privilege in NE. We didn't do that,
         # so we'll reset the privilege array.
         expected_provider['privilegeJurisdictions'] = []
@@ -71,7 +72,9 @@ def test_existing_provider_ingest(self):
             event = json.load(f)
 
         event['pathParameters'] = {'compact': 'aslp', 'providerId': provider_id}
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = (
+            'openid email stuff aslp/readGeneral aslp/aslp.readPrivate'
+        )
         resp = get_provider(event, self.mock_context)
         self.assertEqual(resp['statusCode'], 200)
 
@@ -131,7 +134,9 @@ def test_old_inactive_license(self):
             event = json.load(f)
 
         event['pathParameters'] = {'compact': 'aslp', 'providerId': provider_id}
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = (
+            'openid email stuff aslp/readGeneral aslp/aslp.readPrivate'
+        )
         resp = get_provider(event, self.mock_context)
         self.assertEqual(resp['statusCode'], 200)
 
@@ -188,7 +193,7 @@ def test_newer_active_license(self):
             event = json.load(f)
 
         event['pathParameters'] = {'compact': 'aslp', 'providerId': provider_id}
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/readGeneral'
         resp = get_provider(event, self.mock_context)
         self.assertEqual(resp['statusCode'], 200)
 
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_licenses.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_licenses.py
index bde29ff64..169ae7b9d 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_licenses.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_licenses.py
@@ -14,7 +14,9 @@ def test_post_licenses(self):
             event = json.load(f)
 
         # The user has write permission for aslp/oh
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/read aslp/write aslp/oh.write'
+        event['requestContext']['authorizer']['claims']['scope'] = (
+            'openid email aslp/readGeneral aslp/write aslp/oh.write'
+        )
         event['pathParameters'] = {'compact': 'aslp', 'jurisdiction': 'oh'}
         with open('../common/tests/resources/api/license-post.json') as f:
             event['body'] = json.dumps([json.load(f)])
@@ -30,7 +32,9 @@ def test_post_licenses_invalid_license_type(self):
             event = json.load(f)
 
         # The user has write permission for aslp/oh
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/read aslp/write aslp/oh.write'
+        event['requestContext']['authorizer']['claims']['scope'] = (
+            'openid email aslp/readGeneral aslp/write aslp/oh.write'
+        )
         event['pathParameters'] = {'compact': 'aslp', 'jurisdiction': 'oh'}
         with open('../common/tests/resources/api/license-post.json') as f:
             license_data = json.load(f)
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_providers.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_providers.py
index 9bc8702ea..afb511c9b 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_providers.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_providers.py
@@ -17,7 +17,7 @@ def test_query_by_ssn(self):
             event = json.load(f)
 
         # The user has read permission for aslp
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/readGeneral aslp/aslp.readPrivate'
         event['pathParameters'] = {'compact': 'aslp'}
         event['body'] = json.dumps({'query': {'ssn': '123-12-1234'}})
 
@@ -39,7 +39,7 @@ def test_query_by_ssn(self):
             body,
         )
 
-    def test_query_by_provider_id(self):
+    def test_query_by_provider_id_sanitizes_data_even_with_read_private_permission(self):
         self._load_provider_data()
 
         from handlers.providers import query_providers
@@ -48,7 +48,7 @@ def test_query_by_provider_id(self):
             event = json.load(f)
 
         # The user has read permission for aslp
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/readGeneral aslp/aslp.readPrivate'
         event['pathParameters'] = {'compact': 'aslp'}
         event['body'] = json.dumps({'query': {'providerId': '89a6377e-c3a5-40e5-bca5-317ec854c570'}})
 
@@ -80,7 +80,7 @@ def test_query_providers_updated_sorting(self):
             event = json.load(f)
 
         # The user has read permission for aslp
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/readGeneral aslp/aslp.readPrivate'
         event['pathParameters'] = {'compact': 'aslp'}
         event['body'] = json.dumps(
             {'sorting': {'key': 'dateOfUpdate'}, 'query': {'jurisdiction': 'oh'}, 'pagination': {'pageSize': 10}},
@@ -109,7 +109,7 @@ def test_query_providers_family_name_sorting(self):
             event = json.load(f)
 
         # The user has read permission for aslp
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/readGeneral'
         event['pathParameters'] = {'compact': 'aslp'}
         event['body'] = json.dumps(
             {'sorting': {'key': 'familyName'}, 'query': {'jurisdiction': 'oh'}, 'pagination': {'pageSize': 10}},
@@ -143,7 +143,7 @@ def test_query_providers_by_family_name(self):
             event = json.load(f)
 
         # The user has read permission for aslp
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/readGeneral'
         event['pathParameters'] = {'compact': 'aslp'}
         event['body'] = json.dumps(
             {
@@ -175,7 +175,7 @@ def test_query_providers_given_name_only_not_allowed(self):
             event = json.load(f)
 
         # The user has read permission for aslp
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/readGeneral'
         event['pathParameters'] = {'compact': 'aslp'}
         event['body'] = json.dumps(
             {
@@ -201,7 +201,7 @@ def test_query_providers_default_sorting(self):
             event = json.load(f)
 
         # The user has read permission for aslp
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/readGeneral'
         event['pathParameters'] = {'compact': 'aslp'}
         event['body'] = json.dumps({'query': {}})
 
@@ -229,7 +229,7 @@ def test_query_providers_invalid_sorting(self):
             event = json.load(f)
 
         # The user has read permission for aslp
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/readGeneral'
         event['pathParameters'] = {'compact': 'aslp'}
         event['body'] = json.dumps({'query': {'jurisdiction': 'oh'}, 'sorting': {'key': 'invalid'}})
 
@@ -241,8 +241,7 @@ def test_query_providers_invalid_sorting(self):
 
 @mock_aws
 class TestGetProvider(TstFunction):
-    def test_get_provider(self):
-        """Provider detail response"""
+    def _when_testing_get_provider_response_based_on_read_access(self, scopes: str, expected_provider: dict):
         self._load_provider_data()
 
         from handlers.providers import get_provider
@@ -251,19 +250,39 @@ def test_get_provider(self):
             event = json.load(f)
 
         # The user has read permission for aslp
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = scopes
         event['pathParameters'] = {'compact': 'aslp', 'providerId': '89a6377e-c3a5-40e5-bca5-317ec854c570'}
         event['queryStringParameters'] = None
 
-        with open('../common/tests/resources/api/provider-detail-response.json') as f:
-            expected_provider = json.load(f)
-
         resp = get_provider(event, self.mock_context)
 
         self.assertEqual(200, resp['statusCode'])
         provider_data = json.loads(resp['body'])
         self.assertEqual(expected_provider, provider_data)
 
+    def _when_testing_get_provider_with_read_private_access(self, scopes: str):
+        with open('../common/tests/resources/api/provider-detail-response.json') as f:
+            expected_provider = json.load(f)
+
+        self._when_testing_get_provider_response_based_on_read_access(scopes, expected_provider)
+
+    def test_get_provider_with_compact_level_read_private_access(self):
+        self._when_testing_get_provider_with_read_private_access(
+            scopes='openid email aslp/readGeneral aslp/aslp.readPrivate',
+        )
+
+    def test_get_provider_with_matching_license_jurisdiction_level_read_private_access(self):
+        # test provider has a license in oh and a privilege in ne
+        self._when_testing_get_provider_with_read_private_access(
+            scopes='openid email aslp/readGeneral aslp/oh.readPrivate'
+        )
+
+    def test_get_provider_with_matching_privilege_jurisdiction_level_read_private_access(self):
+        # test provider has a license in oh and a privilege in ne
+        self._when_testing_get_provider_with_read_private_access(
+            scopes='openid email aslp/readGeneral aslp/ne.readPrivate'
+        )
+
     def test_get_provider_wrong_compact(self):
         """Provider detail response"""
         self._load_provider_data()
@@ -274,7 +293,7 @@ def test_get_provider_wrong_compact(self):
             event = json.load(f)
 
         # The user has read permission for aslp
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/readGeneral'
         event['pathParameters'] = {'compact': 'octp', 'providerId': '89a6377e-c3a5-40e5-bca5-317ec854c570'}
         event['queryStringParameters'] = None
 
@@ -289,7 +308,7 @@ def test_get_provider_missing_provider_id(self):
             event = json.load(f)
 
         # The user has read permission for aslp
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/readGeneral'
         # providerId _should_ be included in these pathParameters. We're leaving it out for this test.
         event['pathParameters'] = {'compact': 'aslp'}
         event['queryStringParameters'] = None
@@ -297,3 +316,19 @@ def test_get_provider_missing_provider_id(self):
         resp = get_provider(event, self.mock_context)
 
         self.assertEqual(400, resp['statusCode'])
+
+    def test_get_provider_returns_expected_general_response_when_caller_does_not_have_read_private_scope(self):
+        """Provider detail response"""
+        with open('../common/tests/resources/api/provider-detail-response.json') as f:
+            expected_provider = json.load(f)
+            expected_provider.pop('ssn')
+            expected_provider.pop('dateOfBirth')
+            # we do not return the military affiliation document keys if the caller does not have read private scope
+            expected_provider['militaryAffiliations'][0].pop('documentKeys')
+            # also remove the ssn from the license record
+            expected_provider['licenses'][0].pop('ssn')
+            expected_provider['licenses'][0].pop('dateOfBirth')
+
+        self._when_testing_get_provider_response_based_on_read_access(
+            scopes='openid email aslp/readGeneral', expected_provider=expected_provider
+        )
diff --git a/backend/compact-connect/lambdas/python/staff-user-pre-token/tests/test_main.py b/backend/compact-connect/lambdas/python/staff-user-pre-token/tests/test_main.py
index 2dbf94ce7..57e47c139 100644
--- a/backend/compact-connect/lambdas/python/staff-user-pre-token/tests/test_main.py
+++ b/backend/compact-connect/lambdas/python/staff-user-pre-token/tests/test_main.py
@@ -22,7 +22,6 @@ def test_happy_path(self):
                 'sk': 'COMPACT#aslp',
                 'compact': 'aslp',
                 'permissions': {
-                    'actions': {'read'},
                     'jurisdictions': {
                         # should correspond to the 'aslp/write' and 'aslp/al.write' scopes
                         'al': {'write'}
@@ -34,7 +33,7 @@ def test_happy_path(self):
         resp = customize_scopes(event, self.mock_context)
 
         self.assertEqual(
-            sorted(['profile', 'aslp/read', 'aslp/write', 'aslp/al.write']),
+            sorted(['profile', 'aslp/readGeneral', 'aslp/write', 'aslp/al.write']),
             sorted(resp['response']['claimsAndScopeOverrideDetails']['accessTokenGeneration']['scopesToAdd']),
         )
 
diff --git a/backend/compact-connect/lambdas/python/staff-user-pre-token/tests/test_user_scopes.py b/backend/compact-connect/lambdas/python/staff-user-pre-token/tests/test_user_scopes.py
index 39bb1a516..c3a1905f1 100644
--- a/backend/compact-connect/lambdas/python/staff-user-pre-token/tests/test_user_scopes.py
+++ b/backend/compact-connect/lambdas/python/staff-user-pre-token/tests/test_user_scopes.py
@@ -20,13 +20,15 @@ def test_compact_ed_user(self):
                 'pk': f'USER#{self._user_sub}',
                 'sk': 'COMPACT#aslp',
                 'compact': 'aslp',
-                'permissions': {'actions': {'read', 'admin'}, 'jurisdictions': {}},
+                'permissions': {'actions': {'read', 'admin', 'readPrivate'}, 'jurisdictions': {}},
             }
         )
 
         scopes = UserScopes(self._user_sub)
 
-        self.assertEqual({'profile', 'aslp/read', 'aslp/admin', 'aslp/aslp.admin'}, scopes)
+        self.assertEqual(
+            {'profile', 'aslp/readGeneral', 'aslp/admin', 'aslp/aslp.admin', 'aslp/aslp.readPrivate'}, scopes
+        )
 
     def test_board_ed_user(self):
         from user_scopes import UserScopes
@@ -37,13 +39,24 @@ def test_board_ed_user(self):
                 'pk': f'USER#{self._user_sub}',
                 'sk': 'COMPACT#aslp',
                 'compact': 'aslp',
-                'permissions': {'actions': {'read'}, 'jurisdictions': {'al': {'write', 'admin'}}},
+                'permissions': {'jurisdictions': {'al': {'write', 'admin', 'readPrivate'}}},
             }
         )
 
         scopes = UserScopes(self._user_sub)
 
-        self.assertEqual({'profile', 'aslp/read', 'aslp/admin', 'aslp/write', 'aslp/al.admin', 'aslp/al.write'}, scopes)
+        self.assertEqual(
+            {
+                'profile',
+                'aslp/readGeneral',
+                'aslp/admin',
+                'aslp/write',
+                'aslp/al.admin',
+                'aslp/al.write',
+                'aslp/al.readPrivate',
+            },
+            scopes,
+        )
 
     def test_board_ed_user_multi_compact(self):
         """
@@ -58,7 +71,7 @@ def test_board_ed_user_multi_compact(self):
                 'pk': f'USER#{self._user_sub}',
                 'sk': 'COMPACT#aslp',
                 'compact': 'aslp',
-                'permissions': {'actions': {'read'}, 'jurisdictions': {'al': {'write', 'admin'}}},
+                'permissions': {'jurisdictions': {'al': {'write', 'admin'}}},
             }
         )
         self._table.put_item(
@@ -66,7 +79,7 @@ def test_board_ed_user_multi_compact(self):
                 'pk': f'USER#{self._user_sub}',
                 'sk': 'COMPACT#octp',
                 'compact': 'octp',
-                'permissions': {'actions': {'read'}, 'jurisdictions': {'al': {'write', 'admin'}}},
+                'permissions': {'jurisdictions': {'al': {'write', 'admin'}}},
             }
         )
 
@@ -75,12 +88,12 @@ def test_board_ed_user_multi_compact(self):
         self.assertEqual(
             {
                 'profile',
-                'aslp/read',
+                'aslp/readGeneral',
                 'aslp/admin',
                 'aslp/write',
                 'aslp/al.admin',
                 'aslp/al.write',
-                'octp/read',
+                'octp/readGeneral',
                 'octp/admin',
                 'octp/write',
                 'octp/al.admin',
@@ -99,7 +112,6 @@ def test_board_staff(self):
                 'sk': 'COMPACT#aslp',
                 'compact': 'aslp',
                 'permissions': {
-                    'actions': {'read'},
                     'jurisdictions': {
                         'al': {'write'}  # should correspond to the 'aslp/al.write' scope
                     },
@@ -109,7 +121,7 @@ def test_board_staff(self):
 
         scopes = UserScopes(self._user_sub)
 
-        self.assertEqual({'profile', 'aslp/read', 'aslp/write', 'aslp/al.write'}, scopes)
+        self.assertEqual({'profile', 'aslp/readGeneral', 'aslp/write', 'aslp/al.write'}, scopes)
 
     def test_missing_user(self):
         from user_scopes import UserScopes
@@ -131,7 +143,7 @@ def test_disallowed_compact(self):
                 'pk': f'USER#{self._user_sub}',
                 'sk': 'COMPACT#aslp',
                 'compact': 'aslp',
-                'permissions': {'actions': {'read'}, 'jurisdictions': {'al': {'write', 'admin'}}},
+                'permissions': {'jurisdictions': {'al': {'write', 'admin'}}},
             }
         )
         self._table.put_item(
@@ -139,7 +151,7 @@ def test_disallowed_compact(self):
                 'pk': f'USER#{self._user_sub}',
                 'sk': 'COMPACT#aslp',
                 'compact': 'abc',
-                'permissions': {'actions': {'read'}, 'jurisdictions': {'al': {'write', 'admin'}}},
+                'permissions': {'jurisdictions': {'al': {'write', 'admin'}}},
             }
         )
 
@@ -161,7 +173,7 @@ def test_disallowed_compact_action(self):
                 'compact': 'aslp',
                 'permissions': {
                     # Write is jurisdiction-specific
-                    'actions': {'read', 'write'},
+                    'actions': {'write'},
                     'jurisdictions': {'al': {'write', 'admin'}},
                 },
             }
@@ -183,7 +195,7 @@ def test_disallowed_jurisdiction(self):
                 'pk': f'USER#{self._user_sub}',
                 'sk': 'COMPACT#aslp',
                 'compact': 'aslp',
-                'permissions': {'actions': {'read'}, 'jurisdictions': {'ab': {'write', 'admin'}}},
+                'permissions': {'jurisdictions': {'ab': {'write', 'admin'}}},
             }
         )
 
@@ -203,7 +215,7 @@ def test_disallowed_action(self):
                 'pk': f'USER#{self._user_sub}',
                 'sk': 'COMPACT#aslp',
                 'compact': 'aslp',
-                'permissions': {'actions': {'read'}, 'jurisdictions': {'al': {'write', 'hack'}}},
+                'permissions': {'jurisdictions': {'al': {'write', 'hack'}}},
             }
         )
 
diff --git a/backend/compact-connect/lambdas/python/staff-user-pre-token/user_scopes.py b/backend/compact-connect/lambdas/python/staff-user-pre-token/user_scopes.py
index 5db28567a..d5ed845e3 100644
--- a/backend/compact-connect/lambdas/python/staff-user-pre-token/user_scopes.py
+++ b/backend/compact-connect/lambdas/python/staff-user-pre-token/user_scopes.py
@@ -21,7 +21,7 @@ def _get_scopes_from_db(self, sub: str):
         user_data = self._get_user_data(sub)
         permissions = {
             compact_record['compact']: {
-                'actions': set(compact_record['permissions']['actions']),
+                'actions': set(compact_record['permissions'].get('actions', [])),
                 'jurisdictions': compact_record['permissions']['jurisdictions'],
             }
             for compact_record in user_data
@@ -48,13 +48,18 @@ def _process_compact_permissions(self, compact_name, compact_permissions):
         compact_actions = compact_permissions.get('actions', set())
 
         # Ensure included actions are limited to supported values
-        disallowed_actions = compact_actions - {'read', 'admin'}
+        # Note we are keeping in the 'read' permission for backwards compatibility
+        # Though we are not using it in the codebase
+        disallowed_actions = compact_actions - {'read', 'admin', 'readPrivate'}
         if disallowed_actions:
             raise ValueError(f'User {compact_name} permissions include disallowed actions: {disallowed_actions}')
 
-        # Read is the only truly compact-level permission
-        if 'read' in compact_actions:
-            self.add(f'{compact_name}/read')
+        # readGeneral is always added an implicit permission granted to all staff users at the compact level
+        self.add(f'{compact_name}/readGeneral')
+
+        if 'readPrivate' in compact_actions:
+            # This action only has one level of authz, since there is no external scope for it
+            self.add(f'{compact_name}/{compact_name}.readPrivate')
 
         if 'admin' in compact_actions:
             # Two levels of authz for admin
@@ -74,13 +79,17 @@ def _process_compact_permissions(self, compact_name, compact_permissions):
 
     def _process_jurisdiction_permissions(self, compact_name, jurisdiction_name, jurisdiction_actions):
         # Ensure included actions are limited to supported values
-        disallowed_actions = jurisdiction_actions - {'write', 'admin'}
+        disallowed_actions = jurisdiction_actions - {'write', 'admin', 'readPrivate'}
         if disallowed_actions:
             raise ValueError(
                 f'User {compact_name}/{jurisdiction_name} permissions include disallowed actions: '
                 f'{disallowed_actions}',
             )
         for action in jurisdiction_actions:
-            # Two levels of authz
-            self.add(f'{compact_name}/{action}')
             self.add(f'{compact_name}/{jurisdiction_name}.{action}')
+
+            # Grant coarse-grain scope, which provides access to the API itself
+            # Since `readGeneral` is implicitly granted to all users, we do not
+            # need to grant a coarse-grain scope for the `readPrivate` action.
+            if action != 'readPrivate':
+                self.add(f'{compact_name}/{action}')
diff --git a/backend/compact-connect/lambdas/python/staff-users/tests/function/test_data_model/test_client.py b/backend/compact-connect/lambdas/python/staff-users/tests/function/test_data_model/test_client.py
index 0a78933be..f1ceb543f 100644
--- a/backend/compact-connect/lambdas/python/staff-users/tests/function/test_data_model/test_client.py
+++ b/backend/compact-connect/lambdas/python/staff-users/tests/function/test_data_model/test_client.py
@@ -142,7 +142,7 @@ def test_update_user_permissions_jurisdiction_actions(self):
 
         self.assertEqual(user_id, resp['userId'])
         self.assertEqual(
-            {'actions': {'read'}, 'jurisdictions': {'oh': {'admin'}, 'ky': {'write'}}},
+            {'actions': {'readPrivate'}, 'jurisdictions': {'oh': {'admin'}, 'ky': {'write'}}},
             resp['permissions'],
         )
         # Just checking that we're getting the whole object, not just changes
@@ -164,7 +164,7 @@ def test_update_user_permissions_board_to_compact_admin(self):
         )
 
         self.assertEqual(user_id, resp['userId'])
-        self.assertEqual({'actions': {'read', 'admin'}, 'jurisdictions': {}}, resp['permissions'])
+        self.assertEqual({'actions': {'readPrivate', 'admin'}, 'jurisdictions': {}}, resp['permissions'])
         # Checking that we're getting the whole object, not just changes
         self.assertFalse({'type', 'userId', 'compact', 'attributes', 'permissions', 'dateOfUpdate'} - resp.keys())
 
diff --git a/backend/compact-connect/lambdas/python/staff-users/tests/function/test_handlers/test_patch_user.py b/backend/compact-connect/lambdas/python/staff-users/tests/function/test_handlers/test_patch_user.py
index f7eb983f5..d17cf3dd7 100644
--- a/backend/compact-connect/lambdas/python/staff-users/tests/function/test_handlers/test_patch_user.py
+++ b/backend/compact-connect/lambdas/python/staff-users/tests/function/test_handlers/test_patch_user.py
@@ -30,7 +30,7 @@ def test_patch_user(self):
                 'dateOfUpdate': '2024-09-12T23:59:59+00:00',
                 'permissions': {
                     'aslp': {
-                        'actions': {'read': True},
+                        'actions': {'readPrivate': True},
                         'jurisdictions': {'oh': {'actions': {'admin': True, 'write': True}}},
                     },
                 },
@@ -128,7 +128,7 @@ def test_patch_user_add_to_empty_actions(self):
         # Add compact read and oh admin permissions to the user
         event['pathParameters'] = {'compact': 'aslp', 'userId': user_id}
         api_user['permissions'] = {
-            'aslp': {'actions': {'read': True}, 'jurisdictions': {'oh': {'actions': {'admin': True}}}}
+            'aslp': {'actions': {'readPrivate': True}, 'jurisdictions': {'oh': {'actions': {'admin': True}}}}
         }
         event['body'] = json.dumps(api_user)
 
@@ -163,7 +163,7 @@ def test_patch_user_remove_all_actions(self):
         # Remove all the permissions from the user
         event['pathParameters'] = {'compact': 'aslp', 'userId': user_id}
         api_user['permissions'] = {
-            'aslp': {'actions': {'read': False}, 'jurisdictions': {'oh': {'actions': {'write': False}}}}
+            'aslp': {'actions': {'readPrivate': False}, 'jurisdictions': {'oh': {'actions': {'write': False}}}}
         }
         event['body'] = json.dumps(api_user)
 
@@ -194,3 +194,50 @@ def test_patch_user_forbidden(self):
         resp = patch_user(event, self.mock_context)
 
         self.assertEqual(403, resp['statusCode'])
+
+    def test_patch_user_allows_adding_read_private_permission(self):
+        self._load_user_data()
+
+        from handlers.users import patch_user
+
+        with open('tests/resources/api-event.json') as f:
+            event = json.load(f)
+
+        # The user has admin permission for aslp/oh
+        event['requestContext']['authorizer']['claims']['scope'] = (
+            'openid email aslp/admin aslp/oh.admin aslp/aslp.admin'
+        )
+        event['pathParameters'] = {'compact': 'aslp', 'userId': 'a4182428-d061-701c-82e5-a3d1d547d797'}
+        event['body'] = json.dumps(
+            {
+                'permissions': {
+                    'aslp': {
+                        'actions': {
+                            'readPrivate': True,
+                        },
+                        'jurisdictions': {'oh': {'actions': {'readPrivate': True}}},
+                    }
+                }
+            }
+        )
+
+        resp = patch_user(event, self.mock_context)
+
+        self.assertEqual(200, resp['statusCode'])
+        user = json.loads(resp['body'])
+        self.assertEqual(
+            {
+                'attributes': {'email': 'justin@example.org', 'familyName': 'Williams', 'givenName': 'Justin'},
+                'dateOfUpdate': '2024-09-12T23:59:59+00:00',
+                'permissions': {
+                    'aslp': {
+                        'actions': {'readPrivate': True},
+                        # test user starts with the write permission, so it should still be there
+                        'jurisdictions': {'oh': {'actions': {'write': True, 'readPrivate': True}}},
+                    },
+                },
+                'type': 'user',
+                'userId': 'a4182428-d061-701c-82e5-a3d1d547d797',
+            },
+            user,
+        )
diff --git a/backend/compact-connect/lambdas/python/staff-users/tests/function/test_handlers/test_post_user.py b/backend/compact-connect/lambdas/python/staff-users/tests/function/test_handlers/test_post_user.py
index c6af4ca19..656e6f95b 100644
--- a/backend/compact-connect/lambdas/python/staff-users/tests/function/test_handlers/test_post_user.py
+++ b/backend/compact-connect/lambdas/python/staff-users/tests/function/test_handlers/test_post_user.py
@@ -19,7 +19,9 @@ def test_post_user(self):
             api_user = json.load(f)
 
         # The user has admin permission for aslp/oh
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email aslp/admin aslp/oh.admin'
+        event['requestContext']['authorizer']['claims']['scope'] = (
+            'openid email aslp/admin aslp/aslp.admin aslp/oh.admin'
+        )
         event['pathParameters'] = {'compact': 'aslp'}
 
         resp = post_user(event, self.mock_context)
diff --git a/backend/compact-connect/lambdas/python/staff-users/tests/resources/api/user-post.json b/backend/compact-connect/lambdas/python/staff-users/tests/resources/api/user-post.json
index 9cda12771..f234d5355 100644
--- a/backend/compact-connect/lambdas/python/staff-users/tests/resources/api/user-post.json
+++ b/backend/compact-connect/lambdas/python/staff-users/tests/resources/api/user-post.json
@@ -8,7 +8,7 @@
   "permissions": {
     "aslp": {
       "actions": {
-        "read": true
+        "readPrivate": true
       },
       "jurisdictions": {
         "oh": {
diff --git a/backend/compact-connect/lambdas/python/staff-users/tests/resources/api/user-response.json b/backend/compact-connect/lambdas/python/staff-users/tests/resources/api/user-response.json
index cbf7f145b..18426954f 100644
--- a/backend/compact-connect/lambdas/python/staff-users/tests/resources/api/user-response.json
+++ b/backend/compact-connect/lambdas/python/staff-users/tests/resources/api/user-response.json
@@ -10,7 +10,7 @@
   "permissions": {
     "aslp": {
       "actions": {
-        "read": true
+        "readPrivate": true
       },
       "jurisdictions": {
         "oh": {
diff --git a/backend/compact-connect/lambdas/python/staff-users/tests/resources/dynamo/user.json b/backend/compact-connect/lambdas/python/staff-users/tests/resources/dynamo/user.json
index ef6b9435c..cc2552e4a 100644
--- a/backend/compact-connect/lambdas/python/staff-users/tests/resources/dynamo/user.json
+++ b/backend/compact-connect/lambdas/python/staff-users/tests/resources/dynamo/user.json
@@ -37,7 +37,7 @@
     "M": {
       "actions": {
         "SS": [
-          "read"
+          "readPrivate"
         ]
       },
       "jurisdictions": {
diff --git a/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_authorize_compact.py b/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_authorize_compact.py
index 68a4b3c3e..2f69d3a78 100644
--- a/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_authorize_compact.py
+++ b/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_authorize_compact.py
@@ -9,14 +9,14 @@ class TestAuthorizeCompact(TstLambdas):
     def test_authorize_compact(self):
         from cc_common.utils import authorize_compact
 
-        @authorize_compact(action='read')
+        @authorize_compact(action='readGeneral')
         def example_entrypoint(event: dict, context: LambdaContext):  # noqa: ARG001 unused-argument
             return {'body': 'Hurray!'}
 
         with open('tests/resources/api-event.json') as f:
             event = json.load(f)
 
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/readGeneral'
         event['pathParameters'] = {
             'compact': 'aslp',
         }
@@ -27,13 +27,13 @@ def test_no_path_param(self):
         from cc_common.exceptions import CCInvalidRequestException
         from cc_common.utils import authorize_compact
 
-        @authorize_compact(action='read')
+        @authorize_compact(action='readGeneral')
         def example_entrypoint(event: dict, context: LambdaContext):  # noqa: ARG001 unused-argument
             return {'body': 'Hurray!'}
 
         with open('tests/resources/api-event.json') as f:
             event = json.load(f)
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/read'
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/readGeneral'
         event['pathParameters'] = {}
 
         with self.assertRaises(CCInvalidRequestException):
@@ -43,7 +43,7 @@ def test_no_authorizer(self):
         from cc_common.exceptions import CCUnauthorizedException
         from cc_common.utils import authorize_compact
 
-        @authorize_compact(action='read')
+        @authorize_compact(action='readGeneral')
         def example_entrypoint(event: dict, context: LambdaContext):  # noqa: ARG001 unused-argument
             return {'body': 'Hurray!'}
 
@@ -59,7 +59,7 @@ def test_missing_scope(self):
         from cc_common.exceptions import CCAccessDeniedException
         from cc_common.utils import authorize_compact
 
-        @authorize_compact(action='read')
+        @authorize_compact(action='readGeneral')
         def example_entrypoint(event: dict, context: LambdaContext):  # noqa: ARG001 unused-argument
             return {'body': 'Hurray!'}
 
diff --git a/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_collect_changes.py b/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_collect_changes.py
index bf1199b92..a41fc9850 100644
--- a/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_collect_changes.py
+++ b/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_collect_changes.py
@@ -10,12 +10,12 @@ def test_compact_changes(self):
         resp = collect_and_authorize_changes(
             path_compact='aslp',
             scopes={'openid', 'email', 'aslp/admin', 'aslp/aslp.admin'},
-            compact_changes={'actions': {'admin': True, 'read': False}, 'jurisdictions': {}},
+            compact_changes={'actions': {'admin': True, 'readPrivate': False}, 'jurisdictions': {}},
         )
         self.assertEqual(
             {
                 'compact_action_additions': {'admin'},
-                'compact_action_removals': {'read'},
+                'compact_action_removals': {'readPrivate'},
                 'jurisdiction_action_additions': {},
                 'jurisdiction_action_removals': {},
             },
@@ -69,14 +69,14 @@ def test_compact_and_jurisdiction_changes(self):
             path_compact='aslp',
             scopes={'openid', 'email', 'aslp/admin', 'aslp/aslp.admin'},
             compact_changes={
-                'actions': {'admin': True, 'read': False},
+                'actions': {'admin': True, 'readPrivate': False},
                 'jurisdictions': {'oh': {'actions': {'admin': True, 'write': False}}},
             },
         )
         self.assertEqual(
             {
                 'compact_action_additions': {'admin'},
-                'compact_action_removals': {'read'},
+                'compact_action_removals': {'readPrivate'},
                 'jurisdiction_action_additions': {'oh': {'admin'}},
                 'jurisdiction_action_removals': {'oh': {'write'}},
             },
diff --git a/backend/compact-connect/stacks/api_stack/v1_api/api.py b/backend/compact-connect/stacks/api_stack/v1_api/api.py
index 81fb8554f..ed79e857b 100644
--- a/backend/compact-connect/stacks/api_stack/v1_api/api.py
+++ b/backend/compact-connect/stacks/api_stack/v1_api/api.py
@@ -25,7 +25,7 @@ def __init__(self, root: IResource, persistent_stack: ps.PersistentStack):
         self.api: cc_api.CCApi = root.api
         self.api_model = ApiModel(api=self.api)
         read_scopes = [
-            f'{resource_server}/read' for resource_server in persistent_stack.staff_users.resource_servers.keys()
+            f'{resource_server}/readGeneral' for resource_server in persistent_stack.staff_users.resource_servers.keys()
         ]
         write_scopes = [
             f'{resource_server}/write' for resource_server in persistent_stack.staff_users.resource_servers.keys()
@@ -112,17 +112,17 @@ def __init__(self, root: IResource, persistent_stack: ps.PersistentStack):
         )
 
         # /v1/staff-users
-        staff_users_admin_resource = self.compact_resource.add_resource('staff-users')
-        staff_users_self_resource = self.resource.add_resource('staff-users')
+        self.staff_users_admin_resource = self.compact_resource.add_resource('staff-users')
+        self.staff_users_self_resource = self.resource.add_resource('staff-users')
         # GET    /v1/staff-users/me
         # PATCH  /v1/staff-users/me
         # GET    /v1/compacts/{compact}/staff-users
         # POST   /v1/compacts/{compact}/staff-users
         # GET    /v1/compacts/{compact}/staff-users/{userId}
         # PATCH  /v1/compacts/{compact}/staff-users/{userId}
-        StaffUsers(
-            admin_resource=staff_users_admin_resource,
-            self_resource=staff_users_self_resource,
+        self.staff_users = StaffUsers(
+            admin_resource=self.staff_users_admin_resource,
+            self_resource=self.staff_users_self_resource,
             admin_scopes=admin_scopes,
             persistent_stack=persistent_stack,
             api_model=self.api_model,
diff --git a/backend/compact-connect/stacks/api_stack/v1_api/api_model.py b/backend/compact-connect/stacks/api_stack/v1_api/api_model.py
index c2cb9992b..5d37cdb47 100644
--- a/backend/compact-connect/stacks/api_stack/v1_api/api_model.py
+++ b/backend/compact-connect/stacks/api_stack/v1_api/api_model.py
@@ -294,8 +294,11 @@ def _staff_user_permissions_schema(self):
                     'actions': JsonSchema(
                         type=JsonSchemaType.OBJECT,
                         properties={
-                            'read': JsonSchema(type=JsonSchemaType.BOOLEAN),
+                            'readPrivate': JsonSchema(type=JsonSchemaType.BOOLEAN),
                             'admin': JsonSchema(type=JsonSchemaType.BOOLEAN),
+                            # TODO keeping 'read' action for backwards compatibility  # noqa: FIX002
+                            #  this should be removed after the frontend is updated
+                            'read': JsonSchema(type=JsonSchemaType.BOOLEAN),
                         },
                     ),
                     'jurisdictions': JsonSchema(
@@ -309,6 +312,7 @@ def _staff_user_permissions_schema(self):
                                     properties={
                                         'write': JsonSchema(type=JsonSchemaType.BOOLEAN),
                                         'admin': JsonSchema(type=JsonSchemaType.BOOLEAN),
+                                        'readPrivate': JsonSchema(type=JsonSchemaType.BOOLEAN),
                                     },
                                 ),
                             },
diff --git a/backend/compact-connect/stacks/api_stack/v1_api/staff_users.py b/backend/compact-connect/stacks/api_stack/v1_api/staff_users.py
index 093b64049..10b006209 100644
--- a/backend/compact-connect/stacks/api_stack/v1_api/staff_users.py
+++ b/backend/compact-connect/stacks/api_stack/v1_api/staff_users.py
@@ -51,10 +51,10 @@ def __init__(
         self._add_get_users(self.admin_resource, admin_scopes, env_vars=env_vars, persistent_stack=persistent_stack)
         self._add_post_user(self.admin_resource, admin_scopes, env_vars=env_vars, persistent_stack=persistent_stack)
 
-        user_id_resource = self.admin_resource.add_resource('{userId}')
+        self.user_id_resource = self.admin_resource.add_resource('{userId}')
         # <base-url>/{userId}
-        self._add_get_user(user_id_resource, admin_scopes, env_vars=env_vars, persistent_stack=persistent_stack)
-        self._add_patch_user(user_id_resource, admin_scopes, env_vars=env_vars, persistent_stack=persistent_stack)
+        self._add_get_user(self.user_id_resource, admin_scopes, env_vars=env_vars, persistent_stack=persistent_stack)
+        self._add_patch_user(self.user_id_resource, admin_scopes, env_vars=env_vars, persistent_stack=persistent_stack)
 
         self.me_resource = self_resource.add_resource('me')
         # <base-url>/me
@@ -301,7 +301,7 @@ def _add_patch_user(
         env_vars: dict,
         persistent_stack: ps.PersistentStack,
     ):
-        patch_user_handler = self._patch_user_handler(
+        self.patch_user_handler = self._patch_user_handler(
             env_vars=env_vars,
             data_encryption_key=persistent_stack.shared_encryption_key,
             users_table=persistent_stack.staff_users.user_table,
@@ -310,7 +310,7 @@ def _add_patch_user(
         # Add the PATCH method to the me_resource
         user_resource.add_method(
             'PATCH',
-            integration=LambdaIntegration(patch_user_handler),
+            integration=LambdaIntegration(self.patch_user_handler),
             request_validator=self.api.parameter_body_validator,
             request_models={'application/json': self.api_model.patch_staff_user_model},
             method_responses=[
@@ -359,7 +359,7 @@ def _add_post_user(
         env_vars: dict,
         persistent_stack: ps.PersistentStack,
     ):
-        post_user_handler = self._post_user_handler(
+        self.post_user_handler = self._post_user_handler(
             env_vars=env_vars,
             data_encryption_key=persistent_stack.shared_encryption_key,
             users_table=persistent_stack.staff_users.user_table,
@@ -369,7 +369,7 @@ def _add_post_user(
         # Add the POST method to the me_resource
         users_resource.add_method(
             'POST',
-            integration=LambdaIntegration(post_user_handler),
+            integration=LambdaIntegration(self.post_user_handler),
             request_validator=self.api.parameter_body_validator,
             request_models={'application/json': self.api_model.post_staff_user_model},
             method_responses=[
diff --git a/backend/compact-connect/stacks/persistent_stack/staff_users.py b/backend/compact-connect/stacks/persistent_stack/staff_users.py
index 21ea338bb..a53036990 100644
--- a/backend/compact-connect/stacks/persistent_stack/staff_users.py
+++ b/backend/compact-connect/stacks/persistent_stack/staff_users.py
@@ -70,11 +70,11 @@ def __init__(
 
     def _add_resource_servers(self):
         """Add scopes for all compact/jurisdictions"""
-        # {compact}.write, {compact}.admin, {compact}.read for every compact
-        # Note: the .write and .admin scopes will control access to API endpoints via the Cognito authorizer, however
-        # there will be a secondary level of authorization within the business logic that controls further granularity
-        # of authorization (i.e. 'aslp/write' will grant access to POST license data, but the business logic inside
-        # the endpoint also expects an 'aslp/co.write' if the POST includes data for Colorado.)
+        # {compact}.write, {compact}.admin, {compact}.readGeneral for every compact
+        # Note: the .readGeneral .write and .admin scopes will control access to API endpoints via the Cognito
+        # authorizer, however there will be a secondary level of authorization within the business logic that controls
+        # further granularity of authorization (i.e. 'aslp/write' will grant access to POST license data, but the
+        # business logic inside the endpoint also expects an 'aslp/co.write' if the POST includes data for Colorado.)
         self.write_scope = ResourceServerScope(
             scope_name='write',
             scope_description='Write access for the compact, paired with a more specific scope',
@@ -83,7 +83,10 @@ def _add_resource_servers(self):
             scope_name='admin',
             scope_description='Admin access for the compact, paired with a more specific scope',
         )
-        self.read_scope = ResourceServerScope(scope_name='read', scope_description='Read access for the compact')
+        self.read_scope = ResourceServerScope(
+            scope_name='readGeneral',
+            scope_description='Read access for generally available data (not private) in the compact',
+        )
 
         # One resource server for each compact
         self.resource_servers = {
diff --git a/backend/compact-connect/tests/app/test_api/test_purchases_api.py b/backend/compact-connect/tests/app/test_api/test_purchases_api.py
index db923e024..92589818b 100644
--- a/backend/compact-connect/tests/app/test_api/test_purchases_api.py
+++ b/backend/compact-connect/tests/app/test_api/test_purchases_api.py
@@ -86,15 +86,13 @@ def test_synth_generates_post_purchases_privileges_handler_with_required_secret_
         )
 
         # We need to ensure the lambda can read these secrets, else all transactions will fail
+        # sort the compact names to ensure the order is consistent
+        self.context['compacts'].sort()
         self.assertIn(
             {
                 'Action': 'secretsmanager:GetSecretValue',
                 'Effect': 'Allow',
-                'Resource': [
-                    _generate_expected_secret_arn('aslp'),
-                    _generate_expected_secret_arn('coun'),
-                    _generate_expected_secret_arn('octp'),
-                ],
+                'Resource': [_generate_expected_secret_arn(compact) for compact in self.context['compacts']],
             },
             policy['Properties']['PolicyDocument']['Statement'],
         )
diff --git a/backend/compact-connect/tests/app/test_api/test_staff_users_api.py b/backend/compact-connect/tests/app/test_api/test_staff_users_api.py
new file mode 100644
index 000000000..81eedaf4d
--- /dev/null
+++ b/backend/compact-connect/tests/app/test_api/test_staff_users_api.py
@@ -0,0 +1,194 @@
+from aws_cdk.assertions import Capture, Template
+from aws_cdk.aws_apigateway import CfnMethod, CfnModel, CfnResource
+from aws_cdk.aws_lambda import CfnFunction
+
+from tests.app.test_api import TestApi
+
+
+class TestStaffUsersApi(TestApi):
+    """These tests are focused on checking that the API endpoints for the `staff-users` path are
+    configured correctly.
+
+    When adding or modifying API resources, a test should be added to ensure that the
+    resource is created as expected. The pattern for these tests includes the following checks:
+    1. The path and parent id of the API Gateway resource matches expected values.
+    2. If the resource has a lambda function associated with it, the function is present with the expected
+    module and function.
+    3. Check the methods associated with the resource, ensuring they are all present and have the correct handlers.
+    4. Ensure the request and response models for the endpoint are present and match the expected schemas.
+    """
+
+    def test_synth_generates_staff_users_resources(self):
+        api_stack = self.app.sandbox_stage.api_stack
+        api_stack_template = Template.from_stack(api_stack)
+
+        # Ensure the resource is created with expected path for self-service endpoints
+        # /v1/staff-users
+        api_stack_template.has_resource_properties(
+            type=CfnResource.CFN_RESOURCE_TYPE_NAME,
+            props={
+                'ParentId': {
+                    # Verify the parent id matches the expected 'v1' resource
+                    'Ref': api_stack.get_logical_id(api_stack.api.v1_api.resource.node.default_child),
+                },
+                'PathPart': 'staff-users',
+            },
+        )
+
+        # Ensure the resource is created with expected path for self-service endpoints
+        # /v1/compacts/{compact}/staff-users
+        api_stack_template.has_resource_properties(
+            type=CfnResource.CFN_RESOURCE_TYPE_NAME,
+            props={
+                'ParentId': {
+                    # Verify the parent id matches the expected 'v1' resource
+                    'Ref': api_stack.get_logical_id(api_stack.api.v1_api.compact_resource.node.default_child),
+                },
+                'PathPart': 'staff-users',
+            },
+        )
+
+    def test_synth_generates_patch_staff_users_endpoint_resource(self):
+        api_stack = self.app.sandbox_stage.api_stack
+        api_stack_template = Template.from_stack(api_stack)
+
+        # Ensure the resource is created with expected path
+        # /v1/compacts/{compact}/staff-users/{userId}
+        api_stack_template.has_resource_properties(
+            type=CfnResource.CFN_RESOURCE_TYPE_NAME,
+            props={
+                'ParentId': {
+                    # Verify the parent id matches the expected 'staff-users' resource
+                    'Ref': api_stack.get_logical_id(api_stack.api.v1_api.staff_users_admin_resource.node.default_child),
+                },
+                'PathPart': '{userId}',
+            },
+        )
+
+        patch_handler_properties = self.get_resource_properties_by_logical_id(
+            logical_id=api_stack.get_logical_id(api_stack.api.v1_api.staff_users.patch_user_handler.node.default_child),
+            resources=api_stack_template.find_resources(CfnFunction.CFN_RESOURCE_TYPE_NAME),
+        )
+
+        self.assertEqual(
+            'handlers.users.patch_user',
+            patch_handler_properties['Handler'],
+        )
+        patch_method_request_model_logical_id_capture = Capture()
+        patch_method_response_model_logical_id_capture = Capture()
+
+        # ensure the GET method is configured with the lambda integration and authorizer
+        api_stack_template.has_resource_properties(
+            type=CfnMethod.CFN_RESOURCE_TYPE_NAME,
+            props={
+                'HttpMethod': 'PATCH',
+                # the provider users endpoints uses a separate authorizer from the staff endpoints
+                'AuthorizerId': {
+                    'Ref': api_stack.get_logical_id(api_stack.api.staff_users_authorizer.node.default_child),
+                },
+                # ensure the lambda integration is configured with the expected handler
+                'Integration': TestApi.generate_expected_integration_object(
+                    api_stack.get_logical_id(
+                        api_stack.api.v1_api.staff_users.patch_user_handler.node.default_child,
+                    ),
+                ),
+                'RequestModels': {
+                    'application/json': {'Ref': patch_method_request_model_logical_id_capture},
+                },
+                'MethodResponses': [
+                    {
+                        'ResponseModels': {'application/json': {'Ref': patch_method_response_model_logical_id_capture}},
+                        'StatusCode': '200',
+                    },
+                ],
+            },
+        )
+
+        # now check the model matches expected contract
+        patch_request_model = TestApi.get_resource_properties_by_logical_id(
+            patch_method_request_model_logical_id_capture.as_string(),
+            api_stack_template.find_resources(CfnModel.CFN_RESOURCE_TYPE_NAME),
+        )
+
+        self.compare_snapshot(
+            patch_request_model['Schema'],
+            'PATCH_STAFF_USERS_REQUEST_SCHEMA',
+            overwrite_snapshot=False,
+        )
+
+        patch_response_model = TestApi.get_resource_properties_by_logical_id(
+            patch_method_response_model_logical_id_capture.as_string(),
+            api_stack_template.find_resources(CfnModel.CFN_RESOURCE_TYPE_NAME),
+        )
+
+        self.compare_snapshot(
+            patch_response_model['Schema'],
+            'PATCH_STAFF_USERS_RESPONSE_SCHEMA',
+            overwrite_snapshot=False,
+        )
+
+    def test_synth_generates_post_staff_user_endpoint_resource(self):
+        api_stack = self.app.sandbox_stage.api_stack
+        api_stack_template = Template.from_stack(api_stack)
+
+        post_user_handler_properties = self.get_resource_properties_by_logical_id(
+            logical_id=api_stack.get_logical_id(api_stack.api.v1_api.staff_users.post_user_handler.node.default_child),
+            resources=api_stack_template.find_resources(CfnFunction.CFN_RESOURCE_TYPE_NAME),
+        )
+
+        self.assertEqual(
+            'handlers.users.post_user',
+            post_user_handler_properties['Handler'],
+        )
+        post_method_request_model_logical_id_capture = Capture()
+        post_method_response_model_logical_id_capture = Capture()
+
+        # ensure the GET method is configured with the lambda integration and authorizer
+        api_stack_template.has_resource_properties(
+            type=CfnMethod.CFN_RESOURCE_TYPE_NAME,
+            props={
+                'HttpMethod': 'POST',
+                # the provider users endpoints uses a separate authorizer from the staff endpoints
+                'AuthorizerId': {
+                    'Ref': api_stack.get_logical_id(api_stack.api.staff_users_authorizer.node.default_child),
+                },
+                # ensure the lambda integration is configured with the expected handler
+                'Integration': TestApi.generate_expected_integration_object(
+                    api_stack.get_logical_id(
+                        api_stack.api.v1_api.staff_users.post_user_handler.node.default_child,
+                    ),
+                ),
+                'RequestModels': {
+                    'application/json': {'Ref': post_method_request_model_logical_id_capture},
+                },
+                'MethodResponses': [
+                    {
+                        'ResponseModels': {'application/json': {'Ref': post_method_response_model_logical_id_capture}},
+                        'StatusCode': '200',
+                    },
+                ],
+            },
+        )
+
+        # now check the model matches expected contract
+        post_request_model = TestApi.get_resource_properties_by_logical_id(
+            post_method_request_model_logical_id_capture.as_string(),
+            api_stack_template.find_resources(CfnModel.CFN_RESOURCE_TYPE_NAME),
+        )
+
+        self.compare_snapshot(
+            post_request_model['Schema'],
+            'POST_STAFF_USERS_REQUEST_SCHEMA',
+            overwrite_snapshot=False,
+        )
+
+        post_response_model = TestApi.get_resource_properties_by_logical_id(
+            post_method_response_model_logical_id_capture.as_string(),
+            api_stack_template.find_resources(CfnModel.CFN_RESOURCE_TYPE_NAME),
+        )
+
+        self.compare_snapshot(
+            post_response_model['Schema'],
+            'POST_STAFF_USERS_RESPONSE_SCHEMA',
+            overwrite_snapshot=False,
+        )
diff --git a/backend/compact-connect/tests/app/test_pipeline.py b/backend/compact-connect/tests/app/test_pipeline.py
index f1429e609..a29d877e4 100644
--- a/backend/compact-connect/tests/app/test_pipeline.py
+++ b/backend/compact-connect/tests/app/test_pipeline.py
@@ -5,7 +5,12 @@
 
 from app import CompactConnectApp
 from aws_cdk.assertions import Match, Template
-from aws_cdk.aws_cognito import CfnUserPool, CfnUserPoolClient, CfnUserPoolRiskConfigurationAttachment
+from aws_cdk.aws_cognito import (
+    CfnUserPool,
+    CfnUserPoolClient,
+    CfnUserPoolResourceServer,
+    CfnUserPoolRiskConfigurationAttachment,
+)
 from aws_cdk.aws_lambda import CfnFunction, CfnLayerVersion
 from aws_cdk.aws_ssm import CfnParameter
 
@@ -53,6 +58,29 @@ def test_synth_pipeline(self):
         for ui_stack in (self.app.pipeline_stack.test_stage.ui_stack, self.app.pipeline_stack.prod_stage.ui_stack):
             self._inspect_ui_stack(ui_stack)
 
+    def test_synth_generates_resource_servers_with_expected_scopes_for_staff_users(self):
+        persistent_stack = self.app.pipeline_stack.test_stage.persistent_stack
+        persistent_stack_template = Template.from_stack(persistent_stack)
+
+        # Get the resource servers created in the persistent stack
+        resource_servers = persistent_stack.staff_users.resource_servers
+        # We must confirm that these scopes are being explicitly created for each compact
+        # which are absolutely critical for the system to function as expected.
+        self.assertEqual(self.context['compacts'], list(resource_servers.keys()))
+
+        for compact, resource_server in resource_servers.items():
+            # for this test, we just get the 'aslp' compact resource server
+            resource_server_properties = self.get_resource_properties_by_logical_id(
+                persistent_stack.get_logical_id(resource_server.node.default_child),
+                persistent_stack_template.find_resources(CfnUserPoolResourceServer.CFN_RESOURCE_TYPE_NAME),
+            )
+            # Ensure the resource servers are created with the expected scopes
+            self.assertEqual(
+                ['admin', 'write', 'readGeneral'],
+                [scope['ScopeName'] for scope in resource_server_properties['Scopes']],
+                msg=f'Expected scopes for compact {compact} not found',
+            )
+
     def test_cognito_using_recommended_security_in_prod(self):
         stack = self.app.pipeline_stack.prod_stage.persistent_stack
         template = Template.from_stack(stack)
diff --git a/backend/compact-connect/tests/resources/snapshots/PATCH_STAFF_USERS_REQUEST_SCHEMA.json b/backend/compact-connect/tests/resources/snapshots/PATCH_STAFF_USERS_REQUEST_SCHEMA.json
new file mode 100644
index 000000000..f0705dc35
--- /dev/null
+++ b/backend/compact-connect/tests/resources/snapshots/PATCH_STAFF_USERS_REQUEST_SCHEMA.json
@@ -0,0 +1,53 @@
+{
+  "additionalProperties": false,
+  "properties": {
+    "permissions": {
+      "additionalProperties": {
+        "additionalProperties": false,
+        "properties": {
+          "actions": {
+            "properties": {
+              "readPrivate": {
+                "type": "boolean"
+              },
+              "admin": {
+                "type": "boolean"
+              },
+              "read": {
+                "type": "boolean"
+              }
+            },
+            "type": "object"
+          },
+          "jurisdictions": {
+            "additionalProperties": {
+              "properties": {
+                "actions": {
+                  "additionalProperties": false,
+                  "properties": {
+                    "write": {
+                      "type": "boolean"
+                    },
+                    "admin": {
+                      "type": "boolean"
+                    },
+                    "readPrivate": {
+                      "type": "boolean"
+                    }
+                  },
+                  "type": "object"
+                }
+              },
+              "type": "object"
+            },
+            "type": "object"
+          }
+        },
+        "type": "object"
+      },
+      "type": "object"
+    }
+  },
+  "type": "object",
+  "$schema": "http://json-schema.org/draft-04/schema#"
+}
diff --git a/backend/compact-connect/tests/resources/snapshots/PATCH_STAFF_USERS_RESPONSE_SCHEMA.json b/backend/compact-connect/tests/resources/snapshots/PATCH_STAFF_USERS_RESPONSE_SCHEMA.json
new file mode 100644
index 000000000..31dd2a592
--- /dev/null
+++ b/backend/compact-connect/tests/resources/snapshots/PATCH_STAFF_USERS_RESPONSE_SCHEMA.json
@@ -0,0 +1,87 @@
+{
+  "additionalProperties": false,
+  "properties": {
+    "userId": {
+      "type": "string"
+    },
+    "attributes": {
+      "additionalProperties": false,
+      "properties": {
+        "email": {
+          "maxLength": 100,
+          "minLength": 5,
+          "type": "string"
+        },
+        "givenName": {
+          "maxLength": 100,
+          "minLength": 1,
+          "type": "string"
+        },
+        "familyName": {
+          "maxLength": 100,
+          "minLength": 1,
+          "type": "string"
+        }
+      },
+      "required": [
+        "email",
+        "givenName",
+        "familyName"
+      ],
+      "type": "object"
+    },
+    "permissions": {
+      "additionalProperties": {
+        "additionalProperties": false,
+        "properties": {
+          "actions": {
+            "properties": {
+              "readPrivate": {
+                "type": "boolean"
+              },
+              "admin": {
+                "type": "boolean"
+              },
+              "read": {
+                "type": "boolean"
+              }
+            },
+            "type": "object"
+          },
+          "jurisdictions": {
+            "additionalProperties": {
+              "properties": {
+                "actions": {
+                  "additionalProperties": false,
+                  "properties": {
+                    "write": {
+                      "type": "boolean"
+                    },
+                    "admin": {
+                      "type": "boolean"
+                    },
+                    "readPrivate": {
+                      "type": "boolean"
+                    }
+                  },
+                  "type": "object"
+                }
+              },
+              "type": "object"
+            },
+            "type": "object"
+          }
+        },
+        "type": "object"
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "userId",
+    "attributes",
+    "permissions"
+  ],
+  "type": "object",
+  "$schema": "http://json-schema.org/draft-04/schema#"
+}
diff --git a/backend/compact-connect/tests/resources/snapshots/POST_STAFF_USERS_REQUEST_SCHEMA.json b/backend/compact-connect/tests/resources/snapshots/POST_STAFF_USERS_REQUEST_SCHEMA.json
new file mode 100644
index 000000000..ddbcdefd8
--- /dev/null
+++ b/backend/compact-connect/tests/resources/snapshots/POST_STAFF_USERS_REQUEST_SCHEMA.json
@@ -0,0 +1,83 @@
+{
+  "additionalProperties": false,
+  "properties": {
+    "attributes": {
+      "additionalProperties": false,
+      "properties": {
+        "email": {
+          "maxLength": 100,
+          "minLength": 5,
+          "type": "string"
+        },
+        "givenName": {
+          "maxLength": 100,
+          "minLength": 1,
+          "type": "string"
+        },
+        "familyName": {
+          "maxLength": 100,
+          "minLength": 1,
+          "type": "string"
+        }
+      },
+      "required": [
+        "email",
+        "givenName",
+        "familyName"
+      ],
+      "type": "object"
+    },
+    "permissions": {
+      "additionalProperties": {
+        "additionalProperties": false,
+        "properties": {
+          "actions": {
+            "properties": {
+              "readPrivate": {
+                "type": "boolean"
+              },
+              "admin": {
+                "type": "boolean"
+              },
+              "read": {
+                "type": "boolean"
+              }
+            },
+            "type": "object"
+          },
+          "jurisdictions": {
+            "additionalProperties": {
+              "properties": {
+                "actions": {
+                  "additionalProperties": false,
+                  "properties": {
+                    "write": {
+                      "type": "boolean"
+                    },
+                    "admin": {
+                      "type": "boolean"
+                    },
+                    "readPrivate": {
+                      "type": "boolean"
+                    }
+                  },
+                  "type": "object"
+                }
+              },
+              "type": "object"
+            },
+            "type": "object"
+          }
+        },
+        "type": "object"
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "attributes",
+    "permissions"
+  ],
+  "type": "object",
+  "$schema": "http://json-schema.org/draft-04/schema#"
+}
diff --git a/backend/compact-connect/tests/resources/snapshots/POST_STAFF_USERS_RESPONSE_SCHEMA.json b/backend/compact-connect/tests/resources/snapshots/POST_STAFF_USERS_RESPONSE_SCHEMA.json
new file mode 100644
index 000000000..31dd2a592
--- /dev/null
+++ b/backend/compact-connect/tests/resources/snapshots/POST_STAFF_USERS_RESPONSE_SCHEMA.json
@@ -0,0 +1,87 @@
+{
+  "additionalProperties": false,
+  "properties": {
+    "userId": {
+      "type": "string"
+    },
+    "attributes": {
+      "additionalProperties": false,
+      "properties": {
+        "email": {
+          "maxLength": 100,
+          "minLength": 5,
+          "type": "string"
+        },
+        "givenName": {
+          "maxLength": 100,
+          "minLength": 1,
+          "type": "string"
+        },
+        "familyName": {
+          "maxLength": 100,
+          "minLength": 1,
+          "type": "string"
+        }
+      },
+      "required": [
+        "email",
+        "givenName",
+        "familyName"
+      ],
+      "type": "object"
+    },
+    "permissions": {
+      "additionalProperties": {
+        "additionalProperties": false,
+        "properties": {
+          "actions": {
+            "properties": {
+              "readPrivate": {
+                "type": "boolean"
+              },
+              "admin": {
+                "type": "boolean"
+              },
+              "read": {
+                "type": "boolean"
+              }
+            },
+            "type": "object"
+          },
+          "jurisdictions": {
+            "additionalProperties": {
+              "properties": {
+                "actions": {
+                  "additionalProperties": false,
+                  "properties": {
+                    "write": {
+                      "type": "boolean"
+                    },
+                    "admin": {
+                      "type": "boolean"
+                    },
+                    "readPrivate": {
+                      "type": "boolean"
+                    }
+                  },
+                  "type": "object"
+                }
+              },
+              "type": "object"
+            },
+            "type": "object"
+          }
+        },
+        "type": "object"
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "userId",
+    "attributes",
+    "permissions"
+  ],
+  "type": "object",
+  "$schema": "http://json-schema.org/draft-04/schema#"
+}
diff --git a/backend/compact-connect/tests/smoke/config.py b/backend/compact-connect/tests/smoke/config.py
new file mode 100644
index 000000000..06d41fad7
--- /dev/null
+++ b/backend/compact-connect/tests/smoke/config.py
@@ -0,0 +1,67 @@
+import json
+import logging
+import os
+from functools import cached_property
+
+import boto3
+from aws_lambda_powertools import Logger
+
+logging.basicConfig()
+logger = Logger()
+logger.setLevel(logging.DEBUG if os.environ.get('DEBUG', 'false').lower() == 'true' else logging.INFO)
+
+
+class _Config:
+    @property
+    def api_base_url(self):
+        return os.environ['CC_TEST_API_BASE_URL']
+
+    @property
+    def provider_user_dynamodb_table(self):
+        return boto3.resource('dynamodb').Table(os.environ['CC_TEST_PROVIDER_DYNAMO_TABLE_NAME'])
+
+    @property
+    def data_events_dynamodb_table(self):
+        return boto3.resource('dynamodb').Table(os.environ['CC_TEST_DATA_EVENT_DYNAMO_TABLE_NAME'])
+
+    @property
+    def staff_users_dynamodb_table(self):
+        return boto3.resource('dynamodb').Table(os.environ['CC_TEST_STAFF_USER_DYNAMO_TABLE_NAME'])
+
+    @property
+    def cognito_staff_user_client_id(self):
+        return os.environ['CC_TEST_COGNITO_STAFF_USER_POOL_CLIENT_ID']
+
+    @property
+    def cognito_staff_user_pool_id(self):
+        return os.environ['CC_TEST_COGNITO_STAFF_USER_POOL_ID']
+
+    @property
+    def cognito_provider_user_client_id(self):
+        return os.environ['CC_TEST_COGNITO_PROVIDER_USER_POOL_CLIENT_ID']
+
+    @property
+    def cognito_provider_user_pool_id(self):
+        return os.environ['CC_TEST_COGNITO_PROVIDER_USER_POOL_ID']
+
+    @property
+    def test_provider_user_username(self):
+        return os.environ['CC_TEST_PROVIDER_USER_USERNAME']
+
+    @property
+    def test_provider_user_password(self):
+        return os.environ['CC_TEST_PROVIDER_USER_PASSWORD']
+
+    @cached_property
+    def cognito_client(self):
+        return boto3.client('cognito-idp')
+
+
+def load_smoke_test_env():
+    with open(os.path.join(os.path.dirname(__file__), 'smoke_tests_env.json')) as env_file:
+        env_vars = json.load(env_file)
+        os.environ.update(env_vars)
+
+
+load_smoke_test_env()
+config = _Config()
diff --git a/backend/compact-connect/tests/smoke/license_upload_smoke_tests.py b/backend/compact-connect/tests/smoke/license_upload_smoke_tests.py
index 7edaf54e3..10c1e637e 100644
--- a/backend/compact-connect/tests/smoke/license_upload_smoke_tests.py
+++ b/backend/compact-connect/tests/smoke/license_upload_smoke_tests.py
@@ -6,6 +6,8 @@
 import requests
 from smoke_common import (
     SmokeTestFailureException,
+    create_test_staff_user,
+    delete_test_staff_user,
     get_api_base_url,
     get_data_events_dynamodb_table,
     get_provider_user_dynamodb_table,
@@ -19,9 +21,12 @@
 
 # This script can be run locally to test the license upload/ingest flow against a sandbox environment
 # of the Compact Connect API.
+# Your sandbox account must be deployed with the "security_profile": "VULNERABLE" setting in your cdk.context.json
 # To run this script, create a smoke_tests_env.json file in the same directory as this script using the
 # 'smoke_tests_env_example.json' file as a template.
 
+TEST_STAFF_USER_EMAIL = 'testStaffUserLicenseUploader@smokeTestFakeEmail.com'
+
 
 def upload_licenses_record():
     """
@@ -33,7 +38,7 @@ def upload_licenses_record():
     Step 3: Verify the license record is recorded in the data events table.
     """
 
-    headers = get_staff_user_auth_headers()
+    headers = get_staff_user_auth_headers(TEST_STAFF_USER_EMAIL)
 
     # Step 1: Upload a license record through the POST '/v1/compacts/aslp/jurisdictions/ne/licenses' endpoint.
     post_body = [
@@ -149,5 +154,18 @@ def upload_licenses_record():
 
 if __name__ == '__main__':
     load_smoke_test_env()
-    upload_licenses_record()
-    print('License record upload smoke test passed')
+    # Create staff user with permission to upload licenses
+    test_user_sub = create_test_staff_user(
+        email=TEST_STAFF_USER_EMAIL,
+        compact=COMPACT,
+        jurisdiction=JURISDICTION,
+        permissions={'actions': {'admin'}, 'jurisdictions': {JURISDICTION: {'write', 'admin'}}},
+    )
+    try:
+        upload_licenses_record()
+        print('License record upload smoke test passed')
+    except SmokeTestFailureException as e:
+        print(f'License record upload smoke test failed: {str(e)}')
+    finally:
+        # Clean up the test staff user
+        delete_test_staff_user(TEST_STAFF_USER_EMAIL, user_sub=test_user_sub, compact=COMPACT)
diff --git a/backend/compact-connect/tests/smoke/military_affiliation_smoke_tests.py b/backend/compact-connect/tests/smoke/military_affiliation_smoke_tests.py
index e24991cdc..e10f8ec8e 100644
--- a/backend/compact-connect/tests/smoke/military_affiliation_smoke_tests.py
+++ b/backend/compact-connect/tests/smoke/military_affiliation_smoke_tests.py
@@ -8,12 +8,13 @@
 from smoke_common import (
     SmokeTestFailureException,
     get_api_base_url,
-    get_provider_user_auth_headers,
+    get_provider_user_auth_headers_cached,
     load_smoke_test_env,
 )
 
 # This script is used to test the military affiliations upload flow against a sandbox environment
-# # of the Compact Connect API.
+# of the Compact Connect API. It requires that you have a provider user set up in the sandbox environment.
+# Your sandbox account must also be deployed with the "security_profile": "VULNERABLE" setting in your cdk.context.json
 
 # To run this script, create a smoke_tests_env.json file in the same directory as this script using the
 # 'smoke_tests_env_example.json' file as a template.
@@ -26,7 +27,7 @@ def test_military_affiliation_upload():
     # Step 3: Verify that the test pdf file was uploaded successfully by checking the response status code.
     # Step 4: Get the provider data from the GET '/v1/provider-users/me' endpoint and verify that the military
     # affiliation record is active.
-    headers = get_provider_user_auth_headers()
+    headers = get_provider_user_auth_headers_cached()
 
     post_body = {
         'fileNames': ['military_affiliation.pdf'],
@@ -111,7 +112,7 @@ def test_military_affiliation_patch_update():
     # '/v1/provider-users/me/military-affiliation' endpoint.
     # Step 4: Get the provider data from the GET '/v1/provider-users/me' endpoint and verify that all the military
     # affiliation records are inactive.
-    headers = get_provider_user_auth_headers()
+    headers = get_provider_user_auth_headers_cached()
 
     patch_body = {
         'status': 'inactive',
diff --git a/backend/compact-connect/tests/smoke/purchasing_privileges_smoke_tests.py b/backend/compact-connect/tests/smoke/purchasing_privileges_smoke_tests.py
index 534db37d2..a67d0495e 100644
--- a/backend/compact-connect/tests/smoke/purchasing_privileges_smoke_tests.py
+++ b/backend/compact-connect/tests/smoke/purchasing_privileges_smoke_tests.py
@@ -1,15 +1,14 @@
 # ruff: noqa: T201  we use print statements for smoke testing
 #!/usr/bin/env python3
+import time
 from datetime import UTC, datetime
 
 import requests
+from config import config
 from smoke_common import (
     SmokeTestFailureException,
     call_provider_users_me_endpoint,
-    get_api_base_url,
-    get_provider_user_auth_headers,
-    get_provider_user_dynamodb_table,
-    load_smoke_test_env,
+    get_provider_user_auth_headers_cached,
 )
 
 # This script can be run locally to test the privilege purchasing flow against a sandbox environment
@@ -29,16 +28,22 @@ def test_purchasing_privilege():
     if original_privileges:
         provider_id = original_provider_data.get('providerId')
         compact = original_provider_data.get('compact')
-        dynamodb_table = get_provider_user_dynamodb_table()
+        dynamodb_table = config.provider_user_dynamodb_table
         for privilege in original_privileges:
-            print(f'Deleting privilege record: {privilege}')
+            privilege_pk = f'{compact}#PROVIDER#{provider_id}'
+            privilege_sk = (
+                f'{compact}#PROVIDER#privilege/{privilege["jurisdiction"]}#'
+                f'{datetime.fromisoformat(privilege["dateOfRenewal"]).date().isoformat()}'
+            )
+            print(f'Deleting privilege record:\n{privilege_pk}\n{privilege_sk}')
             dynamodb_table.delete_item(
                 Key={
-                    'pk': f'{compact}#PROVIDER#{provider_id}',
-                    'sk': f'{compact}#PROVIDER#privilege/{privilege["jurisdiction"]}'
-                    f'#{datetime.fromisoformat(privilege["dateOfRenewal"]).date().isoformat()}',
+                    'pk': privilege_pk,
+                    'sk': privilege_sk,
                 }
             )
+            # give dynamodb time to propagate
+            time.sleep(1)
 
     post_body = {
         'orderInformation': {
@@ -61,9 +66,9 @@ def test_purchasing_privilege():
         'selectedJurisdictions': ['ne'],
     }
 
-    headers = get_provider_user_auth_headers()
+    headers = get_provider_user_auth_headers_cached()
     post_api_response = requests.post(
-        url=get_api_base_url() + '/v1/purchases/privileges', headers=headers, json=post_body, timeout=20
+        url=config.api_base_url + '/v1/purchases/privileges', headers=headers, json=post_body, timeout=20
     )
 
     if post_api_response.status_code != 200:
@@ -93,5 +98,4 @@ def test_purchasing_privilege():
 
 
 if __name__ == '__main__':
-    load_smoke_test_env()
     test_purchasing_privilege()
diff --git a/backend/compact-connect/tests/smoke/query_provider_smoke_tests.py b/backend/compact-connect/tests/smoke/query_provider_smoke_tests.py
new file mode 100644
index 000000000..ae8a1863b
--- /dev/null
+++ b/backend/compact-connect/tests/smoke/query_provider_smoke_tests.py
@@ -0,0 +1,209 @@
+# ruff: noqa: S101 T201  we use asserts and print statements for smoke testing
+import json
+
+import requests
+from config import config, logger
+from smoke_common import (
+    SmokeTestFailureException,
+    call_provider_users_me_endpoint,
+    create_test_staff_user,
+    delete_test_staff_user,
+    get_staff_user_auth_headers,
+    load_smoke_test_env,
+)
+
+# This script can be run locally to test the Query/Get Provider flow against a sandbox environment of the Compact
+# Connect API. It requires that you have a provider user set up in the same compact of the sandbox environment.
+# Your sandbox account must also be deployed with the "security_profile": "VULNERABLE" setting in your cdk.context.json
+# file, which allows you to log in users using the boto3 Cognito client.
+
+# The staff user should be created **without** any 'readPrivate' permissions, as this flow is intended to test
+# the general provider data retrieval flow.
+
+# To run this script, create a smoke_tests_env.json file in the same directory as this script using the
+# 'smoke_tests_env_example.json' file as a template.
+
+
+TEST_STAFF_USER_EMAIL = 'testStaffUserQuerySmokeTests@smokeTestFakeEmail.com'
+
+
+def get_general_provider_user_data_smoke_test():
+    """
+    Verifies that a provider record can be fetched from the GET provider users endpoint with private fields sanitized.
+
+    Step 1: Get the provider id of the provider user profile information.
+    Step 2: The staff user calls the GET provider users endpoint with the provider id.
+    Step 3: Verify the Provider response matches the profile.
+    """
+    # Step 1: Get the provider id of the provider user profile information.
+    test_user_profile = call_provider_users_me_endpoint()
+    provider_id = provider_user_profile['providerId']
+    compact = provider_user_profile['compact']
+
+    # Step 2: The staff user calls the GET provider users endpoint with the provider id.
+    staff_users_headers = get_staff_user_auth_headers(TEST_STAFF_USER_EMAIL)
+
+    get_provider_response = requests.get(
+        url=config.api_base_url + f'/v1/compacts/{compact}/providers/{provider_id}',
+        headers=staff_users_headers,
+        timeout=10,
+    )
+
+    if get_provider_response.status_code != 200:
+        raise SmokeTestFailureException(f'Failed to query provider. Response: {get_provider_response.json()}')
+    logger.info('Received success response from GET endpoint')
+
+    # Step 3: Verify the Provider response matches the profile.
+    provider_object = get_provider_response.json()
+
+    # verify the ssn is NOT in the response
+    if 'ssn' in provider_object:
+        raise SmokeTestFailureException(f'unexpected ssn field returned. Response: {get_provider_response.json()}')
+
+    # remove the fields from the user profile that are not in the query response
+    test_user_profile.pop('ssn', None)
+    test_user_profile.pop('dateOfBirth', None)
+    for provider_license in test_user_profile['licenses']:
+        provider_license.pop('ssn', None)
+        provider_license.pop('dateOfBirth', None)
+    for military_affiliation in test_user_profile['militaryAffiliations']:
+        military_affiliation.pop('documentKeys', None)
+
+    if provider_object != test_user_profile:
+        raise SmokeTestFailureException(
+            f'Provider object does not match the profile.\n'
+            f'Profile response: {json.dumps(test_user_profile)}\n'
+            f'Get Provider response: {json.dumps(provider_object)}'
+        )
+    logger.info('Successfully fetched expected provider records.')
+
+
+def query_provider_user_smoke_test():
+    """
+    Verifies that a provider record can be queried .
+
+    Step 1: Get the provider id of the provider user profile information.
+    Step 2: Have the staff user query for that provider using the profile information.
+    Step 3: Verify the Provider response matches the profile.
+    """
+
+    # Step 1: Get the provider id of the provider user profile information.
+    test_user_profile = call_provider_users_me_endpoint()
+    provider_id = provider_user_profile['providerId']
+    compact = provider_user_profile['compact']
+
+    # Step 2: Have the staff user query for that provider using the profile information.
+    staff_users_headers = get_staff_user_auth_headers(TEST_STAFF_USER_EMAIL)
+    post_body = {'query': {'providerId': provider_id}}
+
+    post_response = requests.post(
+        url=config.api_base_url + f'/v1/compacts/{compact}/providers/query',
+        headers=staff_users_headers,
+        json=post_body,
+        timeout=10,
+    )
+
+    if post_response.status_code != 200:
+        raise SmokeTestFailureException(f'Failed to query provider. Response: {post_response.json()}')
+    logger.info('Received success response from query endpoint')
+    # Step 3: Verify the Provider response matches the profile.
+    providers = post_response.json()['providers']
+    if not providers:
+        raise SmokeTestFailureException(f'No providers returned by query. Response: {post_response.json()}')
+
+    provider_object = providers[0]
+
+    # verify the ssn is NOT in the response
+    if 'ssn' in provider_object:
+        raise SmokeTestFailureException(f'unexpected ssn field returned. Response: {post_response.json()}')
+
+    # remove the fields from the user profile that are not in the query response
+    test_user_profile.pop('ssn', None)
+    test_user_profile.pop('dateOfBirth', None)
+    test_user_profile.pop('licenses')
+    test_user_profile.pop('militaryAffiliations')
+    test_user_profile.pop('privileges')
+
+    if provider_object != test_user_profile:
+        raise SmokeTestFailureException(
+            f'Provider object does not match the profile.\n'
+            f'Profile response: {test_user_profile}\n'
+            f'Query Provider object: {provider_object}'
+        )
+
+    logger.info('Successfully queried expected provider record.')
+
+
+def get_provider_data_with_read_private_access_smoke_test(test_staff_user_id: str):
+    """
+    Verifies that a staff user can read private fields of a provider record if they have the 'readPrivate' permission.
+
+    Step 1: Update the staff user's permissions using the PATCH '/v1/staff-users/me/permissions' endpoint to include
+    the 'readPrivate' permission.
+    Step 2: Generate a new token and call the GET provider users endpoint with the new token.
+    Step 3: Verify the Provider response matches the profile.
+    """
+
+    # Step 1: Get the provider user profile information.
+    test_user_profile = call_provider_users_me_endpoint()
+    provider_id = provider_user_profile['providerId']
+    compact = provider_user_profile['compact']
+    # Step 1: Update the staff user's permissions using the PATCH '/v1/staff-users/me/permissions' endpoint.
+    staff_users_headers = get_staff_user_auth_headers(TEST_STAFF_USER_EMAIL)
+    patch_body = {'permissions': {'aslp': {'actions': {'readPrivate': True}}}}
+    patch_response = requests.patch(
+        url=config.api_base_url + f'/v1/compacts/{compact}/staff-users/{test_staff_user_id}',
+        headers=staff_users_headers,
+        json=patch_body,
+        timeout=10,
+    )
+
+    if patch_response.status_code != 200:
+        raise SmokeTestFailureException(f'Failed to PATCH staff user permissions. Response: {patch_response.json()}')
+    logger.info('Successfully updated staff user permissions.')
+
+    # Step 2: Generate a new token and call the GET provider users endpoint with the new token.
+    staff_users_headers = get_staff_user_auth_headers(TEST_STAFF_USER_EMAIL)
+    get_provider_response = requests.get(
+        url=config.api_base_url + f'/v1/compacts/{compact}/providers/{provider_id}',
+        headers=staff_users_headers,
+        timeout=10,
+    )
+
+    if get_provider_response.status_code != 200:
+        raise SmokeTestFailureException(f'Failed to GET staff user. Response: {get_provider_response.json()}')
+
+    logger.info('Received success response from GET endpoint')
+
+    # Step 3: Verify the Provider response matches the profile.
+    provider_object = get_provider_response.json()
+    if provider_object != test_user_profile:
+        raise SmokeTestFailureException(
+            f'Provider object does not match the profile.\n'
+            f'Profile response: {test_user_profile}\n'
+            f'Get Provider response: {provider_object}'
+        )
+
+    logger.info('Successfully fetched expected user profile.')
+
+
+if __name__ == '__main__':
+    load_smoke_test_env()
+    provider_user_profile = call_provider_users_me_endpoint()
+    provider_compact = provider_user_profile['compact']
+    # ensure the test staff user is in the same compact as the test provider user without 'readPrivate' permissions
+    test_user_sub = create_test_staff_user(
+        email=TEST_STAFF_USER_EMAIL,
+        compact=provider_compact,
+        jurisdiction='oh',
+        permissions={'actions': {'admin'}, 'jurisdictions': {'oh': {'write', 'admin'}}},
+    )
+    try:
+        get_general_provider_user_data_smoke_test()
+        query_provider_user_smoke_test()
+        get_provider_data_with_read_private_access_smoke_test(test_staff_user_id=test_user_sub)
+        logger.info('Query provider smoke tests passed')
+    except SmokeTestFailureException as e:
+        logger.error(f'Query provider smoke tests failed: {str(e)}')
+    finally:
+        delete_test_staff_user(TEST_STAFF_USER_EMAIL, user_sub=test_user_sub, compact=provider_compact)
diff --git a/backend/compact-connect/tests/smoke/smoke_common.py b/backend/compact-connect/tests/smoke/smoke_common.py
index 89974cbed..53a710383 100644
--- a/backend/compact-connect/tests/smoke/smoke_common.py
+++ b/backend/compact-connect/tests/smoke/smoke_common.py
@@ -1,8 +1,11 @@
 import json
 import os
+import sys
 
 import boto3
 import requests
+from botocore.exceptions import ClientError
+from config import config, logger
 
 
 class SmokeTestFailureException(Exception):
@@ -14,15 +17,154 @@ def __init__(self, message):
         super().__init__(message)
 
 
-def get_provider_user_auth_headers():
+provider_data_path = os.path.join('lambdas', 'python', 'staff-users')
+common_lib_path = os.path.join('lambdas', 'python', 'common')
+sys.path.append(provider_data_path)
+sys.path.append(common_lib_path)
+
+with open('cdk.json') as context_file:
+    _context = json.load(context_file)['context']
+JURISDICTIONS = _context['jurisdictions']
+COMPACTS = _context['compacts']
+
+os.environ['COMPACTS'] = json.dumps(COMPACTS)
+os.environ['JURISDICTIONS'] = json.dumps(JURISDICTIONS)
+
+# We have to import this after we've added the common lib to our path and environment
+from cc_common.data_model.schema.user import UserRecordSchema  # noqa: E402
+
+_TEST_STAFF_USER_PASSWORD = 'TestPass123!'  # noqa: S105 test credential for test staff user
+_TEMP_STAFF_PASSWORD = 'TempPass123!'  # noqa: S105 temporary password for creating test staff users
+
+
+def _create_staff_user_in_cognito(*, email: str) -> str:
+    """
+    Creates a staff user in Cognito and returns the user's sub.
+    """
+
+    def get_sub_from_attributes(user_attributes: list):
+        for attribute in user_attributes:
+            if attribute['Name'] == 'sub':
+                return attribute['Value']
+        raise ValueError('Failed to find user sub!')
+
+    try:
+        user_data = config.cognito_client.admin_create_user(
+            UserPoolId=config.cognito_staff_user_pool_id,
+            Username=email,
+            UserAttributes=[{'Name': 'email', 'Value': email}],
+            TemporaryPassword=_TEMP_STAFF_PASSWORD,
+        )
+        logger.info(f"Created staff user, '{email}'. Setting password.")
+        # set this to simplify login flow for user
+        config.cognito_client.admin_set_user_password(
+            UserPoolId=config.cognito_staff_user_pool_id,
+            Username=email,
+            Password=_TEST_STAFF_USER_PASSWORD,
+            Permanent=True,
+        )
+        logger.info(f"Set password for staff user, '{email}' in Cognito. New user data: {user_data}")
+        return get_sub_from_attributes(user_data['User']['Attributes'])
+
+    except ClientError as e:
+        if e.response['Error']['Code'] == 'UsernameExistsException':
+            logger.info(f"Staff user, '{email}', already exists in Cognito. Getting user data.")
+            user_data = config.cognito_client.admin_get_user(
+                UserPoolId=config.cognito_staff_user_pool_id, Username=email
+            )
+            return get_sub_from_attributes(user_data['UserAttributes'])
+
+        raise e
+
+
+def delete_test_staff_user(email, user_sub: str, compact: str):
+    """
+    Deletes a test staff user from Cognito.
+    """
+    try:
+        logger.info(f"Deleting staff user from cognito, '{email}'")
+        config.cognito_client.admin_delete_user(UserPoolId=config.cognito_staff_user_pool_id, Username=email)
+        # now clean up the user record in DynamoDB
+        pk = f'USER#{user_sub}'
+        sk = f'COMPACT#{compact}'
+        logger.info(f"Deleting staff user record from DynamoDB, PK: '{pk}', SK: '{sk}'")
+        config.staff_users_dynamodb_table.delete_item(Key={'pk': pk, 'sk': sk})
+        logger.info(f"Deleted staff user, '{email}', from Cognito and DynamoDB")
+    except ClientError as e:
+        logger.error(f"Failed to delete staff user data, '{email}': {str(e)}")
+        raise e
+
+
+def create_test_staff_user(*, email: str, compact: str, jurisdiction: str, permissions: dict):
+    """
+    Creates a test staff user in Cognito, stores their data in DynamoDB, and returns their user sub id.
+    """
+    logger.info(f"Creating staff user, '{email}', in {compact}/{jurisdiction}")
+    user_attributes = {'email': email, 'familyName': 'Dokes', 'givenName': 'Joe'}
+    sub = _create_staff_user_in_cognito(email=email)
+    schema = UserRecordSchema()
+    config.staff_users_dynamodb_table.put_item(
+        Item=schema.dump(
+            {
+                'type': 'user',
+                'userId': sub,
+                'compact': compact,
+                'attributes': user_attributes,
+                'permissions': permissions,
+            },
+        ),
+    )
+    logger.info(f'Created staff user record in DynamoDB. User data: {user_attributes}')
+
+    return sub
+
+
+def get_user_tokens(email, password=_TEST_STAFF_USER_PASSWORD, is_staff=False):
+    """
+    Gets Cognito tokens for a user.
+    {
+        'IdToken': 'string',
+        'AccessToken': 'string',
+        'RefreshToken': 'string',
+        'ExpiresIn': 123,
+        'TokenType': 'string',
+        'NewDeviceMetadata': {
+            'DeviceKey': 'string',
+            'DeviceGroupKey': 'string'
+        }
+    }
+    """
+    try:
+        logger.info('Getting tokens for user: ' + email + ' user type: ' + ('staff' if is_staff else 'provider'))
+        response = config.cognito_client.admin_initiate_auth(
+            UserPoolId=config.cognito_staff_user_pool_id if is_staff else config.cognito_provider_user_pool_id,
+            ClientId=config.cognito_staff_user_client_id if is_staff else config.cognito_provider_user_client_id,
+            AuthFlow='ADMIN_USER_PASSWORD_AUTH',
+            AuthParameters={'USERNAME': email, 'PASSWORD': password},
+        )
+
+        return response['AuthenticationResult']
+
+    except ClientError as e:
+        logger.info(f'Failed to get tokens for user {email}: {str(e)}')
+        raise e
+
+
+def get_provider_user_auth_headers_cached():
+    provider_token = os.environ.get('TEST_PROVIDER_USER_ID_TOKEN')
+    if not provider_token:
+        tokens = get_user_tokens(config.test_provider_user_username, config.test_provider_user_password, is_staff=False)
+        os.environ['TEST_PROVIDER_USER_ID_TOKEN'] = tokens['IdToken']
+
     return {
         'Authorization': 'Bearer ' + os.environ['TEST_PROVIDER_USER_ID_TOKEN'],
     }
 
 
-def get_staff_user_auth_headers():
+def get_staff_user_auth_headers(username: str, password: str = _TEST_STAFF_USER_PASSWORD):
+    tokens = get_user_tokens(username, password, is_staff=True)
     return {
-        'Authorization': 'Bearer ' + os.environ['TEST_STAFF_USER_ACCESS_TOKEN'],
+        'Authorization': 'Bearer ' + tokens['AccessToken'],
     }
 
 
@@ -47,7 +189,7 @@ def load_smoke_test_env():
 def call_provider_users_me_endpoint():
     # Get the provider data from the GET '/v1/provider-users/me' endpoint.
     get_provider_data_response = requests.get(
-        url=get_api_base_url() + '/v1/provider-users/me', headers=get_provider_user_auth_headers(), timeout=10
+        url=config.api_base_url + '/v1/provider-users/me', headers=get_provider_user_auth_headers_cached(), timeout=10
     )
     if get_provider_data_response.status_code != 200:
         raise SmokeTestFailureException(f'Failed to GET provider data. Response: {get_provider_data_response.json()}')
diff --git a/backend/compact-connect/tests/smoke/smoke_tests_env_example.json b/backend/compact-connect/tests/smoke/smoke_tests_env_example.json
index d40aabe4c..70448717c 100644
--- a/backend/compact-connect/tests/smoke/smoke_tests_env_example.json
+++ b/backend/compact-connect/tests/smoke/smoke_tests_env_example.json
@@ -2,6 +2,11 @@
   "CC_TEST_API_BASE_URL": "https://api.test.compactconnect.org",
   "CC_TEST_PROVIDER_DYNAMO_TABLE_NAME": "Sandbox-PersistentStack-ProviderTable12345",
   "CC_TEST_DATA_EVENT_DYNAMO_TABLE_NAME": "Sandbox-PersistentStack-DataEventTable1234",
-  "TEST_PROVIDER_USER_ID_TOKEN": "This can be fetched by logging in as a licensee into the Compact Connect UI of your test environment and copying the value of 'id_token_licensee' from the browser's local storage.",
-  "TEST_STAFF_USER_ACCESS_TOKEN": "This can be fetched by logging in as a staff user into the Compact Connect UI of your test environment and copying the value of 'auth_token_staff' from the browser's local storage."
+  "CC_TEST_STAFF_USER_DYNAMO_TABLE_NAME": "Sandbox-PersistentStack-StaffUserTable1234",
+  "CC_TEST_COGNITO_STAFF_USER_POOL_ID": "us-east-1_12345",
+  "CC_TEST_COGNITO_STAFF_USER_POOL_CLIENT_ID": "72612345",
+  "CC_TEST_COGNITO_PROVIDER_USER_POOL_ID": "us-east-1_12345",
+  "CC_TEST_COGNITO_PROVIDER_USER_POOL_CLIENT_ID": "72612345",
+  "CC_TEST_PROVIDER_USER_USERNAME": "example@example.com",
+  "CC_TEST_PROVIDER_USER_PASSWORD": "examplePassword"
 }

From b9bdfb374199fe744a516bed08a97d3dd22ec5ee Mon Sep 17 00:00:00 2001
From: John Sandoval <jsandoval81@users.noreply.github.com>
Date: Mon, 6 Jan 2025 07:56:02 -0700
Subject: [PATCH 06/18] Frontend/hifi style (#419)

### Requirements List
- _None_

### Description List
- Swapped out the existing lo-fi app style for the hi-fi design version
-
https://www.figma.com/design/SYM0uWszsu8Sf0YfxAhIMY/JCC?node-id=1-12&p=f&t=etxgVUar50LKNAGL-0
- Also updated the green text color to be WCAG AA
- The designs as-of 12/20 aren't crystal clear on the nav menu on phone
size; but the design team and I discussed and concluded the following:
- On tablet & desktop the nav menu will always be partially expanded
(icons only)
- On tablet & desktop the nav menu will expand fully when hovered /
focused
- On phone the nav menu will not be present, but instead a fixed header
with a hamburger toggle
- On phone the nav menu will expand fully when toggled, similar to
tablet & desktop
- Note that these updates were only to layout & style - not new screen
features / updates; with the few exceptions below
    - Licensee credit card payment screen:
- Re-arranged the first / last name form fields to match the current
designs billing address section,
        - Added a mock populate for local environments
- Note that the overhaul of the Staff Licensing Data Detail page is
covered in a separate ticket #361

### Testing List
- `yarn test:unit:all` should run without errors or warnings
- `yarn serve` should run without errors or warnings
- `yarn build` should run without errors or warnings
- Code review
- Smoke test all app screens; feel free to reach out on Slack w/ initial
questions if it's easier than piling up this PR with a lot of small
threads.
- Depending on how nit any findings are, they _may_ be separate tickets
since we were just squeezing this update in between feature
enhancements.

Closes #313
Closes #405
---
 .../src/assets/icons/ico-select-arrow-alt.svg |   3 +
 .../logos/compact-connect-logo-white.svg      |   9 +
 .../Forms/InputButton/InputButton.ts          |   3 +-
 .../Forms/InputButton/InputButton.vue         |   1 +
 .../Forms/InputCheckbox/InputCheckbox.less    |  46 ++--
 .../components/Forms/InputFile/InputFile.less |   9 +
 .../Forms/InputSearch/InputSearch.less        |   8 +-
 .../HomeStateBlock/HomeStateBlock.less        |   2 +-
 .../src/components/Icons/Account/Account.less |   6 +
 .../components/Icons/Account/Account.spec.ts  |  19 ++
 .../src/components/Icons/Account/Account.ts   |  18 ++
 .../src/components/Icons/Account/Account.vue  |  36 +++
 .../Icons/CheckCircle/CheckCircle.vue         |   3 +-
 .../components/Icons/Dashboard/Dashboard.less |   6 +
 .../Icons/Dashboard/Dashboard.spec.ts         |  19 ++
 .../components/Icons/Dashboard/Dashboard.ts   |  18 ++
 .../components/Icons/Dashboard/Dashboard.vue  |  17 ++
 .../Icons/LicenseSearch/LicenseSearch.less    |   6 +
 .../Icons/LicenseSearch/LicenseSearch.spec.ts |  19 ++
 .../Icons/LicenseSearch/LicenseSearch.ts      |  18 ++
 .../Icons/LicenseSearch/LicenseSearch.vue     |  28 ++
 .../LicenseSearchAlt/LicenseSearchAlt.less    |   6 +
 .../LicenseSearchAlt/LicenseSearchAlt.spec.ts |  19 ++
 .../LicenseSearchAlt/LicenseSearchAlt.ts      |  18 ++
 .../LicenseSearchAlt/LicenseSearchAlt.vue     |  17 ++
 .../src/components/Icons/Logout/Logout.less   |   6 +
 .../components/Icons/Logout/Logout.spec.ts    |  19 ++
 webroot/src/components/Icons/Logout/Logout.ts |  18 ++
 .../src/components/Icons/Logout/Logout.vue    |  22 ++
 .../components/Icons/Purchase/Purchase.less   |   6 +
 .../Icons/Purchase/Purchase.spec.ts           |  19 ++
 .../src/components/Icons/Purchase/Purchase.ts |  18 ++
 .../components/Icons/Purchase/Purchase.vue    |  19 ++
 .../src/components/Icons/Reports/Reports.less |   6 +
 .../components/Icons/Reports/Reports.spec.ts  |  19 ++
 .../src/components/Icons/Reports/Reports.ts   |  18 ++
 .../src/components/Icons/Reports/Reports.vue  |  13 +
 .../components/Icons/Settings/Settings.less   |   6 +
 .../Icons/Settings/Settings.spec.ts           |  19 ++
 .../src/components/Icons/Settings/Settings.ts |  18 ++
 .../components/Icons/Settings/Settings.vue    |  39 +++
 .../src/components/Icons/Upload/Upload.less   |   6 +
 .../components/Icons/Upload/Upload.spec.ts    |  19 ++
 webroot/src/components/Icons/Upload/Upload.ts |  18 ++
 .../src/components/Icons/Upload/Upload.vue    |  21 ++
 webroot/src/components/Icons/Users/Users.less |   6 +
 .../src/components/Icons/Users/Users.spec.ts  |  19 ++
 webroot/src/components/Icons/Users/Users.ts   |  18 ++
 webroot/src/components/Icons/Users/Users.vue  |  24 ++
 .../Licensee/LicenseeList/LicenseeList.less   |   5 +-
 .../LicenseeList/LicenseeList.spec.ts         |   1 -
 .../Licensee/LicenseeList/LicenseeList.vue    |  40 +--
 .../Licensee/LicenseeRow/LicenseeRow.less     |   4 -
 .../LicenseeSearch/LicenseeSearch.less        |   7 +-
 .../Licensee/LicenseeSearch/LicenseeSearch.ts |   2 +-
 .../Lists/ListContainer/ListContainer.less    |   1 -
 .../Lists/Pagination/Pagination.less          |  11 +-
 .../Lists/Pagination/Pagination.vue           |   3 +-
 webroot/src/components/Modal/Modal.less       |   4 -
 .../Page/PageContainer/PageContainer.less     |  11 +-
 .../Page/PageContainer/PageContainer.spec.ts  |  27 --
 .../Page/PageContainer/PageContainer.ts       |  49 ++--
 .../Page/PageContainer/PageContainer.vue      |   7 +-
 .../Page/PageFooter/PageFooter.less           |   4 +-
 .../Page/PageHeader/PageHeader.less           |  90 ++++++-
 .../Page/PageHeader/PageHeader.spec.ts        |   7 -
 .../components/Page/PageHeader/PageHeader.ts  |  29 ++-
 .../components/Page/PageHeader/PageHeader.vue |  30 ++-
 .../Page/PageMainNav/PageMainNav.less         | 169 ++++++++----
 .../Page/PageMainNav/PageMainNav.spec.ts      |   9 +-
 .../Page/PageMainNav/PageMainNav.ts           | 138 +++++++---
 .../Page/PageMainNav/PageMainNav.vue          | 132 +++++++---
 .../PaymentProcessorConfig.ts                 |   2 +-
 .../PrivilegeCard/PrivilegeCard.less          |   2 +-
 .../SelectedStatePurchaseInformation.less     |  84 +++---
 .../SelectedStatePurchaseInformation.ts       |  29 ++-
 .../SelectedStatePurchaseInformation.vue      |  13 +-
 .../components/StateUpload/StateUpload.less   | 131 +++++-----
 .../src/components/StateUpload/StateUpload.ts |   2 +-
 .../components/StateUpload/StateUpload.vue    |  61 ++---
 .../Users/UserInvite/UserInvite.less          |   2 +-
 .../components/Users/UserInvite/UserInvite.ts |   3 +-
 .../components/Users/UserList/UserList.less   |  42 ++-
 .../src/components/Users/UserList/UserList.ts |   1 +
 .../components/Users/UserList/UserList.vue    |   2 +-
 .../src/components/Users/UserRow/UserRow.less |   7 +-
 .../Users/UserRowEdit/UserRowEdit.less        |   2 +-
 webroot/src/locales/en.json                   |  24 +-
 webroot/src/locales/es.json                   |  24 +-
 webroot/src/pages/Account/Account.less        |   6 +
 .../FinalizePrivilegePurchase.less            |  75 ++++--
 .../FinalizePrivilegePurchase.ts              | 246 +++++++++---------
 .../FinalizePrivilegePurchase.vue             |  91 ++-----
 .../LicensingDetail/LicensingDetail.spec.ts   |   6 +-
 .../pages/LicensingList/LicensingList.less    |   1 -
 .../SelectPrivileges/SelectPrivileges.less    |  11 +-
 .../SelectPrivileges/SelectPrivileges.vue     |  21 +-
 .../src/pages/StateUpload/StateUpload.less    |  14 +-
 webroot/src/pages/StateUpload/StateUpload.vue |   2 +-
 webroot/src/pages/UserList/UserList.less      |   1 -
 webroot/src/router/index.ts                   |   6 +
 webroot/src/store/global/global.actions.ts    |   6 +
 webroot/src/store/global/global.mutations.ts  |   8 +
 webroot/src/store/global/global.spec.ts       |  30 +++
 webroot/src/store/global/global.state.ts      |   2 +
 webroot/src/styles.common/_colors.less        |  16 +-
 webroot/src/styles.common/_fonts.less         |   6 +-
 webroot/src/styles.common/_inputs.less        |  12 +-
 webroot/src/styles.common/_lists.less         |  44 +++-
 webroot/src/styles.common/_sizes.less         |   7 +-
 webroot/src/styles.common/_transitions.less   |   1 +
 webroot/src/styles.common/mixins/buttons.less |   2 +
 .../src/styles.common/transitions/list.less   |  26 ++
 113 files changed, 1877 insertions(+), 724 deletions(-)
 create mode 100644 webroot/src/assets/icons/ico-select-arrow-alt.svg
 create mode 100644 webroot/src/assets/logos/compact-connect-logo-white.svg
 create mode 100644 webroot/src/components/Icons/Account/Account.less
 create mode 100644 webroot/src/components/Icons/Account/Account.spec.ts
 create mode 100644 webroot/src/components/Icons/Account/Account.ts
 create mode 100644 webroot/src/components/Icons/Account/Account.vue
 create mode 100644 webroot/src/components/Icons/Dashboard/Dashboard.less
 create mode 100644 webroot/src/components/Icons/Dashboard/Dashboard.spec.ts
 create mode 100644 webroot/src/components/Icons/Dashboard/Dashboard.ts
 create mode 100644 webroot/src/components/Icons/Dashboard/Dashboard.vue
 create mode 100644 webroot/src/components/Icons/LicenseSearch/LicenseSearch.less
 create mode 100644 webroot/src/components/Icons/LicenseSearch/LicenseSearch.spec.ts
 create mode 100644 webroot/src/components/Icons/LicenseSearch/LicenseSearch.ts
 create mode 100644 webroot/src/components/Icons/LicenseSearch/LicenseSearch.vue
 create mode 100644 webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.less
 create mode 100644 webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.spec.ts
 create mode 100644 webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.ts
 create mode 100644 webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.vue
 create mode 100644 webroot/src/components/Icons/Logout/Logout.less
 create mode 100644 webroot/src/components/Icons/Logout/Logout.spec.ts
 create mode 100644 webroot/src/components/Icons/Logout/Logout.ts
 create mode 100644 webroot/src/components/Icons/Logout/Logout.vue
 create mode 100644 webroot/src/components/Icons/Purchase/Purchase.less
 create mode 100644 webroot/src/components/Icons/Purchase/Purchase.spec.ts
 create mode 100644 webroot/src/components/Icons/Purchase/Purchase.ts
 create mode 100644 webroot/src/components/Icons/Purchase/Purchase.vue
 create mode 100644 webroot/src/components/Icons/Reports/Reports.less
 create mode 100644 webroot/src/components/Icons/Reports/Reports.spec.ts
 create mode 100644 webroot/src/components/Icons/Reports/Reports.ts
 create mode 100644 webroot/src/components/Icons/Reports/Reports.vue
 create mode 100644 webroot/src/components/Icons/Settings/Settings.less
 create mode 100644 webroot/src/components/Icons/Settings/Settings.spec.ts
 create mode 100644 webroot/src/components/Icons/Settings/Settings.ts
 create mode 100644 webroot/src/components/Icons/Settings/Settings.vue
 create mode 100644 webroot/src/components/Icons/Upload/Upload.less
 create mode 100644 webroot/src/components/Icons/Upload/Upload.spec.ts
 create mode 100644 webroot/src/components/Icons/Upload/Upload.ts
 create mode 100644 webroot/src/components/Icons/Upload/Upload.vue
 create mode 100644 webroot/src/components/Icons/Users/Users.less
 create mode 100644 webroot/src/components/Icons/Users/Users.spec.ts
 create mode 100644 webroot/src/components/Icons/Users/Users.ts
 create mode 100644 webroot/src/components/Icons/Users/Users.vue
 create mode 100644 webroot/src/styles.common/transitions/list.less

diff --git a/webroot/src/assets/icons/ico-select-arrow-alt.svg b/webroot/src/assets/icons/ico-select-arrow-alt.svg
new file mode 100644
index 000000000..8faa8c233
--- /dev/null
+++ b/webroot/src/assets/icons/ico-select-arrow-alt.svg
@@ -0,0 +1,3 @@
+<svg width="10" height="18" viewBox="0 0 10 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M5.00016 2.83L8.17016 6L9.58016 4.59L5.00016 0L0.410156 4.59L1.83016 6L5.00016 2.83ZM5.00016 15.17L1.83016 12L0.420156 13.41L5.00016 18L9.59016 13.41L8.17016 12L5.00016 15.17Z" fill="white"/>
+</svg>
diff --git a/webroot/src/assets/logos/compact-connect-logo-white.svg b/webroot/src/assets/logos/compact-connect-logo-white.svg
new file mode 100644
index 000000000..02b31cdbe
--- /dev/null
+++ b/webroot/src/assets/logos/compact-connect-logo-white.svg
@@ -0,0 +1,9 @@
+<svg width="176" height="98" viewBox="0 0 176 98" fill="none" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<rect x="0.651855" y="0.158203" width="175" height="97.2222" fill="url(#pattern0_8217_1597)"/>
+<defs>
+<pattern id="pattern0_8217_1597" patternContentUnits="objectBoundingBox" width="1" height="1">
+<use xlink:href="#image0_8217_1597" transform="scale(0.000740741 0.00133333)"/>
+</pattern>
+<image id="image0_8217_1597" width="1350" height="750" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABUYAAALuCAYAAABiqcxsAAAABGdBTUEAALGPC/xhBQAACklpQ0NQc1JHQiBJRUM2MTk2Ni0yLjEAAEiJnVN3WJP3Fj7f92UPVkLY8LGXbIEAIiOsCMgQWaIQkgBhhBASQMWFiApWFBURnEhVxILVCkidiOKgKLhnQYqIWotVXDjuH9yntX167+3t+9f7vOec5/zOec8PgBESJpHmomoAOVKFPDrYH49PSMTJvYACFUjgBCAQ5svCZwXFAADwA3l4fnSwP/wBr28AAgBw1S4kEsfh/4O6UCZXACCRAOAiEucLAZBSAMguVMgUAMgYALBTs2QKAJQAAGx5fEIiAKoNAOz0ST4FANipk9wXANiiHKkIAI0BAJkoRyQCQLsAYFWBUiwCwMIAoKxAIi4EwK4BgFm2MkcCgL0FAHaOWJAPQGAAgJlCLMwAIDgCAEMeE80DIEwDoDDSv+CpX3CFuEgBAMDLlc2XS9IzFLiV0Bp38vDg4iHiwmyxQmEXKRBmCeQinJebIxNI5wNMzgwAABr50cH+OD+Q5+bk4eZm52zv9MWi/mvwbyI+IfHf/ryMAgQAEE7P79pf5eXWA3DHAbB1v2upWwDaVgBo3/ldM9sJoFoK0Hr5i3k4/EAenqFQyDwdHAoLC+0lYqG9MOOLPv8z4W/gi372/EAe/tt68ABxmkCZrcCjg/1xYW52rlKO58sEQjFu9+cj/seFf/2OKdHiNLFcLBWK8ViJuFAiTcd5uVKRRCHJleIS6X8y8R+W/QmTdw0ArIZPwE62B7XLbMB+7gECiw5Y0nYAQH7zLYwaC5EAEGc0Mnn3AACTv/mPQCsBAM2XpOMAALzoGFyolBdMxggAAESggSqwQQcMwRSswA6cwR28wBcCYQZEQAwkwDwQQgbkgBwKoRiWQRlUwDrYBLWwAxqgEZrhELTBMTgN5+ASXIHrcBcGYBiewhi8hgkEQcgIE2EhOogRYo7YIs4IF5mOBCJhSDSSgKQg6YgUUSLFyHKkAqlCapFdSCPyLXIUOY1cQPqQ28ggMor8irxHMZSBslED1AJ1QLmoHxqKxqBz0XQ0D12AlqJr0Rq0Hj2AtqKn0UvodXQAfYqOY4DRMQ5mjNlhXIyHRWCJWBomxxZj5Vg1Vo81Yx1YN3YVG8CeYe8IJAKLgBPsCF6EEMJsgpCQR1hMWEOoJewjtBK6CFcJg4Qxwicik6hPtCV6EvnEeGI6sZBYRqwm7iEeIZ4lXicOE1+TSCQOyZLkTgohJZAySQtJa0jbSC2kU6Q+0hBpnEwm65Btyd7kCLKArCCXkbeQD5BPkvvJw+S3FDrFiOJMCaIkUqSUEko1ZT/lBKWfMkKZoKpRzame1AiqiDqfWkltoHZQL1OHqRM0dZolzZsWQ8ukLaPV0JppZ2n3aC/pdLoJ3YMeRZfQl9Jr6Afp5+mD9HcMDYYNg8dIYigZaxl7GacYtxkvmUymBdOXmchUMNcyG5lnmA+Yb1VYKvYqfBWRyhKVOpVWlX6V56pUVXNVP9V5qgtUq1UPq15WfaZGVbNQ46kJ1Bar1akdVbupNq7OUndSj1DPUV+jvl/9gvpjDbKGhUaghkijVGO3xhmNIRbGMmXxWELWclYD6yxrmE1iW7L57Ex2Bfsbdi97TFNDc6pmrGaRZp3mcc0BDsax4PA52ZxKziHODc57LQMtPy2x1mqtZq1+rTfaetq+2mLtcu0W7eva73VwnUCdLJ31Om0693UJuja6UbqFutt1z+o+02PreekJ9cr1Dund0Uf1bfSj9Rfq79bv0R83MDQINpAZbDE4Y/DMkGPoa5hpuNHwhOGoEctoupHEaKPRSaMnuCbuh2fjNXgXPmasbxxirDTeZdxrPGFiaTLbpMSkxeS+Kc2Ua5pmutG003TMzMgs3KzYrMnsjjnVnGueYb7ZvNv8jYWlRZzFSos2i8eW2pZ8ywWWTZb3rJhWPlZ5VvVW16xJ1lzrLOtt1ldsUBtXmwybOpvLtqitm63Edptt3xTiFI8p0in1U27aMez87ArsmuwG7Tn2YfYl9m32zx3MHBId1jt0O3xydHXMdmxwvOuk4TTDqcSpw+lXZxtnoXOd8zUXpkuQyxKXdpcXU22niqdun3rLleUa7rrStdP1o5u7m9yt2W3U3cw9xX2r+00umxvJXcM970H08PdY4nHM452nm6fC85DnL152Xlle+70eT7OcJp7WMG3I28Rb4L3Le2A6Pj1l+s7pAz7GPgKfep+Hvqa+It89viN+1n6Zfgf8nvs7+sv9j/i/4XnyFvFOBWABwQHlAb2BGoGzA2sDHwSZBKUHNQWNBbsGLww+FUIMCQ1ZH3KTb8AX8hv5YzPcZyya0RXKCJ0VWhv6MMwmTB7WEY6GzwjfEH5vpvlM6cy2CIjgR2yIuB9pGZkX+X0UKSoyqi7qUbRTdHF09yzWrORZ+2e9jvGPqYy5O9tqtnJ2Z6xqbFJsY+ybuIC4qriBeIf4RfGXEnQTJAntieTE2MQ9ieNzAudsmjOc5JpUlnRjruXcorkX5unOy553PFk1WZB8OIWYEpeyP+WDIEJQLxhP5aduTR0T8oSbhU9FvqKNolGxt7hKPJLmnVaV9jjdO31D+miGT0Z1xjMJT1IreZEZkrkj801WRNberM/ZcdktOZSclJyjUg1plrQr1zC3KLdPZisrkw3keeZtyhuTh8r35CP5c/PbFWyFTNGjtFKuUA4WTC+oK3hbGFt4uEi9SFrUM99m/ur5IwuCFny9kLBQuLCz2Lh4WfHgIr9FuxYji1MXdy4xXVK6ZHhp8NJ9y2jLspb9UOJYUlXyannc8o5Sg9KlpUMrglc0lamUycturvRauWMVYZVkVe9ql9VbVn8qF5VfrHCsqK74sEa45uJXTl/VfPV5bdra3kq3yu3rSOuk626s91m/r0q9akHV0IbwDa0b8Y3lG19tSt50oXpq9Y7NtM3KzQM1YTXtW8y2rNvyoTaj9nqdf13LVv2tq7e+2Sba1r/dd3vzDoMdFTve75TsvLUreFdrvUV99W7S7oLdjxpiG7q/5n7duEd3T8Wej3ulewf2Re/ranRvbNyvv7+yCW1SNo0eSDpw5ZuAb9qb7Zp3tXBaKg7CQeXBJ9+mfHvjUOihzsPcw83fmX+39QjrSHkr0jq/dawto22gPaG97+iMo50dXh1Hvrf/fu8x42N1xzWPV56gnSg98fnkgpPjp2Snnp1OPz3Umdx590z8mWtdUV29Z0PPnj8XdO5Mt1/3yfPe549d8Lxw9CL3Ytslt0utPa49R35w/eFIr1tv62X3y+1XPK509E3rO9Hv03/6asDVc9f41y5dn3m978bsG7duJt0cuCW69fh29u0XdwruTNxdeo94r/y+2v3qB/oP6n+0/rFlwG3g+GDAYM/DWQ/vDgmHnv6U/9OH4dJHzEfVI0YjjY+dHx8bDRq98mTOk+GnsqcTz8p+Vv9563Or59/94vtLz1j82PAL+YvPv655qfNy76uprzrHI8cfvM55PfGm/K3O233vuO+638e9H5ko/ED+UPPR+mPHp9BP9z7nfP78L/eE8/stRzjPAAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAJcEhZcwAALiMAAC4jAXilP3YAADjOSURBVHic7d3pjts4FgZQVZD3f2XPj7QnTpUXyRbJu5wDNKaBQSdcrkjqK7r8dblcNgAAAACATn6tbgAAAAAAwGyCUQAAAACgHcEoAAAAANCOYBQAAAAAaEcwCgAAAAC0IxgFAAAAANoRjAIAAAAA7QhGAQAAAIB2BKMAAAAAQDuCUQAAAACgHcEoAAAAANCOYBQAAAAAaEcwCgAAAAC0IxgFAAAAANoRjAIAAAAA7QhGAQAAAIB2BKMAAAAAQDuCUQAAAACgHcEoAAAAANCOYBQAAAAAaEcwCgAAAAC0IxgFAAAAANoRjAIAAAAA7QhGAQAAAIB2BKMAAAAAQDuCUQAAAACgHcEoAAAAANCOYBQAAAAAaEcwCgAAAAC0IxgFAAAAANoRjAIAAAAA7QhGAQAAAIB2BKMAAAAAQDuCUQAAAACgHcEoAAAAANCOYBQAAAAAaEcwCgAAAAC0IxgFAAAAANoRjAIAAAAA7QhGAQAAAIB2BKMAAAAAQDuCUQAAAACgHcEoAAAAANCOYBQAAAAAaEcwCgAAAAC0IxgFAAAAANoRjAIAAAAA7QhGAQAAAIB2BKMAAAAAQDuCUQAAAACgHcEoAAAAANCOYBQAAAAAaEcwCgAAAAC0IxgFAAAAANoRjAIAAAAA7QhGAQAAAIB2BKMAAAAAQDuCUQAAAACgHcEoAAAAANCOYBQAAAAAaEcwCgAAAAC0IxgFAAAAANoRjAIAAAAA7QhGAQAAAIB2BKMAAAAAQDuCUQAAAACgHcEoAAAAANCOYBQAAAAAaEcwCgAAAAC0IxgFAAAAANoRjAIAAAAA7QhGAQAAAIB2BKMAAAAAQDuCUQAAAACgHcEoAAAAANCOYBQAAAAAaEcwCgAAAAC0IxgFAAAAANoRjAIAAAAA7fxe3QDgNJfVDQBguq/VDQAAgKwEo5CH4BOA7657g4AUAAAOEoxCTEJQAI64bMJRAAA4RDAK6wlBATiDcBQAAA4QjMJ8glAARhGOAgDAToJRmEMYCsAswlEAANhBMApjCEIBAAAAAhOMwnmEoQBE4dYoAAC8IBiFzwhDAQAAABISjMJ7BKIAAAAAiQlGYT9hKAAAAEARv1Y3ABK4bEJRAPKxdwEAwBNujMJ9XiYBAAAAChOMwr8EogAAAAANCEbhD4EoANV8rW4AAABEJhilO4EoAAAAQEOCUboSiAIAAAA0JhilG4EoAAAAAIJR2hCIAtCJ3y8KAAAvCEapTiAKAAAAwA+/VjcABhKKAtCR26IAALCDG6NUJBAFoCuhKAAA7CQYpRKBKACdCUUBAOAAH6WnCqEoAJ0JRQEA4CA3RslOIApAZwJRAAB4k2CUzISiAHQiBAUAgBMJRslIIPqcF2cAAACAFwSjZCMU/UP4CQAAAPABwShZdA5EhaAAAAAAJxOMkkG3UFQQCgAAADCYYJTouoSiwlAAAACAiQSjRFU9EBWEAgAAACwkGCWiqqGoMBQAAAAgCMEo0VQLRYWhAAAAAAEJRomkUigqEAUAAAAITDBKBFUCUWEoAAAAQBKCUVarEIoKRAEAAACSEYyyUvZQVCAKAAAAkJRglFUyh6ICUQAAAIDkBKOskDUUFYgCAAAAFCEYZbaMoahAFAAAAKAYwSgzZQtFBaIAAAAARQlGmSVTKCoQBQAAACju1+oG0IJQFAAAAIBQ3BhltCyhqEAUAAAAoBHBKCNlCEUFogAAAAAN+Sg9owhFAQAAAAjLjVFGiB6KCkQBAAAAmnNjlLMJRQEAAAAIz41RzhQ5FBWIAgAAAPB/boxyFqEoAAAAAGkIRjmDUBQAAACAVHyUnk9FDUUFogAAAAA85MYonxCKAgAAAJCSYJR3CUUBAAAASEswSiVCUQAAAAB28TtGeUe026ICUQAAAAAOcWOUo4SiAAAAAKQnGOUIoSgAAAAAJQhG2UsoCgAAAEAZglEyEooCAAAA8BHBKHtEui0qFAUAAADgY4JRXhGKAgAAAFCOYJRnhKIAAAAAlCQYJQOhKAAAAACnEozySJTbokJRAAAAAE4nGOUeoSgAAAAApQlGiUooCgAAAMAwv1c3gHAi3BYVigIAANSz4n3T+yXwkBuj3BKKAgAAANCCYJRIhKIAAAAATCEY5SrCbVEAAAAAmEIwyrbFCEXdFgUAAABgGsEoEQhFAQAAAJhKMMrq26JCUQAAAACmE4yyklAUAAAAgCUEo72tvi0KAAAAAEsIRvtaHYq6LQoAAADAMoJRVhCKAgAAALCUYLSnlbdFhaIAAAAALCcYBQAAAADaEYz247YoAAAAAO39Xt0A2hCK1nU0bFcLAAAAwHKC0V5WfxM9+YyomVd/puAUAAAAGE4wygyCrhyiBOff26F+AAAAgNMJRvtYFXoJtWKLEoY+IygFAAAATicYhX4yhKHP3LZfSAoAAAC8RTDag9uiZA9DHxGSAgAAAG8RjDKKkGq9qmHoI9f+qj0AAADgJcFofd3CMcy5gBQAAAB4STDKCAKpNboHot8JSAEAAICHfq1uAEMJynq4bOb6GWMDAAAA/CAY5Wxu580l9NtHeAwAAAD8QzBalxCoNkHfe4wZAAAAsG2b3zHKudwWHU+w9zm/exQAAABwYxQSEYqey3gCAABAY4LRmlYEPm7fjSXEG8O4AgAAQFM+Sg+xCe7Gu2x9gv1R9dRl/Lo5q16q1ofx6e3M9VQNxDPy/GW+czm7Fsw/QDBfl4vcpRi3RevwcM5VrY5X10+18exgVs1krI3Zz1PGMarM2aqu1Xvllfleb2UtdJt/ayoQimC0HhtNDR7MNTLXcvSayTy2la2um8h1sXpsriKPUWVR5n/b1MCZIs3rM+Z8jqj1UH3+va8CoQhG63GrJT8P5VqZajprrWQa471mzsUZ4xexdqLURcSx2bY447NH1rNI1Lm/lakOosgwr8+Y83Nlq4cI859tzCKIMG/ATn7HaC02rfzM4XrRf+dohRq57UPksa4ocv2sfvYij822/W2fZ+Z80ef+ljrYJ9OcvmLOP5e5HpyZAAYTjPIJm/O5Mh/aqlkd0NxTtT688M2RpX5W1EOWsbnyzJwn29zfUgf3ZZ7TV8z5cdXqQQ0ADCAYhRiqHdw4T5facNgfJ2MNzfjhRMZxuRXxBzhZZJ/7W9bOWvO5hzl/rXpNqAGAEwlG68j6+7yof3jjPV3rwmH/XJnraGQtZB6XW56XY6rM+z0da6HyfO7Rcc5f6VYTagDgBL9WNwCa63aAy2L17zlUF8bhU5XG7+x+VBmXWxX7dLYuY9Shn5XWtzMYCzXRue8AHxOMwjoOMTGtCkW7H+ofMSbHVRyzs/pUcWyuKvftU93GpvJ+UrVfn+o6LpVr/ShjAfAmwWgNPkYP51gZivKYw/5+lcfpk751qaEOfTyiy7w/Uqnv3edyj25j1KmvRxgXgIMEo7CGQ0ssX5tQNANj9VyH8Xmnjx3G5Va3/j5iHP7IHpZlb/8K1cdLTbxmjAAO8OVLHOW26OeqHFTerYVo/ReI5uKLBu7rVE++jf217mPU6XnYK2NNmMf3ZZzvPdTEMVXrAOBUbozm54CQS+b5+vr2z+o/5wxC0byM4V8dx2JvnzuOzVXXvnft9x6ZxiZTW6OqNobV+jOLcQN4QTAKPDMjwFwVkgpF8zOWvb2af/XRbwy69fcd0cfIR4DPVWUsq/RjFeMH8IRglCNW3+7LLtOhZNVtzll/r1C0ju5j2r3/jxgXeCzq8xG1XdllH9fs7Y/COAI8IBgFbkX4ePu2jWuDL1mqqevYdu33rXtjYFz+1WU8uvTzLNHGK1p7iEFdnMt4AtwhGM3N5pZH9LmKEojeOrtNK/sXff4rMMZ9mfvXqo9R9f6NEmXcorSjsoxjnLHNGRhXgG8Eo+wVLTTLJPoBJPrcntE+oWgPnca6U1+PMC5wjGemj0xznamt2UQ/9wNMJxiF3rIcjj65PSoU7aXDmHfo41G+sOU140NUWc4izGGtGsezBnCHYBTGinq4i/jR+T2Otlko2pOxB9gvwpqZ8UySUYS5fiZ6+zLzjAE8IBjNa+bBwUZaS/b53NP+1cGvg/165gB+8lzwiNroI+pcR21XBdnP/gBDCUZhnIgHvCoHo2f9WN3HiPPelbkA2G/1mrl6/2ad1bVXmecK4IXfqxsATNPhYNShjwCfuGzWSuL62uKEZJ88J1H68Ih1oAdzDLCDYBTGiH4gruD7y1OEw1+mea/8wnfLy99+r8Yp07yPYoz6smbOsyocPbPft39WpvlfIeP47KmV1f1a/RwDpPF1uaxes3mD3y8aX7QHyzyOF23O7xlVB537fpVhDL77dEwy9vmoqmPkedhnxDhlGZsI54YZYzW7n5Hmv8scn+GMsZrV187rViQRni9gJzdGoT4b83jRD4yja+D650cfB/44qx4qz3v1MYpwKzCykWMTtSYiGnlzdFX9R5p/68BzZ4/NjFvEo+bz7D83+41woBhfvgTni3DYvXII6O1rm1sDs/++IyI9l6uMmp+oc/4uY9TXzDUs8nq5bXHWzBHhVIRxj9KOlaLU2D0zfqA8MngF4AA3RgE+E/Fgv/pwHOlGzK3Ot2PcGn7NGPW1cl1QF3NEXftXf9nUqn0xar3PHouznv+o9Q2QghujPGOTzc389RRp3iO1pasVt4Yz6jhGUYOJ2aLMR5R23IpSI5+MTYabmdHb18HqOvnk71c/AB8SjMK5orxEMEek+V59qH8kWpsizdloq3+HXhYr2pttjCqKuGZGa08k74xNpvHM1NZPRduHI4390bZEajtAWoLRfKIdJojJQamX6PMdMYCoznjvY5x6ijzv0dbLSOfOveMSbQz3ytjm7CKO+ZE6B+AEglGA90R5Wcx0MI7S1ihzV1mUuX5mdRtX//1dZRn3LO2c7dW4ZB+36r/vM9L+G7lWqtc5QCiCUThPlMOew1IfGec6Y5uziTLGUdpxT5S2rW5HlH1rltXjfVSU9kark0fjEmW8iC9DrdxrY9bb0AChCUZ5xKYLj0V4SfSMfibCHI6gLuA+z0Zd1cKiSn25FWXfzTS+Xw/+HYATCUahFocmMlCnY0QcV216LVp7Kso8xpnbPtLXt/+FPTLWS7XgHyAcwSjAMRFuPFQ4IFfoA/moOzKKULcR9r7vIozLKNX6FrF+AGDbNsEoQDaVXpZW96XSi9rqseQz5m+cKmNbpR/EVGk/fMQzBMBdgtFcOhxasoowNw58QERR1qYo7WAecw5sm7UAgCcEowD7rQ7AKx7sK/YJWK/i2rK6T6v3QHJSNwCEJhjlntUHb+Anz+UYFV7Y1MZrxuixCs8AwCPWfwCeEowCsJqXFvAcnKnyWFbuG/8y1wAwgWAUanB4Hm/lrSrzyyNZaiNLOwGow94DwEuCUQAiWPny4qPEUEeHIMR6SRbqBYDwBKMAQGUdgjIA/mXtB2CX36sbAMBTDvYAkJMbkwAQnGAUPufQC+f42jxPRwjN4V+dngnr5XzGGwAKEowCvOZlCADqs9+fx5dWApCCYBQgLgf7eS6b8a7InPZhruepsl4KQQEAX74EQCgVXrbhXeqfI9TLMZdv/wAAuDGaiAMcAADs4+wMALwkGAUAACoQhuImNQCHCEb5zmECAMjE2QWBKADwFsEoQExe9AHgMWEoAPAxX74EQDRCYYB9Oq6XvjwJADiNG6MAAEB0wlAA4HRujAIAAJEJRQGAIdwYBXjOyxgArGEPBgCGcmMUPtfx93sBAIwkFAUAhhOMAgAAkQhFAYApfJQeAACIQCAKAEzlxijU4EViHL8qAQDGc5YBAKYTjPKdQykAADM5fwIASwhG83BrDQCAaoSiAMAyglEAovGSDLBP9vUye/sBgOR8+RLUcdncLK7EfAJAPmfu3YJjABhMMAoAAMyWNfTzQ0sAKEQwCuf42vIe8AEgMzfs88lyZlJX+VgPADhEMAq1OAwCALzPOQoAGhGMAhBJlltEAKtlXS+jtlsgCgAN+VZ6gLiivjxW5IUYoKevzR4AAG0JRqEeYdr5vDABxGbvm+eTPTHSPEUPRCONVTbGDoDdBKNwnsiHawAA4geiVRhjAFIQjHKPn7LmZw7r6DSXnfoKnK/TGtKpr2cS1gEA/xCMAgAA1QlFe/HDAwB2EYzCuSIduh0IyWRlvUZ6bgFeybq/W+cBgHAEo7k41HFU1peniFY+f+YRYB/r5VgZz6IZ2wwATCIYBSq4bF6GAYAaqpxpVofSVcYRgIEEo3C+1YfA76ofCi8P/r0afQPYp/KaUrlvI0Q7kwEAwQhGoYdOL1Ij++oF63yra9OcQk2r15YRKvYJRvPcAPCUYJRHHCLqqTinj/pU9aP1FfsEQA5+kMQ7ItSN8xMADwlGYYwIh8B7Kh0M9/SlUn+vKvVpdV+iPqfAOVavMWeq1BeeM9cAMJFgFPqpcOA+0oez+ytMA8ijwp4HfM5aAMBdgtF8hDJ5RJ6rzIfDd9pe7aP1FfpSoQ8AM0RYLyOfaSqJMNcjRKmfquMLwAcEozzj8FBbxvn9tM1n9TnCAT/j/F1FaHuEOQTmiLDmvCtz2wEAwhOMwljRw5csL1xn3vjM0uc9MvYlY5uB/DKuPVHaHP0sU0WU+R4lSh1lHedqn36azdgBDwlGgegHrRFtO6PPDvjHRWlrlLkD5oqyBu2Rqa18znzPlW28Lw/+HYATCEZhvCwhTMSAdHR7ovX3XRn6kaGNQH0Z1qIMbeQ85nuNLON+r51Z2v5IlncjoAnBaE42E0aKcNiaGdJ+8vdEehYjzNsjkdoWac6ANSL+IPAqWruyr5nRxrO7aPUUuT4ir1NZGU/gLsEor9hAzhHtIPjKZVtzIFt1CKxy+IzWhyrjCtQUaX2yXo4TeVwjt62LiM/envZEazNAWoJR4JXRB8ZVIew977QhWuideSxHizZXwHoR1szVf/8j1sxxItTdKlHrKsJ8HK2LCG3OxpgBPwhGYZ6oB8G9Lts5IeZZf84oEdv0DrdvAfazXtYWaZwjtWWVqGfilc/ku3+vejrOmAH/+L26AaRw2eIeYLL52upsxlX6cc/Rmo88r9d2jX6Go/b/yhoGvGK9/KvimhnhPJth7sm3FkSo7WxGjJl5gKQEo3lFDmKggqOH4ujP5KhDfuQ+XzmkAkfcrmtnrh8Z1sttG7dmRtgnZwVej/5e/opQD6+MqJdRfRbKHXfG/EavYWAHwSjMl+EgyF/VDprfa+9o39Qu0Mkna6b1Mq4ZAan5r+PeXO6tnZl1kOnMGul9aO8Pw6K0FziZYJS9Mm20GUQ6DHCejPOarb1HWbeAM1kzazk7IK1eH2fLeG66itpu72yfiTqvwECCUVgn82Gwk6OHS/MahxcDgFii7pGP2vRoH4nYh6yi1kRmwlGAAwSjuTlIwFgOlXmZO4BjrJs/OWfP4Z3mfBnCUfMOhPBrdQNIxcZ1vugHls4+mRvzupbxBzhm5rppjYY5vLsB7CAYhfW8IMRzxpyYVwAysF8RgTocQzg6l/GGhASj+TlE1GAe4zhzLszrfMYcID5rNfeoizEih3XmHFhOMMpRkTfW7BwMajKv8xhrgGOsm0SjJsfwDgfwgGAUYnEYXGvU+JvX8YwxwDGr183Vfz9xqY0xooaj5htYSjAK8TgczPe1jR938zqOsQWsA8dEGa8o7Yio+9h07z8AkwhGa5h9cIj608ZKZgR1/OGbeHMzpsCV9WCfaOMUrT3EoTb6MNfAMoJRiM0hYawV42tOz+GHBwDHWTdzME9/GYvzGEuAOwSjvMut0XkcYsZYOa5Cvc8YO+AR68NjkccmcttmMxY/OTd9LsP4ZWgjUJBgtA4bSW0OhOeKMpZR2pGJMQNesU78K8sZIkMbRzMGzxmf47I8/1eZ2goUIRiFXBwWPhPxcBitPVFFnDsgLuvFH9nGIVt7z9S570cYp/2yjlXWdgNJCUZr8SVMPQiI3hN5zMzpc8YGeEf3tTVr3zvOW7f+fqpjjRyVfXyytx9IRDAKeTkw7JPp8JyprTMYD+AM3daRKmtnhT7s0aWfIxi7n6o8/9tWpx9AcIJRPuXW6FqVDj8jZB2brO0+i7oGztZlTanWz2r9uWWvO4dx/KviOFTsExDM79UN4HRfm7Cyo+uhwdz/UeEQ1XVOK8wdEFPldbXy2llx3irP1yoV62Sv6vXk/RYYSjDKGS5b/Q05i86Hwm2rWYcd5rTivAFxVVpXO62fFeat03ytUqFO9upUT53mFZhMMAo13R6UOhwgOhwMK85ph3kD4sr8ot15/cw4b53na5WMdbJH91qqOq/AQoLRmlZ83MCt0bgqBmrb1rvesh8KO88dEE+mNdX6+VeGeTNf61U5B6ulf2V4/oEkvi4Xa0lRKybWhp1LxodfjT0WfT7NHfSR/QwSbT21fu4XYe7MVw4RauUVtXTMqjk1T5CcYLS27C8mzBVxMVBP71s9n+YO+qp0/vCindus+TNf+a0+N22bOjrbqDk1T1CMj9IDV482eS8VOd0bTwdEgGNmrKXW0HHOPtuYq7pmnpse/X2cyxgDu7gxWl+lWxsAQHzOHgAApPBrdQMoSdoOAAAAQGiCUQAAAACgHcFofas+WubWKAAAAABhCUYBAAAAgHYEoz24NQoAAAAANwSjjCYcBQAAACAcwWgfq26NAgAAAEA4glFmcGsUAAAAgFAEo72svDUqHAUAAAAgDMEoAAAAANCOYLQft0YBAAAAaE8w2pNwFAAAAIDWBKMAAAAAQDuC0b7cGgUAAACgLcEoqwhHAQAAAFhGMNrbyluj2yYcBQAAAGARwSirCUcBAAAAmE4wyupbowAAAAAwnWCUbVsfjro1CgAAAMBUglGiEI4CAAAAMI1glKvVt0a3TTgKAAAAwCSCUW4JRwEAAABoQTBKRMJRAAAAAIYSjPJdhFuj2yYcBQAAAGAgwSj3RAlHAQAAAGAIwSiRuTUKAAAAwBCCUR6JcmtUOAoAAADA6QSjPCMcBQAAAKAkwShZCEcBAAAAOI1glFei3BrdNuEoAAAAACcRjLJHtHBUQAoAAADARwSj7BUpHN024SgAAAAAHxCMcoRwFAAAAIASBKNkJxwFAAAA4DDBKEdFuzW6bcJRAAAAAA4SjPIO4SgAAAAAqQlGeZdwFAAAAIC0BKN8Imo4KiAFAAAA4CnBKJ+KGI5um3AUAAAAgCcEo1QmHAUAAADgLsEoZ4h6a3TbfLQeAAAAgDsEo5wlcji6bcJRAAAAAG4IRjmTcBQAAACAFASjnC1DOCogBQAAAGhOMMoI0cPRbROOAgAAALQmGGWULOGogBQAAACgIcEoI2UIR7dNQAoAAADQjmCU0bKEo9smHAUAAABoQzDKDNnCUQEpAAAAQHGCUWbJFI5um4AUAAAAoDTBKDNlC0e3TUAKAAAAUJJglNkyhqPbJiAFAAAAKOXrcpH1sET2wssa8AIAAACwuTHKOl9b7nDRDVIAAACAxASjrJY5HN02ASkAAABASoJRIsgejm7b34BUSAoAAACQgGCUKCqEo1cCUgAAAIDgBKNEUikc3Ta3SAEAAADC+r26AfDNNRytFibe9qdaAAwAAACQjhujRFU5PHSTFAAAAGAxwSiRVQ5Hr4SkAAAAAAv4KD3RVf1o/T3f+9ghGAYAAABYQjBKFl9bj3D01r3+CksBAAAATiAYJZOO4eh3wlIAAACAEwhGyabTR+v32jMWwlMAAACAG4JRsnJ79BhjBVCPH3rFYq8FqMueC0V9XS7OcKSniAHozMvaWs4hAGyb/RhSEoxSiWIGoDMvZHM5dwCwlz0aghKMUo2CBqAzL15zOG8A8Cl7NgQgGKUqhQ1AV160xnLGAGAE+zcs4MuXqMqXMwEAAJDF9/dXQSlM4MYoHShyALrxMjWGMwUAK9jXYRDBKJ0odgA68RJ1LucIACKwv8OJfJSeTq4biBcbAAAAMrp9nxWSwocEo3QkIAUAACA7ISl8SDBKZwJSAAAAKhCSwht+rW4ABPC12TgAqMcP/s5jLAHI5LLZu2AXN0bhLzdIAQAAqMItUnjBjVH4yQ1SAAAAKnGLFO5wYxQeuw1HbSAAAABkd323dRkINjdGYS+3SAHIxr51HmMJQDVukMLmxigc5RYpAAAAVbhBSmuCUXifkBQAAIAKBKS0JBiFcwhJAQAAyE5ASitfl4sMBwbygAGwgpeZMezrAHTjTEFpglGYx8MGwAxeYMaynwPQkfMFJfkoPczzfSPxYgUAAEAGl004SkFujEIcHkYAPuWFZQ57NgCdOW9QhmAUYvOAArCXl5S57NEAdObcQQmCUcjLwwvAtnkxWc1+DEBnziGkJhiF2jzgAHV5EYnFngtAZ84lpCQYBQAAAPhJYHKMcJR0fCs9AAAAwE97gj7h6V/XsRCQkoZgFAAAAOA990LA7mHpZROOkoRgFAAAAOA8wlLhKEkIRgEAAADG+h4SdghKfbSe8H6tbgAAAABAM183/1TXIQQmKcEoAAAAwDodQlLhKCH5KD0AAABADLfhaLUw0UfrCceNUQAAAIB4qt4krRb4kphgFAAAACC2agGpcJQQBKMAAAAAOVS6RSocZTnBKAAAAEA+FQJS4ShLCUYBAAAA8soekF42ASmLCEYBAAAA8qsQkMJUglEAAACAOjIHpMJRphKMAgAAANSTNSAVjjKNYBQAAACgrowBqXCUKQSjAAAAAPVlC0iFowwnGAUAAADoQzgK/xGMAgAAAPSS6faocJRhBKMAAAAAPWUJSIWjDCEYBQAAAOhNOEpLglEAAAAAMtweFY5yKsEoAAAAAFfCUdoQjAIAAABwSzhKC4JRAAAAAL6L/tF64SgfE4wCAAAA8EjkcBQ+IhgFAAAA4Jmo4ahbo3xEMAoAAADAK1E/Wi8c5W2CUQAAAAD2Eo5ShmAUAAAAgCOEo5QgGAUAAADgKOEo6QlGAQAAAHhHxHAUdhOMAgAAAPCuaOGoW6PsJhgFAAAA4BPCUVISjAIAAADwqa8tVkAqHOUlwSgAAAAAZxGOkoZgFAAAAIAzRQpH4SHBKAAAAABnixKOujXKQ4JRAAAAAEYQjhKaYBQAAACAUaKEo/CDYBQAAACA6twa5QfBKAAAAAAjRbk1KhzlH4JRAAAAAEaLEo7C/wlGAQAAAJghQjjq1ij/JxgFAAAAYBbhKGEIRgEAAACYKUI4CoJRAAAAAKZbHY66NYpgFAAAAICWhKPNCUYBAAAAWGH1rVGa+726AQAAAEBKkW/bCdzy+NrW1tJlUy9tuTEKAAAAwEqCSZYQjAIAAACw2spwNPLtZwYSjAIAAAAA7QhGAQAAAIjArVGmEowCAAAAEIVwlGkEowAAAABAO4JRAAAAACJxa5QpBKMAAAAARLMyHKUJwSgAAAAA/OXWaBOCUQAAAAAicmuUoX6vbgBQxtGfqNngAAAAeOVrW3OD87J5by1PMArsMWITevVn2oAAAACAYQSjwHdRfpfKvXYISwEAAPpxa5QhBKPAtsUJQ1/53k4bFAAAAPAWwSj0lCUIfeW2H0JSAACAulbdGqUw30oPvVy2uhvJZavdPwAAgO5WXIjxjlmYG6NQX8dF/Npnt0gBAACAu9wYhbrcnnSLFAAAoBq3RjmNG6NQjwX7PrdIAQAAgP9zYxTqcDNyH+MEAACQm1ujnMKNUcjP4vweN0gBAACgMTdGIS83H89hDAEAAPJxyYWPCUYhJ2HeuYTMAAAAvOK9sRjBKOQiwBvL2AIAAOTh1igfEYxCHkK7OYTPAAAA0IAvX4IcBHXzXTY/fTziXo0aPwCieHSWslfxnTMN5PO1zX1n9q5YiGAUYhOIrtV9w/u0/o78953Hmf0+rUl11o+aqW/GXqUO8pt1plErAMl8XS5yFwjKwxlHl0NutJrrMu48NqMm1Vktaqa2SPuUOogrUp1sW/1aiTbet6qPPf9aUYtqrADBKMTkwYyn4qaXrc4qzgE/raxLNZaTmqktw16lDtbLUCdX1eol8thXG2tem12PaqwAwSjE46GMqcqmV6W+qszHEVHn7oy5iNi3CjUWcVy37byxjda/CjUTRbS5PUIdzJO5Tq5W1kuF8YvEsx+DYJTD/I5RiMUBJabsG17Furr2KfvcdBe5NtVYTGqmrshze8RtP9TC+arUyZV6gXP5EiYOE4xCHNUOelVk3ug61JQXipwy1aYDbxxZ6kZAekyWeX2HWjhP5Tq5Ui8ACwhGIYYOhz3m6FxLXijiy1qfamutzHWjZh7LOq/vsIa8p1ON3FIvABP9Wt0AoO2hL4NsB1K19MdlMxYRVZiTCn3IpMKzXKEPZ+s8Jl37fVTnGrllHOA92d7hWEwwCms57MSVaUN1cL7PuMRRaR7U1RzVxrhaf97h2fnDODxnbH5SMxCb5zM5wSisYwGNK0so6qC8jzFap3KNVu1XBFXHtmq/9ujc90cqr4/vMB6vGR+AAQSjAP/KFIqynxeu+TqMd4c+zlZ9TKv37ztr72vdx0eNHGO8YJ8s73QEIBiFNRxoYsqwgToQf8bYzdFpnDv1dbQuY6mffNd1rLr2+wzGDmLxTCYmGIX5LJoxZQlF+ZxweayOY9uxz2frNoaV+2uNfU+3MevW3xE8awAnEIzCXA4vvMPBdwxjer7OY9q575/qOnYV+12xTzN12O879HE24wn3Zbj4QgCCUYDYm6bD7ljG9zzG0hi8o/uYVep/pb6sVnUsq/YrAmML8CbBKMzjwBKTUBTjDGt49v6oMA4V+hBNtTGt1h+A76xzSQlGYQ6LZExCUa6M92eM31/GYh/jVIe5HKfK2FbpB5BP5Pc9ghCMAl1F3iS9QKxh3N9j3H4yJhyVtWaytjuT7GOcvf1ZRD7XAoQmGIXxHAjjiXx4VC9rGX8Yz3N2X7ZxydZe5lMjc0Q+1wKEJxgFuol8ePQCEYN54AzqiMrU91wZxztjmzOKfK6FKDwnPPV7dQOguE6Hwnc3nJljFHlT7FQrGVy22PVCDuqIozLUjP1qjQy1caVGgK4yrdX8RzAK41Q/FJ614N/+OdXH7JGu/Y7OwQbgX/artTLsS2pknui1AJCCj9IDR31t4w5iX9u4Pz/q4dELRGzmB5gt6roTtV3EoUbmiXquBUhHMArsNTIQHf33OTzyCS96fEL9AGeKuqZEbVdFzrUAJxKMwhjVDocrD2CfBqSRD4/V6gSAc0TbH6K1pzvz0Vfkcy1E5tnhIcEo8MzsW6LPvNOWKG2/x0tNLuaLT6gfMlO/vKJG5oh8rgX+siYmIxiF81VZCKMevva2K2r7yavKsw3kYM3hmSj1EaUd1TnXAgziW+mBe6Ifvr625wfx6O33EgFABtn3q6PngWz9zfAt9QAQmhujcK5sB+p7shyws7Tzuwo10pn5411qh2yy1uzX9v6vAvraPvvvu8laI9moRTiHZ4m7BKPArWybxb32ZusD+XgRBIhlVJiZISBdtSfZC+eIXn8A6QlGgausB6+vB/8ekZcIAI4Qej03K7jMEJBSj5oDmEAwCufJ8hJxT/aDlxcWZsv8vLOOuoHzrNj3o541Zq8t1rLxotYaQDm+fAlw8Jqj8kvEqxqq3HfOd60ndcNet2uQuvlc9DFcfW559QWQ1LFqbVld48DnfDleIoJRAI5498ssblV5oXTg+dyz8bv3/1WpHd736plTN7VFWXM7h6MV+72nrmatLTNr/Ky/K3JNRFkzgMAEo9Cbw8IckQ+Me51ZK24E8m49qZ2+PlmDstfNzB/CRB6jaGeWaOGoH9Yd9+l4nX2j1PwBLCAYhXNEOhjv5fDFHiPrJHtYsW1eRI86a6wq1A77nP1DGTWTk3U2hirPz4h6si9BDs4C/ODLlwDGyrrxzvxCK1+e1cPIF9FMsq4JK6iZuaLWZuQ5i9a2qHMYxYzzxrt/R7RaAmhDMAo9OXzxzKr6yFqXXkSfG/0imrVueE7NsG055ipDG5k/T0f2PjUEsJBgFGCcjIHZ6sO526O1zLx1TB0z5lPNwDEZzzTbtv5c8c4XxgEwkWAUPpftoOgAxj2rXxy+i9QWYJ6M38hcQcSzTKb5idTWiHO5SpR5edSOKO0DaE0wCkDUg3nUdt3jRfSnFR9bJDdzCDFl3OOirSff2xOtfQBtCUYBxsj4EhGRF4eczBtZZKnVbntKlnkhpqj18/XtfwEIQDAKvTiI8V2GmsjQRmJQK3mZu3W6ha6jqGH2UCcAwQhGAfpyOD+XcOEPdQV8whryuc77kfoB4BDBKEBP2V4csrUX2G/1873674fIMoWsnmUADhOMApwv00tEJl544oswRxHaAFnYrwBgDHtsEoJR+EymxU5YwJVaAKKwHgFnsJYAe1kv+IdgFIBMHGSAEawtMZgHAGCq36sbAMBUXjrHumx9x7hrv4HzZPokTnRn7EdZ5sP+A8Db3BgFAGAFYQYAAEsJRgHOleV2RWbCFF5RI/Ca/YoKrPcAfEQwCtCHlwcAAAD4j2AUgIyEvLGYDwAAIB3BKPQgtAAAoBLnWwA+JhgFAAAAANoRjEIPvmABtyrm8bwBAAAkIBgFAACo55Mf1PkhH1CV9Y1/CEYByMotWADoyRkAgFMIRgEAAADgPH6Ak4RgFAAAAABoRzAKAAAAALQjGAUAAAAA2hGMwmf83hAAAACAhASj0MdldQMAAAAAohCMAgAAAADtCEYBAAAAgHYEo9CLj9NTiXoGAADgbYJRAAAAbkX/glE/HAXgFIJRgB68QMwT/WUSAAA68k7ED4JR6MdmAAAAALQnGIXPuR0GAAAAbJuMIBXBKPTk1ijZqWEA6M1ZAICPCUYB+vACAQAAAP/5vboBwDKXzRX/Eb42ASQAvMO5BACYyo1ROEfWg7wAr58Kc16hDwD8ZH3nKDUD7GW94C7BKACcJ+sPSYB+rFe8okYAKE8wCvjJWT+Z5zxz2wGA8zkbAPA2wSiwbTUOlBX6AADd2c8ByMxt+2QEo3Ce7Atg5heRy7f/XS1DLUQZqyMythkAGM8ZAYC3CEaBWxkPld/bnLEPvJZhXjME4gAZZFjzAcjDvsJDglHgu0ybxqO2ZurDSsYJoDc/0OGVTDXiXAPAYYJROFemw+MzGQ6Wr9q4ug9ZamH1OO2RoY0AnMvazzvUDQCHCEaBRyIfLCO3LaPI4xm5bQDwzOXmH+aJPt7R2wfQimAUzpflpuAe0Q7zR9sTqe3RRRyriG16pNJzD/QSef3KtA98d+93oGftT+QaeSTqWEf7wtDqjDPbNrcOMq6X7QlGgT0iHCrebcPKtmfbGCPM81WktgCwTsb94FmbM/Ynq2hj7QtDAQISjMIY2QKxPVbddDjj73Xw3C/CWEVowxEVn3eASDLtC3vamvn2aDZRxtkXhgIEJRgFjprx+7JG/B0OnvutGisvigBrZPgBT4b94WgbM/TpKkONPLJynPecbTLVwT3RayP7+AKDCUZhnOiHhDOcFWBetnmB62xZ62B2SOnQCsArkfeKT37lT+R+VbFinM0rrOf3i/LS79UNAMpw+KvpOq+jNvrsdeMABDDX6H3pqLP2sWj9qirqueaymfuRjC/wkBujMJYNOB63Rt8z4lcbZA9FASrJtldF2ENGtCFCvx7JViPPRDzXRJ77CowvcJcbo0BHfmr8vu+Hyr3jWPEwqoYA1lp1y3L0nub26DzRzjXOqGMZ314qvn8wgGAUxvvaLMoRzT4YVa2Din0C6CrrXjUrSFzxOyqjhThZa2SvCH2LOO+VnLFe3NaJuWLb1EFqglGgMwdP3qVuAOIZEVasDsrcHu3JGXW8e8/214v/HyhIMApzVP/pOvuoAwCiq7JXvQo99v43UUQKSKvUCHynruswl+wmGIV5HCJj8hN5jlIvADlVOIdFObc4144XZa73UA9AWr6VHmDuQS7LAZf7zB/QgbUutrO/UZ24zDPEZ89MTjAKc1k04xKOAsBf9qr4VodmamSO1fPMc+YnHnPCIYJRmM8hMi6bKM94dgGIxu3RHswxwCCCUVhDwIIayMV8AR1Z+/JYFZypESCS2WuhNbAAwSjAv3ykHgD+slfxihqZI/qtUXUApCQYhXUcHuISjnLLHAHAc/bKOaKHowDpCEZhLYfIuBw82TbPKMC2WQszMEd9OKPCfT5Gz1sEo7CeBTWuWZurGojJvAD8ZU2MK8rcRGlHB1HDUTUApCMYhRgcIlADsZgPgJ+sjfFEm5No7aksajgKK3geeJtgFOJwkIzJ7xvtxzwAPGaNjCPqXERtF3OYfzpQ54UIRiEWC2xMwtE+jD/Aa9bK9aLPQfT2VeGWHHgO+JBgFOJxkEQNrGHcAfazZq6TZeyztDO7iKGQuQfSEIxCTA4TsayYDzUwl/EGOM7aOV+2Mc/W3qwihqMww4rat64VIxiFuL42i24EK+fA/M9hnAHeZw2dJ+tYZ203nzHvQAqCUYjPoWKdCGMfoQ2VGV+Az1lLx8s+xtnbz3vMOyO5LcopBKOQgwV4vkhj7vbwGMYU4DzW1HGqjG2VfkRkbAHeJBiFPIRjc0Qe56jtyibyHANkZn09X7XxVCPniz6e0dtHTn6vLqcRjEI+DhfjZBjbDG2MzPgBjGetPUflcazct5myjGOWdsIz6rio36sbALzluij7Sdk5sm1y5v+4bHMMkN3XZp96V5c9y3nmfRlrxJrAWdQRp3JjFHLzcaTPZR6/zG2fyTgBrOGcclzH8erY509kHq/Mbac3tVuYG6NQg5+4H1dlczP3j1WZY4Ds7FWvdd+z1MhrVWrEzVE+oXY4nWAUanGofK3KofI7c/9X1TkGyM5e9ZM9619q5KeKNWKeyaTiM8gNwSjU5LDxU5cNrfPcd5ljgOw671VX9qzn1EiPGnF7lCPUCkMIRqE2h8oeh8p7Os191zkGyK7TXnVlzzpGjdTXcY45blV9dHseWxKMQg+3C3qHQ4cN7K/Kc2+eAWroEIzYsz5T+Txz1b1GOqwDQEBfl4t1BxqrtAB0P0wekXnezTNAD5n3qit71lhqpL7Ic2zu5nFblKEEo8BVtsXARnWe6HNvrgF6i75P3bJnrZOhTtTH+1bPr7lbY+W8m/MmBKPAM5EWCBvTPKvn3VwD8MrqvWrb7FfRqZH6Rs2xeYvDbVGGE4wC7xi5cNiEYhox5+YagDMJSdjDmQZycFuUKQSjAAAAAEQhFGWaX6sbAAAAAAAwm2AUAAAAgAjcFmUqwSgAAAAAq/ldj0wnGAUAAABgpdWhqNuiTQlGAQAAAOhKKNqYYBQAAACAVVbfFqUxwSgAAAAAK6wORd0WbU4wCgAAAMBsq0NREIwCAAAAMFWEUNRtUQSjAAAAALQiFGXbNsEoAAAAAPNEuC0K27YJRgEAAACYI0Io6rYo/ycYBQAAAGA0oSjhCEYBAAAAGClCKAo/CEYBAAAAGCVKKOq2KD8IRgEAAAAYQShKaIJRAAAAAM4WJRSFhwSjAAAAAJwpUijqtigPCUYBAAAAOItQlDQEowAAAACcQShKKoJRAAAAAD4VKRSFXQSjAAAAAHwiWijqtii7CEYBAAAAeJdQlLQEowAAAAC8QyhKar9XNwAAAACAVKIFotsmFOUNbowCAAAAsFfEUBTeIhgFAAAAYI+ooajborxFMAoAAADAK0JRyvE7RgEAAAB4JGogum1CUT7kxigAAAAA9whFKU0wCgAAAMB3QlHK81F6AAAAAK4iB6LbJhTlRG6MAgAAALBtQlGacWMUAAAAoLfogei2CUUZwI1RAAAAgL6EorTlxigAAABAPxkC0W0TijKQYBQAAACgjyyB6LYJRRnMR+kBAAAAehCKwg03RgEAAABqyxSIbptQlEkEowAAAAA1ZQtEt00oykSCUQAAAIBaMgai2yYUZTLBKAAAAEANWQPRbROKsoBgFAAAACC3zIHotglFWUQwCgAAAJBT9kB024SiLCQYBQAAAMilQiC6bUJRFhOMAgAAAMRXJQzdNoEoQQhGAQAAAOKqFIhum1CUQASjAAAAALFUC0OvhKKEIhgFAAAAWK9qGHolFCUcwSgAAADAfNWD0CuBKGEJRgEAAADm6BKGXglFCU0wCgAAADBGtyD0llCU8ASjAAAAAJ/rHILeEoiShmAUAAAAYB/h53NCUVIRjAIAwPm8OAPQiUCUlASjAADwGSEoAJ0JRUlLMAoAAO8RiALQmUCU9H6tbgAAACQkFAWgM6EoJbgxCgAAxwhFAehKIEopglEAANhPKApARwJRSvJRegAA2EcoCkBHQlHKcmMUAAAAgO8EopQnGAUAgNfcFgWgC4EobQhGAQAAABCI0o5gFAAAAKAvgShtCUYBAAAA+hGI0p5gFAAAnvP7RQGoRCAK/xGMAgAAANQnEIVvBKMAAAAANQlD4YlfqxsAAADBeakEIJuvzf4FL7kxCgAAAJCfIBQOEowCAAAA5CUQhTcJRgEAAAByEYbCCQSjAADw2te2bZfVjQCgNWEonEwwCgAAABCPIBQGE4wCAMA+bo0CMJowFCYSjAIAwH7CUQDOJAiFhQSjAABwjHAUgHcIQSEYwSgAABwnHAXgGSEoJCAYBQCA91xfegWkAP0IPqEAwSgAAHzGyzEAQEK/VjcAAAAAAGA2wSgAAAAA0I5gFAAAAABoRzAKAAAAALQjGAUAAAAA2hGMAgAAAADtCEYBAAAAgHYEowAAAABAO4JRAAAAAKAdwSgAAAAA0I5gFAAAAABoRzAKAAAAALQjGAUAAAAA2hGMAgAAAADtCEYBAAAAgHYEowAAAABAO4JRAAAAAKAdwSgAAAAA0I5gFAAAAABoRzAKAAAAALQjGAUAAAAA2hGMAgAAAADtCEYBAAAAgHYEowAAAABAO4JRAAAAAKAdwSgAAAAA0I5gFAAAAABoRzAKAAAAALQjGAUAAAAA2hGMAgAAAADtCEYBAAAAgHYEowAAAABAO4JRAAAAAKAdwSgAAAAA0I5gFAAAAABoRzAKAAAAALQjGAUAAAAA2hGMAgAAAADtCEYBAAAAgHYEowAAAABAO4JRAAAAAKAdwSgAAAAA0I5gFAAAAABoRzAKAAAAALQjGAUAAAAA2hGMAgAAAADtCEYBAAAAgHYEowAAAABAO4JRAAAAAKAdwSgAAAAA0I5gFAAAAABoRzAKAAAAALQjGAUAAAAA2hGMAgAAAADtCEYBAAAAgHYEowAAAABAO4JRAAAAAKAdwSgAAAAA0I5gFAAAAABoRzAKAAAAALQjGAUAAAAA2hGMAgAAAADtCEYBAAAAgHYEowAAAABAO4JRAAAAAKAdwSgAAAAA0I5gFAAAAABoRzAKAAAAALQjGAUAAAAA2hGMAgAAAADtCEYBAAAAgHYEowAAAABAO4JRAAAAAKAdwSgAAAAA0I5gFAAAAABoRzAKAAAAALQjGAUAAAAA2hGMAgAAAADtCEYBAAAAgHb+B8L3gAm9MfRGAAAAAElFTkSuQmCC"/>
+</defs>
+</svg>
diff --git a/webroot/src/components/Forms/InputButton/InputButton.ts b/webroot/src/components/Forms/InputButton/InputButton.ts
index 46f2e3ca3..2a417a000 100644
--- a/webroot/src/components/Forms/InputButton/InputButton.ts
+++ b/webroot/src/components/Forms/InputButton/InputButton.ts
@@ -17,8 +17,9 @@ import {
 })
 class InputButton extends Vue {
     @Prop({ required: true }) private label!: string;
-    @Prop({ default: true }) private isEnabled?: boolean;
     @Prop({ required: true }) private onClick?: () => void;
+    @Prop({ default: '' }) private id?: string;
+    @Prop({ default: true }) private isEnabled?: boolean;
     @Prop({ default: false }) private shouldTransformText?: boolean;
     @Prop({ default: false }) private shouldHideMargin?: boolean;
     @Prop({ default: false }) private isTransparent?: boolean;
diff --git a/webroot/src/components/Forms/InputButton/InputButton.vue b/webroot/src/components/Forms/InputButton/InputButton.vue
index 89905eb9b..db8194924 100644
--- a/webroot/src/components/Forms/InputButton/InputButton.vue
+++ b/webroot/src/components/Forms/InputButton/InputButton.vue
@@ -9,6 +9,7 @@
     <div class="input-container input-button-container" :class="{ 'no-margin': shouldHideMargin }">
         <input
             type="button"
+            :id="id"
             class="input-button"
             :class="{
                 'no-text-transform': !shouldTransformText,
diff --git a/webroot/src/components/Forms/InputCheckbox/InputCheckbox.less b/webroot/src/components/Forms/InputCheckbox/InputCheckbox.less
index b6b1e195a..5cbfc783e 100644
--- a/webroot/src/components/Forms/InputCheckbox/InputCheckbox.less
+++ b/webroot/src/components/Forms/InputCheckbox/InputCheckbox.less
@@ -6,11 +6,11 @@
 //
 
 div.checkbox-container {
-    @checkboxBGColor: @white;
+    @checkboxBGColor: transparent;
     @checkboxFontColor: @white;
-    @checkboxBorderColor: @darkGrey;
-    @checkboxBorderWidth: 1px;
-    @checkboxBorderRadius: 2px;
+    @checkboxBorderColor: @fontColor;
+    @checkboxBorderWidth: @inputBorderWidth;
+    @checkboxBorderRadius: 4px;
     @checkboxActiveBorderColor: @primaryColor;
     @checkboxSize: 20px;
     @checkboxFontSize: @checkboxSize - 2px;
@@ -37,6 +37,7 @@ div.checkbox-container {
         width: @checkboxSize;
         height: @checkboxSize;
         margin: 0;
+        padding: 0;
         cursor: pointer;
         opacity: 0;
 
@@ -46,6 +47,7 @@ div.checkbox-container {
             top: 0;
             left: 0;
             display: inline-block;
+            height: @checkboxSize;
             margin: 0;
             padding: 0;
 
@@ -69,28 +71,42 @@ div.checkbox-container {
             color: transparent;
             font-style: normal;
             background-color: @checkboxBGColor;
-            content: "\002E";
+            content: " ";
         }
 
         // Checked replacement
-        &:checked + .checkbox-replacement::before {
-            border: solid @checkboxBorderWidth @checkboxBorderColor;
-            border-radius: @checkboxBorderRadius;
-            color: @checkboxFontColor;
-            font-style: normal;
-            background-color: @primaryColor;
-            content: " \2713";
+        &:checked + .checkbox-replacement {
+            &::before {
+                border: solid @checkboxBorderWidth @checkboxBorderColor;
+                border-radius: @checkboxBorderRadius;
+                color: @checkboxFontColor;
+                font-style: normal;
+                background-color: @checkboxBGColor;
+                content: " ";
+            }
+
+            &::after {
+                position: absolute;
+                top: 50%;
+                left: 50%;
+                width: 70%;
+                height: 70%;
+                border-radius: 2px;
+                background-color: @checkboxBorderColor;
+                transform: translate(-50%, -50%);
+                content: " ";
+            }
         }
 
         // Active focus replacement
         &:focus + .checkbox-replacement::before {
-            width: @checkboxSize + 2px;
-            height: @checkboxSize + 2px;
+            width: @checkboxSize;
+            height: @checkboxSize;
             border: @checkboxBorderWidth + 1px solid @checkboxActiveBorderColor;
         }
     }
 
-    label {
+    .input-label {
         cursor: pointer;
     }
 }
diff --git a/webroot/src/components/Forms/InputFile/InputFile.less b/webroot/src/components/Forms/InputFile/InputFile.less
index eaa19b141..544319d59 100644
--- a/webroot/src/components/Forms/InputFile/InputFile.less
+++ b/webroot/src/components/Forms/InputFile/InputFile.less
@@ -68,6 +68,15 @@
                 height: auto;
                 fill: @white;
             }
+
+            &.transparent {
+                border-color: @black;
+                color: @black;
+
+                .icon {
+                    fill: @black;
+                }
+            }
         }
 
         .selected-files {
diff --git a/webroot/src/components/Forms/InputSearch/InputSearch.less b/webroot/src/components/Forms/InputSearch/InputSearch.less
index cc0d13a59..da371f64b 100644
--- a/webroot/src/components/Forms/InputSearch/InputSearch.less
+++ b/webroot/src/components/Forms/InputSearch/InputSearch.less
@@ -26,12 +26,12 @@
         }
 
         input {
-            width: 100%;
+            width: 320px;
             height: 4.8rem;
             padding-left: 4.2rem;
-            border: 0;
-            border-radius: 8px;
-            background-color: @veryLightGrey;
+            border-color: @fontColor;
+            border-radius: 14px;
+            background-color: transparent;
         }
     }
 }
diff --git a/webroot/src/components/HomeStateBlock/HomeStateBlock.less b/webroot/src/components/HomeStateBlock/HomeStateBlock.less
index a1f76b9e7..43413ab8f 100644
--- a/webroot/src/components/HomeStateBlock/HomeStateBlock.less
+++ b/webroot/src/components/HomeStateBlock/HomeStateBlock.less
@@ -14,7 +14,7 @@
     padding: 2rem;
     border-radius: 2rem;
     color: #fff;
-    background-color: @darkBlue;
+    background-color: @primaryColor;
 
     .home-state-img-container {
         width: 4rem;
diff --git a/webroot/src/components/Icons/Account/Account.less b/webroot/src/components/Icons/Account/Account.less
new file mode 100644
index 000000000..2e901e5e8
--- /dev/null
+++ b/webroot/src/components/Icons/Account/Account.less
@@ -0,0 +1,6 @@
+//
+//  Account.less
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
diff --git a/webroot/src/components/Icons/Account/Account.spec.ts b/webroot/src/components/Icons/Account/Account.spec.ts
new file mode 100644
index 000000000..5a2a5c73f
--- /dev/null
+++ b/webroot/src/components/Icons/Account/Account.spec.ts
@@ -0,0 +1,19 @@
+//
+//  Account.spec.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { expect } from 'chai';
+import { mountShallow } from '@tests/helpers/setup';
+import Account from '@components/Icons/Account/Account.vue';
+
+describe('Account component', async () => {
+    it('should mount the component', async () => {
+        const wrapper = await mountShallow(Account);
+
+        expect(wrapper.exists()).to.equal(true);
+        expect(wrapper.findComponent(Account).exists()).to.equal(true);
+    });
+});
diff --git a/webroot/src/components/Icons/Account/Account.ts b/webroot/src/components/Icons/Account/Account.ts
new file mode 100644
index 000000000..fa5e8b3fc
--- /dev/null
+++ b/webroot/src/components/Icons/Account/Account.ts
@@ -0,0 +1,18 @@
+//
+//  Account.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { Component, Vue, toNative } from 'vue-facing-decorator';
+
+@Component({
+    name: 'Account',
+})
+class Account extends Vue {
+}
+
+export default toNative(Account);
+
+// export default Account;
diff --git a/webroot/src/components/Icons/Account/Account.vue b/webroot/src/components/Icons/Account/Account.vue
new file mode 100644
index 000000000..baa8f39f5
--- /dev/null
+++ b/webroot/src/components/Icons/Account/Account.vue
@@ -0,0 +1,36 @@
+<!--
+    Account.vue
+    CompactConnect
+
+    Created by InspiringApps on 12/16/2024.
+-->
+
+<template>
+    <svg class="icon account-icon fill-type" viewBox="0 0 28 28" fill="none">
+        <path d="M2.92676 13.9601C2.92676 7.84444 7.88448 2.88672 14.0001 2.88672C20.1158 2.88672 25.0735 7.84444
+            25.0735 13.9601C25.0735 16.9945 23.853 19.7438 21.8761 21.744C21.8718 21.6162 21.8667 21.4915 21.8604
+            21.3705C21.8258 20.7018 21.7542 19.9951 21.5406 19.4795C21.0658 18.3332 20.1551 17.4225 19.0088
+            16.9477C18.5287 16.7488 18.0239 16.6674 17.4601 16.6289C16.9129 16.5916 16.2417 16.5916 15.4147
+            16.5916H15.3795H12.6209H12.5857C11.7586 16.5916 11.0874 16.5916 10.5403 16.6289C9.97642 16.6674 9.47167
+            16.7488 8.99154 16.9477C7.84526 17.4225 6.93455 18.3332 6.45974 19.4795C6.24617 19.9951 6.17461 20.7018
+            6.13998 21.3705C6.13372 21.4915 6.12853 21.6162 6.12424 21.7441C4.14731 19.7439 2.92676 16.9946 2.92676
+            13.9601ZM8.10383 23.3348C9.81112 24.4109 11.8329 25.0335 14.0001 25.0335C16.1674 25.0335 18.1892 24.4109
+            19.8966 23.3348C19.8957 22.6398 19.8909 22.0109 19.8631 21.474C19.8277 20.7909 19.7593 20.4052 19.6929
+            20.2448C19.421 19.5886 18.8997 19.0673 18.2435 18.7954C18.0476 18.7143 17.786 18.6558 17.3239
+            18.6243C16.8529 18.5921 16.2501 18.5916 15.3795 18.5916H12.6209C11.7503 18.5916 11.1474 18.5921 10.6764
+            18.6243C10.2144 18.6558 9.95272 18.7143 9.75691 18.7954C9.10069 19.0673 8.57932 19.5886 8.3075
+            20.2448C8.24109 20.4052 8.17267 20.7909 8.13731 21.474C8.1095 22.0109 8.10467 22.6399 8.10383
+            23.3348ZM14.0001 0.886719C6.77991 0.886719 0.926758 6.73987 0.926758 13.9601C0.926758 21.1803 6.77991
+            27.0335 14.0001 27.0335C21.2204 27.0335 27.0735 21.1803 27.0735 13.9601C27.0735 6.73987 21.2204 0.886719
+            14.0001 0.886719ZM11.322 10.2353C11.322 8.75617 12.5211 7.55712 14.0002 7.55712C15.4793 7.55712 16.6783
+            8.75617 16.6783 10.2353C16.6783 11.7144 15.4793 12.9134 14.0002 12.9134C12.5211 12.9134 11.322 11.7144
+            11.322 10.2353ZM14.0002 5.55712C11.4165 5.55712 9.32203 7.6516 9.32203 10.2353C9.32203 12.8189 11.4165
+            14.9134 14.0002 14.9134C16.5839 14.9134 18.6783 12.8189 18.6783 10.2353C18.6783 7.6516 16.5839 5.55712
+            14.0002 5.55712Z"
+        />
+    </svg>
+
+</template>
+
+<script lang="ts" src="./Account.ts"></script>
+<style scoped lang="less" src="./Account.less"></style>
diff --git a/webroot/src/components/Icons/CheckCircle/CheckCircle.vue b/webroot/src/components/Icons/CheckCircle/CheckCircle.vue
index 70a1eed76..bb90c8f33 100644
--- a/webroot/src/components/Icons/CheckCircle/CheckCircle.vue
+++ b/webroot/src/components/Icons/CheckCircle/CheckCircle.vue
@@ -8,7 +8,8 @@
 <template>
     <svg version="1.1" class="icon icon-check-circle" x="0px" y="0px"
         viewBox="0 0 512 512" xml:space="preserve">
-        <path fill="#000" d="M256,0C114.7,0,0,114.7,0,256s114.7,256,256,256s256-114.7,256-256S397.3,0,256,0z M256,
+        <path fill="transparent"
+            d="M256,0C114.7,0,0,114.7,0,256s114.7,256,256,256s256-114.7,256-256S397.3,0,256,0z M256,
             481C131.7, 481,31,380.3,31,256 S131.7,31,256,31s225,100.7,225,225S380.3,481,256,481z"
         />
         <path d="M412.5,145.3c-9.8-9.8-25.6-9.8-35.4,0L197.5,324.9l-58.5-58.5c-9.8-9.8-25.6-9.8-35.4,
diff --git a/webroot/src/components/Icons/Dashboard/Dashboard.less b/webroot/src/components/Icons/Dashboard/Dashboard.less
new file mode 100644
index 000000000..043fca9dd
--- /dev/null
+++ b/webroot/src/components/Icons/Dashboard/Dashboard.less
@@ -0,0 +1,6 @@
+//
+//  Dashboard.less
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
diff --git a/webroot/src/components/Icons/Dashboard/Dashboard.spec.ts b/webroot/src/components/Icons/Dashboard/Dashboard.spec.ts
new file mode 100644
index 000000000..4c00f294d
--- /dev/null
+++ b/webroot/src/components/Icons/Dashboard/Dashboard.spec.ts
@@ -0,0 +1,19 @@
+//
+//  Dashboard.spec.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { expect } from 'chai';
+import { mountShallow } from '@tests/helpers/setup';
+import Dashboard from '@components/Icons/Dashboard/Dashboard.vue';
+
+describe('Dashboard component', async () => {
+    it('should mount the component', async () => {
+        const wrapper = await mountShallow(Dashboard);
+
+        expect(wrapper.exists()).to.equal(true);
+        expect(wrapper.findComponent(Dashboard).exists()).to.equal(true);
+    });
+});
diff --git a/webroot/src/components/Icons/Dashboard/Dashboard.ts b/webroot/src/components/Icons/Dashboard/Dashboard.ts
new file mode 100644
index 000000000..5dec07c60
--- /dev/null
+++ b/webroot/src/components/Icons/Dashboard/Dashboard.ts
@@ -0,0 +1,18 @@
+//
+//  Dashboard.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { Component, Vue, toNative } from 'vue-facing-decorator';
+
+@Component({
+    name: 'Dashboard',
+})
+class Dashboard extends Vue {
+}
+
+export default toNative(Dashboard);
+
+// export default Dashboard;
diff --git a/webroot/src/components/Icons/Dashboard/Dashboard.vue b/webroot/src/components/Icons/Dashboard/Dashboard.vue
new file mode 100644
index 000000000..a791bbcb6
--- /dev/null
+++ b/webroot/src/components/Icons/Dashboard/Dashboard.vue
@@ -0,0 +1,17 @@
+<!--
+    Dashboard.vue
+    CompactConnect
+
+    Created by InspiringApps on 12/16/2024.
+-->
+
+<template>
+    <svg class="icon dashboard-icon stroke-type" viewBox="0 0 23 20" fill="none">
+        <rect x="1.22754" y="13.9688" width="9.46552" height="4.29808" rx="1.05172" stroke-width="2.10345"/>
+        <rect x="1.22754" y="1.43945" width="9.46552" height="8.41379" rx="2.10345" stroke-width="2.10345"/>
+        <rect x="14.8999" y="1.43945" width="6.31034" height="16.8276" rx="2.10345" stroke-width="2.10345"/>
+    </svg>
+</template>
+
+<script lang="ts" src="./Dashboard.ts"></script>
+<style scoped lang="less" src="./Dashboard.less"></style>
diff --git a/webroot/src/components/Icons/LicenseSearch/LicenseSearch.less b/webroot/src/components/Icons/LicenseSearch/LicenseSearch.less
new file mode 100644
index 000000000..b9b91d273
--- /dev/null
+++ b/webroot/src/components/Icons/LicenseSearch/LicenseSearch.less
@@ -0,0 +1,6 @@
+//
+//  LicenseSearch.less
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
diff --git a/webroot/src/components/Icons/LicenseSearch/LicenseSearch.spec.ts b/webroot/src/components/Icons/LicenseSearch/LicenseSearch.spec.ts
new file mode 100644
index 000000000..6206d287e
--- /dev/null
+++ b/webroot/src/components/Icons/LicenseSearch/LicenseSearch.spec.ts
@@ -0,0 +1,19 @@
+//
+//  LicenseSearch.spec.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { expect } from 'chai';
+import { mountShallow } from '@tests/helpers/setup';
+import LicenseSearch from '@components/Icons/LicenseSearch/LicenseSearch.vue';
+
+describe('LicenseSearch component', async () => {
+    it('should mount the component', async () => {
+        const wrapper = await mountShallow(LicenseSearch);
+
+        expect(wrapper.exists()).to.equal(true);
+        expect(wrapper.findComponent(LicenseSearch).exists()).to.equal(true);
+    });
+});
diff --git a/webroot/src/components/Icons/LicenseSearch/LicenseSearch.ts b/webroot/src/components/Icons/LicenseSearch/LicenseSearch.ts
new file mode 100644
index 000000000..b990f9596
--- /dev/null
+++ b/webroot/src/components/Icons/LicenseSearch/LicenseSearch.ts
@@ -0,0 +1,18 @@
+//
+//  LicenseSearch.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { Component, Vue, toNative } from 'vue-facing-decorator';
+
+@Component({
+    name: 'LicenseSearch',
+})
+class LicenseSearch extends Vue {
+}
+
+export default toNative(LicenseSearch);
+
+// export default LicenseSearch;
diff --git a/webroot/src/components/Icons/LicenseSearch/LicenseSearch.vue b/webroot/src/components/Icons/LicenseSearch/LicenseSearch.vue
new file mode 100644
index 000000000..c0917a727
--- /dev/null
+++ b/webroot/src/components/Icons/LicenseSearch/LicenseSearch.vue
@@ -0,0 +1,28 @@
+<!--
+    LicenseSearch.vue
+    CompactConnect
+
+    Created by InspiringApps on 12/16/2024.
+-->
+
+<template>
+    <svg class="icon license-search-icon stroke-type" viewBox="0 0 22 21" fill="none">
+        <path d="M11.977 5.49092L10.8869 3.31066C10.5731 2.68317 10.4162 2.36941 10.1822 2.14019C9.97522 1.93748
+            9.72578 1.78331 9.45192 1.68885C9.14222 1.58203 8.79144 1.58203 8.08988 1.58203H4.35465C3.26006 1.58203
+            2.71276 1.58203 2.29468 1.79505C1.92693 1.98243 1.62794 2.28142 1.44056 2.64918C1.22754 3.06726 1.22754
+            3.61455 1.22754 4.70914V5.49092M1.22754 5.49092H16.0813C17.7232 5.49092 18.5442 5.49092 19.1713
+            5.81045C19.7229 6.09152 20.1714 6.54001 20.4525 7.09164C20.772 7.71876 20.772 8.5397 20.772
+            10.1816V14.4814C20.772 16.1233 20.772 16.9442 20.4525 17.5713C20.1714 18.1229 19.7229 18.5714 19.1713
+            18.8525C18.5442 19.172 17.7232 19.172 16.0813 19.172H5.91821C4.27632 19.172 3.45538 19.172 2.82826
+            18.8525C2.27663 18.5714 1.82814 18.1229 1.54707 17.5713C1.22754 16.9442 1.22754 16.1233 1.22754
+            14.4814V5.49092ZM14.42 15.7518L12.9542 14.2859M13.9314 11.8429C13.9314 13.7318 12.4001 15.2631 10.5112
+            15.2631C8.62219 15.2631 7.09087 13.7318 7.09087 11.8429C7.09087 9.9539 8.62219 8.42259 10.5112
+            8.42259C12.4001 8.42259 13.9314 9.9539 13.9314 11.8429Z"
+            stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+        />
+    </svg>
+
+</template>
+
+<script lang="ts" src="./LicenseSearch.ts"></script>
+<style scoped lang="less" src="./LicenseSearch.less"></style>
diff --git a/webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.less b/webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.less
new file mode 100644
index 000000000..558f6abba
--- /dev/null
+++ b/webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.less
@@ -0,0 +1,6 @@
+//
+//  LicenseSearchAlt.less
+//  CompactConnect
+//
+//  Created by InspiringApps on 1/2/2025.
+//
diff --git a/webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.spec.ts b/webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.spec.ts
new file mode 100644
index 000000000..87bdc4c7e
--- /dev/null
+++ b/webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.spec.ts
@@ -0,0 +1,19 @@
+//
+//  LicenseSearchAlt.spec.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 1/2/2025.
+//
+
+import { expect } from 'chai';
+import { mountShallow } from '@tests/helpers/setup';
+import LicenseSearchAlt from '@components/Icons/LicenseSearchAlt/LicenseSearchAlt.vue';
+
+describe('LicenseSearchAlt component', async () => {
+    it('should mount the component', async () => {
+        const wrapper = await mountShallow(LicenseSearchAlt);
+
+        expect(wrapper.exists()).to.equal(true);
+        expect(wrapper.findComponent(LicenseSearchAlt).exists()).to.equal(true);
+    });
+});
diff --git a/webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.ts b/webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.ts
new file mode 100644
index 000000000..0825cff96
--- /dev/null
+++ b/webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.ts
@@ -0,0 +1,18 @@
+//
+//  LicenseSearchAlt.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 1/2/2025.
+//
+
+import { Component, Vue, toNative } from 'vue-facing-decorator';
+
+@Component({
+    name: 'LicenseSearchAlt',
+})
+class LicenseSearchAlt extends Vue {
+}
+
+export default toNative(LicenseSearchAlt);
+
+// export default LicenseSearchAlt;
diff --git a/webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.vue b/webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.vue
new file mode 100644
index 000000000..5bcc723a6
--- /dev/null
+++ b/webroot/src/components/Icons/LicenseSearchAlt/LicenseSearchAlt.vue
@@ -0,0 +1,17 @@
+<!--
+    LicenseSearchAlt.vue
+    CompactConnect
+
+    Created by InspiringApps on 1/2/2025.
+-->
+
+<template>
+    <svg viewBox="0 0 1024 1024" class="icon search-icon">
+        <path d="M448 768A320 320 0 1 0 448 128a320 320 0 0 0 0 640z m297.344-76.992l214.592 214.592-54.336
+            54.336-214.592-214.592a384 384 0 1 1 54.336-54.336z"
+        />
+    </svg>
+</template>
+
+<script lang="ts" src="./LicenseSearchAlt.ts"></script>
+<style scoped lang="less" src="./LicenseSearchAlt.less"></style>
diff --git a/webroot/src/components/Icons/Logout/Logout.less b/webroot/src/components/Icons/Logout/Logout.less
new file mode 100644
index 000000000..7c0a66079
--- /dev/null
+++ b/webroot/src/components/Icons/Logout/Logout.less
@@ -0,0 +1,6 @@
+//
+//  Logout.less
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
diff --git a/webroot/src/components/Icons/Logout/Logout.spec.ts b/webroot/src/components/Icons/Logout/Logout.spec.ts
new file mode 100644
index 000000000..600fa8e82
--- /dev/null
+++ b/webroot/src/components/Icons/Logout/Logout.spec.ts
@@ -0,0 +1,19 @@
+//
+//  Logout.spec.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { expect } from 'chai';
+import { mountShallow } from '@tests/helpers/setup';
+import Logout from '@components/Icons/Logout/Logout.vue';
+
+describe('Logout component', async () => {
+    it('should mount the component', async () => {
+        const wrapper = await mountShallow(Logout);
+
+        expect(wrapper.exists()).to.equal(true);
+        expect(wrapper.findComponent(Logout).exists()).to.equal(true);
+    });
+});
diff --git a/webroot/src/components/Icons/Logout/Logout.ts b/webroot/src/components/Icons/Logout/Logout.ts
new file mode 100644
index 000000000..2a7f34863
--- /dev/null
+++ b/webroot/src/components/Icons/Logout/Logout.ts
@@ -0,0 +1,18 @@
+//
+//  Logout.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { Component, Vue, toNative } from 'vue-facing-decorator';
+
+@Component({
+    name: 'Logout',
+})
+class Logout extends Vue {
+}
+
+export default toNative(Logout);
+
+// export default Logout;
diff --git a/webroot/src/components/Icons/Logout/Logout.vue b/webroot/src/components/Icons/Logout/Logout.vue
new file mode 100644
index 000000000..ab6104b36
--- /dev/null
+++ b/webroot/src/components/Icons/Logout/Logout.vue
@@ -0,0 +1,22 @@
+<!--
+    Logout.vue
+    CompactConnect
+
+    Created by InspiringApps on 12/16/2024.
+-->
+
+<template>
+    <svg class="icon logout-icon stroke-type" viewBox="0 0 21 20" fill="none">
+        <path d="M7.48378 18.755L6.31111 18.755C4.66922 18.755 3.84828 18.755 3.22116 18.4355C2.66953 18.1544 2.22104
+            17.706 1.93998 17.1543C1.62044 16.5272 1.62044 15.7063 1.62044 14.0644L1.62044 5.85571C1.62044 4.21382
+            1.62044 3.39287 1.93998 2.76576C2.22104 2.21413 2.66953 1.76564 3.22116 1.48457C3.84828 1.16504 4.66922
+            1.16504 6.31111 1.16504L7.48378 1.16504M14.3243 14.8462L19.2104 9.96004M19.2104 9.96004L14.3243
+            5.07393M19.2104 9.96004L7.48378 9.96004"
+            stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+        />
+    </svg>
+
+</template>
+
+<script lang="ts" src="./Logout.ts"></script>
+<style scoped lang="less" src="./Logout.less"></style>
diff --git a/webroot/src/components/Icons/Purchase/Purchase.less b/webroot/src/components/Icons/Purchase/Purchase.less
new file mode 100644
index 000000000..2a4839234
--- /dev/null
+++ b/webroot/src/components/Icons/Purchase/Purchase.less
@@ -0,0 +1,6 @@
+//
+//  Purchase.less
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
diff --git a/webroot/src/components/Icons/Purchase/Purchase.spec.ts b/webroot/src/components/Icons/Purchase/Purchase.spec.ts
new file mode 100644
index 000000000..02cfdd33e
--- /dev/null
+++ b/webroot/src/components/Icons/Purchase/Purchase.spec.ts
@@ -0,0 +1,19 @@
+//
+//  Purchase.spec.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { expect } from 'chai';
+import { mountShallow } from '@tests/helpers/setup';
+import Purchase from '@components/Icons/Purchase/Purchase.vue';
+
+describe('Purchase component', async () => {
+    it('should mount the component', async () => {
+        const wrapper = await mountShallow(Purchase);
+
+        expect(wrapper.exists()).to.equal(true);
+        expect(wrapper.findComponent(Purchase).exists()).to.equal(true);
+    });
+});
diff --git a/webroot/src/components/Icons/Purchase/Purchase.ts b/webroot/src/components/Icons/Purchase/Purchase.ts
new file mode 100644
index 000000000..e8b21f9ef
--- /dev/null
+++ b/webroot/src/components/Icons/Purchase/Purchase.ts
@@ -0,0 +1,18 @@
+//
+//  Purchase.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { Component, Vue, toNative } from 'vue-facing-decorator';
+
+@Component({
+    name: 'Purchase',
+})
+class Purchase extends Vue {
+}
+
+export default toNative(Purchase);
+
+// export default Purchase;
diff --git a/webroot/src/components/Icons/Purchase/Purchase.vue b/webroot/src/components/Icons/Purchase/Purchase.vue
new file mode 100644
index 000000000..9d5282835
--- /dev/null
+++ b/webroot/src/components/Icons/Purchase/Purchase.vue
@@ -0,0 +1,19 @@
+<!--
+    Purchase.vue
+    CompactConnect
+
+    Created by InspiringApps on 12/16/2024.
+-->
+
+<template>
+    <svg class="icon purchase-icon stroke-type" viewBox="0 0 23 18" fill="none">
+        <path d="M1.85152 5.66842H20.5855M3.7254 1.09863H18.7122C20.0917 1.09863 21.21 2.26688 21.21 3.70908L21.2103
+            13.5039C21.2103 14.9461 20.092 16.1142 18.7125 16.1142L3.72564 16.114C2.34615 16.114 1.22785 14.9449
+            1.22781 13.5027L1.22754 3.7101C1.2275 2.26784 2.34584 1.09863 3.7254 1.09863Z"
+            stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+        />
+    </svg>
+</template>
+
+<script lang="ts" src="./Purchase.ts"></script>
+<style scoped lang="less" src="./Purchase.less"></style>
diff --git a/webroot/src/components/Icons/Reports/Reports.less b/webroot/src/components/Icons/Reports/Reports.less
new file mode 100644
index 000000000..e0c0721d1
--- /dev/null
+++ b/webroot/src/components/Icons/Reports/Reports.less
@@ -0,0 +1,6 @@
+//
+//  Reports.less
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
diff --git a/webroot/src/components/Icons/Reports/Reports.spec.ts b/webroot/src/components/Icons/Reports/Reports.spec.ts
new file mode 100644
index 000000000..d0effdfb0
--- /dev/null
+++ b/webroot/src/components/Icons/Reports/Reports.spec.ts
@@ -0,0 +1,19 @@
+//
+//  Reports.spec.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { expect } from 'chai';
+import { mountShallow } from '@tests/helpers/setup';
+import Reports from '@components/Icons/Reports/Reports.vue';
+
+describe('Reports component', async () => {
+    it('should mount the component', async () => {
+        const wrapper = await mountShallow(Reports);
+
+        expect(wrapper.exists()).to.equal(true);
+        expect(wrapper.findComponent(Reports).exists()).to.equal(true);
+    });
+});
diff --git a/webroot/src/components/Icons/Reports/Reports.ts b/webroot/src/components/Icons/Reports/Reports.ts
new file mode 100644
index 000000000..c6ad0817f
--- /dev/null
+++ b/webroot/src/components/Icons/Reports/Reports.ts
@@ -0,0 +1,18 @@
+//
+//  Reports.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { Component, Vue, toNative } from 'vue-facing-decorator';
+
+@Component({
+    name: 'Reports',
+})
+class Reports extends Vue {
+}
+
+export default toNative(Reports);
+
+// export default Reports;
diff --git a/webroot/src/components/Icons/Reports/Reports.vue b/webroot/src/components/Icons/Reports/Reports.vue
new file mode 100644
index 000000000..9c8fe2375
--- /dev/null
+++ b/webroot/src/components/Icons/Reports/Reports.vue
@@ -0,0 +1,13 @@
+<!--
+    Reports.vue
+    CompactConnect
+
+    Created by InspiringApps on 12/16/2024.
+-->
+
+<template>
+    <h3>Reports</h3>
+</template>
+
+<script lang="ts" src="./Reports.ts"></script>
+<style scoped lang="less" src="./Reports.less"></style>
diff --git a/webroot/src/components/Icons/Settings/Settings.less b/webroot/src/components/Icons/Settings/Settings.less
new file mode 100644
index 000000000..061017a6c
--- /dev/null
+++ b/webroot/src/components/Icons/Settings/Settings.less
@@ -0,0 +1,6 @@
+//
+//  Settings.less
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
diff --git a/webroot/src/components/Icons/Settings/Settings.spec.ts b/webroot/src/components/Icons/Settings/Settings.spec.ts
new file mode 100644
index 000000000..e6fd29536
--- /dev/null
+++ b/webroot/src/components/Icons/Settings/Settings.spec.ts
@@ -0,0 +1,19 @@
+//
+//  Settings.spec.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { expect } from 'chai';
+import { mountShallow } from '@tests/helpers/setup';
+import Settings from '@components/Icons/Settings/Settings.vue';
+
+describe('Settings component', async () => {
+    it('should mount the component', async () => {
+        const wrapper = await mountShallow(Settings);
+
+        expect(wrapper.exists()).to.equal(true);
+        expect(wrapper.findComponent(Settings).exists()).to.equal(true);
+    });
+});
diff --git a/webroot/src/components/Icons/Settings/Settings.ts b/webroot/src/components/Icons/Settings/Settings.ts
new file mode 100644
index 000000000..e3e2b1a6d
--- /dev/null
+++ b/webroot/src/components/Icons/Settings/Settings.ts
@@ -0,0 +1,18 @@
+//
+//  Settings.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { Component, Vue, toNative } from 'vue-facing-decorator';
+
+@Component({
+    name: 'Settings',
+})
+class Settings extends Vue {
+}
+
+export default toNative(Settings);
+
+// export default Settings;
diff --git a/webroot/src/components/Icons/Settings/Settings.vue b/webroot/src/components/Icons/Settings/Settings.vue
new file mode 100644
index 000000000..b9509f9e2
--- /dev/null
+++ b/webroot/src/components/Icons/Settings/Settings.vue
@@ -0,0 +1,39 @@
+<!--
+    Settings.vue
+    CompactConnect
+
+    Created by InspiringApps on 12/16/2024.
+-->
+
+<template>
+    <svg class="icon settings-icon stroke-type" viewBox="0 0 30 29" fill="none">
+        <path d="M17.4354 3.53887C16.8144 0.989646 13.1866 0.989646 12.5656 3.53887C12.4729 3.92194 12.2911 4.2777
+            12.0349 4.57721C11.7787 4.87672 11.4554 5.11152 11.0914 5.26249C10.7273 5.41347 10.3327 5.47636 9.93976
+            5.44604C9.5468 5.41572 9.16655 5.29305 8.82996 5.08802C6.58791 3.72189 4.0223 6.28746 5.38845
+            8.52947C6.27088 9.9773 5.48813 11.8663 3.84091 12.2667C1.29001 12.886 1.29001 16.5154 3.84091
+            17.1331C4.22408 17.2259 4.57991 17.4079 4.87943 17.6643C5.17894 17.9207 5.41367 18.2442 5.56451
+            18.6084C5.71534 18.9727 5.77801 19.3674 5.74742 19.7605C5.71682 20.1535 5.59383 20.5338 5.38845
+            20.8703C4.0223 23.1124 6.58791 25.6779 8.82996 24.3118C9.16649 24.1064 9.54678 23.9834 9.93984
+            23.9528C10.3329 23.9222 10.7276 23.9849 11.0919 24.1357C11.4562 24.2866 11.7797 24.5213 12.036
+            24.8208C12.2924 25.1203 12.4744 25.4762 12.5672 25.8593C13.1866 28.4102 16.816 28.4102 17.4337
+            25.8593C17.5269 25.4764 17.7091 25.1208 17.9655 24.8215C18.2219 24.5222 18.5454 24.2876 18.9095
+            24.1368C19.2737 23.986 19.6682 23.9233 20.0612 23.9537C20.4542 23.9841 20.8344 24.1068 21.171
+            24.3118C23.4131 25.6779 25.9787 23.1124 24.6125 20.8703C24.4075 20.5337 24.2848 20.1535 24.2544
+            19.7605C24.224 19.3676 24.2867 18.973 24.4375 18.6089C24.5883 18.2447 24.8229 17.9213 25.1222
+            17.6649C25.4215 17.4084 25.7771 17.2263 26.1601 17.1331C28.711 16.5138 28.711 12.8844 26.1601
+            12.2667C25.7769 12.1739 25.4211 11.9919 25.1216 11.7355C24.822 11.4791 24.5873 11.1556 24.4365
+            10.7914C24.2856 10.4271 24.223 10.0324 24.2536 9.63934C24.2842 9.24628 24.4072 8.866 24.6125
+            8.52947C25.9787 6.28746 23.4131 3.72189 21.171 5.08802C20.8345 5.2934 20.4542 5.41639 20.0611
+            5.44698C19.6681 5.47758 19.2733 5.41491 18.9091 5.26408C18.5448 5.11325 18.2213 4.87852 17.9649
+            4.57901C17.7086 4.2795 17.5266 3.92367 17.4337 3.54051L17.4354 3.53887Z" stroke-width="2"
+        />
+        <path d="M17.9055 14.6997C17.9055 16.3041 16.6049 17.6048 15.0005 17.6048C13.3961 17.6048 12.0954 16.3041
+            12.0954 14.6997C12.0954 13.0953 13.3961 11.7947 15.0005 11.7947C16.6049 11.7947 17.9055 13.0953 17.9055
+            14.6997Z" stroke-width="2"
+        />
+    </svg>
+
+</template>
+
+<script lang="ts" src="./Settings.ts"></script>
+<style scoped lang="less" src="./Settings.less"></style>
diff --git a/webroot/src/components/Icons/Upload/Upload.less b/webroot/src/components/Icons/Upload/Upload.less
new file mode 100644
index 000000000..9ec4d18f0
--- /dev/null
+++ b/webroot/src/components/Icons/Upload/Upload.less
@@ -0,0 +1,6 @@
+//
+//  Upload.less
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
diff --git a/webroot/src/components/Icons/Upload/Upload.spec.ts b/webroot/src/components/Icons/Upload/Upload.spec.ts
new file mode 100644
index 000000000..53b265ff1
--- /dev/null
+++ b/webroot/src/components/Icons/Upload/Upload.spec.ts
@@ -0,0 +1,19 @@
+//
+//  Upload.spec.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { expect } from 'chai';
+import { mountShallow } from '@tests/helpers/setup';
+import Upload from '@components/Icons/Upload/Upload.vue';
+
+describe('Upload component', async () => {
+    it('should mount the component', async () => {
+        const wrapper = await mountShallow(Upload);
+
+        expect(wrapper.exists()).to.equal(true);
+        expect(wrapper.findComponent(Upload).exists()).to.equal(true);
+    });
+});
diff --git a/webroot/src/components/Icons/Upload/Upload.ts b/webroot/src/components/Icons/Upload/Upload.ts
new file mode 100644
index 000000000..a6052043b
--- /dev/null
+++ b/webroot/src/components/Icons/Upload/Upload.ts
@@ -0,0 +1,18 @@
+//
+//  Upload.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { Component, Vue, toNative } from 'vue-facing-decorator';
+
+@Component({
+    name: 'Upload',
+})
+class Upload extends Vue {
+}
+
+export default toNative(Upload);
+
+// export default Upload;
diff --git a/webroot/src/components/Icons/Upload/Upload.vue b/webroot/src/components/Icons/Upload/Upload.vue
new file mode 100644
index 000000000..5e18e1384
--- /dev/null
+++ b/webroot/src/components/Icons/Upload/Upload.vue
@@ -0,0 +1,21 @@
+<!--
+    Upload.vue
+    CompactConnect
+
+    Created by InspiringApps on 12/16/2024.
+-->
+
+<template>
+    <svg class="icon upload-icon stroke-type" viewBox="0 0 20 20" fill="none">
+        <path d="M18.8175 12.7648V13.9374C18.8175 15.5793 18.8175 16.4003 18.498 17.0274C18.2169 17.579 17.7685
+            18.0275 17.2168 18.3086C16.5897 18.6281 15.7688 18.6281 14.1269 18.6281H5.91821C4.27632 18.6281 3.45538
+            18.6281 2.82826 18.3086C2.27663 18.0275 1.82814 17.579 1.54707 17.0274C1.22754 16.4003 1.22754 15.5793
+            1.22754 13.9374V12.7648M14.9087 5.9242L10.0225 1.03809M10.0225 1.03809L5.13643 5.9242M10.0225
+            1.03809V12.7648" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+        />
+    </svg>
+
+</template>
+
+<script lang="ts" src="./Upload.ts"></script>
+<style scoped lang="less" src="./Upload.less"></style>
diff --git a/webroot/src/components/Icons/Users/Users.less b/webroot/src/components/Icons/Users/Users.less
new file mode 100644
index 000000000..5d6b8759d
--- /dev/null
+++ b/webroot/src/components/Icons/Users/Users.less
@@ -0,0 +1,6 @@
+//
+//  Users.less
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
diff --git a/webroot/src/components/Icons/Users/Users.spec.ts b/webroot/src/components/Icons/Users/Users.spec.ts
new file mode 100644
index 000000000..8abb18463
--- /dev/null
+++ b/webroot/src/components/Icons/Users/Users.spec.ts
@@ -0,0 +1,19 @@
+//
+//  Users.spec.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { expect } from 'chai';
+import { mountShallow } from '@tests/helpers/setup';
+import Users from '@components/Icons/Users/Users.vue';
+
+describe('Users component', async () => {
+    it('should mount the component', async () => {
+        const wrapper = await mountShallow(Users);
+
+        expect(wrapper.exists()).to.equal(true);
+        expect(wrapper.findComponent(Users).exists()).to.equal(true);
+    });
+});
diff --git a/webroot/src/components/Icons/Users/Users.ts b/webroot/src/components/Icons/Users/Users.ts
new file mode 100644
index 000000000..4a1284c2d
--- /dev/null
+++ b/webroot/src/components/Icons/Users/Users.ts
@@ -0,0 +1,18 @@
+//
+//  Users.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/16/2024.
+//
+
+import { Component, Vue, toNative } from 'vue-facing-decorator';
+
+@Component({
+    name: 'Users',
+})
+class Users extends Vue {
+}
+
+export default toNative(Users);
+
+// export default Users;
diff --git a/webroot/src/components/Icons/Users/Users.vue b/webroot/src/components/Icons/Users/Users.vue
new file mode 100644
index 000000000..741bdc3de
--- /dev/null
+++ b/webroot/src/components/Icons/Users/Users.vue
@@ -0,0 +1,24 @@
+<!--
+    Users.vue
+    CompactConnect
+
+    Created by InspiringApps on 12/16/2024.
+-->
+
+<template>
+    <svg class="icon users-icon stroke-type" viewBox="0 0 22 20" fill="none">
+        <path d="M20.772 18.8776V16.9232C20.772 15.1018 19.5263 13.5713 17.8403 13.1374M14.42 1.57173C15.8526 2.15161
+            16.8631 3.55604 16.8631 5.19649C16.8631 6.83694 15.8526 8.24137 14.42 8.82124M15.8859 18.8776C15.8859
+            17.0563 15.8859 16.1456 15.5883 15.4273C15.1916 14.4695 14.4306 13.7085 13.4729 13.3118C12.7545 13.0143
+            11.8439 13.0143 10.0225 13.0143H7.09087C5.26956 13.0143 4.3589 13.0143 3.64056 13.3118C2.68277 13.7085
+            1.92181 14.4695 1.52509 15.4273C1.22754 16.1456 1.22754 17.0563 1.22754 18.8776M12.4656 5.19649C12.4656
+            7.35531 10.7155 9.10538 8.55671 9.10538C6.39789 9.10538 4.64782 7.35531 4.64782 5.19649C4.64782 3.03767
+            6.39789 1.2876 8.55671 1.2876C10.7155 1.2876 12.4656 3.03767 12.4656 5.19649Z"
+            stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+        />
+    </svg>
+
+</template>
+
+<script lang="ts" src="./Users.ts"></script>
+<style scoped lang="less" src="./Users.less"></style>
diff --git a/webroot/src/components/Licensee/LicenseeList/LicenseeList.less b/webroot/src/components/Licensee/LicenseeList/LicenseeList.less
index f4acaccf5..ad348e5eb 100644
--- a/webroot/src/components/Licensee/LicenseeList/LicenseeList.less
+++ b/webroot/src/components/Licensee/LicenseeList/LicenseeList.less
@@ -6,14 +6,13 @@
 //
 
 .licensee-list-container {
-    background-color: @white;
+    background-color: transparent;
 
     .search-toggle-container {
         display: flex;
         flex-direction: column;
         flex-wrap: wrap;
         align-items: flex-end;
-        margin-bottom: 2.4rem;
 
         @media @desktopWidth {
             flex-direction: row;
@@ -30,7 +29,7 @@
             padding: 0.4rem 1rem;
             border-radius: @borderRadiusPillShape;
             color: @white;
-            background-color: @primaryColor;
+            background-color: @darkBlue;
 
             @media @desktopWidth {
                 margin-right: 2.4rem;
diff --git a/webroot/src/components/Licensee/LicenseeList/LicenseeList.spec.ts b/webroot/src/components/Licensee/LicenseeList/LicenseeList.spec.ts
index f1c92a722..3ccdc5df8 100644
--- a/webroot/src/components/Licensee/LicenseeList/LicenseeList.spec.ts
+++ b/webroot/src/components/Licensee/LicenseeList/LicenseeList.spec.ts
@@ -113,7 +113,6 @@ describe('LicenseeList component', async () => {
         const requestConfig = await component.fetchListData();
 
         expect(requestConfig).to.matchPattern({
-            compact: undefined,
             jurisdiction: undefined,
             licenseeFirstName: undefined,
             licenseeLastName: undefined,
diff --git a/webroot/src/components/Licensee/LicenseeList/LicenseeList.vue b/webroot/src/components/Licensee/LicenseeList/LicenseeList.vue
index 0e9ba2cef..6019c3c0b 100644
--- a/webroot/src/components/Licensee/LicenseeList/LicenseeList.vue
+++ b/webroot/src/components/Licensee/LicenseeList/LicenseeList.vue
@@ -7,32 +7,32 @@
 
 <template>
     <div class="licensee-list-container">
-        <h1 class="list-title">{{ $t('licensing.licensingListTitle') }}</h1>
         <transition name="fade-slow" mode="out-in">
-            <div v-if="!hasSearched" class="search-initial-container">
-                <LicenseeSearch :searchParams="searchParams" @searchParams="handleSearch" />
-            </div>
-            <div v-else-if="shouldShowSearchModal" class="search-modal-container">
+            <div v-if="!hasSearched || shouldShowSearchModal" class="search-initial-container">
+                <h1 class="list-title">{{ $t('licensing.licensingListTitle') }}</h1>
                 <LicenseeSearch :searchParams="searchParams" @searchParams="handleSearch" />
             </div>
             <div v-else class="licesee-list-container">
-                <div class="search-toggle-container">
-                    <div v-if="searchDisplayAll" class="search-tag">
-                        <span class="title">{{ $t('common.viewing') }}:</span>
-                        <span class="search-terms">{{ searchDisplayAll }}</span>
-                        <CloseX
-                            class="search-terms-reset"
-                            @click="resetSearch()"
+                <div class="list-actions-container">
+                    <h1 class="list-title no-margin">{{ $t('licensing.licensingListTitle') }}</h1>
+                    <div class="search-toggle-container">
+                        <div v-if="searchDisplayAll" class="search-tag">
+                            <span class="title">{{ $t('common.viewing') }}:</span>
+                            <span class="search-terms">{{ searchDisplayAll }}</span>
+                            <CloseX
+                                class="search-terms-reset"
+                                @click="resetSearch()"
+                                tabindex="0"
+                            />
+                        </div>
+                        <button
+                            class="search-toggle"
+                            @click="toggleSearch()"
                             tabindex="0"
-                        />
+                        >
+                            {{ $t('licensing.searchLabel') }}
+                        </button>
                     </div>
-                    <button
-                        class="search-toggle"
-                        @click="toggleSearch()"
-                        tabindex="0"
-                    >
-                        {{ $t('licensing.searchLabel') }}
-                    </button>
                 </div>
                 <ListContainer
                     :listId="listId"
diff --git a/webroot/src/components/Licensee/LicenseeRow/LicenseeRow.less b/webroot/src/components/Licensee/LicenseeRow/LicenseeRow.less
index f7e9b8d56..ca0ea6af3 100644
--- a/webroot/src/components/Licensee/LicenseeRow/LicenseeRow.less
+++ b/webroot/src/components/Licensee/LicenseeRow/LicenseeRow.less
@@ -11,9 +11,5 @@
     &:not(.is-header) {
         min-height: 60px;
         cursor: pointer;
-
-        &:hover {
-            background-color: #e9e9e9;
-        }
     }
 }
diff --git a/webroot/src/components/Licensee/LicenseeSearch/LicenseeSearch.less b/webroot/src/components/Licensee/LicenseeSearch/LicenseeSearch.less
index da862fb8d..13eac7fe3 100644
--- a/webroot/src/components/Licensee/LicenseeSearch/LicenseeSearch.less
+++ b/webroot/src/components/Licensee/LicenseeSearch/LicenseeSearch.less
@@ -12,7 +12,6 @@
     justify-content: center;
     width: 100%;
     min-height: 60vh;
-    border: 1px solid @lightGrey;
     border-radius: 8px;
     background-color: @white;
 
@@ -24,7 +23,7 @@
 
     .search-title {
         font-weight: @fontWeightBold;
-        font-size: @fontSizeExtraLarge;
+        font-size: 2.6rem;
     }
 
     .search-subtext {
@@ -65,4 +64,8 @@
             width: 100%;
         }
     }
+
+    .search-submit {
+        margin-top: 2.4rem;
+    }
 }
diff --git a/webroot/src/components/Licensee/LicenseeSearch/LicenseeSearch.ts b/webroot/src/components/Licensee/LicenseeSearch/LicenseeSearch.ts
index 8e5565da1..70432e554 100644
--- a/webroot/src/components/Licensee/LicenseeSearch/LicenseeSearch.ts
+++ b/webroot/src/components/Licensee/LicenseeSearch/LicenseeSearch.ts
@@ -16,7 +16,7 @@ import MixinForm from '@components/Forms/_mixins/form.mixin';
 import InputText from '@components/Forms/InputText/InputText.vue';
 import InputSelect from '@components/Forms/InputSelect/InputSelect.vue';
 import InputSubmit from '@components/Forms/InputSubmit/InputSubmit.vue';
-import SearchIcon from '@components/Icons/Search/Search.vue';
+import SearchIcon from '@components/Icons/LicenseSearchAlt/LicenseSearchAlt.vue';
 import { CompactType } from '@models/Compact/Compact.model';
 import { FormInput } from '@models/FormInput/FormInput.model';
 import Joi from 'joi';
diff --git a/webroot/src/components/Lists/ListContainer/ListContainer.less b/webroot/src/components/Lists/ListContainer/ListContainer.less
index 0065572eb..b3aababd0 100644
--- a/webroot/src/components/Lists/ListContainer/ListContainer.less
+++ b/webroot/src/components/Lists/ListContainer/ListContainer.less
@@ -7,7 +7,6 @@
 
 .list-container {
     width: 100%;
-    background-color: @white;
 
     .list {
         width: 100%;
diff --git a/webroot/src/components/Lists/Pagination/Pagination.less b/webroot/src/components/Lists/Pagination/Pagination.less
index 2d8f917cb..3eb7db718 100644
--- a/webroot/src/components/Lists/Pagination/Pagination.less
+++ b/webroot/src/components/Lists/Pagination/Pagination.less
@@ -26,6 +26,7 @@
             justify-content: center;
             width: 3.2rem;
             height: 3.2rem;
+            border-radius: 4px;
             color: @black;
 
             &:not(:last-child) {
@@ -34,9 +35,9 @@
         }
 
         .selected {
-            border-color: @black;
+            border-color: @primaryColor;
             color: @white;
-            background-color: @black;
+            background-color: @primaryColor;
         }
 
         .clickable {
@@ -50,17 +51,17 @@
 
         .caret {
             &.previous {
-                width: 8.4rem;
+                width: 3.2rem;
             }
 
             &.next {
-                width: 6.4rem;
+                width: 3.2rem;
             }
 
             svg {
                 width: 1.2rem;
                 height: 1.2rem;
-                fill: @black;
+                fill: @primaryColor;
             }
         }
     }
diff --git a/webroot/src/components/Lists/Pagination/Pagination.vue b/webroot/src/components/Lists/Pagination/Pagination.vue
index fc79809d0..85e0b93c0 100644
--- a/webroot/src/components/Lists/Pagination/Pagination.vue
+++ b/webroot/src/components/Lists/Pagination/Pagination.vue
@@ -29,8 +29,9 @@
                 tabindex="0"
                 class="pagination-item caret clickable next"
                 :aria-label="$t('paging.nextPage')"
+                role="button"
             >
-                <span>{{ $t('paging.nextPage') }} <RightCaretIcon /></span>
+                <RightCaretIcon />
             </li>
         </ul>
         <InputSelect
diff --git a/webroot/src/components/Modal/Modal.less b/webroot/src/components/Modal/Modal.less
index 99d99dcd8..ea0bd1e7e 100644
--- a/webroot/src/components/Modal/Modal.less
+++ b/webroot/src/components/Modal/Modal.less
@@ -50,10 +50,6 @@
     display: flex;
     justify-content: space-between;
 
-    .modal-title {
-        color: @primaryColor;
-    }
-
     .icon-close-modal {
         color: @midGrey;
         font-size: 2.4rem;
diff --git a/webroot/src/components/Page/PageContainer/PageContainer.less b/webroot/src/components/Page/PageContainer/PageContainer.less
index c6e44083e..b081d4c61 100644
--- a/webroot/src/components/Page/PageContainer/PageContainer.less
+++ b/webroot/src/components/Page/PageContainer/PageContainer.less
@@ -10,11 +10,8 @@
     flex-direction: column;
     width: 100%;
     min-height: 100vh;
-    background-color: #eee;
-
-    &.include-page-header {
-        padding-top: @appHeaderHeight;
-    }
+    padding-top: @appHeaderHeight;
+    background-color: @ambientGrey;
 
     header {
         position: fixed;
@@ -31,5 +28,9 @@
         flex-direction: column;
         flex-grow: 1;
         flex-shrink: 0;
+
+        @media @tabletWidth {
+            padding-left: @navPartialExpandWidth;
+        }
     }
 }
diff --git a/webroot/src/components/Page/PageContainer/PageContainer.spec.ts b/webroot/src/components/Page/PageContainer/PageContainer.spec.ts
index 4258d4187..235c4a60a 100644
--- a/webroot/src/components/Page/PageContainer/PageContainer.spec.ts
+++ b/webroot/src/components/Page/PageContainer/PageContainer.spec.ts
@@ -8,8 +8,6 @@
 import { expect } from 'chai';
 import { mountShallow } from '@tests/helpers/setup';
 import PageContainer from '@components/Page/PageContainer/PageContainer.vue';
-import PageFooter from '@components/Page/PageFooter/PageFooter.vue';
-import PageHeader from '@components/Page/PageHeader/PageHeader.vue';
 
 describe('PageContainer component', async () => {
     it('should mount the component', async () => {
@@ -18,29 +16,4 @@ describe('PageContainer component', async () => {
         expect(wrapper.exists()).to.equal(true);
         expect(wrapper.findComponent(PageContainer).exists()).to.equal(true);
     });
-    it('should have the page footer or header if route is not deny-listed', async () => {
-        const wrapper = await mountShallow(PageContainer);
-
-        expect(wrapper.findComponent(PageFooter).exists()).to.equal(true);
-        expect(wrapper.findComponent(PageHeader).exists()).to.equal(true);
-    });
-    it('should not have the page footer or header if route is deny-listed', async () => {
-        const wrapper = await mountShallow(PageContainer, {
-            computed: {
-                includePageHeader: {
-                    get() {
-                        return false;
-                    }
-                },
-                includePageFooter: {
-                    get() {
-                        return false;
-                    }
-                },
-            }
-        });
-
-        expect(wrapper.findComponent(PageFooter).exists()).to.equal(false);
-        expect(wrapper.findComponent(PageHeader).exists()).to.equal(false);
-    });
 });
diff --git a/webroot/src/components/Page/PageContainer/PageContainer.ts b/webroot/src/components/Page/PageContainer/PageContainer.ts
index b5f718874..d16ced28b 100644
--- a/webroot/src/components/Page/PageContainer/PageContainer.ts
+++ b/webroot/src/components/Page/PageContainer/PageContainer.ts
@@ -7,6 +7,7 @@
 
 import { Component, Vue, toNative } from 'vue-facing-decorator';
 import PageHeader from '@components/Page/PageHeader/PageHeader.vue';
+import PageNav from '@components/Page/PageNav/PageNav.vue';
 import PageLoadingMask from '@components/Page/PageLoadingMask/PageLoadingMask.vue';
 import PageFooter from '@components/Page/PageFooter/PageFooter.vue';
 
@@ -14,50 +15,42 @@ import PageFooter from '@components/Page/PageFooter/PageFooter.vue';
     name: 'PageContainer',
     components: {
         PageHeader,
+        PageNav,
         PageLoadingMask,
         PageFooter,
     }
 })
 class PageContainer extends Vue {
-    //
-    // Data
-    //
-    globalStore: any = {};
-    userStore: any = {};
-
-    //
-    // Lifecycle
-    //
-    created() {
-        this.globalStore = this.$store.state;
-        this.userStore = this.$store.state.user;
-    }
-
     //
     // Computed
     //
-    get includePageHeader(): boolean {
-        const currentRouteName = this.$route.name;
-        const nonHeaderRouteNames: Array<string> = [];
-
-        return (!nonHeaderRouteNames.includes((currentRouteName as string)));
+    get globalStore() {
+        return this.$store.state;
     }
 
-    get includePageFooter(): boolean {
-        const currentRouteName = this.$route.name;
-        const nonFooterRouteNames: Array<string> = [];
-
-        if (this.isPhone) {
-            nonFooterRouteNames.push('SelectPrivileges');
-        }
-
-        return (!nonFooterRouteNames.includes((currentRouteName as string)));
+    get userStore() {
+        return this.$store.state.user;
     }
 
     get isPhone(): boolean {
         return this.$matches.phone.only;
     }
 
+    get includePageHeader(): boolean {
+        const { isLoggedIn } = this.userStore;
+        const currentRouteName: string = this.$route.name as string;
+        const nonHeaderRouteNames: Array<string> = [
+            'Login',
+            'Logout',
+        ];
+
+        return (isLoggedIn && this.isPhone && !nonHeaderRouteNames.includes(currentRouteName));
+    }
+
+    get includePageFooter(): boolean {
+        return false;
+    }
+
     get isLoading(): boolean {
         return this.globalStore.isLoading
             || this.userStore.isLoadingAccount
diff --git a/webroot/src/components/Page/PageContainer/PageContainer.vue b/webroot/src/components/Page/PageContainer/PageContainer.vue
index 0494fee5b..46fb278bc 100644
--- a/webroot/src/components/Page/PageContainer/PageContainer.vue
+++ b/webroot/src/components/Page/PageContainer/PageContainer.vue
@@ -6,10 +6,11 @@
 -->
 
 <template>
-    <div class="page-container" :class="{ 'include-page-header': includePageHeader }">
-        <header v-if="includePageHeader" v-show="!isLoading">
-            <PageHeader></PageHeader>
+    <div class="page-container">
+        <header>
+            <PageHeader v-if="includePageHeader"></PageHeader>
         </header>
+        <PageNav />
         <div class="page-content" role="main">
             <transition name="fade">
                 <PageLoadingMask v-show="isLoading"></PageLoadingMask>
diff --git a/webroot/src/components/Page/PageFooter/PageFooter.less b/webroot/src/components/Page/PageFooter/PageFooter.less
index ebd0824b9..64ca55899 100644
--- a/webroot/src/components/Page/PageFooter/PageFooter.less
+++ b/webroot/src/components/Page/PageFooter/PageFooter.less
@@ -14,8 +14,8 @@ footer.app-footer {
     min-height: @appFooterHeight;
     margin-top: 2rem;
     padding: 0.8rem;
-    color: @black;
-    background-color: @darkGrey;
+    color: @white;
+    background-color: @primaryColor;
 
     @media @desktopWidth {
         flex-direction: row;
diff --git a/webroot/src/components/Page/PageHeader/PageHeader.less b/webroot/src/components/Page/PageHeader/PageHeader.less
index 75dbabeac..a25953712 100644
--- a/webroot/src/components/Page/PageHeader/PageHeader.less
+++ b/webroot/src/components/Page/PageHeader/PageHeader.less
@@ -5,28 +5,102 @@
 //  Created by InspiringApps on 5/4/2020.
 //
 
-.page-header {
+.page-header-container {
     position: fixed;
     top: 0;
     left: 0;
+    z-index: 10;
     display: flex;
     align-items: center;
     width: 100%;
     height: @appHeaderHeight;
     padding: 0 1.6rem;
-    border-bottom: 0.1rem solid @darkGrey;
-    background-color: @darkGrey;
+    color: @white;
+    background-color: @primaryColor;
 
-    .header-content {
+    @media @tabletWidth {
+        background-color: transparent;
+    }
+
+    .logo-container {
         display: flex;
-        flex-grow: 1;
         align-items: center;
-        justify-content: flex-start;
+        justify-content: center;
+        width: 80px;
+
+        .logo {
+            display: inline-block;
+            width: 100%;
+            height: auto;
+            cursor: pointer;
+        }
     }
 
-    .nav-container {
+    .nav-toggle-container {
+        position: relative;
         display: flex;
         align-items: center;
-        justify-content: flex-end;
+        justify-content: center;
+        width: @appHeaderHeight;
+        height: @appHeaderHeight;
+        margin-left: auto;
+
+        .nav-toggle {
+            position: absolute;
+            top: 50%;
+            left: 50%;
+            width: 28px;
+            height: 16px;
+            transform: translate(-50%, -50%);
+            cursor: pointer;
+
+            &::after,
+            &::before {
+                position: absolute;
+                top: 0;
+                right: 0;
+                left: 0;
+                width: 100%;
+                height: 0;
+                border-bottom: 2px solid white;
+                transition: all ease-out 0.2s;
+                content: '';
+            }
+
+            &::after {
+                top: 100%;
+            }
+
+            .middle-bar {
+                position: absolute;
+                top: 50%;
+                display: block;
+                width: 100%;
+                height: 2px;
+                overflow: hidden;
+                white-space: nowrap;
+                text-indent: 100%;
+                background-color: @white;
+                transition: all ease-out 0.1s;
+            }
+
+            &.expanded {
+                &::after {
+                    top: 50%;
+                    transform: rotate(-45deg);
+                    transform-origin: center;
+                }
+
+                &::before {
+                    top: 50%;
+                    transform: rotate(45deg);
+                    transform-origin: center;
+                }
+
+                .middle-bar {
+                    opacity: 0;
+                }
+            }
+        }
     }
 }
diff --git a/webroot/src/components/Page/PageHeader/PageHeader.spec.ts b/webroot/src/components/Page/PageHeader/PageHeader.spec.ts
index 27d1d645e..e29dc1a18 100644
--- a/webroot/src/components/Page/PageHeader/PageHeader.spec.ts
+++ b/webroot/src/components/Page/PageHeader/PageHeader.spec.ts
@@ -8,7 +8,6 @@
 import { expect } from 'chai';
 import { mountShallow } from '@tests/helpers/setup';
 import PageHeader from '@components/Page/PageHeader/PageHeader.vue';
-import PageNav from '@components/Page/PageNav/PageNav.vue';
 
 describe('PageHeader component', async () => {
     it('should mount the component', async () => {
@@ -17,10 +16,4 @@ describe('PageHeader component', async () => {
         expect(wrapper.exists()).to.equal(true);
         expect(wrapper.findComponent(PageHeader).exists()).to.equal(true);
     });
-    it('should have the PageNav child component', async () => {
-        const wrapper = await mountShallow(PageHeader);
-        const nav = wrapper.findComponent(PageNav);
-
-        expect(nav.exists()).to.equal(true);
-    });
 });
diff --git a/webroot/src/components/Page/PageHeader/PageHeader.ts b/webroot/src/components/Page/PageHeader/PageHeader.ts
index 59992d3ad..6f88d7d56 100644
--- a/webroot/src/components/Page/PageHeader/PageHeader.ts
+++ b/webroot/src/components/Page/PageHeader/PageHeader.ts
@@ -5,26 +5,33 @@
 //  Created by InspiringApps on 5/4/2020.
 //
 
-import { AuthTypes } from '@/app.config';
 import { Component, Vue, toNative } from 'vue-facing-decorator';
-import CompactSelector from '@components/CompactSelector/CompactSelector.vue';
-import PageNav from '@components/Page/PageNav/PageNav.vue';
-import PageMainNav from '@components/Page/PageMainNav/PageMainNav.vue';
 
 @Component({
     name: 'PageHeader',
-    components: {
-        CompactSelector,
-        PageNav,
-        PageMainNav,
-    }
+    components: {}
 })
 class PageHeader extends Vue {
     //
     // Computed
     //
-    get isStaffUser(): boolean {
-        return this.$store.state.authType === AuthTypes.STAFF;
+    get globalStore() {
+        return this.$store.state;
+    }
+
+    //
+    // Methods
+    //
+    logoClick(): void {
+        this.$router.push({ name: 'Home' });
+    }
+
+    navToggle(): void {
+        if (this.globalStore.isNavExpanded) {
+            this.$store.dispatch('collapseNavMenu');
+        } else {
+            this.$store.dispatch('expandNavMenu');
+        }
     }
 }
 
diff --git a/webroot/src/components/Page/PageHeader/PageHeader.vue b/webroot/src/components/Page/PageHeader/PageHeader.vue
index fe3398442..800facbcf 100644
--- a/webroot/src/components/Page/PageHeader/PageHeader.vue
+++ b/webroot/src/components/Page/PageHeader/PageHeader.vue
@@ -6,16 +6,30 @@
 -->
 
 <template>
-    <div class="page-header">
-        <div class="header-content">
-            <CompactSelector
-                v-if="isStaffUser"
-                :isPermissionBased="true"
-                :hideIfNotMultiple="true"
+    <div class="page-header-container">
+        <div v-if="$matches.phone.only" class="logo-container">
+            <img
+                src="@assets/logos/compact-connect-logo-white.svg"
+                :alt="$t('common.appName')"
+                class="logo"
+                @click="logoClick"
+                @keyup.enter="logoClick"
+                role="button"
+                tabindex="0"
             />
         </div>
-        <div class="nav-container">
-            <PageNav />
+        <div v-if="$matches.phone.only" class="nav-toggle-container">
+            <div
+                class="nav-toggle"
+                :class="{ expanded: $store.state.isNavExpanded }"
+                @click="navToggle"
+                @keyup.enter="navToggle"
+                role="button"
+                tabindex="0"
+                :aria-label="$t('common.toggleNav')"
+            >
+                <span class="middle-bar"></span>
+            </div>
         </div>
     </div>
 </template>
diff --git a/webroot/src/components/Page/PageMainNav/PageMainNav.less b/webroot/src/components/Page/PageMainNav/PageMainNav.less
index 373648d1d..c5327ada9 100644
--- a/webroot/src/components/Page/PageMainNav/PageMainNav.less
+++ b/webroot/src/components/Page/PageMainNav/PageMainNav.less
@@ -5,88 +5,145 @@
 //  Created by InspiringApps on 11/20/2020.
 //
 
+@navAnimation: 0.4s ease-out;
+
 .main-nav-container {
+    position: fixed;
+    top: @appHeaderHeight;
+    left: 0;
+    z-index: 5;
     display: flex;
-    align-items: center;
+    flex-direction: column;
+    width: 0;
+    height: ~"calc(100vh - @{appHeaderHeight})";
+    overflow: hidden;
+    overflow-y: auto;
+    background-color: @primaryColor;
+    transition: width @navAnimation;
 
-    .nav-toggle {
-        width: 3.6rem;
-        cursor: pointer;
+    @media @tabletWidth {
+        top: 0;
+        width: @navPartialExpandWidth;
+        height: 100vh;
+    }
 
-        & > div {
-            width: 100%;
-            height: 0.6rem;
-            border-radius: @borderRadiusSmall;
-            background-color: @primaryColor;
+    .logo-container {
+        width: 100%;
+        max-width: 200px;
+        height: 100px;
+        margin: 1.6rem 0 1.2rem 0;
 
-            &:not(:first-child) {
-                margin-top: 0.6rem;
-            }
+        .logo {
+            display: inline-block;
+            width: 100%;
+            cursor: pointer;
         }
     }
 
-    ul.main-nav {
-        position: absolute;
-        top: 100%;
-        right: 0;
-        z-index: 1;
-        width: 70vw;
-        background-color: @white;
-        box-shadow: -0.8rem 0.8rem 2.0rem 0.4rem fadeout(@black, 90%);
-
-        @media @desktopWidth {
-            position: relative;
-            top: initial;
-            right: initial;
-            display: flex;
-            flex-direction: row;
-            align-items: center;
-            justify-content: flex-end;
-            width: auto;
-            overflow: visible;
-            background-color: transparent;
-            box-shadow: none;
+    &.expanded {
+        width: @navFullExpandWidth;
+
+        .logo-container {
+            width: 100%;
+            max-width: 200px;
         }
+    }
+
+    ul.nav {
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        margin-bottom: 1.6rem;
 
         li {
             display: flex;
             align-items: center;
-            justify-content: center;
             width: 100%;
-            padding: 0 0.6rem;
             cursor: pointer;
 
+            &:hover {
+                background-color: darken(@primaryColor, 4%);
+            }
+
             &.page-nav {
                 a {
-                    padding: 1.2rem;
-                    color: @fontColor;
+                    display: flex;
+                    align-items: center;
+                    padding: 1.2rem 1.6rem; // Bump the left-right padding depending on the @navPartialExpandWidth
+                    border-left: 3px solid transparent;
+                    color: fade(@white, 75%);
+
+                    .link-icon {
+                        pointer-events: none;
+                    }
+
+                    .icon {
+                        width: 2.4rem;
+
+                        &.stroke-type {
+                            fill: none;
+                            stroke: @white;
+                            stroke-opacity: 0.75;
+                        }
+
+                        &.fill-type {
+                            fill: @white;
+                            fill-opacity: 0.75;
+                        }
+                    }
+
+                    .link-label {
+                        margin-left: 1.6rem;
+                        white-space: nowrap;
+                        pointer-events: none;
+                    }
 
                     &.router-link-active {
-                        font-weight: @fontWeightBold;
+                        border-left-color: @white;
+                        color: @white;
+                        font-weight: @fontWeightExtraBold;
+
+                        .icon {
+                            &.stroke-type {
+                                stroke-opacity: 1;
+                            }
+
+                            &.fill-type {
+                                fill-opacity: 1;
+                            }
+                        }
+                    }
+
+                    &:hover .icon {
+                        &.stroke-type {
+                            fill: none;
+                        }
+
+                        &.fill-type {
+                            fill: @white;
+                        }
                     }
                 }
             }
         }
     }
-}
 
-// Nav menu slide transition
-.nav-slide-enter,
-.nav-slide-leave-to {
-    max-height: 0;
-    opacity: 0;
-}
+    .compact-selector {
+        margin: auto 3.2rem 1.6rem 1.6rem;
 
-.nav-slide-enter-to,
-.nav-slide-leave {
-    max-height: 40.0rem;
-    opacity: 1;
-}
-
-.nav-slide-enter-active {
-    transition: all 0.25s linear;
-}
+        &:deep(.select-dropdown) {
+            border-color: @white;
+            border-radius: 0;
+            color: @white;
+            background-color: transparent;
+            background-image: url('@assets/icons/ico-select-arrow-alt.svg');
+        }
+    }
 
-.nav-slide-leave-active {
-    transition: all 0.25s linear;
+    .separator {
+        height: 1px;
+        margin: 1.6rem 10px;
+        background-color: fade(@white, 50%);
+        transition: width @navAnimation;
+    }
 }
diff --git a/webroot/src/components/Page/PageMainNav/PageMainNav.spec.ts b/webroot/src/components/Page/PageMainNav/PageMainNav.spec.ts
index a69d00ac4..f482365fb 100644
--- a/webroot/src/components/Page/PageMainNav/PageMainNav.spec.ts
+++ b/webroot/src/components/Page/PageMainNav/PageMainNav.spec.ts
@@ -44,16 +44,11 @@ describe('PageMainNav component', async () => {
                         return mainNavLinks;
                     }
                 },
-                isDesktop: {
+                isNavExpanded: {
                     get() {
                         return true;
                     }
-                },
-                isMainNavVisible: {
-                    get() {
-                        return true;
-                    }
-                },
+                }
             },
         });
         const links = wrapper.findAll('a');
diff --git a/webroot/src/components/Page/PageMainNav/PageMainNav.ts b/webroot/src/components/Page/PageMainNav/PageMainNav.ts
index f98b2a5ea..8ab408e4c 100644
--- a/webroot/src/components/Page/PageMainNav/PageMainNav.ts
+++ b/webroot/src/components/Page/PageMainNav/PageMainNav.ts
@@ -5,33 +5,58 @@
 //  Created by InspiringApps on 11/20/2020.
 //
 
-import { reactive, computed } from 'vue';
+import {
+    reactive,
+    computed,
+    ComputedRef,
+    markRaw,
+    Raw
+} from 'vue';
 import { Component, Vue, toNative } from 'vue-facing-decorator';
 import { AuthTypes } from '@/app.config';
-import { Compact } from '@models/Compact/Compact.model';
+import UploadIcon from '@components/Icons/Upload/Upload.vue';
+import UsersIcon from '@components/Icons/Users/Users.vue';
+import LicenseSearchIcon from '@components/Icons/LicenseSearch/LicenseSearch.vue';
+import SettingsIcon from '@components/Icons/Settings/Settings.vue';
+import DashboardIcon from '@components/Icons/Dashboard/Dashboard.vue';
+import PurchaseIcon from '@components/Icons/Purchase/Purchase.vue';
+import AccountIcon from '@components/Icons/Account/Account.vue';
+import LogoutIcon from '@components/Icons/Logout/Logout.vue';
+import CompactSelector from '@components/CompactSelector/CompactSelector.vue';
+import { Compact, CompactType } from '@models/Compact/Compact.model';
 import { CompactPermission } from '@models/StaffUser/StaffUser.model';
 
+export interface NavLink {
+    to: string;
+    params?: {
+        compact?: CompactType | null,
+    };
+    label?: string | ComputedRef,
+    iconComponent?: Raw<any>,
+    isEnabled?: boolean,
+    isExternal?: boolean,
+    isExactActive?: boolean,
+}
+
 @Component({
     name: 'PageMainNav',
+    components: {
+        UploadIcon,
+        UsersIcon,
+        LicenseSearchIcon,
+        SettingsIcon,
+        DashboardIcon,
+        PurchaseIcon,
+        AccountIcon,
+        LogoutIcon,
+        CompactSelector,
+    }
 })
 class PageMainNav extends Vue {
-    //
-    // Data
-    //
-    isMainNavToggled = false;
-
     //
     // Computed
     //
-    get isDesktop(): boolean {
-        return this.$matches.desktop.min;
-    }
-
-    get isMobile(): boolean {
-        return !this.isDesktop;
-    }
-
-    get globalStore(): any {
+    get globalStore() {
         return this.$store.state;
     }
 
@@ -39,8 +64,8 @@ class PageMainNav extends Vue {
         return this.globalStore.authType;
     }
 
-    get isMainNavVisible(): boolean {
-        return this.isDesktop || this.isMainNavToggled;
+    get isNavExpanded(): boolean {
+        return this.globalStore.isNavExpanded;
     }
 
     get userStore() {
@@ -102,28 +127,40 @@ class PageMainNav extends Vue {
         return hasWritePermissions;
     }
 
-    get mainLinks() {
+    get mainLinks(): Array<NavLink> {
         return reactive([
             {
-                to: 'Licensing',
+                to: 'StateUpload',
                 params: { compact: this.currentCompact?.type },
-                label: computed(() => this.$t('navigation.licensing')),
-                isEnabled: Boolean(this.currentCompact) && this.isLoggedInAsStaff,
+                label: computed(() => this.$t('navigation.upload')),
+                iconComponent: markRaw(UploadIcon),
+                isEnabled: Boolean(this.currentCompact) && this.hasStateWritePermissions,
+                isExternal: false,
+                isExactActive: true,
+            },
+            {
+                to: 'Users',
+                params: { compact: this.currentCompact?.type },
+                label: computed(() => this.$t('navigation.users')),
+                iconComponent: markRaw(UsersIcon),
+                isEnabled: this.isAnyTypeOfAdmin,
                 isExternal: false,
                 isExactActive: false,
             },
             {
-                to: 'StateUpload',
+                to: 'Licensing',
                 params: { compact: this.currentCompact?.type },
-                label: computed(() => this.$t('navigation.upload')),
-                isEnabled: Boolean(this.currentCompact) && this.hasStateWritePermissions,
+                label: computed(() => this.$t('navigation.licensing')),
+                iconComponent: markRaw(LicenseSearchIcon),
+                isEnabled: Boolean(this.currentCompact) && this.isLoggedInAsStaff,
                 isExternal: false,
-                isExactActive: true,
+                isExactActive: false,
             },
             {
                 to: 'CompactSettings',
                 params: { compact: this.currentCompact?.type },
                 label: computed(() => this.$t('navigation.compactSettings')),
+                iconComponent: markRaw(SettingsIcon),
                 isEnabled: Boolean(this.currentCompact) && this.isCompactAdmin,
                 isExternal: false,
                 isExactActive: false,
@@ -132,28 +169,37 @@ class PageMainNav extends Vue {
                 to: 'LicenseeDashboard',
                 params: { compact: this.currentCompact?.type },
                 label: computed(() => this.$t('navigation.dashboard')),
+                iconComponent: markRaw(DashboardIcon),
                 isEnabled: Boolean(this.currentCompact) && this.isLoggedInAsLicensee,
                 isExternal: false,
                 isExactActive: false,
             },
             {
-                to: 'Account',
-                label: computed(() => this.$t('navigation.account')),
-                isEnabled: this.isLoggedIn,
+                to: 'SelectPrivileges',
+                params: { compact: this.currentCompact?.type },
+                label: computed(() => this.$t('navigation.purchasePrivileges')),
+                iconComponent: markRaw(PurchaseIcon),
+                isEnabled: Boolean(this.currentCompact) && !this.isLoggedInAsStaff,
                 isExternal: false,
                 isExactActive: false,
             },
+        ].filter((link) => link.isEnabled));
+    }
+
+    get myLinks(): Array<NavLink> {
+        return reactive([
             {
-                to: 'Users',
-                params: { compact: this.currentCompact?.type },
-                label: computed(() => this.$t('navigation.users')),
-                isEnabled: this.isAnyTypeOfAdmin,
+                to: 'Account',
+                label: computed(() => this.$t('navigation.account')),
+                iconComponent: markRaw(AccountIcon),
+                isEnabled: this.isLoggedIn,
                 isExternal: false,
                 isExactActive: false,
             },
             {
                 to: 'Logout',
                 label: computed(() => this.$t('navigation.logout')),
+                iconComponent: markRaw(LogoutIcon),
                 isEnabled: this.isLoggedIn,
                 isExternal: false,
                 isExactActive: true,
@@ -164,12 +210,30 @@ class PageMainNav extends Vue {
     //
     // Methods
     //
-    toggleMainNav() {
-        this.isMainNavToggled = !this.isMainNavToggled;
+    logoClick(): void {
+        this.$router.push({ name: 'Home' });
     }
 
-    collapseMainNav() {
-        this.isMainNavToggled = false;
+    navToggle(): void {
+        if (this.globalStore.isNavExpanded) {
+            this.$store.dispatch('collapseNavMenu');
+        } else {
+            this.$store.dispatch('expandNavMenu');
+        }
+    }
+
+    navExpand(): void {
+        this.$store.dispatch('expandNavMenu');
+    }
+
+    navCollapse(): void {
+        this.$store.dispatch('collapseNavMenu');
+    }
+
+    clickOutside(event): void {
+        if (!event.target.closest('.main-nav-container, .nav-toggle')) {
+            this.navCollapse();
+        }
     }
 }
 
diff --git a/webroot/src/components/Page/PageMainNav/PageMainNav.vue b/webroot/src/components/Page/PageMainNav/PageMainNav.vue
index b29738682..6a048bea6 100644
--- a/webroot/src/components/Page/PageMainNav/PageMainNav.vue
+++ b/webroot/src/components/Page/PageMainNav/PageMainNav.vue
@@ -6,40 +6,106 @@
 -->
 
 <template>
-    <div v-if="mainLinks.length" class="main-nav-container" v-click-outside="collapseMainNav">
-        <div v-if="isMobile" class="nav-toggle" @click="toggleMainNav" @keyup.enter="toggleMainNav">
-            <div></div>
-            <div></div>
-            <div></div>
+    <div
+        v-if="mainLinks.length"
+        class="main-nav-container"
+        :class="{ expanded: isNavExpanded }"
+        @mouseenter="!$matches.phone.only && navExpand($event)"
+        @focusin="!$matches.phone.only && navExpand()"
+        @mouseleave="!$matches.phone.only && navCollapse($event)"
+        @focusout="!$matches.phone.only && navCollapse()"
+        v-click-outside="clickOutside"
+    >
+        <div v-if="$matches.tablet.min" class="logo-container">
+            <img
+                src="@assets/logos/compact-connect-logo-white.svg"
+                :alt="$t('common.appName')"
+                class="logo"
+                @click="logoClick"
+                @keyup.enter="logoClick"
+                role="button"
+                :aria-label="$t('common.appName')"
+                tabindex="0"
+            />
         </div>
-        <transition name="nav-slide">
-            <ul v-if="isMainNavVisible" class="main-nav" @click="toggleMainNav" @keyup.enter="toggleMainNav">
-                <li v-for="link in mainLinks" :key="link.label" class="page-nav main-links">
-                    <!-- Internal links that should only have active style if the route path matches exactly -->
-                    <router-link v-if="!link.isExternal && link.isExactActive"
-                        :to="{ name: link.to, params: link.params || {}}"
-                        exact
-                    >
-                        {{ link.label }}
-                    </router-link>
-                    <!-- All other internal links -->
-                    <router-link v-else-if="!link.isExternal"
-                        :to="{ name: link.to, params: link.params || {}}"
-                    >
-                        {{ link.label }}
-                    </router-link>
-                    <!-- External links (to another domain) -->
-                    <a v-else
-                        :href="link.to"
-                        class="external-link"
-                        target="_blank"
-                        rel="noopener noreferrer"
-                    >
-                        {{ link.label }}
-                    </a>
-                </li>
-            </ul>
-        </transition>
+        <ul class="nav main-nav">
+            <li v-for="link in mainLinks" :key="link.label" class="page-nav main-links">
+                <!-- Internal links that should only have active style if the route path matches exactly -->
+                <router-link v-if="!link.isExternal && link.isExactActive"
+                    :to="{ name: link.to, params: link.params || {}}"
+                    exact
+                    :aria-label="link.label"
+                    tabindex="0"
+                >
+                    <component v-if="link.iconComponent" :is="link.iconComponent" class="link-icon" />
+                    <span v-if="isNavExpanded" class="link-label">{{ link.label }}</span>
+                </router-link>
+                <!-- All other internal links -->
+                <router-link v-else-if="!link.isExternal"
+                    :to="{ name: link.to, params: link.params || {}}"
+                    :aria-label="link.label"
+                    tabindex="0"
+                >
+                    <component v-if="link.iconComponent" :is="link.iconComponent" class="link-icon" />
+                    <span v-if="isNavExpanded" class="link-label">{{ link.label }}</span>
+                </router-link>
+                <!-- External links (to another domain) -->
+                <a v-else
+                    :href="link.to"
+                    class="external-link"
+                    target="_blank"
+                    rel="noopener noreferrer"
+                    :aria-label="link.label"
+                    tabindex="0"
+                >
+                    <component v-if="link.iconComponent" :is="link.iconComponent" class="link-icon" />
+                    <span v-if="isNavExpanded" class="link-label">{{ link.label }}</span>
+                </a>
+            </li>
+        </ul>
+        <div class="compact-selector">
+            <CompactSelector
+                v-if="isLoggedInAsStaff && isNavExpanded"
+                :isPermissionBased="true"
+                :hideIfNotMultiple="true"
+            />
+        </div>
+        <div class="separator"></div>
+        <ul class="nav my-nav">
+            <li v-for="link in myLinks" :key="link.label" class="page-nav my-links">
+                <!-- Internal links that should only have active style if the route path matches exactly -->
+                <router-link v-if="!link.isExternal && link.isExactActive"
+                    :to="{ name: link.to, params: link.params || {}}"
+                    exact
+                    :aria-label="link.label"
+                    tabindex="0"
+                >
+                    <component v-if="link.iconComponent" :is="link.iconComponent" class="link-icon" />
+                    <span v-if="isNavExpanded" class="link-label">{{ link.label }}</span>
+                </router-link>
+                <!-- All other internal links -->
+                <router-link v-else-if="!link.isExternal"
+                    :to="{ name: link.to, params: link.params || {}}"
+                    :aria-label="link.label"
+                    tabindex="0"
+                >
+                    <component v-if="link.iconComponent" :is="link.iconComponent" class="link-icon" />
+                    <span v-if="isNavExpanded" class="link-label">{{ link.label }}</span>
+                </router-link>
+                <!-- External links (to another domain) -->
+                <a v-else
+                    :href="link.to"
+                    class="external-link"
+                    target="_blank"
+                    rel="noopener noreferrer"
+                    :aria-label="link.label"
+                    tabindex="0"
+                >
+                    <component v-if="link.iconComponent" :is="link.iconComponent" class="link-icon" />
+                    <span v-if="isNavExpanded" class="link-label">{{ link.label }}</span>
+                </a>
+            </li>
+        </ul>
     </div>
 </template>
 
diff --git a/webroot/src/components/PaymentProcessorConfig/PaymentProcessorConfig.ts b/webroot/src/components/PaymentProcessorConfig/PaymentProcessorConfig.ts
index 6f2c9dc6e..aefe58bba 100644
--- a/webroot/src/components/PaymentProcessorConfig/PaymentProcessorConfig.ts
+++ b/webroot/src/components/PaymentProcessorConfig/PaymentProcessorConfig.ts
@@ -9,10 +9,10 @@ import { Component, mixins, toNative } from 'vue-facing-decorator';
 import { reactive, computed } from 'vue';
 import MixinForm from '@components/Forms/_mixins/form.mixin';
 import Card from '@components/Card/Card.vue';
-import MockPopulate from '@components/Forms/MockPopulate/MockPopulate.vue';
 import InputText from '@components/Forms/InputText/InputText.vue';
 import InputPassword from '@components/Forms/InputPassword/InputPassword.vue';
 import InputSubmit from '@components/Forms/InputSubmit/InputSubmit.vue';
+import MockPopulate from '@components/Forms/MockPopulate/MockPopulate.vue';
 import { CompactType, PaymentProcessorConfig as PaymentProcessorPayload } from '@models/Compact/Compact.model';
 import { StaffUser } from '@models/StaffUser/StaffUser.model';
 import { FormInput } from '@models/FormInput/FormInput.model';
diff --git a/webroot/src/components/PrivilegeCard/PrivilegeCard.less b/webroot/src/components/PrivilegeCard/PrivilegeCard.less
index c912e4292..99ea292e4 100644
--- a/webroot/src/components/PrivilegeCard/PrivilegeCard.less
+++ b/webroot/src/components/PrivilegeCard/PrivilegeCard.less
@@ -18,7 +18,7 @@
         border-top-left-radius: 2rem;
         border-top-right-radius: 2rem;
         color: @white;
-        background-color: @darkBlue;
+        background-color: @primaryColor;
 
         .privilege-title {
             font-size: @fontSizeLarge;
diff --git a/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.less b/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.less
index 1ad9f5fb1..825fa8f06 100644
--- a/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.less
+++ b/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.less
@@ -9,40 +9,42 @@
     margin: 0.4rem 0;
     padding: 1rem 1.6rem;
     border-radius: 20px;
-    color: white;
     background-color: @primaryColor;
 
     @media @tabletWidth {
         margin: 1rem 1rem;
     }
 
-    .jurisprudence-modal {
-        :deep(.modal-container) {
-            max-width: 90vw;
-            padding: 2rem;
-
-            @media @tabletWidth {
-                max-width: 60rem;
-                padding: 4rem;
-            }
+    .jurisprudence-check-box {
+        color: @white;
 
-            .jurisprudence-modal-content {
-                padding-top: 1rem;
-                overflow-y: hidden;
-                color: black;
+        :deep(.checkbox-container) {
+            input {
+                &:not(:checked) + .checkbox-replacement::before {
+                    border-color: @white;
+                }
 
-                .action-button-row {
-                    display: flex;
-                    flex-direction: row;
-                    justify-content: flex-end;
-                    margin-top: 4rem;
-                    margin-bottom: -3rem;
+                &:checked + .checkbox-replacement {
+                    &::before {
+                        border-color: @white;
+                    }
 
-                    .understand-button {
-                        margin-left: 1rem;
+                    &::after {
+                        background-color: @white;
                     }
                 }
             }
+
+            label {
+                margin-left: 1rem;
+                color: @white;
+                font-weight: @fontWeightLight;
+                font-size: 1.3rem;
+
+                @media @tabletWidth {
+                    font-size: 1.5rem;
+                }
+            }
         }
     }
 
@@ -51,6 +53,7 @@
         flex-direction: row;
         justify-content: space-between;
         margin: 1rem 0;
+        color: @white;
 
         :deep(.input-button-container) {
             &.input-container {
@@ -81,6 +84,12 @@
                 font-size: @fontSizeLarger;
             }
         }
+
+        .deselect-state {
+            padding-right: 1rem;
+            padding-left: 1rem;
+            cursor: pointer;
+        }
     }
 
     .collapse-button-container {
@@ -97,16 +106,29 @@
         }
     }
 
-    .jurisprudence-check-box {
-        :deep(.checkbox-container) {
-            label {
-                margin-left: 1rem;
-                color: white;
-                font-weight: @fontWeightLight;
-                font-size: 1.3rem;
+    .jurisprudence-modal {
+        :deep(.modal-container) {
+            max-width: 90vw;
+            padding: 2rem;
 
-                @media @tabletWidth {
-                    font-size: 1.5rem;
+            @media @tabletWidth {
+                max-width: 60rem;
+                padding: 4rem;
+            }
+
+            .jurisprudence-modal-content {
+                padding-top: 1rem;
+                // overflow-y: hidden;
+
+                .action-button-row {
+                    display: flex;
+                    flex-direction: row;
+                    justify-content: flex-end;
+                    margin-top: 4rem;
+
+                    .understand-button {
+                        margin-left: 1rem;
+                    }
                 }
             }
         }
diff --git a/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.ts b/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.ts
index d6505f04d..2e4706b8d 100644
--- a/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.ts
+++ b/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.ts
@@ -183,7 +183,7 @@ class SelectedStatePurchaseInformation extends mixins(MixinForm) {
         this.formData = reactive(initFormData);
     }
 
-    handleJurisprudenceClicked() {
+    handleJurisprudenceClicked(): void {
         const newValue = this.jurisprudenceCheckInput?.value;
 
         if (newValue) {
@@ -194,13 +194,13 @@ class SelectedStatePurchaseInformation extends mixins(MixinForm) {
         }
     }
 
-    deselectState() {
+    deselectState(): void {
         const stateAbbrev = this.selectedStatePurchaseData?.jurisdiction?.abbrev;
 
         this.$emit('exOutState', stateAbbrev);
     }
 
-    submitUnderstanding() {
+    submitUnderstanding(): void {
         const { isJurisprudencePending, jurisprudenceCheckInput } = this;
 
         if (isJurisprudencePending && jurisprudenceCheckInput) {
@@ -210,7 +210,7 @@ class SelectedStatePurchaseInformation extends mixins(MixinForm) {
         }
     }
 
-    closeAndInvalidateCheckbox() {
+    closeAndInvalidateCheckbox(): void {
         const { isJurisprudencePending, jurisprudenceCheckInput } = this;
 
         if (isJurisprudencePending && jurisprudenceCheckInput) {
@@ -220,15 +220,32 @@ class SelectedStatePurchaseInformation extends mixins(MixinForm) {
         }
     }
 
-    setJurisprudenceInputValue(newValue) {
+    setJurisprudenceInputValue(newValue): void {
         if (this.jurisprudenceCheckInput) {
             (this.jurisprudenceCheckInput.value as any) = newValue; // any use required here because of outstanding ts bug regarding union type inference
         }
     }
 
-    togglePriceCollapsed() {
+    togglePriceCollapsed(): void {
         this.isPriceCollapsed = !this.isPriceCollapsed;
     }
+
+    focusTrap(event: KeyboardEvent): void {
+        const firstTabIndex = document.getElementById('jurisprudence-modal-back-button');
+        const lastTabIndex = document.getElementById(this.formData.submitUnderstanding.id);
+
+        if (event.shiftKey) {
+            // shift + tab to last input
+            if (document.activeElement === firstTabIndex) {
+                lastTabIndex?.focus();
+                event.preventDefault();
+            }
+        } else if (document.activeElement === lastTabIndex) {
+            // Tab to first input
+            firstTabIndex?.focus();
+            event.preventDefault();
+        }
+    }
 }
 
 export default toNative(SelectedStatePurchaseInformation);
diff --git a/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.vue b/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.vue
index e4786235d..ec0088bfe 100644
--- a/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.vue
+++ b/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.vue
@@ -9,13 +9,13 @@
     <li class="selected-state-purchase-info-container">
         <div class="info-row">
             <div class="state-title">{{selectedStatePurchaseData.jurisdiction.name()}}</div>
-            <InputButton
+            <button
                 v-if="!isPriceCollapsed"
-                label="X"
-                :isTextLike="true"
-                aria-label="deselect state"
+                class="deselect-state"
+                :aria-label="$t('licensing.deselectState')"
                 @click="deselectState()"
-            />
+                @keyup.enter="deselectState()"
+            >X</button>
         </div>
         <div v-if="!isPriceCollapsed">
             <div class="info-row sub-row">
@@ -58,6 +58,8 @@
             :showActions="false"
             :title="jurisprudenceModalTitle"
             @close-modal="closeAndInvalidateCheckbox"
+            @keydown.tab="focusTrap($event)"
+            @keyup.esc="closeAndInvalidateCheckbox"
         >
             <template v-slot:content>
                 <div class="jurisprudence-modal-content">
@@ -65,6 +67,7 @@
                     <form @submit.prevent="submitUnderstanding">
                         <div class="action-button-row">
                             <InputButton
+                                id="jurisprudence-modal-back-button"
                                 class="back-button"
                                 :label="backText"
                                 :isTransparent="true"
diff --git a/webroot/src/components/StateUpload/StateUpload.less b/webroot/src/components/StateUpload/StateUpload.less
index 68e3652f7..92e707777 100644
--- a/webroot/src/components/StateUpload/StateUpload.less
+++ b/webroot/src/components/StateUpload/StateUpload.less
@@ -5,95 +5,102 @@
 //  Created by InspiringApps on 6/18/2024.
 //
 
-.state-upload {
-    flex-grow: 1;
+.state-upload-container {
     width: 100%;
 
     @media @desktopWidth {
         width: 50%;
-        max-width: 60rem;
+        max-width: 56rem;
     }
 
-    .state-upload-form {
-        display: flex;
-        flex-basis: 100%;
-        flex-direction: column;
-        align-items: flex-start;
+    .state-upload {
+        width: 100%;
+        margin-top: 2rem;
 
-        .sub-title {
-            font-style: italic;
-        }
-
-        .state-upload-form-container {
+        .state-upload-form {
             display: flex;
-            flex-grow: 1;
-            margin-top: 4.8rem;
+            flex-basis: 100%;
+            flex-direction: column;
+            align-items: flex-start;
 
-            .state-select {
-                width: 20rem;
+            .sub-title {
+                font-style: italic;
             }
 
-            .compact-select {
-                width: 25.4rem;
+            .state-upload-form-container {
+                display: flex;
+                flex-grow: 1;
+
+                .state-select {
+                    width: 20rem;
+                }
+
+                .compact-select {
+                    width: 25.4rem;
+                }
+
+                .input-submit-container {
+                    margin-top: 8rem;
+                }
             }
 
-            .input-submit-container {
-                margin-top: auto;
+            form {
+                display: flex;
+                flex-direction: column;
+                flex-grow: 1;
             }
         }
 
-        form {
+        .state-upload-success {
             display: flex;
             flex-direction: column;
             flex-grow: 1;
-        }
-    }
-
-    .state-upload-success {
-        display: flex;
-        flex-direction: column;
-        flex-grow: 1;
-        align-items: center;
-        justify-content: center;
-        padding: 0 0.8rem;
-        text-align: center;
-
-        .icon-container {
-            display: flex;
             align-items: center;
             justify-content: center;
-            width: 6.4rem;
-            height: 6.4rem;
-            margin-bottom: 1.6rem;
-            border-radius: 50%;
-            overflow: hidden;
-            background-color: @primaryColor;
-
-            .icon-check-circle {
-                width: 100%;
-                fill: @white;
-            }
-        }
+            padding: 1.6rem 0.8rem;
+            text-align: center;
+
+            .icon-container {
+                display: flex;
+                align-items: center;
+                justify-content: center;
+                width: 6.4rem;
+                height: 6.4rem;
+                margin-bottom: 1.6rem;
+                border-radius: 50%;
+                overflow: hidden;
+                background-color: @lightGreen;
 
-        .success-actions {
-            display: flex;
-            flex-direction: column;
-            justify-content: center;
-            width: 100%;
-            margin-top: 2.4rem;
+                .icon-check-circle {
+                    width: 100%;
+                    fill: @white;
+                }
+            }
 
-            @media @desktopWidth {
-                flex-direction: row;
+            .success-subtitle {
+                margin-top: 1.2rem;
             }
 
-            .success-btn {
-                margin-bottom: 1.6rem;
-                padding-top: 1rem;
-                padding-bottom: 1rem;
+            .success-actions {
+                display: flex;
+                flex-direction: column;
+                justify-content: center;
+                width: 100%;
+                margin-top: 4rem;
 
                 @media @desktopWidth {
-                    &:first-child {
-                        margin-right: 1.2rem;
+                    flex-direction: row;
+                }
+
+                .success-btn {
+                    margin-bottom: 1.6rem;
+                    padding-top: 1rem;
+                    padding-bottom: 1rem;
+
+                    @media @desktopWidth {
+                        &:first-child {
+                            margin-right: 1.2rem;
+                        }
                     }
                 }
             }
diff --git a/webroot/src/components/StateUpload/StateUpload.ts b/webroot/src/components/StateUpload/StateUpload.ts
index 7247ce8fb..9f4ef400d 100644
--- a/webroot/src/components/StateUpload/StateUpload.ts
+++ b/webroot/src/components/StateUpload/StateUpload.ts
@@ -15,12 +15,12 @@ import { reactive, computed, ComputedRef } from 'vue';
 import { uploadTypes } from '@/app.config';
 import MixinForm from '@components/Forms/_mixins/form.mixin';
 import Card from '@components/Card/Card.vue';
-import MockPopulate from '@components/Forms/MockPopulate/MockPopulate.vue';
 import InputSelect from '@components/Forms/InputSelect/InputSelect.vue';
 import InputFile from '@components/Forms/InputFile/InputFile.vue';
 import InputSubmit from '@components/Forms/InputSubmit/InputSubmit.vue';
 import CheckCircle from '@components/Icons/CheckCircle/CheckCircle.vue';
 import LoadingSpinner from '@components/LoadingSpinner/LoadingSpinner.vue';
+import MockPopulate from '@components/Forms/MockPopulate/MockPopulate.vue';
 import { CompactType } from '@models/Compact/Compact.model';
 import { StaffUser } from '@models/StaffUser/StaffUser.model';
 import { FormInput } from '@models/FormInput/FormInput.model';
diff --git a/webroot/src/components/StateUpload/StateUpload.vue b/webroot/src/components/StateUpload/StateUpload.vue
index b88983296..317697dd7 100644
--- a/webroot/src/components/StateUpload/StateUpload.vue
+++ b/webroot/src/components/StateUpload/StateUpload.vue
@@ -6,37 +6,40 @@
 -->
 
 <template>
-    <Card class="state-upload">
-        <Transition name="fade" :mode="elementTransitionMode">
-            <LoadingSpinner v-if="isInitializing" />
-            <div v-else-if="!isFormSuccessful" class="state-upload-form">
-                <h1>{{ $t('stateUpload.formTitle') }}</h1>
-                <div class="sub-title">{{ $t('stateUpload.formSubtext') }}</div>
-                <MockPopulate :isEnabled="isMockPopulateEnabled" @selected="mockPopulate" />
-                <div class="state-upload-form-container">
-                    <form @submit.prevent="handleSubmit">
-                        <InputSelect :formInput="formData.state" class="state-select" />
-                        <InputFile :formInput="formData.files" class="file-select" />
-                        <InputSubmit
-                            :formInput="formData.submit"
-                            :label="submitLabel"
-                            :isEnabled="!isFormLoading"
-                        />
-                    </form>
+    <div class="state-upload-container">
+        <h1>{{ $t('stateUpload.formTitle') }}</h1>
+        <div class="sub-title">{{ $t('stateUpload.formSubtext') }}</div>
+        <Card class="state-upload">
+            <Transition name="fade" :mode="elementTransitionMode">
+                <LoadingSpinner v-if="isInitializing" />
+                <div v-else-if="!isFormSuccessful" class="state-upload-form">
+                    <MockPopulate :isEnabled="isMockPopulateEnabled" @selected="mockPopulate" />
+                    <div class="state-upload-form-container">
+                        <form @submit.prevent="handleSubmit">
+                            <InputSelect :formInput="formData.state" class="state-select" />
+                            <InputFile :formInput="formData.files" class="file-select" />
+                            <InputSubmit
+                                :formInput="formData.submit"
+                                :label="submitLabel"
+                                :isEnabled="!isFormLoading"
+                            />
+                        </form>
+                    </div>
                 </div>
-            </div>
-            <div v-else class="state-upload-success">
-                <div class="icon-container">
-                    <CheckCircle />
+                <div v-else class="state-upload-success">
+                    <div class="icon-container">
+                        <CheckCircle />
+                    </div>
+                    <h1 class="success-title">{{ $t('stateUpload.successTitle') }}</h1>
+                    <div class="success-subtitle">{{ $t('stateUpload.successSubTitle') }}</div>
+                    <div class="success-actions">
+                        <button class="success-btn transparent" @click="resetForm">Upload another</button>
+                        <button class="success-btn" @click="resetForm">Done</button>
+                    </div>
                 </div>
-                <h1>{{ $t('stateUpload.successTitle') }}</h1>
-                <div class="success-actions">
-                    <button class="success-btn transparent" @click="resetForm">Upload another</button>
-                    <button class="success-btn" @click="resetForm">Done</button>
-                </div>
-            </div>
-        </Transition>
-    </Card>
+            </Transition>
+        </Card>
+    </div>
 </template>
 
 <script lang="ts" src="./StateUpload.ts"></script>
diff --git a/webroot/src/components/Users/UserInvite/UserInvite.less b/webroot/src/components/Users/UserInvite/UserInvite.less
index 59e0467eb..616cc00e2 100644
--- a/webroot/src/components/Users/UserInvite/UserInvite.less
+++ b/webroot/src/components/Users/UserInvite/UserInvite.less
@@ -63,7 +63,7 @@
     .row-separator {
         width: 100%;
         height: 2px;
-        margin-top: -32px;
+        margin-top: -10px;
         background-color: @lightGrey;
     }
 
diff --git a/webroot/src/components/Users/UserInvite/UserInvite.ts b/webroot/src/components/Users/UserInvite/UserInvite.ts
index d2c9916d2..becf5eb97 100644
--- a/webroot/src/components/Users/UserInvite/UserInvite.ts
+++ b/webroot/src/components/Users/UserInvite/UserInvite.ts
@@ -9,12 +9,12 @@ import { Component, mixins, toNative } from 'vue-facing-decorator';
 import { reactive, computed, ComputedRef } from 'vue';
 import MixinForm from '@components/Forms/_mixins/form.mixin';
 import Card from '@components/Card/Card.vue';
-import MockPopulate from '@components/Forms/MockPopulate/MockPopulate.vue';
 import InputText from '@components/Forms/InputText/InputText.vue';
 import InputSelect from '@components/Forms/InputSelect/InputSelect.vue';
 import InputButton from '@components/Forms/InputButton/InputButton.vue';
 import InputSubmit from '@components/Forms/InputSubmit/InputSubmit.vue';
 import LoadingSpinner from '@components/LoadingSpinner/LoadingSpinner.vue';
+import MockPopulate from '@components/Forms/MockPopulate/MockPopulate.vue';
 import { Compact } from '@models/Compact/Compact.model';
 import { State } from '@models/State/State.model';
 import {
@@ -482,6 +482,7 @@ class UserInvite extends mixins(MixinForm) {
         this.formData.email.value = `test@example.com`;
         this.formData.firstName.value = `Test`;
         this.formData.lastName.value = `User`;
+        this.validateAll({ asTouched: true });
     }
 }
 
diff --git a/webroot/src/components/Users/UserList/UserList.less b/webroot/src/components/Users/UserList/UserList.less
index 4d05ee371..352c341ec 100644
--- a/webroot/src/components/Users/UserList/UserList.less
+++ b/webroot/src/components/Users/UserList/UserList.less
@@ -6,41 +6,31 @@
 //
 
 .user-list-container {
-    background-color: @white;
+    background-color: transparent;
 
-    .list-actions-container {
-        display: flex;
-        flex-direction: column;
-        width: 100%;
-        padding-bottom: 1.2rem;
+    .search-container {
+        margin-top: 1.2rem;
 
         @media @desktopWidth {
-            flex-direction: row;
+            margin-top: 0;
         }
 
-        .search-container {
-            width: 100%;
-            max-width: 80rem;
-
-            @media @desktopWidth {
-                width: 50%;
-            }
-
-            .user-search-submit {
-                .visually-hidden();
-            }
+        .user-search-submit {
+            .visually-hidden();
         }
+    }
 
-        .invite-button-container {
-            display: flex;
+    .invite-button-container {
+        display: flex;
+        margin-top: 2.4rem;
 
-            @media @desktopWidth {
-                margin-left: auto;
-            }
+        @media @desktopWidth {
+            margin-top: 0;
+            margin-left: 4rem;
+        }
 
-            .invite-user {
-                height: 4.0rem;
-            }
+        .invite-user {
+            height: 4rem;
         }
     }
 
diff --git a/webroot/src/components/Users/UserList/UserList.ts b/webroot/src/components/Users/UserList/UserList.ts
index 99430cc69..d40d9deda 100644
--- a/webroot/src/components/Users/UserList/UserList.ts
+++ b/webroot/src/components/Users/UserList/UserList.ts
@@ -116,6 +116,7 @@ class UserList extends mixins(MixinForm) {
                 name: 'user-search',
                 label: computed(() => this.$t('account.userSearchLabel')),
                 shouldHideLabel: true,
+                shouldHideMargin: true,
                 placeholder: computed(() => this.$t('account.userSearchLabel')),
             }),
         });
diff --git a/webroot/src/components/Users/UserList/UserList.vue b/webroot/src/components/Users/UserList/UserList.vue
index ac45c94dc..fcaf2cac0 100644
--- a/webroot/src/components/Users/UserList/UserList.vue
+++ b/webroot/src/components/Users/UserList/UserList.vue
@@ -7,8 +7,8 @@
 
 <template>
     <div class="user-list-container">
-        <h1 class="list-title">{{ $t('account.usersListTitle') }}</h1>
         <div class="list-actions-container">
+            <h1 class="list-title no-margin">{{ $t('account.usersListTitle') }}</h1>
             <div class="search-container">
                 <form @submit.prevent="handleSearch">
                     <InputSearch :formInput="formData.userSearch" class="user-search" />
diff --git a/webroot/src/components/Users/UserRow/UserRow.less b/webroot/src/components/Users/UserRow/UserRow.less
index bd694740a..80083e694 100644
--- a/webroot/src/components/Users/UserRow/UserRow.less
+++ b/webroot/src/components/Users/UserRow/UserRow.less
@@ -119,7 +119,7 @@
 
     .expanded-content {
         &.active {
-            overflow-clip-margin: 1px;
+            overflow-clip-margin: 2px;
         }
 
         .cell.expand-collapse::before {
@@ -131,6 +131,7 @@
             width: 100%;
             height: 10px;
             background-color: @white;
+            transition: background-color 0.2s ease-out;
             content: "";
         }
 
@@ -150,6 +151,10 @@
         }
     }
 
+    &:hover .cell.expand-collapse::before {
+        background-color: @rowHighlight;
+    }
+
     .modal-mask {
         position: fixed;
         top: 0;
diff --git a/webroot/src/components/Users/UserRowEdit/UserRowEdit.less b/webroot/src/components/Users/UserRowEdit/UserRowEdit.less
index d361f707e..b4c759155 100644
--- a/webroot/src/components/Users/UserRowEdit/UserRowEdit.less
+++ b/webroot/src/components/Users/UserRowEdit/UserRowEdit.less
@@ -59,7 +59,7 @@
     .row-separator {
         width: 100%;
         height: 2px;
-        margin-top: -32px;
+        margin-top: -10px;
         background-color: @lightGrey;
     }
 
diff --git a/webroot/src/locales/en.json b/webroot/src/locales/en.json
index 01d4a28dd..4b3851e92 100644
--- a/webroot/src/locales/en.json
+++ b/webroot/src/locales/en.json
@@ -1,5 +1,6 @@
 {
     "common": {
+        "appName": "Compact Connect",
         "yes": "Yes",
         "no": "No",
         "back": "Back",
@@ -24,6 +25,7 @@
         "save": "Save",
         "saveChanges": "Save changes",
         "sendInvite": "Send invite",
+        "toggleNav": "Toggle nav menu",
         "submit": "Submit",
         "clear": "Clear",
         "success": "Success",
@@ -38,8 +40,6 @@
         "firstName": "First Name",
         "middleName": "Middle Name",
         "lastName": "Last Name",
-        "firstname": "First name",
-        "lastname": "Last name",
         "selection": "Selection",
         "dateOfBirth": "Date of Birth",
         "dateOfBirthShort": "DOB",
@@ -345,11 +345,12 @@
     "navigation": {
         "login": "Login",
         "home": "Home",
-        "upload": "Upload",
-        "licensing": "Licensing",
+        "upload": "Upload data",
+        "licensing": "Search licensing data",
         "dashboard": "Dashboard",
-        "users": "Users",
+        "users": "Manage users",
         "compactSettings": "Compact Settings",
+        "purchasePrivileges": "Privilege purchasing",
         "styleGuide": "Styleguide",
         "account": "Account",
         "logout": "Logout"
@@ -446,19 +447,23 @@
         "formTitle": "Compact data upload",
         "formSubtext": "Current uploads are for test purposes and the data will not be saved permanently",
         "uploadHint": "Only 1 CSV",
-        "successTitle": "Your document has been uploaded successfully"
+        "successTitle": "Your document has been uploaded successfully",
+        "successSubTitle": "If your document encounters any errors during processing you will be notified via email"
     },
     "payment": {
-        "firstNameOnCard": "Enter first name on card",
-        "lastNameOnCard": "Enter last name on card",
         "payment": "Payment",
         "creditCardTitle": "Credit Card",
+        "fullNameOnCard": "Name on card",
+        "enterFullNameOnCard": "Enter name on card",
         "cardNumber": "Card number",
         "cardExpirationMonth": "Expiration month",
         "cardExpirationYear": "Expiration year",
+        "cvv": "CVV",
+        "enterFirstName": "Enter first name",
+        "enterLastName": "Enter last name",
         "billingAddressTitle": "Billing Address",
         "enterStreetAddress": "Enter street address",
-        "apptUnitNumber": "Appt/unit number",
+        "apptUnitNumber": "Apt/unit number",
         "streetAddress": "Street Address",
         "streetAddress2": "Street Address 2",
         "completePurchase": "Complete Purchase",
@@ -483,6 +488,7 @@
         "privileges": "Privileges",
         "noRefundsMessage": "All compact privilege purchases are final. Refunds will not be issued.",
         "ssn": "SSN",
+        "deselectState": "Deselect state",
         "commissionFee": "Commission Fee",
         "jurisdictionFee": "Jurisdiction Fee",
         "adverseActions": "Adverse actions",
diff --git a/webroot/src/locales/es.json b/webroot/src/locales/es.json
index b92b7d055..30fe96e61 100644
--- a/webroot/src/locales/es.json
+++ b/webroot/src/locales/es.json
@@ -1,5 +1,6 @@
 {
     "common": {
+        "appName": "Compact Connect",
         "yes": "Sí",
         "no": "No",
         "back": "Volver",
@@ -23,6 +24,7 @@
         "invite": "Invitar",
         "save": "Guardar",
         "sendInvite": "Enviar invitación",
+        "toggleNav": "Alternar menú de navegación",
         "saveChanges": "Guardar cambios",
         "submit": "Enviar",
         "clear": "Borrar",
@@ -36,10 +38,8 @@
         "loading": "Cargando...",
         "viewing": "Viendo",
         "firstName": "Nombre",
-        "firstname": "Nombre",
         "middleName": "Segundo nombre",
         "lastName": "Apellido",
-        "lastname": "Apellido",
         "selection": "Selección",
         "dateOfBirth": "Fecha de nacimiento",
         "dateOfBirthShort": "Fecha de nacim.",
@@ -350,6 +350,7 @@
         "dashboard": "Panel",
         "users": "Usuarios",
         "compactSettings": "Configuraciones compactas",
+        "purchasePrivileges": "Compras con privilegios",
         "styleGuide": "Guía de estilo",
         "account": "Cuenta",
         "logout": "Cerrar sesión"
@@ -446,23 +447,27 @@
         "formTitle": "Carga de datos compacta",
         "formSubtext": "Las cargas actuales son para fines de prueba y los datos no se guardarán de forma permanente.",
         "uploadHint": "Sólo 1 archivo CSV",
-        "successTitle": "Su documento ha sido subido exitosamente"
+        "successTitle": "Su documento ha sido subido exitosamente",
+        "successSubTitle": "Si su documento encuentra algún error durante el procesamiento, se le notificará por correo electrónico."
     },
     "payment": {
-        "apptUnitNumber": "Número de apto",
         "payment": "Pago",
-        "cardNumber": "Número de tarjeta",
-        "billingAddressTitle": "Dirección de Envio",
         "creditCardTitle": "Tarjeta de Crédito",
+        "fullNameOnCard": "Nombre en la tarjeta",
+        "enterFullNameOnCard": "Introduzca el nombre en la tarjeta",
+        "cardNumber": "Número de tarjeta",
         "cardExpirationMonth": "Mes de vencimiento",
         "cardExpirationYear": "Año de vencimiento",
+        "cvv": "CVV",
+        "enterFirstName": "Introduzca el nombre",
+        "enterLastName": "Introduzca el apellido",
+        "billingAddressTitle": "Dirección de Envio",
         "enterStreetAddress": "Introduzca dirección",
+        "apptUnitNumber": "Número de apto",
         "streetAddress": "Dirección",
         "streetAddress2": "Dirección 2",
         "completePurchase": "Finalizar compra",
-        "expirattionDate": "Fecha de vencimiento",
-        "firstNameOnCard": "Introduzca el nombre en la tarjeta",
-        "lastNameOnCard": "Introduzca el apellido en la tarjeta",
+        "expirationDate": "Fecha de vencimiento",
         "continueToPurchase": "Continuar comprando",
         "compactPrivilegeStateFee": "Quota Estatal de Privilegio Compacto",
         "compactCommissionFee": "Tarifa de Comisión Compacta",
@@ -482,6 +487,7 @@
         "noRefundsMessage": "Todas las compras de privilegios compactos son definitivas. No se emitirán reembolsos.",
         "adverseActions": "Acciones adversas",
         "status": "Estado",
+        "deselectState": "Deseleccionar estado",
         "issueDate": "Fecha de asunto",
         "expireDate": "Fecha de caducidad",
         "expirationDate": "Fecha de caducidad",
diff --git a/webroot/src/pages/Account/Account.less b/webroot/src/pages/Account/Account.less
index 3063bb4a3..f85e77469 100644
--- a/webroot/src/pages/Account/Account.less
+++ b/webroot/src/pages/Account/Account.less
@@ -6,6 +6,12 @@
 //
 
 .account-page-container {
+    padding: 0 1.2rem;
+
+    @media @desktopWidth {
+        padding: 0;
+    }
+
     .account-component-container {
         margin: 3.2rem auto 0 auto;
     }
diff --git a/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.less b/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.less
index a8159bf17..c894e9a2f 100644
--- a/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.less
+++ b/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.less
@@ -76,15 +76,14 @@
             .cost-breakdown-container {
                 display: flex;
                 flex-direction: column;
-                justify-content: space-between;
                 margin-top: 1rem;
                 padding: 2rem;
                 border-radius: 20px;
-                color: white;
-                background-color: @primaryColor;
+                color: @white;
+                background-color: @darkBlue;
 
                 @media @tabletWidth {
-                    width: 32rem;
+                    width: 30rem;
                     margin-top: unset;
                     padding: 8rem 2rem;
                     border-radius: 0 20px 20px 0;
@@ -92,15 +91,42 @@
 
                 @media @desktopWidth {
                     margin-top: 8rem;
-                    padding: 8rem 4rem;
+                }
+
+                .no-refunds-checkbox {
+                    margin-top: auto;
                 }
 
                 :deep(.checkbox-container) {
+                    input {
+                        &:not(:checked) + .checkbox-replacement::before {
+                            border-color: @white;
+                        }
+
+                        &:checked + .checkbox-replacement {
+                            &::before {
+                                border-color: @white;
+                            }
+
+                            &::after {
+                                background-color: @white;
+                            }
+                        }
+
+                        &:focus {
+                            outline: 0;
+                        }
+                    }
+
                     label {
                         margin-left: 1rem;
-                        color: white;
-                        font-weight: @fontWeight;
-                        font-size: 1.5rem;
+                        color: @white;
+                        font-weight: @fontWeightLight;
+                        font-size: 1.3rem;
+
+                        @media @tabletWidth {
+                            font-size: 1.5rem;
+                        }
                     }
                 }
 
@@ -108,7 +134,6 @@
                     .info-row {
                         display: flex;
                         flex-direction: row;
-                        justify-content: space-between;
                         margin: 1rem 0;
 
                         &.purchase-total {
@@ -117,7 +142,15 @@
                         }
 
                         .info-row-label {
-                            max-width: 16rem;
+                            width: 16rem;
+                        }
+
+                        .info-row-amount {
+                            margin-left: auto;
+
+                            @media @desktopWidth {
+                                margin-left: unset;
+                            }
                         }
                     }
 
@@ -131,10 +164,10 @@
             .finalize-purchase-core-container {
                 padding: 2rem;
                 border-radius: 20px;
-                background-color: white;
+                background-color: @white;
 
                 @media @tabletWidth {
-                    width: 42rem;
+                    width: 36rem;
                     margin-top: unset;
                     border-radius: 20px 0 0 20px;
                 }
@@ -174,18 +207,18 @@
 
                         .state-zip-line {
                             display: flex;
-                            flex-direction: row;
+                            flex-direction: column;
                             justify-content: space-between;
 
-                            :deep(.input-container) {
-                                &.no-margin {
-                                    input {
-                                        width: 10rem;
-                                    }
+                            .state-select {
+                                margin-bottom: 1.6rem;
+                            }
 
-                                    select {
-                                        width: 15rem;
-                                    }
+                            @media @desktopWidth {
+                                flex-direction: row;
+
+                                .state-select {
+                                    margin-bottom: 0;
                                 }
                             }
                         }
diff --git a/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.ts b/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.ts
index 7255c8906..e2fa4e51b 100644
--- a/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.ts
+++ b/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.ts
@@ -16,6 +16,7 @@ import InputSelect from '@components/Forms/InputSelect/InputSelect.vue';
 import InputCheckbox from '@components/Forms/InputCheckbox/InputCheckbox.vue';
 import InputCreditCard from '@components/Forms/InputCreditCard/InputCreditCard.vue';
 import InputSubmit from '@components/Forms/InputSubmit/InputSubmit.vue';
+import MockPopulate from '@components/Forms/MockPopulate/MockPopulate.vue';
 import { Compact } from '@models/Compact/Compact.model';
 import { State } from '@models/State/State.model';
 import { FormInput } from '@models/FormInput/FormInput.model';
@@ -26,6 +27,7 @@ import Joi from 'joi';
 @Component({
     name: 'FinalizePrivilegePurchase',
     components: {
+        MockPopulate,
         InputText,
         InputSelect,
         InputCheckbox,
@@ -58,20 +60,24 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
     //
     // Computed
     //
-    get firstNameInputLabel(): string {
-        return this.$t('common.firstname');
+    get userStore(): any {
+        return this.$store.state.user;
     }
 
-    get firstNamePlaceHolderText(): string {
-        return this.$t('payment.firstNameOnCard');
+    get currentCompact(): Compact | null {
+        return this.userStore?.currentCompact || null;
     }
 
-    get lastNameInputLabel(): string {
-        return this.$t('common.lastname');
+    get currentCompactType(): string | null {
+        return this.currentCompact?.type || null;
+    }
+
+    get currentCompactCommissionFee(): number | null {
+        return this.currentCompact?.compactCommissionFee || null;
     }
 
-    get lastNamePlaceHolderText(): string {
-        return this.$t('payment.lastNameOnCard');
+    get arePurchaseAttestationsAccepted(): boolean {
+        return this.userStore.arePurchaseAttestationsAccepted;
     }
 
     get isDesktop(): boolean {
@@ -86,24 +92,44 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         return !this.$matches.tablet.min;
     }
 
-    get cancelText(): string {
-        return this.$t('common.cancel');
+    get paymentTitleText(): string {
+        return this.$t('payment.payment');
     }
 
-    get backText(): string {
-        return this.$t('common.back');
+    get creditCardTitleText(): string {
+        return this.$t('payment.creditCardTitle');
     }
 
-    get submitLabel(): string {
-        return this.$t('payment.completePurchase');
+    get cardNumberLabel(): string {
+        return this.$t('payment.cardNumber');
     }
 
-    get paymentTitleText(): string {
-        return this.$t('payment.payment');
+    get expirationDateText(): string {
+        return this.$t('payment.expirationDate');
     }
 
-    get noRefundsAcknowledgement(): string {
-        return this.$t('licensing.noRefundsMessage');
+    get cvvLabel(): string {
+        return this.$t('payment.cvv');
+    }
+
+    get billingAddressTitleText(): string {
+        return this.$t('payment.billingAddressTitle');
+    }
+
+    get firstNameInputLabel(): string {
+        return this.$t('common.firstName');
+    }
+
+    get firstNamePlaceholderText(): string {
+        return this.$t('payment.enterFirstName');
+    }
+
+    get lastNameInputLabel(): string {
+        return this.$t('common.lastName');
+    }
+
+    get lastNamePlaceholderText(): string {
+        return this.$t('payment.enterLastName');
     }
 
     get streetAddress1Label(): string {
@@ -122,22 +148,10 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         return this.$t('payment.apptUnitNumber');
     }
 
-    get creditCardTitleText(): string {
-        return this.$t('payment.creditCardTitle');
-    }
-
-    get billingAddressTitleText(): string {
-        return this.$t('payment.billingAddressTitle');
-    }
-
     get stateText(): string {
         return this.$t('common.state');
     }
 
-    get cardNumberLabel(): string {
-        return this.$t('payment.cardNumber');
-    }
-
     get stateOptions() {
         const stateOptions = [{ value: '', name: this.$t('common.select') }];
 
@@ -158,22 +172,10 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         return this.$t('common.zipCode');
     }
 
-    get cvvLabel(): string {
-        return 'CVV';
-    }
-
-    get expirationDateText(): string {
-        return this.$t('payment.expirationDate');
-    }
-
     get selectionText(): string {
         return this.$t('common.selection');
     }
 
-    get userStore(): any {
-        return this.$store.state.user;
-    }
-
     get statesSelected(): Array<string> {
         return this.userStore.selectedPrivilegesToPurchase;
     }
@@ -192,7 +194,7 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         });
     }
 
-    get seletedStatePurchaseDsiplayDataList(): Array<object> {
+    get selectedStatePurchaseDisplayDataList(): Array<object> {
         return this.selectedStatePurchaseDataList.map((state) => {
             const stateFeeText = `${state?.jurisdiction?.name()} ${this.compactPrivilegeStateFeeText}`;
             const stateMilitaryPurchaseText = `${state?.jurisdiction?.name()} ${this.militaryDiscountText}`;
@@ -217,26 +219,6 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         });
     }
 
-    get currentCompact(): Compact | null {
-        return this.userStore?.currentCompact || null;
-    }
-
-    get currentCompactType(): string | null {
-        return this.currentCompact?.type || null;
-    }
-
-    get currentCompactCommissionFee(): number | null {
-        return this.currentCompact?.compactCommissionFee || null;
-    }
-
-    get stateFeeText(): string {
-        return this.$t('payment.expirationDate');
-    }
-
-    get arePurchaseAttestationsAccepted(): boolean {
-        return this.userStore.arePurchaseAttestationsAccepted;
-    }
-
     get purchaseDataList(): Array<PrivilegePurchaseOption> {
         return this.currentCompact?.privilegePurchaseOptions || [];
     }
@@ -271,10 +253,6 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         return this.$t('licensing.militaryDiscountText');
     }
 
-    get formValidationErrorMessage(): string {
-        return this.$t('common.formValidationErrorMessage');
-    }
-
     get totalPurchasePrice(): number {
         let total = this.totalCompactCommissionFee;
 
@@ -291,12 +269,6 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         return total;
     }
 
-    get isSubmitEnabled(): boolean {
-        this.checkValidForAll();
-
-        return this.isFormValid && this.formData.noRefunds.value && !this.isFormLoading;
-    }
-
     get totalCompactCommissionFeeDisplay(): string {
         return this.totalCompactCommissionFee?.toFixed(2) || '';
     }
@@ -305,30 +277,48 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         return this.totalPurchasePrice?.toFixed(2) || '';
     }
 
+    get noRefundsAcknowledgement(): string {
+        return this.$t('licensing.noRefundsMessage');
+    }
+
+    get cancelText(): string {
+        return this.$t('common.cancel');
+    }
+
+    get backText(): string {
+        return this.$t('common.back');
+    }
+
+    get submitLabel(): string {
+        return this.$t('payment.completePurchase');
+    }
+
+    get isSubmitEnabled(): boolean {
+        return this.isFormValid && this.formData.noRefunds.value && !this.isFormLoading;
+    }
+
+    get formValidationErrorMessage(): string {
+        return this.$t('common.formValidationErrorMessage');
+    }
+
+    get isMockPopulateEnabled(): boolean {
+        return Boolean(this.$envConfig.isDevelopment);
+    }
+
     //
     // Methods
     //
-    initFormInputs() {
+    initFormInputs(): void {
         this.formData = reactive({
-            firstName: new FormInput({
-                id: 'first-name',
-                name: 'first-name',
-                label: this.firstNameInputLabel,
-                shouldHideLabel: false,
-                shouldHideMargin: true,
-                autocomplete: 'given-name',
-                placeholder: this.firstNamePlaceHolderText,
-                validation: Joi.string().required().messages(this.joiMessages.string),
-            }),
-            lastName: new FormInput({
-                id: 'last-name',
-                name: 'last-name',
-                label: this.lastNameInputLabel,
+            creditCard: new FormInput({
+                id: 'card',
+                name: 'card',
+                label: this.cardNumberLabel,
                 shouldHideLabel: false,
                 shouldHideMargin: true,
-                autocomplete: 'family-name',
-                placeholder: this.lastNamePlaceHolderText,
-                validation: Joi.string().required().messages(this.joiMessages.string),
+                placeholder: '0000 0000 0000 0000',
+                autocomplete: 'cc-number',
+                validation: Joi.string().required().regex(new RegExp('(^[0-9]{4} [0-9]{4} [0-9]{4} [0-9]{4})')).messages(this.joiMessages.creditCard),
             }),
             expMonth: new FormInput({
                 id: 'exp-month',
@@ -366,15 +356,25 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
                 enforceMax: true,
                 validation: Joi.string().required().regex(new RegExp('(^[0-9]{3,4}$)')).max(4),
             }),
-            creditCard: new FormInput({
-                id: 'card',
-                name: 'card',
-                label: this.cardNumberLabel,
+            firstName: new FormInput({
+                id: 'first-name',
+                name: 'first-name',
+                label: this.firstNameInputLabel,
                 shouldHideLabel: false,
                 shouldHideMargin: true,
-                placeholder: '0000 0000 0000 0000',
-                autocomplete: 'cc-number',
-                validation: Joi.string().required().regex(new RegExp('(^[0-9]{4} [0-9]{4} [0-9]{4} [0-9]{4})')).messages(this.joiMessages.creditCard),
+                autocomplete: 'given-name',
+                placeholder: this.firstNamePlaceholderText,
+                validation: Joi.string().required().messages(this.joiMessages.string),
+            }),
+            lastName: new FormInput({
+                id: 'last-name',
+                name: 'last-name',
+                label: this.lastNameInputLabel,
+                shouldHideLabel: false,
+                shouldHideMargin: true,
+                autocomplete: 'family-name',
+                placeholder: this.lastNamePlaceholderText,
+                validation: Joi.string().required().messages(this.joiMessages.string),
             }),
             streetAddress1: new FormInput({
                 id: 'street-address-1',
@@ -395,14 +395,6 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
                 autocomplete: 'address-line2',
                 placeholder: this.streetAddress2PlaceHolderText
             }),
-            noRefunds: new FormInput({
-                id: 'no-refunds-check',
-                name: 'no-refunds-check',
-                label: this.noRefundsAcknowledgement,
-                validation: Joi.boolean().required(),
-                value: false,
-                isDisabled: false
-            }),
             stateSelect: new FormInput({
                 id: 'state-select',
                 name: 'state-select',
@@ -425,6 +417,14 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
                 shouldHideErrorMessage: true,
                 validation: Joi.string().required().regex(new RegExp('(^[0-9]{5}$)|(^[0-9]{5}-[0-9]{4}$)')),
             }),
+            noRefunds: new FormInput({
+                id: 'no-refunds-check',
+                name: 'no-refunds-check',
+                label: this.noRefundsAcknowledgement,
+                validation: Joi.boolean().required(),
+                value: false,
+                isDisabled: false
+            }),
             submit: new FormInput({
                 isSubmitInput: true,
                 id: 'submit',
@@ -433,7 +433,7 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         this.watchFormInputs();
     }
 
-    async handleSubmit() {
+    async handleSubmit(): Promise<void> {
         this.validateAll({ asTouched: true });
 
         if (this.isFormValid) {
@@ -462,7 +462,7 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         }
     }
 
-    handleCancelClicked() {
+    handleCancelClicked(): void {
         if (this.currentCompactType) {
             this.$router.push({
                 name: 'LicenseeDashboard',
@@ -471,7 +471,7 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         }
     }
 
-    handleBackClicked() {
+    handleBackClicked(): void {
         if (this.currentCompactType) {
             this.$router.push({
                 name: 'SelectPrivileges',
@@ -480,15 +480,15 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         }
     }
 
-    handleExpYearRefEmitted(inputData) {
+    handleExpYearRefEmitted(inputData): void {
         this.expYearRef = inputData.ref;
     }
 
-    handleCVVRefEmitted(inputData) {
+    handleCVVRefEmitted(inputData): void {
         this.cvvRef = inputData.ref;
     }
 
-    togglePaymentCollapsed() {
+    togglePaymentCollapsed(): void {
         this.shouldShowPaymentSection = !this.shouldShowPaymentSection;
     }
 
@@ -514,7 +514,7 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         creditCard.value = format(creditCard.value);
     }
 
-    handleExpMonthInput(formInput) {
+    handleExpMonthInput(formInput): void {
         // Remove all non-numerals
         formInput.value = formInput.value.replace(/[^\d]/g, '');
 
@@ -523,7 +523,7 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         }
     }
 
-    handleExpYearInput(formInput) {
+    handleExpYearInput(formInput): void {
         // Remove all non-numerals
         formInput.value = formInput.value.replace(/[^\d]/g, '');
 
@@ -532,13 +532,27 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         }
     }
 
-    handleCVVInput(formInput) {
+    handleCVVInput(formInput): void {
         // Remove all non-numerals
         formInput.value = formInput.value.replace(/[^\d]/g, '');
     }
 
-    handleZipInput(formInput) {
+    handleZipInput(formInput): void {
         // Remove all non-numerals
         formInput.value = formInput.value.replace(/[^\d]/g, '');
     }
+
+    mockPopulate(): void {
+        this.formData.creditCard.value = `5424 0000 0000 0015`;
+        this.formData.expMonth.value = `01`;
+        this.formData.expYear.value = `29`;
+        this.formData.cvv.value = `900`;
+        this.formData.firstName.value = `Test`;
+        this.formData.lastName.value = `User`;
+        this.formData.streetAddress1.value = `123 Fake St`;
+        this.formData.stateSelect.value = `ca`;
+        this.formData.zip.value = `46214`;
+        this.formData.noRefunds.value = true;
+        this.validateAll({ asTouched: true });
+    }
 }
diff --git a/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.vue b/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.vue
index b7cc8e477..14dedbebd 100644
--- a/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.vue
+++ b/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.vue
@@ -11,50 +11,25 @@
             <div class="finalize-purchase-container">
                 <div class="finalize-purchase-core-container">
                     <div class="finalize-purchase-title-row">
-                        <div
-                            class="finalize-purchase-title"
-                        >
-                            {{paymentTitleText}}
-                        </div>
-                        <CollapseCaretButton
-                            v-if="isPhone"
-                            @toggleCollapse="togglePaymentCollapsed"
-                        />
+                        <div class="finalize-purchase-title">{{paymentTitleText}}</div>
+                        <CollapseCaretButton v-if="isPhone" @toggleCollapse="togglePaymentCollapsed" />
                     </div>
+                    <MockPopulate :isEnabled="isMockPopulateEnabled" @selected="mockPopulate" />
                     <div v-if="shouldShowPaymentSection || !isPhone" class="payment-core-form">
                         <div class="credit-card-section">
-                            <div class="credit-card-title">
-                                {{creditCardTitleText}}
-                            </div>
+                            <div class="credit-card-title">{{creditCardTitleText}}</div>
                             <div class="form-row">
-                                <InputText
-                                    :formInput="formData.firstName"
-                                />
-                            </div>
-                            <div class="form-row">
-                                <InputText
-                                    :formInput="formData.lastName"
-                                />
-                            </div>
-                            <div class="form-row">
-                                <InputCreditCard
-                                    :formInput="formData.creditCard"
-                                    @input="formatCreditCard()"
-                                />
+                                <InputCreditCard :formInput="formData.creditCard" @input="formatCreditCard()" />
                             </div>
                             <div class="cc-dets form-row">
                                 <div class="exp-chunk">
-                                    <div class="exp-chunk-title">
-                                        {{expirationDateText}} *
-                                    </div>
+                                    <div class="exp-chunk-title">{{expirationDateText}} *</div>
                                     <div class="exp-chunk-input">
                                         <InputText
                                             :formInput="formData.expMonth"
                                             @input="handleExpMonthInput(formData.expMonth)"
                                         />
-                                        <div class="slash">
-                                            /
-                                        </div>
+                                        <div class="slash">/</div>
                                         <InputText
                                             :formInput="formData.expYear"
                                             @input="handleExpYearInput(formData.expYear)"
@@ -72,23 +47,21 @@
                             </div>
                         </div>
                         <div class="billing-address-section">
-                            <div class="billing-address-title">
-                                {{billingAddressTitleText}}
+                            <div class="billing-address-title">{{billingAddressTitleText}}</div>
+                            <div class="form-row">
+                                <InputText :formInput="formData.firstName" />
                             </div>
                             <div class="form-row">
-                                <InputText
-                                    :formInput="formData.streetAddress1"
-                                />
+                                <InputText :formInput="formData.lastName" />
                             </div>
                             <div class="form-row">
-                                <InputText
-                                    :formInput="formData.streetAddress2"
-                                />
+                                <InputText :formInput="formData.streetAddress1" />
+                            </div>
+                            <div class="form-row">
+                                <InputText :formInput="formData.streetAddress2" />
                             </div>
                             <div class="state-zip-line form-row">
-                                <InputSelect
-                                    :formInput="formData.stateSelect"
-                                />
+                                <InputSelect :formInput="formData.stateSelect" class="state-select" />
                                 <InputText
                                     :formInput="formData.zip"
                                     @input="handleZipInput(formData.cvv)"
@@ -102,43 +75,33 @@
                         <div class="selection-title">{{selectionText}}</div>
                         <ul>
                             <li
-                                v-for="(state) in seletedStatePurchaseDsiplayDataList"
+                                v-for="(state) in selectedStatePurchaseDisplayDataList"
                                 :key="state.jurisdiction.abbrev"
                                 class="selected-state-block"
                             >
                                 <div class="info-row">
-                                    <div class="info-row-label">
-                                        {{state.stateFeeText}}
-                                    </div>
-                                    <div class="expire-date-value">${{state.stateFeeDisplay}}</div>
+                                    <div class="info-row-label">{{state.stateFeeText}}</div>
+                                    <div class="info-row-amount">${{state.stateFeeDisplay}}</div>
                                 </div>
                                 <div v-if="state.isMilitaryDiscountActive" class="info-row">
-                                    <div class="info-row-label">
-                                        {{state.stateMilitaryPurchaseText}}
-                                    </div>
-                                    <div class="expire-date-value">-${{state.stateMilitaryDiscountAmountDisplay}}</div>
+                                    <div class="info-row-label">{{state.stateMilitaryPurchaseText}}</div>
+                                    <div class="info-row-amount">-${{state.stateMilitaryDiscountAmountDisplay}}</div>
                                 </div>
                             </li>
                         </ul>
                         <div class="compact-commission-fee info-row">
-                            <div class="info-row-label">
-                                {{compactCommissionFeeText}}
-                            </div>
-                            <div class="expire-date-value">${{totalCompactCommissionFeeDisplay}}</div>
+                            <div class="info-row-label">{{compactCommissionFeeText}}</div>
+                            <div class="info-row-amount">${{totalCompactCommissionFeeDisplay}}</div>
                         </div>
                         <div class="purchase-total info-row">
-                            <div class="info-row-label total">
-                                {{totalTitle}}
-                            </div>
-                            <div class="expire-date-value total">${{totalPurchasePriceDisplay}}</div>
+                            <div class="info-row-label total">{{totalTitle}}</div>
+                            <div class="info-row-amount total">${{totalPurchasePriceDisplay}}</div>
                         </div>
                     </div>
-                    <InputCheckbox :formInput="formData.noRefunds" />
+                    <InputCheckbox :formInput="formData.noRefunds" class="no-refunds-checkbox" />
                 </div>
             </div>
-            <div v-if="formErrorMessage" class="form-error-message">
-                {{formErrorMessage}}
-            </div>
+            <div v-if="formErrorMessage" class="form-error-message">{{formErrorMessage}}</div>
             <div class="button-row">
                 <InputButton
                     :label="cancelText"
diff --git a/webroot/src/pages/LicensingDetail/LicensingDetail.spec.ts b/webroot/src/pages/LicensingDetail/LicensingDetail.spec.ts
index cc6ea585e..21e371ab4 100644
--- a/webroot/src/pages/LicensingDetail/LicensingDetail.spec.ts
+++ b/webroot/src/pages/LicensingDetail/LicensingDetail.spec.ts
@@ -9,11 +9,13 @@ import { expect } from 'chai';
 import { mountShallow } from '@tests/helpers/setup';
 import mockStore from '@tests/mocks/mockStore';
 import LicensingDetail from '@pages/LicensingDetail/LicensingDetail.vue';
+import { Compact, CompactType } from '@models/Compact/Compact.model';
 
 describe('LicensingDetail page', async () => {
+    before(async () => {
+        await mockStore.dispatch('user/setCurrentCompact', new Compact({ type: CompactType.ASLP }));
+    });
     it('should mount the page component', async () => {
-        mockStore.dispatch('user/setCurrentCompact', 'aslp');
-
         const wrapper = await mountShallow(LicensingDetail);
 
         expect(wrapper.exists()).to.equal(true);
diff --git a/webroot/src/pages/LicensingList/LicensingList.less b/webroot/src/pages/LicensingList/LicensingList.less
index 4d00eae8f..a109e9b4a 100644
--- a/webroot/src/pages/LicensingList/LicensingList.less
+++ b/webroot/src/pages/LicensingList/LicensingList.less
@@ -7,7 +7,6 @@
 
 .licensing-list-section {
     padding: 3.2rem 2.4rem;
-    background-color: @white;
 
     @media @desktopWidth {
         padding: 3.2rem 6.4rem;
diff --git a/webroot/src/pages/SelectPrivileges/SelectPrivileges.less b/webroot/src/pages/SelectPrivileges/SelectPrivileges.less
index ddc9b0ea1..27f78ac5c 100644
--- a/webroot/src/pages/SelectPrivileges/SelectPrivileges.less
+++ b/webroot/src/pages/SelectPrivileges/SelectPrivileges.less
@@ -126,12 +126,17 @@
                             margin: 0.4rem;
                             padding: 0 1rem;
                             border: 1px solid @lightGrey;
-                            border-radius: 10px;
+                            border-radius: 12px;
 
                             @media @tabletWidth {
                                 margin: 1rem;
                             }
 
+                            &.selected {
+                                border-color: @fontColor;
+                                background-color: @veryLightBlue;
+                            }
+
                             :deep(.checkbox-container) {
                                 label {
                                     padding: 0 5rem 0 0.4rem;
@@ -145,7 +150,7 @@
                                 width: 100%;
                                 height: 100%;
                                 margin: 0 -1rem;
-                                border-radius: 10px;
+                                border-radius: 12px;
                                 cursor: pointer;
                                 opacity: 0.5;
                             }
@@ -156,7 +161,7 @@
                                 width: 100%;
                                 height: 100%;
                                 margin: 0 -1rem;
-                                border-radius: 10px;
+                                border-radius: 12px;
                                 background-color: @lightGrey;
                                 cursor: not-allowed;
                                 opacity: 0.5;
diff --git a/webroot/src/pages/SelectPrivileges/SelectPrivileges.vue b/webroot/src/pages/SelectPrivileges/SelectPrivileges.vue
index 74352d221..bbfa5a522 100644
--- a/webroot/src/pages/SelectPrivileges/SelectPrivileges.vue
+++ b/webroot/src/pages/SelectPrivileges/SelectPrivileges.vue
@@ -28,6 +28,7 @@
                             <div
                                 v-else
                                 class="state-select-unit"
+                                :class="{ selected: state.value }"
                             >
                                 <div
                                     @click.prevent="toggleStateSelected(state)"
@@ -39,16 +40,18 @@
                                     :formInput="state"
                                 />
                             </div>
-                            <SelectedStatePurchaseInformation
-                                v-if="isPhone && findStatePurchaseInformation(state)"
-                                class="selected-state-block"
-                                :selectedStatePurchaseData="findStatePurchaseInformation(state)"
-                                :jurisprudenceCheckInput="formData.jurisprudenceConfirmations[state.id]"
-                                @exOutState="deselectState"
-                            />
+                            <Transition name="fade">
+                                <SelectedStatePurchaseInformation
+                                    v-if="isPhone && findStatePurchaseInformation(state)"
+                                    class="selected-state-block"
+                                    :selectedStatePurchaseData="findStatePurchaseInformation(state)"
+                                    :jurisprudenceCheckInput="formData.jurisprudenceConfirmations[state.id]"
+                                    @exOutState="deselectState"
+                                />
+                            </Transition>
                         </li>
                     </ul>
-                    <ul v-if="!isPhone" class="selected-state-list">
+                    <TransitionGroup tag="ul" name="list" v-if="!isPhone" class="selected-state-list">
                         <SelectedStatePurchaseInformation
                             v-for="(state) in selectedStatePurchaseDataList"
                             :key="state.jurisdiction.abbrev"
@@ -57,7 +60,7 @@
                             :jurisprudenceCheckInput="formData.jurisprudenceConfirmations[state.jurisdiction.abbrev]"
                             @exOutState="deselectState"
                         />
-                    </ul>
+                    </TransitionGroup>
                 </div>
             </div>
             <div class="button-row">
diff --git a/webroot/src/pages/StateUpload/StateUpload.less b/webroot/src/pages/StateUpload/StateUpload.less
index 71fc7fa0e..a86e21357 100644
--- a/webroot/src/pages/StateUpload/StateUpload.less
+++ b/webroot/src/pages/StateUpload/StateUpload.less
@@ -5,12 +5,16 @@
 //  Created by InspiringApps on 8/19/2024.
 //
 
-.state-upload-container {
+.state-upload-page-container {
+    justify-content: center;
+    min-height: ~"calc(100vh - @{appHeaderHeight} - @{appFooterHeight} - 2rem)";
+    padding: 0 2.4rem;
+
+    @media @desktopWidth {
+        padding: 0;
+    }
+
     .state-upload-component-container {
         margin: 0 auto;
-
-        @media @desktopWidth {
-            margin-top: 4.8rem;
-        }
     }
 }
diff --git a/webroot/src/pages/StateUpload/StateUpload.vue b/webroot/src/pages/StateUpload/StateUpload.vue
index d866fe5e0..aeba0edb2 100644
--- a/webroot/src/pages/StateUpload/StateUpload.vue
+++ b/webroot/src/pages/StateUpload/StateUpload.vue
@@ -6,7 +6,7 @@
 -->
 
 <template>
-    <Section class="state-upload-container">
+    <Section class="state-upload-page-container">
         <StateUpload class="state-upload-component-container" />
     </Section>
 </template>
diff --git a/webroot/src/pages/UserList/UserList.less b/webroot/src/pages/UserList/UserList.less
index 4e6a2738f..cb323cacf 100644
--- a/webroot/src/pages/UserList/UserList.less
+++ b/webroot/src/pages/UserList/UserList.less
@@ -7,7 +7,6 @@
 
 .user-list-section {
     padding: 3.2rem 2.4rem;
-    background-color: @white;
 
     @media @desktopWidth {
         padding: 3.2rem 6.4rem;
diff --git a/webroot/src/router/index.ts b/webroot/src/router/index.ts
index a23234c38..ebdbfd234 100644
--- a/webroot/src/router/index.ts
+++ b/webroot/src/router/index.ts
@@ -61,4 +61,10 @@ router.beforeEach(async (to, from, next) => {
     }
 });
 
+router.afterEach(() => {
+    if (window.innerWidth < 770) {
+        store.dispatch('collapseNavMenu');
+    }
+});
+
 export default router;
diff --git a/webroot/src/store/global/global.actions.ts b/webroot/src/store/global/global.actions.ts
index 81b8eb427..d82f29be7 100644
--- a/webroot/src/store/global/global.actions.ts
+++ b/webroot/src/store/global/global.actions.ts
@@ -33,4 +33,10 @@ export default {
     setAuthType: ({ commit }, type) => {
         commit(MutationTypes.SET_AUTH_TYPE, type);
     },
+    expandNavMenu: ({ commit }) => {
+        commit(MutationTypes.EXPAND_NAV_MENU);
+    },
+    collapseNavMenu: ({ commit }) => {
+        commit(MutationTypes.COLLAPSE_NAV_MENU);
+    },
 };
diff --git a/webroot/src/store/global/global.mutations.ts b/webroot/src/store/global/global.mutations.ts
index 2a341efa3..9576b065b 100644
--- a/webroot/src/store/global/global.mutations.ts
+++ b/webroot/src/store/global/global.mutations.ts
@@ -20,6 +20,8 @@ export enum MutationTypes {
     SET_MODAL_OPEN = '[Global] Modal isOpen set',
     SET_MODAL_LOGOUT_ONLY = '[Global] Modal isLogoutOnly set',
     SET_AUTH_TYPE = '[Global] Auth type set',
+    EXPAND_NAV_MENU = '[Global] Expand nav menu',
+    COLLAPSE_NAV_MENU = '[Global] Collapse nav menu',
 }
 
 export default {
@@ -55,4 +57,10 @@ export default {
     [MutationTypes.SET_AUTH_TYPE]: (state: State, type: AuthTypes) => {
         state.authType = type;
     },
+    [MutationTypes.EXPAND_NAV_MENU]: (state: State) => {
+        state.isNavExpanded = true;
+    },
+    [MutationTypes.COLLAPSE_NAV_MENU]: (state: State) => {
+        state.isNavExpanded = false;
+    },
 };
diff --git a/webroot/src/store/global/global.spec.ts b/webroot/src/store/global/global.spec.ts
index 14c763907..f3fdd758b 100644
--- a/webroot/src/store/global/global.spec.ts
+++ b/webroot/src/store/global/global.spec.ts
@@ -107,6 +107,20 @@ describe('Global Store Mutations', () => {
 
         expect(state.authType).to.equal(authType);
     });
+    it('should successfully set nav menu expand', () => {
+        const state = {};
+
+        mutations[MutationTypes.EXPAND_NAV_MENU](state);
+
+        expect(state.isNavExpanded).to.equal(true);
+    });
+    it('should successfully set nav menu collapse', () => {
+        const state = {};
+
+        mutations[MutationTypes.COLLAPSE_NAV_MENU](state);
+
+        expect(state.isNavExpanded).to.equal(false);
+    });
 });
 describe('Global Store Actions', () => {
     it('should successfully start store loading', () => {
@@ -177,4 +191,20 @@ describe('Global Store Actions', () => {
         expect(commit.calledOnce).to.equal(true);
         expect(commit.firstCall.args).to.matchPattern([MutationTypes.SET_AUTH_TYPE, authType]);
     });
+    it('should successfully set nav menu expand', () => {
+        const commit = sinon.spy();
+
+        actions.expandNavMenu({ commit });
+
+        expect(commit.calledOnce).to.equal(true);
+        expect(commit.firstCall.args).to.matchPattern([MutationTypes.EXPAND_NAV_MENU]);
+    });
+    it('should successfully set nav menu collapse', () => {
+        const commit = sinon.spy();
+
+        actions.collapseNavMenu({ commit });
+
+        expect(commit.calledOnce).to.equal(true);
+        expect(commit.firstCall.args).to.matchPattern([MutationTypes.COLLAPSE_NAV_MENU]);
+    });
 });
diff --git a/webroot/src/store/global/global.state.ts b/webroot/src/store/global/global.state.ts
index 31995159d..a100e9f4c 100644
--- a/webroot/src/store/global/global.state.ts
+++ b/webroot/src/store/global/global.state.ts
@@ -14,6 +14,7 @@ export interface State {
     isModalOpen: boolean;
     isModalLogoutOnly: boolean;
     authType: AuthTypes;
+    isNavExpanded: boolean;
 }
 
 export const state: State = {
@@ -23,4 +24,5 @@ export const state: State = {
     isModalOpen: false,
     isModalLogoutOnly: false,
     authType: AuthTypes.PUBLIC,
+    isNavExpanded: false,
 };
diff --git a/webroot/src/styles.common/_colors.less b/webroot/src/styles.common/_colors.less
index feee7f520..5f74b7a26 100644
--- a/webroot/src/styles.common/_colors.less
+++ b/webroot/src/styles.common/_colors.less
@@ -16,23 +16,24 @@
 @midGrey: @__grey;
 @darkGrey: #7b7b7b;
 @veryDarkGrey: #4a4a4a;
+@ambientGrey: #f5f6f8;
 @lightGrey: #c8c8c8;
 @veryLightGrey: #f0f2f5;
 @lightTextGrey: #757575; // WCAG AA compliant
 
 // Blues
-@__blue: #1C7CB0; // WCAG AA compliant
+@__blue: #2459A9;
 @midBlue: @__blue;
 @midBlueWcagAA: ;
-@darkBlue: darken(@midBlue, 15%);
-@lightBlue: lighten(@midBlue, 40%);
-@veryLightBlue: lighten(@midBlue, 55%);
+@darkBlue: #1e2f5e;
+@lightBlue: #d1ecf8;
+@veryLightBlue: #f6f9ff;
 
 // Greens
-@__green: #359444;
+@__green: #288737;
 @midGreen: @__green;
 @darkGreen: darken(@midGreen, 15%);
-@lightGreen: lighten(@midGreen, 40%);
+@lightGreen: #82ccaf;
 
 // Reds
 @__red: #A62B2D;
@@ -70,6 +71,7 @@
 //==============================
 //= App-specific color palette =
 //==============================
-@primaryColor: @black;
+@primaryColor: @midBlue;
 @secondaryColor: @midOrange;
 @tersiaryColor: @midBlue;
+@rowHighlight: #fafbff;
diff --git a/webroot/src/styles.common/_fonts.less b/webroot/src/styles.common/_fonts.less
index 30fb5eff7..d0ebd01ee 100644
--- a/webroot/src/styles.common/_fonts.less
+++ b/webroot/src/styles.common/_fonts.less
@@ -8,17 +8,17 @@
 // ==============
 // = Font Faces =
 // ==============
-@import (css) url('https://fonts.googleapis.com/css2?family=Public+Sans:ital,wght@0,100..900;1,100..900&display=swap');
+@import (css) url('https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,200..1000;1,6..12,200..1000&family=Public+Sans:ital,wght@0,100..900;1,100..900&display=swap');
 
 // =================
 // = Font Families =
 // =================
-@fontFamily: 'Public Sans', sans-serif;
+@fontFamily: 'Nunito Sans', 'Public Sans', sans-serif;
 
 // ===================
 // = App Font Colors =
 // ===================
-@fontColor: @black;
+@fontColor: #09122b;
 @fontColorLight: #595959;
 
 // ==================
diff --git a/webroot/src/styles.common/_inputs.less b/webroot/src/styles.common/_inputs.less
index cc9c4c6f0..1110a6827 100644
--- a/webroot/src/styles.common/_inputs.less
+++ b/webroot/src/styles.common/_inputs.less
@@ -5,10 +5,14 @@
 //  Created by Inspiring Apps on 5/3/2024.
 //
 
+@inputBorderWidth: 1px;
+@inputBorderColor: @midGrey;
+@inputBorderRadius: 4px;
+
 .input-container {
     display: flex;
     flex-direction: column;
-    margin-bottom: 4rem;
+    margin-bottom: 2.4rem;
 
     &.no-margin {
         margin: 0;
@@ -21,7 +25,7 @@
         margin-bottom: 0.6rem;
         color: @fontColor;
         font-weight: @fontWeightBold;
-        font-size: @h4FontSize;
+        font-size: 1.6rem;
 
         .icon {
             padding-right: 0.6rem;
@@ -39,8 +43,8 @@
         box-sizing: border-box;
         min-height: 4rem;
         padding: 0 0.4rem;
-        border: 1px solid @black;
-        border-radius: 0;
+        border: @inputBorderWidth solid @inputBorderColor;
+        border-radius: @inputBorderRadius;
         font-size: @fontSize;
         font-family: @fontFamily;
         background-color: @white;
diff --git a/webroot/src/styles.common/_lists.less b/webroot/src/styles.common/_lists.less
index 46e4dcbe6..6989259ae 100644
--- a/webroot/src/styles.common/_lists.less
+++ b/webroot/src/styles.common/_lists.less
@@ -5,11 +5,39 @@
 //  Created by Inspiring Apps on 6/1/20.
 //
 
-@listBorder: 1px solid @lightGrey;
+@listBorder: 1.5px solid @ambientGrey;
 @listBorderRadius: 8px;
 
 .list-title {
     margin-bottom: 3.2rem;
+
+    &.no-margin {
+        margin: 0;
+    }
+}
+
+.list-actions-container {
+    display: flex;
+    flex-direction: column;
+    width: 100%;
+    padding-bottom: 1.2rem;
+
+    @media @desktopWidth {
+        flex-direction: row;
+        align-items: center;
+        justify-content: flex-end;
+        margin-bottom: 1.2rem;
+        margin-left: auto;
+    }
+
+    .list-title {
+        margin-right: auto;
+    }
+}
+
+.table-container {
+    border-radius: @listBorderRadius;
+    background-color: @white;
 }
 
 .first-list-row() {
@@ -44,12 +72,17 @@
     padding: 0.8rem 0;
     border: @listBorder;
     border-top: 0;
+    transition: background-color 0.2s ease-out;
 
     @media @tabletWidth {
         flex-direction: row;
         align-content: center;
     }
 
+    &:hover:not(.is-header) {
+        background-color: @rowHighlight;
+    }
+
     &.is-header {
         .first-list-row();
 
@@ -60,6 +93,7 @@
             display: flex;
             flex-direction: row;
             align-items: center;
+            min-height: 48px;
         }
     }
 
@@ -125,7 +159,7 @@
             cursor: pointer;
 
             &:hover {
-                background-color: @lightGrey;
+                background-color: @veryLightGrey;
             }
         }
 
@@ -139,9 +173,9 @@
         display: none;
         width: 0;
         height: 0;
-        margin-left: 2px;
+        margin-left: 6px;
         border: solid 5px transparent;
-        border-top: solid 7px @primaryColor;
+        border-top: solid 7px @lightGrey;
         border-bottom-width: 0;
 
         &.is-selected {
@@ -150,7 +184,7 @@
 
         &.asc {
             border-top-width: 0;
-            border-bottom: solid 7px @primaryColor;
+            border-bottom: solid 7px @lightGrey;
         }
     }
 }
diff --git a/webroot/src/styles.common/_sizes.less b/webroot/src/styles.common/_sizes.less
index 06bc42b55..1aa610eea 100644
--- a/webroot/src/styles.common/_sizes.less
+++ b/webroot/src/styles.common/_sizes.less
@@ -15,14 +15,19 @@
 @tabletWidth: ~"(min-width: 770px)";
 @desktopWidth: ~"(min-width: 1024px)";
 @largeDesktopWidth: ~"(min-width: 1600px)";
+@extraLargeDesktopWidth: ~"(min-width: 2400px)";
 
 // ==================================================
 // = Component sizes that need to be known globally =
 // ==================================================
 // Header bar
-@appHeaderHeight: 88px;
+@appHeaderHeight: 48px;
 @appFooterHeight: 88px;
 
+// Main nav menu
+@navPartialExpandWidth: 6rem;
+@navFullExpandWidth: 28rem;
+
 // ================================================
 // = Abstract sizes used uniformly throughout app =
 // ================================================
diff --git a/webroot/src/styles.common/_transitions.less b/webroot/src/styles.common/_transitions.less
index 48af50c20..ce778c936 100644
--- a/webroot/src/styles.common/_transitions.less
+++ b/webroot/src/styles.common/_transitions.less
@@ -10,3 +10,4 @@
 @import './transitions/slide-up-down';
 @import './transitions/fade';
 @import './transitions/fade-slow';
+@import './transitions/list';
diff --git a/webroot/src/styles.common/mixins/buttons.less b/webroot/src/styles.common/mixins/buttons.less
index 909f86f9c..ef546e55b 100644
--- a/webroot/src/styles.common/mixins/buttons.less
+++ b/webroot/src/styles.common/mixins/buttons.less
@@ -60,10 +60,12 @@
         background-color: @buttonTransparentBGColor;
 
         .icon {
+            transition: fill @transition;
             fill: @buttonTransparentTextColor;
         }
 
         &:hover {
+            border-color: @buttonTransparentHoverBGColor;
             color: @buttonTransparentHoverTextColor;
             background-color: @buttonTransparentHoverBGColor;
 
diff --git a/webroot/src/styles.common/transitions/list.less b/webroot/src/styles.common/transitions/list.less
new file mode 100644
index 000000000..539825594
--- /dev/null
+++ b/webroot/src/styles.common/transitions/list.less
@@ -0,0 +1,26 @@
+//
+//  list.less
+//  InspiringApps modules
+//
+//  Created by InspiringApps on 12/19/24.
+//
+
+.list-enter-from,
+.list-leave-to {
+    opacity: 0;
+}
+
+.list-enter-to,
+.list-leave-from {
+    opacity: 1;
+}
+
+.list-move,
+.list-enter-active,
+.list-leave-active {
+    transition: all 0.3s ease;
+}
+
+.list-leave-active {
+    position: absolute;
+}

From 455f758f3429c9851d93b0dcab0719be94f586e8 Mon Sep 17 00:00:00 2001
From: landonshumway-ia <landon@inspiringapps.com>
Date: Mon, 6 Jan 2025 08:58:16 -0600
Subject: [PATCH 07/18] Feat/Transaction History Processing Workflow with Email
 Notifications (#420)

This PR adds a new workflow for processing transaction history and
sending email notifications when batch settlement failures occur.

The workflow consists of two main components:

1. Transaction History Processing Lambda
2. Email Notification Service Lambda

### Transaction History Processing Lambda

The transaction history processor runs daily at noon UTC-4 and performs
the following:

1. Retrieves settled transactions from the payment processor for the
last 24 hours
2. Processes transactions in batches (max 500 per iteration) to avoid
timeouts
3. Stores transaction records in DynamoDB with the following schema:
   - `pk`: `COMPACT#{compact}#TRANSACTIONS#MONTH#{YYYY-MM}`
- `sk`:
`COMPACT#{compact}#TIME#{epoch}#BATCH#{batchId}#TX#{transactionId}`
4. Returns one of three statuses:
   - `COMPLETE`: All transactions processed successfully
- `IN_PROGRESS`: More transactions to process (triggers another
iteration)
- `BATCH_FAILURE`: Settlement error detected in batch (triggers email
notification)

### Email Notification Service Lambda

A new general-purpose email notification service that:

1. Takes a template name and recipient configuration
2. Loads recipient email addresses from the compact configuration table
3. Supports multiple recipient types:
   - Compact Operations Team
   - Compact Adverse Actions
   - Compact Summary Report
   - Specific email addresses
4. Renders emails using EmailBuilderJS for consistent formatting
5. Sends emails via SES with proper branding and formatting

### Requirements List
- This change requires that all compacts listed in the cdk.json have
valid credentials to an authorize.net account. Without this, when the
workflow attempts to run it will fail and an alert will be fired once
per compact every day (very noisy by design). This means we either need
to remove all compacts from the cdk.json file that we do not want to
have this workflow for, or we disable alerting for this particular
workflow infrastructure until we are ready to go live.

### Description List
- Added new Transaction History DynamoDB table
- Added Step function workflow to process settled transactions daily
- Added python lambda that uses Authorize.net's SDK to fetch settled
transaction history
- Added Email Notification Service for sending email notifications
anywhere in system.

### Testing List
- Unit and functional tests for both lambdas and supporting classes
- Manual testing in development environment

Closes #286

---------

Co-authored-by: Justin Frahm <justin@inspiringapps.com>
---
 backend/bin/run_tests.sh                      |   2 +-
 .../design/transaction_history_processor.pdf  | Bin 0 -> 79419 bytes
 .../compact-connect/lambdas/nodejs/README.md  |  32 +-
 .../email-notification-service/.gitignore     |   3 +
 .../email-notification-service/README.md      |  33 ++
 .../email-notification-service-lambda.ts      |  76 ++++
 .../email-notification-service/handler.ts     |  11 +
 .../nodejs/ingest-event-reporter/README.md    |  44 --
 .../nodejs/ingest-event-reporter/handler.ts   |   2 +-
 .../{lib => ingest-event-reporter}/lambda.ts  |  28 +-
 .../lib/compact-configuration-client.ts       |  42 ++
 .../{report-emailer.ts => email-service.ts}   | 157 ++++++-
 .../lib/environment-variables-service.ts      |   2 +-
 .../lambdas/nodejs/lib/jurisdiction-client.ts |   2 +-
 .../lambdas/nodejs/lib/models/compact.ts      |  16 +
 .../email-notification-service-event.ts       |  23 ++
 .../compact-configuration-client.test.ts      |  98 +++++
 .../email-notification-service-lambda.test.ts | 141 +++++++
 .../nodejs/tests/email-service.test.ts        | 300 ++++++++++++++
 .../lambdas/nodejs/tests/lambda.test.ts       |  10 +-
 .../nodejs/tests/report-emailer.test.ts       | 201 ---------
 .../lambdas/python/common/.coveragerc         |   2 +-
 .../lambdas/python/common/cc_common/config.py |  14 +
 .../data_model/transaction_client.py          |  41 ++
 .../python/common/cc_common/exceptions.py     |   4 +
 .../python/common/requirements-dev.txt        |  10 +-
 .../lambdas/python/common/requirements.txt    |   4 +-
 .../python/common/tests/function/__init__.py  | 147 +++++++
 .../function/test_data_model}/__init__.py     |   0
 .../test_data_model/test_user_client.py}      |   0
 .../tests/resources/dynamo/user.json          |   0
 .../unit/test_data_model/test_data_client.py  |  76 +++-
 .../test_transaction_client.py                |  79 ++++
 .../python/custom-resources/.coveragerc       |   2 +-
 .../custom-resources/requirements-dev.txt     |  10 +-
 .../lambdas/python/data-events/.coveragerc    |   2 +-
 .../python/data-events/requirements-dev.txt   |  10 +-
 .../python/provider-data-v1/.coveragerc       |   2 +-
 .../provider-data-v1/requirements-dev.txt     |  10 +-
 .../tests/function/__init__.py                |   3 +
 .../lambdas/python/purchases/.coveragerc      |   2 +-
 .../purchases/handlers/transaction_history.py |  80 ++++
 .../python/purchases/purchase_client.py       | 385 +++++++++++++++++-
 .../python/purchases/requirements-dev.txt     |  10 +-
 .../lambdas/python/purchases/requirements.txt |   2 +-
 .../python/purchases/tests/__init__.py        |   1 +
 .../purchases/tests/function/__init__.py      |  13 +
 .../test_handlers/test_transaction_history.py | 244 +++++++++++
 .../tests/unit/test_purchase_client.py        | 280 +++++++++++++
 .../python/staff-user-pre-token/.coveragerc   |   2 +-
 .../staff-user-pre-token/requirements-dev.txt |  10 +-
 .../lambdas/python/staff-users/.coveragerc    |   2 +-
 .../python/staff-users/requirements-dev.txt   |  10 +-
 .../staff-users/tests/function/__init__.py    |   2 +-
 .../function/test_data_model/__init__.py      |   0
 .../unit/test_data_model/test_paginated.py    |   2 +-
 .../test_data_model/test_schema/test_user.py  |   8 +-
 .../compact-connect/pipeline/backend_stage.py |  11 +
 backend/compact-connect/requirements-dev.txt  |   4 +-
 backend/compact-connect/requirements.txt      |   4 +-
 .../stacks/persistent_stack/__init__.py       | 130 +++++-
 .../transaction_history_table.py              |  41 ++
 .../compact-connect/stacks/reporting_stack.py |  60 +--
 .../transaction_monitoring_stack/__init__.py  |  35 ++
 ...transaction_history_processing_workflow.py | 236 +++++++++++
 .../tests/app/test_transaction_monitoring.py  | 222 ++++++++++
 backend/multi-account/requirements.txt        |   2 +-
 67 files changed, 3038 insertions(+), 399 deletions(-)
 create mode 100644 backend/compact-connect/docs/design/transaction_history_processor.pdf
 create mode 100644 backend/compact-connect/lambdas/nodejs/email-notification-service/.gitignore
 create mode 100644 backend/compact-connect/lambdas/nodejs/email-notification-service/README.md
 create mode 100644 backend/compact-connect/lambdas/nodejs/email-notification-service/email-notification-service-lambda.ts
 create mode 100644 backend/compact-connect/lambdas/nodejs/email-notification-service/handler.ts
 rename backend/compact-connect/lambdas/nodejs/{lib => ingest-event-reporter}/lambda.ts (85%)
 create mode 100644 backend/compact-connect/lambdas/nodejs/lib/compact-configuration-client.ts
 rename backend/compact-connect/lambdas/nodejs/lib/{report-emailer.ts => email-service.ts} (78%)
 create mode 100644 backend/compact-connect/lambdas/nodejs/lib/models/compact.ts
 create mode 100644 backend/compact-connect/lambdas/nodejs/lib/models/email-notification-service-event.ts
 create mode 100644 backend/compact-connect/lambdas/nodejs/tests/compact-configuration-client.test.ts
 create mode 100644 backend/compact-connect/lambdas/nodejs/tests/email-notification-service-lambda.test.ts
 create mode 100644 backend/compact-connect/lambdas/nodejs/tests/email-service.test.ts
 delete mode 100644 backend/compact-connect/lambdas/nodejs/tests/report-emailer.test.ts
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/transaction_client.py
 create mode 100644 backend/compact-connect/lambdas/python/common/tests/function/__init__.py
 rename backend/compact-connect/lambdas/python/{license-data/data_model => common/tests/function/test_data_model}/__init__.py (100%)
 rename backend/compact-connect/lambdas/python/{staff-users/tests/function/test_data_model/test_client.py => common/tests/function/test_data_model/test_user_client.py} (100%)
 rename backend/compact-connect/lambdas/python/{staff-users => common}/tests/resources/dynamo/user.json (100%)
 create mode 100644 backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_transaction_client.py
 create mode 100644 backend/compact-connect/lambdas/python/purchases/handlers/transaction_history.py
 create mode 100644 backend/compact-connect/lambdas/python/purchases/tests/function/test_handlers/test_transaction_history.py
 delete mode 100644 backend/compact-connect/lambdas/python/staff-users/tests/function/test_data_model/__init__.py
 create mode 100644 backend/compact-connect/stacks/persistent_stack/transaction_history_table.py
 create mode 100644 backend/compact-connect/stacks/transaction_monitoring_stack/__init__.py
 create mode 100644 backend/compact-connect/stacks/transaction_monitoring_stack/transaction_history_processing_workflow.py
 create mode 100644 backend/compact-connect/tests/app/test_transaction_monitoring.py

diff --git a/backend/bin/run_tests.sh b/backend/bin/run_tests.sh
index f117ca78d..be08e41af 100755
--- a/backend/bin/run_tests.sh
+++ b/backend/bin/run_tests.sh
@@ -25,13 +25,13 @@ if [[ "$LANGUAGE" == 'python' || "$LANGUAGE" == 'all' ]]; then
     pytest --cov=. --cov-config=.coveragerc tests
   ) || exit "$?"
   for dir in \
-    compact-connect/lambdas/python/common \
     compact-connect/lambdas/python/custom-resources \
     compact-connect/lambdas/python/data-events \
     compact-connect/lambdas/python/provider-data-v1 \
     compact-connect/lambdas/python/purchases \
     compact-connect/lambdas/python/staff-user-pre-token \
     compact-connect/lambdas/python/staff-users \
+    compact-connect/lambdas/python/common \
     multi-account
     do
     (
diff --git a/backend/compact-connect/docs/design/transaction_history_processor.pdf b/backend/compact-connect/docs/design/transaction_history_processor.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..dc4e9d0007d98dd264a971609d3627702890423c
GIT binary patch
literal 79419
zcmV)SK(fCjP((&8F)lX>CBlHhfx?2qg9<SqFd%PYY6?6&FI0JOWiL=+XJvCQLvM9%
zbRaP=OKD_tTQeXqAW~gEJ_==SWN%_>3N#=vAa7!73Oqb7Ol59obZ8(lH!?FYFGgu>
zbY*fcMr>hpWkh9TZ)9aYJ_>Vma%Ev{3V59DeOr$txpLn7{)&3>W7kRENk9-_pCbqo
za2_lH_Oo2NjErs@D;c)ezut`azF;!DYo@DmXQq34QU}^$bY(Jm3C2Bw?!27je-BO@
zIk$5@U7mh9$E1I^fBT;tAGLq`pX8sXlWY3WBN{H&+S`jYKK=5mzH0yfZ~t=o=U@Ia
z|7iV{(*NUIJZrbV_TT^Tr+@w5r@#1%Km7TRfAgo)@|S;k`cHrQWB=g~fBpCV-~KlK
zKlfk$?w|hgpZ_X7Eb_nqyPW>z-}|q>KI`_uW&Lkt$In0e{P(^9XPJ>Mg+BM&$(6ET
zcBN!_PyUe~e?!yxGJfstj2E=^n?9#aT@a5B<b~gKT|P4#C$qsQ$7=oh-3J#>f9`+y
z+mr8){h!|Y@29i(CHDWO*!q9l;!c0}*QdYl!<+y2SAYKF=|7zM?rpcwy|#t^`WD72
zqjdiI25x`t&E;IUM7^0a7Rl#^Me<dDk$>>>Zvbj2=U@+1bSf{Q`5U?gAZvw|z4qJZ
zQT*389g=OJJBJXsg;=`Vx6Qw{ZDHNEUw`pSI;T@iK-7*(=SJx9*72-eWa(mw=St{t
zK<OM6!jphL>0&=SGQX!Y8|`^XpB-yW>=4s+z2le{bPp)GFO2T4*YDWP&+KJ*Z7<{X
zBUqRIpU?t0!}BA!{goWS%i03JrG@{3%vfvTy#DLyfBa(4FQ>KDJNv`mf4WZW|NYZA
zUiW_PGgD78^>vAt&oA(oW?y69uA2LQo=#ObskZyC_0(iv(MtVPT+nulb|R0uj)DH9
zJ)n6xmDc|OP-1@xPivE%pdHTcRC521exwK`s1?8aj@7*zS%bB0tv0nTrxZKo(Dvgg
z$%M3>ygb(WW4)!F%d;``KjfekD$3`x@8rl@3x5~ny~um9<Fyj1SbDpYs3Ps$p9!_U
z5))ef6lMC_y7X1;|7bhNEQ9c9ZF!6V?a=$uC!LH@-`7?jqpqrsT$Wm&L<{e0JIFCh
zGI;Gj2~`bpEc@>n0~%{*ZJDLEOVIO+?a^t-do}bwWE|Y8>mVy)t-{}B?fU*CS@W#@
z)_$@DVPyTQ2O?#8nkcm**X8u-R2<$E{8v2beamj>-#asq6;^7-c3=5q&*<L^cI4A3
zF819gOsmOIA7u(@+b%k%s7O584(;gigp*ePTh=`YIt7d%WZ-3$1rET_zUawt)i?XA
zPrZje-GWxZexfa3@Y#-mmsu68rFZ=W;-r`5*VVSx!ry_DL4^kp`ylHY!EO6Dimg%*
zTu>JFD9<-(cjT1a>n(?|YfEvppsk{0k)wnbaZ%b;4v?->6`WbuUG}pnqB@lo<j6Zi
zAptmp(Jb}|X5I=!Xx|@KQdE+*g<d$Dj#7+-?QHUUk^|9Xq<Ru`r?qvFUEp7<3|vnV
zT2Yq|ZCR5(6QO?~bw!T0OsC3dgM7TBj%@ba_E_qU*vr%|XxE4*GWWmg@;0TiNsmdB
zt`vis7uq1}pkvoof41TXyFUGZ!38!sdICi$t)74Be%%1s4j^XI;}vu`(vGsj*v4f=
zOth7n$&-bIDxsyw#&$>X1y7<y#BPQh`XrWgd|yTbvKW=G=s^a~3Vl}0)E3Da+A3Md
zlRf|yBU%^Pwt#k!v#3v^MY38!78{<#m&W%MRb{pHGfz0@+HMVtn%KhAXbUDclKaNp
z!q@uFvR$h^i54-fj$W7XrSW|k4LPQawKH9L5<t~Qwdb}nOtigVHaiXIL0cCPVQm*#
z2YnJPGF)wIuTJsGSqErdzN8Es;=v&v9OA(t9vtGqAs!s!!Otrme8vWm@328^tq_W#
z$qUM=`TUBhe)~t)hwJ6PzN)o<S(+~e7XPXJ!s`Dp90XTCvi;L|_WE!#ES8;~Y3rdZ
zQK=6>7ni0Molu?wA-EOrNvUya`qCC!d|9EY;!%Ik_1QgxijNbNV^N4NJ_F<8be#4P
z*f+&;UY|pyuD~*;W~QjK3&o$#uEuaW``9N%S@ETr$ptkW-?_xu1uk)17Jj&3VX88K
z)+Q({*oFvFrk;_cv@k7nlQ<<fS^xMDvvM%M=vz9o>htJO2&pTh_d6%-L)(E<RcDvf
z7OtmVw!O-je8kB5m`<rUw!I#C`$Z+|)Zb`oZC_%w1?WV$OzR=$Sy`k9{59x8^d983
zRDit>#2JXy!Jx|nK#hhq>nME1qV|Ec4h5i3OZsG%PU@o0v1N3w%|4{K7=W3&7DgLu
zpaf85gO0=wixPG7YJ^arzqKrQkZ|q*2%!%v=mAvaMIKYkM2F1>?%wE-eA|K9IgBmr
zT*k!#xn;?H)H+_Yi?<aPDC7lHMxaGy>BOUf)<cNcV}iNn8LYY<MR{*u9Qh|NTt%Qt
zbX-TBp7&TdzXI78tT4dfAawy$G7(2BGz>|;<01~I;)V<JQ47loi8u-bUtDL)4uexp
z8L&{baR9EY;G>$c^|iiVv8+ovFZSi${f#--`}a3sc0S`Ihk!#>Am{;5T#U;4I)EA3
zuoX-T$Xk#VNH|eO!w43z973ShvFWLk&Q<ACA92u=qRoEtd^G^{zO%)(?L7_<!KBjZ
zqk%2qn5c^J4C)(}Cjc~>ix0@tVI91xCgB?7moPziFI|W9bA-lFu7Y`KK+<_*?mp~E
zSoYn>@Y*+Ce&?#p)4x&L+sZu6SZq+VcKt{ReNxo&sme0P(GEPNfSmG<em3Jt6iBf1
z%Op{JQHsiSnV`P$jzAZ9vYw@6%_WP91E4B1>3@p7W94<583=n}&($qDrJBnMHsx&(
zwE(~YTp|Sjg{UhUC=YG_WtHQy5Ga%5!X(w9@5k+z#ZplM`b=2erc{(*pF`*D-nG$=
zh#DXS&e}j>vy$%O(h7{R0Gx!ujckaIJ#L5cous`0z5}^J)KU@-*Hyh`m3R_F7gF;?
z5m4#8=Nqk^GFGCu<*5MynE*A9sdM`pEMyJrCMW?;6ClL7tYC!P*c9Od5hX&h3D`Mc
zoH0#B9|9>;bq46wpzvi5s&5zvRaSlj2W`5m#x+$CFu<^4UiAB=T#+&F*PH^xz0TT&
zh#1tWP8U$D$`af)2u}{k`RP4Cp9n8&|B2$AJ!tE61+qs0t}pFbpe}IlPy<5Z;497{
zO(-BUIu=TEjy9O;-3s>O%fqeGoibp>)~Gm0@!ORlmRImZ80*3G10)4NO{ISj9~`w<
zSMjPJFG$d;oRq{B4XKX`BDmuqM+ahM!YjVTF?iW!6?5I#asZWfJwV=rDDgohpS>OA
zkf5nN`edsp=)g}vPI@x1E-+Y4ib4vLMj?hxw}L$7O&_5kQ8V-upP@$T!h0-#&^-zP
zs+Ob7T1aSNZv>fj`1AyH%`2xB<bb_Wr_E&U7HB&q@jFn`Pm=f3c4vvCZs|j)8=|Cp
zVW+F9T>60J#^!~b*Y?nIT-VT46I9ta>MBAXMBC^lAmBV!*##JfDruVvCV|9NN9L8v
zN1ctYy6np1e8oFOp9TaRbv2Ck1I2VgHBKin;#e;0QM%YU)Dgl81ACumtB+C1yK2Q?
z8o*(SJ03d>&Ag+K9|ts~_28z^ro#%>4YcW^i!KO{afZa;6ZvEco$q7x!ZRaypSJs<
zHrb^^hKr(*Z7@MyH5`$n)k0VJA%aW=>ef&?F+d)f648-z$!yBIZZ<{uoOlT13WkaU
zswxc6R^@{pw5RC)d)O!NNPte_JyswzN^C0BvqxE!OuAOg`cbg(vZRFu57mP<lfGZ6
zEY%&>p`XAy)WyjiYSvd$7{$Wy#tLI6zE$P!tdf{lo3c{sPFDMe)Gk8JDlgO*LyeHS
zTt=fP%0480bLcA1K;ez6S$k`({-SPKX|JGe>3mQ#OW=5&7p;4phhiO##sLoM{&$%e
ztSwzE7gS24-G5cN27t^P(u(Sc)lm-G=!*i4iM5vJd6r=Iyk!RORncPEVYZA)5j<37
zuX9wu1)Qd~wgVLmf?~wfr4O??h|0(oD$33V7;O3gz0#UMYnTdEi6XrTP828gp9+y4
z;u(RMK)nbGKa!!<jV{pI#?!DYIx_iNYhWxeqAd{cI~D~ZTlF9y5Fwy4&VmBno+bek
ziwj7&TCH*(D?6?D-CU+~z+Kwe@M{IyN+3WH9Lm@g$Q}i_zO=`#zLY(h)4?L&Ka0GT
zed&jP5Bs|DLvlvF#P5VR<C9Tw5Nb)Mthx~pLLDiHU)#`8FXJaQPx?ZYp>vr?jD|v;
z`3p{Jq$$jI{hS`tro@o|w9w1=4Z#kol&DgM-Xb-VdE9p&@myi#I_!iW-A>qt5D#hN
zgG(E`Or3`#{6}$w@3R|zE#GHfmG-tQdKMZxrur4?LZcH34_jsmB7B)|PQ*zZx~9kl
zDQ-P+U5X3CJ`bCcQ|XhYJ$7Vvczusd3QTU6WIy$uxx;WFLUJ_W6H=;I?nGeiANZt9
zzdD`?6$(pSfs0w(C=`OlR^@F3tVa`&5!*@}*KusdcsCmM*N%9b4@_n}Vh!)y-vX}+
z?9@-E0&h%JSt^_LTi!@<0xp`Myso{OmQ@(SO4iJf8Hm(%2`j2+{oBC%JmY=DX@}v;
zH^e;avUraNL&Y&xn{}kuOt&<dh>nw#>+~BHHaHjxx(ESMA{2oK;6;}yOydOtVsX#I
z;bGKAB`PHeW$oE?NKyyt(W+;J)k%=jOno563KUL_;Xx{!HxL)>(fxcUEPMP_hauqo
z8v>p=MPl6H6!}`l1}E0zHx)1rum9oo|7KqQePUB-<O%Tl7sZGNopgpOuI3*%A(#h;
zR239dqz+OPmYJX6HTbwYIo0my=*jG>Q2s%Y3SFqI+$$MX1j2HhIU|&gVlU__#Gk&I
zs=Vh(4inLf8?9P?B>RWx1w%pu(RXw-Ggi-Kicd?Y8EzSeBIWh4Tue1rr~v_*9xVbT
z0E-Bw1-dywOumDVN^o##4FD7A(wnx8ZM0%g|8E&j$<C7{T?l1b^a1c(^)snb;}RwR
z4rgjXtIs7_^a4Frx&jb~h#zAcJYxz!*#>$w)u2R-ay?ycx)Zd!$S?%*$_#NCB2Puk
zurJ6dqX`tJAj9~V5K9f49H>~NIdd@!8pJXk5Ql{b%FP(RleqdbMZlG?!z}b(oKUXr
z3I5mEoKR`ZSG<jovz0(aWhF|FqBA^J0+f-BtSq{~F4+)|q$gSFpojllMQ=~*o=5s6
zQY#CB`&FbuEDjz@(>}Y6y^-2r(RirnDc`EPL{oVKoz0+VQ6DS-N=2a0GCCAm<k#L2
z6E1T}${}&clY;=Or@w%If<%EmLiL0>7WUV9S?`ay@ot9}!N4iSuP1I6Tqh}!k*K5(
zAbCu{e$%~13|c`{*Xk@0@6CDjoOpz<DJcrHxRkX$oHAyN(ajGwoOogs0cELa)Hk~0
zUah^AU#q=UuGiku{c~8Dm$kRHzv93rP4`!H(bgyt7uS@H&y1mdrtaYH?6z(5TEAGn
z?D_ni+f4BmO{AVn(Cqy9R+>nmOU+d$QXhG2gCPtcs$JAgYdjK7^Q}&C`z0Xx8UwK0
zSl^xlc#Hr#n8$XdF5OkhcLxp6aT4_V(Wm1s*Kuf>_d*~se3hWj2`k}^_PJ=wW;VK%
z2OaM`ONSa(8ZCMEv-2v_lq=~ik#;y0ry|6onrr~e3Q83c2;oXNVr7rM4pCKP$WGXu
zne0lJ@@WQflJ;+Q!m7#%6vIMH$ow*MMyOt81X4~5wpq-}O`Fz2x_{FelHB|m+FmiB
zz%WL20BcOazQneIkLD}a#e-MZTY<b)g|4d=#@xj+Nf_T2a!Q;TB`!3XW$iUW`N;{Y
z5Yvw{)2<7R#wxs)1=Jo^yG-o_gJ9lZQ!W}|uqQsix?D1&>5xPS`=6j8T!ang-PKT=
zCIjwegmKeC?o1g*yHIKYlpMr;hH?AFptvS1NqiiHpFW<&+M<qVCKrBj!Ao2B&?RkW
zJ|&RlA>yaVuSnvTb{jhvRBPjk1X^2yIL}%#=HXY6Sx!L_o;#5kx}9OcgkB1PrvrN8
zAwPr2UCe466FkNGH7Fkh0>uJ?VB3KLn2uvJ#+%MZSjrBEdda4c28~*DjzCw!qWF!m
z^wNgW`9df}nqmY}4LcfLL#yLGo*<a10uqGQR+#XnA}vk>fi5$F*wqGM4R6H>NR^0B
z0!wVTfx!B;uiFT090az_1eOQN2yDg-d7k@X_A^w?6d<*W*0sKAOS@LEgXE<`V;j&r
z!j#;Y^NZgWzXEk(1_i*P6GeQ_Ls6`S?)Q+XS|C-^B6Sf@ksS;LBIHLBbv=L&kzopA
zJf|XpHZzX_skjeA9cY^pE;AtMSyQ@()QtzFveeQG1z{K!!^mDFQP=ZHZ<Z1dv+$FW
zlw|^GOMp4TY!?k5APBQT!TAh|O0*{-q55JJI{>Na{Bd9ix~d~oDo)`b0jnByk)gMB
zI!dQ8K_i4%{<H#x*$D*I^cjq4cXUf8A}uKSvLa%uWcrKLW($H3v>t&!FgW{hb)YFP
zN9+`kYJ+e$A$E#;f`1NPem;2lPr=J`-V-?0CH02r1Y{sYS$mk>5dx^@?lxQIX*D>r
z>hlAPKxn7HI5C`i7-aHf*>0;XTdcurY^5f*GlsMe${DY{n0vY~ev&Rmgs#z*&=jLB
zm~t`qOIg7Hl8U~<*4G{^#so|Zr(eI4=*l%B?Iy6mi{+J$8=Ws}Fv=_2Rmz??DEfRt
zz<v<~HHqX=ii8#&L;Oj!gd<6g)6nyu>2f2(%EJSvi)|oCQPR~@j93PDg&;$}fKMY1
z0H^k$Ol?o66G8BRM*|_lX?4LDP^)Ev%=%d7=o3$;c?gp9V$QKG<kc!*5bcUFy@c$0
z1Z^;U^BI_(n?Y>OO-6+p{SKZ65mhpZv<xDlP*?GFL}}COyM^$iLDI|m9-vP{3?BUt
zvwz%3yFR{z?9ppN^(~9i+MWndUj{9C8s09YEKaCNMVzm;M_ipkpkIhC@$gA*<j6Iy
z4u=h%Zjd{RY@wI~F>DH9ng*ry66fHyCj$|96RA`vamkdnjPTH3hm7As5i_m88e#)c
zLP<eIshy%TtBk>7G>}nI9eJVuQV%t`+@PX)S;0X?%X!&O<~DQ8BDGBpee)yfo6g0y
zL*cyE@vSj7LFzZZsb#y%N%=&9DO*6oBOy4d9_gQZ4%)K-w?0w2R7ZZPxp2X?7%{hn
zoUbcn_uyb0TZm5*pm{t*_Y7FStx;5b;YP~6FB|lOv$K80Z4QIXVUT&}2ASaMjw*JC
z26J91%#W|Zgqru{Q5?ehyBF3w+1eo)9S-j|b$F-dcF<%T8`QyiVsTYg#X?$%hxUdj
zT^>h;kmmD9$Qy+GPqh(xn9Pw3!`wBjIIN`jLcoF7Us$Kf;!(F5Mw_j5q|Z8foVuh_
zNwm#brS8ONPv!G4_d;M|l_`rib12WEy%#m}CZnPnIj818bdG51gec#brsEf2NY}%P
zRh-xNHsj!uc2vIn9XgfQvixtVQ!zju<n77g<s&S+@K^x9N=qvsVb5U&5xpE1Xr?)f
zC`PwJl!83SK@nOa_5sMDTB=7W19~PeK^(X4nOS<vXcuCqv5#C&f$Sp&5iI>^t4AXf
z=wB31g_m0g;*wNMsrpDv7F;g&3jIkXJ4!)*8F^aHHNALe;kR41#nOTUn{~WRh2N#N
z9X$N~^Kf6nj+6L8Ssqc-uWRG>=uTxh__o`E@HPXkyXv}ApVV!AvUuD;Un0;F62P*o
zz{NB+fQ2fF;u2|tw_@3vKkk{))d~Z%&zAo~S9P9_ovN|O7ouA)PRB0K$4)gZ6fk^H
zT9w-B;=5SZrsj4!slW69M_(5bnoW9m-D0&YkCA;7bWspS{!r<Og{q1oo=hwwKaG}f
zqYAiH!&cX8nR>izKXB9TCZ>ZOKGh$>r<z^dAvPTriSsH`|M(V(T>YL@s*i1iE}`up
zWQU0N{zbgbQuY+OI9#gl*QMI(9wGSmX#Y)$i5=Siq5a>^8tl+wzs8|m=0iIHiB((d
z(AM^OJMTR@99CK|G+OFt_Ul2-+k={)9aJ|RR6iY5Ufbsew*ygh6H&A<R3nPZt3+{`
ziDKRo#XJ*5HxtF1_i>-Df5b<hkND`HB0hSbr}BgA1u^c)YCWXKcPu@oT)(gMDC_gq
z(j!aX(1c@Ul0bVJq#SrxSEt;CPDem;r=(I;m_fl1;EyDb#?3<DDk#?E%m`B1-6)rB
zR}F$3P}%en(!&})39($$$Zs=p?JIYE=<@Ghm+vCgj>z|e8oy&|99-QI@qYM+ehmLm
z41ULf{T;kkZYF4N%WGK?P0!bp9V3krw>t_LGeo**DtKJM>3oIOaoAL<WNN3j=Sr&S
z)Ogq0lBBF$9)7J0l^}#qIhV`0ut3{}nt(j75ALJY@s(9!y%0-T!5)=p%1Ww?*Tk9i
z2&sZ`3K2dq8m;kdCTf6;nW#az-ZL|RAiQq_YzPfDzly6b=-j#way&?S8*d;+4Ss^r
zu~Oi)Gl^vb2_nX8xLb4zWauO=$u1?7QKvGw?egs3lXEnIwZxV15E$eFAWm{!mUY0J
z$=t>}ecDm>^&qrA2BGz#?U8wpVAQt^M%|Yn@O!vp$mjajnPErl$D71{?7Yz7(2C!^
zR=kh)t2{tO^hu27)u7HNo1BI`+R4f@D<pR`pkR1vO6#HFuC1XK6EwA$Al2eI<c85f
zrWUgRIzVGYA)J2zwU`3M(pZI+YH>)T-NlY&RhU_4eerS^f?jDloGj6=9rtJ32{(sm
zNk+aL%G#?-t=Zpmi&jb<?P1tZXc#sG!g9H^Hpcz|vh4$e-E*CS4}6(0>9!JFT@pO>
zs`H^&3HYPyRlUz0b!rZ`^7(Kp{}gWJoR=NM{!kO%uI$zhVe$wOKd&tD#}5&&U7)xh
z36h;Pr$}IKAznS8Qj%i!HrvymC;0^Oq#m$f^7yg>>!ry!Ubu0ut&7OGLUl0n1}$?i
z7mE}uHnOHXaWm@A9Fgt+K2y5CzE-;5E!S)JdqrQ&{qnMS|FfUv&rdXzt|n95i6C|M
zt@VXM`<;<}zJUL2Jzp!+f36}`pPl^W9GZ8}OZLAyt7M;MWBbnq4ay&D``Ujlr}5zP
zZpQEUas3}JyLd5+mv<bzgJFJdYyI{Tg@t>gf(QTq_FV~bgM-=(pCr$`qW#ErJj=oA
z9M^xQozYgdt)c{4^1}sfFZAT`YTKiSj&l|LYU_e;Yn$Wf{MXyJueUSW=viN3D~@q^
zjQL7?VGmCJqy0J^KfdjB%-VKMzo%<9xAi5lDA+{U?yM<ZZI^SCR+LsgMRG1(vx?t!
zowN<yncG3%OlK*L(;swFt}2LAw9A=IXs1lCt2g?)Ts6ftu4k`OREJCd(aU@7?4;qk
zBzqPUgRVpuZQ_Z=5Bf8@v@D8)cCj^CuD0bRZTFVPY|*N^AKK=+)^&+D&4^~T9jdl%
z7c{f3=F4WqyE4jZm}6fAwxA8{sw<*xn$Z@Fcv=m4@pZ-T#}`eNUHiLwB&wYsew}9q
z?XgbJ+Eq3}Rxe0DsC0!j)4>PekhVM0xaaKzWYY5}MlIQR+1nVf^D@>hR&Z~-kjlM{
zMe(N3Fv=w^a&>M0NrhO&s~GiMDqclzcooHaqU)sJC+>!U=gVi>5p6vQI%Bke|7c@T
zL7UM2gxOJ@UfZ0tVte2Ia%#Z#<%I3(a|+tTq0vL3El)AyteRTDgDzt07ql)@`w`va
ziG)KErh$lh*NlKX0ar;2&`vrJeI#*8V_bY*+kCz+cIESIe!}k>c=R;2Nf7$RauzY$
zEFuY@j2wSWKmm?CLMlev+Y$nCpvxOkV*8O_a5i$F!x#%V*UXA0)_U-ogV!9q=HN94
zuQ_<lSK~FG(~`p1)RH0zzHqLNk8D3~+Y4Ah#Spz7vc=Yc+pjM?UTtUefXk8Pr$DDr
zvG(Khc0SRWf>-irsS`&D3AX=Q+oJ~^@j5@XQfI@DCk_X=qHU5u>@eD2VEM<wy|!?l
z!{2x}{ytAhL2?E$_=eCS<-q>UE^SvYDqI0ewkw7E+QGPLAg(#pZREd+nJy^dTxd79
zg3cK?RkCw+X4;L&If)C#oXnw}l3m`qI$R%8hS9LWI1jM%;5^4U(Bi$gvg!R5Ytyv=
z&OKosiNyjL;)i;=5AdSGv-bdR0%KfsZM1sfv`~`3Ei(|mzgz{M)HC5i3v0xui`DmE
z670M++vU-&__B7}{8U{#IhN4&HE<(JlHG(SE=#n5_Sfvb@1}xJgWEcmb=Vbm{U+@H
zWr_ru_utcX4Ja^DKqG$WUqKk_X3_56sNnYmy=Qod`dVc1pwQ_iP@pG3?!&dV1R`7v
zYU-$9087)=!&SczmACljIZUY`qOlZ&ZY_P=vIY1!i6MbQ(fQ)d8HIMJ@L&P*xMkRD
z%D$S?om519ut*b$9Ds+WmQgq$ub~by{NbK<aCWK#AKM!kCg2ef0cV(O8ny;bF=m?t
zbj>BhAe&{L0hwwrXA;_h`SyUa5{?>(18zMWInj$v$2`2zAUnmuj|evr-RTalM9=_-
z7@(#d6VQm~%Ya<z6d$yu(}kk7Cg33wb`$8_kn%K%$^23&Au}q4B@`qLhb0u892*ys
zYz=OtUsQ!$lExX8a8i%AoJrs5IS-Q}+KhsCV|`3J(<;CCjavg-%ekhv<xt1@J<jis
ze15w$w4*j$K=h5Lc!5oSaJtxmF-N+Ci~@3=ag&VU@vGOK^=4Ay%0RRtSa9nGA^0I9
zLUpBcNE&LTKuis7M9`WM`KbfVQ`-~M2quf#0oa&Zz_{HF)b}e-0KEPt=fUew$x#aF
z^asN=$S+}n@LswO>E{TIp<D&?g2FMIjd{Eq8Ft+ZT^TeDTmV#&x)Uu(%Z-~U7;7^^
zEh8_<sCs~$+zRr5{8%9(*dm61ct*zPUwN3FhI%Bs5*@(>h15pFaVi0I_*YyQ;;SPW
zaT3`aVAn)oL8l$^;IhWhY3CyiX;4DOl<G;G*Fdzs3hI(0f+A|1WLJg^LAp)MVaY&B
zlwu;tP==}qOM;qtKsFz^d!zSVaBPzE!c%V<H=*mw#Zm-ZC&6j7FKd0K4pp|Lj5im%
zjVM4cAs~Syhaq|t?GaV0kki#cpdr{(no3l~I<_kSe{}JAg^CIH!A-Kh@F#=>!Q`m8
zi=yQWDq>h|SfNKk58l-otkebxGT6^fbj)_k3&U!|GN1gwyIhvodK*##%@BEA`papv
z6Ka`5lrUm7o(x2O9Rtd68Zsl?9Zp!bbEx5K%$Q5a&%lZ}%Y^_x*I=s3YFY__w7}BL
zvj_6ubSc4iDd}X;djNe7Ot{kZ;($x3E0FvyJuG^+FZuXuNTi(=d-t{yX`qDSlhi#R
z)Ee0ZK%^@^vclRHg6L!r$o6>g87NozqyZv&u5McE%~^R?!n?fFo&zDc6_C-7&k(xX
za<V7&6@ly?5slst!s2ij6cV4%4zvRilpI0a5jKkiMrbxr30QH0q2(F$NDie$gqT;}
zdFH?-n2zZ5pNd2k5G(??cIjfE)MwCw6|PK!X>EqObh#MS1-dXWxc{IB>VzOyHFbF~
zBl$1F*dLIM%ZNx`rd28W+AT{E2UK#&d93WT;&&hRoe8jc4J&`@D#sdF4m)F0&W1LY
z`a(!TlaU0qWUfRSYl8eU7QG{gig*L8%DQmvR408&$s)x8P-NzNkSt;Wv5o{XWod#E
zBA*5aLj?V3F$pRnwFBo7(UX(F`B^69A}=!O3j(^#{45T@5~L8E8k&g%ZpitXwl^*I
z{YJIqcbFHTBX_J%dWy&GUNWd$C$<B*f`H^KxM}Sx^BFW?8!Ks*6Ft}_SRchwuu{Jb
z<|c@g2kMB(H4IG3@r?SWXoM6X#yKOef(Zf4HOzJTjiMy7C@E<n0a8kUBL3IINZw2q
z2LkHhf#Nk~j`%PFrtul(XFf}d#A>SeWx`C8%(q#>FU2JMU<vmqO4_J}Q<J~j-jsH5
z_d{R(koszJdji(&{?Ja_#Is~j({LZVTU4XRN#UMBcyd6_PwxTxG%hb4{g2v(VdlBP
zU4iUTfa^<p7ATb+r3PkIy|YKZLNG@mtI{+x5Ctgl;Ph=7d1)z6nwbx4_BSv_2_o8q
zx&U2N`SG!iPjBr9pGHcFLp6>%>orIg>grEffwg~}O;w#Lbu6gjC9XiH$YJ`8bi8W9
zo8RVYn^{5+rkxWV$7YOole%2o4%6Hr+x#f9O<$=U*0#hPGghGqhO~Y~%oZjrtxSa^
zi1N`iCm>BS&_-S@w;h|SLQ|nCuJbQUr_Ck@;27uvH!x0IQb)iy+VlYy*cjA01M2N2
z+Q6h9#Z8bwEu{k~gqd1oSDyNWC$rY^glLBO(KUfCGv%^^h2{`tNCdpy{!4L9DKHcG
zAQG^0L!>XoGv5-{Kv0pCkRp%tS<?+M5(tOLYU+CsCZL&Vi+NK{VoA-KCQ~8mHSweu
zb0jtK0Z{hx$t0{w*{|fb?)^}_kc*p{h^TaMgH3m1aIJf4q<<w-i|YbpeOprtFN?-`
zd+MS&98qmma38XwbXs5)5puMgLBJknLClpo?aw0-7n$Gz8UHAi8hN2}WKt=tauIuJ
zg0-4N<7##g&3&Wy+r7$av4RmGqMpH0{Mx&7ddGD}ntB+0yRg*JwF*aL8m^$S1jxTK
z2bvO;*pf@*Lha4!-S4>CRiFP5ZQg}w<FngyJ)D~?>`!*5yLzncTwpoZJZ`D7(FT<L
zN=q%zzEcX}5C*A1l2BugcV;mWMN~`c))R#a3<TsjmK7WoNtDO3WLPv8y2lArU68Vm
znkRyVnBh>EU!pSb?F)hs667feA$b0EK?voVP54m+HGm9kv*`CbnmWC^f1^=TPgBY%
zRx}10V=#dN06_`KO#@t=FOwT)+?qkn-!!^wka(g7lz7u^X&Z8_wIfXZHA-()COpCl
zZ5DSgS`2=NcP>&K2+^r?j>d{0DK!ibXp(AUl96U=7!(jzIa>-+@z)^e_;g{KQlH%w
zFcvxova`*o+tzr5pmo4viW`VuHUQgD-4)2iFhPEa6BL?+zcV<nO8j49Tcdp23Yo>d
zv)D2DSk%^I(Bh_rk$vq@^kdl*D6nqGygB#VylUHF^RhGWwBroeqt{N<y(WmT=OV6y
zPrnO3-5KEy`_Um5e^0UarYaR~d9_SMTFX@Q^VdZm$M}i9gIUXKEA;r8G7#ARDgEGO
zH%U_*?(8NP%>*4I@sg-f7tOvP)HlpBC-C}|Y;xc0H;w4a3+-NA=zP5%2uj-p<S4$Z
z2lDLaPK0`+bF!vo90h3dpDJmYPP6%vraWp>b5QN?3!Yr?w$z%?oGN`n{1^J3G%n~(
zn)m{8)YdN(J3HRyj+ZVJ!O?zH26ldN3L-wA!x+8-k27$+d6`G>I0M(47n|v$HMalg
z@Ax(w+kbxFB&UJfMEjyP+b2Op?$cs9%l7vLPmW<MNGj4N7QD6C9xb**^2BDbbnq=N
zeb~wOLw@!`OKux{r%~=yMYw(vrdUq}Syn|doI0ygT}hL$5zdgrBEw)3*!iNaYhoI%
zy2JcASQ`;uQ=9L`+`G1Zmi~Nzd#H;6^;D~VH%I~&+ey|bc|Fuco^LGT9OU_?$*EO>
zGx{X_v-Ud2ZTm9`Y_A=E|LXBCpD72_7q#oLNL{~D4(R32Uwq(}>n+{6gg4Ib0^f#U
zrI)lQA1tgx3J_YdmeP|fBG=*sxUvFER3w3Tn^{{PzXdC1s*t$3)B0Y*lQ&gUZaZ8u
zM>xWd6^`%<5_s=-p!%WFd^?Til@043-E+mEYiaefAwC%paknb&5-`stLGxS!R0Glo
zjO1lW=1e7M&QvCjR@DEDlm9f~1evdf_o@L5yq^I48^G#Jb@Pw_zNIsjc&g4+k`}ej
zhS`}~?Izz2Ri@KOq&bYTqwf}$x$hCu=%pruq^9DC`BX>GU60H5_avn~8}eGUJzU}n
z4VSn;T&S=%)*EgWvMqF-dfE>5^((eXGe+H3WLT16?>CblVfsgy{@aA<zk<(MjIsBN
zPmR34=%TU6uI_tAXts<nDyA4yge0UP$(WilChZ5e7@6FF*BtK`P%9Ku0TU}g(;1&x
zXB)8+Dy1aL7XsFg>w6HON9I{s)O$KcbQm;lMWibRgxoF*LR1V4UY6z=7}3E9K)b(Y
zk@8E+c`$WLn+F~BE4y#JVpHi9fx?7Mf@#62A?R6l-mU;CQ*=16Q7_qfaJ*O@SIq-b
z;oP2bNNU8l0A-q^0h}qGcg0nEjZ$}CTg!4{UG|F0=H>svZgd5R*}#vn4W1JJC)+?o
zqdavGqgS$Mk)YaLG>V9Q8D$&PM90t*T^4>KQMAo)L?%R#!qSf@NEXe<t@J_<AbuAF
z>ma<uO@Kwr+)}Z*^PWQ$S%IHY6{#Wbu+JaS&_7Nz^lJ#v!VZH34J$Bw471B>6@k7$
z0*VlU$(~}e&kUIzhR|f9*;;Q_(~dxvO?HdrWs%Dl?w%<)6&yhl4U5x?nKWuifYMda
zo=tN{_NqZQ4ZpfQqL1eR)LcHhio@d~CV)D+ux*V;2r_?;bZ!G6>5c%?@w^5%Yyjrw
z0YC@y*lsnR?Wq-VME$&vsGrw%*XOb$-SQCb58?h0?q61A>3DGeVLEa@-Zb~)wM~sJ
z?g?2w5<ZTEk8hdq@fzBuuALr?{b1||V?Y0X#$NiM53}70{FG)pSKS`7&0)9uFm^jv
z%d*3@`=ggGcx_dh%RAJbBeX^d?puV`_@y(yLs9)$imG=p?8w>al8po1kVfazut5WY
z>^&;FJp=98yX(kVfw(OscQy~GI>zYeIJOX<Bw+UgpepYKjBf{LR|j}^D^cs5&+Ty1
zeQ;9WX=~YY+3aBqIgBB1XbkZ&?1=zBB=-*^x%=4m1Z5sF>f6bv+3g8CJp9f-gx}fc
zQuk0~CA6U;Fa!p|2xF1*x`>;FbZMO#4CRdoNmT*7_IT1wLbY~>aOaAMayQz7(s4im
z0n|E6P~`_al%_><oASKDE~3(rdYo^?!$dqIE6p$+gI5;-MWvg{Xb@&7YbZB+&x$u1
zL4x~1^bjY97;QDP>Rf$-EjZ#%MMzNkVU#PLm-V*8S$26k3rkgqlr8~GNiUmn8tJch
zWaP@A|HkF-P!pL??F<sx-f4}l5Y50$?zTGD5j$&juE|*M)=%bfs>HqIq24|b(z`#J
zSxEcH3dI9yU#1$^c^yzIbsk??z?3QK7}(}t@v)+nROVsawoP4!*>lPc8u~-f(0)jc
zA{{@HOcVNn*i)I~@FRUBKT_zdc}L9MabeH<xUlE7-3|M^A%}_VFp<5Xi7Z4{cc|M3
z+8${8rf8e|a>&3xlnk6h+>`xw=%nvcC%vtZU3|5`QoUYaDXTmg5Y+dwz|ymy6;c}w
z_ytx@|LT|%HvamVQc*I1d%L-@0NpEdyY1@aQoFiyj_s|AKOI*m%iyKU<LYFc(|fo&
z`4ygXT$lWlyMOmxk$faW9LW$zGQ?N9h58_-ABC89sbWWF*>OYf`K@p0ePv%`sYh(*
zVFCQXEP$ylJ7oJ*SG`24WG@3!l~s6AvgQ&Hcq2gb2*mJRz^E#VA*O>7J{`BfqH;qV
z4=`DoaR%-rN`V;xM5soSaiF9AlUez*5dT@5v_Pzg)b~^oh25xsO&J`OXEOuh-US$T
zSX8j-Z`Cef>0G8iS1G}DZK@b2F0!zBwEHL)KOoOvoV2qU&#LrAn(QH8SqIfT%(}w!
z+KZhtjw?@Mu+EgK5`@$C(JGBT1MT5Fh-lngda~1Cm0vYjwfW|SPV1{m7g{i00Fh_2
zl79jENl*7(!tk<3R0+Si6MQ(J4!oKVBrpsdsrdn1y?^13cfZ2r3+1)7?&x&YIH*VS
zvv)6SfBg}!Uf9myW8S=Qb(emSix;+IKki+4VN8GR<kweEzPo<%TaZg>K6~%Nm7l-(
zz%3V-=Ceo#Z+h>7S97RD56R((S{%D%Y8ai*##1rVXo;&axI=l^YnSM)U1&QYi2L~>
zxwB$er4UFTmnk;DL>Ki^2DO^_n4}amWM{o&?I9$ZS$g;K4i1dm<fejrn}lryk3k)T
z{6wSu66bN6H?L3JOa`$Zz|vOfO$|X}@QGeRiPa_)mc-)TQqS*3i}7(!>5t`B-gh_Y
zaa(|@GskTKr#HJTVBfW&$87<}Z2|A|wt$WwN8Pc*)poerzJjZ*quEh*>}O9GDcK*v
zD?hWpwTei&L$%RMCZ1S<2_)#zLc$D0mauLb|4pDCmI-Tid)C#-R!K)Y7s@**XcoIy
zb|&|?Q?lG=S^sFUtyJaV9ZQtZ=zsyuEw*8uwamTWbXr>P^8UrD%5_y84s;cs*OVrh
zLg<1mpf8omJ?~e5{Pm!^6)HEu1zRV91&npl;z?eB<N+tcw0P~ptxVp`G9WKGuQGli
zxm-f(qhf3&2RS-$!)NR}_qD-G?IHE_xsw$l0wBJlG$8M(0pUSo*`gcKi>LwJCtF29
z3w|Q;vI>G#2?{ru#)IHjK)hXU1sOTr^bsDMO0B^YWpv@a6{J$$0ujp7*&2w@Iuc~S
zlMmQE3+DXKX$3i8ubh4}ncM6~OIh|<_zru-`LIX4sXd~rNqZdXAH49H#2WA5D@Vn|
z_gpctOEtTQbhdbfFBTDTK9uKxUC5&VuHab<h0Kryn5?xB8S&6{?eZKdy!i+aVrkZT
zjayI>rPB0~MA9Jv8qXjWDp6n=Q@i!Bq+Rj$2lG3a-&-@kvh1mEc~~zG>*Zm+d|55s
zyB#vqN0%gP-o+e8kR-iX;8er8H5TCtWRC(|U%GX~&F!gIqpPO2N1kuL=pexC$T$Pz
z^xMF6J$*Npk+#4Oh*&Q9H9EAP7m<f}w4=(}j9Rf*F1Hnp#x!oL$hG7>0_71lvb<T?
zh$~^w?Usji{i9gdy$^dTh<tD^<$c-X#;0iELUbCHLIe->6tbD0{VA}#rYlW@4@_2r
ze`3b2RQxpvc)|K!h6veR0b{2XX@I&6b=w+`5VQ__dkOK&2H*fxcLj1WOpsi_yFyZn
z+}jNZRcz9UZK1R{-heDSEp{#3CLc8&V?c|W7DgiQI~4s`_5^~f8!~UsZNxEzJ-0W1
z^rI0<J&HK~>|XgUD(z8j4oksdDL5<zFAh^`X@}l)NZ}tx3eU;y(8E5usFB;AS{sKw
z;qB}RT`Jh2HywWB_vI(PDM#EduVyd$&txwuUrj+%POoGyZhuyhp>({^-<PwRkAG8j
zlCH6a^~Jw<;x|H-S;7jS=!3qe&EL>7tEBLEyc7D5U#O7yreoS!Zc(exja9uN<+GFO
zF5~y()6!d|e5N?%#yp)eXj)P|hL!)4u23!HZ!l~x*#HgJ)Z9lWr%a;uP$U&DR7=89
zd&2`1uinlk5xU~b+HLcB?KU~OXnp0LyCPYjESe(q{R&ECm=ND2Wt)}!P^6v1uDG`+
z0cWJ<i-n`k!Ki-OSpS)Lqk>pOJZV;?XR~NGx~lfv4|nj{H{-Km*;CN(C?fn$iwHlb
zyL+x)g;uL&WLW#DAvB5u2&~d%F4Bg|1=pOS_q$kG^2XBT6862cSuN|h5m)UBc9YC{
z4jS;KVwtn}rJE{t#T_=N!$|*;jPxn&xryx!!wI_Za@@rEBk|hY_FTkSkZA#)*Cp4=
zx@g*?5kH;cVqqUar8hyNhYj5%JEn09WzCA(Hv>+2)LxB+^G?8sG-(uAOJ?9#OFQL5
zu(i4|<6x8fgHXg^S4S|Rga(e@JMoC}i^i1rF#2}lO}4J}+>B{BwdM3r<e{On9Hi>B
z#FnfB*sR`7yHrEnVR-nQ@_S1y`aZ%g1@+O!x6+P|TJ$n_4T{!z9JS~_YAyPsdhYq1
zSI_ln*;8Wvhzj^fQ2`<O9bT*h2|g4ObSk$)5<9N<{2{LQOr7EH&|Z%s=|_?DH!PB#
zi`(PhII#A>+V6_BxB1<}tA6)jes>8^^Q>v}bXp;?5DOIL{s66PEKpXc66zvCXK+!W
zpiesfCWVqy_3Fiz$bzU4`czcvP$eXNg7Jz*;Rlquf>K{VY4fB(;<A>i`EB~1l(oiK
zl0t!_F50KfVNnS4a~!9Z*6#-q^DBhXG<PWqEvwWB*$NsYcMv#!VTC?*T!4WWt1WVD
z8~q4W#y12C<NHNRVcXaQ@?+d`iqn{r6uT*7zEUNzj<qN#Y|V9ofzZ}4cVW}LfS3=?
zCs!y>5O%`z>zU)s97`N{AW$7RBBKrie*{`_OQ1UN4h3usCs$}0kodN-f^LGY*6lyg
z{XqARi|!Wpb6(QtqJHL=o}PC|2tldPvIUwy_L+dyYiI4Y0SPu&)zrn=8oNTC2?0kt
zK8397^x~sYFAe~@$*XCDig-0BDttPLBciF}Tc6d4WkBQExLltb=*GAD)D27YJWfl9
zL($?Jx7OxY8$c;=Lu98V9K;JTn%~k1LGz=;pR0_-f-JnOh8P8@a0}U!*&>36A@imJ
zWAK&T>-TL7M~nD)@1XhW(a<q0b7P&&vKfDyA=D6j2$YnU&7&UD;xo{?1&DaT<@U)3
z4)@N<Kd5KTE46+=q^nY3ZO6vp$L9c_0>B)SwX55#2Kxp)ue#j$KqOL|3hUFM)}R$5
zq`?PZLy#>)k7Obcz^SMx5GyZFx@Y@8@nz?s7&^bKprb)YeVPVvU<6@>gK6)<!^cJI
zqMOF%xW4npZd&cqcCEJO0WQeRGFzdVwY=pd=@cz)3@hoQt)5@Zv+G!AkTy3<&zPa)
zb}YSPHF4F=JPRGd%r%exGVM|09svwcggKi$0fi=Do?n!F$Ihaz`t?0Zn>}i`?vY#4
zo~&yut4}Zp+96QTb9}l7-Ub9^n_$FNsu-YWV`1w80*HWDeKL)v^}*Ap-NO%w?{3B<
z3vYiw;DcvIm)c1Xt^g+!1C(rp1Z!Hi#QQk)@2PLM6`}=O-(j2G0n!igg*0__b5MbX
zC+*m!z{Qk;ux#>%JDpM8tSi=sGy&+XV+L=cUD@)f9`KLnOkmfc%YhDgOMj~5F_u!N
z2A_HPzO=HFi;!(wSz3(G;?<m1cHLz`mAdY^A`G~rXKbe9gb>4tbO}QAxtec(1362U
zG#3jen8FpXx*4)7p_o9aR7`C;aSZ-;q}X-U%0XSfCv~l5M+9v!+3-ti<XyQ2hPVO!
zG7WqSi3=&M5M3{xv2xEqUnqM~sEBh%8>q~^GVU6I63-xK=gqKbpvF!0V)le4J7(Wj
zVoRNn03Ik{Im2pc9k(cSHMg^pbAh-A4;zDhbb8D$#=$;Qf_-3+AI_TMC`%J6EoA1Y
zKEnJ7&>O~hXqO1432W1CiLv5K>K&&2Up@c|Ln}AVg-4iN3DbeXj(UcU;BFIMaY7?E
z6W=Xd`)2yo5ALx??{1H7Gwr8WP5aSI`(}NsdROEMnK=hmyhI3=Pe%xrIklo?wUJiG
z-(VGWuukQ`-x?uU!|-IBtzp^hpaLPl=s6TOPZ|`}G8bVR<M-%E$zE-0fn#yB3pyIF
zCJSO-IL=BlS5e4pYGIvwlItC1U1nQcrA6-x*0+;fo@7?wrvYIWa{bdw2(!OxZaTK^
zN7=d`(d62Oxf}Dv-WUBSp}ubA+D9eAFifw)E7GtyfVu=2xU5k-7K?6wR_*Y3^Ktz4
z1(WNy`_vATt6Xr<G(#obZgP!h27V{~tNr^eZLMTMjxHBk9>J#|o11DECS^`)8?TV5
zc2j$++G*ett(MYNT-##8iUXo%8SBdYP0Y6%)#pj;LT^Y{9YcI(eV~?%oalLM<h_W@
zrjX5uDlp=qC1ZRlaCp|?P$|JP>!IBd(z?rzb{J{CuaPE&edf++>Yk4j>`bM@EF&zq
z$oW#?GFyJO3+68{Hv(S0&y7&x3?WM9Auu7*;!=>d#bXc4_oRSIu+dgMEt?Ml)K<Jh
z&8t?5_ORD4-`-yDma@a3bd$9rhnJ9qO}#J`5YM*|O$C7NH5Ksggu@2&wQVq+Q0y^E
z`)O6=3~)9ysd{t5wlFuw18uX4^(DZ?uiK6B*TAt)e(q*7z}pt0gu}}BbujEU>qL3g
zI+4seAt}A(6lm?P2!$;eqCqh3+LM4jolxe8FKRsrdyhaOppT{N$nrKrxIy!nhw-G@
zgKZj=JKIgskK?y=Wx!uiTXc(W{HDy+rBkSj>g@muVwzrj(JjHx??q<djAdEY#mssM
zUBIn2dCZW%`0Ki;>S*8KBYV_C;D?3<y=V2%A#xgSm?!F5k|KIuWiHJ&Cr}s=?m<oE
zKQwC!t}(#o%N`?Sq0(bSdug5k$PSkQYVh3<FEm+a9`xi|iU?G349bqPZ!F9}HK!vT
zsX7_AtTg$muvXoMJ~NbMrmRoHAErttMZ-yEEG)BNDPG8Do@lsH@H~CExR(_Crh2=(
z;+@QA_+;h*lTqUY1S`4X?B8X>w}(b%F-)fAtRBgJ0uj{J%pu72x6_IZNAU-$SMmf?
zDwtP2b#Yt$mlXCa$_EsMa`C&+<FF^KXZD-hlNzJ_?v7b3c7|E27~&!!knB}loS{^9
zsLNM%#+EkZ61uI8;2Fqg3Em$GY3J`26`(Kw{VV!*fsh?ZcZ_#dFrJ3BVWTB@i$!(U
zKo>XQve8sFP?~_7F~-i!Gth_|!K>QRP5N%#kyQS%IiIV067An8RJ-jO>pM4Zb=J8D
zD|y>D43S0>D^}@DMy4<rnJ&08vO1nblWd2f44HIlBXi^p!DSIr+!sDE(5Y<|1&p<V
zn<Lk<O)>8m3tw9g2IUA+$Z3{0-YHU#kh=FBQs;9#jBVf3*w$V(w&m;9wWZcuW$f(b
zWp(XmKa0TVPf<cio=yOKrTs_ZOdNCJG!86kn?H19EQ;asj{L0+sFpKIzAfi?YBVP)
zP{aHfY)b%gVR!OaF8C4vH+?9(sRO!$@K~h52Y^G3?R9p~0NI&yN1Sjv$F#K5xp<e>
zUHamh6$wC)vy)*T<Z9Fxizd&>nEL52QYvoz5idUjbVxylaZWn0D$$m=4Jk;Hp$+Nf
zClo2=5u60sON?fE?-}rW7ARC*1TK)D)<?4C_-Xvz+c1g^vdrTt&&K0ZJe@<z_0<1(
z+hB-z@N{E;D&k*sX&NG!G`o{+{Vv;jw)s3N!SHl=^b@U}5!R#c7NmY^pKR;5*v26E
z!gcJQfED500MNnIGcPLAFR~r#`ge?QSw|juTxCXV>+=E0wb~Ec+CSU)u)Tcc*!k(G
zM#NF!oq%Jfop}%e{RrFoakh1U!LNfQk}O7<7VBDaGWkhuW(^fvgf5`L^^zawCf0W`
zGP4*Zk{>ItZ;)ozSF|us(8eHhhSSA>ao4!~z>Al3f(GDFF6KH|)^`TY3@e$;(+V@H
zZUg9PSehPBU%edCko<El^BLX}Ucb4aT<0xPX|#y+pRci&m%o1L_Z!UUU0moCP?o2{
zmj3-~Y!(X^NE)jNDEo}?MQ@Bgg>7p*lEV7_<B6rLHb4k&1$eiB*HYOV0FMzs2lLo&
zG?$d4Z2U(p8}I6#xc}ouzT-wdY{hXS-^6&@o(oZqYpmYa+`VN`WlOd-3WZa+L*Y*0
z?(R^yySux)OCg23ySux)TjB2R8~ZqY`^D{d`$WHUzw_@AMC@EEb4n&-uQkb>nS)t*
zDj&Y-a56p*a!n5Of?5)tH0dFJp1T>)voHmr;)6!Ay$Z+LCzlDhiyc)+;t9dwxUyTi
z5pA((nQz=(tcLequun3K`iAe5uTi32&RL%#DCjkXRjN_DX}7R^=sC`cv5Z;&nh5?t
zBg!$&W#$M)G*?845Fae6%;ou+D66-pwKKWea4(BSr|9qOQn~(_G7k8tkadDFpSQCl
z;1Ty#2Kc_jlj?eEWM4m2EUu|KA9>-WOSYgnr$_e%Iwad}%m&UW)pMs*hYViJF-66^
z!cDCaXm+L8;@oCRLc{Yu!*7$x5L^%pNf?3j4eQQD(%I&e$Nf_6w`ikqZ982EC8Q3o
z4Q*QB?j6t!T?S(X3t*l+k;IlI$8QQx2PPB8lbB0wnV5*xoXWLibx*ez?h|4n`ZiJR
z93b;K6-kozxxs1UfYPO1<5F!#WLL|!s0?>|FGipsQ4gg?icTkwl;;5s-C~Dy!cEPl
zZacWP&-2kkF`x7?7@J;9hZ@{$C2toOuA(o;iLG9nlwco6#p<9Q8egk=+?x-9)M9`=
zNY|`2k#CsMTvsiWFbj07d1Gbb8#xgMi)?&@Zpb#jPo8&fx;!SDttTq(oz`1bot3(B
zw+AO`%oiku)~8}j)<%S5oeI*<;zhBRTxyo_R{v;q6u~Jq@^-8gLXFg*7MTZieKeVB
z{|nt6Gj0aA#CT4?6|@b+&#V^p?|HN_xfF`s3J*Y~eA!!KR49?f$%1dz?sts&KVp*F
ze{>J*DgMHRX*Q);oiMa+18PQId_kP8SzC^?($wP)roG%f_+u%$snpm=W_r&~?VPit
z{Go8ZbV~=;r^@2#^ALu9=oO_}@J#7g2-}%RKa~BdKyS6Ov1SLzZOMD1N~iB^o}#Sc
zlJ7gKGAAq1`cHx<Q25#sjt$L|UR9e+xwNz|r;o~wr)m%dNG(dH9w{zYuP(Dlkg3t8
zSKq@1u(Eh~Bddq$w9A(+&lkk2SZQ`6poPYqgPRiY%@5z@7Svi%4vK3d51Qsx{V~x^
z+sh9K#@dSzQ0(_JrA<{UKuRrXDZa&;D=%o>PecDy9r)$Hw)6s)$T5sPD$Ff(#aF#a
zP~DH}iA@TRsumNIc78?U2$szE#q^4v64`wAbCnbH+gX`0N?3~hG-c=LXI4n7P`Sa6
zGHk}n{#~jZTZ<n8emc97NTY`Gl+}Bwf&Qp=g$e}rke~YpsQ7bpVt9z-nNn)Vf%vg-
zkf7aR+@Q-DI(1I|NJ;O-=3g?ZulxNn^De;gV|m*k04*CmayDQtc_Fd~6rlb?(~R87
zTZ*qmXH9Mo58;(e3yKw<>5MPp<dDfxaB3V*=HW5c)U3|6-DT$C7@O)B7{qei!nk=5
zRJ)TwOX)j_VKh>?a)8Z+N=KZND_O-Holl>lz{4#}eF$(R-g2EZ$r+=f*Y!76tO^do
zeGW!n)~nOU0wqtUlT~zrrn*cRE$uahnmlSWt>5S!mT0n#TZ7W;?G0ZmzJl6~60-aF
zeyK0--k&#x19Lb66oz(~t6b4Tl|Ufd+Qn7}^b?U2<d(NiyWj_KqA)wVGDg9FglVWY
zVM#BuMbDi9ymk&MBXEeq*Ts=czaz$p-KDxvpQ0ubJ7#}>Z~L|@;yeHyFV_KePip7~
z5Ca?<Ad~$X%alq(!msAk5~7h#MIWk)0Evr~#@)oS5F9A3JBqPHIcAC$Qw;C@66`0`
z7o;nzL&ooaCh7qrPp}-7E(5YK8fnfBJM2Iwd9$c3C&fPu9*f5O_G)a{WHva4+vb!6
zeiN317O@hRu6cC}1XlK;RfIu*f21Vlh~$8DcPIYfNZrd-!!HF3G0IdbJdsRkN*vWx
zLm1pjGf2~IP;gb_3oucNMt`%Ksd!+*nYP+yoB3Wz3A)+`g8jX>n2?3vNs;ZA`y$Jr
z7=$Fld<kWQ_ezsTsKJmWb?r+=erM1^ZH9mscqD(J>`0*lF4b0oSCo;=%4x4ff+0q(
z!7zAR=c-rv?>m8s7jdLEYOrx>M;HYqiHl!VsU&70k@J-b8a;?>d&hTOoVMn;WG9se
zh|Ety#mG_fM$VZ{JhcKfBEJoUpnn24$RA##E)pA{1p8UNqvC<oj`uZFmlZZ}7tQS3
z>!XHQ7G2MrF@X2J6&!|t?D$`zcClI~O7~S?9BD?xq|UU^=4%p&w{(3i8%cLpZ|d=^
zAufeH6rcZYZd@ISrArmqn;><`Dl&fAT6VYfu^I8P)LMi9fVllm;~^0`L#{zd94XN-
znnG4Oe<;fojf!8o5Dx*~oID#N!aVjPDU=<BP7vfxJ$zatf_eNb_5o>2^*5L4)D@6_
zq(P;k1ht!4u(~N@f34N<E2ggDv~N1v$_r-r*60Jdzq_*SG^dOHYcueKRi>l7!X<lu
z4{)uY&4ZK}sUV#d5#kd!S`Ho0Y<KEG6YJ%Ms%YP3*ikrLST`SB4uo|^@c~M{J;_?7
zK@Vneu;eWv{?`ErLl)A060ATJ#z3#9Q2bP*dK?l0KIbxMf~j0vP<~S_Bf}y%px3Bl
zi+<LrBR0Oq5V{Zi;V>NI{sy4pJ8Hx;7;`|q!vqEB4W<NLxnf@EfSZH|Y^;BaA)hsL
z@`-;PQe`UXFm@+__yXM=(yVD4<Oi1^pWO~5n(}TAP+CG5=(O;%@m98{m?2A~F~~QQ
zUcvdFVakCR5$2nMHLXx~*3=QF&U<V)DN#ky@yF!ulbPWVqHD(*0~yZh3eKRSPJ2Hr
zyg^=xd_y~wYMRtgokoX%sDDCd*AC@;&1Gh2gH$(0PY5r?(AbF|PZ+KJ;zfOU6aW<H
z|CZ97y0U*j0Njo%4e(-UD=pEsMnL}wfOIfkvYm7)W{E%^A!B0^*@X4%0kGT)(NNCF
z-9(loPGxFYuDox^_{Mzc50miNJEUN`xs|tTl-09}<OVg=fRqB^TwbbLCY``=`gTw#
zpY%fic!iAX-OGA|+!;LG(vo*Iidf{{U*a9arlgX@P1-Mr_pAyKLr!$;inJvb@QxP}
zTUr^0YXiM4cf8C@HVYcQUKs~NGw@HaUaAf*nHGS;EZL|pZou@d0YAi|5lKEgvd;ei
zc9j{6WYvn}-V2ik&xZ|=j71|>-w-ealEHnO^AyUaBN^o}anVtOu?0m5-5IeimFHBh
zGsb#gS8p5lEHtheNo=$?4gN-Np<Ws(M3}R@N%-?!Kcx)@QkhdA;X%-!?ooJ@Vw5pi
zCWHJthS*m^{$%uhNP!*WL>v?$HXqlYpi>z9Sd1p=E$99bBxf~=*tmiFSNLm}{6~RC
z(FKQs&u5<K#4hR0-h~UCtw;Mv(7K$h{WOKJ3Gi6heJS?NDjAp!=L}dupd<dwm}E6z
z9Rt=I-^k>|8Cr}dExN<LV%v}{pEFGe-jY>&3P;xjV+{A>J2@KZ9GPQT!Ctpx;NM>O
zK#>V4$!<RBw}Y`~4rtKf7%~QbyCgwHVI!olj`Q`BFbYW+=eNEP3Io*W;4gG@f##s}
zqZKZ;5moyOlOX8Cv1ahsG>HMxEAAHivA~p6e=a2?@b)rU_mvTXm$j*U*ANm%-9ex}
zsuCofewy5?=-A7?L8QhmRTkv6Db*$j%78XWQZS`dHZ(&>%6>1doM#qI<w*y1GVG6W
z#4<4_{_S^f3q<eO@1e%6WDKw$6CDpe4iqWg*PW;ww_2v4jc3r)(AR=&FgoG-0!#X%
zp!TH?#7I~xOY8^aQL1DxKTE2)t;`AG9V&WeE>7_)umE=xG%6?MgJBy;VzA<(l)0?|
zqqYb)6+-%{K$&IUzCxF9Y5@+iY~8sLpY#`Yv&Xx)JB?RaNOMFI=MZJ-Fp4ZBpEwFK
z4JtTUwqe}8e8M_Q*hqeff^DEv|8JKKGt*qOPC>nV^_XBbM9|Ew+?H2lBsmrH-20r-
zrcB&qn*>-DaWCxwBVOb)EKl`hKz;PY8oyL9P9$*E4+Skoj=ue|r9Lvr+OU~`$^+X~
z6sgBWiZHb0OuQ5Dyf+kM1QYV=IvkCs?R}QE6E%I<XZ!30lazD7jj9kO)QCqDYX#+j
z)B*2z<pCXtvppLnQNWwShatGOyYV8cZg!UY8`qNk`<)Ig5|#W0feViP(lh6<R!tyx
zRHOf|sW7JqC_u0lXt9_=Q^hr8k70_m8Al?|1Ol`Wqlkj?)P#u*M`+V{;{kV6EuLee
zS*-74mT}|T3{GJRo>QZi{JP&r45GoHA#g!xEQr8@3&G<Op9jkX&Po~hx+2y3VV?Df
zO!h^=@=fM<_#u(5m!F+A#>s2P2%EL0d$c-54=MTKt(!_OXM^xz0555qdexx<<<H;E
zJNYt?6Vr><*=>`myq2?;-~+Pqyp^Qa30HC6eu8ns_u{-~Kcb{4j?}TXM^|horYSr{
zDfSan+|Sb3@oq2;o)gn1`v>no?!Xrvw8x6#Oyot8X6Hp6;9zeTYux6XEPjebbELA_
zisDFNxqYhoM-yWl1CD=4$^7H;Ku+{_TJ*EB=u^^|{PP~$@BgZhT;t+`9NXq+J2B04
zemZ+tobhba7u5P;?s4WIiZTU{Hn1CKYX4}%q;hgRM!D}vJ_XDv3%vzd5zD|xJY0Q%
z6g__@pD7rWqU77HwB&h6y&QIof^Y})tQbs0W&V|3Uephj%vx(HQi?74tjDkmB#v6^
zVI#*H+ZwQMJNG$fC3VS3u&QUk!U%UpU_1y6ol-N%eVhFI*jY<ApstaHO@x?^mU_CM
zj@m!Euc5>Tw$N?VqC_@3J1Dc2Y^@6PJ68t>w9drdZ&pB0owN&MT0K{>37+;Y!y2`}
zT_2fXM9R)tJGgofw!UB#TLVH_t7A|kMJwsTMA|8|=J>7<D=iQ{r{s_kR@i5Twv|g7
ziUhBweu(5*Ky$x<&N7aijVRYh+CZFRptdvW5!)*b-tZ+->tcgo3am1Hy`;H}2u#K$
zQiPI@hJ**T?_jT9yKNQMK@x0&Q{_ZOjC&}aEi80=4B}z#bf|+Gn(1w`wxQKeF?4^l
z6M;>Jyo3{!ia<aG(QmL>Hsr__$b}Hp;hv`e|1Gz{^?1qwD+{TspQpdzoW+g`)t5*v
z!^EG&MEVdk){OiO7(#EW`+&`rf<hTC!`r~OM}XORJ0Ombw~fwuh2!KgPK2*_|GBa%
zw+KT~kCSW%3Ww_#V1vzu5x#1W$L_d=CjfCFu!U>xg%ZXd-tRd_NMDs>b?XrxjuR_^
zM=D=3=Fw(v9(}b*^op+G9QYBnJCo2|`?-LWlY#wvB+Z<xrY@43U@Qdw@M^nV5>NUJ
zYX#Bo=eFK?6y(_>k{`})rELZgn<cw{pR?wV*c;qA6gH@dZ}Q8dQ29R)8Kkv$Od&?a
z;=Q@j)%kfe2-~SyLzWJtxEy$|lqYq{%)|5u)EthHrh@neP=zI<dYKecQcY}U><#$H
zg%`Yib;Z6ccXyiu1KBqSh3%O;x9OUYr{v3&dpY<uHLR^772+!^d}Y-^Lm?+Nfht=)
zqLrN9*s~XqxlO6ht1|`m(`5)k;hR&mGXon`WdMstd})OWa%zV%WsLtO`2mHxk#q1G
zue7g!?@>zYLvCVhS#vhx%O-Kk|K;VO;C^;?p^DoC(CmKp+Z=%5yf)z~<{A>%B-krS
za9+~l8Tdh|#L@fF<@Dqe?mb0PT(%&)YgUJc5b0gbeohBbiC!_MTS7aR-Ixl3iCfS$
zqf#>14Tf?p&>mz4-{`umH__hmMfGv48j@6d;cCExj=a{1#~RpiN1!mpe)&zTE;34`
zPAAC<d#64zX@vvwW2_p^y#E-zBEShOf&!@;u9s^75-iY*r&~iLyIUy`BE%`iQCrHx
z?STpA6u$$(=*BwDNp?c!bH5+ydH(c+CX0tFH+<FM^OZYKR}xhaPH7*a(2btIn0)Nf
z+snvttoL>7EUmngM|cq4G5VoPqIYcSrb7Fc`cRWL)QXyt=dMLNkMj;Farg_hJb_(*
z0*$QGRT_vY1;W)PD)jrf2UVnU!6koYkJ&s3Tpr~JreO<3PwXB{JG1YNx__SYwsOnt
zcoW->n`zjEqF829j5M3-n-iS9;}$@s9^b`p3LGA%Gs}zh0keC04aHyGB!-cKKAE(c
zN&;S{G29>I6|_H=45Vz7{*IB(mHS8RS%#)ilRt29WbhN{)v3h5!kk0S*UO2;(smg6
zHWPfOY#m`yq&&CP`#EI%@9OIOa2QF>Hlz*)Z+qN9K~dF_L{z)0=!3T&)=Zq14`X_D
zU7N;uJDC~^yom~Im#xzqCA=3US>UQIux4>Mafpx^_+IFg6Uv3+DK5$MWYc)&Sci@`
zuz*$o_%R+$uzU}r*wT!oYhU|q?U1JZbV|VFSvKQ90#0H|AG51A+|t&~xmEy9*JE-d
z+}yP&J<gK%jSD^y0upWonFH(t;*x@<@~tt0OyO_vUqK3CdNEuAFuBeLi3de<EmU)E
zLKnSxK|X|JX%que75EfVzPjpa{FJI?o#>?(%<9A#hA8>#b5|;4ak`@iHGZ%y4CXhf
zs4*={fZ%;)ij)q5CTJJ9w3LPesOsWbw;7w?Ym2-!g2UYH<snJ;o~~+HI<Kd@aLVi+
ze3{Y{6@&7jP0f<8lpcJ(jhHm$P>)$2eB=s!(I&VEU0*D;DY)?yRRC_kAH8lQ()QU~
z2^88LS=SwX%!)aeH|1FN$iLkr8VPc|ti=J@(>(;#;6=U-=$!ywGxbA6uf|28Gwr;%
zoiR?}B!@$40v+{;FNSxXw(KZr3Y_P6-eb+}+9rh`4Lz{KPdt<rCD-G+U$Tig<hLMD
zF!CWGAuFF(y}vFyK&xH=*0z7L+Kv9gQM`XH?dJw-j5h5i!n!IG0RfO)UL#;{`--w{
zu|h(uy<b+nzYfj$u)Q7Yd_2<n9DT6A4d}dXPx-v2@j8`1k9Bdq74g2+xLk#Fy?cDv
z_<Z}wdZG1sl=*m?@=3r&d*1wjeZQmq*zkG3cN<Q+&=o&E1N*6y7_;$8g`{$k$AdoK
z8T0gH3r9w8ZfJ2(ch=ofN>O-+ZZO}K^sc;FJu_}HB^n-Blr9GZ9OEhC9u7!oeXg2E
z;${63t?z#eDr+UGW31p_uv5Ni(47F6H@ZDtb5D~C+wyo$7f0jb-iZCVO7E5GDb2b`
zjnsv<WOEZH!$f@?!|{wAN8W+X6@~^*cJ6%!n$?g3Sli2xt~Sk|O~j22Zk#VV?l5g*
zYz|MF{*_5%x|)j=1App)@zdFa5>R4r1;lw@+A8&B{5EY#(T|FjyO#R$D8f8={#}*1
zM#w_aZ>rN2^WkEnqcbS6-Ijk<M0+vz)I)RVe3(-sftL2Ln4#4&p`P*;s<uNhO}F~Y
zYDM46c6*HJTc)rgI*81S==4qmP(5#Du%{uQ5w1Y8U#hIgHNNN<j>e?!WJy=n-gT5f
z0`)QDww2Yc5^DeJyh6-=^(M+upa={Y0A)2xnvQu4e3WO~>~$Y=&(4u&g#6?Qx}5km
z{L34!xnWGva^rm>2rY9ipbzR$s&eE!rqQyYftpMN4~EaojT@*)7(eXQgZBa!zHTH)
zg|BUJ?xw{FM)&xzG2flT#jajb{&4w&9;+1e5?=#ig=2V;zj5Q+3Lw22O-MDOi1!if
zStFtEUB>3^5qYn+>*aKAQ^qZF>XOi3L%v{Q$`GGN(t(S$WOjk19bjx0B`VHbEUA-|
z|GPz|_n(IuR)%|ybSOA4Yar27xZGVB4(^p&L+w|e{y1T$W)h&53dw?%y;Um^Su`Oy
zu%5?X;@D9>E2IrU-&c?-uQ7HA`|m`XMT*A-dHnFi(*9h@oY7xfU+WN#%f}U%6*U+8
z^i-5a=?H|f`Waz}&)cQ@X&nZG7uuB9xfrxPfN9gw&M$sK&z#%#wm<y*HkWNsl>7Yi
zxDSGQ)@@1+)}wY)ZVYNsQ&yx-$ERj^?jO^o#wE=rS8b!2c(LrFhLbWFDGoy|H`JHe
zg`%0gFT)DWqCmrKxpYyKp4O|KyU<zdDo<;E{TY@Qwq;%<6pdBpOQ0Ky;oQAD-s#oN
z9@FXrl|&eps~>6L0qc3G@!Xy7RYLJXG~NbttBBhVg^1RVx}`^w5Gl{}BjcS6(jom<
z1SH@(kHi!2M>AQE#cg^k4o;w2LIfNg4{@e=<|<j#-m{M^W-^G6J-%OHMj0nbNI7`|
ze5rlG-3?v9;#1#0bGZor-??0>|IFoz?^Dmg_x|2iR!F1lA?8Jmj_b}hVp}@@xkn@3
z93xO&B+!3@J~0<>EK?Kfk4&z&_h@zJ<>&w;VWH}<XBjAxFBcevMYy=k4D5ABBi|66
zMo_vfqRDVNL+Ao2v1OOZT4vBL5Ft=(Ma!+d4At<w$R{`#Ss+HzVJw=D1mz<%a|b3y
zv3eRK(l@_k7i+btm*-iN{opynQQ0lg0Ob)|&&X%^JT9pQ9~XU4J#bZE8VaEIlz3>=
z;X(Ei<05qCLv6?T_1;@UW^qce-v#ZFyZA}8U`L*6?|jl*r<~NzaC>6%T@HVjJmy;J
ztD)y@o$FB^o;;pY$$1O<uP-3BJ?6-!g)vH8s%wl2(F+VtlKBZGr7OjK@)XX%G(<9C
zTf5aG-D4Id!b)Z^RucKZKWO~dL-~TjM*UQ;Old2{1M%w0sL};-6`{c$R7wsLhW#{6
zb+W}IR1TRD1eJqAf1zf)<n~ikMv@SjW{o<5(KzpaJ68aT$=RbH7ze3+?tTjnL2^D?
zKwD_Mnpa`8mN30f{ajEuDBRv|fGe);$hVAG$Iyp`Ef7$VCo<%RIe0@qTBy+ie#(o$
zOBP|LnNHie!WGr@E%ky^vz~U3pQe+9x06XMG-*0);RrZbCR^r9J`)-mC$3T%AD6p`
z_apXIZ@{P8)$VX3!#(_V+sy22fEyT4pBaqKdLWfJ@de40^*~QJT^#!AE{_2!Unbv*
z0bsnAoK&a^uRRPg^I0597Z9SIDV~z8lUD(XdzNPLuOilR&cD95Di{;A0TjE>NkcGJ
zrpt$4&l~0Of5-7xRO~h3OdkF!`|8;Y<%nh<>1d5##x6rgCz_J20ze|)<?lRfRo`I2
zkq5{aA)1i%fa(f2W02>FFx0owYuEq8gjECCB7#xtFVISTtjsv>--<9i`sIme$DW#K
zi3(DzrTT?u0bOE0JlpL)T#E8N<8?aZ@j>)@<Kp%i`+i=USCPBH=5mgW=_<O|ZwSN1
z_9<&5rFzW95wxp4Vk^nZ<tt9@L^R>*S=;2H1-mm-)vIiW$(3x!rt&=x1A6rM0FlG>
zX&R?Dp<fdv6Q}D5=g8y3%K7p-5zkI&v}@Z_=;{eoqsl4O;HeWDo@qAU!OfUJ#FS5x
zM2y;$A1=1nO%n}XsF5~3vBW@m(8uUymzl=*UbYQUimu^8VXvv*UB`2?iA8AdPBV{t
zOEO)rOLHGj`|uyvo9|0q@3*{~?@P%ZnuBYb)}~!2Ti$O2ojLKVxU*RLpG~)I)_hJ^
zJ6{c6i(X~4=1a7&Mm`YU>0f+`$M&=4e8xWC;8PPktC~8ZzDL@^zIQ1CX>#Tc+@Z(#
z+Je4^U4rJ_SSpovKjrNtgd6r6f_%y<>3_d@@!}p?oFeH6zOZ6krSsHZMH4D*4bh?&
zj55$0ZM=Sz^lrR-vr3UPg<@~%2vpv<=!cako~N|VXwE=RnD+l7lp7Fr!1|LCJO})c
z3i2}1?)XLxgrt%dbWMQ7rgkaMags5++ZotbL?cxn$`3M6KT)~M1Ij6d9(H)cVGn4E
z&wH8=F1X4%r{Kpr>9V$7)zVbo@0>;q4TA5a^9Y!IHI=wV8R=f^84eQ}I`NZWUGa%c
zlEV4Mf!Ps7$h-9Mn{g48P0TeA?eJ9T=w)f*7R!yV#v!A|A*#EAOJNOj+4}=dDDpKx
zGCgXgIDE7XGc2{<{z1--ZZs~m_>o^Y(GV&v3|-j5cc=Rm7q~4lM6<id8SHD%HGNle
z#i7RM<(w*J?n+#DDfH;kLWhL+$-i$ev!IF5BhE@i{NPfih+RZ@SX`_~6j)JJLWOVH
zGFyjUVw+_X&SuyDx<==yG=my)?j4Gd@I-`dfN*2m#Z2T){tj$k4Yy)*#@FXIxizFY
zVTR5G1P3u<r?BJOY|TMUV^)Bb1<q%X_=+CPSeUEYapTwid;hLttV0a_kx)zBMIiV4
zYrP~DVNsoxu0J}Kquw=GD}_8FEKqaUk@n{%0XE<FTmW<(#Rcc(eS4-$0rl(rS#I_1
z1zCCOq1)rmf&3#i4YOS+Qekarupl!8hM2e;kEyIcd2gOI#B@L+O-Q#Q>;-l!=9A=J
z?VMZQ7({~DOHawQ>}KL|KEizi=TPf20Og^8YVOK5ArSA$kBtZ2()LK~P!@wdz#v@e
zXB?cv3(I`Rsx89eEx)P@(jralIsMs;80<4@ur#MyW^r(8i7Gs*VaPppSs?SaGD9k;
z9yFV_Dz!+FD!<CpMs;u;Y|S`Zb7VAfGX`dmun%-$^|CS*O>q$33m|(BxG9<L{a|BZ
zT}fn17A~<#9<DdjV@J2JUx`A7OaReBD0JpvAFH2iY<|o&dYUYbu>2*luqYV84s0iY
zwjtU>h4exVQ`A`CIbs|syT}LIc$p-6MjPe}n5+n}f31Cusfl0wLNsYxvJn%w!;uOr
zk${>@^KH%&`}`Z2jjyQG&`_gOrg0C+q~lQY_hV@_f}7du8>NRtOl>EYZ7`jzK_}jI
z3Tu`76+!h*Ju8i6hp-F=L8>zlPaF=^dV1=k3ytg_K>JAzWiL)HO(th))Sj&dU(GPo
zw2K1g2Dvxd?J|M&bx`>)wd7hbPq#3Zlt2AV5iH^IQ7V`{)M~R8%eEo*1JshST*lNX
zA9;+bbv9@<S>bhpQi<DoAf;!B&VQj32g#n#R}}SSwU@%cuOwI;j-F;Q`o1QYddANT
zOyGfbX=N(@n@$2_5%=?O?PYRd5Bb{A0EXD22;nz1vPT-F<vPVn!7~`MB^H|nL`JaK
zVkuKmUt??m#C8StPV2~(0vaJ3w{Qw6^Jo}kOupkUoB`&Jv&sbP*yreEQ#Saog{~ty
zH}17s{xJM@N!!=R``(pBFr2wF(+v2_ig*lrF>KUB**V!eN3l$f21EudzXZ$*!fshF
z3!`)Lal{oMys%GIRx|H8^Zi(3!S%BaqSiSqkDDs2mm6BAfz<8?W1%VSk2klJp-)fD
zRX@Ua^t9I7`R%w-8EY~r9*qJgcUf;RVPW=J=DBhRZc{?zMzwa_(R!vWS6@eq#WZF8
zz*faqm&i0Mo-Q(#N2~mi$Z?;L8e}<=Pi|qIBm_-Fw~SUF*M+DHwZ6GwfOnSa;U^lP
zZ}iaAe-1z06RY0U$TJSfn~$;GLm~MahBoYMrA5p`Rad_E-X2c@nk~C6>VD={-kwWm
zD4{p|AVuzzL{bT@%zK8`X!Q=)=v|x0^FC^1Ri*BWesY_I{q^->-`ddS63EaTBsM$@
zHoU@?Yd7q!6Bqtcu~26)%a@^hcT_3jY2MPGMT4{uQA7I|bdOEg6)zon7Y1b3P!6>I
z3mL{P)bf36c}tWX#N%E}T}H`mztp7QKw5Gfpb^5U97S-o1rim0sYJZwiBD>TrT~0J
z4n3$YziPK9wf0qE#OUo}v?hYfC_Wo5(8kYGW{_y%ObDrb8D>K2Pv$5U2pL%`44zKQ
zQI#pn`{fb5Dc494!k+;JZGnX<#vavU{X`C%I*v_i<rVdPGI%6S!f&%!Edi4*0Zdo;
zm|kGbx>a8;G<fObpynHVIWoUkf$tD-4oF67=VUKTtLkZCDAN}?68-`3>|X>6iVfeY
zq~vPpzTbf%I?C&|01eM9tg&vSuZS?7BSX0CWT!bFn}zz4FF<1gMQR86J6&#}FKN{y
zVXrAn4Ui;f4=174VRz{<OOltD;QIC->n}4>71EL<)dw93%^85)DHG60A)OD*!(hCG
z`GuNfpl!cn9C=ad6cORuW!BA3nR|wc(cP!XqXud?oH7zRfsHMvHw3{so*Sf8J20b!
z))&THFq@+-6UG8y0%lL<)7#O}^CZYiIYu6Dx%T-Qnsa;Otnvirp<~jc6oB2hD($Mm
z0CR55imbh)^UOb}q~a_;b0<@M!$b4)ey=b^z4TSNWOk&GJEIIcOrs>h+L1cJR?!(H
zVJR~-lu4B?->g(HSeXrwGXz*D0+2ENS*0SQGbcJjYeOxgJH@+CTLI1&WXg=`;At6E
zSu1YG3=2+&OM2&_>e_G&&uE6T&stxnfEDM5Z1)=Uw7{!OM@l(<d^EWapJW*M`%1`%
z+PUk7nMS+9ls8Ty2s8Lb9`Zl%(Yi6(eS?UQX5-4bZQuA!QhuvvrA}hGfl#htW27*N
zhGh^WrdNKCDQ5y&U%AxFhX$=%%(BC-7Q-K(Y=?~5>C^RqTAEh#V5V#3fofqk*^G8I
z1b_mUY6h4po1lK2SSoDpoUm12KjNv1d<3e%opp?5JW{zZA5J1)r2nFj)BD2nBL_0c
zBnQ%r>KQr#6Y{i@qQZ*u5=R?a4Cw&ge};B)({YuLf0$BrxZz%&FXhY?jogUUI!j6b
zs`2pUs_jC}R>p$ldexOMT&ETTS=EN69U7#n7rd$$t;+Z|c^4PWz8tgaOswEutVGvv
z^CdMBNTZ!^7T;(_K~O1eDg_mD+dJPH_HJ=vXc~Go=ZtEyawmk=;K>f>qg~V60|r(I
z1p-xbU}FMq9WSxr^h7BJ9b<kXSl1(2uetcA&(i*4aq?%@-nSu0==~mrObD{c8vZgf
zkSTZX1YSV<@xuk=ej^#gF`Wgr@y{xw#Va#(X!~`nH&U$R;DsLC6CXqBddKwIQ2|Q@
zJYp4jGJh%gdU>qSo9Z%$&{ta?6TQA$*&T9UIJU)l+}G-ftv7-$&MGFKiCg=CFjeTt
z#wI4j&5Eatt{zcqO{$VY+|BvS3s}9Z;(4Yifrdlz)`N5LZ=vwLsE{mm56-NUjaSr-
z+rqgE8W&ER2Y`c4<W}L#^6Ba!REhBzz6sXa9|x@pk>R!<yY*~|^qu9Cv9#=lJQLPQ
zMS3v)zf0rc<m9O&ZSb^Br-4O*eNTg?zop<7NPD~OZaqsUm}Y968Si2S*y)Y<(Tv`C
zju-2P0Uf#TQ}i3E-Iq5Ad|3n;#R#<Jj)^7szJ;S)Kl`QnE`#~i239+&ka7apy!xwr
z;0_FvkO9(~&N7&lj@s~A3N>vygo0wQ2y-6|b~a3YpXsTx`ivmMR?8(0qJA68A|Yk=
zLIG5(e*B=mT&Y||Nu-yMXd%&yl3`v6(4Z>#+6v2wJYxoAI1WM&tYjs$a(t2~DJpTR
zl6K)leCfLR$YBtUu}<UE0j7@Gt)P*8#6*6}=$9t)ZdrH}Oz0+>h4#=#54m1DLf*Zw
z@)wo|x_VDbLCK-Qw|l9@T^<Oe+4nTkj}#oD#g-ZBsa@jMg^rTT(l6y-RR+=I43@Nl
z{EX^OHOlT7hxLSiW&jb1IiFT*!$sUPic&~I!e4$KobX6pd49OTx-7%Gc+7CAoLPY%
z8K6lvAu9krL1UoyIzK1<sIlB|4w2w<sJKz!HI%}HcDqeN-r6q9oiKfQW0x4aDlXb2
zr&)^R?G@exwdD;KRZI^OuS@X*G;7e~18cuN4`FgiUZQMG`#xBr1k*pnT<nMAX$_bW
z0UsVUzGf>V*kX5x?vR|!t|6=RZn;q=-<zZH15J5_#6qDdMykrhN<F~KjSgYjmnEzi
z2NNc(Xc_i}#mg2wz%-W(#SF-iD+77LZ+FaBLNPM_YfKPOhPDi7AAxHS{lpM7No#Nd
zsc)iUYU#0saU+du3Kp}Sv20={_w6{$X8JE7Qm)$vZf8+<5d=cz)cFutq%|9ujc+Eq
zi)LIY?jY065R5<AI5dc^ct5wJBZCR$BpX@7=xV6P;fml9lb!4(2iIUCH*;T2WtmvR
zALM!Q2}!MP%;C%2eDfGq_^7WQ=bZtn@IYZj2G7Tnuzq`Is=Y)_gv=aOBsfcgk^6{@
zfX(~4Auwm#9KWxpq3c+?xJ<*WUJ?5PJdi!px4VNK*T!6LP)f{3d@Bowu`rKNBjnmi
zb_Ii=8z`~$yF+4(|F_8M^Y6grg*@zu-h9#EKUJ-#sBu-&t_YoCRK%L>tg7anLeB&#
zL1A&o!uA%b5SW=`R0>1X+eh3;tLl3d1=k?po$n(dvFER{gNH`kU*Z}VbJG&j`nw?}
z{j}ehA{D$>v1Fd^&xaJeHX2u_3$#ky+`;)Kvs~ez_485dRrEN23%r67czb5XYo`wI
zb7D)O70S8uePgf=q0IY;=wJ+%B0#4IPlNLj)!y=X-~Rx~G>5?agPH1|L{tCdsAB$i
zjw(iG`u{JADoqQERWX#eOdWb%G<nsMOiXUc<DKS7Qdu&B#aS8@e*;Pjo3~zPEP=+4
z0$!(rlvpZ_JfeYcwbuHe;3rq6!^{?k%Zv~SaYlfJ?6m<MHwRP{8&slbl}E&TWV_c(
z>ne|rO!-p92%!0vIlW?J#GdPwl6dJc?rNdUWpB^xB{WrPhUZ<J+8EG()oj2)oQ&JS
zQxFJ1L|DTa*n|oe9m-H4e)9O5Gw!Gv<UNtoX+}vk-ej5Dm^Y0n^cmu_q?}U3L(a$C
zp}uT48g&}9k|bvEjU}?r)3ZxX+rc&b7%UbDnQrXD4_A_;LO(F0HfdDgC|r8xX+CBM
z+7JXsHf=Gq5kqqKM!Yu;&LZFy>smc-9HAwCIKt^_4ASx8(cYLE_GEz^spie(^7bxp
zvRp;VShgls@Po{X-iF-09>UVwlpd6|RYY;=NJ^T`TGFLk_E;=@ABt#Z#O3|!Fm#&-
zFUNIT?ZWe=jY#xYCFN65q0w3mGK!F<imP$;*_85Ik2_aZY~8gvw+_#*2Tum5ebI9{
zA1<P-=)<}gs$LSz@uG;MRre30_`&V5S~Wt#sW1$3gQvtF4^c1HvP*lN4Mg-IlX3hd
z$HZ@yx*D&0z@G!7h;Gkn%0e<uU}70-Z%)xV>$zIOzANY0yK9$tNrbFO?@>;%2&NJB
zwuSgm<{0}qJ#tMQmvl56+^YM4T#O~shqr`WP_8~eoi(`K5WGV)3^b)<=|-}e53Igw
zIY!$+J@NbH2lx*J&d6L^_LF1Lyo01^oq1i~BKuyMnCTmbWE*#q*Q@&O6Y1Mx19xwd
zG592wU+pv%GC?K3mb_w@H1Is~o8Zv*?z~CmpToJvlXNafZy~f!8k>u4tVE=g6+h~4
zP~n*0`ZJ^5=9#@Jr*SnKh~s|5$YMKx2^}(^^?kL)bF~US9Rd?Ve(=vt?3idj5*&Y5
zEV4c^bNcS0$ZDWuyP#f_r~@o5{sSS`?B20h>jW0wwjs1-S7{!-`wi|S?9_Aom>&#O
z&%IP4!I!Tk6w*fN{C#qG{<U<kOMMbz+nibFL?6UuSGaOpo$928@4SiQ(h7jeg`mMb
zkr(?`KHJ_;S^H)(z-d|r>_s+hcjGdq?WJKk^?rLU%Yj4Vp5D{)^F>%f*W;ugrarjK
z-|Z_ey2EduA<&Y*>hD;X4B5r5^7O$YUiBNFr*i7N6-LNw&xNz%r5~*<5_|{clC;%G
z?}*Lp5+BI78*K~^AK|E`4)C^M!<pikdv~>`*NMIy4DiN&Ye<WcI!FS2VM+Jq)#h75
zX~b;mUiDta#SXWP=@Z3h-t4my(VoY6;W+++uG~z06Ui~x>g~_iZ|R{-Y^XSX8m&t&
zN)d6wJheZtP~+TS+$B`_LR+>=*!1J!!$2#ZYHK){KE>h!!cIyP-_}!=<e}|Bf|-o~
z--p{!f;CWUv^;!+e9CHy*1EEi)~D;@&YhzJJ0*=f+RC2MU}no0l~d-qAjV+U5r+20
z7UlZ2-_4qdj?t}l%CW$YdQLL^6pQy&9;A&_a%+=b^X3Y!aIx&mH+el0+kwwBp!{rC
zIsns99KTaXANxzn(JSQSMIWIffN7l^Hzz5QauZXS&QJJs6wqvN)0y64Akrw7`Kdv)
z#_H#yN}B?=M=!$d-32D&l&5*x*sU^ro_5vCN^IoRif+cmAEOG%hJ6z!frcs#adFET
zLpSh8WE`@)%u4jy=?}ReelLhT!w)}T<(en&s}|=Jvy7*s;iiGVX}krYuA-wWvz3<k
zSi`jU5AwOEBYd5Vt2L)Y9ie2grFz#{{VIWM)~t-Yltb#(=%aierxB{$noI<Ba~MCO
ziAEYhYtuP|S-Aj*C1Vb9r$N+gt#y|hJxNRJ{_|pA*mm)W5n$lhw%K4d9r3}e8fSgN
zZEST~r`AF$w#R7pd`%K<O}LeYeUvP%{@q&zQ`}Y-r7>hGI^Mzgh}&kwJ4H0lo=|Uk
zA}^(&(D*Stl?qe4y?(HqiGbdLaMsuQK0l2{Ie`!`wA%RuZZ*K6_w)KECs(6u9uRFb
z+#&O!tT-3^iE5xI@KiNNc{LW>jNYV=fQJsoPl=pBR34ok31_7hvM+@!iSm@GY;3b-
zzEquRS1_MvJ?e#S&e@<@bK15Hbj+HR-&z-4qtF}#$bIeuDs%E_eOg3__&GRd<-?5;
zdrb%UT{Jl7u8_JRl$8@W=!&8bJ-&v*kQ#rl|NMhtdBQ~7liMO<eaiEJF>7JUgbiTO
z)xCP{BvLiG9``o&Au_c<Uxz&)iGQZ>Vk5u!xqE2$(CHPit0JdEZlLs;A&S|Ff%8GR
zJ-y5!y|%0A7je~4m|&Vh@qS`KJO}L%HjSYdhw5@qz_r6rNh&idLdB&*@YULU5v7&a
zFe~S8JaLOz9qAEwY2)jh4<gJ>)b+Q!F#eLR!!X`XKuXKnG4jgD<hr!V+PTo%Ztd4g
z0==wW@2EKu{gkb$I;zgzBmJ?HGbm#kiB`Znb=MEIv-OV!H}9agA7*Kj=0z)!w0lHl
zr?!$03c|GF9|L6^ZdCQ*Rr;GHWy^b&yqTu(iPW4tn{?!PpYNnM%KW6}U8*N>_h(iv
z4C5%Hx2|>D$#%Bh`tTLFXqWXzl{4EU&v_@H5xQ+{l6%#g6CvlX`ouCr)@VoJHM_&C
zI^1y_Ba*n|D=qldZU%%w?c;;J4Dh1vvOb~}RF=mZxNF@H2i>+o8cAH9zS~HBgKlh{
zTHP+`^}cRldaTL6A)9D&lylX?)=7dBA|Ht^+WIeqD>@~UlbQuXw~^!|w<L10?0HI$
zRqam3&d1>2R&04re_j;9zljPA^9HuVLu}u%Xd-RACRCHwIU;r!R8l3>egN~KoWELv
z4zEFo;ZN0jPLv8kOwn=mU$rmxdAPBi(h;ozaQhS{`cjU~Hv+}C#ctM<mZ5RqlS8!T
zYMe_6*gehf8gJ80MpD6}s74-<Nb=XU_wu0KuMKBH+@Hxdzeamz@x%p^LG$83g(Ri{
zaN$KmLkxUF^75U+iq>`(N#J!3^j0k|(1hfPDm;0bb^|P_@P>#}G2R<y5hMxSqi!le
z4~EU{sLZS=qWr~1?Kp)#z7lWYLHv8n^#@PrKdD6JjT~&8><x?@@EQIf5B+2nwKw{M
zQ1l-cihBAEv<jabqt=d}Hyt$o;1iX{|080P*P@j&GBnc@uyNI(`@CjjWu{@kXJKKd
zVbS_;dQw_`YipZNxqqP~W%+FUPtyW=4n`uMs%gcHES-%U%?$Kt6`b@P|KK+LgW#0@
zzx4d0g|PJ}NvWB&39X8mHNUlk+5dC>-&Cip|4A>kfQ_Z$-%!r>AC=4KTbkK98T}3Y
z?Eg{!AI|@M8}xttnf^KQ|KN`mc6Ah0aQq}}r4^8(mA0|B(zB!$<j1F@HPFMS`|p9J
z|DU|Ge^u@eJpJF;`xkKjCqL<F{^9B8$G`acFNC-MN%r6R_%Hv2{IBHx1<n5}xqm_H
zf0FytKK=_B|JSnr0<{0FEW`gLei;5De*Ubl41W<re=7SoaK!KzarCEl|00(DRQ508
z=}%?<2BsMP2BsMP2BsMQBBuVVzl?taSB!rVSO4=l!T1+3^>1>215b>915b>915b>9
z15b>95l{a%PJaVSOn(te|I;SZU&PVB$^AtP{TX(d{x5OF^fz$C^cQjTZ~gp>82UH4
zzlfiIllzO<`O|Uz8~9=Vi}?97yUc$PLw_p!FF5*PWNqSTiqAmL%s}@U>KcBQ=^2^n
zXa&q19b}E{1#PTsZLI$Y&)Gg>W-}90M|{@LS`jl#M<aV$5zEh5PRQspQ2y^wRNP9>
z<iDb6T2&c+b0Y&s+W%_t8RlC#aB<Pf+J8pz297rN`1H)5alWOEy#qe|pV|AYbF#Aj
zto-zchv&bVD%k277=0>qHZw31wbyg|48;C9x9h5XzJBhPONRiyMcso$-h(9XPa^A2
zk`F4G4Js)HmB<I>yoGaO?kY}-EQYf5`0Uce2r7=z8}f83DD?lgAD<L@4~q<kqOTpl
zkEeBA5M~aSUum<-Gi(mA&M*i8K&ua1lg+$y9_boqxP<Br#xAzaL~|Z$XT*f+WrgSN
zYe8mU>Sq*$>UryaB#sS@%Nj!U3{oEbI7y5BdeMk8sZ1UlQ99hxqG8GweOLfQjx#nw
zb%@L{pK#o^s8Ho>_N$rcDZdU;A)BR}<LPMqYLKv_3YJ9V8F+(g_^_j&sc?^S>f8Yx
zVnQ|st{TV4daOt@Z5Y}}Z(`ie#E2ab5l2NQ)s$gJII2Rt=v@Os^<Ua+?s~8vND({M
z26r;W@dD%Ia+_9f*=J-H^?i_LA}~9>_wsP61;dUSSlY<}Gfx^ngf16vJm2%Klla3n
z%C`ljvm(0`WbT}Utf@0HI91zN?<Cr}W$wJkigG(%bhuhLk!O<Bot5t9&tYj|LysaX
z54uK<&&qoS5D~pF86Q;+Gxo)~5ND>^FTFF{*1?m6gzkb^94@HuAp*t-2m#WougCxg
z6I%))q0Q0(tQ1E}JIv1_<s;=?hm|ejKZ>=*7IsjdCCju&X)bL<5<;vMV=ucB3%ab(
zqc$V2w>aVWP{_TtT$9f#0nANJ{m;+TY2Kqfm;)rl*w*j|&L1R%gkGo(p3jhoGx3e#
zHxRR-p#t$rckM$$goFS&l^LR`!>~{RN2R-Q4M`y({?_lKWw}B^dJt5}{AhEbp+^$;
zu+y2m3Zg<Ng{8UeO+rE_H3Q+8`t%W@q1H^7=-l7N2?=x4e(q>Jl4+xn5QfXWUi{iM
zk|WH;7y!w`IY2<1p&gKN_YTPnC6};^>m0!TG}|D)k<Z(d{P`t<A6b<&*~ld$43~WO
z#wjC5jP2H45Gw!lz<)1DPFaqSa0GFTR2P+m@Yh+5<(EHhh{tgh*w6=rhH{ml|Ef>s
z6B5dtuakZSC!g^UdnxSEb<YEDgK+%3U)93^pg_{m;n3$o?0_6Q3K3f?;Jtp!6}s$Y
z0AM1y98bZLBFvOkM|ubM2RwrBh8-EHitq~TwB5Cf%iM`j<>BQFbz*LxljOSSW4?jP
z(`wOh+t4C*#MK92!4y7<wJ(Ql=99ToCeFZ5>rF*o^?rI#6Iq${`bHA6Ep(?&m3K<!
z?Q=Z-HBZQ9kfGK6rcas^hAbD|08@+GjsZ|<lF@jO)6?|{mc*F`WU{;}o`TKf4kzoI
zExt>RF?$J}2qVYy{*j}vGRLfg(x->RD{291LOQ-ij{E&1#eGNW;{^97Z#vdfL#oHC
z)sdCyOqgCX9vRLVTwjIXa(aXj-i$t7Ae9!O7E#e<usE71@wyh)$Ys^X)M7Pb_-$Zo
zm*y4y(>$XMJW1qE^waZHHcVy=EmenPMno@tf&$tehE{W&hp-_%TeY9_jq*bZ9sqEv
zJc~u$q$jLM8Z(9L(07*u4~3(zpT<{!+xqA9Y{i{dK1t8}53`P@KD$YO%$>)K=gjbV
z^iq(jCf5vJA497?^+V{8zAgPXGdQl0T~v9%s;Y>}k7Sg^7Y47Dk|U)lWDmfcs>qV0
z`|lBbTZ&oV<nuLsMj@Zj`XvmQ!XzZ?#HG|oYwSivu?Xs8=E8<WZk&qs6p1WeBiFu#
z>l)Gz6~hCr)w9=VCQtmxVvDu+4{CE`@0cGGALob6XPS>Ulh{0fy00Hq-JRVgCYV|k
zun!@h{$OgHe-*oFSWX;t-W)gqtl<0x-!1!HuXW@e!nxOBeEOm9ukq}-+>xKo6#GD1
zRCxftj^P2*#A&<!b;Go7MR-%rS$&yj?8sc4HTmSsc6At^GIwARDfNxMg~Mxsd$Y-G
zmwC(nqCUZ~4js**1>2%4TsO^CLB&T^QHqeIO{k7_$SWXaKVN0LJ=-gBW&x?Sqi>lo
zzg3Gb;vA|mWV)aBh{@q<l?~?2?AN8q@niTG)4(w%7q=?HZq!F63{LE1rf&^*FD<EF
zXMu!U`74pn&c{SIKaJ^_n@c|8c=SVhGQrWMgP50bGQk5Ri#3JsFOw&|3BuDD!}@|;
z@#P;ImiN#bBkQZ&7@#Q%-C+j5n?KPOotNZ`WO{`-f}__?v$(-vi+84v>kfYTLle{?
zlxQS%jyq~cx)NC=X4}ggyAO0w#8u=Di-2h4y>UESqY~PTpVZkfeDV?fu9y{U*XgPq
zfa@GFscZ*^#?+7HG5{VaAk644?yh+x3uX{awky1J<1DGA&4WWJ*1Oj;8ZYr4<Gg3;
z?%3iwK{bXu`H<dQQyR8wu2Nur@W8T#erapg*xaNtz)_@|0l?qbJdoucNu9m79BN*p
z#MBiE7X?cr<G+GS`@QN_OZsQhOZ*3DKR+|U09CY`$i%Dq?_BjpwI^lp^+TCt4IzkY
z0d;#7`exhjk{E!J2wO(Q4pAQ$mgVoJXs9#%lM&B!OShpTK9MZ0+qnbeL1O&4eZ<jj
zphgo#qGtw}DT!z^l71^!y#_b?mUezFpAQcqj2FxX0W+d{Wr-6d8OFmO1|u(AGRY^;
zux7Pnu}RbMZG8v{y8PhDyYyZ3k}MXbQ-r?<gdGt&1ajqd*@VBdj~yK%OdfMaYFV$?
zX^`A||9W;Pq`xmACw0F-WGp(W*c_dDWo`Q2$sa+1>ku)VB@=Ckorrr=r7M(<Bq$<p
z%mzmJhmPf4a32PYw&Vd)`N_UV2pc$QW?fE8WU4IA*V&8b<ii%Q@$y_*QP!{Fqo(`>
z$y@YGzG}C}vFWG80blC6AtnO3ikBq<X(~RSlTlAsm-LP`?RIt?XQ_6bJCfhe*+5X!
zx;1f>Ja~-VDt&AYlxMCd?fQ8S#1arAACtE)>!Lw3+u8M2GSk&Wzg7zA!rnNer}P9V
zh<{t#km*7GNn%eEDblq+BNp8RI=C}j*}ZY0pf%e^Jau(QQYUtK>-^M2RRSAwje8rn
zRA*O`aCJ`amXqFyHwssThCamrpjZFY;{cv0)>SkXZ7hOE3zdQSEOF_PbSDVRs}F_s
z-foKaoZO@KDp}aCh|tGvyb{}8RB4nZ{Eb>{{UNUUa(uS;MoolQq`f|a&XMB2IFwiX
zky2Ak;c)qSs+BLI;)ibVp^2T@rM1=B)khu9n^I=CX*7lFuB_S^bfzTleb@}6oHtv;
zF8DlWq(3HY>S%aY;u*bTiSBWl{5mka)^A>21ajW9Ds@W;J%3S8SpgGPCW5!b#6>55
zdW<uAu*=`aC#GRvYk=WaV;3-_&x^qlXJiP@22z1D`t(8gf3I%xf<G3Z5%K-h^I6cB
z1lr}E#o;M9^=Od%0WpB?Xiz;wl?CO2;#5E0mkW%h@oOGa`sXI-*ilhvmiz-oYm9Yo
zd~545rcR9Hg|}1in^J_;Prc@%{{4o4`3QCnO*{BOcW9M{e&OF)H%Y`<@&>~SCTvc5
zET3<}0YuhE!4nkrB=fa>Zq6fWhL+os)U2|BMG?B+d7O>JOu~uwh%U@96~lU~$Y8XD
zkr~wm#T;coFW7%rzw`wcOfs{5CcrT!;W9U<eO*lJ(F~izfO$}Tjb_&@5e)2O_UWBY
zorSo1>hU3npcel0oVxz=)lAUX+<-Uv>AJDXB^||ar((oMbhvisS2ot=T!;W}?)M=N
zOwD_U$a3?LiadFERjJUWkSvMCrjXk`gCxtrt=^LKC*cO7V4A#?Nay7It@p!%E~L&a
z4*`i;VX#Oo+K{q$-&m!Bh?E0{!7JvS4*Eg$W3mfAchXk{Gd3`qi@Hef&?oGgfoY>1
zSZ>GUyqaUdUHFp6+>d+PC)ll?tG;ebH=M@jz#OwBygh1qh4U)O-jAOaw(CB6*^~F8
zK{l)MIwLgl>>nh&w<u4*z3194B=~AQKDEJf|A(%xj*IHs9<>0K5)c?#x?$)N5P=~D
zY3Z3Eq`O1JQ5tC&TIrIIlt#K8x*H?}q#NED?!Djpe((2r|G+tO&R%=<T6>>$)>)lP
z?2i4_parB11oK)HIEFGj-jQq0AHLD;zPFW4De~{@SGfvxkJ0#!754PXIIt6Is>)Mx
zhtFwes&miGB$g)gqW=X5>Gs{jW4O3Y*7?aitVdeX^3*Q#ED=9cSA)bEey!tt&}9{N
z=<L#>)(7M{f;D9{UO0y45xwb8O1QW(DZ+nGL@?Wl;oyd(2g6Mb7RE*0e>O5ZaB|5X
z*)8&!U;S+U*o^gK=z3k>$3#LVAofzsb)zxN&OeYd=VL1VuoX4u3Khg?1GD%uV8%Rq
z?>50MiHH2A5v=WbM#+xx?`Aj;<MQ+Aa{xej4%>-)FMB0~1;#j7kf$+wWW^uD^Dn>U
z-Cui!!3Hn#@{X2^A>n(yf9dn&D!Y-XbV|fKx#A25b6BbEBCGwE>=2eiAnR(I<jOE@
z<GgYHJ6BWKqmcT0SIjrAePybd9_3DfBJLn&g-dm<%v$+L=+wx{FawQu-Bd5p(mLv|
z3SY_!Vn0hvABRA`p907pg7DWj9(5DO`17HliafZ20>qq9>UMWm_-<8m4S1u0ZDad)
z6t#go*LoP4JBU=s*Y54hgLfi<3L1YWG%~y-Z7<ZQ3C|bh+!G{@w1f7fbT>;_<55S!
zY3XgpIf>EIgK&sQj7aZC&E~YHCGOQoX9P@&$~>H*cRuEF;iZ#QlnqYk<5|bF*EUM8
zUj4Nnx5oR_w9=`fk3*wi*Srq?>&XZI(ZmE~KUf!wEwB|jOwx#_?oZbgtG<yP=?us4
zJUs(}NQPj9@-#R*>fYIJq_|Mu{9!y)Oaa-|*;WrFxJlZJO+E%|^x$Rs4w9I-#PoKC
zoyM+nxAE4B?h%^sxJ2FOqSozWVb=B2>kCraxgg;y2D5!>rDWJSP17WPCE>LOUc_vr
z)9VXWv{M>&O*<wjsEGuV(3}MaYDTxRPTqAtA#?mI#r&vuee+K#4YgBXHiy7{MT5_J
zFQ<%)_4*>Sj<5c@Jk88`Di%|5;i1=;9OQmJO15kd<|u0Cm$K5&!RJJ5nRln6uDaxo
zF%jv}tqS_GyRMq<8hy;+_Yp0JkN3DN!7jm=Kz9rPPXX^z<TEk2L@5&7{Drl@aoj|`
z>u&iy!eoYeE)ekuJf5YJ(-mu6#q~*2B-1J<rX=I|Bos1}lg{^d`NBqfSyRR5HFSlJ
zlZ%S1kA+FVTNwWGgO4*EFID@ON1<f2-QPTdCE3Bz6HJRl1YwWMkPJ$;O0$`5$r^z-
z*>uWs%bgi3AHTHYbZZ~oy$g^m^P3Tmo|FLcM=Rpds>{R}vfxix*ZeBp?l}nIrTkE-
z;`ze_;PLA*d+4GLi1-&wMbS$C82Kc2_LI;{Sr^bnBuHgaZj}tkc(LjhzqWSCs+WI0
zMfv693S!_eWo<i>nTU7XJWM_-ZvO~;bW48fMsCH^w&p2xWF$;utF0=`z?dbgbBuZb
zbgooO2=0<(`we8-RDS}nLZd<#hSVAw7|YTJ3g-6>xDH|92Ztb<vi7z|2v!2PfCI?)
zlbVJ<ep>8AeEGSYk}z9)!B?M4l>H4Opl%&d-~l*}AzkH#9R780_rb!#r@pMV&JD1H
z?gzcFh~U9=J4&WDN*?D2nI&M0pYQ+(LWyjPr;*_+6M0xeOtro#wK1r7eX2e$Y{y~a
z%iOxspKQ*KEti^<sAj3V(jABG26n>B2M>u?c+10%kzZm?<(<uI^!89R(~<c~GPq15
z&AhdOdm2Vz1~QwcE!0FI!G6tB5sQk!OEzE$wGW~=5z&$=dGF=A(!aF)y^BeUcqF=?
z)R(-(_DB{5{}b+W*uCDxnAOk?1vk8?mjgRRwdKEVA4nM7(8n2%&V4<M?FHhgYW>Rs
zyXId9OQ_TfTY<gaOEtsl<Lf!80unxki|gVvDB!FBNq^98MO0d5PX_5E6@+WaVeigz
zD8U*<LP|FU0Eiif^mtrp&I-DNY^3frgx^AeqM>Yshtq7(i{Lc0l$PPOZb8Wmlh+4U
z08FS!B?URfvb#vla?2r=>j8CEV9NUtr(ztF9ppK=H5|_Z4a5Zd{PkQsW-Ip3sx-;~
zBQhKcK9DgMz)~5xzaJhGy;s7*TMi8#s45}H8Mk)SrH|32#SB|9Ap7h#(G072F-6)c
zMvoa@2`Xl`R|;Lkfa$B^Ntd*R3tlLCb6Ii%9u-^WMDbQjq$ZQLL*F&Fe0Zd}WYw~A
zAJ!byV&Q-4&(#08ZOROd3;lT@ZqABrBA<@xBwmx+)D)J@RyS-j&c~Af?EyD!ky{P$
zw)dY;fYK@1IBqn<U-C>01+}kJE>W+7$?rqJZ|LGtB$*hPF}|3YSRno(m<yhx{xK*u
zm&e@xo3l!NuHd4Bh|WGQPJqr&K<pFP_%XvnjBSR;(eB#Gvc>cIID=)K+2K(B>)8YW
zR+3(e0W89cHt69U1cW3!fh0lj14>cfL~MNdX9Xpf-80qXL68wPz$z&Bb5NMU%NaB7
zPZS5i?#OuD3rtd>p%(z0-_Nue;?;2CgSPB%DFmg+8YKMf398zbno)U-mmm_^>DXO}
z4<KIIV&nk^{rLF&^0Clb4Cc%bj5}?C>|saK1xH&**8VS((ud`~m<TM;ihd2Jw?P`W
zeMVhnV(u;sFF`DF@I^tY2Cbzg5Npnt-m(H2kcU3mb}3_e`}*@G4Dp%lzq=CHWpw#r
zqBtb5szK=AI|v^V#6i&X5Zq-XM?9Y8>;1r9YWXAf?<lKC?N%swl(fViH-L-4eys!g
zl2sk0J5|7sWUiCAo(*KwVeq93Y@zErCc~kIMh-$9(u!=!$}F>OV|o{tu$=CL48tob
zaWFM}_s#>NLfevm@E~9JJksA60Hw;+?@UR7uV>!^Y}xLn!VCpZzXf}|my!tUXTW<B
zh@us9e3?85yMNzu`K^(<?guj$v!zy2deUGaXA|((r#2Q35PZQjJ^uwkf{;aS^MRf>
zKU0k;OKf9iqlBp1*hDBOiP)Gtt6BorlE<Usf)nnA88FQCg|~cEFQqjebB55?yh!g2
z5_rO{_m<2Rl#ETf?hL{atQx^ki)hux1o1mHuUi4mlF4WuFeDE?Axt90mH;0-g!AG(
zUoQHw7eyASW-gA8S}@L6mJQ?RM7NvSamdR+hPb`!J#AYQ5H3Q1aqyR{6On^32QJH#
zZCa9>9lqP?DnZFg^+Dk+jj1Ep*upjzfZCH}7Q)C36FqzZ$K0l5oZv+dzJ5NQ-HfAH
zU{Q1RcTnO!AUd_se^}lLx8d3_S*$wb2fkL1mrM@*B|o?PO$pcy=?m@2dw%U?&$HDo
zIk(yl$ZHbKY5^;rHy<Y@5H0s{_TPl{Gx~DO#H&{3WF&}~jX+%lI5OFZO87uOaJZ<1
z!?+o)_qe#{j`se))A|TQp;CAh6wqHmE&pcITd-4NTM=xsdU~1Mrt2+_sLnufgx@h)
z5V1nI-ajh$oW#Ugfd;#Jbrw>eRvX*825=hwFA;fakrAIn_bxFnW|mT=w=NinbD@T%
zIsT<7whI3*?Vmc~vuxzlRR4?*PEbR94Gr?{&YoNKwCVf}7AEET^_v%t3)l{)<^Q1m
z6ZYW|==lVbibK59!~$U391tB~e+cakFzHF7MBkO37JELZT6PAdp!I^R3==N9#gQ3$
zfsfXb%lRB9Vq8JCVzad|<Cjy(Xb<-<`!|gU#o8wtJAjGNgHjZHLVEwLr4<9bn_xi=
z1oojwSehSXx7hq9=pkk}heT}Nqe7}3kpdj=#TFn}0CFxtq*_2tHK&cnr83on<$2$K
z%`DzwPFS7Yy51Ig^lQ?!N`Pr(7IeM>c6p}aPxTM#y7u-;gy{&H3IK$rOZ;bHORy>%
z`M>z*OZQ*?;hXRUzhxh`Oan<Q*_8TR|NP4w_!TfWZi(1+1^PjB9E+I!+Y4XeU2?qq
ze!9KEvs7fZ7)572dFr0-|0b$}S^pn-`d}gsTxy=Dw_B`!LR~|_M6jNi)?fY=d!*^J
z>%hL=D;MaSFaxHkff7-Z*W?Z{M7zo;`d`g200$6QMrSGgU(N9GnCN0K^0DO6<EVB2
zZ5L{J7kLCw=+K-;fLN@Q&zwTz<x;}&Ts+q6+G_C~2nFYBq|Pkouc?W`%-GunEF{As
z&~Q!<l7LHkmK5P{;n{1P`faB)%oB)5So<thAfwO<a!kYqM#kG5Jo*Hl8lMpp2!T^M
zZouy+>_D@2T7XsHH{XYNMbDab-D)Zbih`&xpV<<`NkjuA)u-XLS_3wkY!Pt?`Vsbg
z9`pyC{m{lN3mtt1{s7Sj;02>KXJ%-v>P-CGhbl&7uDGT$0!TnkZl&#cJhppAY_-Ei
zbmDSx?cNXQNeN5d;ZmAEr4_7OSJs?K6btLPlimXD*6XzhM2UDABn?VAgx-C&ydT*z
z!yH(q0}`lOe;rNRI1KUn%oduS!w;$r8#xlf)KGl#TSO@be-Bs4f`{@yNc_f_R!>`@
zdM4^cwYiz1(fhqO&qLG5jivk9wi22JOZU5>>%9BLyz4yK4?H)A;5BK$r$ul&|ARt<
z?c~b}5Ar8Q2cWOiB4G`p(21^SX$3r3<$;7G@eq)+RRF8x=jT{tZ%wTB28D!SHAz1H
z#hngi56E!hi>ktoLB&k=O3xX(J59v!RGw^Bw@$F1<r(;-2LtKJztTqRN7BbTGf<Vg
z;#ItGuz_`i68Q%Bd1E4XB74~sFZlo}(pn>(D7@v-Pm$Wzi9*cQ4zI8hgqe$LhFJ$}
z<s~Ks(g~Sa6`rQjoeL|s=am(j9z8s#gq-4FDvjwws5-2>r@tdC@&im&u!N91jvycU
z5^Ik-VrJWW=v*H)`@OR(n~>fCsFJpH7Nxjs5<8=G*vTWxmHDc#16t$*aReWaGrAxA
zJ6OIBeIyzTaHXc=?%&D02OEN4TNfzK@+f=R!T^+(mhaIgM2p^xyO8G&87>LP6wl$c
zY7y!j+;cX-*#lT2uhj<sPx$_LzJZd4(YyaziDa;S-yD#D)5_EV`y1XO40gWrJL;I>
zb}bU>gDFjFRqFr#fTSGg5!thd=T0Q4V$e^1G9=viAR(9*aOQ;hA#eV%MJ7Dt*Qkm3
zm>w3Y77onbELjnp#uz6qXMD!QtXJk>q!H~qk6Dv-bvYYas0x+s?hjwEkXpm<u#2`&
zANV?Mx){5lrKbI6{3%RIHoe^<4K*Z~2-&7(rY_i_;Zk18B-Vkv*$5om@Up(g1yrk9
z5BJ{R%BvQ7z}}?k!BsA?_9%geBq<gaHV7@1Ip_Z;EPu%-!&hOdT3tyoGQdW((3M#R
zqTKVp`*l+{odNkjvsb*+&#rba8#;#S&!5+xc6J*jAYBaZ9i+zMCEOubK4q;rD5(vD
zgsN&<ISGm6l8*m`mbO8UgIfO@!}l8c#2UJvHa#Jof&$C8tM8{C^28O%&Y_-!AoZ_A
z7cxgin$`D3l|kqvrIcaL(3&N45uYYuD&D`h?^ec9fu8_C-CD)QU0L^EM6?_d?w!4F
z`PIG>b@4=$9dFtNNr5!T!F)Goax(;K<VEr{KSNt-Pp^d$)vGkx6C`cPr*^1+`wCCs
z9zJTg+L+2bsP=L)MEC(kSdLB*DOu>((DrF^F;?cF>0e}HE&!}+%V>gxOJA2jG9Az=
zpk}(>Wc{pk-L_=sGN7d`urQZa3l-CIhRt0@7lw$f?~wWMnjKEaFnilY8*JT4odBfP
z;335Og;`cuw?R7L-cPq~@p)(uF$CDWP|D)8_$ShZtb@5b7^=<I<Krss4uB}*E<c$E
zlHmsj24ImmXVfaqsa;}DAB;BTyr7-HR|Wk@X<^D3(vf!;U%O0NfzbQOHa)<I#t_k#
z0rvrZkxq-?pAhm|dF8HA>|A_HIIHcQD@|pCo@Q7_O#4JWp7T$^>d~%ZA2_W&ILU}s
zA_FIYYaB-5cx5z2rSB+um-$%i@*<Xs@gqiYn+iYD1px!JINHO0L!y<)`~n9PAIwr9
zgcQx5M8jUQw2ukJ{^5k&&q97SQo%LHu(|Md3G`El#FScN`SNlJYy5ryS1#EH{NHwg
zXF}7hyLZC;VH}_9k`Gl?k(!war=SjDKw80v3LO9BnIEJJQY@>?JTBV<x4yLgjqE2F
z&Y@)T)WgA(Z<6p@_Kn87VIhjR=jpDTA9<>|{qZYCn?ANE&56V8cT2H;E@A2p+-s3%
zd(svK8yYTxAN|qz53*z?G`8EMTj^t#gfW$1SAryo>v@7H&CmF;<*5>;Q7k)u2QwPd
zMWg(_#l=qp-ctai{~pftUZuEPNTq-d%AXMR8|>~&LG_-ZFbP7@cku}gm(cS5f34e;
zOO#5(uD7d`AYd!5{XvCJ<qo*Nx_!O0xTVdQB2>d4PnscETA}7M=1ojUFpa)G4(GG2
zig!_{VBbsW^8qa6#oQmw^4u=nbz;alpeYhLVR)p~6b5Y(@AL!G$Ql%nR?1p%(iO7j
zMU*K;pdM{JE*z5;U-M-GVIM}mntH)2Ee-K+WX;+;+X$qU<S7-g_jj9e)79#?>c*5V
znrbgHMTxO?i2`n6=Y?Ini~b?Ee?&IT`yEd*pKnSjFX(crONhxA&si>dP)VHXq(dKg
zS3W4)Z7?ruf|q*WCb^+g(0tx-`3mE;qu3ur?u3T{!w;HR-rAb6C1b|7?ty+!Fy4L_
z0&M~&6E)WLk2lS7t+iM3#h{XTdyEUg{J8T<&^DnA6K}Y)3dCJ!fA`0^>x8_4&l=y@
z#ZB|4*J>1g`Vklqle<&Hwb>nJ-@FR9^M3Gz9RV)d2TGPIi=0$SUg)Me?wBDAv)p#n
zR2xc}hrbB_@ggu><`G}Iu))JPVo7;7ke*BjD~fR2T7SEvKO9zy_IU-g|MhtV9}|5;
z%LIgNh)0Fl+$ZEUJL=ExCP<m-&Me?BzEvS9G(;8GDikIXML)+&rf9K1`;>%Ol(^td
z;Z%e>9)+w{heP1Ewm#OS8XPvInqR|k8#1kqg*Sn=<}>C=w3m_H_X7ZPQEJQ#bDKEs
zD$<xz#-m8hbJE-?jeCd)evHfYu_q)Uf$e0|&*-%rg59X(GgCp{n-9PcZ9Pb@-NeXP
ztl&#pyy=tz-Xu{QMtBDk7(J7)tUS*8B-=Qu>+>7472}M4ao7hmZBxGgwV=ks<PzS8
z)d_Y<FTbTO>kq?{?`lCb0>6E%L?)O!kZHy{#4{LW>19|^iFdfQvC&H!%C-}lg5MC%
z@6GE$!dq?<Rrj19@P)|BTkrW%Qwox)oAJ9&C?ffv{KVn<&@;6_;<w3D1?tD9Gv6%z
zmP?KXuuAw5Fo)eT5XVoO^p=IYm}g-Q>AW!+AtAq2y;R;<26AF*k-eIbe{=2FyFix*
z{+dA+#>p%Zlpq3?Zrm?l*w{MG1$Uy;yD471obRlKd54i{Q=ar;F9LA`;%HulnC!ng
zJ{GKbz*f}$>UsobBPCmsCtfkphuk@O=|w{Eu!R9FBClSH#1P)IjSoSq-*At-9LYG}
zsbm*toT)yp0EQ|H7nZoiSpMReBV&46o+!S?@x{kpA_wi4frJEGv#N;gdqw4Ot_)dR
zJdgBY#=G||D-S}kzYKjeDQKU_2*LXq>O?7FB-V)B$Ks1-l(%g+bMZ9m6+P0O&=cdJ
zmpGrP;ZZmj${uO!RU_ie>E&3{uoRnFQx)%suZ(*vU3@@IN>e2QUE`Qqd&(%UG^O{C
zK0ZtT0pX}O;yuIVoQxLrk_={1hlHk1<jy1U_aSBNE^I2o89=X}H|!Ou%zHl_(~lcs
z2+#WC>5*t-({&|_+f+~5JPC#D_XPbu$%QT#Zb5Lf+x(1p5Subq9M<>W^yMsl^puGx
z%eFKQO#6~fVYD&#fjakWu?kBW*dvH9st?<IXUe)_lg^pnUoUsY@+P}yeLXO4ZNoV?
zLx+<K0_8~znO=gNfN;3%7AF_t)_!D0$&QL0Ja{?`?07I*b7wl2B$%eipRVCh?#_r9
zUCxx_rkZyoJ#RM_NR4z%yb1cDnf8kc&xHMr<}eqZd+TKQ@sCVu(gigBzGSJc4Gh-i
zlIB^Qgie2Ji-8nWQ+~N=DmF_pQdl{A|F~vU91~&Pb^0kVc<0?W_UXgw_NOYGTuhHh
z(RpB0NI*N3;9udX>n$W|*|<SD+7H6dS{V5mTN}lD-V{l_Mj8KhP-eFxeI7;^SKaar
z$TtnT1%JP#ruLd%_~7)w56ZDKLuT;d9#=a$m~Qj_U$XI^2z$Ay*VX^F!Z4`3@u!&!
z5{Md4)fbj;*2!Iw5Mq~_NdUdVNuZ_s^#<knWU6w%kvP6YhaW=M<%TEiOHtzC-EwhG
zbciE0V4NWVLWd-TTowQK<Zl8K3R%+Q3x)a0(-s;$P(eIT5?Ag*MD9Rj+Iz~}^fb1K
zrGOJ*oMOwu>nr)Uy?;Ko?xtn~O}P>U4kMbk0pc(D`uYfC+8Uc_|K?j})Bnw%c&#>J
z@lJf#heJ!+zK>RrSzOE-oMaVz^z%#mLJzR1b<L<SF8)rcDt7xS&_a6Vt1b9?dO;A#
zfg30Pz%Sh9x7kN3!^=7q5V@I0e#@t_NrK0y8!@f3!<)dr18xK2pP2@zw%1Qm^Bc!@
zEq<B&RRWm=!uC#KQ;WG?V%F}&avjHhF`aUu<HyH2EqNt}Ae_6H2=SYf?M3xA0lU-H
z&DI;dHe`li$Dco1)^pSD;g%)oS4I;vug8n>)uk*sKRRc4mDuN~`b+<O3r4OhZ9D${
zo3i!l&IaE?<X<uzrgL?Q4Xc$){e(lIg`nFXv`J3zXiC<7L@1vCtd*HpO!+Jtmb3fe
z{w)CO;9<2nvvWIPYG45v+!!xRwQ88N8?fAhhVC6ajG~7O3$-i)ny7r((6+Ijz2bhd
zKD=OY3mU%U5}SK8k0XZw*4-%5nB2_g-)`W-pj%Lhhgvz~O&K4@?so!C7>v@{awOeL
zrNGIx_cytPUbyW*N+tpm_Qj@re2ZECq6F{H-7!CQ%15{7wxJhYpmeWub>Szs5NGbX
zM-v!PU;XDi<?`3?YFn;c6XECkfPc%dA73)!9fLjhy-$gW24Jk(*xTkV?#oDtaeG=4
zrMl&ryg{+}42?Zq=tcKLV#&`N3E_um@axRyq1!_BhBv+rIKV25NNsabZLS!&`T%{E
z<tT)347H1(Zw43>^e)<c>x{^K9uw<5KpMeS*6!HB9*P@rwF~e`=Kh(MD(M(-I(vJn
zL$$+^*NSuAT6zL_gWz?m7>~_h*TX{SZy*K|q51_~J!4%DL!tAxr-q?*y)vD@(;6|{
z8g5}L8d0wvWE$W1o<q+}9i1SjE7yeKR*$|Y&S13oeElpfy5#-U4ti?UeD3iZcR{3#
z-xIew^c|i<)rnjQBr)r|Eh;Bys?*zjnZC3#oI95eqOq}H@U6Rca;!%kj>8ge5qNX%
zCT<*ba{`O__o@EZ``5o_=L4>QeM)5+=<xD8BBzz$E8~FK+aFl2w$JaT`<(ZdR^I}A
zsUydY)t4!G|6&S_a1KCQo7gKqVz){(J{T-p>+Nv5E8GbbS|(33zGXJFD4%1OrlSY5
z$m`3U5e`W{@}5MG{W;=#*!NcchWd{wAYZzW*W;+(ZYY<p@E`c?IcgjgY7I`5Aa?^&
z7%+jXK*8>(ITu{>VXW32ASYtV5S~5R+I=H`^MrX}_@|7BVA9E&cxfad!7I~IH4=5Y
zj9?O_>^?GsI|Qf%zH^FW9p7H8{oo*<=@g1r2<OhaCqRi@KLNIxdXqi6+R)f0!c4to
zZzU~go%ZD3M)-0{Y|y&haw%jp1rL){R^~8uEoEY!@&uC<0#q!1-<`NfnH8vcL6^Z@
zE&_Gzb9So|sCiA7VGq}Af^m!0WzJHxPM^vg#>K11%MG09V7kT|nVv*vj++N=tGkMs
z;J7{brWO2%wL$f5shkp@XG!_j=xfzi0U;s2FAGh|w$?K#3kKvv(@K6Bymg;A_&Hf1
zz?V*&?J6uVk-55Z3BNZwM#E{n;kE5ye$zcL>h=v6t79{zwyNb_hStP{?mQlFE6gwc
z=Z|&KBdU3aGDTc_1|M+ftS%;Za>+#Z{#6`%n^IPK;eh2;KrYMHn7h~?J}<G>m*@G%
z6A6rce%tpNdJ^MYeBa1R#<r$$_#+nSQ}CbH8B>r94Su|ObFWIudUUtYVD#%*RsH0l
zKlz`IRdO4IcG30tB#Wx^Lc=FjlTxAtz6s24<hfba<&y_Lwg%y)*a;?NSNy-F5vlUK
z?Lz84v6vV3B55Oj&#pn|Qx1yfQl$rq&4TMh!iXz*`>Iu~p}~dH---*;6zRdATzuWA
z*f-8ACu|ujCLa4fBpD)}as@CFdPf%9VSs2**sZSgnH&t!{ZqorQ6-(8X<aI2i6O|z
zoXy@&x{4Z^)E1HZ+MZOkoK`97s<MIQV|yUCbv6|}ItB7xnX9C`Bp?V`WE|3(Mqah-
z;kA+fW!{#DmdRPV_6_KDI-Ns~=H**T%6+Tmpb<lQWPF+<g##$-H+6-gL|2t(+j<4N
z9$VAV3H_UCB~J*xjdmcfZVL1k3?his>CWwPDwRT6nX_aLkCIXi_dg?u<}ZP|*Mss|
znlgz3t+P>Sx{N^+Jihc**XL!-bhVaiuM`I{Nr77`1-DZadx*U0GIGs3N;D`v;i@t#
zljcntsqTM*gCK&oYq7DU^1(sxyXzIFmhJ@wH5$g893$}#f`b~3jA*w#GJ}I2nh_5X
zZLtubWK?LsorMCGvowXMruvmWtn{Fudtv7n$3>YyjjQ+e{j=Kxifu;qF`!fxoOuaH
zk5l^yl(u$=DgrgGqqA0UDxjQI1lo;rdw?>eHADX}nKySia^U?{1}NPqN~FDfCr+R?
zqJ6+|{iqzMmK}#2a9-e{kE9M#nL-r+!hXR~I2Js?K|$1EOZQl5yy@sdrgPGti66KD
zBWIYdMqkerGt&{WY+3}00Jmp(JhBW04ptP#)ZW#l1<A)2WnO9ng|RHUa$<eY=;(~U
zf8GHD<*z>ZqF#3YIuME!RYqUgKSPO|KOu<X)|EROAtH#%Q>f4VX#5x`p3OE2vgh#+
z3WB)35$^P;28wZM_oUtNmV<*VIQC90Lic23_@iqK2X%yr2pAdc#%aKSclgE;pZ^SD
zDZpsQx3{Q9rx!;Yk4nEUD7geq30hAbdjs)X>CN;RB_jCN&DNXe<5|(^K$jt;XGV5q
z>4*V24I!k{i*k)uJInU;Sq~1<HqAD3p-&sr$6==PN{$15&u0e8!7aqc^dPIlUZE%%
znO$IEz?L@V3`n35*nMPc+Ukb$Hw=$GUz`uRu0M)L(F9sAF1onj3YyzT*f~u(xD8YR
z?)JKfI0403{Am!ld8FgbxJho<QD;L7e@2r<yP4*top^4hy(!-QxU0C`picL%^y)QU
zwmGvUoy0klVK?>a2ZvbNKpE<o0i?Z7SsZwd@JI9yR^0Wkh3KH`&sqs6nvG5U&=yTy
zlk97G;mR7}j3)T3Sw%bXo-j^ML0^6F`tYP+jdF%0Y}QN@AXI0@s7qe_>zF`|L53uB
z)of%T$wL$;N3Z88>Ml0xl@vR7CXjCoK5u}~H_ksxFsnuxmml-8y^=fY8)mn0k(Sw=
zffLE3zp9P^DSK1FM5jzR;@*1A{OSFHsZV=uTF9L_<Ps~CXf^#*Jl#+DK<2}B^k{<G
z#v}^QB)^DU1C>l)5;-(qcFjAr)bl)*Cq85d_p|4DbS~jI>CvL!&|?8<)o;sB^qhXJ
zA3sG{mN4`Mxq*~cHATPPxEf7)QVdUJQZzASyAS9ML)S0(fhV>UE@L~dx=rL7VWC&^
zruVJ42NvcFC&|4XmW9}kcTPW7vj$*>I|pW)tljU)D-Dqg%Z68NRtxu!!ehKTs6S<H
z-H0!jT7!SDR=J&XjrHbRQ{eb~%Gu7*FLED)LSg+o&t@2}n?#I`AD1r9eg?X4=<%9=
zBwyu09xGB9Pz;Ky;9qBa<6nAgS*8|uGx~`1>4<xs5FS2#{ll%*-FmCzJ(H!g3AhK3
z*eC_@jr&t3l3br^6F;Poxx|;SYnK{PRn87|GTZuxu_k4s6{)XN?|t4bYFKKq0`;la
zx2^J<wBra;4#CH68kMQs2DBRW<A=3=4?w-7M6CDy`u<QD+-bJ8i^Dp`8&1=+$$X9|
zJZLLF7uB2jCEzk)rRXfLmHS>+jD?G%>!mt9<w^R$r15X{SDus%w#Nmw+O?56_zZdT
zzwPi-ZMAV59QUR0TCp7_AQ&$rf@l)Vy%dODC#+sNsS}q&vD#%ZCe=cUgYeGXVv+p0
zVS28(8|L;|tj=xO)+5NL)dkLHtd54@nmd8Enx&nP^i5-}vzOfY8M#HXZo`i|hq5Mj
z*IO|#bh%;9%}t8?jRSGU5O)!ZZxabFr1f1nrkpg5okbEs4}=lD7oVaqgl#fE;0m6P
zz&JR~9q7j$>`HaJ-*sO*xFRbNOX?r~@JSTf;T{jpWX<p<U9}}8SB5u#pz|Wb^Qftx
zj0Z|$iz49$K+$3ztpreyqNvocM18ed-)@c(YM#-wUm|<W;tslaIG7YNXBu1F$6MRG
z+ga{uI#_XO3vFmI8z{f*x|lC(X~zQ>0Q8Lff)}ca)X}pBNiw`q4(;!-C4FW8-1nOJ
znSo4X1D3tHVc@V|Dtk#-K?bvvdFS0w=JyCsW;~PZ#tzC9DwEe}JftQnIXi}U%dMn}
zN%X^$b?|<EZ|aV~e)zq5;zzm1QJX;}<BWJst0ar75#ooUuZgsuY4Akf)#2UTjUK2x
z8UkITt_nyow5{4jimHlS%WAN`_X?A34QtYReTJ=|BvZu9<(-h*yBJ-~t=!?I@8x|p
zDYVEruhyV@lvQf&c*(v!snE!*_I~|V0{!qQlTEni$p;>>F1)CN!o1qg1wFBK0Rtr&
z<y-3=iyz|G9rnoZYD%*m`WEJ~9hOPhCZXl3i3ixx{MaG>N#|<0fAssw{bMSGmGQpc
z+!qqRw#PH18cjekY8^U>yr^SS!lS1ptDfsf`u>|+2MpgE#HdlbKicM=r<<w*lYRS?
z;O#b^`sv4Ooq=HSHO$E$?g?pL{eo%<sO;RQocu+vuX|fJ5!-JzoZj(C94{GTJ6!K?
z1xJJt1q|7&4t~vb;VVhk6Kng@o|6IQ>*7kiHgu_rstO~&Y%<v7@(S8bJLoUS6wo$x
zIHqWkBw4sz9Uq3)sXA8)eyU%Ior4w<to{~Kr4l4T1WQ%54b*k!<i?t5dKAgByIXxf
zWg+Cx{7kYQR61slar5T=L4vW`WfAK#Ww^{9JM(JAgoR8c)lxz08XcIsi$vry>+Sm<
zUcC%b&MM9V4cWINC_VOjSR$9!ckM=Ah-2BDw!m5XO&of)9hxEZo7!rwRP7bdR;`B!
zDXYZ4vS*52rt1#LUghiU4IK}aSg{X<Pq#>tE_85e63ur~1q?kGx6`d0M(qR|SMi8>
zKbZ&5!IB9o3-jDwf!SH!WyEH;cSIG0rLCQ048oQj1-SF{ZIsn*WhwbT`f=Y$&cmd5
z_ftN}%zQ&s)rhxgwsU~Ja(rfU*3e76Ka?jwXJyt)i;Pp&H{WKhR874E(oURcpx^xd
z9won8cxyb3lgbMg^SPLa;`UVo+o{)#sbQT#bmQbPdNzW0oD05Bh<aF(ZI>MdaWchc
z`w_fJ3?;ietkrz0a7sQ;DnW{TZPoS$e_p{6Ywz1%Ur_cB1%fMa1fPFm)k-aM1?L8?
zS(lxCxfg-aMOg(>+kU_Vw&KY`8yviJ6>D^ZjB!O3l4~qTJ>C3Hk}3i=EBq~KgWu$y
z#->%-S=o5J+AIe0R0PgSl8jT}zK(04-5iP5^<GT<cMc%MGrgGtg^+PZfomgRcbL9l
zmK7<l^SCdsuyd``NFO2)bCgh|jtCFX6g#Y%7*dT>TPzK?%IHiU>3+hxq5{#-K-Il{
zHM5*fSCE>D@y3P{_R?(M=ZaXMcNlh|5yu@iCu}3|%#ZNP2u$fd4qG#fVzdok7&kzj
z3o*@4>(I{fr<%>}G!VIt`W`Tn+kDz1YU8&81pK`n#EeOab9Fk=j)97KXupbP9kXX!
zeDSTP(Ik?b<O3=G_+0bKEEkjXiECjd-i_E=WhI@fUc_Ep_iwF|S^kjyxXPEESL?{i
z$$URfu``A@mFyK!a!TMLwC^QK2U`x3vgWkBVhhD7DgFAnfT*CKosOfp85A&X?ttN=
zt5x_OPv?#)PLjsoz<Kwc{kJ>>f52ZO-&}RnpxK8nc;(P6-}5wmBQS4p-M;E=yZByR
zpYEO$ZgI;)$T-vI6`ce%PrDQztT0K^x0(qKgbAc;;(IA1RBNC&?^^{ogY7s2qhb{V
zl4#(q>^WM@ZG*yAB1>#xP#0TfgS+#Ey%rhimA;Hk^GEL&X-Uc<R<@)FT%aBoJ-O=P
z`nU<hs-;6{$T8AL#Yn_YSd95yoH5*i$_HeS%D-En#g)NP+#>JdPN^hLIu3vNUYP2e
zD^*^505$kKT6KtMARq<L?*kjFXVY{^hE{)kW|BK4%%`}#ItW+mkD0-5R$VM!9o!fU
z|Jk3vV(6b)S~hmrIqtYrolEjf(6?_((>~S;^(0Eds6?)8fZw!E&i;~XH5d69F^gsM
zd*isqU$q*KDo4C>0wTV*Jqu+q>z<r$Pi%SlL$)+oJ9T?SERPkFbg^ZkqTKcp!-m)I
z$Lx7G6hgM$XYpvtTh#rx8t+3=nrG?1=G#xU0;!$T$irT>!ic=?%Lw5qfRWUu;BC&O
zEh}*B_l4uw3Z%hjxZnPygVf+R13c1&mWkK{m(=}te6z4x=DM(2Owy>c<a@)Hfu{rO
z!E;$;8aA{D5&V!90^xyK0kDM%=$VEs?xJ+P`ejX~$eLQL-IE#9&m|nX&e<l24Sb4G
z-%u==ap$j(f0rvn<ghI7A$1{x-UiLjwgUM+T`7+0aGHN&wX1YT9<ZOxvY=pmqUQxP
zzv_m!r7(x*?(1x|z!_G%CM9v15;7@5g@Vi5ZM`~uHo+H<q|Hvf*P5I*EfC$RBC}7^
zAFb85wZiwMeH53=ki_M!efeEE{j)4XrJjv<>8iFfT%^aLQ{FNsxS>(8(gNi*j!6C2
zf#L0+a(&Z^G&Ux<l5`<reeb$zKD`B>uolAG*rhsBx9Qg;EY>dYVwQ&JOWR}XEM7fS
zc*W~?!CJcwmnaB>2)WhQDclvx{n9?;BsigMut}RF1wlPZyE1}h$&i0UMTrp@C#0w{
zXsV6Q><+*-5jjtVkWUl1q@%tS-f)m^2%l^n_pg%Nh_N<Y-$z*PI<_61uY#j_Z5*9D
zjsW~Z!)0BO<XOgZk2Gk&>Q64#7PJs3H4=?<r=C2Q{Uo&!o`ZxOFJ0y6Eatey{%IKU
zOY6$}ub&^weMd&HWuhEc09Y2s!FBi7NS=zzXLyWK45up!A<wbzV_-VVjnvh(_T{es
zO%Lgt-Ek4Sy2Izkdd{}nQsZJ=iRA72(J}&a`gJ_B=*PNVmDf^n67)Hfnx0kKrCjAv
zZirI;;6}UUd{C{M>~9(nXdJeQ^b*|!A1KVL<`d?meJ1a#Z>@P>PjBaS;Q|0d-nGDQ
zEDt!9i$k5#V$-uC;8u>~CRS3Mf+R6K1FA?0g4uR3nC)youDvi?1Hzee@2E-;>6w{t
zgv-?J)hGA150r-=+fCogOQQu@W(Q;_B`(yR0$V}t5CCmIH-$Djk9op?n(f5Xr+1)B
zF|}b#N&#ML_TU2uO6TX|GnR&~UyB;kO(<1$`Fh?noSX(ZA2Xh4-i3~^X_%E%k9bDs
z^Qfx*HVIINtN=2Yyf3Jwjd?pzjncA$`I)zJ{RWR+4_xKtd21yy+S$3Hb>#a}T=!e>
zw)henm%Bpd23GOq@7*H6NEVGhe-RU=gv;>HNa1V)A{a|9d%qzfk!b1%P>amoPul`j
zf9W%SJqioCHp%+^8#{aa9rP9uMbh7x&*r%`-QsG!UuWnk*BC2m-j_}=x7Hv@h;l{y
zf}87^ZOOuYL8?Bg<mE_@?8&?zuIvpE|A_2VO*siUk&Q|kV8ujaP=bYs%F3a*hrrXo
zR@Y9Pm~_{SP<q%}A%+vG_7r#3k*<nK@|@R-hv$wn9mkp>6`13Wv-;D_CmJKE`o6pc
zx);4(1y75|5iRoS!?^zb?IRyt+`oG(D-HFfaG~yggc0}$4}EmwGntF23bRt_kHzSM
z&&9Qt-bqkE-NX!LH)@#kl=B<@CjTF}{K<!6+OYS*^`iIhZi}zYLf^FAJ-A1%9CAxl
zd;ODFjP-3*LXd_o)6;x8yY22gr&oZO9{n4Som8#r@B4Tf2v18YF8VI`6mEcQ1(NiG
z0s-<k>kmtyCvDQfzLIIV1^&ZqT?2wuOw`OBgCMiRElVtu(Qic*f#Nx=e;jC~@P_Tc
z96zB(L3Voe^<h>y9aCnyeH82G1@(A3GM*g2s8&f(wuA^v`wv@3P;m4}toMi+@I@e{
zYQloY{=oRC!ekJMzoisj`A_h+LUs7hY<y1L_+xWjOJMvD*{$^9@~~*9h+28?Q+RD0
z(tv9C*R~DP6`@9eB+1gphw0YZW=+f2ig?w8v5jZeQ0vGz>RT;<OP<H0N^<Af!R24@
zrXO2@UrC>wfwwR-e|jln1NoBxk~Cv_x7AE@T!(leWMQ73V=XRsIt6f%55~7zpbYt}
zCj&~OG4xvDA|~-6c1r@DNo$WYe^TaP<V!47Xg_Ba>p_#;gs<~#6^j*L=fMs2*Q7M=
z%>M=AThWvNm3cmY4HDS*04n&`z?||&1i6(<3X^J>2QOVNu6lYb_>AzkO)?|35q8di
zj3Z9*VBlDQQNOb{wY9gCsLVGO;2&_z4Plzd){1ANa+e>0cWp-sk$YY&l892-P}H{&
zv^OcSX&>&FRCON`%kyx{@*?ko$A7k(#4HEi$LNFU{Yq!e1Re64*HiZl{)#9s`1S8W
z9FS-upF+CO{8gxi6iK;@=20(nj2QAsL>XKCTL6EoE~Ino>m`m|iq<DPt^b($;gUYF
zD^d?nkl2(*NlvTjzsOn1ODCGSpeI@A(A8SkZU<sSo2n#F^r4G1bOBsRX~TxbtKc13
zU+vF4aG<4B!DwUvZ|}N?cx-x0_&<0>(1&H=)bK2W%PDPG|M!S0N1xLOP#-pG`(%;x
zvlO>U$Nxmqg;E4PUSJs~hXlciq1!j4Hp-3A{kH%r$vHCb0Zd<g>#$tJ=28d;+(kwS
zodZaL%xfkEhzFr+-w^E_R0hhCEk*2MkDZYu!22$-WF>+7d^L{R#I;($RsuE3e;o)1
zGD2H2D;U%md1EcGcswqqu79}aD-*Bge><k{Vn?5PwgB)Y5$i8fj@D>uLsj;3$@@4N
zrz#}^b=hil63Lb8{>_evE?ze9^3gBXq6$E?wkkjv^DjJt0=|{SeXxbvSqU`?>@x&Q
z&M#v7`QN|Q$qk8&zhrS&reJQF>iIx-4nQRbo6%bRvqXtSv04N-rva;YOuDk+f_=TC
zSu5g4_PTjnx!Xg-qn09yTk^7sBmlF&cvhRLHTj$50J8^QJ<XrErAbcna(|Y4c8wo-
zOtR-H08%8YDDeP+l(}Sd=*+3OT)oB3XQ8)hIqM~(ZTe*zQp**xt3>|~2sPi{6UKx~
zm*ipSlz!XzD3oROHD0HG>&#0%8<zDTOY)k?XMwsxAQH4;==y@UEji6J-Pd0G`xC3#
zp}d43H2)qNNB~ifr?*q}Z&~4WS#}tBr8Aq2lK1Z@Me9&cD)n&M(z0J0+9<sPd-I&c
zd-zJ}dN|2{>=;JhT2&~X&emOe)?VuB+-8^)Sr0ZgAD45xT=*c`^WAFu&LO}84&z&^
z^z|sO01?C4o1OAzo?R-`MXd|FfE09H5DNoPH?mr6Y^t2>4HC-y!CS;xM148|=cOxv
zv-XLlZU#R0A}&-xzykj!N+bM(X0psU-{_*A_{hAnUrO=F%%Lzdi?ojEz+`w~jtc7S
z9WV!Ao{>95kB{C0w7afB!G-r$1M^O64!CEN0G$cM9Nz>Mq^sROg!MK$a`ziQwb#cI
zana%o@7xYWTXuo{&VW}Q9jPF>2~QdSt-SE|yfLEqc!$(gCU**Kc06`Juc*kmE{o|s
z<l#d5gL&4>B-Q<BKABY>Uhfgp;ag36LL-YQ%^I=Ezr9E)a{sgSU&$PD8^)jT4CNo0
zx_x!6HE3=pEjgbB@fPSsO~qONf@SiM@L><z4v-Ab(MsU(L_4)t+sf~(qWTpaX}@%8
z{~W+&Qmhc7#bKI*8KC{ws$fS2v({0FUp&F=I~rEW0@F}kVqk@?JeSv<J4MGm$)JF`
zc*Y!-Ww5#D;oMV@nH;nBqNrXt$+fB`_%qr2;3n{Y@Gpo-m@(O=#1$l81y^#+u2mq9
zG4&1d15>C%KWK^tFz0^8)6#ULec|b-sS!mJ8^<p30Srbn+sO=2Gyy=-^4s9r7~+ED
zm7OCQfTF>tDB75nNu*iz11SV(4N3eA3-ipKGEzl0leNdFzVezt0SdlIYC^QE)h}ec
zzKDP7CKGU87tC#~5DMB|2UwSEN9i%Z$wk+9solAfo#26maFJ~crtwg7@dtqb9bd->
z61K#zgD^eCX^P8|2S=>R9kb^mN7~gQ-pbwxYMo7~I$!xOqN)@kY*iN>(??>L^uK@)
z1uH$)-#!$4r!vSJ;_1GZigIt}pZo<&l3LX`DRUdSG!7NN)=6@5-W>aqgQ>Iewexk7
zl%%US@D8+FMP23T+b{Es{N8OQ<SAqDo%@ggz`36*nQ40R&cf4H+$M(8R%cu%vKB_5
zZq216VwZyqt7|qqyQ@oeo`GNa1MNQWj8)e>ov#Tp%9yXY%$^a#@`bAnc_a#(><|U~
z2bjBdx|R?%Gk$T4<f969r|cRDFDk(h;nJ3zpG&#oB~EQxUh)IM^7NTI9_PNMaEsav
z8?d8iL5qhJeCT_3Vm2ju4blok*sE;b0*Uo1Bxu?AL)ocZ%SK{OWFB#{cN{8ZJ1jgo
z*b2Nmnj^Ma@<$pA!}0{jWyS>GX8Hv#6+^(=%hzNMHsGsnQ{Q;Z;dC(nZQNta+(Z;R
zgzZ;m-gV|ZJpmqA&j?c%HvU!=zSIbr5BSnrPa5i8=b#7?;l;|@{exE}fN0pxazeo}
z>GxFdlIs2T2js26qp(IS6Eu3P<Bx~a#xx<L#x}20Gwqqio$;a?Q-76o8ICW|*$HM^
zzwX(*`C^ET2rdzr9Khdgn)|D>l1kH0pRUEq-e2NOiqx-2#ExRh<j6#xJej9eJ6ADX
zUs<eg&3m}2z31XDyZiStzx`q2cjvbTZk%kTUw5NZWfXf1t;rDI&iBW^NLI`>^Iv4T
z>HYmBKAZ~{zSU>d)(U2`7BG<2%nXqnP?O^jcSRrsqpU@Sv?x@MT@HCE{f0A{O6FL_
zPW*;3HH<Antq)>P92K6B4a#=U+p0x$M9mpu9AkXK9B&D1f#D5*h)u^GPSe(clv4{3
zQg2LjB*dh37_kcVw)u`M_}wVZ;A4=nFXF5SUJzZX0&guP1o8p<e9m}(CflZ!e=dHH
zzF++FAtVq`w2+-r6Tq>~XyLAX;^5AFH3t<5RLQRPK6^Q&z$aHAVAbv)qSqIHI6H@v
zZeyZs9dRYQd6==JU)TCNiThmz+j`Kq^CjmPQ9@@t9DE=WA9nWSxw$?c*r9es{jtMf
zpmn1_=~$1rO+>!<Ar7=4aeWvQOJZVqceS`NtX*5YGKYjG_yBS{G;5{`z@$hYaPhHq
z4eiedt!ot<i@k`_O*vygl=R4CtOV`OyUD)ll;7mH1?nIRhdW=#M(Fxr2X~flHM5d8
z$(>Hj_}u!q2R}xYJP)eN+L=8{kbad8jwP8~#4MKb*_76`?TOSjeZP0hMH(DHS+pUQ
z=@$8ILSygREXU}UUQlg;g_IDXg;MJWDV{>CEGMI8Svs?3bG2_6M7+SXXo-Gbhfc+O
zw*~^r!@Af(_*_?SE!)w<8zzZCJ&0d&e)|XqCaDhM^~O;k_K?UDQ*jHdFfBnjsDx5b
z+@B0R^R*F~?<_I0ygjEgmWDaKH6Bjh*9UiSB(^C<<x-ni=3h*2vWr2>sTcEfHJ7-q
z?r5O1+bf{MO_IsZ3v%xJt5x0OFeRQ)HwuJO;S1rl>?*ER@BVzf(0(tHaC!0eM4X(D
zXg?BaRsnoxM?T$vz1pskL_g$7fo4)mw$?M3IJoK;gY)qY?q`M#z_(NGaSBqr7rAAM
zm}rhT(EUL%f{ug%H@?mbLwxpF3*jk(!}aa?*G})SY(gUqxlfNe*tMJCnY75KXuqi%
zkNQ-t9qTq>^`er8-p}_;VX{dIlT<s+;i?_ZL9Avgf37l7AonAI`xh)m3VEAo|44>S
z4FeAn-M+<_PMAmT)2}KStJO@wj4%<{>?%ndLLg<c`Yhmu$Aa8rhTK-nRxl^pW6*GB
z9_>DKn}Ewy@(jb2VB%{VWCq%fFS!*C$n;F>pvrlbz=$ac$5EIw0g@DrT}ix}B|hiZ
z*5izVaI#QN3{H!=h3|^f(9kpzL_SjI`3Zx>+cM~DCfA8KI83)5v)ru0j%vG9K&p}_
z^M`QZ&f*<JDBCM?v07^qex<RJpZ)N%?lLb@lH&=@r{?Gp>N}>$V}|X=)Cf;n*<OoE
zZWE*Z0+#D64UrHzjCb+RtDp{QpA-fgT|mmR+m48YQMh;B(5Fv_Iu+?)p<A-JGLLfn
zsj6aMZ%s^_NK2LDGh-%bBKci_H~MtrHYeiNP8-#<(>ONLYfhj}x1l<)rGnYg_%D!X
zvl>ABlvDT3%2Km(2HNvTrXM9w*R){7F}{L$<Kzr&rcQ{>Vvw1wc16D1PQow0wU!ND
zy=<S=6rtxMpz<V>>(LqeJLCqhb%(kvd5}HR{gkASNT!2X#d}f4Bn>|g(V2x`T^N^e
zX1LnbNBI|f*jc%l$w5h;p8U>l%%el<4mm+==I2C9y{ms{lIhL4BZvPIb3H>-X3U-0
zGOu9t;!5L)=+oN{UG^b(RY-gLQ^x*5e2}uMP25G3_Gb253mvQ7KHJkk;B|+zycJrV
zgJoJrZ`gI*Mt$q2Uh`44P$ky<mN6e(hz4i-<H;}94tuN=W>@mBuXoNKa?ztFn&-~E
zAuYU&R7gty9>brl0{@<qq2o+VQd$!koh7jWMzUEc5f61oxD@hJaWPNV2RO2#6+R2~
zr==nnpC$7XL~+yhgj|;Gyhv?$r5fnZg%NCM3r;GqQZld?B{wJ<`}tDT+WizpR*B37
zfDUYPQ~-aC2$IEUD{DS}$l7rLDOV<%#r<&_kW4+{WXURb$BI|$)6mtF|Ls0DlJT<E
zRMrWrupJ|o{xdlOrD<HA-sG1u^(R!>!sIu<-;R_0ptl3;)(GqPbHszi+G1MjBMZ!2
zu4&yDzq%EOtf=7FlY}Qp8PQfEjlvE~W1JS$9j9AU)W>MZ4SqeZQz0k5i(M$hb(?|-
z#i4FG>wT}ao>do>)483wCx2$t&QjZD3$?C#LFtN_xnWl2U1rTR)7T=*QEGV<S7Fl|
zo8L{&(&?2N$7lX{^jC6fMzp9k_}dpM!QalHSKO78y0g^kZ^J;cTe)^RHuhhB2-YFY
z)i?1*#jNWj*%b4|K*|PrmiVZaO}q=Q;a}_<y@x4b#XqYmxf&x52dV@*gC^a}7ClAv
zG`vd~#J?7D{l3X=gTCaPzLC3`IQ;vk){A`zIX0E)y<RliU>X!M&PNFup0)`q8*_^w
zaH?p1VhJw#tiK#lg+B&-YdC3trgl?TvDnuPyh%)6et^{vhR&DM9R=qCvl0?8cI6)8
zwW2E?yjWKYS{&$rZfYirlp8=bLlC6ujj-Hl8qi*BlId9aXL!2@aFrn4b%`5H01PCB
zoRtFg6dZd4AL%=Q167}r;Z-L)Fi=tPJoz-CqU0FehfLz^n6RlyMuuUl)b2x42@cTd
z%qKYc(8n}3NPYx9`G6T+q@h|6vd<+>5M|0Px!G2CC?k_$O1z3V0UDkG|3g!Qf*y3U
z_3RE25j+~w8i7A1AP~<g%xis0N9Sb`qZLaE2@YCP9}G1*WqeIXC$&lO<)#wdN3BWS
zp8m(*+!w%A!F}!_<Gn%vGS76Iei9b*oDooR0`As7Oz2IlP6!I3<B0Ej0(4T#D1Ehr
zC2gmtOi!0lXd6Mym(|WsM^~$!`pXy(36YUOK=x9GKj8zMll}A5eVrTKl?_(wt#tc;
z<3wcE1t~8hvssvd{(+Wa7WW(*XyB&SrE*lX{-sruj*fTgz!N=BK4cFLc#RmKQpZq*
zU{wgf@`W~mcr{W*=5Y3V2+KUTq71+J_mK6~Ha10>70V;{-zAiOJRgJBzm{$Omf00G
zctC(Uv5K>QwpUSu15}=wiLPSHKNsf?B_uGk#s9&4a39@z?%cjSnFpWhjR7HW_vBO`
z#Q{F>q#50e&t$gVa($tT$cygW+<ZQ@6uh=DE*ZS8Z`(gtD^eW;F+lV(W+Y6Ldu2CN
zVpT6t&biN-*b}0x1p;M%#~hlcgb+3)o?{JJ#Cd4NuFqC9jVf)8>|y>N?%q49spah#
zkD#C+BGu3p={@w02!`I9^d=ITNG|~bDm{Qwl@6gJMWjea>7CF!M|x-x2rU@6@tp5@
z?|awp{rk7>x~!Sx$us*YGkfpZvu7SYBZtf=g}qFi-hS~1MX=j!Q4sa^*EA*a(#@l{
zfZX%13t8ml;lcRU4*i}MYoMGqSRqwp_LDN^UVy@(Qu%jQ^;+84_P46&4m`#D4K_|J
zNxuhX4P<x=<*HzI=cA|~!DH4*nai&#*9zeAq`K>7!;~?;-w@-@S>$A=%oG&>^dv0G
zKGsr2dADN=tnl4wls8|wyxSdAvFx;BQ-udz{3UZz?(5312Vym&(^fGlSJ<m=h=RnO
zw;{!LWVDr{<%w59+Jz6QU8<9!AX9h<L>CX=NZ;5cC1sY-_PbbLPRFwd9Wjbvp(|~i
zOlGFnDeOXYmg)aB=u2fx@o&O=dnqFS-z^Bl{u>1De_&5Re~?B0MGyr5068m{IZN1_
zrHkxEZ1x`lo3nELcf#iU!&&*Avy3mg$XUDqSQP_o@Tu(Y&nkdr5x@$civK2x|In8B
z($YVrR>d~$Xw!C-S^Jhn`<Ch72~V4~Z<@Dn+x+>t`OnY4KX<b6$}NlV%<Jpx|DhiL
z4U+fYdPs^$iv4%^Rs$_tFPDd6e}G=~|0itK|AyuI?*<6}KLEFy3#z?(;o$G^;y(zk
z`YKN!ib_5F`^4b4claMrW&c#;@7*56MIYi52qgSZ#>0n${$wfqZ+sROlKeY^@NmU{
zG9GOkpFrY&lBndLBqjbQ3F9G~|76L(6G&VLe*m6?2Veh_K@xa@Klwk}|FQXx{D0T@
zUtauc{Xbg&OV5Aw{_D-Z-u+|sA5Z?v*55w<$DjYh?tgjrAMO9v^<S<3dhw5E|JwL3
zAO2I9f2{pohd*0l{0o*lzrW<9G@(fyVM}ee=syvhSMg@G^86aMq(S;LZRnHNOO5&E
z854H3iFMSTmnQ-K*7(2n@2~fA(9_=-%--H!H%s#A>PC4{dkEm?2zoVX&vlVbkz@}s
z<8GDR>L#u58oi%U#6k?fzmB)cx=2e_qiRu+1fkRA5@^Bn_`8$2vLt)qeu9GO+N9rF
zUSUyyzYceXVOqqu*c`PK9s$^@vL~2U0;yHPrlmQR&VF1Lu}}j}N(Rxfu|+I205Pl9
z7m)2M2-fLF^%@yM>1^O@5epE&Frvd9bwFoF4M{RVXN=tZNP&0)l|`64v54Vj0q0wE
zTKUlE?7&?1+sNSVZ+f{jw~@GRK91a5+t26ihf0al{X*uwDIXGq>*ack(s4G8K6j^v
z%!{P5%()0=goK9L`)MP#t?UIka-G~uM$uxvM7QWqV-&S7;lVp$J?uMXfl%MmBMjz3
zBw6`PcC6(*f4h6m(*H=BP*UHcB42P>!O`dupm$F;h`qSMv6zi3)c$ObRY+-6yR?h2
zLv40(v;n=6B@w&<7$ewv6s++;u(Y4BW55L(ezgx3rUo##fFieHLlQSbRi?Qy4~mD9
zZ{VqyND-2JK=o#wo0hDZ@(r6#mx->zv&qdHHgBD<oR3HV=6sfzcU%Bhks%9Ke0gL@
z?gSl^2B2CgEB^sHz0D8+dE^t5U2}dLus2@B#ZYkL36n!iTktX_oZtyBw*f|B=NO=?
zl9um|G9w5zYoabRq6X}=PWp^V1b+gI>6g*vK5#W42AmjjtFKT3BwLD}k^?A2cVpWe
zh~xm0nY`0YFvYK2fNxx<meL4QYJdebA$Ub1I1Vso6{8)vIYt<ol%JG6oOGiDwYZ>m
zol1QRAmM&CZr-$gqhq)k#>7nmc;i^W1yKGa4o}PnJiJJtz7=|VR80>M^=rVS(6N9D
zpc+J)_#R($80TY0#5D%rnXZ_?blVQ|>crI0-x<4a=WXp@B#4{AoZL`}1uju#TVWr3
z79<f32QHE0>4rTpxoE^6I_zw(`KD+jaEUa#5#v2hNX802`*CYY<B1Ce;_?ZzaG>HD
z<rtftH@QEpuN{Zn7#E)GGY=aVA`y)Rx+w%)jhjxS5i`oz)#AD?G~Atlx9Gv}`fS-*
zl;t13oL%in*AIw+eO6PJN^6n({V^fC+I>6+#S`2vQWDXLJWUd2*5+BI#=Gez^F_$4
zT73m=*nH7wEBe|0#cOyJGL?!H(H)4AnHV(B`kA|c;U^?{3^v#1fzz7JIEmA7i(v9%
z6beHU5KrOt8P9=o{I72?*+(olXP#xWc|8GjL7LUVk+FM@X!4#LbWOtPx@_HF9)iua
z_~4sXFKQ*oxTEABsd}(QA&rw>PB<P|?`Y)<W8_s!=huMu5pEnKMWgfWlREeF{lIUF
z+#kJX0nNV@45uD$%JZZ#$+Gt9Kj&nWwX5we@Bw?>^WC}W$2V1)-WK=dWfvs2)#*jG
z0W4iu8GYC3QMWDL?Y*a5@Ru2yIrUsk!bNroZ}Dw4^Ob`Hks{4V20kuAv%jYR&0C=d
zAAm1A8My;FSyiA}0Y+pwd}YqlP9<43jX$PV57iF@*s3#^K2^X9Hi&sHrNl>Jekw8!
zJa=20FB`5b?{Rjw4{fMef41&;_}!5cY`)tPWLsNq8Cswl?@LT&Qkf7j5is`?hr1}K
zY_*rnG9@>FrU@2*W%U^M%Dg`HOgxS_m6`g1^CsiGWn7CI&2&k&1ZU>}-S|u2a_iXE
zX1IPdc*D3)M!P&n=NNoEbF%eAa0rsGHGcKvcb?h0RZQ-#X{n3s@Q0VUPtIZ0-4EB&
zQ0?#Zx-O!T(}8+{L))_A+zzRX``S}XmT6(+u#Ng-7<Bo>w1@B+!1uQoy{iVr?VP+#
zA-O4%JEb#QJ7jmso~5NPKqQW@S$A2AtcI6T<yX5-`5$pR5gDX{5T6V%r^ePVMDEc7
zBdAy3t-0ZJmTI4)-&Mp5Yu{DmVRR_IThRBb_tMFw=st#M^JTu;&bawZJ@}KKM@{?*
zm1!G0o9~V`l8-^iK?k|;q3j35e`)5Po8Z$sDhubZ;FH<#FBpAqGKU)V%kqbe_Pb`a
zbXRBu8=V=*`esmyA9uE}#pbED!Dy#4{D8`K3=&_MbyU2)G>B@yySCf*(#~~?>Rz3P
zVrt^yq>peg?aB(*#x6Uf-P-NcyAoD!4BAOpLS;3L=CX*b-WooB2tMm`@r&7f?kKwP
z_2)YO>buD8@gJC@JH%#});+ehX(wqmEH^+#G^*i*pIdXoCdTt?KC?9PygfLEzKhsS
zlu?aF%CUY{Ka$1G)tn*~fEU@HtT4GogFk|P*fL)y1OwgNI-jYkUF%cX{a8_0+WY0?
zWVF3T&5+-4N4@hydw;{@nPN`xS(I+Ej>3FtP6)yFy%l{OwW1>i+D)o>{Qr?-o<<-K
zXd64H87FJmNMTp!Z+aG|J2o0O)k2bs6}Pm{C8ZKGflDk;v*bG=#TH&^)92HiYGNtY
zmNYc+hrbjEVz<qu=vzF??T9LV&5#R1)@y6upV%c0|NI6onJo^;bWZvsKC0m>^l1y3
zka|pv)`~16_FZj!=UuMuv=a35{@L}TZ+Z5Qudoz(tHXLf-O<)#xknhHT_Pgx8R7}D
z{k{MSA1&Ul?W@-btvV~;UqA%}ioaGkYJk+bsct)Q<_Xv}I~rdvlU9AIY-hB!4`DvH
z>+&PxPH%B@_))v^!X}=hB`Td4e<~t`a;_Y9yiDoASzl!X$A8hTEC^{VelK($r@9L9
zF=4gpt{Y`&co2*3xdWRAg?#<_;LEG`tM9_LMlh25$$%(i>!YD!SQgd-D`Cl;j$*W0
z-SyVS9dHxf%JjDvEu+48{wCJacg%pA`l^QNOrzREqRw<Wp~=Z(%L;mr%KC?IJS76!
z*$Q5coh;T@pt(|uIZ@mxw=bTP9X;MdQ(m33Nzb#Szi~w7*i&HXr0>YwOEFD#2(JE8
zm&1))t3BbP_#=MD;7AdH2b?V<ZmD!yk$A<f5!2%{y2$=?4`uRo{PK=-+SiWJF|}Ej
z;z6XQeL`e?uT<|^?FC-=@+t5jxk<aK+_#Ll&AWbu-8$1jUGF+NTtQAMTEHYOHN1qn
z`@5dPo{0CV#*bZ-pQA|8x6fP*Q+uUG*J}0N;hQiV`psY`B+xQUO{{S9XDGv+^<Z30
zVTpuFc)KRDMO<rYQ|8X)-Drd173&;#JtC!JNOrH&@t?-;hIM06Mx$A7dw<P8Y8ABZ
zp+4Ct`4!2{v)0hcrqW1bU6<+S9^3vZD^O`pC2dDVaFpFuOat%qk0sG`|Gi+HW6R5k
z5qIbi*!}lQD`R!Op4+gr7v}A@WjRr{V~(mL3KAm03b?oG7k_O8WNw$P7#tKK8=^-G
z0;VdsvHp_-XV;11D^ox<H;NxCG|z22@~MvK#*ZsEGMz)G;y+Z1Cp)CnAo;eOqLA=K
zEkyJK*J*0-K6l_s!)gvCGe}2O&DpRo_`o}2|NQQi(1fTxUoi!_be6V}n)#xeUWI<*
zhKC*P#Fb|PeQ?sLa?B5iYK%bfC>Pe3EIe&+gSkUvFfNP?#%a-t`(*9bmyur}ZN;Q^
zeGSFqZ|rz!8Y|Y%JI(5cVk8m<?6aN4AMV}r=D(4?T2jH+f+cBz{m8`1`Tm3>Ycqtn
z)yc!k_q=If#rx#nKG(C<Uum|kWi@j+2QH#3e;yM0Y}F43i^DmNdsoszR4zaqYVw_(
z#B)~x6INXnFSXw`e|l*l6=HIk?k3N3{kV8#*FhK-m>bCCB-1os{1HEjIJk2X9Vv66
zvJO9Tvn+wqt5gnCH8(Lc`e_+nf1cT!mLg@KlwQort&keyx)S*&-`CkXi4)+O=VD4o
zZqdoQZe|S7`J5>PDw|WBr&~W!u<qIp@!y0ayENjkv5#&HYVnk&4g=LPno-6|UL!?@
z3OgrrRMoi~{<ML)rhAUhDP9$MR&hOJaL{7q5sy2)O7|!IQO48iRopf|Y)!Urx@WK=
ze;}tgAs&Z?b;MB}@`<7=+?AN8Dj$EKSYI6a(Zcw3cY@2<IJ+x2f@W0PNY3bSVZLY0
zv6D9<p4c<Y|L29*@EY4S7dj{_byzPNdFnylrXxc&nL~I{hKT_Yq%ZkXd-+(nm_ziH
ztW3I-5#t@<e@R#T#9UQuiR}(@hnO@($d#Va?F|%qO2vw`V%m%ziNlg<pyZz)ffsrk
zUwEzRA(mCD2F~bk>_SVcgE1RROgTTUmzS_RJ`s#5!~*{0>*p>fD5I|dVj3H~!nUo=
z%Qc`Z**!yTv2F>yiz=H6Wmk*b1fUy>qb-IH<<z3JF`zeUI#Ln;8n!fl2ogoDxiA^{
ziC!$LTZc*=M4Vy<jOCxngcp6<D*e(|uT}HBfLh^Adw{yhw;(<W^RpxTSfzKV(>om_
zyUd)<v*L)^OvqE;2tM0YP>I1H<Ihi1-GY=x8Bv8Y%|BljIc)`eOfH3}&a&aY#TP1I
z<hAF2Y$!#~$`0XO%JLfl2B+Z_@mRdYgNt@1qnD}#<FOMehr-;%yghfnwOrpmfu-#1
zVWFkGvz4zjIu3@$1)JZmTm`0J^^K*RmwND89{H&RkAFW~*3Qno(2#B$S8|ZatV(J;
zeSLL~Y=M^9>ZCWqJKwt?GZ#;j)~&6TX+TNU(G2=|7U#fam-^bVcqQf_yIP+`rV}-t
zHT)Q9Wd_YFcMfiFJ+6q>GiN;M(MeesSmrtV{%bJ_i~X{?KAppc#<G^>b>Rl9S#0wp
zcdq!4Xm4vOur0m+GTsH*%}hbr9*M=puj%|;EtN`dSUEhf);oK7zAU$~Wl|fzlYV<+
z6=HNLapkoTYupAcZ59k8d-{~MNv0u)jAGh)1Ax~-o!+_5>r-Mpb!Yr6Q|hnAV@;O|
z=t=Meg73$9u|D^fP~XNpmg`rxOo8)$1}kH|UrS>1hb}3W$r(AvYomJnNh;P=X+_@}
zI;;0zp2+=OFTo!u-&QYlz~X`kj_VRF8MQ+<zHNIp+B$T08OVCY(>OjhQ>o9|6NRkz
zNbpl{I%-9qoCy+9XbKQV#u=XkWu})^Y#o;`Oax_V?%b*KR8iZ<&rTUWIvbyu{`jR%
zWk}hCF+lnwi6IJq7jRP}+ETWT<$|*tCa1srR(<ub{6g=2)l-(uwp6K;tq&STb+A<_
zAINHey#9z;>)6ERw-0R``9W0aGx(A9niW<a<rMUo`M6@AZ3d+@D4qR!IXHFWx(fa2
zP*iVQ<K&35M2m3L4~Qj#9yrjP(>P&<i%%v|BKH=|mEiTmPM?4$adm@d8-qUBjvpme
zx9b*iIblJ#n~bBX?42%r;_=fVEZJxw|FBB6>`v!zI_6W?VOxp<`apKD`If_{L+v(-
zUvu&~7I#S96H{V!@lZq@&37;4={b~RtkqQEMC~2ftB_xQ)IJh#Il5B0;gpC91ITPi
zv7>Uk#J7}1E(RnS-?h+QvU=CGn-g8CdqG~OCLbYD7o^LNYh^I=`(N@d!SFyH!f;_Y
z(2c<n-liEye}Ni&?vX@n2A=%B4z9`4&pU7D=kK&ze|~_NwP3oB_`d(R4Qd+BGCLT^
zyCHt{89|b4q6ioNPKS6F8Mn#6$W^4R`RJSb<&)LxdReT}gwrjrW18rkM=!IKF06_e
zyOEX$deT+QjiY8P2+s+~G^o-Af3CSju*(vzwF9RYM_I-}2w$tGhthn-H1?DFtkk>3
zr@%O8T57bz3%aTq)ZH>?Nyd5c=M@Qh7r;W+e>~@~<QQ#`R;@qO_6$)WQ%jCycDr^*
zU8j?D+riD`bytCPm8Xr5Z0?s^HyCI|oK^r>CVL>2_cR{c)w&J9+s?Wn^=PX-+ZgDc
z8=>H^`{!67qQ7#589|3G#G$rFify6#&^GD|DFNZPPSHTO48jDxFB%VzzDSU@Bwx8Z
zNR?BQ*Y8wakoNlvc0WZ_<Staer_KWFKs+-~j)ou2;otm*F2Z_CB+H6pWa?*g8*u9E
z&G)#$ZiLK3)~W_)`mnvLpbxB1v(EGnN(57Fx*&t!iYGZOFWbHV>k>dSR4b*<y9yfD
zGlnrvPVm&0w0pP!*JsO6!40aer8mlc_*c_V8E{f|(H9_1@f+~SBGrOrgG^;oFgEXJ
zf$%ZA1N{Es4LzLnPzw|~J8NG%S)zyUYVOH_yT5M!)?IM7t<e!|?Ki4{+Q%VhZ&Rok
zp4-=2-#Y8d(3TdzenyLThtUfT9(_{RV$d%iEMqS!{nYNL)Vk35{z;bM?^yk}X#A^_
z)FzN0yTf^j*@q*yZ+{Q~U$qWW=05^CH(!GAZ^=$-aN|b#oQr2)-dnBgn^k&0BEFBP
z7n!-w@TE{8)8USu9W_z7U2SQ9?&{~HZOUW^wib+aH1aRgTdm1i$N0H_da;DTcR;sK
zPeD88>1;F7adzC_V&tSj^FysciRD~@43vls0{rFhDYXkysjY1%`b%am0eIpr!4wY+
zH!B66B-4BH?>rots<cbchKqX%vS2oFwyYEgU0xbQ8^>o0=<G*pYEmcaN0yr6r@-Ni
z{4OpG$$r&d9MWR=c=G}K%=e^L7%@F!yn8Z!AHC^9>!ZN5YOTCND2Bg^NV-eh-)>ka
zr40+JSH9J_J_Fc^?tViy36|wZJ&V=@Qpf0xp6<+@)>7%v2e?k$1f#B*pTK*r*rMZR
z#fZr(kmM$BBq%5nhWU!tjJUwTYiNFRGc${qvc>10=uOiLge}`I65n03$P_O(iAFmy
zB_dzz56fgVRV{ey>*#QM?Ifg$fO9zI;#w|$xJ|YtCbmB3LgRg?e<3(+TvUJEX8YWy
zz*^%cd4)s{O?LcjI4^kO;O-8?VX_M$(Zu+GR02P4MJWo|*DzDxQeR{1Eqh{>a+yFl
z%`j|;n12SZ*UBSHZM8i4l&$!s3n=BMZXq^Y6W#Zy3$m`0ID1}WU_haC_8pQxw=#-5
z!(aFbXO1VAhz&UMdOW*##wf?>F@wio|2MPeP5k@!9)Z`KsXQ}APrLj4LL3ZHA*o9$
zw`Y~Rd@mp4JKp0QUhpVhYN0o|*g;L+Z88_OP}Gt7@qV2sc#U4AJMN}056|+C5^?2W
z5RbLv7kLhR`)gZ*0zaI}F3T5bKK|8h06uYv7CatdV8?B}jY5`G>9nLRh=jNDBa}`?
z5xSKX!^)%T4u$k8(fH>~4`g*NmvcERBp_t4djdSA+?^IsJZFR*C8j{=kqs9OORYPH
zmIjm{6v|g=sm*!t5Bm)KkU^_StR&w<bd>O+3E*)IxhL*bac0Ke+XgYP3dNbez`9$4
zUt%vjp3n4Uyk4WwdzaQ;w=T#+a=IbfvQf%lx5UCbx@2nbqQ#&h`RZ7)3(^K{47O?1
zc5nJLZK|1FiT#+9sGOz+7hg>g0k5#hC&4~j$BzUynn(oQD_eZha2fl4Z`j=p9&t?)
zNH5b6lDNKNzrcV0s97E?M@I6A<Adv;Arc)TnmC?^=rYceFO3u3!ti^n{}|%y;@2;b
zUk9QO5!`U4H@|8C4Tehx;vWS)W;E%2%JBMlFM5Mj3Z1J*I-pifOGh8|%7|Nj!u_b0
z1^F~S*gOM1@F6=$umP6X1@<-f(507OJr_Nyqa^|1dzH*JG*yECk$l)GqyKn2V<R(*
zPKN7W23w_z`w@XPE)aKkgt1c`jRT4Z=%@F-=?)WUXRe`OXzWjqWR*&PSg>7A&MYiU
zA*`&8uHIUnNH;O)Nx8br>)Mtqi7Z541T4vycoV`?NK3Q&4{gqO44?JLQXndhTMSKF
zU*22UR~4ZM?8VuOeTK!#ZA9j7wF$ErV9}A32wUD)fd?Df!s_id^$ZW0oq@k38uAp_
z@3_-}=5L=x71wHPWNp(%-|a`j>VA0auV4dj5oAMkloTze^s(2(RES6DYWIg0Z4}=;
zUEc75gPT9hx4jiI>fGwRhnGGp)hXP5LDG+`YsmBMOLp`q4FyeP)0z5&*SrvfmD`Kj
z{8ixYYrf)1QxBxk*^kjfpKs-2lgU8y^6r)(EbB!nb(ZES;}VwvA2$11w{uZsm7&Q<
z;uY`Q;K~lLPD1RG#E*2s=;J}b@A8A+Y;B8zx)o{Q1qZWl512<Pu?kzIIvb?5(8mUq
zZgToQG*F#Dl?~sx`Bk@?wDu*CGyeiKCkn3AOK{2DnwF{1SHKeL>GI1ytGQg>hb5^-
z(iv5@jZVGmr!;%^*Fppin!#~Y$+&U^tlKDQh>)$f4BsH~Z>nG1a7KH}F6i`kSq0Lt
zd}s7}{?|#-tSpC{2j=ut-}K4e^i;KPj>gJcn3I2E>m_0#jYzr#SobapR&_DpOOxtF
z92}={6$VY+ne4(~xGP)7-Wj?E;-43j#~-z+q0zE!3h9o6hfmP&swG-`cLH%kmzy(@
z`8Yv>0~-gdz))Jj@1050>BHs0CV_I%PIRk`XtTZH7pml|*yqzldr~}E89m6ClJ=q(
zfFK7)9FE~9&L}Hx3byN}3FJl$S!epbi^6ac(;_Nww46dsp(5SZc0PJTmrw!kRPN0W
zTrhR)S(>f3JgBd9O5(>-Z*rT5VI9NV+ruY;Oj~vycI9>o$2k@H7D3h?C-ITbu}Mm?
z$b~PfR89vD`@_`N+6!6-3XS&>>2Yd;Vz$$`v*TAx-kevrXR`^|R;>Wn4%j5_vz}Io
zbjeMiPjTDP#<cxsh~_VMIb`&6nkU$dw|H#}rGg`(XEkl*dIF?n1f^9UZ?lpujf);$
zrX?Iy1ykC`4`fv8GP=Ei-uR7qtYUPlGtSWtH0#{3H_VxC^7<HLtfic?U~kmT>FA`2
zMG(UA{ylFsUef5b3DIeOpKrEu@(SX$OLwDODirM(&~`|@;Av=8gj}AE@!vY=L3S}j
ze})vjd!_K8Q_aV{<Nz_xGYFY})(AbzBDZPRr$J;z12HN-r)*%fewQhu!Lmkg@1a}#
zcIzF&skv_a({`g;*n`NaeO`d%qvzzYfqo9+or{%VCMZ4d)^B!$I{5)`x0O-oHzqBY
z%RR>d4$HGp6I9hb5pY`Ef)6OaHEkqpz0KY8Q7VB<6Y+NumO+V&okO#o5Dn~cQ~o=4
zm0$(-W}5P=puUdZEsKP|t_MA&gWZEapIrG}1G|aW`hy-TOTP`r>MSXokLNHs!<QQ~
zN2ZmAUkffZIQ(^~<hQE{tGugc4G-+qz;Bfx?UFW;p=Akk?$<-3RQ!r@egh*mHQ4K-
zVnSnlV_=RI(^}AqJPdIz^Lf{2FsUFL=^P=fA@(a_JThf466#bQA*pei?t9SG*1sHN
z_l;n52Qc7_TSFeOFFZFir(cFh3&}B6Q_`!fI7sE$P8uY?n)|BW$}qmd6bL7xP(N*2
zssHIc7H|&C8fh`(;$&60YTP>5;3D1jnw-^xj$*t!hL$ALgTA!TD5Y@qwCtI7r#-<c
z+0{nq)<{h8J`I>D8#pZgJc@jOk7#1zhR9hTvcc5(#KF^h>l4P!ghC|*UC_=3_KVJN
zbHp*T;HUHkMLy%Pknc;#F$sC;l#h;^!1UQvT(VVtBn$wfHgYJPXe5(o=1n7~xZk|R
zFE5OyHzBGD{GCT4UII&*#Z^}YPvWOX3`WurZI4FBSD2r|i(0?5H9PHIkmf%Rl^&cZ
z7)FMgcZh3!Y86~GfhEeRFbUdKGM;ENs-5~bh=Osv)^z@kJ!h0zZtHCs={~<RhLE8|
zc6Op7wtWUiar;;O=?K!9*pHklxCwNk+%kV0Qu_z8BWC|L<%#g{QqqFqLZ0X+#OW#*
zDE*VrI*N5cO^j5z07mI0dl92H)X$8r?<slJR1x89kj92v?@a0g4j+r6+T<_Mw4n3_
z*a72kwb`;l|8fieDhC@%<9oW>L%f-aIHcj@&}4Ia_H$Yl+%|CdmuTq&TF{ESov6f_
zHtVN|_+^dx{L{X#eF?7u9<{0;t0l=T@5doUqw|*(IIdg=TjJx9>pncVBhAeZ1g?UK
z8M@`8)BUxR8Y@rAxP}Wd!}2X8tfjlcx*&;+Vg;&ubE&12EQsh`L()!Z&1vV>{lh1K
zJmZ`Y$7Y{W-qW(J>I~Pu9M4WTA_{p^%Gqp_>%i6P0yWWFVyD9`hRgn@(GxGeuoeb*
zY8~9BU6k@_Krs{%c2E$!KY!0j+m8)IzhJex0&_XmfcGII)s+*0TE<__sy?=NpHeR{
zlfQeN&@n2OghI;BRW-sMzgL;};bbSpp$a+~wc$NR0*03l+-_fiemBs#rUO&zO+>2=
zx0POn;+>2-i=$CF8O(!j4@U4d8I6UTASq$vVfa@WpA5dK5NLgQ`-54P3*hroJ8ygY
zLLqw>J@0P)D)Pqf)fAgkTa3q;htJTBFBg%UYWCv`&u^sM^U(#-&s*7*sCLOqy7+9p
z00nxE#|FNWV+d=cOTU==-WE#g2hXOF40eqc-4?qmkDA3!Y7onO29h}of>QP*d_KGF
z?lz}#z>y^nv)&0Z<X=C!bFNw)xD4^Ybk%lt9@v*Kx_yI=^W;(nI<bUtG98TBc|&J3
zsyr5>zy|MM5gCsITS>>A`bIrpt4*Hc*MJBL@(}DX2o1|YadI7ZTbjC?vy0QC(&_J#
zGYcLwTfx)ccmoyqS`avr294lod+$1*Oq7%Q(V>nvCp%cff5qFw+o5Pa{Hh;9IVswn
zC!w46_Q7#=VyCVRkD5+6;hdG~F}vECgM^<<Q|tEIU5X5BOx0`I*^7hC5g8kX?~NnB
zM3=1YQSuY)2!`?z?NwX+*rlabF=^VtJ&rU=PkY_C^65HrP0c2P`L;Q{Nt|-|Ti&5U
zm`<P<>cP4293p>gW-nX9tYBaanpIk^DNS!YR4llu*@s-TS84FsG6>-8|M}uQ7P&3&
zs%#EzLjB%;K;F=^opm*I@+yJz?cK&{v|(%(m6br5_Qgv3a?nntv-Qghj9<d9&*^s~
z6WTdCf9BJR{+dfjua;N4`huvF&T_tZF8fNed9ln--{>n`2Yhyr9NQ~WIU=#m82qO4
zX4m$>QnMVc!Q{kqYX`OT;N!{D%dC;lW}p1haR-4}7du}QSXhdm8TpW;#_DAYZE~+1
z4bMKv1CcONISm;U$vyp|5T)0Fw)pt`ddp$LBr<{m5&EO_J_2SX5$pq@1(9$?btCiN
zW{=5tapgXuRY5sOzxqEYR$7&77wisxnV4FaA{GH#77Gr5+y{|tM|JC!o%F(ix4hR^
zxu&p>!Egfgal@h`jpSUpD7`1UPd`t$J7bT=sO_l70y$|_tVQvHBp{NKtZ1o$MXdcZ
zIDvCjH_%~n;tMPIMr)cKd|WoL057S-jKOT(LZ~EAf=GZZ6!w_W%c3fBt%u+nq>X9O
zb=mQF{_~c^@)K_nrpI>FLQ*OA7=DePEG%}^)d4^I^_q4Q?tw^V{fQFBEnz|U+HXrq
z#gKJz*=(RH9Alg9mEZ)%ZOefX3C#H53L)rOBx5%fUKFYmzj_BRm(~7I<uD3(i=gFH
zEFlr0@(y_GY0F{vcFq|bDoxwPb-!ytcHkU|P=piMwhSZIxA6<kVM1HWn@EKRpA9^z
zqx2rWclX3)HH@aWsZu|I6Xg9~(u7^LIAK{ouz*Nz${4M45$4>(lkblGX09*1z$z1Y
zkHKNLuMPrfyA*=(7QQR+dPm0{++zTdbV;_4t#88&_sHo$B+7@Qm5%FwA1&F$h&!%9
z?JA4ok5~JI5Zrc>HpG(}pAazZj5ghMynD!6sX#?ilp-rQ%zvKIfnxlvGMwN}i5G_7
zUX`32L{gADf>aPJnPZ{1qgH*IgMf`#i3NXAjRD>o_b*I;fE`m-f6q*bFH@Fi&weN;
ztEAX~iX}W9XneUO`-U2@s41oXo}lC2a2xAxmKJ87u%pNkd+#zOR^o0Sai~ufKa-Y*
z`^wjscL1NIu17y2{GN?()g}^jByDZtecyr)$N^+)#NW%aaXaV({9lLACL-|7<c|j}
z1$=&IxQE7_WpdpL4Q0NJ!{SgfJm-M;rHjER#@6H0Jq+1~K0sxE?wQ5=<wz8)cr-^2
z!NAg?7sLPl)vcY@vtq7w%MaF7<SbRX^S!&fyG3g^%(zJkAS0K1!#p!NSNYsI?ypj#
z=e^ZCc56{=Pm<G2H40eTM6=k=o8c3J)>R6kOf>gfNEnr3eEmOo40Sc2wTN$L|2_|R
zmRdj499x6{P%OXXO$a$hdVAU|oawZ;i7^37d_w3&WvKUmvCeoYn$~881Yw_**2Y=Q
zO?Ru5XKn^?Ri?+2ehY5LE_p+29%vO@^6J!Gb#4_Q2=ZBS<i)e-XAj{ImrO>zWXY{F
z;_vtebEqvuK3p<zl**3CC=wx{&uQ0fc4v6wt$<$~NgpAG;Lg<(3<g_@zB-XR0A;Wh
zsMn$2Ig6z0hRW0K!saFDHs4uEWZf0YQ=J#z8Wl_*x%Kfr;{5W0l<?Smlg{Td_-P@t
zM$YytXS$dIC|fV#m^a(QF0!}+x8ro<aa>0zr!1@L!qyTru@<+ye!c?}%Obw5{Jwsy
z`RsvK?@eV*qV6IF=?t^&6Q?2h{62W0TJ=7a;yifEoh!MXnsmc<W{bDyL;VCkN{TzB
z{@$QCVmcu~i<rn_Bq!_258rTq-N}gR2<I3#mVurA-k`HQck4*?y>B7LMDr`~^Z<i_
zOS;`>;8Qw%`&|dRHuu#bzp_O^iLSU9U6ZPOeevs%r0{o(soESDF1(Thpn~c=IhkoT
z)DrSfBj65Q^TqA*h--4cCy)$Wk+<sp?C~orB?s`=`uf>S&UZy@9V(VM)c4yJrDW<^
zM2s9@@sie<3#X|=1^9jZ(?m5<{|j*_=Stf=aoSaZ9XY@y1XgqJU4Ab!Ks@N&fiH3V
z2|g03GOnVaJ-y8a0LgH#pR$)13vLCBN!LHbDXUQ71C(x|{5+`vzR%xaWXe|wJ1X6=
z-5T;DzwQ8>Ey}kRk`Msh-E!Y2@=_##I(bNjYQG+!#IGWARym#^w37zU)eG5eO7GJH
zyuNrEPw<4=l9U_I6ksvrRlwO;;UkcOrq;QRckyvX4KMkw&Wfri0rR_WU#80KCJ=;X
zywsjBns{&rz<;Xo0kOwR0C+VML!=)ecO!Jc{rdL!sP_zE=mPQeq;AvhjVHN%_)Zi5
z_55A(D-OVWf3M`Z6TrixO|Gv`Z#-Ea)=O9U^My>%vVH`p%@9;kfVp5vZsaZn@xEUc
z4Gsg0y;?p*SZB071wbU+<Arzb0F+l`caw#<sR1wAZXKFJ@!u?{3gS?%?6`yN3St2H
z=r6r#t{Z?)#m(95nKwE*CoHcEQM-hpWK$L3;&t|brcXdwl3XJ*AcE6++kv23VIEI;
z9&h&+q3HmhogCl;!w7}+Hb+2pQ3@#VNP{oFM)^)Ct&<~sAa)b9edkGRtteO_YAUd3
znh=tZ+EXIC6TQk6dJ1uY4@?EdAOL0v{5+fSE_XZuByPH=q-C0_8)=O4%@z&jf8v23
zohC8FAoyp{cgwn8*Wzm75uMK3nXCS_l3<ttqgz!-F@5|-<jWS|`$9<){&+o)S90A*
zBA=qPvfj;+*JEy2=di_jMueRpmBFWUWR4EF%yF~SP?}xMWA-1m$Zm#E#w;raqz2Wp
zmU^#KZjV`ye2;MD)Hkc5FV9XjOFJ$SWa%qh0`c(c{b)is`1~Nr*8$T!(`PL5#m|Lr
zM?3r?-MRZ%$=l)S`_=n(vf!$4AZ`-VD#PsbH2Gn7m~#L;rdzK^HU(*3K!PkRTfuDI
zpmc%4)&FLW&B(C^K9<gSZ8Oh|(Dz6N>D=;W4cxMfnB4Qw#V;=4S=vR5Shd|_om=CI
z6D)UCOHM#MaZH6t++P`=A)%yZsveT_EQlYo$Wg78R>HI<Bkv{2jk`zzUd(><@==C!
zuMT7&vIqy_p;1u~53r0BFbKcOLGqnqrH`FKixzASvW&(?#m}^=T1RrrA~cf9=)Kb|
zEo}mN4_?jb8yS7|boarpHbiFd^2A5Rau^$YhC(7bo%Te&5`zLa;*mL8Rx@F{WhNdZ
zG)ViEQd&D`=WA&fd5z|&1GCQ!X-NT(O{Oz+e9^Q1&o@HqpkGTxx6eKGUGG$H%*T(H
zNrOg*n7g)#BjUw#T`YP_E#j98lXkY(`agf4w^w<7yZk)eq&4hP!lSlN0^n9;rgwM{
zI}k#g>>?9iZ2PxpKc^qOMqZ8Mn1DObe6GsnrFoG%C_!Uf-TrL<m*A==-D_K>;qJ*7
ztBYq}MFxZ$hK`KlIHVr;oR0AkwKac%&iE+oQBBOGrVDLGn+4+`0*u4cpI4PhkO8Ic
zpS&p>(RH&fa;8Z85Fnja)+e%vMO;1c8Pz8)4Hm0De5kXO=VHm?7eKYaB6WPYXKjA(
zDJNAOmNBNF<fQ+Qw#<UnN_Xn8JWc@_zP-}~fA;=8uws%<SnZ=-R_<~?WB6)-4QabS
zzinh~keli4K?xY&Yb?Tm?U|rfl^cv%<eiv*oct8B{A4#X-HLg_Vb0$BWusF+2MWyh
zB1w2K?f9d8dQrrPvu2l~k+nGo-uB~P6T2_`HGSclcZ8!}m1PmN=9Vd$=v=QPn`@+^
zET(~C3C|gdZh!eU)d4ob+>#CXU2@-YiCpD9n0flRZsRzK;(Q}{8_~{WiY-H^=O;Mc
zH8oTBS>HKq&xpw<M<-mB!9mhrVF`%s`0Vqkj-F`gj8#|wn$H=wN5wdct8-u*dSPc3
zY=@)dcBb2%)T*0B&B|ATeHM3CvPhjHCv>)Ix*@aFwSC?9@<~HAY-u93N{c`<sqqtx
zfl42MG^e*6I<Z|f2~F0*1&{%{(#=o5%MiwA*AlhVRRSL~>_oi>9~}RR7At+}s;onO
z(EG~&>!#<K-8j>4J-l>8e2Adu)!K(&H@qj>%cHmSO&xQ~?wKuFJH1xa%s`|9$*$=;
zy+nVKTUof9Jn@Raoa|X>4j>e`s1Pi4M~2`J+SqWcCsF^X+b*dwQ;pfx=to)yhj@BB
z(al~VA(hL1@$~3#Q7NIc&ZFI~aw4S(FmoPocpEn1nZRGF7<Ey2S){asDdWbtzP%yS
z7c(noL-R}ll@k!XN#Vx`S*cPPj<+gg7~xuVH@Pn;9bK+JvVsl*e@U|O>q)|E1yzf>
z_4sI@Q#Z=TmJ2!UhvoEoA+9N`x$0RVN7Zf?hZ9Okg%7JQ7BYU`47ZzHGSOLsNTYVg
znkVIWE{Lp9_D_Aj@hHaDY>JKdKrr8|Cm^*cjBbjGQt9P-&M!iETuHjOCFoU-dG!lt
z?vV~PO2#y8X!+FgbPtvToeJQ{n~$dj;>fkLL;6D*ho@`X4+k@To`>6E)@9-la~qb$
zjhg|~>-)Ron<YCoMu|BrusgbR2=2D-0nFk${gUkn(zR1l9JVf;nQI6Sv0aC}V&@2R
zZWi=R0P5mJo)0*T%l;Nj6aYJ_9V8T*<+#H$zqHFQgu7a*M2IBE=$$zSNQ777H#_wc
zw-zY-?&+8@@;N<*7w)nW`+Kd@+a&)I<5byau5Hr2?U0U=iI|agd>iNx5c1Ws?{t{!
zb&Ts`9HOxDuZ~;b8HnSDi-QiMs>%Asl#kO@JP)?o;hf9M*i4zb2fE~reV4J0K%)=)
zPkrZUg)<S)@z{3u$xbKS@8W_Or_=KAlXPrT^*%JH9sRoT)Nk=BDO+|iJ=@POX1$NC
zB0?Tji^kEFY4p8Lv;*xd&&6jc>)#Ggi+tJub#G#dnD-F<@>Zyh+MZ~@qObij=_dn8
z@h<65+xs|i>lz~)FtKRym9jIV10aOt^hb$%*2>j1v}(VeOSt0N*l3*Fo1I+t?5it$
zhu-FBbf&~`<^#I8p~&=6r)f-g2~?gdSo6-Tc`EfF`^of*@V;&_r5E7fA}N2i@UuV9
zxP!f+SVuz_duiFpTu9(<_Wa#qZd$~_2L#_zW@w#I*`ntvH&q?4DXpm(R&k^Gqi0$T
zYuXGcem;gzX)^)|O@G%v-D(J>qQ|~>`u1S((s+;lUaHSfNq~BB;BA{c{1I(BdPin0
z5~Z)<Jk#>kSEu(P&lc|JM5MN3u5BE5lRjI=@^wZJ;61f(-nE-~T@5#|7C4dNUfL?b
zf}BhUZIH2tKEgEdNM%CPYty^pAz!f~C$HwNe9S%T#-t-sUq~7>0)5Uv!Ti2tk!5M?
zhh+^zdM7N&bi0^>M8V>{ZvXkm8oeb|1h)PV0T+po9PYJI{JJp1?)m`wZZXdT#KDbo
z@2TDzpIx8{U?(1fxK`KPU3qA2iYlkrx|tlWw*uhvp&OGEs6;sbI20A^syN}voId&J
zC~5K?h*LBP7N{pu+m&|qI$@!nTL^gDLJ7l5GSI2_mTW<%Lrjjam1TuHyoXOcm(r9L
zim$@Fm?siEXI_7F^}+TnJ!TKXX&`>S2F}wzoJNSW2nm-i8p(or51aLA@k^nrqFH-(
z9-<~P@0*<@JNrp`N}$XJjV_X!MbfPyoa`c(-%^lvV*x?E(#O$whJ1%&Ro901GHPi`
zOh)8#UPr&5p9`##r095|f!x2#G2KGZ?zG{zfqpr|s4A^K_8w^~W*(w4xPZTs_G#x$
z%9xs5J{oF!K+ivYGwE>bGGH8Bs9Yvw3l+P`*<3o2W!CwWCw_iqRId&>KQD2xXm#fS
z)qO<LFnRI*#KoCu0a|^gtkl#@`2*rd*G+r$_D-d%rO^_}{dzI1HyPtR&ET=8-;~HI
zcl-w3(0Q{HAKdsP?3I>4sibqTqDu43iv<zOCZHGmp5NuDE0p9m&b{m}-P3102fCb_
z2@P%eO*&Hxfe`raHQE5)BtdyGiz(cf(CCf#f!!fBFm?JF(tBCY?;Gy7bRIKJUR?KE
zTJ_cwdw9I_LbVoyBZ-6BlwaZRek1QX8Pdq<I=#$<;hw50pCw!{z8{I=r0qzs3s4Y|
zCrK4Oo1|?{-Mo=^^%DAwGd^uJ5%KiK7=Gy_G1q}2VIY9NtgQBOw1JB#q{(yG-=Ls(
z)9Kdj<LnS94MHIb$#=J~BU3IWV&{_|ZAvN6zChr|Wj#MehNfTdOoo$z2W&zZ*XGNQ
zq8q`TUsquSmbc6eyqc=sU!bAFXn2zeXov9-^A*Lr;2uE?vLA$4!)Ri<3;FWan7=y&
zs1$~{;mA{j(uXJ!`T^<+s9vUb>0Hw~K;y3WYX|8ZLKn?(2aW;@EJv*|$Q*e4==W;v
z1Ya%8eQa4(<pU#_tRJ-MClifh$Zm5I@0lVWh^IbaTWQJXrdFU4C(+eY2i$(0p|ohi
zu&@eY&oi_U+=>Dr1q?yfF+d}9M+v7+JyGT3Bc4e=*;7_1PId(*-;v?hyZ5Igo~i_y
z)Q5Roq08!{ASj!0+_|qx&%P>|U+q3<K(q)Ct2wa<DJZU-xP0*YLM6*`<Vd9^&Crrj
zixSax+u(tUrC{5tj$8Y;t4jmuTQYXQiEm8NZb&u0HLQ55@QvYu-FRZAS1cjBHLvZo
z#aq-SvfOQwFW60qFe-!Y`yYy-93XU-N7Fklk#A7D7%9iNJyW<96+&t|W59D7Rp+kk
zAXya19y}wHdN5LA4qS}X?JbcIo@9sh##WtIeqM{kMSi}#n4Cc!gMlED69i;VY*F(9
zJd58^dEFye=p^efwRN%%drpoxFGLzYVXR<^(F0$(REK;^@6ik1f~dYNzJZtf>Ywq&
zt|0g^JR#rnd0x3tX)7pZ!>pE&aY+SluwA}_pTVRKR&k+L4USNVa!%B>>>4#MRQL$Q
zE#a?a5Y8qulS(ng{hiNwdkxLlNq?;$7&NZC0Qo8ZMjT9Iom5}dM$%R~y?A7;H{7e=
zuw&ALhgmNN`iv4exFx>E{uGpQ0S_dDBzU<<!{Xbgm+78CAR5{Sk0JK8`irS0N=`*W
zrtO^F2EgANF9q>YQ)9i5ltUhGxw+Fkf`QeNwL2!uKrN6ZG-F9+tf%B9*IVJxopukc
zob@r)LmWCtz(>c_Cy@>mh{1r;zeaM;T;?+7?r&@8Edz&d6S*x!U*4VvPT>s=uh))h
z*vTa1VEczH@j+dAEb$)?LAs|xbi|JZP-diMSOw!{;1rwd#+UqdE~Dcwp4{K(7bvTB
zJt<`#Ac8$b4rYFZ0_6fLqV$%$fWp76C6L`8<hb48p2{Ye2Zi*D<+8>!SC)kh6QWg?
z#^Tran7X!+6TOfprb7GAZjxP_FkJ|*x~Jf{2Lin@4~*D<kGmu|EX2uVW#vfkw|v<1
z3ACfe0^NSIzM*&Y5j4lG6t#c~?F@aAl9Q0-QM;<IiUsmBZOm<EwCph3b*x|?{*Q{?
zwo6;(*9#qI&Bmobqt?#@F#&iN9PXd)ucPsC`L_62<CMonJ@7a8DtP^;5-7))9$0#8
z+1O3CxOnr}u4qr+;3!&9gELnfdxJ`?hO6g4RoXXReMKFRg3Nl19h7BUMeUQ?_I>Nw
z!0i+Wx;-5@(MW#Gxogv<=L?YY{1sQB_LyVe9IZoha%xuzR2vsrB<PlaN^2W_E~6hu
zR3^-v0W@0iI5|!<dk){UV4Lyfu1G)@Rk`NW*$G2Nj?0f?|93g<b_pjK8B?fcxK;Hd
zUJFhHL)H0N;93g6aE`+dz~Lt>2s#$ksf+Szdn&|t>%e^`69vIi3WS;kzDL;3S&OL3
zBasmYHN^t8c7*Jb$x`iaD)biqZ>DpV9flN?{x$@lF|{XlGg}@XRB@3{iTDzQWP25b
zWW;oq9`CazdYsFF%+{jpL|qRuhHbmH)9~(AIn6LM4@*8`vxo1b3bTWE4S!0ozpc<I
zTDk=~ozwJ{F{ea~Fc+2oIh4+LkFG1H!fHrZler0X>ty%V_QAl1Zis!7VuQk`qfya}
zGG%Ev5I2uW*%#{+Zkc=eZd<)eQBe7cCOZl#Okkf}s3!hRWksY=J|fVu8m{w3fb|VY
z=fw;IJ9u#R>cs%=<{R3}`bXfrV8%30ALx$wue<YxoSR;SE!_CHh=_VjZ9U#j{N^rD
zY<a}Diwl7kF;$iwh~Ccbe6MX{IZ^UB*XL}#4<Fq%g;ugp)>0M^Vg(;pyH+NZN|w1k
zzYW>ssTSG(&|Oltsq0Y96ge;JsL||mmtnZ8cFMlUQE{gFezj!GK}USh^ityESiPy0
zqG0JAC)m}TO+eOHA?%+gg<nJua={~;CsE)9cr$62-qO+@;0+6U0V*q#N{+gFG739A
zL7#Dfmt0mvTtyQLJwy$9i)&W$YnV+Mp#^JIK7SvZ-k9O`?h9_0ySj9VxqDm15gy`-
z9Y4*g={tQmC@H%^|9g5Bvfi@$t$o>B5>$4<cELN&xwFz2st!jocb7CHvJbUC@I6*R
zGpiqS`9CXEZ#c|sw8;xXTBuCnPQG-P>^wd4OJJxEtjyO*S@qpS@94ii6~eh;2TpU`
zl<VpOYGI|2+q#t^V#0M^PBM=ykci7&dwh*qOwtFV3M!w?Wz)+n?elqPw8%H>W1tfz
z_1CU-*aZ!P_)|eKg|2zUrPO&l>jl3}>Cl6!1b(nlN}8tS2Zmask9*}C`#SKeB7{7P
zdBt)nVvyQM^k#_!mzZH(ZMdtWXmOAVIVadhi#=siniZ8cFubr)rvSpn#$(}=6`JIj
zeFW~(Z^T*>naX%lY^>AZ!SVHAG(iAtWRlp-+FFp4=IlP!Ft#*8NveAJZA%E*Nj)k`
z06TfkLmHk1Lv3fxeb)AL^U+(;|0$dMx1bMiaJqrLeEq3IdAU%;GWLDT)Y6FSE`sj&
z>z-}=ZM}aV(i<;p%9TBMHD8X-2rGcGdux$co)i%Hd6gfa@upK!oYroyZ9FInD4C|?
zi05L+Z$gA(+mC!xfvpd{$lI=wm_nwT_M8)m*8v&sEw9>+%CAz!S}2%sKNlYqU0$xm
z>Nz;fi~iWUa?~*&46t#6H%-<G^Hu$j7cvWw$zVBLe?^a<kt$>&3U<LIeL1%nY9L3I
z3eeHoFhE_bB64ooE^#g0h!+IcUHSn%*S;JH)z+3e3$9<qp3cl{4O}-on|o&dLi^2j
zu?W}{D<2)Yx}9~{p(nJb>8tTJdy^aYi^e^#(4D*RwvW!=dZrYbb{H+)-;~zEyzSiJ
zN0T{N@~`=BgxJ*NEy1x}4zGB6++{OLL+1XYZe(G%&1G-1OwQy?iCjXllk@dce>Rz-
zQC3D(ztG2Uy_1B>nqcp?!w!p`=5%=bRcGZ6>rkuxzy$GU-PC00#^orP_1yQ{yz!Or
zhzaLqQ+h)xZh`gQK1qvQPnvgbUNr?S`fV9ymrz|$S@vvh8RE=u-m7T-DEI2=Rq#^$
zF3P=D(R5}7Y4xmgVy9i`TwVt1*qUWgE_`q#l0KQtzd2p;reMax?;YNk!6+?vofnoH
zwgvlJU#hwlN~Q3_zpEE}WaIMQ0g+XKjgc})(e#*rJxG-HJTFjZ%Z2=<V|6vH_Buh$
z!Tnw!A~nJ_KoT;FO#M10#+Dw7Xc%0vzBaHQlsR!fE9pNffpTzZAy6OZISBi`%zuby
zF_N1QEEk*Wl(+vaULW9o@QBIs%p;jlQmG*#(BC=JQNl-rPQdOP?$!y>E%7Du3-t-e
zjYkT5FYP3foPMiQdOrSm)UCU;L>P<A-nXTjGAe8)Y<z^$H((n&nM`lm)nX!D>(BlA
z`vp$h(TYEnpFTpQ`+TGXNy!IYxJ5-gYPxmWdz38YO)ND4B;&euuYAs4!1v|Zjn!tr
zv($}1Xa1#~4`g-`BG2ycVA=;PzJIt~ZpdKt;}$jd{i?%B1|MRn5g`AukyFv!)(%76
z5J{X&(obcIMI1)6M5k=1{E^QOTJHM_N4IR!5sNalz&N@`jz4o==2W;(3h{~x44iC5
z|2!ym?BA@ttFifxN+lSt_j=6*I>EG|iVpxb*~oe6{t@gd^R=y6zEZ5LZ;#__78)T_
zNIQ>qV&(U7+-r(jt*ArY^ZE=j+bcgJ`-zSm={QFEiFDHp$HL!u3W^Q9E?!rM2U5N*
zRt=kl(wyltIih~q)mo4am8c(i>`i`s%D)EjONl~~A5c4dXj#XybBIK*!PQTudBH?G
z_q=OCW}6az{Ss0l=IrWAmMkap$x(V|xyW{FlFX~w<kB*=eamNWEW~u4`Q@&~AzkZG
z{8s}$^}c5NpT|lP1EPUGenNW1ql)dWK{rcJ+J^jZ3}5ESj34$u@-8T2Dzouhi0{3O
zDVur_rI+_MS~{54!LxQ{@0MY@OrFdnMK9!&o=$q0%3L<x{&Wy%<0k=rlwJKvPEmwA
z5izd3`n$Yfd%nfHR~jGH460S~ppnX<bMOn+oPk^cecXRw&d?2ejtctEJPp-r7Q-1G
z{#P?s9uM{Q_h&?fEH_f>(xhZmd}n9I7`vL7>`{`&%wRHRG)9)}Qj$;-DJ6u8Hfa+f
z)h*mCS<*s_h%7}ZCC{0ma__I^_q?9J9$xs)oX>VX=bX=SyypENYGBK1wVcm8BumQ3
zKxmhgId0{vBs=;gCB|U!n?pSY$s4tXUl)9=d#Kibm4ORP?9IRIwZqf#%97V3j~I>%
z`m00764oZ{n7jJIE6}<hIc4x<|6T8Af0nFLJkWo*p-x7Qr&gz)<7}FMIZj#Hbk@&g
z#b=54_*Fe=N9)xF+ZedV%v#sJ0gGYl2MOHu-k;9LK0%LFmZhrsykZ>+PK*z%u*=&e
zRkN<=`cn0<1j4gbpGRt$_Zu$szO6LUy2fx^k+9i|GTKn{$oTZ<u)*#H4*eZ3!uJg%
zSNBl0Y(h^xm?%igN3Z?dv?%0#Ew~c5RK;bumB)|U>cuS^_g*-0(Wmd=V#|QSn8b!v
z?^vhw$oJpXo^}qA$%Lm9El*Y<)vTpz7wWQdb-P^Fzc5^4+1$}Y-8Iv`Sw#bXKreZ7
zZ|enFjyj%l$g*Q+RgV`beQl3d59R!g#p4IhxTm{YKc(+!_`=BZong;&y18`Qy*9xT
zdQo-W7tZnoRhH8M`|EpLkzsp}`5rkLVo;<-Sz_r60BLQ`dJZdIF}W`B=CAXT-|TG@
z+XssG<D&McT6Zmzy?Am@@X5jO3>EvX^6o`~)ypjxD;(+7axPBI%uPEzmjNm5o}+U9
znODl9B^Ijvj*VoeWce5w)v{0AnDa_2lZr?!;G^5wTDPyXm-Q;;tr^M6&+{@W9;fuV
zS;g8}8l>WF8lGL6efE^aOtwoL=+OR3nY$?WgnP^1UI}uIowBD2r5cmJ6lxY?$3~aG
z47NL?v|-twkIoGDX+-0`mN}}s2NW{)H2j62&C5PxqpFmPp6?Ona%-UY{=C?RLvQ4&
zI+ALFnLe!-_u*cR<WM`W9@gxV%_p_ItM>k6!+mAbfA$%!uvokI)P~G9!7S6k;^Vls
zJ>YZh*PD`&i)@t2)Qb1KD~hw`J*CDqxQ$1Z&GTL`;o!>f9Q56odo}sknA4uWIhAs;
z4cmL=IZh{^BUsWoMy*=xcI>SJuMk_6&*iIXuqjBh!8&CssgS>pKK3cC%G>9ISL%S=
zz2O9bve(U{wR~mYEse)%_}IqhxG!nVYO9p(NJsO+H}4pJQy+HOq}-z?9(VXymG??P
zcXR!CV#4lbayPb7)p}D>cUN|=;)(txp-xwFN|D+ZbY8C=9cYbsdn1`zF8e0nwNuFg
zN`_-|;a^L~QmT5wdjd&LPBiu7$rdG{<}yxsgErrS2G~w@R+$S4qwdWf!=)=!vid?Y
zAB~w6hi*A?E%|Hp3d2}C*iiDB5oJqwh1uJaUIar}Q0P2|gO5gFh%Y*M$i4)L$hWr?
z(3a;i$|*2!;<iF10~9=R_Y>6pEn2W-w;F9wb%Ou)ZC7dy82d7cjmd-=zkgo3Nmyk|
zNf?*jdumndE&+R_MYNds#vPM@XEl>EN9L$X!5Sc&_;8-+olxzykRfbMc*MtQWEoIA
zl!u%#2siGe*{N)ofJNz99JW$`NkqhBTBKo5zG~ke(S-SZ>7v;!1V-2CZ61MAi~;o#
zcu2Q%Q|oM4f0ygNSCDIzMC9Y$ivU-uI&4#TgmW(PsTHi#ufIQg0vIZK?ozNLy@6MB
z-Lj#@H&PW~AHpXP7I4JT)20)nR!wQru>KJm`tLW;44~+FPWJ9&00Lr`TgP00{P5vx
zA8~&+tTUH0PtyXP_4h2dS%%>463Xd2@c<0Mwr`{BaV-n@mR7ynRoN5gBh+A=3p<fm
zWB8W6+U7<n02rfEIU7Jdz>b`yEg2g%0K7ioZ+3J$bKB68F!iuf`y{2X3S%u;(1_JF
ziF*r4X|T@94_aLk%Y4G?SINLu-n{9uau~N)q9R6N@r?T?tZFw&M5c5&-%0$OFEbv{
z)G7~?D=oh+y>gfCc&@2JXS!R&_=ust$pmIxsp8#O*!YLu<+%pzTXk3RjAliawyJ7|
zm0cg>E7|StK*oprj=g~=KD`3jeW2nJvXS+u4>Q@`nj0;m^4O!j76xJ2G3wswAxEf}
z8UpXcOVGYF3*-?JZdS&_;d*M4aYM0V<a%;Q+Q(L{vF<39EY$TYTyJHmjg^;gD{PEW
zlxo)qk=MvDj+5wb5U3+6Y)qBCllt<M;GTk2@FLTMfx{1+=WLT`2Ot<L^{kK0YR`YO
zC9=I6diXkukewfH^EDSCb4mH7<!I&Txl3^pMYmVwwS4)OdY@dswe}RR<oM0MY_s~2
ziI-cFpv6bRNigs8&%76ne=<iaw=FIV@4)D}Q|6wi2&Y4Nmp_FLceM@*0b$^6s+YEP
z@XnTR#-5gLV}OsM?i|$9({m1dcQ2au{}%ZM7*;|5vN+J`b>lBkqVNFwiRZCZhD?Uc
z(5`4*6haqEK<OcL^)Psx8?+9AhAacP3;~<Rbqw}nAux~`%2k($!s{b+QTiAx9-)f^
zf7~E*o-duv1t?5tA%YN#%M?n*6Q+shad><OKRSc;6W8g7Yy@6th&|-sO=q&XUQ?<p
zf&@U2tAHQCLI{7kL1sK2pXo2u0xT8&pr&aP;#f`1#l^;BD~lljv!W8Q1Ui;Uz|i$k
z3{SiV;XB?H741PJU{OpQi@+k_3HqSA`Zu8vLd%{)fo%Cah679B3fY=lLXNB;0VIOK
z0)V5wbT5|K<R7Zrck6*x2X732EiMGT-k!zuw7~12gx^6ZgvcR6k(NBJ&^k*rLg*rU
z$P$Cln|#0`^d}#12;!7};D^-?0=j?&I95CSN-`E8SOI4MLBAeH1K=w$!vG@-EoK-)
zL}10SqxBJZar}T8E%N2>tivF1lk5L$>#_O>Fu~u?4vR(L#ElaXXmRFa^$<YA@5N(;
zkYM7*@d%7K^M#mUV%ULeaN@iN78XqK_vQg+fbRACad1X);>LxzX5zeu2Hq8?Uk?E&
z#Ha_GN1XSt2(W#A&yEJjZ{ijYprK*J&JK&fi1R+M4M4$((T@^>&xsian@8N@3!&%4
zuw&5xNKVW+IJSV~_v!&KoLKDu^-i330j!-k=>QlH9FE^>2T=njZX7R!*84p>SQw1h
ztpnnMIO~D!AT<46K5z|oDuzzWNkW6ar#wE3E=+CaAhsgSNf;CchsI!07=Vw5A!<X8
zYypRb6!7U>f4V3Ix_h(z1w4MRyC291EPsC<U)PW6sVz(p%m4<9kF*Y8u$c%4o~Iy?
z&SxR0T!yYT1h5l@$!Kzr;Z5fYv>`L0W*%UmgG|YF@DA_|qz7w5R;=JaVTMC$LnZ+N
zZ$O|8(Rj>X+xK%$Xwep&n$$Xko*wia@)1YC{0cEqm|!80BOL_3V3_YOKoGDPAn!Z!
z-_cALU!D?C@!K<Zw0(J`02%(cB<!?)?A*k7!oCAXuPSA2rC#ZeXX>?cI!~)l#CB9c
zrH9+rl}guN9rtK`S4(CX89?h)QEP~~GWPJJFA-5bX0oQ8$&u$J8kKXaOk%PtjjR0f
zW0z5lb0iK$zs{19m$+1UN^<G8(-kt(B=}xZfXq>8*^Mu~w>?U>kZPBhUmHo+U#?<%
ztma^piFv$Mf%NK2zRE-9FUloXAJi*=oIV-!HqGg>J-(dy&`UDIGHe$ohq5=T;g3p1
z`FI)2zMiG46;_e7ug*O3B5v~rIa3+=md?1nEz!2pE9i5~s}$v4>Ter}T%%c(_4h&8
z^UB%#^6#o{#YgAb7ByUo4k<GC>p63Nr;Le}<p6)?0V|S1qSDwN*<=lq*iF&Zw7#1C
z(mAP;S{WZZOLBXVtA{Wr8C^4T^M+p(JVKhyl5N!3oM@X%^D9=&T9A)T(_aGF#=dwJ
zyT({LDr9JRYS!?bh=T_&c?=CSxFyanP=2$2j`AOoR`M$>Zb);f`_VzMYtKa(TdCM&
z3bYcM%%4k67?9t7^sGzCf4ZdK6V+QDyc<`2Z}-5E%&QRglQ5@EMZGr+u5EbrbeqGu
zJX*w|2gi+!j6W}F{M+i{q57H^!%3Rkb?&?Dt+IN5ccZn3&I(BT<CV6FqiJ$C3ij?j
z^QYyR4dFxIsAVfotjH&BV%~oHdc29SLT&E~xdXeFE6ZG-_f`41;!)zk^*VdrX{=nV
zO#P^Q!ax1thHJHXG`rNH>n;SRuo<hHIfqJ5=JXXJpO2@UuBGp9MHRi4eNq-cARS62
zowwhcZnkavnpIV|o;^k<90`S=Ti?}wN;C9SuT5HUuhnDed3`(Q94Os6o~jg8M5x+B
zXmnZ8Yi#kY4Ve{q?@J_A$=Y&fl$p)B?gs-6jm3Ny=cdqWg}o}eN;PDqbg%4mFNxu+
z30F(DrQpwWE%vRxfWt<4E|2$IUY~GxXAI$?%dx|94;oj$udRMx%L&RG)eC;*-BOx9
zpB0f<8E%We%|h43@pQ<9L+*s38q0Sz+)wkA<~<wJ-;UZ$d-KxUEJ-s%&b-(s+wRo-
zmzB$<hs&@nnF(=2V?lnDKQqUPy-9a{chd@QEups;Jmk#isxH44Tz9Rw={Yr`k!O;p
zL6pZfx0(>*>Ccoa*Dc+0vxk<r`S{IVwc}s$?RV6zP+MWq9LH6|d9zD{IjEe!HB`8>
zy{ZNlyM{a3(k><yhsx48Svk9qOh=W#pvr<Lqcu+q$>lXAvpU}!>#5qMLX`1u<BP(y
z%W|mQEzUFC4N~lQs5>WL7FS;N4<V%A82B0!@nD_J%?JaRZ|1K*UFx`2H@|r##J+Zz
zl~Om~-N1(w$Tjk;8(A1H`{ZL__vLG)7yUOqeoxNm3cbZ2kkI~+g`R(B#^bJUw<iow
zq=!a~sDu<39y4<=p;Cut#@EDXrq-mDZ`x&Lom^97wnwhyVc4t<eexF77t&{q)r9Sx
zI8^`g<*vBA^0sCE7ao%*?yvr1qgV6UrXBcabLNh8Cl5M&YPZN7zOAs*GvsF62QP=U
z@%kDD4zFyi!#koE(eM}8nO)!ZcQ0EBo#uy@WklTL!a9v2(>~*lM^xuIU+n0yvo49c
z=k|>v`F7oQz5a>bKUsf$-rB+2k=`8q$hw!j_|*h~_kL05XiG~HZ5`vqaD72WSN<c9
zadnHEPny=w%{jgG=xZJSoi{ShzAiYtPAil*@aW!6sn4?(PH4P16462V^6cU0-g3iX
z!=yp2(0zkeKJIyAFLWN7owz)kYLHu#yxY`KJ_;F{8}%d#|NH<&-^*R)kyB>f`0eW@
zm0Qb0@3uS;gy%%0&KPx^IWR7>@d2e%om62sFS4(*GN8G0qn+Ql+SRkNo3td)?u%Sc
zm2cT?>kN-RmsgRd-zh6Ov|-WZ_llg@EkksfuibLrj>H%@#Z18Orl6kwXM2YhmCaLm
zVKU|i2smsm%YQ2Bqo>llH65gY?=Q@F0bBt>m=31exXFR<V*Yzl1nEsA0u4>colN4B
zi3UAYYukbZ3DiuQXb*Zqe}U^{F<{9Sm`-c!CK;x*|C<c@A!f1;nM~QXpe@ruYfqnn
zunzb>17Y%`u>^D`T|oblDbZM>FjEVJgDy1dpUIGH6a>0fAC>^&!SZ5r4K*|nY^I@x
zGoFT``I)i2*=s`hEQgSFj*Ji=29c>@M3Er}k%D~ve1Qr?kS~YpPYN>Bpo5MWeB8>P
zBzzmvK!`{LK86~inn6?+Xi#Jj2r{4PNwPP$oZ<wp3^lw30zVQ21qKG{24Z!2d@l%1
zBoZMM2Et%;0ELc!Fjqhi(&73q70H;A0-VL*v;Bk>4nioE?!gNX2<@LViplsP*)M?4
z5y@pTAQp$^3s%M-LhGW1c1}*f*Y5{0*I!pO8C?d?7Yd^L0YcPtLK;mxsjn|IWhJna
z$sl?1_`Y-jh3@CaVKYSa7zC;+GW2r@xJCFSBo+v_A4TLO6OLf=fx{MBN#fACUWOV$
zI!u-)J%A(7pop#9$dJ$_95!Y0K_pD5a#F!Gjf}}sZBmsf-AlaAe-w28(jj6N>i8~l
znil5IwfbMq?&rSwmzp0_nJ)9YDzGm}qT-V!EGj9&l2-?f(ZQk|F&GjCN5T-D9L>nk
zzsRO@gL;(h8T?<lr;+`Gd+OZ%cmC;w(<IPnBy%1kK)6Mz=9GW{Hj|{!LNjrm;25Cr
zIJ^!H&G676f;|8>0#OgIj|b<RjuK7jpS=GRO6B?s=v)Tt{~~l6uSn?Rf=oMpqJu5k
zaNuNv_yGL~5a7j+_yWSMp+=xEfPkl|Qv7=e7G3X51+ee23k1)}_D2}+{1KC#9F5NR
zp>jQW;I2sc$YP4F&cKzE%~a_B5puy+^+K|^pg{qbYYc%SpT)B0@dOBPw<qkW*0WiG
zEWRzD<;en(8nin=qB+~&k3$az3m^)#-$jd3iy4Tf9G=&-pewr8n6jB_?n(yNY*+#Y
zOTgl=MDT;B{O3DvkjMn|)NR&O8-vB6AqRE{3tS^%06M%U@5juYT|o<q!2A*xUSySv
zJ<IcFEDt)W(|8RVW2b!Q`IimRZLx?$=E*Jxk}cl4D*BwX9h+f~EZpB!lW-@&^n~px
zWlv;dh8^;t%tD!cs{2e&<kVMpe|_?Tg3S-=F84ZXf9GBo?&W3VN$t9AA9uHJp6}=w
z7lsP`WBXUXImfF8R{UA1_I36SdRwGy(7YD}ml&n1^FPuQ;cDDY*EN!nJ=ODW$Wpaz
zHG^doOz+Pbu~MthQOsOUQj78LY`#7ZS>&)W|I)fQb53H9BulA$9$8Lyzkk0!iStbB
zYQjM>V|e#gxXSa00u%LDW^m<b>G-S#Yb)lQw4K>y3s1F`YPOxBQV>fzZ)%7$UfPx=
zopAzOt;@@M&(OMLHcJpK`=nm#Y5k0{PB`=_OJS^10Y2Mw_DsZ_7?k8Kltd0{=1UYj
z1try_7^RvXON^@`ud2ipE-<RrG1@Tf`P^#Ax3WYrL3T-!{mq7G!IuBrt>7f_1wmlv
R$mr?o6EQNHnie*e{{v~^%?bbj

literal 0
HcmV?d00001

diff --git a/backend/compact-connect/lambdas/nodejs/README.md b/backend/compact-connect/lambdas/nodejs/README.md
index 32ad35c0b..2d27942eb 100644
--- a/backend/compact-connect/lambdas/nodejs/README.md
+++ b/backend/compact-connect/lambdas/nodejs/README.md
@@ -2,9 +2,37 @@
 
 This folder contains all lambda runtimes that are written with NodeJS/TypeScript. Because these lambdas are each bundled through CDK with ESBuild, we can pull common code and tests together, leaving only the entrypoints in a lambda-specific folder, leaving ESBuild to pull in only needed lib code.
 
-## Testing
 
-The code in this folder can be tested by running:
+## Prerequisites
+* **[Node](https://github.com/creationix/nvm#installation) `22.X`**
+* **[Yarn](https://yarnpkg.com/en/) `1.22.22`**
+    * `npm install --global yarn@1.22.22`
+
+_[back to top](#ingest-event-reporter-lambda)_
+
+---
+## Installing dependencies
+- `yarn install`
+
+## Bundling the runtime
+- `yarn build`
+
+_[back to top](#ingest-event-reporter-lambda)_
+
+---
+## Local development
+- **Linting**
+    - `yarn run lint`
+        - Lints all code in all the Lambda function
+- **Running an individual Lambda**
+    - The easiest way to execute the Lambda is to run the tests ([see below](#tests))
+        - Commenting out certain tests to limit the execution scope & repetition is trivial
+
+_[back to top](#ingest-event-reporter-lambda)_
+
+---
+## Testing
+This project uses `jest` and `aws-sdk-client-mock` for approachable unit testing. The code in this folder can be tested by running:
 - `yarn install`
 - `yarn test`
 
diff --git a/backend/compact-connect/lambdas/nodejs/email-notification-service/.gitignore b/backend/compact-connect/lambdas/nodejs/email-notification-service/.gitignore
new file mode 100644
index 000000000..a9db021f9
--- /dev/null
+++ b/backend/compact-connect/lambdas/nodejs/email-notification-service/.gitignore
@@ -0,0 +1,3 @@
+*.mjs
+*.js
+*.js.map
diff --git a/backend/compact-connect/lambdas/nodejs/email-notification-service/README.md b/backend/compact-connect/lambdas/nodejs/email-notification-service/README.md
new file mode 100644
index 000000000..2cf4eb646
--- /dev/null
+++ b/backend/compact-connect/lambdas/nodejs/email-notification-service/README.md
@@ -0,0 +1,33 @@
+# Email Notification Service Lambda
+
+This package contains code required to generate system emails for users in compact connect, as well as 
+compacts/jurisdictions staff. It leverages [EmailBuilderJS](https://github.com/usewaypoint/email-builder-js) to dynamically render email HTML content that should 
+be rendered consistently across email clients.
+
+The lambda is intended to be invoked directly, rather than through an API endpoint. It uses the following payload structure:
+```
+{
+  template: string;           // Name of the template to use (ie transactionBatchSettlementFailure)
+  recipientType: // must be one of the following
+    | 'COMPACT_OPERATIONS_TEAM'              // compactOperationsTeamEmails
+    | 'COMPACT_ADVERSE_ACTIONS'              // compactAdverseActionsNotificationEmails
+    | 'COMPACT_SUMMARY_REPORT'               // compactSummaryReportNotificationEmails
+    | 'JURISDICTION_OPERATIONS_TEAM'         // jurisdictionOperationsTeamEmails
+    | 'JURISDICTION_ADVERSE_ACTIONS'         // jurisdictionAdverseActionsNotificationEmails
+    | 'JURISDICTION_SUMMARY_REPORT'          // jurisdictionSummaryReportNotificationEmails
+    | 'SPECIFIC';                           // specificEmails provided in payload
+  compact: string;           // Compact identifier
+  jurisdiction?: string;     // Optional jurisdiction identifier, must be specified if sending to a Jurisdiction based email list
+  specificEmails?: string[]; // Optional list of specific email addresses to send the message to
+  templateVariables: {              // Template variables for hydration
+    [key: string]: any;
+  };
+}
+```
+
+This schema provides flexibility for adding new notification template types. Each template type corresponds to a 
+particular method in the `EmailServiceTemplater` class. The `recipientType` field is used to determine which email addresses to
+send the email to, and correspond to email lists defined in the compact/jurisdiction configurations used by the system.
+The `specificEmails` field is used to send the email to a specific list of email addresses, and is only used when 
+`recipientType` is set to `SPECIFIC`. The `templateVariables` field is used to hydrate the email template with dynamic content.
+if needed.
diff --git a/backend/compact-connect/lambdas/nodejs/email-notification-service/email-notification-service-lambda.ts b/backend/compact-connect/lambdas/nodejs/email-notification-service/email-notification-service-lambda.ts
new file mode 100644
index 000000000..58ff8a46d
--- /dev/null
+++ b/backend/compact-connect/lambdas/nodejs/email-notification-service/email-notification-service-lambda.ts
@@ -0,0 +1,76 @@
+import type { LambdaInterface } from '@aws-lambda-powertools/commons/lib/esm/types';
+import { Logger } from '@aws-lambda-powertools/logger';
+import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
+import { SESClient } from '@aws-sdk/client-ses';
+import { Context } from 'aws-lambda';
+
+import { EnvironmentVariablesService } from '../lib/environment-variables-service';
+import { CompactConfigurationClient } from '../lib/compact-configuration-client';
+import { EmailService } from '../lib/email-service';
+import { EmailNotificationEvent, EmailNotificationResponse } from '../lib/models/email-notification-service-event';
+
+const environmentVariables = new EnvironmentVariablesService();
+const logger = new Logger({ logLevel: environmentVariables.getLogLevel() });
+
+interface LambdaProperties {
+    dynamoDBClient: DynamoDBClient;
+    sesClient: SESClient;
+}
+
+export class Lambda implements LambdaInterface {
+    private readonly emailService: EmailService;
+
+    constructor(props: LambdaProperties) {
+        const compactConfigurationClient = new CompactConfigurationClient({
+            logger: logger,
+            dynamoDBClient: props.dynamoDBClient,
+        });
+
+        this.emailService = new EmailService({
+            logger: logger,
+            sesClient: props.sesClient,
+            compactConfigurationClient: compactConfigurationClient,
+        });
+    }
+
+    /**
+     * Lambda handler for email notification service
+     * 
+     * This handler sends an email notification based on the requested email template.
+     * See README in this directory for information on using this service.
+     *
+     * @param event - Email notification event
+     * @param context - Lambda context
+     * @returns Email notification response
+     */
+    @logger.injectLambdaContext({ resetKeys: true })
+    public async handler(event: EmailNotificationEvent, context: Context): Promise<EmailNotificationResponse> {
+        logger.info('Processing event', { event: event });
+
+        // Check if FROM_ADDRESS is configured
+        if (environmentVariables.getFromAddress() === 'NONE') {
+            logger.info('No from address configured for environment');
+            return {
+                message: 'No from address configured for environment, unable to send email'
+            };
+        }
+
+        switch (event.template) {
+        case 'transactionBatchSettlementFailure':
+            await this.emailService.sendTransactionBatchSettlementFailureEmail(
+                event.compact,
+                event.recipientType,
+                event.specificEmails
+            );
+            break;
+        default:
+            logger.info('Unsupported email template provided', { template: event.template });
+            throw new Error(`Unsupported email template: ${event.template}`);
+        }
+
+        logger.info('Completing handler');
+        return {
+            message: 'Email message sent'
+        };
+    }
+}
diff --git a/backend/compact-connect/lambdas/nodejs/email-notification-service/handler.ts b/backend/compact-connect/lambdas/nodejs/email-notification-service/handler.ts
new file mode 100644
index 000000000..7dd5d5ce3
--- /dev/null
+++ b/backend/compact-connect/lambdas/nodejs/email-notification-service/handler.ts
@@ -0,0 +1,11 @@
+import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
+import { SESClient } from '@aws-sdk/client-ses';
+import { Lambda } from './email-notification-service-lambda';
+
+
+const lambda = new Lambda({
+    dynamoDBClient: new DynamoDBClient(),
+    sesClient: new SESClient(),
+});
+
+export const sendEmail = lambda.handler.bind(lambda);
diff --git a/backend/compact-connect/lambdas/nodejs/ingest-event-reporter/README.md b/backend/compact-connect/lambdas/nodejs/ingest-event-reporter/README.md
index ac8e0fab6..a32e0d687 100644
--- a/backend/compact-connect/lambdas/nodejs/ingest-event-reporter/README.md
+++ b/backend/compact-connect/lambdas/nodejs/ingest-event-reporter/README.md
@@ -3,47 +3,3 @@
 This package contains code required to generate emailed reports for compacts/jurisdictions. It leverages
 [EmailBuilderJS](https://github.com/usewaypoint/email-builder-js) to dynamically render email
 HTML content that should be rendered consistently across email clients.
-
-## Table of Contents
-- **[Prerequisites](#prerequisites)**
-- **[Installing dependencies](#installing-dependencies)**
-- **[Bundling the runtime](#bundling-the-runtime)**
-- **[Local development](#local-development)**
-- **[Tests](#tests)**
-
----
-## Prerequisites
-* **[Node](https://github.com/creationix/nvm#installation) `22.X`**
-* **[Yarn](https://yarnpkg.com/en/) `1.22.22`**
-    * `npm install --global yarn@1.22.22`
-
-_[back to top](#ingest-event-reporter-lambda)_
-
----
-## Installing dependencies
-- `yarn install`
-
-## Bundling the runtime
-- `yarn build`
-
-_[back to top](#ingest-event-reporter-lambda)_
-
----
-## Local development
-- **Linting**
-    - `yarn run lint`
-        - Lints all code in all the Lambda function
-- **Running an individual Lambda**
-    - The easiest way to execute the Lambda is to run the tests ([see below](#tests))
-        - Commenting out certain tests to limit the execution scope & repetition is trivial
-
-_[back to top](#ingest-event-reporter-lambda)_
-
----
-## Tests
-This project uses `jest` and `aws-sdk-client-mock` for approachable unit testing. To run the included test:
-
-- `yarn test`
-
-This lambda module requires >90% code coverage and >90% code _branch_ coverage. Be sure that all contributions are
-covered with tests accordingly.
diff --git a/backend/compact-connect/lambdas/nodejs/ingest-event-reporter/handler.ts b/backend/compact-connect/lambdas/nodejs/ingest-event-reporter/handler.ts
index a2204d0b5..127204d13 100644
--- a/backend/compact-connect/lambdas/nodejs/ingest-event-reporter/handler.ts
+++ b/backend/compact-connect/lambdas/nodejs/ingest-event-reporter/handler.ts
@@ -1,6 +1,6 @@
 import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
 import { SESClient } from '@aws-sdk/client-ses';
-import { Lambda } from '../lib/lambda';
+import { Lambda } from './lambda';
 
 
 const lambda = new Lambda({
diff --git a/backend/compact-connect/lambdas/nodejs/lib/lambda.ts b/backend/compact-connect/lambdas/nodejs/ingest-event-reporter/lambda.ts
similarity index 85%
rename from backend/compact-connect/lambdas/nodejs/lib/lambda.ts
rename to backend/compact-connect/lambdas/nodejs/ingest-event-reporter/lambda.ts
index 4b5c43d22..52ebc0712 100644
--- a/backend/compact-connect/lambdas/nodejs/lib/lambda.ts
+++ b/backend/compact-connect/lambdas/nodejs/ingest-event-reporter/lambda.ts
@@ -4,11 +4,12 @@ import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
 import { SESClient } from '@aws-sdk/client-ses';
 import { Context } from 'aws-lambda';
 
-import { EnvironmentVariablesService } from './environment-variables-service';
-import { JurisdictionClient } from './jurisdiction-client';
-import { IEventBridgeEvent } from './models/event-bridge-event-detail';
-import { ReportEmailer } from './report-emailer';
-import { EventClient } from './event-client';
+import { EnvironmentVariablesService } from '../lib/environment-variables-service';
+import { CompactConfigurationClient } from '../lib/compact-configuration-client';
+import { JurisdictionClient } from '../lib/jurisdiction-client';
+import { IEventBridgeEvent } from '../lib/models/event-bridge-event-detail';
+import { EmailService } from '../lib/email-service';
+import { EventClient } from '../lib/event-client';
 
 const environmentVariables = new EnvironmentVariablesService();
 const logger = new Logger({ logLevel: environmentVariables.getLogLevel() });
@@ -25,20 +26,27 @@ interface LambdaProperties {
 export class Lambda implements LambdaInterface {
     private readonly jurisdictionClient: JurisdictionClient;
     private readonly eventClient: EventClient;
-    private readonly reportEmailer: ReportEmailer;
+    private readonly emailService: EmailService;
 
     constructor(props: LambdaProperties) {
         this.jurisdictionClient = new JurisdictionClient({
             logger: logger,
             dynamoDBClient: props.dynamoDBClient,
         });
+
+        const compactConfigurationClient = new CompactConfigurationClient({
+            logger: logger,
+            dynamoDBClient: props.dynamoDBClient,
+        });
+
         this.eventClient = new EventClient({
             logger: logger,
             dynamoDBClient: props.dynamoDBClient,
         });
-        this.reportEmailer = new ReportEmailer({
+        this.emailService = new EmailService({
             logger: logger,
             sesClient: props.sesClient,
+            compactConfigurationClient: compactConfigurationClient,
         });
     }
 
@@ -61,7 +69,7 @@ export class Lambda implements LambdaInterface {
 
                 // If there were any issues, send a report email summarizing them
                 if (ingestEvents.ingestFailures.length || ingestEvents.validationErrors.length) {
-                    const messageId = await this.reportEmailer.sendReportEmail(
+                    const messageId = await this.emailService.sendReportEmail(
                         ingestEvents,
                         compact,
                         jurisdictionConfig.jurisdictionName,
@@ -101,7 +109,7 @@ export class Lambda implements LambdaInterface {
                             && !weeklyIngestEvents.validationErrors.length
                             && weeklyIngestEvents.ingestSuccesses.length
                         ) {
-                            const messageId = await this.reportEmailer.sendAllsWellEmail(
+                            const messageId = await this.emailService.sendAllsWellEmail(
                                 compact,
                                 jurisdictionConfig.jurisdictionName,
                                 jurisdictionConfig.jurisdictionOperationsTeamEmails
@@ -117,7 +125,7 @@ export class Lambda implements LambdaInterface {
                             );
                         }
                         else if(!weeklyIngestEvents.ingestSuccesses.length) {
-                            const messageId = await this.reportEmailer.sendNoLicenseUpdatesEmail(
+                            const messageId = await this.emailService.sendNoLicenseUpdatesEmail(
                                 compact,
                                 jurisdictionConfig.jurisdictionName,
                                 jurisdictionConfig.jurisdictionOperationsTeamEmails
diff --git a/backend/compact-connect/lambdas/nodejs/lib/compact-configuration-client.ts b/backend/compact-connect/lambdas/nodejs/lib/compact-configuration-client.ts
new file mode 100644
index 000000000..586e2b083
--- /dev/null
+++ b/backend/compact-connect/lambdas/nodejs/lib/compact-configuration-client.ts
@@ -0,0 +1,42 @@
+import { Logger } from '@aws-lambda-powertools/logger';
+import { DynamoDBClient, GetItemCommand } from '@aws-sdk/client-dynamodb';
+import { unmarshall } from '@aws-sdk/util-dynamodb';
+import { EnvironmentVariablesService } from './environment-variables-service';
+import { Compact } from './models/compact';
+
+const environmentVariables = new EnvironmentVariablesService();
+
+interface CompactConfigurationClientProperties {
+    logger: Logger;
+    dynamoDBClient: DynamoDBClient;
+}
+
+export class CompactConfigurationClient {
+    private readonly logger: Logger;
+    private readonly dynamoDBClient: DynamoDBClient;
+
+    constructor(props: CompactConfigurationClientProperties) {
+        this.logger = props.logger;
+        this.dynamoDBClient = props.dynamoDBClient;
+    }
+
+    public async getCompactConfiguration(compact: string): Promise<Compact> {
+        this.logger.info('Getting compact configuration', { compact });
+
+        const command = new GetItemCommand({
+            TableName: environmentVariables.getCompactConfigurationTableName(),
+            Key: {
+                'pk': { S: `${compact}#CONFIGURATION` },
+                'sk': { S: `${compact}#CONFIGURATION` }
+            }
+        });
+
+        const response = await this.dynamoDBClient.send(command);
+
+        if (!response.Item) {
+            throw new Error(`No configuration found for compact: ${compact}`);
+        }
+
+        return unmarshall(response.Item) as Compact;
+    }
+}
diff --git a/backend/compact-connect/lambdas/nodejs/lib/report-emailer.ts b/backend/compact-connect/lambdas/nodejs/lib/email-service.ts
similarity index 78%
rename from backend/compact-connect/lambdas/nodejs/lib/report-emailer.ts
rename to backend/compact-connect/lambdas/nodejs/lib/email-service.ts
index 833d9d9b6..a3d9b4374 100644
--- a/backend/compact-connect/lambdas/nodejs/lib/report-emailer.ts
+++ b/backend/compact-connect/lambdas/nodejs/lib/email-service.ts
@@ -3,8 +3,11 @@ import * as crypto from 'crypto';
 import { Logger } from '@aws-lambda-powertools/logger';
 import { SendEmailCommand, SESClient } from '@aws-sdk/client-ses';
 import { renderToStaticMarkup, TReaderDocument } from '@usewaypoint/email-builder';
+import { CompactConfigurationClient } from './compact-configuration-client';
 import { EnvironmentVariablesService } from './environment-variables-service';
 import { IIngestFailureEventRecord, IValidationErrorEventRecord } from './models';
+import { RecipientType } from './models/email-notification-service-event';
+
 
 const environmentVariableService = new EnvironmentVariablesService();
 
@@ -13,9 +16,10 @@ interface IIngestEvents {
     validationErrors: IValidationErrorEventRecord[];
 }
 
-interface ReportEmailerProperties {
+interface EmailServiceProperties {
     logger: Logger;
     sesClient: SESClient;
+    compactConfigurationClient: CompactConfigurationClient;
 }
 
 const getEmailImageBaseUrl = () => {
@@ -27,9 +31,10 @@ const getEmailImageBaseUrl = () => {
  * Integrates with AWS SES to send emails and with EmailBuilderJS to render JS object templates into HTML
  * content that is expected to be consistently rendered across common email clients.
  */
-export class ReportEmailer {
+export class EmailService {
     private readonly logger: Logger;
     private readonly sesClient: SESClient;
+    private readonly compactConfigurationClient: CompactConfigurationClient;
     private readonly emailTemplate: TReaderDocument = {
         'root': {
             'type': 'EmailLayout',
@@ -43,9 +48,10 @@ export class ReportEmailer {
         }
     };
 
-    public constructor(props: ReportEmailerProperties) {
+    public constructor(props: EmailServiceProperties) {
         this.logger = props.logger;
         this.sesClient = props.sesClient;
+        this.compactConfigurationClient = props.compactConfigurationClient;
     }
 
     private async sendEmail({ htmlContent, subject, recipients, errorMessage }:
@@ -100,7 +106,7 @@ export class ReportEmailer {
         // Generate the HTML report
         const report = JSON.parse(JSON.stringify(this.emailTemplate));
 
-        this.insertHeader(report, compact, jurisdiction, 'License Data Summary');
+        this.insertHeaderWithJurisdiction(report, compact, jurisdiction, 'License Data Summary');
         this.insertNoErrorImage(report);
         this.insertSubHeading(report, 'There have been no license data errors this week!');
         this.insertFooter(report);
@@ -121,7 +127,7 @@ export class ReportEmailer {
         // Generate the HTML report
         const report = JSON.parse(JSON.stringify(this.emailTemplate));
 
-        this.insertHeader(report, compact, jurisdiction, 'License Data Summary');
+        this.insertHeaderWithJurisdiction(report, compact, jurisdiction, 'License Data Summary');
         this.insertClockImage(report);
         this.insertSubHeading(report, 'There have been no licenses uploaded in the last 7 days.');
         this.insertFooter(report);
@@ -139,7 +145,7 @@ export class ReportEmailer {
     public generateReport(events: IIngestEvents, compact: string, jurisdiction: string): string {
         const report = JSON.parse(JSON.stringify(this.emailTemplate));
 
-        this.insertHeader(
+        this.insertHeaderWithJurisdiction(
             report,
             compact,
             jurisdiction,
@@ -179,6 +185,51 @@ export class ReportEmailer {
         return validationErrors;
     }
 
+    private async getRecipients(compact: string, 
+        recipientType: RecipientType, 
+        specificEmails?: string[]
+    ): Promise<string[]> {
+        if (recipientType === 'SPECIFIC') {
+            if (specificEmails) return specificEmails;
+            
+            throw new Error(`SPECIFIC recipientType requested but no specific email addresses provided`);
+        }
+
+        const compactConfig = await this.compactConfigurationClient.getCompactConfiguration(compact);
+        
+        switch (recipientType) {
+        case 'COMPACT_OPERATIONS_TEAM':
+            return compactConfig.compactOperationsTeamEmails;
+        default:
+            throw new Error(`Unsupported recipient type for compact configuration: ${recipientType}`);
+        }
+    }
+
+    public async sendTransactionBatchSettlementFailureEmail(compact: string, 
+        recipientType: RecipientType, 
+        specificEmails?: string[]
+    ): Promise<void> {
+        const recipients = await this.getRecipients(compact, recipientType, specificEmails);
+        
+        if (recipients.length === 0) {
+            throw new Error(`No recipients found for compact ${compact} with recipient type ${recipientType}`);
+        }
+
+        const report = JSON.parse(JSON.stringify(this.emailTemplate));
+        const subject = `Transactions Failed to Settle for ${compact.toUpperCase()} Payment Processor`;
+        const bodyText = 'A transaction settlement error was detected within the payment processing account for the compact. ' +
+            'Please reach out to your payment processing representative to determine the cause. ' +
+            'Transactions made in the account will not be able to be settled until the issue is addressed.';
+
+        this.insertHeader(report, subject);
+        this.insertBody(report, bodyText);
+        this.insertFooter(report);
+
+        const htmlContent = renderToStaticMarkup(report, { rootBlockId: 'root' });
+        
+        await this.sendEmail({ htmlContent, subject, recipients, errorMessage: 'Unable to send transaction batch settlement failure email' });
+    }
+
     private insertIngestFailure(report: TReaderDocument, ingestFailure: IIngestFailureEventRecord) {
         const blockAId = `block-${crypto.randomUUID()}`;
 
@@ -482,7 +533,11 @@ export class ReportEmailer {
         report['root']['data']['childrenIds'].push(blockDivId);
     }
 
-    private insertHeader(report: TReaderDocument, compact: string, jurisdiction: string, heading: string) {
+    private insertHeaderWithJurisdiction(report: TReaderDocument, 
+        compact: string, 
+        jurisdiction: string, 
+        heading: string) {
+
         const blockLogoId = 'block-logo';
         const blockHeaderId = 'block-header';
         const blockJurisdictionId = 'block-jurisdiction';
@@ -667,4 +722,92 @@ export class ReportEmailer {
 
         report['root']['data']['childrenIds'].push(blockId);
     }
+
+    /**
+     * Adds a standard header block with Compact Connect logo to the report.
+     * 
+     * @param report The report object to insert the block into.
+     * @param heading The text to insert into the block.
+     */
+    private insertHeader(report: TReaderDocument, heading: string) {
+        const blockLogoId = 'block-logo';
+        const blockHeaderId = 'block-header';
+
+        report[blockLogoId] = {
+            'type': 'Image',
+            'data': {
+                'style': {
+                    'padding': {
+                        'top': 40,
+                        'bottom': 8,
+                        'right': 68,
+                        'left': 68
+                    },
+                    'backgroundColor': null,
+                    'textAlign': 'center'
+                },
+                'props': {
+                    'width': null,
+                    'height': 100,
+                    'url': `${getEmailImageBaseUrl()}/compact-connect-logo-final.png`,
+                    'alt': '',
+                    'linkHref': null,
+                    'contentAlignment': 'middle'
+                }
+            }
+        };
+
+        report[blockHeaderId] = {
+            'type': 'Heading',
+            'data': {
+                'props': {
+                    'text': heading,
+                    'level': 'h1'
+                },
+                'style': {
+                    'textAlign': 'center',
+                    'padding': {
+                        'top': 28,
+                        'bottom': 12,
+                        'right': 24,
+                        'left': 24
+                    }
+                }
+            }
+        };
+
+        report['root']['data']['childrenIds'].push(blockLogoId);
+        report['root']['data']['childrenIds'].push(blockHeaderId);
+    }
+
+    /**
+     * Inserts a body text block into the report.
+     * 
+     * @param report The report object to insert the block into.
+     * @param bodyText The text to insert into the block.
+     */
+    private insertBody(report: TReaderDocument, bodyText: string) {
+        const blockId = `block-body`;
+
+        report[blockId] = {
+            'type': 'Text',
+            'data': {
+                'style': {
+                    'fontSize': 16,
+                    'fontWeight': 'normal',
+                    'padding': {
+                        'top': 24,
+                        'bottom': 24,
+                        'right': 40,
+                        'left': 40
+                    }
+                },
+                'props': {
+                    'text': bodyText
+                }
+            }
+        };
+
+        report['root']['data']['childrenIds'].push(blockId);
+    }
 }
diff --git a/backend/compact-connect/lambdas/nodejs/lib/environment-variables-service.ts b/backend/compact-connect/lambdas/nodejs/lib/environment-variables-service.ts
index 3a50fd644..0dd1f58eb 100644
--- a/backend/compact-connect/lambdas/nodejs/lib/environment-variables-service.ts
+++ b/backend/compact-connect/lambdas/nodejs/lib/environment-variables-service.ts
@@ -19,7 +19,7 @@ export class EnvironmentVariablesService {
         return this.getEnvVar(this.uiBasePathUrlVariable);
     }
 
-    public getCompactconfigurationTableName() {
+    public getCompactConfigurationTableName() {
         return this.getEnvVar(this.compactConfigurationTableNameVariable);
     }
 
diff --git a/backend/compact-connect/lambdas/nodejs/lib/jurisdiction-client.ts b/backend/compact-connect/lambdas/nodejs/lib/jurisdiction-client.ts
index 41cc06a88..34614cf2d 100644
--- a/backend/compact-connect/lambdas/nodejs/lib/jurisdiction-client.ts
+++ b/backend/compact-connect/lambdas/nodejs/lib/jurisdiction-client.ts
@@ -31,7 +31,7 @@ export class JurisdictionClient {
         compactAbbr: string
     ): Promise<IJurisdiction[]> {
         const resp = await this.dynamoDBClient.send(new QueryCommand({
-            TableName: environmentVariables.getCompactconfigurationTableName(),
+            TableName: environmentVariables.getCompactConfigurationTableName(),
             Select: 'ALL_ATTRIBUTES',
             KeyConditionExpression: 'pk = :pk and begins_with (sk, :sk)',
             ExpressionAttributeValues: {
diff --git a/backend/compact-connect/lambdas/nodejs/lib/models/compact.ts b/backend/compact-connect/lambdas/nodejs/lib/models/compact.ts
new file mode 100644
index 000000000..cddd44ec7
--- /dev/null
+++ b/backend/compact-connect/lambdas/nodejs/lib/models/compact.ts
@@ -0,0 +1,16 @@
+export interface CompactCommissionFee {
+    feeAmount: number;
+    feeType: string;
+}
+
+export interface Compact {
+    pk: string;
+    sk: string;
+    compactAdverseActionsNotificationEmails: string[];
+    compactCommissionFee: CompactCommissionFee;
+    compactName: string;
+    compactOperationsTeamEmails: string[];
+    compactSummaryReportNotificationEmails: string[];
+    dateOfUpdate: string;
+    type: string;
+}
diff --git a/backend/compact-connect/lambdas/nodejs/lib/models/email-notification-service-event.ts b/backend/compact-connect/lambdas/nodejs/lib/models/email-notification-service-event.ts
new file mode 100644
index 000000000..3352861b3
--- /dev/null
+++ b/backend/compact-connect/lambdas/nodejs/lib/models/email-notification-service-event.ts
@@ -0,0 +1,23 @@
+export type RecipientType =
+    | 'COMPACT_OPERATIONS_TEAM'
+    | 'COMPACT_ADVERSE_ACTIONS'
+    | 'COMPACT_SUMMARY_REPORT'
+    | 'JURISDICTION_OPERATIONS_TEAM'
+    | 'JURISDICTION_ADVERSE_ACTIONS'
+    | 'JURISDICTION_SUMMARY_REPORT'
+    | 'SPECIFIC';
+
+export interface EmailNotificationEvent {
+    template: string;
+    recipientType: RecipientType;
+    compact: string;
+    jurisdiction?: string;
+    specificEmails?: string[];
+    templateVariables: {
+        [key: string]: any;
+    };
+}
+
+export interface EmailNotificationResponse {
+    message: string;
+}
diff --git a/backend/compact-connect/lambdas/nodejs/tests/compact-configuration-client.test.ts b/backend/compact-connect/lambdas/nodejs/tests/compact-configuration-client.test.ts
new file mode 100644
index 000000000..171545efe
--- /dev/null
+++ b/backend/compact-connect/lambdas/nodejs/tests/compact-configuration-client.test.ts
@@ -0,0 +1,98 @@
+import { mockClient } from 'aws-sdk-client-mock';
+import 'aws-sdk-client-mock-jest';
+import { Logger } from '@aws-lambda-powertools/logger';
+import { DynamoDBClient, GetItemCommand } from '@aws-sdk/client-dynamodb';
+import { CompactConfigurationClient } from '../lib/compact-configuration-client';
+
+const SAMPLE_COMPACT_CONFIGURATION = {
+    'pk': { S: 'aslp#CONFIGURATION' },
+    'sk': { S: 'aslp#CONFIGURATION' },
+    'compactAdverseActionsNotificationEmails': { L: [{ S: 'adverse@example.com' }]},
+    'compactCommissionFee': {
+        M: {
+            'feeAmount': { N: '3.5' },
+            'feeType': { S: 'FLAT_RATE' }
+        }
+    },
+    'compactName': { S: 'aslp' },
+    'compactOperationsTeamEmails': { L: [{ S: 'operations@example.com' }]},
+    'compactSummaryReportNotificationEmails': { L: [{ S: 'summary@example.com' }]},
+    'dateOfUpdate': { S: '2024-12-10T19:27:28+00:00' },
+    'type': { S: 'compact' }
+};
+
+/*
+ * Double casting to allow us to pass a mock in for the real thing
+ */
+const asDynamoDBClient = (mock: ReturnType<typeof mockClient>) =>
+    mock as unknown as DynamoDBClient;
+
+describe('CompactConfigurationClient', () => {
+    let compactConfigurationClient: CompactConfigurationClient;
+    let mockDynamoDBClient: ReturnType<typeof mockClient>;
+
+    beforeAll(async () => {
+        process.env.DEBUG = 'true';
+        process.env.COMPACT_CONFIGURATION_TABLE_NAME = 'compact-table';
+        process.env.AWS_REGION = 'us-east-1';
+    });
+
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockDynamoDBClient = mockClient(DynamoDBClient);
+    });
+
+    it('should return compact configuration from DynamoDB', async () => {
+        mockDynamoDBClient.on(GetItemCommand).resolves({
+            Item: SAMPLE_COMPACT_CONFIGURATION
+        });
+
+        compactConfigurationClient = new CompactConfigurationClient({
+            logger: new Logger(),
+            dynamoDBClient: asDynamoDBClient(mockDynamoDBClient)
+        });
+
+        const config = await compactConfigurationClient.getCompactConfiguration('aslp');
+
+        expect(mockDynamoDBClient).toHaveReceivedCommandWith(
+            GetItemCommand,
+            {
+                TableName: 'compact-table',
+                Key: {
+                    'pk': { S: 'aslp#CONFIGURATION' },
+                    'sk': { S: 'aslp#CONFIGURATION' }
+                }
+            }
+        );
+
+        expect(config).toEqual({
+            pk: 'aslp#CONFIGURATION',
+            sk: 'aslp#CONFIGURATION',
+            compactAdverseActionsNotificationEmails: ['adverse@example.com'],
+            compactCommissionFee: {
+                feeAmount: 3.5,
+                feeType: 'FLAT_RATE'
+            },
+            compactName: 'aslp',
+            compactOperationsTeamEmails: ['operations@example.com'],
+            compactSummaryReportNotificationEmails: ['summary@example.com'],
+            dateOfUpdate: '2024-12-10T19:27:28+00:00',
+            type: 'compact'
+        });
+    });
+
+    it('should throw error when no configuration found', async () => {
+        mockDynamoDBClient.on(GetItemCommand).resolves({
+            Item: undefined
+        });
+
+        compactConfigurationClient = new CompactConfigurationClient({
+            logger: new Logger(),
+            dynamoDBClient: asDynamoDBClient(mockDynamoDBClient)
+        });
+
+        await expect(compactConfigurationClient.getCompactConfiguration('invalid'))
+            .rejects
+            .toThrow('No configuration found for compact: invalid');
+    });
+});
diff --git a/backend/compact-connect/lambdas/nodejs/tests/email-notification-service-lambda.test.ts b/backend/compact-connect/lambdas/nodejs/tests/email-notification-service-lambda.test.ts
new file mode 100644
index 000000000..bcc5061a4
--- /dev/null
+++ b/backend/compact-connect/lambdas/nodejs/tests/email-notification-service-lambda.test.ts
@@ -0,0 +1,141 @@
+import { mockClient } from 'aws-sdk-client-mock';
+import 'aws-sdk-client-mock-jest';
+import { DynamoDBClient, GetItemCommand } from '@aws-sdk/client-dynamodb';
+import { SESClient, SendEmailCommand } from '@aws-sdk/client-ses';
+import { Lambda } from '../email-notification-service/email-notification-service-lambda';
+import { EmailNotificationEvent } from '../lib/models/email-notification-service-event';
+
+const SAMPLE_EVENT: EmailNotificationEvent = {
+    template: 'transactionBatchSettlementFailure',
+    recipientType: 'COMPACT_OPERATIONS_TEAM',
+    compact: 'aslp',
+    templateVariables: {}
+};
+
+const SAMPLE_COMPACT_CONFIGURATION = {
+    'pk': { S: 'aslp#CONFIGURATION' },
+    'sk': { S: 'aslp#CONFIGURATION' },
+    'compactAdverseActionsNotificationEmails': { L: [{ S: 'adverse@example.com' }]},
+    'compactCommissionFee': {
+        M: {
+            'feeAmount': { N: '3.5' },
+            'feeType': { S: 'FLAT_RATE' }
+        }
+    },
+    'compactName': { S: 'aslp' },
+    'compactOperationsTeamEmails': { L: [{ S: 'operations@example.com' }]},
+    'compactSummaryReportNotificationEmails': { L: [{ S: 'summary@example.com' }]},
+    'dateOfUpdate': { S: '2024-12-10T19:27:28+00:00' },
+    'type': { S: 'compact' }
+};
+
+/*
+ * Double casting to allow us to pass a mock in for the real thing
+ */
+const asDynamoDBClient = (mock: ReturnType<typeof mockClient>) =>
+    mock as unknown as DynamoDBClient;
+
+const asSESClient = (mock: ReturnType<typeof mockClient>) =>
+    mock as unknown as SESClient;
+
+describe('EmailNotificationServiceLambda', () => {
+    let lambda: Lambda;
+    let mockDynamoDBClient: ReturnType<typeof mockClient>;
+    let mockSESClient: ReturnType<typeof mockClient>;
+
+    beforeAll(async () => {
+        process.env.DEBUG = 'true';
+        process.env.COMPACT_CONFIGURATION_TABLE_NAME = 'compact-table';
+        process.env.AWS_REGION = 'us-east-1';
+    });
+
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockDynamoDBClient = mockClient(DynamoDBClient);
+        mockSESClient = mockClient(SESClient);
+
+        // Reset environment variables
+        process.env.FROM_ADDRESS = 'noreply@example.org';
+        process.env.UI_BASE_PATH_URL = 'https://app.test.compactconnect.org';
+
+        // Set up default successful responses
+        mockDynamoDBClient.on(GetItemCommand).resolves({
+            Item: SAMPLE_COMPACT_CONFIGURATION
+        });
+
+        mockSESClient.on(SendEmailCommand).resolves({
+            MessageId: 'message-id-123'
+        });
+
+        lambda = new Lambda({
+            dynamoDBClient: asDynamoDBClient(mockDynamoDBClient),
+            sesClient: asSESClient(mockSESClient)
+        });
+    });
+
+    it('should return early when FROM_ADDRESS is NONE', async () => {
+        process.env.FROM_ADDRESS = 'NONE';
+
+        const response = await lambda.handler(SAMPLE_EVENT, {} as any);
+
+        expect(response).toEqual({
+            message: 'No from address configured for environment, unable to send email'
+        });
+
+        // Verify no calls were made to DynamoDB or SES
+        expect(mockDynamoDBClient).not.toHaveReceivedAnyCommand();
+        expect(mockSESClient).not.toHaveReceivedAnyCommand();
+    });
+
+    it('should successfully send transaction batch settlement failure email', async () => {
+        const response = await lambda.handler(SAMPLE_EVENT, {} as any);
+
+        expect(response).toEqual({
+            message: 'Email message sent'
+        });
+
+        // Verify DynamoDB was queried for compact configuration
+        expect(mockDynamoDBClient).toHaveReceivedCommandWith(GetItemCommand, {
+            TableName: 'compact-table',
+            Key: {
+                'pk': { S: 'aslp#CONFIGURATION' },
+                'sk': { S: 'aslp#CONFIGURATION' }
+            }
+        });
+
+        // Verify email was sent with correct parameters
+        expect(mockSESClient).toHaveReceivedCommandWith(SendEmailCommand, {
+            Destination: {
+                ToAddresses: ['operations@example.com']
+            },
+            Message: {
+                Body: {
+                    Html: {
+                        Charset: 'UTF-8',
+                        Data: expect.stringContaining('A transaction settlement error was detected')
+                    }
+                },
+                Subject: {
+                    Charset: 'UTF-8',
+                    Data: 'Transactions Failed to Settle for ASLP Payment Processor'
+                }
+            },
+            Source: 'Compact Connect <noreply@example.org>'
+        });
+    });
+
+    it('should throw error for unsupported template', async () => {
+        const event: EmailNotificationEvent = {
+            ...SAMPLE_EVENT,
+            template: 'unsupportedTemplate'
+        };
+
+        await expect(lambda.handler(event, {} as any))
+            .rejects
+            .toThrow('Unsupported email template: unsupportedTemplate');
+
+        // Verify no AWS calls were made
+        expect(mockDynamoDBClient).not.toHaveReceivedAnyCommand();
+        expect(mockSESClient).not.toHaveReceivedAnyCommand();
+    });
+});
diff --git a/backend/compact-connect/lambdas/nodejs/tests/email-service.test.ts b/backend/compact-connect/lambdas/nodejs/tests/email-service.test.ts
new file mode 100644
index 000000000..e02bbf15b
--- /dev/null
+++ b/backend/compact-connect/lambdas/nodejs/tests/email-service.test.ts
@@ -0,0 +1,300 @@
+import { mockClient } from 'aws-sdk-client-mock';
+import 'aws-sdk-client-mock-jest';
+import { Logger } from '@aws-lambda-powertools/logger';
+import { SendEmailCommand, SESClient } from '@aws-sdk/client-ses';
+import { IValidationErrorEventRecord } from '../lib/models';
+import { EmailService } from '../lib/email-service';
+import { CompactConfigurationClient } from '../lib/compact-configuration-client';
+import {
+    SAMPLE_SORTABLE_VALIDATION_ERROR_RECORDS,
+    SAMPLE_UNMARSHALLED_INGEST_FAILURE_ERROR_RECORD,
+    SAMPLE_UNMARSHALLED_VALIDATION_ERROR_RECORD
+} from './sample-records';
+
+const SAMPLE_COMPACT_CONFIG = {
+    pk: 'aslp#CONFIGURATION',
+    sk: 'aslp#CONFIGURATION',
+    compactAdverseActionsNotificationEmails: ['adverse@example.com'],
+    compactCommissionFee: {
+        feeAmount: 3.5,
+        feeType: 'FLAT_RATE'
+    },
+    compactName: 'aslp',
+    compactOperationsTeamEmails: ['operations@example.com'],
+    compactSummaryReportNotificationEmails: ['summary@example.com'],
+    dateOfUpdate: '2024-12-10T19:27:28+00:00',
+    type: 'compact'
+};
+
+/*
+ * Double casting to allow us to pass a mock in for the real thing
+ */
+const asSESClient = (mock: ReturnType<typeof mockClient>) =>
+    mock as unknown as SESClient;
+
+describe('Email Service', () => {
+    let mockSESClient: ReturnType<typeof mockClient>;
+    let mockCompactConfigurationClient: jest.Mocked<CompactConfigurationClient>;
+    let emailService: EmailService;
+
+    beforeAll(async () => {
+        process.env.DEBUG = 'true';
+        process.env.FROM_ADDRESS = 'noreply@example.org';
+        process.env.UI_BASE_PATH_URL = 'https://app.test.compactconnect.org';
+    });
+
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockSESClient = mockClient(SESClient);
+        mockCompactConfigurationClient = {
+            getCompactConfiguration: jest.fn(),
+        } as unknown as jest.Mocked<CompactConfigurationClient>;
+
+        mockSESClient.on(SendEmailCommand).resolves({
+            MessageId: 'message-id-123'
+        });
+
+        emailService = new EmailService({
+            logger: new Logger(),
+            sesClient: asSESClient(mockSESClient),
+            compactConfigurationClient: mockCompactConfigurationClient
+        });
+    });
+
+    it('should render an html document', async () => {
+        const template = emailService.generateReport(
+            {
+                ingestFailures: [ SAMPLE_UNMARSHALLED_INGEST_FAILURE_ERROR_RECORD ],
+                validationErrors: [ SAMPLE_UNMARSHALLED_VALIDATION_ERROR_RECORD ]
+            },
+            'aslp',
+            'ohio'
+        );
+
+        // Any HTML document would start with a '<' and end with a '>'
+        expect(template.charAt(0)).toBe('<');
+        expect(template.charAt(template.length - 1)).toBe('>');
+    });
+
+    it('should send a report email', async () => {
+        const messageId = await emailService.sendReportEmail(
+            {
+                ingestFailures: [ SAMPLE_UNMARSHALLED_INGEST_FAILURE_ERROR_RECORD ],
+                validationErrors: [ SAMPLE_UNMARSHALLED_VALIDATION_ERROR_RECORD ]
+            },
+            'aslp',
+            'ohio',
+            [
+                'operations@example.com'
+            ]
+        );
+
+        expect(messageId).toEqual('message-id-123');
+        expect(mockSESClient).toHaveReceivedCommandWith(
+            SendEmailCommand,
+            {
+                Destination: {
+                    ToAddresses: ['operations@example.com']
+                },
+                Message: {
+                    Body: {
+                        Html: {
+                            Charset: 'UTF-8',
+                            Data: expect.stringContaining('<!DOCTYPE html>')
+                        }
+                    },
+                    Subject: {
+                        Charset: 'UTF-8',
+                        Data: 'License Data Error Summary: aslp / ohio'
+                    }
+                },
+                Source: 'Compact Connect <noreply@example.org>'
+            }
+        );
+    });
+
+    it('should sort validation errors by record number then time', async () => {
+        const sorted = emailService['sortValidationErrors'](
+            SAMPLE_SORTABLE_VALIDATION_ERROR_RECORDS
+        );
+
+        const flattenedErrors: string[] = sorted.flatMap((record) => record.errors.dateOfRenewal);
+
+        expect(flattenedErrors).toEqual([
+            'Row 4, 5:47',
+            'Row 5, 4:47',
+            'Row 5, 5:47'
+        ]);
+    });
+
+    it('should send an alls well email', async () => {
+        const messageId = await emailService.sendAllsWellEmail(
+            'aslp',
+            'ohio',
+            [ 'operations@example.com' ]
+        );
+
+        expect(messageId).toEqual('message-id-123');
+        expect(mockSESClient).toHaveReceivedCommandWith(
+            SendEmailCommand,
+            {
+                Destination: {
+                    ToAddresses: ['operations@example.com']
+                },
+                Message: {
+                    Body: {
+                        Html: {
+                            Charset: 'UTF-8',
+                            Data: expect.stringContaining('<!DOCTYPE html>')
+                        }
+                    },
+                    Subject: {
+                        Charset: 'UTF-8',
+                        Data: 'License Data Summary: aslp / ohio'
+                    }
+                },
+                Source: 'Compact Connect <noreply@example.org>'
+            }
+        );
+    });
+
+    it('should send a "no license updates" email with expected image url', async () => {
+        const messageId = await emailService.sendNoLicenseUpdatesEmail(
+            'aslp',
+            'ohio',
+            [ 'operations@example.com' ]
+        );
+
+        expect(messageId).toEqual('message-id-123');
+        expect(mockSESClient).toHaveReceivedCommandWith(
+            SendEmailCommand,
+            {
+                Destination: {
+                    ToAddresses: ['operations@example.com']
+                },
+                Message: {
+                    Body: {
+                        Html: {
+                            Charset: 'UTF-8',
+                            Data: expect.stringContaining('src=\"https://app.test.compactconnect.org/img/email/ico-noupdates@2x.png\"')
+                        }
+                    },
+                    Subject: {
+                        Charset: 'UTF-8',
+                        Data: 'No License Updates for Last 7 Days: aslp / ohio'
+                    }
+                },
+                Source: 'Compact Connect <noreply@example.org>'
+            }
+        );
+    });
+
+    describe('Transaction Batch Settlement Failure', () => {
+        it('should send email using compact operations team emails', async () => {
+            mockCompactConfigurationClient.getCompactConfiguration.mockResolvedValue(SAMPLE_COMPACT_CONFIG);
+
+            await emailService.sendTransactionBatchSettlementFailureEmail(
+                'aslp',
+                'COMPACT_OPERATIONS_TEAM'
+            );
+
+            expect(mockSESClient).toHaveReceivedCommandWith(
+                SendEmailCommand,
+                {
+                    Destination: {
+                        ToAddresses: ['operations@example.com']
+                    },
+                    Message: {
+                        Body: {
+                            Html: {
+                                Charset: 'UTF-8',
+                                Data: expect.stringContaining('<!DOCTYPE html>')
+                            }
+                        },
+                        Subject: {
+                            Charset: 'UTF-8',
+                            Data: 'Transactions Failed to Settle for ASLP Payment Processor'
+                        }
+                    },
+                    Source: 'Compact Connect <noreply@example.org>'
+                }
+            );
+        });
+
+        it('should send email using specific emails', async () => {
+            await emailService.sendTransactionBatchSettlementFailureEmail(
+                'aslp',
+                'SPECIFIC',
+                ['specific@example.com']
+            );
+
+            expect(mockSESClient).toHaveReceivedCommandWith(
+                SendEmailCommand,
+                {
+                    Destination: {
+                        ToAddresses: ['specific@example.com']
+                    },
+                    Message: expect.any(Object),
+                    Source: 'Compact Connect <noreply@example.org>'
+                }
+            );
+        });
+
+        it('should throw error when no recipients found', async () => {
+            mockCompactConfigurationClient.getCompactConfiguration.mockResolvedValue({
+                ...SAMPLE_COMPACT_CONFIG,
+                compactOperationsTeamEmails: []
+            });
+
+            await expect(emailService.sendTransactionBatchSettlementFailureEmail(
+                'aslp',
+                'COMPACT_OPERATIONS_TEAM'
+            )).rejects.toThrow('No recipients found for compact aslp with recipient type COMPACT_OPERATIONS_TEAM');
+        });
+
+        it('should throw error for specific recipient type without emails', async () => {
+            await expect(emailService.sendTransactionBatchSettlementFailureEmail(
+                'aslp',
+                'SPECIFIC'
+            )).rejects.toThrow('SPECIFIC recipientType requested but no specific email addresses provided');
+        });
+
+        it('should throw error for unsupported recipient type', async () => {
+            await expect(emailService.sendTransactionBatchSettlementFailureEmail(
+                'aslp',
+                'JURISDICTION_OPERATIONS_TEAM'
+            )).rejects.toThrow('Unsupported recipient type for compact configuration: JURISDICTION_OPERATIONS_TEAM');
+        });
+
+        it('should include logo in email', async () => {
+            mockCompactConfigurationClient.getCompactConfiguration.mockResolvedValue(SAMPLE_COMPACT_CONFIG);
+
+            await emailService.sendTransactionBatchSettlementFailureEmail(
+                'aslp',
+                'COMPACT_OPERATIONS_TEAM'
+            );
+
+            expect(mockSESClient).toHaveReceivedCommandWith(
+                SendEmailCommand,
+                {
+                    Destination: {
+                        ToAddresses: ['operations@example.com']
+                    },
+                    Message: {
+                        Body: {
+                            Html: {
+                                Charset: 'UTF-8',
+                                Data: expect.stringContaining('src=\"https://app.test.compactconnect.org/img/email/compact-connect-logo-final.png\"')
+                            }
+                        },
+                        Subject: {
+                            Charset: 'UTF-8',
+                            Data: 'Transactions Failed to Settle for ASLP Payment Processor'
+                        }
+                    },
+                    Source: 'Compact Connect <noreply@example.org>'
+                }
+            );
+        });
+    });
+});
diff --git a/backend/compact-connect/lambdas/nodejs/tests/lambda.test.ts b/backend/compact-connect/lambdas/nodejs/tests/lambda.test.ts
index 3cb802097..1353b3cdc 100644
--- a/backend/compact-connect/lambdas/nodejs/tests/lambda.test.ts
+++ b/backend/compact-connect/lambdas/nodejs/tests/lambda.test.ts
@@ -4,8 +4,8 @@ import { Context, EventBridgeEvent } from 'aws-lambda';
 import { DynamoDBClient, QueryCommand } from '@aws-sdk/client-dynamodb';
 import { SendEmailCommand, SESClient } from '@aws-sdk/client-ses';
 
-import { Lambda } from '../lib/lambda';
-import { ReportEmailer } from '../lib/report-emailer';
+import { Lambda } from '../ingest-event-reporter/lambda';
+import { EmailService } from '../lib/email-service';
 import { IEventBridgeEvent } from '../lib/models/event-bridge-event-detail';
 import {
     SAMPLE_INGEST_FAILURE_ERROR_RECORD,
@@ -49,7 +49,7 @@ const asSESClient = (mock: ReturnType<typeof mockClient>) =>
     mock as unknown as SESClient;
 
 
-jest.mock('../lib/report-emailer');
+jest.mock('../lib/email-service');
 
 const mockSendReportEmail = jest.fn(
     (events, recipients: string[]) => Promise.resolve('message-id-123')
@@ -62,7 +62,7 @@ const mockSendNoLicenseUpdatesEmail = jest.fn(
     (recipients: string[]) => Promise.resolve('message-id-no-license-updates')
 );
 
-(ReportEmailer as jest.Mock) = jest.fn().mockImplementation(() => ({
+(EmailService as jest.Mock) = jest.fn().mockImplementation(() => ({
     sendReportEmail: mockSendReportEmail,
     sendAllsWellEmail: mockSendAllsWellEmail,
     sendNoLicenseUpdatesEmail: mockSendNoLicenseUpdatesEmail
@@ -71,7 +71,7 @@ const mockSendNoLicenseUpdatesEmail = jest.fn(
 
 describe('Nightly runs', () => {
     let mockSESClient: ReturnType<typeof mockClient>;
-    let mockReportEmailer: jest.Mocked<ReportEmailer>;
+    let mockEmailService: jest.Mocked<EmailService>;
     let lambda: Lambda;
 
     beforeAll(async () => {
diff --git a/backend/compact-connect/lambdas/nodejs/tests/report-emailer.test.ts b/backend/compact-connect/lambdas/nodejs/tests/report-emailer.test.ts
deleted file mode 100644
index 89a9bc6ea..000000000
--- a/backend/compact-connect/lambdas/nodejs/tests/report-emailer.test.ts
+++ /dev/null
@@ -1,201 +0,0 @@
-import { mockClient } from 'aws-sdk-client-mock';
-import 'aws-sdk-client-mock-jest';
-import { Logger } from '@aws-lambda-powertools/logger';
-import { SendEmailCommand, SESClient } from '@aws-sdk/client-ses';
-import { IValidationErrorEventRecord } from '../lib/models';
-import { ReportEmailer } from '../lib/report-emailer';
-import {
-    SAMPLE_SORTABLE_VALIDATION_ERROR_RECORDS,
-    SAMPLE_UNMARSHALLED_INGEST_FAILURE_ERROR_RECORD,
-    SAMPLE_UNMARSHALLED_VALIDATION_ERROR_RECORD
-} from './sample-records';
-
-/*
- * Double casting to allow us to pass a mock in for the real thing
- */
-const asSESClient = (mock: ReturnType<typeof mockClient>) =>
-    mock as unknown as SESClient;
-
-
-describe('Report emailer', () => {
-    let mockSESClient: ReturnType<typeof mockClient>;
-
-    beforeAll(async () => {
-        process.env.DEBUG = 'true';
-        process.env.FROM_ADDRESS = 'noreply@example.org';
-        process.env.UI_BASE_PATH_URL = 'https://app.test.compactconnect.org';
-
-        mockSESClient = mockClient(SESClient);
-
-        mockSESClient.on(SendEmailCommand).resolves({
-            MessageId: 'message-id-123'
-        });
-
-    });
-
-    it('should render an html document', async () => {
-        const logger = new Logger();
-        const reportEmailer = new ReportEmailer({
-            logger: logger,
-            sesClient: asSESClient(mockSESClient)
-        });
-        const template = reportEmailer.generateReport(
-            {
-                ingestFailures: [ SAMPLE_UNMARSHALLED_INGEST_FAILURE_ERROR_RECORD ],
-                validationErrors: [ SAMPLE_UNMARSHALLED_VALIDATION_ERROR_RECORD ]
-            },
-            'aslp',
-            'ohio'
-        );
-
-        // Any HTML document would start with a '<' and end with a '>'
-        expect(template.charAt(0)).toBe('<');
-        expect(template.charAt(template.length - 1)).toBe('>');
-    });
-
-
-    it('should send a report email', async () => {
-        const logger = new Logger();
-        const sesClient = new SESClient();
-        const reportEmailer = new ReportEmailer({
-            logger: logger,
-            sesClient: sesClient
-        });
-        const messageId = await reportEmailer.sendReportEmail(
-            {
-                ingestFailures: [ SAMPLE_UNMARSHALLED_INGEST_FAILURE_ERROR_RECORD ],
-                validationErrors: [ SAMPLE_UNMARSHALLED_VALIDATION_ERROR_RECORD ]
-            },
-            'aslp',
-            'ohio',
-            [
-                'operations@example.com'
-            ]
-        );
-
-        expect(messageId).toEqual('message-id-123');
-        expect(mockSESClient).toHaveReceivedCommandWith(
-            SendEmailCommand,
-            {
-                Destination: {
-                    ToAddresses: ['operations@example.com']
-                },
-                Message: {
-                    Body: {
-                        Html: {
-                            Charset: 'UTF-8',
-                            Data: expect.stringContaining('<!DOCTYPE html>')
-                        }
-                    },
-                    Subject: {
-                        Charset: 'UTF-8',
-                        Data: 'License Data Error Summary: aslp / ohio'
-                    }
-                },
-                Source: 'Compact Connect <noreply@example.org>'
-            }
-        );
-    });
-
-    it('should sort validation errors by record number then time', async () => {
-        const logger = new Logger();
-        const sesClient = new SESClient();
-
-        class TestableReportEmailer extends ReportEmailer {
-            public testSortValidationErrors(validationErrors: IValidationErrorEventRecord[]) {
-                return this.sortValidationErrors(validationErrors);
-            }
-        }
-
-        const reportEmailer = new TestableReportEmailer({
-            logger: logger,
-            sesClient: sesClient
-        });
-
-        const sorted = reportEmailer.testSortValidationErrors(
-            SAMPLE_SORTABLE_VALIDATION_ERROR_RECORDS
-        );
-
-        const flattenedErrors: string[] = sorted.flatMap((record) => record.errors.dateOfRenewal);
-
-        expect(flattenedErrors).toEqual([
-            'Row 4, 5:47',
-            'Row 5, 4:47',
-            'Row 5, 5:47'
-        ]);
-    });
-
-    it('should send an alls well email', async () => {
-        const logger = new Logger();
-        const sesClient = new SESClient();
-        const reportEmailer = new ReportEmailer({
-            logger: logger,
-            sesClient: sesClient
-        });
-        const messageId = await reportEmailer.sendAllsWellEmail(
-            'aslp',
-            'ohio',
-            [ 'operations@example.com' ]
-        );
-
-        expect(messageId).toEqual('message-id-123');
-        expect(mockSESClient).toHaveReceivedCommandWith(
-            SendEmailCommand,
-            {
-                Destination: {
-                    ToAddresses: ['operations@example.com']
-                },
-                Message: {
-                    Body: {
-                        Html: {
-                            Charset: 'UTF-8',
-                            Data: expect.stringContaining('<!DOCTYPE html>')
-                        }
-                    },
-                    Subject: {
-                        Charset: 'UTF-8',
-                        Data: 'License Data Summary: aslp / ohio'
-                    }
-                },
-                Source: 'Compact Connect <noreply@example.org>'
-            }
-        );
-    });
-
-    it('should send a "no license updates" email with expected image url', async () => {
-        const logger = new Logger();
-        const sesClient = new SESClient();
-        const reportEmailer = new ReportEmailer({
-            logger: logger,
-            sesClient: sesClient
-        });
-        const messageId = await reportEmailer.sendNoLicenseUpdatesEmail(
-            'aslp',
-            'ohio',
-            [ 'operations@example.com' ]
-        );
-
-        expect(messageId).toEqual('message-id-123');
-        expect(mockSESClient).toHaveReceivedCommandWith(
-            SendEmailCommand,
-            {
-                Destination: {
-                    ToAddresses: ['operations@example.com']
-                },
-                Message: {
-                    Body: {
-                        Html: {
-                            Charset: 'UTF-8',
-                            Data: expect.stringContaining('src=\"https://app.test.compactconnect.org/img/email/ico-noupdates@2x.png\"')
-                        }
-                    },
-                    Subject: {
-                        Charset: 'UTF-8',
-                        Data: 'No License Updates for Last 7 Days: aslp / ohio'
-                    }
-                },
-                Source: 'Compact Connect <noreply@example.org>'
-            }
-        );
-    });
-});
diff --git a/backend/compact-connect/lambdas/python/common/.coveragerc b/backend/compact-connect/lambdas/python/common/.coveragerc
index 99c409d65..193e8ec8a 100644
--- a/backend/compact-connect/lambdas/python/common/.coveragerc
+++ b/backend/compact-connect/lambdas/python/common/.coveragerc
@@ -1,5 +1,5 @@
 [run]
-data_file = ../../../.coverage
+data_file = ../../../../.coverage
 
 omit =
   */cdk.out/*
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/config.py b/backend/compact-connect/lambdas/python/common/cc_common/config.py
index 4bc9c43ef..23dbed7a1 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/config.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/config.py
@@ -170,5 +170,19 @@ def current_standard_datetime(self):
         """
         return datetime.now(tz=UTC).replace(microsecond=0)
 
+    @cached_property
+    def transaction_client(self):
+        from cc_common.data_model.transaction_client import TransactionClient
+
+        return TransactionClient(self)
+
+    @property
+    def transaction_history_table_name(self):
+        return os.environ['TRANSACTION_HISTORY_TABLE_NAME']
+
+    @property
+    def transaction_history_table(self):
+        return boto3.resource('dynamodb').Table(self.transaction_history_table_name)
+
 
 config = _Config()
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/transaction_client.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/transaction_client.py
new file mode 100644
index 000000000..8581aa610
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/transaction_client.py
@@ -0,0 +1,41 @@
+from datetime import datetime
+
+from cc_common.config import _Config
+
+AUTHORIZE_DOT_NET_CLIENT_TYPE = 'authorize.net'
+
+
+class TransactionClient:
+    """Client interface for transaction history data dynamodb queries"""
+
+    def __init__(self, config: _Config):
+        self.config = config
+
+    def store_transactions(self, compact: str, transactions: list[dict]) -> None:
+        """
+        Store transaction records in DynamoDB.
+
+        :param compact: The compact name
+        :param transactions: List of transaction records to store
+        """
+        with self.config.transaction_history_table.batch_writer() as batch:
+            for transaction in transactions:
+                # Convert UTC timestamp to epoch for sorting
+                transaction_processor = transaction['transactionProcessor']
+                if transaction_processor == AUTHORIZE_DOT_NET_CLIENT_TYPE:
+                    settlement_time = datetime.fromisoformat(transaction['batch']['settlementTimeUTC'])
+                    epoch_timestamp = int(settlement_time.timestamp())
+                    month_key = settlement_time.strftime('%Y-%m')
+
+                    # Create the composite keys
+                    pk = f'COMPACT#{compact}#TRANSACTIONS#MONTH#{month_key}'
+                    sk = (
+                        f'COMPACT#{compact}#TIME#{epoch_timestamp}#BATCH#{transaction["batch"]["batchId"]}'
+                        f'#TX#{transaction["transactionId"]}'
+                    )
+
+                    # Store the full transaction record along with the keys
+                    item = {'pk': pk, 'sk': sk, **transaction}
+                    batch.put_item(Item=item)
+                else:
+                    raise ValueError(f'Unsupported transaction processor: {transaction_processor}')
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/exceptions.py b/backend/compact-connect/lambdas/python/common/cc_common/exceptions.py
index c93b60548..a75245404 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/exceptions.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/exceptions.py
@@ -34,3 +34,7 @@ class CCAwsServiceException(CCBaseException):
 
 class CCConflictException(CCBaseException):
     """Client error in the request, corresponds to a 409 response"""
+
+
+class TransactionBatchSettlementFailureException(CCBaseException):
+    """Raised when a transaction batch has a settlement error."""
diff --git a/backend/compact-connect/lambdas/python/common/requirements-dev.txt b/backend/compact-connect/lambdas/python/common/requirements-dev.txt
index 4038df16e..0a750e06c 100644
--- a/backend/compact-connect/lambdas/python/common/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/common/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/common/requirements-dev.in
 #
-boto3==1.35.87
+boto3==1.35.88
     # via moto
-botocore==1.35.87
+botocore==1.35.88
     # via
     #   boto3
     #   moto
@@ -15,7 +15,7 @@ certifi==2024.12.14
     # via requests
 cffi==1.17.1
     # via cryptography
-charset-normalizer==3.4.0
+charset-normalizer==3.4.1
     # via requests
 cryptography==44.0.0
     # via moto
@@ -35,9 +35,9 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.24
+moto[dynamodb,s3]==5.0.25
     # via -r compact-connect/lambdas/python/common/requirements-dev.in
-py-partiql-parser==0.5.6
+py-partiql-parser==0.6.1
     # via moto
 pycparser==2.22
     # via cffi
diff --git a/backend/compact-connect/lambdas/python/common/requirements.txt b/backend/compact-connect/lambdas/python/common/requirements.txt
index 62ebc0fb5..95819ee63 100644
--- a/backend/compact-connect/lambdas/python/common/requirements.txt
+++ b/backend/compact-connect/lambdas/python/common/requirements.txt
@@ -6,9 +6,9 @@
 #
 aws-lambda-powertools==2.43.1
     # via -r compact-connect/lambdas/python/common/requirements.in
-boto3==1.35.87
+boto3==1.35.88
     # via -r compact-connect/lambdas/python/common/requirements.in
-botocore==1.35.87
+botocore==1.35.88
     # via
     #   boto3
     #   s3transfer
diff --git a/backend/compact-connect/lambdas/python/common/tests/function/__init__.py b/backend/compact-connect/lambdas/python/common/tests/function/__init__.py
new file mode 100644
index 000000000..5135f275c
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/tests/function/__init__.py
@@ -0,0 +1,147 @@
+import json
+import logging
+import os
+
+import boto3
+from boto3.dynamodb.types import TypeDeserializer
+from faker import Faker
+from moto import mock_aws
+
+from tests import TstLambdas
+
+logger = logging.getLogger(__name__)
+logging.basicConfig()
+logger.setLevel(logging.DEBUG if os.environ.get('DEBUG', 'false') == 'true' else logging.INFO)
+
+
+@mock_aws
+class TstFunction(TstLambdas):
+    """Base class to set up Moto mocking and create mock AWS resources for functional testing"""
+
+    def setUp(self):  # noqa: N801 invalid-name
+        super().setUp()
+
+        self.faker = Faker(['en_US', 'ja_JP', 'es_MX'])
+        self.build_resources()
+
+        self.addCleanup(self.delete_resources)
+
+    def build_resources(self):
+        self._table = boto3.resource('dynamodb').create_table(
+            AttributeDefinitions=[
+                {'AttributeName': 'pk', 'AttributeType': 'S'},
+                {'AttributeName': 'sk', 'AttributeType': 'S'},
+                {'AttributeName': 'famGiv', 'AttributeType': 'S'},
+            ],
+            TableName=self.config.users_table_name,
+            KeySchema=[{'AttributeName': 'pk', 'KeyType': 'HASH'}, {'AttributeName': 'sk', 'KeyType': 'RANGE'}],
+            BillingMode='PAY_PER_REQUEST',
+            GlobalSecondaryIndexes=[
+                {
+                    'IndexName': os.environ['FAM_GIV_INDEX_NAME'],
+                    'KeySchema': [
+                        {'AttributeName': 'sk', 'KeyType': 'HASH'},
+                        {'AttributeName': 'famGiv', 'KeyType': 'RANGE'},
+                    ],
+                    'Projection': {'ProjectionType': 'ALL'},
+                },
+            ],
+        )
+        # Adding a waiter allows for testing against an actual AWS account, if needed
+        waiter = self._table.meta.client.get_waiter('table_exists')
+        waiter.wait(TableName=self._table.name)
+
+        # Create a new Cognito user pool
+        cognito_client = boto3.client('cognito-idp')
+        user_pool_name = 'TestUserPool'
+        user_pool_response = cognito_client.create_user_pool(
+            PoolName=user_pool_name,
+            AliasAttributes=['email'],
+            UsernameAttributes=['email'],
+        )
+        os.environ['USER_POOL_ID'] = user_pool_response['UserPool']['Id']
+        self._user_pool_id = user_pool_response['UserPool']['Id']
+
+    def delete_resources(self):
+        self._table.delete()
+        waiter = self._table.meta.client.get_waiter('table_not_exists')
+        waiter.wait(TableName=self._table.name)
+        # Delete the Cognito user pool
+        cognito_client = boto3.client('cognito-idp')
+        cognito_client.delete_user_pool(UserPoolId=self._user_pool_id)
+
+    def _load_user_data(self) -> str:
+        with open('tests/resources/dynamo/user.json') as f:
+            # This item is saved in its serialized form, so we have to deserialize it first
+            item = TypeDeserializer().deserialize({'M': json.load(f)})
+
+        logger.info('Loading user: %s', item)
+        self._table.put_item(Item=item)
+        return item['userId']
+
+    def _create_compact_staff_user(self, compacts: list[str]):
+        """Create a compact-staff style user for each jurisdiction in the provided compact."""
+        from cc_common.data_model.schema.user import UserRecordSchema
+
+        schema = UserRecordSchema()
+
+        email = self.faker.unique.email()
+        sub = self._create_cognito_user(email=email)
+        for compact in compacts:
+            logger.info('Writing compact %s permissions for %s', compact, email)
+            self._table.put_item(
+                Item=schema.dump(
+                    {
+                        'userId': sub,
+                        'compact': compact,
+                        'attributes': {
+                            'email': email,
+                            'familyName': self.faker.unique.last_name(),
+                            'givenName': self.faker.unique.first_name(),
+                        },
+                        'permissions': {'actions': {'read'}, 'jurisdictions': {}},
+                    },
+                ),
+            )
+        return sub
+
+    def _create_board_staff_users(self, compacts: list[str]):
+        """Create a board-staff style user for each jurisdiction in the provided compact."""
+        from cc_common.data_model.schema.user import UserRecordSchema
+
+        schema = UserRecordSchema()
+
+        for jurisdiction in self.config.jurisdictions:
+            email = self.faker.unique.email()
+            sub = self._create_cognito_user(email=email)
+            for compact in compacts:
+                logger.info('Writing board %s/%s permissions for %s', compact, jurisdiction, email)
+                self._table.put_item(
+                    Item=schema.dump(
+                        {
+                            'userId': sub,
+                            'compact': compact,
+                            'attributes': {
+                                'email': email,
+                                'familyName': self.faker.unique.last_name(),
+                                'givenName': self.faker.unique.first_name(),
+                            },
+                            'permissions': self._create_write_permissions(jurisdiction),
+                        },
+                    ),
+                )
+
+    def _create_cognito_user(self, *, email: str):
+        from cc_common.utils import get_sub_from_user_attributes
+
+        user_data = self.config.cognito_client.admin_create_user(
+            UserPoolId=self.config.user_pool_id,
+            Username=email,
+            UserAttributes=[{'Name': 'email', 'Value': email}],
+            DesiredDeliveryMediums=['EMAIL'],
+        )
+        return get_sub_from_user_attributes(user_data['User']['Attributes'])
+
+    @staticmethod
+    def _create_write_permissions(jurisdiction: str):
+        return {'actions': {'read'}, 'jurisdictions': {jurisdiction: {'write'}}}
diff --git a/backend/compact-connect/lambdas/python/license-data/data_model/__init__.py b/backend/compact-connect/lambdas/python/common/tests/function/test_data_model/__init__.py
similarity index 100%
rename from backend/compact-connect/lambdas/python/license-data/data_model/__init__.py
rename to backend/compact-connect/lambdas/python/common/tests/function/test_data_model/__init__.py
diff --git a/backend/compact-connect/lambdas/python/staff-users/tests/function/test_data_model/test_client.py b/backend/compact-connect/lambdas/python/common/tests/function/test_data_model/test_user_client.py
similarity index 100%
rename from backend/compact-connect/lambdas/python/staff-users/tests/function/test_data_model/test_client.py
rename to backend/compact-connect/lambdas/python/common/tests/function/test_data_model/test_user_client.py
diff --git a/backend/compact-connect/lambdas/python/staff-users/tests/resources/dynamo/user.json b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/user.json
similarity index 100%
rename from backend/compact-connect/lambdas/python/staff-users/tests/resources/dynamo/user.json
rename to backend/compact-connect/lambdas/python/common/tests/resources/dynamo/user.json
diff --git a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_data_client.py b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_data_client.py
index 2d4643dd2..13165b85d 100644
--- a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_data_client.py
+++ b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_data_client.py
@@ -2,35 +2,83 @@
 from unittest.mock import MagicMock, patch
 
 from botocore.exceptions import ClientError
-from cc_common.exceptions import CCAwsServiceException
+from cc_common.exceptions import CCAwsServiceException, CCNotFoundException
 
 from tests import TstLambdas
 
 
 class TestDataClient(TstLambdas):
-    @patch('cc_common.config._Config.current_standard_datetime', datetime.fromisoformat('2024-11-08T23:59:59+00:00'))
-    def test_data_client_deletes_records_if_exception_during_create_privilege_records(self):
+    def setUp(self):
         from cc_common.data_model import client
 
-        mock_dynamo_db_table = MagicMock(name='provider-table')
-        mock_batch_writer = MagicMock(name='batch_writer')
+        self.mock_provider_table = MagicMock(name='provider-table')
+        self.mock_ssn_table = MagicMock(name='ssn-table')
+        self.mock_batch_writer = MagicMock(name='batch_writer')
 
         # Ensure the context manager returns the mock_batch_writer
-        mock_dynamo_db_table.batch_writer.return_value.__enter__.return_value = mock_batch_writer
+        self.mock_provider_table.batch_writer.return_value.__enter__.return_value = self.mock_batch_writer
+
+        self.mock_config = MagicMock(spec=client._Config)  # noqa: SLF001 protected-access
+        self.mock_config.provider_table = self.mock_provider_table
+        self.mock_config.ssn_table = self.mock_ssn_table
+
+        self.client = client.DataClient(self.mock_config)
+
+    def test_get_provider_id_success(self):
+        # Mock response from DynamoDB
+        self.mock_ssn_table.get_item.return_value = {
+            'Item': {'pk': 'aslp#SSN#123456789', 'sk': 'aslp#SSN#123456789', 'providerId': 'test_provider_id'}
+        }
+
+        # Call the method
+        provider_id = self.client.get_provider_id(compact='aslp', ssn='123456789')
+
+        # Verify the result
+        self.assertEqual(provider_id, 'test_provider_id')
+        self.mock_ssn_table.get_item.assert_called_once_with(
+            Key={'pk': 'aslp#SSN#123456789', 'sk': 'aslp#SSN#123456789'}, ConsistentRead=True
+        )
+
+    def test_get_provider_id_not_found(self):
+        # Mock response from DynamoDB for non-existent item
+        self.mock_ssn_table.get_item.return_value = {}
+
+        # Verify it raises CCNotFoundException
+        with self.assertRaises(CCNotFoundException):
+            self.client.get_provider_id(compact='aslp', ssn='123456789')
 
+    def test_get_or_create_provider_id_existing(self):
+        # Mock ClientError for existing provider
+        error_response = {
+            'Error': {'Code': 'ConditionalCheckFailedException'},
+            'Item': {'providerId': {'S': 'existing_provider_id'}},
+        }
+        self.mock_ssn_table.put_item.side_effect = ClientError(error_response, 'PutItem')
+
+        # Call the method
+        provider_id = self.client.get_or_create_provider_id(compact='aslp', ssn='123456789')
+
+        # Verify the result
+        self.assertEqual(provider_id, 'existing_provider_id')
+
+    def test_get_provider_not_found(self):
+        # Mock response from DynamoDB for non-existent provider
+        self.mock_provider_table.query.return_value = {'Items': []}
+
+        # Verify it raises CCNotFoundException
+        with self.assertRaises(CCNotFoundException):
+            self.client.get_provider(compact='aslp', provider_id='test_id', detail=True, consistent_read=False)
+
+    @patch('cc_common.config._Config.current_standard_datetime', datetime.fromisoformat('2024-11-08T23:59:59+00:00'))
+    def test_data_client_deletes_records_if_exception_during_create_privilege_records(self):
         # Set the side effect to raise ClientError on put_item
-        mock_batch_writer.put_item.side_effect = ClientError(
+        self.mock_batch_writer.put_item.side_effect = ClientError(
             error_response={'Error': {'Code': 'InternalServerError', 'Message': 'DynamoDB Internal Server Error'}},
             operation_name='PutItem',
         )
 
-        mock_config = MagicMock(spec=client._Config)  # noqa: SLF001 protected-access
-        mock_config.provider_table = mock_dynamo_db_table
-
-        test_data_client = client.DataClient(mock_config)
-
         with self.assertRaises(CCAwsServiceException):
-            test_data_client.create_provider_privileges(
+            self.client.create_provider_privileges(
                 compact_name='aslp',
                 provider_id='test_provider_id',
                 jurisdiction_postal_abbreviations=['CA'],
@@ -39,7 +87,7 @@ def test_data_client_deletes_records_if_exception_during_create_privilege_record
                 compact_transaction_id='test_transaction_id',
             )
 
-        mock_batch_writer.delete_item.assert_called_with(
+        self.mock_batch_writer.delete_item.assert_called_with(
             Key={
                 'pk': 'aslp#PROVIDER#test_provider_id',
                 'sk': 'aslp#PROVIDER#privilege/ca#2024-11-08',
diff --git a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_transaction_client.py b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_transaction_client.py
new file mode 100644
index 000000000..01b57da52
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_transaction_client.py
@@ -0,0 +1,79 @@
+from datetime import datetime
+from unittest.mock import MagicMock
+
+from tests import TstLambdas
+
+TEST_SETTLEMENT_DATETIME = '2024-01-15T10:30:00+00:00'
+
+
+class TestTransactionClient(TstLambdas):
+    def setUp(self):
+        from cc_common.data_model import transaction_client
+
+        self.mock_dynamo_db_table = MagicMock(name='transaction-history-table')
+        self.mock_batch_writer = MagicMock(name='batch_writer')
+        self.mock_dynamo_db_table.batch_writer.return_value.__enter__.return_value = self.mock_batch_writer
+
+        self.mock_config = MagicMock(spec=transaction_client._Config)  # noqa: SLF001 protected-access
+        self.mock_config.transaction_history_table = self.mock_dynamo_db_table
+
+        self.client = transaction_client.TransactionClient(self.mock_config)
+
+    def test_store_transactions_authorize_net(self):
+        # Test data
+        test_transactions = [
+            {
+                'transactionProcessor': 'authorize.net',
+                'transactionId': 'tx123',
+                'batch': {'batchId': 'batch456', 'settlementTimeUTC': '2024-01-15T10:30:00+00:00'},
+            }
+        ]
+
+        # Call the method
+        self.client.store_transactions('aslp', test_transactions)
+
+        # Verify the batch writer was called with correct data
+        expected_epoch = int(datetime.fromisoformat(TEST_SETTLEMENT_DATETIME).timestamp())
+        expected_item = {
+            'pk': 'COMPACT#aslp#TRANSACTIONS#MONTH#2024-01',
+            'sk': f'COMPACT#aslp#TIME#{expected_epoch}#BATCH#batch456#TX#tx123',
+            'transactionProcessor': 'authorize.net',
+            'transactionId': 'tx123',
+            'batch': {'batchId': 'batch456', 'settlementTimeUTC': TEST_SETTLEMENT_DATETIME},
+        }
+        self.mock_batch_writer.put_item.assert_called_once_with(Item=expected_item)
+
+    def test_store_transactions_unsupported_processor(self):
+        # Test data with unsupported processor
+        test_transactions = [
+            {
+                'transactionProcessor': 'unsupported',
+                'transactionId': 'tx123',
+                'batch': {'batchId': 'batch456', 'settlementTimeUTC': '2024-01-15T10:30:00+00:00'},
+            }
+        ]
+
+        # Verify it raises ValueError for unsupported processor
+        with self.assertRaises(ValueError):
+            self.client.store_transactions('aslp', test_transactions)
+
+    def test_store_multiple_transactions(self):
+        # Test data with multiple transactions
+        test_transactions = [
+            {
+                'transactionProcessor': 'authorize.net',
+                'transactionId': 'tx123',
+                'batch': {'batchId': 'batch456', 'settlementTimeUTC': '2024-01-15T10:30:00+00:00'},
+            },
+            {
+                'transactionProcessor': 'authorize.net',
+                'transactionId': 'tx124',
+                'batch': {'batchId': 'batch456', 'settlementTimeUTC': '2024-01-15T11:30:00+00:00'},
+            },
+        ]
+
+        # Call the method
+        self.client.store_transactions('aslp', test_transactions)
+
+        # Verify the batch writer was called twice
+        self.assertEqual(self.mock_batch_writer.put_item.call_count, 2)
diff --git a/backend/compact-connect/lambdas/python/custom-resources/.coveragerc b/backend/compact-connect/lambdas/python/custom-resources/.coveragerc
index 99c409d65..193e8ec8a 100644
--- a/backend/compact-connect/lambdas/python/custom-resources/.coveragerc
+++ b/backend/compact-connect/lambdas/python/custom-resources/.coveragerc
@@ -1,5 +1,5 @@
 [run]
-data_file = ../../../.coverage
+data_file = ../../../../.coverage
 
 omit =
   */cdk.out/*
diff --git a/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt b/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt
index 9e4cc12e5..0c8224935 100644
--- a/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/custom-resources/requirements-dev.in
 #
-boto3==1.35.87
+boto3==1.35.88
     # via moto
-botocore==1.35.87
+botocore==1.35.88
     # via
     #   boto3
     #   moto
@@ -15,7 +15,7 @@ certifi==2024.12.14
     # via requests
 cffi==1.17.1
     # via cryptography
-charset-normalizer==3.4.0
+charset-normalizer==3.4.1
     # via requests
 cryptography==44.0.0
     # via moto
@@ -33,9 +33,9 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.24
+moto[dynamodb,s3]==5.0.25
     # via -r compact-connect/lambdas/python/custom-resources/requirements-dev.in
-py-partiql-parser==0.5.6
+py-partiql-parser==0.6.1
     # via moto
 pycparser==2.22
     # via cffi
diff --git a/backend/compact-connect/lambdas/python/data-events/.coveragerc b/backend/compact-connect/lambdas/python/data-events/.coveragerc
index 99c409d65..193e8ec8a 100644
--- a/backend/compact-connect/lambdas/python/data-events/.coveragerc
+++ b/backend/compact-connect/lambdas/python/data-events/.coveragerc
@@ -1,5 +1,5 @@
 [run]
-data_file = ../../../.coverage
+data_file = ../../../../.coverage
 
 omit =
   */cdk.out/*
diff --git a/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt b/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt
index ac473bbde..215683e2c 100644
--- a/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/data-events/requirements-dev.in
 #
-boto3==1.35.87
+boto3==1.35.88
     # via moto
-botocore==1.35.87
+botocore==1.35.88
     # via
     #   boto3
     #   moto
@@ -15,7 +15,7 @@ certifi==2024.12.14
     # via requests
 cffi==1.17.1
     # via cryptography
-charset-normalizer==3.4.0
+charset-normalizer==3.4.1
     # via requests
 cryptography==44.0.0
     # via moto
@@ -33,9 +33,9 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.24
+moto[dynamodb,s3]==5.0.25
     # via -r compact-connect/lambdas/python/data-events/requirements-dev.in
-py-partiql-parser==0.5.6
+py-partiql-parser==0.6.1
     # via moto
 pycparser==2.22
     # via cffi
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/.coveragerc b/backend/compact-connect/lambdas/python/provider-data-v1/.coveragerc
index 99c409d65..193e8ec8a 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/.coveragerc
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/.coveragerc
@@ -1,5 +1,5 @@
 [run]
-data_file = ../../../.coverage
+data_file = ../../../../.coverage
 
 omit =
   */cdk.out/*
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt b/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt
index 88ac77aa2..94ad2078b 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/provider-data-v1/requirements-dev.in
 #
-boto3==1.35.87
+boto3==1.35.88
     # via moto
-botocore==1.35.87
+botocore==1.35.88
     # via
     #   boto3
     #   moto
@@ -15,7 +15,7 @@ certifi==2024.12.14
     # via requests
 cffi==1.17.1
     # via cryptography
-charset-normalizer==3.4.0
+charset-normalizer==3.4.1
     # via requests
 cryptography==44.0.0
     # via moto
@@ -35,9 +35,9 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.24
+moto[dynamodb,s3]==5.0.25
     # via -r compact-connect/lambdas/python/provider-data-v1/requirements-dev.in
-py-partiql-parser==0.5.6
+py-partiql-parser==0.6.1
     # via moto
 pycparser==2.22
     # via cffi
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py
index e458d3122..86ad11e83 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py
@@ -111,6 +111,9 @@ def privilege_jurisdictions_to_set(obj: dict):
 
         for resource in test_resources:
             with open(resource) as f:
+                if resource.endswith('user.json'):
+                    # skip the staff user test data, as it is not stored in the provider table
+                    continue
                 record = json.load(f, object_hook=privilege_jurisdictions_to_set, parse_float=Decimal)
 
             logger.debug('Loading resource, %s: %s', resource, str(record))
diff --git a/backend/compact-connect/lambdas/python/purchases/.coveragerc b/backend/compact-connect/lambdas/python/purchases/.coveragerc
index 99c409d65..193e8ec8a 100644
--- a/backend/compact-connect/lambdas/python/purchases/.coveragerc
+++ b/backend/compact-connect/lambdas/python/purchases/.coveragerc
@@ -1,5 +1,5 @@
 [run]
-data_file = ../../../.coverage
+data_file = ../../../../.coverage
 
 omit =
   */cdk.out/*
diff --git a/backend/compact-connect/lambdas/python/purchases/handlers/transaction_history.py b/backend/compact-connect/lambdas/python/purchases/handlers/transaction_history.py
new file mode 100644
index 000000000..a07e33e73
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/purchases/handlers/transaction_history.py
@@ -0,0 +1,80 @@
+from datetime import timedelta
+
+from aws_lambda_powertools.utilities.typing import LambdaContext
+from cc_common.config import config
+from cc_common.exceptions import TransactionBatchSettlementFailureException
+from purchase_client import PurchaseClient
+
+
+def process_settled_transactions(event: dict, context: LambdaContext) -> dict:  # noqa: ARG001 unused-argument
+    """
+    Process settled transactions from the payment processor.
+
+    This lambda is invoked as part of the transaction history processing workflow. It retrieves settled transactions
+    from the payment processor and stores them in DynamoDB. It is designed to be invoked multiple times until all
+    transactions have been processed. The lambda will return a status of 'IN_PROGRESS' until all transactions have been
+    processed, at which point it will return a status of 'COMPLETE'.
+
+    If the payment processor reports that there was a settlement failure, the lambda will return a status of
+    'BATCH_FAILURE', which will cause the workflow to send an alert to the compact operations team.
+
+    :param event: Lambda event containing:
+        - compact: The compact name
+        - lastProcessedTransactionId: Optional last processed transaction ID
+        - currentBatchId: Optional current batch ID being processed
+        - processedBatchIds: Optional list of batch IDs that have been processed, this ensures we don't process the same
+            batch multiple times.
+    :param context: Lambda context
+    :return: Dictionary indicating processing status and optional pagination info
+    """
+    compact = event['compact']
+    last_processed_transaction_id = event.get('lastProcessedTransactionId')
+    current_batch_id = event.get('currentBatchId')
+    processed_batch_ids = event.get('processedBatchIds', [])
+
+    # Calculate time range for the last 24 hours
+    end_time = config.current_standard_datetime
+    start_time = end_time - timedelta(days=1)
+
+    # Format timestamps for API call
+    start_time_str = start_time.strftime('%Y-%m-%dT%H:%M:%SZ')
+    end_time_str = end_time.strftime('%Y-%m-%dT%H:%M:%SZ')
+
+    try:
+        # Get transactions from payment processor
+        purchase_client = PurchaseClient()
+        transaction_response = purchase_client.get_settled_transactions(
+            compact=compact,
+            start_time=start_time_str,
+            end_time=end_time_str,
+            # we set the transaction limit to 500 to avoid hitting the 15-minute timeout for lambda
+            transaction_limit=500,
+            last_processed_transaction_id=last_processed_transaction_id,
+            current_batch_id=current_batch_id,
+            processed_batch_ids=processed_batch_ids,
+        )
+
+        # Store transactions in DynamoDB
+        if transaction_response['transactions']:
+            config.transaction_client.store_transactions(compact, transaction_response['transactions'])
+
+        # Return appropriate response based on whether there are more transactions to process
+        response = {
+            'compact': compact,  # Always include the compact name
+            'status': 'IN_PROGRESS' if 'lastProcessedTransactionId' in transaction_response else 'COMPLETE',
+            'processedBatchIds': transaction_response['processedBatchIds'],
+        }
+
+        # Only include pagination values if we're not done processing
+        if 'lastProcessedTransactionId' in transaction_response:
+            response.update(
+                {
+                    'lastProcessedTransactionId': transaction_response['lastProcessedTransactionId'],
+                    'currentBatchId': transaction_response['currentBatchId'],
+                }
+            )
+
+        return response
+
+    except TransactionBatchSettlementFailureException as e:
+        return {'compact': compact, 'status': 'BATCH_FAILURE', 'batchFailureErrorMessage': str(e)}
diff --git a/backend/compact-connect/lambdas/python/purchases/purchase_client.py b/backend/compact-connect/lambdas/python/purchases/purchase_client.py
index a4c0e6512..064e44e82 100644
--- a/backend/compact-connect/lambdas/python/purchases/purchase_client.py
+++ b/backend/compact-connect/lambdas/python/purchases/purchase_client.py
@@ -1,15 +1,44 @@
 import json
+import logging
 from abc import ABC, abstractmethod
 
 from authorizenet import apicontractsv1
-from authorizenet.apicontrollers import createTransactionController, getMerchantDetailsController
+from authorizenet.apicontrollers import (
+    createTransactionController,
+    getMerchantDetailsController,
+    getSettledBatchListController,
+    getTransactionDetailsController,
+    getTransactionListController,
+)
 from authorizenet.constants import constants
 from cc_common.config import config, logger
 from cc_common.data_model.schema.compact import Compact, CompactFeeType
 from cc_common.data_model.schema.jurisdiction import Jurisdiction, JurisdictionMilitaryDiscountType
-from cc_common.exceptions import CCFailedTransactionException, CCInternalException, CCInvalidRequestException
+from cc_common.exceptions import (
+    CCFailedTransactionException,
+    CCInternalException,
+    CCInvalidRequestException,
+    TransactionBatchSettlementFailureException,
+)
 
 AUTHORIZE_DOT_NET_CLIENT_TYPE = 'authorize.net'
+OK_TRANSACTION_MESSAGE_RESULT_CODE = 'Ok'
+MAXIMUM_TRANSACTION_API_LIMIT = 1000
+
+# The authorizenet SDK emits many warnings due to a Pyxb issue that they will not address,
+# see https://github.com/AuthorizeNet/sdk-python/issues/133,
+# so we are ignoring warnings to reduce noise in our logging
+logging.getLogger('pyxb.binding.content').setLevel(logging.ERROR)
+
+
+# We also want to ignore a specific 'error' message from them that does not actually impact the system
+# see https://github.com/AuthorizeNet/sdk-python/issues/109
+class IgnoreContentNondeterminismFilter(logging.Filter):
+    def filter(self, record):
+        return 'ContentNondeterminismExceededError' not in record.getMessage()
+
+
+logging.getLogger('authorizenet.sdk').addFilter(IgnoreContentNondeterminismFilter())
 
 
 def _calculate_jurisdiction_fee(jurisdiction: Jurisdiction, user_active_military: bool) -> float:
@@ -106,6 +135,28 @@ def validate_credentials(self) -> dict:
         Verify that the provided credentials are valid.
         """
 
+    @abstractmethod
+    def get_settled_transactions(
+        self,
+        start_time: str,
+        end_time: str,
+        transaction_limit: int,
+        last_processed_transaction_id: str = None,
+        current_batch_id: str = None,
+        processed_batch_ids: list[str] = None,
+    ) -> dict:
+        """
+        Get settled transactions from the payment processor.
+
+        :param start_time: UTC timestamp string for start of range
+        :param end_time: UTC timestamp string for end of range
+        :param transaction_limit: Maximum number of transactions to return
+        :param last_processed_transaction_id: Optional last processed transaction ID for pagination
+        :param current_batch_id: Optional current batch ID being processed
+        :param processed_batch_ids: Optional list of batch IDs that have already been processed
+        :return: Dictionary containing transaction details and optional pagination info
+        """
+
 
 class AuthorizeNetPaymentProcessorClient(PaymentProcessorClient):
     def __init__(self, api_login_id: str, transaction_key: str):
@@ -385,6 +436,295 @@ def validate_credentials(self) -> dict:
 
         raise CCInvalidRequestException(f'{logger_message} Error code: {error_code}, Error message: {error_message}')
 
+    def _get_settled_batch_list(self, start_time: str, end_time: str) -> apicontractsv1.getSettledBatchListResponse:
+        """
+        Get the list of settled batches from the payment processor.
+
+        :param start_time: UTC timestamp string for start of range
+        :param end_time: UTC timestamp string for end of range
+        :return: Response containing the list of settled batches
+        :raises CCInternalException: If the API call fails
+        :raises TransactionBatchSettlementFailureException: If any batch has a settlement error
+        """
+        merchant_auth = apicontractsv1.merchantAuthenticationType()
+        merchant_auth.name = self.api_login_id
+        merchant_auth.transactionKey = self.transaction_key
+
+        batch_request = apicontractsv1.getSettledBatchListRequest()
+        batch_request.merchantAuthentication = merchant_auth
+        batch_request.includeStatistics = True
+        batch_request.firstSettlementDate = start_time
+        batch_request.lastSettlementDate = end_time
+
+        batch_controller = getSettledBatchListController(batch_request)
+        if config.environment_name != 'prod':
+            batch_controller.setenvironment(constants.SANDBOX)
+        else:
+            batch_controller.setenvironment(constants.PRODUCTION)
+
+        logger.info('Getting settled batch list for timeframe', start_time=start_time, end_time=end_time)
+        batch_controller.execute()
+        batch_response = batch_controller.getresponse()
+
+        if batch_response is None or batch_response.messages.resultCode != OK_TRANSACTION_MESSAGE_RESULT_CODE:
+            logger.error('Failed to get settled batch list')
+            raise CCInternalException('Failed to get settled batch list')
+
+        # Check for settlement errors in any batch
+        if hasattr(batch_response, 'batchList'):
+            batch_ids = [str(batch.batchId) for batch in batch_response.batchList.batch]
+            logger.info('Found settled batches', batch_ids=batch_ids)
+            for batch in batch_response.batchList.batch:
+                if batch.settlementState == 'settlementError':
+                    logger.info(
+                        'Settlement error found in batch. Raising exception to send error email.',
+                        batch_id=batch.batchId,
+                    )
+                    raise TransactionBatchSettlementFailureException(f'Settlement error found in batch {batch.batchId}')
+
+        return batch_response
+
+    def _get_transaction_list(self, batch_id: str, page_offset: int = 1) -> apicontractsv1.getTransactionListResponse:
+        """
+        Get the list of transactions for a specific batch.
+
+        :param batch_id: The batch ID to get transactions for
+        :param page_offset: The page offset for pagination (1-based)
+        :return: Response containing the list of transactions
+        :raises CCInternalException: If the API call fails
+        """
+        merchant_auth = apicontractsv1.merchantAuthenticationType()
+        merchant_auth.name = self.api_login_id
+        merchant_auth.transactionKey = self.transaction_key
+
+        transaction_request = apicontractsv1.getTransactionListRequest()
+        transaction_request.merchantAuthentication = merchant_auth
+        transaction_request.batchId = batch_id
+
+        # Set sorting
+        sorting = apicontractsv1.TransactionListSorting()
+        sorting.orderBy = apicontractsv1.TransactionListOrderFieldEnum.submitTimeUTC
+        sorting.orderDescending = True
+        transaction_request.sorting = sorting
+
+        # Set paging
+        paging = apicontractsv1.Paging()
+        paging.limit = MAXIMUM_TRANSACTION_API_LIMIT  # Maximum allowed by API
+        paging.offset = page_offset
+        transaction_request.paging = paging
+
+        transaction_controller = getTransactionListController(transaction_request)
+        if config.environment_name != 'prod':
+            transaction_controller.setenvironment(constants.SANDBOX)
+        else:
+            transaction_controller.setenvironment(constants.PRODUCTION)
+
+        logger.info('Getting transaction list for batch', batch_id=batch_id, page_offset=page_offset)
+        transaction_controller.execute()
+        transaction_response = transaction_controller.getresponse()
+
+        if (
+            transaction_response is None
+            or transaction_response.messages.resultCode != OK_TRANSACTION_MESSAGE_RESULT_CODE
+        ):
+            logger.error(
+                'Failed to get transaction list',
+                batch_id=batch_id,
+                page_offset=page_offset,
+                response=transaction_response,
+            )
+            raise CCInternalException('Failed to get transaction list')
+
+        transaction_ids = [str(tx.transId) for tx in transaction_response.transactions.transaction]
+        logger.info('Found transactions in batch', batch_id=batch_id, transaction_ids=transaction_ids)
+
+        return transaction_response
+
+    def _get_transaction_details(self, transaction_id: str) -> apicontractsv1.getTransactionDetailsResponse:
+        """
+        Get detailed information for a specific transaction.
+
+        :param transaction_id: The transaction ID to get details for
+        :return: Response containing the transaction details
+        :raises CCInternalException: If the API call fails
+        """
+        merchant_auth = apicontractsv1.merchantAuthenticationType()
+        merchant_auth.name = self.api_login_id
+        merchant_auth.transactionKey = self.transaction_key
+
+        details_request = apicontractsv1.getTransactionDetailsRequest()
+        details_request.merchantAuthentication = merchant_auth
+        details_request.transId = transaction_id
+
+        details_controller = getTransactionDetailsController(details_request)
+        if config.environment_name != 'prod':
+            details_controller.setenvironment(constants.SANDBOX)
+        else:
+            details_controller.setenvironment(constants.PRODUCTION)
+
+        logger.info('Getting transaction details', transaction_id=transaction_id)
+        details_controller.execute()
+        details_response = details_controller.getresponse()
+
+        if details_response is None or details_response.messages.resultCode != OK_TRANSACTION_MESSAGE_RESULT_CODE:
+            logger.error('Failed to get transaction details', transaction_id=transaction_id, response=details_response)
+            raise CCInternalException('Failed to get transaction details')
+
+        return details_response
+
+    def get_settled_transactions(
+        self,
+        start_time: str,
+        end_time: str,
+        transaction_limit: int,
+        last_processed_transaction_id: str = None,
+        current_batch_id: str = None,
+        processed_batch_ids: list[str] = None,
+    ) -> dict:
+        """
+        Get settled transactions from the payment processor.
+
+        :param start_time: UTC timestamp string for start of range
+        :param end_time: UTC timestamp string for end of range
+        :param transaction_limit: Maximum number of transactions to return
+        :param last_processed_transaction_id: Optional last processed transaction ID for pagination
+        :param current_batch_id: Optional current batch ID being processed
+        :param processed_batch_ids: Optional list of batch IDs that have already been processed
+        :return: Dictionary containing transaction details and optional pagination info
+        """
+        # Get settled batch list
+        batch_response = self._get_settled_batch_list(start_time, end_time)
+
+        transactions = []
+        last_batch_id = None
+        last_transaction_id = None
+        processed_transaction_count = 0
+        found_last_processed = last_processed_transaction_id is None
+        processed_batch_ids = processed_batch_ids or []
+        found_current_batch = current_batch_id is None
+
+        if hasattr(batch_response, 'batchList'):
+            for batch in batch_response.batchList.batch:
+                batch_id = str(batch.batchId)
+
+                # Skip batches we've already processed
+                if batch_id in processed_batch_ids:
+                    continue
+
+                # Skip batches until we find the current batch we were processing
+                if not found_current_batch:
+                    if batch_id == current_batch_id:
+                        logger.info('Found current batch to process', batch_id=current_batch_id)
+                        found_current_batch = True
+                    else:
+                        continue
+
+                if processed_transaction_count >= transaction_limit:
+                    last_batch_id = batch_id
+                    break
+
+                # Get transaction list for batch with pagination
+                page_offset = 1
+                transactions_in_page = 0
+                while page_offset == 1 or transactions_in_page >= MAXIMUM_TRANSACTION_API_LIMIT:
+                    transaction_response = self._get_transaction_list(batch_id, page_offset)
+                    transactions_in_page = int(transaction_response.totalNumInResultSet)
+
+                    if hasattr(transaction_response, 'transactions'):
+                        for transaction in transaction_response.transactions.transaction:
+                            # Skip transactions until we find the last processed one
+                            if not found_last_processed:
+                                if str(transaction.transId) == last_processed_transaction_id:
+                                    logger.info(
+                                        'Found last processed transaction',
+                                        transaction_id=last_processed_transaction_id,
+                                        batch_id=batch_id,
+                                    )
+                                    found_last_processed = True
+                                continue
+
+                            # Get detailed transaction information
+                            details_response = self._get_transaction_details(str(transaction.transId))
+                            logger.debug(
+                                'Received transaction details',
+                                batch_id=batch_id,
+                                transaction_id=str(transaction.transId),
+                            )
+                            tx = details_response.transaction
+
+                            licensee_id = None
+                            if hasattr(tx, 'order') and tx.order.description:
+                                # Extract licensee ID from order description (format: "LICENSEE#uuid#")
+                                parts = str(tx.order.description).split('#')
+                                if len(parts) >= 3 and parts[0] == 'LICENSEE':
+                                    licensee_id = parts[1]
+
+                            line_items = []
+                            if hasattr(tx, 'lineItems') and hasattr(tx.lineItems, 'lineItem'):
+                                for item in tx.lineItems.lineItem:
+                                    line_items.append(
+                                        {
+                                            # we must cast these to strings, or they will cause an error when we
+                                            # try to serialize in other parts of the system
+                                            'itemId': str(item.itemId),
+                                            'name': str(item.name),
+                                            'description': str(item.description),
+                                            'quantity': str(item.quantity),
+                                            'unitPrice': str(item.unitPrice),
+                                            'taxable': str(item.taxable),
+                                        }
+                                    )
+
+                            transaction_data = {
+                                # we must cast these to strings, or they will cause an error when we try to serialize
+                                # in other parts of the system
+                                'transactionId': str(tx.transId),
+                                'submitTimeUTC': str(tx.submitTimeUTC),
+                                'transactionType': str(tx.transactionType),
+                                'transactionStatus': str(tx.transactionStatus),
+                                'responseCode': str(tx.responseCode),
+                                'settleAmount': str(tx.settleAmount),
+                                'licenseeId': licensee_id,
+                                'batch': {
+                                    'batchId': str(batch.batchId),
+                                    'settlementTimeUTC': str(batch.settlementTimeUTC),
+                                    'settlementTimeLocal': str(batch.settlementTimeLocal),
+                                    'settlementState': str(batch.settlementState),
+                                },
+                                'lineItems': line_items,
+                                # this defines the type of transaction processor that processed the transaction
+                                'transactionProcessor': AUTHORIZE_DOT_NET_CLIENT_TYPE,
+                            }
+                            transactions.append(transaction_data)
+                            processed_transaction_count += 1
+                            if processed_transaction_count >= transaction_limit:
+                                last_transaction_id = str(tx.transId)
+                                break
+
+                    # Check if we need to get the next page of transactions
+                    page_offset += 1
+
+                if processed_transaction_count >= transaction_limit:
+                    last_batch_id = batch_id
+                    logger.info(
+                        'Transaction limit reached. Returning last processed transaction',
+                        last_processed_transaction_id=last_transaction_id,
+                        current_batch_id=batch_id,
+                    )
+                    break
+
+                # If we've processed all transactions in this batch, add it to the processed list
+                logger.info('Finished processing batch', batch_id=batch_id)
+                processed_batch_ids.append(batch_id)
+
+        response = {'transactions': transactions, 'processedBatchIds': processed_batch_ids}
+
+        if last_transaction_id and last_batch_id:
+            response['lastProcessedTransactionId'] = last_transaction_id
+            response['currentBatchId'] = last_batch_id
+
+        return response
+
 
 class PaymentProcessorClientFactory:
     @staticmethod
@@ -435,6 +775,7 @@ def _get_compact_payment_processor_client(self, compact_name: str) -> PaymentPro
         Get the payment processor credentials for a compact
         """
         secret_name = self._get_payment_processor_secret_name_for_compact(compact_name)
+        logger.info('Getting payment processor credentials for compact', compact_name=compact_name)
         secret = self.secrets_manager_client.get_secret_value(SecretId=secret_name)
 
         return PaymentProcessorClientFactory.create_payment_processor_client(json.loads(secret['SecretString']))
@@ -529,3 +870,43 @@ def validate_and_store_credentials(self, compact_name: str, credentials: dict) -
             )
 
         return response
+
+    def get_settled_transactions(
+        self,
+        compact: str,
+        start_time: str,
+        end_time: str,
+        transaction_limit: int,
+        last_processed_transaction_id: str = None,
+        current_batch_id: str = None,
+        processed_batch_ids: list[str] = None,
+    ) -> dict:
+        """
+        Get settled transactions from the payment processor.
+
+        :param compact: The compact name
+        :param start_time: UTC timestamp string for start of range
+        :param end_time: UTC timestamp string for end of range
+        :param transaction_limit: Maximum number of transactions to return
+        :param last_processed_transaction_id: Optional last processed transaction ID for pagination
+        :param current_batch_id: Optional current batch ID being processed
+        :param processed_batch_ids: Optional list of batch IDs that have already been processed
+        :return: Dictionary containing transaction details and optional pagination info
+        """
+        if not self.payment_processor_client:
+            self.payment_processor_client = self._get_compact_payment_processor_client(compact)
+
+        response = self.payment_processor_client.get_settled_transactions(
+            start_time=start_time,
+            end_time=end_time,
+            transaction_limit=transaction_limit,
+            last_processed_transaction_id=last_processed_transaction_id,
+            current_batch_id=current_batch_id,
+            processed_batch_ids=processed_batch_ids,
+        )
+
+        # Add compact to each transaction
+        for transaction in response['transactions']:
+            transaction['compact'] = compact
+
+        return response
diff --git a/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt b/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
index c716f9f9b..eaf0b0e15 100644
--- a/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/purchases/requirements-dev.in
 #
-boto3==1.35.87
+boto3==1.35.88
     # via moto
-botocore==1.35.87
+botocore==1.35.88
     # via
     #   boto3
     #   moto
@@ -15,7 +15,7 @@ certifi==2024.12.14
     # via requests
 cffi==1.17.1
     # via cryptography
-charset-normalizer==3.4.0
+charset-normalizer==3.4.1
     # via requests
 cryptography==44.0.0
     # via moto
@@ -33,9 +33,9 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.24
+moto[dynamodb,s3]==5.0.25
     # via -r compact-connect/lambdas/python/purchases/requirements-dev.in
-py-partiql-parser==0.5.6
+py-partiql-parser==0.6.1
     # via moto
 pycparser==2.22
     # via cffi
diff --git a/backend/compact-connect/lambdas/python/purchases/requirements.txt b/backend/compact-connect/lambdas/python/purchases/requirements.txt
index b88fcce33..67ff2f5e0 100644
--- a/backend/compact-connect/lambdas/python/purchases/requirements.txt
+++ b/backend/compact-connect/lambdas/python/purchases/requirements.txt
@@ -8,7 +8,7 @@ authorizenet==1.1.5
     # via -r compact-connect/lambdas/python/purchases/requirements.in
 certifi==2024.12.14
     # via requests
-charset-normalizer==3.4.0
+charset-normalizer==3.4.1
     # via requests
 idna==3.10
     # via requests
diff --git a/backend/compact-connect/lambdas/python/purchases/tests/__init__.py b/backend/compact-connect/lambdas/python/purchases/tests/__init__.py
index 74417b790..13fb71b2d 100644
--- a/backend/compact-connect/lambdas/python/purchases/tests/__init__.py
+++ b/backend/compact-connect/lambdas/python/purchases/tests/__init__.py
@@ -15,6 +15,7 @@ def setUpClass(cls):
                 'DEBUG': 'false',
                 'AWS_DEFAULT_REGION': 'us-east-1',
                 'COMPACT_CONFIGURATION_TABLE_NAME': 'compact-configuration-table',
+                'TRANSACTION_HISTORY_TABLE_NAME': 'transaction-history-table',
                 'COMPACTS': '["aslp", "octp", "coun"]',
                 'JURISDICTIONS': '["ne", "oh", "ky"]',
                 'ENVIRONMENT_NAME': 'test',
diff --git a/backend/compact-connect/lambdas/python/purchases/tests/function/__init__.py b/backend/compact-connect/lambdas/python/purchases/tests/function/__init__.py
index 6c6694865..964fde090 100644
--- a/backend/compact-connect/lambdas/python/purchases/tests/function/__init__.py
+++ b/backend/compact-connect/lambdas/python/purchases/tests/function/__init__.py
@@ -33,6 +33,7 @@ def setUp(self):  # noqa: N801 invalid-name
     def build_resources(self):
         self.create_compact_configuration_table()
         self.create_provider_table()
+        self.create_transaction_history_table()
 
     def create_compact_configuration_table(self):
         self._compact_configuration_table = boto3.resource('dynamodb').create_table(
@@ -45,6 +46,17 @@ def create_compact_configuration_table(self):
             BillingMode='PAY_PER_REQUEST',
         )
 
+    def create_transaction_history_table(self):
+        self._transaction_history_table = boto3.resource('dynamodb').create_table(
+            AttributeDefinitions=[
+                {'AttributeName': 'pk', 'AttributeType': 'S'},
+                {'AttributeName': 'sk', 'AttributeType': 'S'},
+            ],
+            TableName=os.environ['TRANSACTION_HISTORY_TABLE_NAME'],
+            KeySchema=[{'AttributeName': 'pk', 'KeyType': 'HASH'}, {'AttributeName': 'sk', 'KeyType': 'RANGE'}],
+            BillingMode='PAY_PER_REQUEST',
+        )
+
     def create_provider_table(self):
         self._provider_table = boto3.resource('dynamodb').create_table(
             AttributeDefinitions=[
@@ -79,6 +91,7 @@ def create_provider_table(self):
     def delete_resources(self):
         self._compact_configuration_table.delete()
         self._provider_table.delete()
+        self._transaction_history_table.delete()
 
     def _load_compact_configuration_data(self):
         """Use the canned test resources to load compact and jurisdiction information into the DB"""
diff --git a/backend/compact-connect/lambdas/python/purchases/tests/function/test_handlers/test_transaction_history.py b/backend/compact-connect/lambdas/python/purchases/tests/function/test_handlers/test_transaction_history.py
new file mode 100644
index 000000000..f36490a67
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/purchases/tests/function/test_handlers/test_transaction_history.py
@@ -0,0 +1,244 @@
+from datetime import datetime
+from unittest.mock import ANY, MagicMock, patch
+
+from moto import mock_aws
+
+from .. import TstFunction
+
+TEST_COMPACT = 'aslp'
+MOCK_START_TIME = '2024-01-01T00:00:00Z'
+MOCK_END_TIME = '2024-01-02T00:00:00Z'
+MOCK_TRANSACTION_LIMIT = 500
+
+# Test transaction data
+MOCK_TRANSACTION_ID = '12345'
+MOCK_BATCH_ID = '67890'
+MOCK_LICENSEE_ID = '89a6377e-c3a5-40e5-bca5-317ec854c570'
+MOCK_SUBMIT_TIME_UTC = '2024-01-01T12:00:00.000Z'
+MOCK_SETTLEMENT_TIME_UTC = '2024-01-01T13:00:00.000Z'
+MOCK_SETTLEMENT_TIME_LOCAL = '2024-01-01T09:00:00'
+
+# Test Pagination values
+MOCK_LAST_PROCESSED_TRANSACTION_ID = 'mock_last_processed_transaction_id'
+MOCK_CURRENT_BATCH_ID = 'mock_current_batch_id'
+MOCK_PROCESSED_BATCH_IDS = ['mock_processed_batch_id']
+
+
+def _generate_mock_transaction():
+    return {
+        'transactionId': MOCK_TRANSACTION_ID,
+        'submitTimeUTC': MOCK_SUBMIT_TIME_UTC,
+        'transactionType': 'authCaptureTransaction',
+        'transactionStatus': 'settledSuccessfully',
+        'responseCode': '1',
+        'settleAmount': '100.00',
+        'licenseeId': MOCK_LICENSEE_ID,
+        'batch': {
+            'batchId': MOCK_BATCH_ID,
+            'settlementTimeUTC': MOCK_SETTLEMENT_TIME_UTC,
+            'settlementTimeLocal': MOCK_SETTLEMENT_TIME_LOCAL,
+            'settlementState': 'settledSuccessfully',
+        },
+        'lineItems': [
+            {
+                'itemId': 'aslp-oh',
+                'name': 'Ohio Compact Privilege',
+                'description': 'Compact Privilege for Ohio',
+                'quantity': '1',
+                'unitPrice': '100.00',
+                'taxable': False,
+            }
+        ],
+        'compact': TEST_COMPACT,
+        'transactionProcessor': 'authorize.net',
+    }
+
+
+@mock_aws
+class TestProcessSettledTransactions(TstFunction):
+    """Test the process_settled_transactions Lambda function."""
+
+    def _when_testing_non_paginated_event(self, test_compact=TEST_COMPACT):
+        return {
+            'compact': test_compact,
+            'lastProcessedTransactionId': None,
+            'currentBatchId': None,
+            'processedBatchIds': None,
+        }
+
+    def _when_testing_paginated_event(self, test_compact=TEST_COMPACT):
+        return {
+            'compact': test_compact,
+            'lastProcessedTransactionId': MOCK_LAST_PROCESSED_TRANSACTION_ID,
+            'currentBatchId': MOCK_CURRENT_BATCH_ID,
+            'processedBatchIds': MOCK_PROCESSED_BATCH_IDS,
+        }
+
+    def _when_purchase_client_returns_transactions(self, mock_purchase_client_constructor, transactions=None):
+        if transactions is None:
+            transactions = [_generate_mock_transaction()]
+
+        mock_purchase_client = MagicMock()
+        mock_purchase_client_constructor.return_value = mock_purchase_client
+        mock_purchase_client.get_settled_transactions.return_value = {
+            'transactions': transactions,
+            'processedBatchIds': [MOCK_BATCH_ID],
+        }
+
+        return mock_purchase_client
+
+    def _when_purchase_client_returns_paginated_transactions(self, mock_purchase_client_constructor):
+        mock_purchase_client = MagicMock()
+        mock_purchase_client_constructor.return_value = mock_purchase_client
+
+        # First call returns first page with pagination info
+        mock_purchase_client.get_settled_transactions.side_effect = [
+            {
+                'transactions': [_generate_mock_transaction()],
+                'processedBatchIds': [MOCK_BATCH_ID],
+                'lastProcessedTransactionId': MOCK_LAST_PROCESSED_TRANSACTION_ID,
+                'currentBatchId': MOCK_CURRENT_BATCH_ID,
+            },
+            # Second call returns final page
+            {'transactions': [_generate_mock_transaction()], 'processedBatchIds': [MOCK_BATCH_ID]},
+        ]
+
+        return mock_purchase_client
+
+    @patch('handlers.transaction_history.PurchaseClient')
+    def test_process_settled_transactions_returns_complete_status(self, mock_purchase_client_constructor):
+        """Test successful processing of settled transactions."""
+        from handlers.transaction_history import process_settled_transactions
+
+        self._when_purchase_client_returns_transactions(mock_purchase_client_constructor)
+        event = self._when_testing_non_paginated_event()
+        resp = process_settled_transactions(event, self.mock_context)
+
+        self.assertEqual({'compact': 'aslp', 'processedBatchIds': [MOCK_BATCH_ID], 'status': 'COMPLETE'}, resp)
+
+    @patch('handlers.transaction_history.PurchaseClient')
+    def test_process_settled_transactions_passes_pagination_values_into_purchase_client(
+        self, mock_purchase_client_constructor
+    ):
+        """Test handling of paginated transaction results."""
+        from handlers.transaction_history import process_settled_transactions
+
+        mock_purchase_client = self._when_purchase_client_returns_paginated_transactions(
+            mock_purchase_client_constructor
+        )
+        event = self._when_testing_paginated_event()
+
+        process_settled_transactions(event, self.mock_context)
+
+        mock_purchase_client.get_settled_transactions.assert_called_with(
+            compact=TEST_COMPACT,
+            # timestamp check handled in another test
+            start_time=ANY,
+            end_time=ANY,
+            transaction_limit=500,
+            last_processed_transaction_id=MOCK_LAST_PROCESSED_TRANSACTION_ID,
+            current_batch_id=MOCK_CURRENT_BATCH_ID,
+            processed_batch_ids=MOCK_PROCESSED_BATCH_IDS,
+        )
+
+    @patch('handlers.transaction_history.PurchaseClient')
+    def test_process_settled_transactions_stores_transactions_in_dynamodb(self, mock_purchase_client_constructor):
+        """Test that transactions are stored in DynamoDB."""
+        from handlers.transaction_history import process_settled_transactions
+
+        self._when_purchase_client_returns_transactions(mock_purchase_client_constructor)
+        event = self._when_testing_non_paginated_event()
+
+        process_settled_transactions(event, self.mock_context)
+
+        # Verify transactions were stored in DynamoDB
+        stored_transactions = self.config.transaction_history_table.query(
+            KeyConditionExpression='pk = :pk',
+            ExpressionAttributeValues={':pk': f'COMPACT#{TEST_COMPACT}#TRANSACTIONS#MONTH#2024-01'},
+        )
+
+        expected_epoch_timestamp = int(datetime.fromisoformat(MOCK_SETTLEMENT_TIME_UTC).timestamp())
+        self.assertEqual(
+            [
+                {
+                    'batch': {
+                        'batchId': MOCK_BATCH_ID,
+                        'settlementState': 'settledSuccessfully',
+                        'settlementTimeLocal': '2024-01-01T09:00:00',
+                        'settlementTimeUTC': '2024-01-01T13:00:00.000Z',
+                    },
+                    'compact': TEST_COMPACT,
+                    'licenseeId': MOCK_LICENSEE_ID,
+                    'lineItems': [
+                        {
+                            'description': 'Compact Privilege for Ohio',
+                            'itemId': 'aslp-oh',
+                            'name': 'Ohio Compact Privilege',
+                            'quantity': '1',
+                            'taxable': False,
+                            'unitPrice': '100.00',
+                        }
+                    ],
+                    'pk': f'COMPACT#{TEST_COMPACT}#TRANSACTIONS#MONTH#2024-01',
+                    'responseCode': '1',
+                    'settleAmount': '100.00',
+                    'sk': f'COMPACT#{TEST_COMPACT}#TIME#{expected_epoch_timestamp}#BATCH#{MOCK_BATCH_ID}#'
+                    f'TX#{MOCK_TRANSACTION_ID}',
+                    'submitTimeUTC': MOCK_SUBMIT_TIME_UTC,
+                    'transactionId': MOCK_TRANSACTION_ID,
+                    'transactionStatus': 'settledSuccessfully',
+                    'transactionType': 'authCaptureTransaction',
+                    'transactionProcessor': 'authorize.net',
+                }
+            ],
+            stored_transactions['Items'],
+        )
+
+    @patch('handlers.transaction_history.PurchaseClient')
+    def test_process_settled_transactions_returns_in_progress_status_with_pagination_values(
+        self, mock_purchase_client_constructor
+    ):
+        """Test that method returns IN_PROGRESS status with pagination values when more transactions are available."""
+        from handlers.transaction_history import process_settled_transactions
+
+        self._when_purchase_client_returns_paginated_transactions(
+            mock_purchase_client_constructor
+        )
+
+        event = self._when_testing_non_paginated_event()
+        resp = process_settled_transactions(event, self.mock_context)
+
+        self.assertEqual(
+            {
+                'compact': TEST_COMPACT,
+                'status': 'IN_PROGRESS',
+                'lastProcessedTransactionId': MOCK_LAST_PROCESSED_TRANSACTION_ID,
+                'currentBatchId': MOCK_CURRENT_BATCH_ID,
+                'processedBatchIds': [MOCK_BATCH_ID],
+            },
+            resp,
+        )
+
+    @patch('handlers.transaction_history.PurchaseClient')
+    def test_process_settled_transactions_returns_batch_failure_status(self, mock_purchase_client_constructor):
+        """Test that method returns BATCH_FAILURE status when a batch settlement error is encountered."""
+        from cc_common.exceptions import TransactionBatchSettlementFailureException
+        from handlers.transaction_history import process_settled_transactions
+
+        mock_purchase_client = MagicMock()
+        mock_purchase_client_constructor.return_value = mock_purchase_client
+        mock_purchase_client.get_settled_transactions.side_effect = TransactionBatchSettlementFailureException(
+            f'Settlement error in batch {MOCK_BATCH_ID}'
+        )
+
+        event = self._when_testing_non_paginated_event()
+        resp = process_settled_transactions(event, self.mock_context)
+
+        self.assertEqual(
+            {
+                'status': 'BATCH_FAILURE',
+                'compact': TEST_COMPACT,
+                'batchFailureErrorMessage': f'Settlement error in batch {MOCK_BATCH_ID}',
+            },
+            resp,
+        )
diff --git a/backend/compact-connect/lambdas/python/purchases/tests/unit/test_purchase_client.py b/backend/compact-connect/lambdas/python/purchases/tests/unit/test_purchase_client.py
index 1a288a594..0bcd68c95 100644
--- a/backend/compact-connect/lambdas/python/purchases/tests/unit/test_purchase_client.py
+++ b/backend/compact-connect/lambdas/python/purchases/tests/unit/test_purchase_client.py
@@ -22,6 +22,33 @@
 
 EXPECTED_TOTAL_FEE_AMOUNT = 150.50
 
+# Test constants for transaction history tests
+MOCK_BATCH_ID = '12345'
+MOCK_BATCH_ID_2 = '12346'
+MOCK_PROCESSED_BATCH_ID = '12344'
+MOCK_PREVIOUS_TRANSACTION_ID = '67889'
+MOCK_ITEM_ID = 'ITEM001'
+MOCK_ITEM_NAME = 'Test Item'
+MOCK_ITEM_DESCRIPTION = 'Test Description'
+MOCK_ITEM_QUANTITY = '1'
+MOCK_ITEM_PRICE = '10.00'
+
+# these transaction ids must be numeric to match the authorize.net SDK response
+MOCK_TRANSACTION_ID_1_BATCH_1 = '11'
+MOCK_TRANSACTION_ID_1_BATCH_2 = '12'
+MOCK_TRANSACTION_ID_2_BATCH_2 = '22'
+
+# Test constants for transaction states and types
+SUCCESSFUL_RESULT_CODE = 'Ok'
+SUCCESSFUL_SETTLED_STATE = 'settledSuccessfully'
+AUTH_CAPTURE_TRANSACTION_TYPE = 'authCaptureTransaction'
+
+# Test timestamps
+MOCK_SETTLEMENT_TIME_UTC = '2024-12-27T17:49:20.757Z'
+MOCK_SETTLEMENT_TIME_LOCAL = '2024-12-27T13:49:20.757'
+MOCK_SETTLEMENT_TIME_UTC_2 = '2024-12-26T15:15:20.007Z'
+MOCK_SETTLEMENT_TIME_LOCAL_2 = '2024-12-26T11:15:20.007Z'
+
 
 def json_to_magic_mock(json_obj):
     """
@@ -592,3 +619,256 @@ def test_purchase_client_raises_exception_if_invalid_credentials(self, mock_get_
             )
 
         self.assertIn('Failed to verify credentials', str(context.exception.message))
+
+    def _when_authorize_dot_net_batch_list_is_successful(self, mock_controller):
+        mock_response = {
+            'messages': {
+                'resultCode': SUCCESSFUL_RESULT_CODE,
+            },
+            'batchList': {
+                'batch': [
+                    {
+                        'batchId': MOCK_BATCH_ID,
+                        'settlementTimeUTC': MOCK_SETTLEMENT_TIME_UTC,
+                        'settlementTimeLocal': MOCK_SETTLEMENT_TIME_LOCAL,
+                        'settlementState': SUCCESSFUL_SETTLED_STATE,
+                    }
+                ]
+            },
+        }
+        return self._setup_mock_transaction_controller(mock_controller, mock_response)
+
+    def _when_authorize_dot_net_transaction_list_is_successful(self, mock_controller):
+        mock_response = {
+            'messages': {
+                'resultCode': SUCCESSFUL_RESULT_CODE,
+            },
+            'transactions': {
+                'transaction': [
+                    {
+                        'transId': MOCK_TRANSACTION_ID,
+                        'transactionStatus': SUCCESSFUL_SETTLED_STATE,
+                    }
+                ]
+            },
+            'totalNumInResultSet': 1,
+        }
+        return self._setup_mock_transaction_controller(mock_controller, mock_response)
+
+    def _generate_mock_transaction_list_response(self, transaction_ids: list[str]):
+        return {
+            'messages': {
+                'resultCode': SUCCESSFUL_RESULT_CODE,
+            },
+            'transactions': {
+                'transaction': [
+                    {
+                        'transId': transaction_id,
+                        'transactionStatus': SUCCESSFUL_SETTLED_STATE,
+                    }
+                    for transaction_id in transaction_ids
+                ]
+            },
+            'totalNumInResultSet': 1,
+        }
+
+    def _generate_mock_transaction_detail_response(self, transaction_id: str):
+        return {
+            'messages': {
+                'resultCode': SUCCESSFUL_RESULT_CODE,
+            },
+            'transaction': {
+                'transId': transaction_id,
+                'submitTimeUTC': MOCK_SETTLEMENT_TIME_UTC,
+                'transactionType': AUTH_CAPTURE_TRANSACTION_TYPE,
+                'transactionStatus': SUCCESSFUL_SETTLED_STATE,
+                'responseCode': '1',
+                'settleAmount': MOCK_ITEM_PRICE,
+                'order': {'description': f'LICENSEE#{MOCK_LICENSEE_ID}#'},
+                'lineItems': {
+                    'lineItem': [
+                        {
+                            'itemId': MOCK_ITEM_ID,
+                            'name': MOCK_ITEM_NAME,
+                            'description': MOCK_ITEM_DESCRIPTION,
+                            'quantity': MOCK_ITEM_QUANTITY,
+                            'unitPrice': MOCK_ITEM_PRICE,
+                            'taxable': 'false',
+                        }
+                    ]
+                },
+            },
+        }
+
+    def _when_authorize_dot_net_transaction_details_are_successful(self, mock_controller):
+        mock_response = self._generate_mock_transaction_detail_response(MOCK_TRANSACTION_ID)
+        return self._setup_mock_transaction_controller(mock_controller, mock_response)
+
+    @patch('purchase_client.getSettledBatchListController')
+    @patch('purchase_client.getTransactionListController')
+    @patch('purchase_client.getTransactionDetailsController')
+    def test_purchase_client_gets_settled_transactions_successfully(
+        self,
+        mock_details_controller,
+        mock_transaction_controller,
+        mock_batch_controller,
+    ):
+        from purchase_client import PurchaseClient
+
+        mock_secrets_manager_client = self._generate_mock_secrets_manager_client()
+        self._when_authorize_dot_net_batch_list_is_successful(mock_batch_controller)
+        self._when_authorize_dot_net_transaction_list_is_successful(mock_transaction_controller)
+        self._when_authorize_dot_net_transaction_details_are_successful(mock_details_controller)
+
+        test_purchase_client = PurchaseClient(secrets_manager_client=mock_secrets_manager_client)
+        response = test_purchase_client.get_settled_transactions(
+            compact='aslp',
+            start_time='2024-01-01T00:00:00Z',
+            end_time='2024-01-02T00:00:00Z',
+            transaction_limit=500,
+        )
+
+        # Verify response structure
+        self.assertIn('transactions', response)
+        self.assertEqual(len(response['transactions']), 1)
+        self.assertIn('processedBatchIds', response)
+        self.assertEqual(len(response['processedBatchIds']), 1)
+
+        # Verify transaction data
+        transaction = response['transactions'][0]
+        self.assertEqual(transaction['transactionId'], MOCK_TRANSACTION_ID)
+        self.assertEqual(transaction['compact'], 'aslp')
+        self.assertEqual(transaction['licenseeId'], MOCK_LICENSEE_ID)
+        self.assertEqual(transaction['batch']['batchId'], MOCK_BATCH_ID)
+        self.assertEqual(len(transaction['lineItems']), 1)
+
+    @patch('purchase_client.getSettledBatchListController')
+    @patch('purchase_client.getTransactionListController')
+    @patch('purchase_client.getTransactionDetailsController')
+    def test_purchase_client_handles_pagination_for_settled_transactions(
+        self,
+        mock_details_controller,
+        mock_transaction_controller,
+        mock_batch_controller,
+    ):
+        from purchase_client import PurchaseClient
+
+        mock_secrets_manager_client = self._generate_mock_secrets_manager_client()
+
+        # Setup multiple batches
+        mock_batch_response = json_to_magic_mock(
+            {
+                'messages': {
+                    'resultCode': SUCCESSFUL_RESULT_CODE,
+                },
+                'batchList': {
+                    'batch': [
+                        {
+                            'batchId': MOCK_BATCH_ID,
+                            'settlementTimeUTC': MOCK_SETTLEMENT_TIME_UTC,
+                            'settlementTimeLocal': MOCK_SETTLEMENT_TIME_LOCAL,
+                            'settlementState': SUCCESSFUL_SETTLED_STATE,
+                        },
+                        {
+                            'batchId': MOCK_BATCH_ID_2,
+                            'settlementTimeUTC': MOCK_SETTLEMENT_TIME_UTC_2,
+                            'settlementTimeLocal': MOCK_SETTLEMENT_TIME_LOCAL_2,
+                            'settlementState': SUCCESSFUL_SETTLED_STATE,
+                        },
+                    ]
+                },
+            }
+        )
+        mock_batch_controller.return_value.getresponse.return_value = mock_batch_response
+
+        mock_transaction_list_responses = [
+            # first batch returns one transaction
+            json_to_magic_mock(self._generate_mock_transaction_list_response([MOCK_TRANSACTION_ID_1_BATCH_1])),
+            # second api call returns two transactions from second call
+            json_to_magic_mock(
+                self._generate_mock_transaction_list_response(
+                    [MOCK_TRANSACTION_ID_1_BATCH_2, MOCK_TRANSACTION_ID_2_BATCH_2]
+                )
+            ),
+            # third api call should be called for second batch again to process remaining transactions,
+            # with same transaction list returned
+            json_to_magic_mock(
+                self._generate_mock_transaction_list_response(
+                    [MOCK_TRANSACTION_ID_1_BATCH_2, MOCK_TRANSACTION_ID_2_BATCH_2]
+                )
+            ),
+        ]
+        mock_transaction_controller.return_value.getresponse.side_effect = mock_transaction_list_responses
+
+        mock_details_responses = [
+            json_to_magic_mock(self._generate_mock_transaction_detail_response(MOCK_TRANSACTION_ID_1_BATCH_1)),
+            json_to_magic_mock(self._generate_mock_transaction_detail_response(MOCK_TRANSACTION_ID_1_BATCH_2)),
+            json_to_magic_mock(self._generate_mock_transaction_detail_response(MOCK_TRANSACTION_ID_2_BATCH_2)),
+        ]
+        mock_details_controller.return_value.getresponse.side_effect = mock_details_responses
+
+        test_purchase_client = PurchaseClient(secrets_manager_client=mock_secrets_manager_client)
+        response = test_purchase_client.get_settled_transactions(
+            compact='aslp',
+            start_time='2024-01-01T00:00:00Z',
+            end_time='2024-01-02T00:00:00Z',
+            transaction_limit=2,
+        )
+
+        # Verify pagination info is returned
+        self.assertEqual(MOCK_TRANSACTION_ID_1_BATCH_2, response['lastProcessedTransactionId'])
+        self.assertEqual(MOCK_BATCH_ID_2, response['currentBatchId'])
+        self.assertEqual([MOCK_BATCH_ID], response['processedBatchIds'])
+        # Verify transaction data
+        self.assertEqual(2, len(response['transactions']))
+        self.assertEqual(response['transactions'][0]['transactionId'], MOCK_TRANSACTION_ID_1_BATCH_1)
+        self.assertEqual(response['transactions'][1]['transactionId'], MOCK_TRANSACTION_ID_1_BATCH_2)
+
+        # now fetch the remaining results
+        response = test_purchase_client.get_settled_transactions(
+            compact='aslp',
+            start_time='2024-01-01T00:00:00Z',
+            end_time='2024-01-02T00:00:00Z',
+            transaction_limit=2,
+            last_processed_transaction_id=response['lastProcessedTransactionId'],
+            current_batch_id=response['currentBatchId'],
+            processed_batch_ids=response['processedBatchIds'],
+        )
+
+        # Verify no pagination info is returned
+        self.assertNotIn('lastProcessedTransactionId', response)
+        self.assertNotIn('currentBatchId', response)
+
+        # assert that the second transaction is returned, the first being skipped
+        self.assertEqual([MOCK_BATCH_ID, MOCK_BATCH_ID_2], response['processedBatchIds'])
+        self.assertEqual(1, len(response['transactions']))
+        self.assertEqual(MOCK_TRANSACTION_ID_2_BATCH_2, response['transactions'][0]['transactionId'])
+
+    @patch('purchase_client.getSettledBatchListController')
+    def test_purchase_client_handles_no_batches_for_settled_transactions(self, mock_batch_controller):
+        from purchase_client import PurchaseClient
+
+        mock_secrets_manager_client = self._generate_mock_secrets_manager_client()
+
+        # Return empty batch list
+        mock_response = json_to_magic_mock(
+            {
+                'messages': {
+                    'resultCode': SUCCESSFUL_RESULT_CODE,
+                },
+                'batchList': {'batch': []},
+            }
+        )
+        mock_batch_controller.return_value.getresponse.return_value = mock_response
+
+        test_purchase_client = PurchaseClient(secrets_manager_client=mock_secrets_manager_client)
+        response = test_purchase_client.get_settled_transactions(
+            compact='aslp',
+            start_time='2024-01-01T00:00:00Z',
+            end_time='2024-01-02T00:00:00Z',
+            transaction_limit=500,
+        )
+
+        # Verify empty response is returned when no batches exist
+        self.assertEqual(len(response['transactions']), 0)
+        self.assertEqual(len(response['processedBatchIds']), 0)
diff --git a/backend/compact-connect/lambdas/python/staff-user-pre-token/.coveragerc b/backend/compact-connect/lambdas/python/staff-user-pre-token/.coveragerc
index 99c409d65..193e8ec8a 100644
--- a/backend/compact-connect/lambdas/python/staff-user-pre-token/.coveragerc
+++ b/backend/compact-connect/lambdas/python/staff-user-pre-token/.coveragerc
@@ -1,5 +1,5 @@
 [run]
-data_file = ../../../.coverage
+data_file = ../../../../.coverage
 
 omit =
   */cdk.out/*
diff --git a/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt b/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt
index 98494f3b7..59c66d880 100644
--- a/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.in
 #
-boto3==1.35.87
+boto3==1.35.88
     # via moto
-botocore==1.35.87
+botocore==1.35.88
     # via
     #   boto3
     #   moto
@@ -15,7 +15,7 @@ certifi==2024.12.14
     # via requests
 cffi==1.17.1
     # via cryptography
-charset-normalizer==3.4.0
+charset-normalizer==3.4.1
     # via requests
 cryptography==44.0.0
     # via moto
@@ -33,9 +33,9 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.24
+moto[dynamodb,s3]==5.0.25
     # via -r compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.in
-py-partiql-parser==0.5.6
+py-partiql-parser==0.6.1
     # via moto
 pycparser==2.22
     # via cffi
diff --git a/backend/compact-connect/lambdas/python/staff-users/.coveragerc b/backend/compact-connect/lambdas/python/staff-users/.coveragerc
index 99c409d65..193e8ec8a 100644
--- a/backend/compact-connect/lambdas/python/staff-users/.coveragerc
+++ b/backend/compact-connect/lambdas/python/staff-users/.coveragerc
@@ -1,5 +1,5 @@
 [run]
-data_file = ../../../.coverage
+data_file = ../../../../.coverage
 
 omit =
   */cdk.out/*
diff --git a/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt b/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt
index 94812d8a0..8bdda48cb 100644
--- a/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/staff-users/requirements-dev.in
 #
-boto3==1.35.87
+boto3==1.35.88
     # via moto
-botocore==1.35.87
+botocore==1.35.88
     # via
     #   boto3
     #   moto
@@ -15,7 +15,7 @@ certifi==2024.12.14
     # via requests
 cffi==1.17.1
     # via cryptography
-charset-normalizer==3.4.0
+charset-normalizer==3.4.1
     # via requests
 cryptography==44.0.0
     # via
@@ -39,9 +39,9 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[cognitoidp,dynamodb,s3]==5.0.24
+moto[cognitoidp,dynamodb,s3]==5.0.25
     # via -r compact-connect/lambdas/python/staff-users/requirements-dev.in
-py-partiql-parser==0.5.6
+py-partiql-parser==0.6.1
     # via moto
 pycparser==2.22
     # via cffi
diff --git a/backend/compact-connect/lambdas/python/staff-users/tests/function/__init__.py b/backend/compact-connect/lambdas/python/staff-users/tests/function/__init__.py
index 5135f275c..3ae4e091c 100644
--- a/backend/compact-connect/lambdas/python/staff-users/tests/function/__init__.py
+++ b/backend/compact-connect/lambdas/python/staff-users/tests/function/__init__.py
@@ -71,7 +71,7 @@ def delete_resources(self):
         cognito_client.delete_user_pool(UserPoolId=self._user_pool_id)
 
     def _load_user_data(self) -> str:
-        with open('tests/resources/dynamo/user.json') as f:
+        with open('../common/tests/resources/dynamo/user.json') as f:
             # This item is saved in its serialized form, so we have to deserialize it first
             item = TypeDeserializer().deserialize({'M': json.load(f)})
 
diff --git a/backend/compact-connect/lambdas/python/staff-users/tests/function/test_data_model/__init__.py b/backend/compact-connect/lambdas/python/staff-users/tests/function/test_data_model/__init__.py
deleted file mode 100644
index e69de29bb..000000000
diff --git a/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_data_model/test_paginated.py b/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_data_model/test_paginated.py
index e9c1cfb1b..789cdff15 100644
--- a/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_data_model/test_paginated.py
+++ b/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_data_model/test_paginated.py
@@ -10,7 +10,7 @@
 
 class TestPaginated(TstLambdas):
     def setUp(self):  # noqa: N801 invalid-name
-        with open('tests/resources/dynamo/user.json') as f:
+        with open('../common/tests/resources/dynamo/user.json') as f:
             self._item = TypeDeserializer().deserialize({'M': json.load(f)})
 
     def test_pagination_parameters(self):
diff --git a/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_data_model/test_schema/test_user.py b/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_data_model/test_schema/test_user.py
index 46a345a72..8d03a6380 100644
--- a/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_data_model/test_schema/test_user.py
+++ b/backend/compact-connect/lambdas/python/staff-users/tests/unit/test_data_model/test_schema/test_user.py
@@ -13,7 +13,7 @@ def test_transform_api_to_dynamo_permissions(self):
         with open('tests/resources/api/user-post.json') as f:
             api_user = json.load(f)
 
-        with open('tests/resources/dynamo/user.json') as f:
+        with open('../common/tests/resources/dynamo/user.json') as f:
             dynamo_user = TypeDeserializer().deserialize({'M': json.load(f)})
 
         schema = UserAPISchema()
@@ -30,7 +30,7 @@ def test_transform_dynamo_to_api_permissions(self):
         with open('tests/resources/api/user-post.json') as f:
             api_user = json.load(f)
 
-        with open('tests/resources/dynamo/user.json') as f:
+        with open('../common/tests/resources/dynamo/user.json') as f:
             dynamo_user = UserRecordSchema().load(TypeDeserializer().deserialize({'M': json.load(f)}))
 
         schema = UserAPISchema()
@@ -45,7 +45,7 @@ def test_serde_record(self):
         """Test round-trip serialization/deserialization of user records"""
         from cc_common.data_model.schema.user import UserRecordSchema
 
-        with open('tests/resources/dynamo/user.json') as f:
+        with open('../common/tests/resources/dynamo/user.json') as f:
             expected_user = TypeDeserializer().deserialize({'M': json.load(f)})
 
         schema = UserRecordSchema()
@@ -60,7 +60,7 @@ def test_serde_record(self):
     def test_invalid_record(self):
         from cc_common.data_model.schema.user import UserRecordSchema
 
-        with open('tests/resources/dynamo/user.json') as f:
+        with open('../common/tests/resources/dynamo/user.json') as f:
             user_data = TypeDeserializer().deserialize({'M': json.load(f)})
         user_data.pop('attributes')
 
diff --git a/backend/compact-connect/pipeline/backend_stage.py b/backend/compact-connect/pipeline/backend_stage.py
index 1b31027f7..d682c9cfd 100644
--- a/backend/compact-connect/pipeline/backend_stage.py
+++ b/backend/compact-connect/pipeline/backend_stage.py
@@ -5,6 +5,7 @@
 from stacks.ingest_stack import IngestStack
 from stacks.persistent_stack import PersistentStack
 from stacks.reporting_stack import ReportingStack
+from stacks.transaction_monitoring_stack import TransactionMonitoringStack
 from stacks.ui_stack import UIStack
 
 
@@ -76,3 +77,13 @@ def __init__(
                 standard_tags=standard_tags,
                 persistent_stack=self.persistent_stack,
             )
+
+        self.transaction_monitoring_stack = TransactionMonitoringStack(
+            self,
+            'TransactionMonitoringStack',
+            env=environment,
+            environment_name=environment_name,
+            environment_context=environment_context,
+            standard_tags=standard_tags,
+            persistent_stack=self.persistent_stack,
+        )
diff --git a/backend/compact-connect/requirements-dev.txt b/backend/compact-connect/requirements-dev.txt
index 8f285a0ad..239bc25b4 100644
--- a/backend/compact-connect/requirements-dev.txt
+++ b/backend/compact-connect/requirements-dev.txt
@@ -14,11 +14,11 @@ cachecontrol[filecache]==0.14.1
     #   pip-audit
 certifi==2024.12.14
     # via requests
-charset-normalizer==3.4.0
+charset-normalizer==3.4.1
     # via requests
 click==8.1.8
     # via pip-tools
-coverage[toml]==7.6.9
+coverage[toml]==7.6.10
     # via
     #   -r compact-connect/requirements-dev.in
     #   pytest-cov
diff --git a/backend/compact-connect/requirements.txt b/backend/compact-connect/requirements.txt
index 5ea2259a4..abaf6f803 100644
--- a/backend/compact-connect/requirements.txt
+++ b/backend/compact-connect/requirements.txt
@@ -14,11 +14,11 @@ aws-cdk-asset-kubectl-v20==2.1.3
     # via aws-cdk-lib
 aws-cdk-asset-node-proxy-agent-v6==2.1.0
     # via aws-cdk-lib
-aws-cdk-aws-lambda-python-alpha==2.173.2a0
+aws-cdk-aws-lambda-python-alpha==2.173.4a0
     # via -r compact-connect/requirements.in
 aws-cdk-cloud-assembly-schema==38.0.1
     # via aws-cdk-lib
-aws-cdk-lib==2.173.2
+aws-cdk-lib==2.173.4
     # via
     #   -r compact-connect/requirements.in
     #   aws-cdk-aws-lambda-python-alpha
diff --git a/backend/compact-connect/stacks/persistent_stack/__init__.py b/backend/compact-connect/stacks/persistent_stack/__init__.py
index 1d091dc23..99b4d05ad 100644
--- a/backend/compact-connect/stacks/persistent_stack/__init__.py
+++ b/backend/compact-connect/stacks/persistent_stack/__init__.py
@@ -1,12 +1,15 @@
 import os
 
-from aws_cdk import RemovalPolicy, aws_ssm
+from aws_cdk import Duration, RemovalPolicy, aws_ssm
 from aws_cdk.aws_cognito import UserPoolEmail
+from aws_cdk.aws_iam import Effect, PolicyStatement
 from aws_cdk.aws_kms import Key
 from aws_cdk.aws_lambda import Runtime
 from aws_cdk.aws_lambda_python_alpha import PythonLayerVersion
+from cdk_nag import NagSuppressions
 from common_constructs.access_logs_bucket import AccessLogsBucket
 from common_constructs.alarm_topic import AlarmTopic
+from common_constructs.nodejs_function import NodejsFunction
 from common_constructs.python_function import COMMON_PYTHON_LAMBDA_LAYER_SSM_PARAMETER_NAME
 from common_constructs.security_profile import SecurityProfile
 from common_constructs.stack import AppStack
@@ -23,6 +26,7 @@
 from stacks.persistent_stack.provider_users_bucket import ProviderUsersBucket
 from stacks.persistent_stack.ssn_table import SSNTable
 from stacks.persistent_stack.staff_users import StaffUsers
+from stacks.persistent_stack.transaction_history_table import TransactionHistoryTable
 from stacks.persistent_stack.user_email_notifications import UserEmailNotifications
 
 
@@ -131,6 +135,8 @@ def __init__(
             # if domain name is not provided, use the default cognito email settings
             user_pool_email_settings = UserPoolEmail.with_cognito()
 
+        self._create_email_notification_service(environment_name)
+
         security_profile = SecurityProfile[environment_context.get('security_profile', 'RECOMMENDED')]
         staff_prefix = f'{app_name}-staff'
 
@@ -224,8 +230,8 @@ def _add_data_resources(self, removal_policy: RemovalPolicy):
         self.ssn_table = SSNTable(self, 'SSNTable', removal_policy=removal_policy)
 
         self.data_event_table = DataEventTable(
-            self,
-            'DataEventTable',
+            scope=self,
+            construct_id='DataEventTable',
             encryption_key=self.shared_encryption_key,
             event_bus=self.data_event_bus,
             alarm_topic=self.alarm_topic,
@@ -233,7 +239,17 @@ def _add_data_resources(self, removal_policy: RemovalPolicy):
         )
 
         self.compact_configuration_table = CompactConfigurationTable(
-            self, 'CompactConfigurationTable', encryption_key=self.shared_encryption_key, removal_policy=removal_policy
+            scope=self,
+            construct_id='CompactConfigurationTable',
+            encryption_key=self.shared_encryption_key,
+            removal_policy=removal_policy,
+        )
+
+        self.transaction_history_table = TransactionHistoryTable(
+            scope=self,
+            construct_id='TransactionHistoryTable',
+            encryption_key=self.shared_encryption_key,
+            removal_policy=removal_policy,
         )
 
         # bucket for holding documentation for providers
@@ -245,3 +261,109 @@ def _add_data_resources(self, removal_policy: RemovalPolicy):
             provider_table=self.provider_table,
             removal_policy=removal_policy,
         )
+
+    def _create_email_notification_service(self, environment_name: str) -> None:
+        """This lambda is intended to be a general purpose email notification service.
+
+        It can be invoked directly to send an email if the lambda is deployed in an environment that has a domain name.
+        If the lambda is deployed in an environment that does not have a domain name, it will perform a no-op as there
+        is no FROM address to use.
+        """
+        # If there is no hosted zone, we don't have a domain name to send from
+        # so we'll use a placeholder value which will cause the lambda to perform a no-op
+        from_address = 'NONE'
+        if self.hosted_zone:
+            from_address = f'noreply@{self.user_email_notifications.email_identity.email_identity_name}'
+
+        self.email_notification_service_lambda = NodejsFunction(
+            self,
+            'EmailNotificationService',
+            description='Generic email notification service',
+            lambda_dir='email-notification-service',
+            handler='sendEmail',
+            timeout=Duration.minutes(5),
+            memory_size=1024,
+            environment={
+                'FROM_ADDRESS': from_address,
+                'COMPACT_CONFIGURATION_TABLE_NAME': self.compact_configuration_table.table_name,
+                'UI_BASE_PATH_URL': self._get_ui_base_path_url(),
+                'ENVIRONMENT_NAME': environment_name,
+                **self.common_env_vars,
+            },
+        )
+
+        # Grant permissions to read compact configurations
+        self.compact_configuration_table.grant_read_data(self.email_notification_service_lambda)
+        # if there is no domain name, we can't set up SES permissions
+        # in this case the lambda will perform a no-op when invoked.
+        if self.hosted_zone:
+            self.setup_ses_permissions_for_lambda(self.email_notification_service_lambda)
+
+        NagSuppressions.add_resource_suppressions_by_path(
+            self,
+            f'{self.email_notification_service_lambda.node.path}/ServiceRole/DefaultPolicy/Resource',
+            suppressions=[
+                {
+                    'id': 'AwsSolutions-IAM5',
+                    'reason': """
+                              This policy contains wild-carded actions and resources but they are scoped to the
+                              specific actions, Table, and Email Identity that this lambda specifically needs access to.
+                              """,
+                },
+            ],
+        )
+
+    def setup_ses_permissions_for_lambda(self, lambda_function: NodejsFunction):
+        """Used to allow a lambda to send emails using the user email notification SES identity."""
+        ses_resources = [
+            self.user_email_notifications.email_identity.email_identity_arn,
+            self.format_arn(
+                partition=self.partition,
+                service='ses',
+                region=self.region,
+                account=self.account,
+                resource='configuration-set',
+                resource_name=self.user_email_notifications.config_set.configuration_set_name,
+            ),
+        ]
+
+        # We'll assume that, if it is a sandbox environment, they're in the Simple Email Service (SES) sandbox
+        if self.node.try_get_context('sandbox'):
+            # SES Sandboxed accounts require that the sending principal also be explicitly granted permission to send
+            # emails to the SES identity they configured for testing. Because we don't know that identity in advance,
+            # we'll have to allow the principal to use any SES identity configured in the account.
+            # arn:aws:ses:{region}:{account}:identity/*
+            ses_resources.append(
+                self.format_arn(
+                    partition=self.partition,
+                    service='ses',
+                    region=self.region,
+                    account=self.account,
+                    resource='identity',
+                    resource_name='*',
+                ),
+            )
+
+        lambda_function.role.add_to_principal_policy(
+            PolicyStatement(
+                actions=['ses:SendEmail', 'ses:SendRawEmail'],
+                resources=ses_resources,
+                effect=Effect.ALLOW,
+                conditions={
+                    # To mitigate the pretty open resources section for sandbox environments, we'll restrict the use of
+                    # this action by specifying what From address and display name the principal must use.
+                    'StringEquals': {
+                        'ses:FromAddress': f'noreply@{self.user_email_notifications.email_identity.email_identity_name}',  # noqa: E501 line too long
+                        'ses:FromDisplayName': 'Compact Connect',
+                    }
+                },
+            )
+        )
+
+    def _get_ui_base_path_url(self) -> str:
+        """Returns the base URL for the UI."""
+        if self.ui_domain_name is not None:
+            return f'https://{self.ui_domain_name}'
+
+        # default to csg test environment
+        return 'https://app.test.compactconnect.org'
diff --git a/backend/compact-connect/stacks/persistent_stack/transaction_history_table.py b/backend/compact-connect/stacks/persistent_stack/transaction_history_table.py
new file mode 100644
index 000000000..d743f4477
--- /dev/null
+++ b/backend/compact-connect/stacks/persistent_stack/transaction_history_table.py
@@ -0,0 +1,41 @@
+from aws_cdk import RemovalPolicy
+from aws_cdk.aws_dynamodb import Attribute, AttributeType, BillingMode, Table, TableEncryption
+from aws_cdk.aws_kms import IKey
+from cdk_nag import NagSuppressions
+from constructs import Construct
+
+
+class TransactionHistoryTable(Table):
+    """DynamoDB table to house transaction history data"""
+
+    def __init__(
+        self,
+        scope: Construct,
+        construct_id: str,
+        *,
+        encryption_key: IKey,
+        removal_policy: RemovalPolicy,
+        **kwargs,
+    ):
+        super().__init__(
+            scope,
+            construct_id,
+            encryption=TableEncryption.CUSTOMER_MANAGED,
+            encryption_key=encryption_key,
+            billing_mode=BillingMode.PAY_PER_REQUEST,
+            removal_policy=removal_policy,
+            point_in_time_recovery=True,
+            partition_key=Attribute(name='pk', type=AttributeType.STRING),
+            sort_key=Attribute(name='sk', type=AttributeType.STRING),
+            **kwargs,
+        )
+        NagSuppressions.add_resource_suppressions(
+            self,
+            suppressions=[
+                {
+                    'id': 'HIPAA.Security-DynamoDBInBackupPlan',
+                    'reason': 'We will implement data back-ups after we better understand regulatory data deletion'
+                    ' requirements',
+                },
+            ],
+        )
diff --git a/backend/compact-connect/stacks/reporting_stack.py b/backend/compact-connect/stacks/reporting_stack.py
index 0a9053836..f020bf9fe 100644
--- a/backend/compact-connect/stacks/reporting_stack.py
+++ b/backend/compact-connect/stacks/reporting_stack.py
@@ -5,7 +5,6 @@
 from aws_cdk.aws_cloudwatch_actions import SnsAction
 from aws_cdk.aws_events import Rule, RuleTargetInput, Schedule
 from aws_cdk.aws_events_targets import LambdaFunction
-from aws_cdk.aws_iam import Effect, PolicyStatement
 from aws_cdk.aws_logs import QueryDefinition, QueryString
 from cdk_nag import NagSuppressions
 from common_constructs.nodejs_function import NodejsFunction
@@ -23,11 +22,7 @@ def __init__(self, scope: Construct, construct_id: str, *, persistent_stack: ps.
     def _add_ingest_event_reporting_chain(self, persistent_stack: ps.PersistentStack):
         from_address = f'noreply@{persistent_stack.user_email_notifications.email_identity.email_identity_name}'
         # we host email image assets in the UI bucket, so we'll use the UI domain name if it's available
-        if self.ui_domain_name is not None:
-            ui_base_path_url = f'https://{self.ui_domain_name}'
-        else:
-            # default to csg test environment
-            ui_base_path_url = 'https://app.test.compactconnect.org'
+        ui_base_path_url = self._get_ui_base_path_url()
 
         # We use a Node.js function in this case because the tool we identified for email report generation,
         # EmailBuilderJS, is in Node.js. To make utilizing the tool as simple as possible, we opted to not mix
@@ -50,50 +45,7 @@ def _add_ingest_event_reporting_chain(self, persistent_stack: ps.PersistentStack
         )
         persistent_stack.data_event_table.grant_read_data(event_collector)
         persistent_stack.compact_configuration_table.grant_read_data(event_collector)
-
-        ses_resources = [
-            persistent_stack.user_email_notifications.email_identity.email_identity_arn,
-            self.format_arn(
-                partition=self.partition,
-                service='ses',
-                region=self.region,
-                account=self.account,
-                resource='configuration-set',
-                resource_name=persistent_stack.user_email_notifications.config_set.configuration_set_name,
-            ),
-        ]
-        # We'll assume that, if it is a sandbox environment, they're in the Simple Email Service (SES) sandbox
-        if self.node.try_get_context('sandbox'):
-            # SES Sandboxed accounts require that the sending principal also be explicitly granted permission to send
-            # emails to the SES identity they configured for testing. Because we don't know that identity in advance,
-            # We'll have to allow the principal to use any SES identity configured in the account.
-            # arn:aws:ses:{region}:{account}:identity/*
-            ses_resources.append(
-                self.format_arn(
-                    partition=self.partition,
-                    service='ses',
-                    region=self.region,
-                    account=self.account,
-                    resource='identity',
-                    resource_name='*',
-                ),
-            )
-
-        event_collector.role.add_to_principal_policy(
-            PolicyStatement(
-                actions=['ses:SendEmail', 'ses:SendRawEmail'],
-                resources=ses_resources,
-                effect=Effect.ALLOW,
-                conditions={
-                    # To mitigate the pretty open resources section for sandbox environments, we'll restrict the use of
-                    # this action by specifying what From address and display name the principal must use.
-                    'StringEquals': {
-                        'ses:FromAddress': from_address,
-                        'ses:FromDisplayName': 'Compact Connect',
-                    }
-                },
-            )
-        )
+        persistent_stack.setup_ses_permissions_for_lambda(event_collector)
 
         NagSuppressions.add_resource_suppressions_by_path(
             self,
@@ -163,3 +115,11 @@ def _add_ingest_event_reporting_chain(self, persistent_stack: ps.PersistentStack
             ),
             log_groups=[event_collector.log_group],
         )
+
+    def _get_ui_base_path_url(self) -> str:
+        """Returns the base URL for the UI."""
+        if self.ui_domain_name is not None:
+            return f'https://{self.ui_domain_name}'
+
+        # default to csg test environment
+        return 'https://app.test.compactconnect.org'
diff --git a/backend/compact-connect/stacks/transaction_monitoring_stack/__init__.py b/backend/compact-connect/stacks/transaction_monitoring_stack/__init__.py
new file mode 100644
index 000000000..58f7cd786
--- /dev/null
+++ b/backend/compact-connect/stacks/transaction_monitoring_stack/__init__.py
@@ -0,0 +1,35 @@
+from __future__ import annotations
+
+import json
+
+from common_constructs.stack import AppStack
+from constructs import Construct
+
+from stacks import persistent_stack as ps
+
+from .transaction_history_processing_workflow import TransactionHistoryProcessingWorkflow
+
+
+class TransactionMonitoringStack(AppStack):
+    def __init__(
+        self,
+        scope: Construct,
+        construct_id: str,
+        *,
+        environment_name: str,
+        persistent_stack: ps.PersistentStack,
+        **kwargs,
+    ):
+        super().__init__(scope, construct_id, **kwargs)
+
+        self.compact_state_machines = {}
+        # we create a state machine for each compact in order to keep permissions separate
+        # and to prevent errors with one compact's transaction account impacting others.
+        for compact in json.loads(self.common_env_vars['COMPACTS']):
+            self.compact_state_machines[compact] = TransactionHistoryProcessingWorkflow(
+                self,
+                f'{compact}-TransactionHistoryProcessingWorkflow',
+                compact=compact,
+                environment_name=environment_name,
+                persistent_stack=persistent_stack,
+            )
diff --git a/backend/compact-connect/stacks/transaction_monitoring_stack/transaction_history_processing_workflow.py b/backend/compact-connect/stacks/transaction_monitoring_stack/transaction_history_processing_workflow.py
new file mode 100644
index 000000000..bc7e7fc1c
--- /dev/null
+++ b/backend/compact-connect/stacks/transaction_monitoring_stack/transaction_history_processing_workflow.py
@@ -0,0 +1,236 @@
+from __future__ import annotations
+
+import os
+
+from aws_cdk import ArnFormat, Duration
+from aws_cdk.aws_cloudwatch import Alarm, ComparisonOperator, TreatMissingData
+from aws_cdk.aws_cloudwatch_actions import SnsAction
+from aws_cdk.aws_events import Rule, Schedule
+from aws_cdk.aws_events_targets import SfnStateMachine
+from aws_cdk.aws_iam import Effect, PolicyStatement
+from aws_cdk.aws_logs import LogGroup, RetentionDays
+from aws_cdk.aws_stepfunctions import (
+    Choice,
+    Condition,
+    DefinitionBody,
+    Fail,
+    JsonPath,
+    LogLevel,
+    LogOptions,
+    Pass,
+    Result,
+    StateMachine,
+    Succeed,
+    TaskInput,
+    Timeout,
+)
+from aws_cdk.aws_stepfunctions_tasks import LambdaInvoke
+from cdk_nag import NagSuppressions
+from common_constructs.python_function import PythonFunction
+from common_constructs.stack import Stack
+from constructs import Construct
+
+from stacks import persistent_stack as ps
+
+
+class TransactionHistoryProcessingWorkflow(Construct):
+    def __init__(
+        self,
+        scope: Construct,
+        construct_id: str,
+        *,
+        compact: str,
+        environment_name: str,
+        persistent_stack: ps.PersistentStack,
+        **kwargs,
+    ):
+        super().__init__(scope, construct_id, **kwargs)
+        stack = Stack.of(self)
+        self.transaction_processor_handler = PythonFunction(
+            self,
+            f'{compact}-TransactionHistoryProcessor',
+            description=f'Processes transaction history records for {compact} compact',
+            lambda_dir='purchases',
+            index=os.path.join('handlers', 'transaction_history.py'),
+            handler='process_settled_transactions',
+            timeout=Duration.minutes(15),
+            environment={
+                'TRANSACTION_HISTORY_TABLE_NAME': persistent_stack.transaction_history_table.table_name,
+                'ENVIRONMENT_NAME': environment_name,
+                **stack.common_env_vars,
+            },
+            alarm_topic=persistent_stack.alarm_topic,
+            # required as this lambda is bundled with the authorize.net SDK which is large
+            memory_size=512,
+        )
+        persistent_stack.transaction_history_table.grant_write_data(self.transaction_processor_handler)
+        persistent_stack.shared_encryption_key.grant_encrypt(self.transaction_processor_handler)
+        # grant access to the compact specific secrets manager secrets following this namespace pattern
+        # compact-connect/env/{environment_name}/compact/{compact_name}/credentials/payment-processor
+        self.transaction_processor_handler.add_to_role_policy(
+            PolicyStatement(
+                effect=Effect.ALLOW,
+                actions=[
+                    'secretsmanager:GetSecretValue',
+                ],
+                resources=[
+                    self._get_secrets_manager_compact_payment_processor_arn_for_compact(
+                        compact=compact, environment_name=environment_name
+                    )
+                ],
+            )
+        )
+        NagSuppressions.add_resource_suppressions_by_path(
+            stack=stack,
+            path=f'{self.transaction_processor_handler.node.path}/ServiceRole/DefaultPolicy/Resource',
+            suppressions=[
+                {
+                    'id': 'AwsSolutions-IAM5',
+                    'reason': """
+                            This policy contains wild-carded actions and resources but they are scoped to the
+                            specific actions, KMS key, and Table that this lambda needs access to.
+                            """,
+                },
+            ],
+        )
+
+        # Create Step Function definition
+        # set initial values for the process task to use
+        self.initialize_state = Pass(
+            self,
+            f'{compact}-InitializeState',
+            result=Result.from_object({'Payload': {'compact': compact, 'processedBatchIds': []}}),
+        )
+
+        self.processor_task = LambdaInvoke(
+            self,
+            f'{compact}-ProcessTransactionHistory',
+            lambda_function=self.transaction_processor_handler,
+            input_path=JsonPath.string_at('$.Payload'),
+            result_path='$',
+            task_timeout=Timeout.duration(Duration.minutes(15)),
+        )
+        self.check_status = Choice(self, f'{compact}-CheckProcessingStatus')
+
+        self.email_notification_service_invoke_step = LambdaInvoke(
+            self,
+            f'{compact}-BatchFailureNotification',
+            lambda_function=persistent_stack.email_notification_service_lambda,
+            payload=TaskInput.from_object(
+                {
+                    'compact': compact,
+                    'template': 'transactionBatchSettlementFailure',
+                    'recipientType': 'COMPACT_OPERATIONS_TEAM',
+                }
+            ),
+            result_path='$.notificationResult',
+            task_timeout=Timeout.duration(Duration.minutes(15)),
+        )
+
+        success = Succeed(self, f'{compact}-ProcessingComplete')
+        fail = Fail(self, f'{compact}-ProcessingFailed', cause='Transaction processing failed')
+
+        # Here we define the chaining between the steps in the state machine
+        self.initialize_state.next(self.processor_task)
+        self.processor_task.next(self.check_status)
+        self.check_status.when(Condition.string_equals('$.Payload.status', 'COMPLETE'), success)
+        self.check_status.when(Condition.string_equals('$.Payload.status', 'IN_PROGRESS'), self.processor_task)
+        self.check_status.when(
+            Condition.string_equals('$.Payload.status', 'BATCH_FAILURE'),
+            self.email_notification_service_invoke_step,
+        )
+        self.check_status.otherwise(fail)
+
+        # after the email has been sent, we end in a success state even though the batch failed,
+        # since that is the result of the external system and not a failure of the state machine
+        self.email_notification_service_invoke_step.next(success)
+
+        state_machine_log_group = LogGroup(
+            self,
+            f'{compact}-TransactionHistoryStateMachineLogs',
+            retention=RetentionDays.ONE_MONTH,
+        )
+        NagSuppressions.add_resource_suppressions(
+            state_machine_log_group,
+            suppressions=[
+                {
+                    'id': 'HIPAA.Security-CloudWatchLogGroupEncrypted',
+                    'reason': 'This group will contain no PII or PHI and should be accessible by anyone with access'
+                    ' to the AWS account for basic operational support visibility. Encrypting is not '
+                    'appropriate here.',
+                }
+            ],
+        )
+
+        # Create the state machine
+        state_machine = StateMachine(
+            self,
+            f'{compact}-TransactionHistoryStateMachine',
+            definition_body=DefinitionBody.from_chainable(self.initialize_state),
+            timeout=Duration.hours(2),
+            logs=LogOptions(
+                destination=state_machine_log_group,
+                level=LogLevel.ALL,
+                include_execution_data=True,
+            ),
+            tracing_enabled=True,
+        )
+        self.transaction_processor_handler.grant_invoke(state_machine)
+        persistent_stack.shared_encryption_key.grant_encrypt_decrypt(state_machine)
+
+        NagSuppressions.add_resource_suppressions_by_path(
+            stack=stack,
+            path=f'{state_machine.node.path}/Role/DefaultPolicy/Resource',
+            suppressions=[
+                {
+                    'id': 'AwsSolutions-IAM5',
+                    'reason': """
+                              This policy contains wild-carded actions and resources but they are scoped to the specific
+                              actions, KMS key, and Lambda function that this state machine needs access to.
+                              """,
+                },
+            ],
+        )
+
+        # Create EventBridge rule to trigger state machine daily at noon UTC-4
+        Rule(
+            self,
+            f'{compact}-DailyTransactionProcessingRule',
+            schedule=Schedule.cron(week_day='*', hour='16', minute='0', month='*', year='*'),
+            targets=[SfnStateMachine(state_machine)],
+        )
+
+        # Create alarm for failed step function executions
+        Alarm(
+            self,
+            f'{compact}-StateMachineExecutionFailedAlarm',
+            metric=state_machine.metric_failed(),
+            evaluation_periods=1,
+            threshold=1,
+            actions_enabled=True,
+            alarm_description=f'{state_machine.node.path} failed to collect transactions',
+            comparison_operator=ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+            treat_missing_data=TreatMissingData.NOT_BREACHING,
+        ).add_alarm_action(SnsAction(persistent_stack.alarm_topic))
+
+    def _get_secrets_manager_compact_payment_processor_arn_for_compact(
+        self, compact: str, environment_name: str
+    ) -> str:
+        """
+        Generate the secret arn for the payment processor credentials.
+        The secret arn follows this pattern:
+        compact-connect/env/{environment_name}/compact/{compact_name}/credentials/payment-processor
+
+        This is used to scope the permissions granted to the lambda specifically for the secret it needs to access.
+        """
+        stack = Stack.of(self)
+        return stack.format_arn(
+            service='secretsmanager',
+            arn_format=ArnFormat.COLON_RESOURCE_NAME,
+            resource='secret',
+            resource_name=(
+                # add wildcard characters to account for 6-character
+                # random version suffix appended to secret name by secrets manager
+                f'compact-connect/env/{environment_name}/compact/{compact}/credentials/payment-processor-??????'
+            ),
+        )
diff --git a/backend/compact-connect/tests/app/test_transaction_monitoring.py b/backend/compact-connect/tests/app/test_transaction_monitoring.py
new file mode 100644
index 000000000..0b650ebe6
--- /dev/null
+++ b/backend/compact-connect/tests/app/test_transaction_monitoring.py
@@ -0,0 +1,222 @@
+import json
+import re
+from unittest import TestCase
+
+from aws_cdk.assertions import Template
+from aws_cdk.aws_lambda import CfnFunction
+
+from tests.app.base import TstAppABC
+
+
+def _generate_expected_secret_arn(compact: str) -> str:
+    return (
+        f'arn:aws:secretsmanager:us-east-1:000011112222:secret:compact-connect/env'
+        f'/prod/compact/{compact}/credentials/payment-processor-??????'
+    )
+
+
+class TestTransactionMonitoring(TstAppABC, TestCase):
+    """
+    These tests verify that the transaction monitoring resources are configured as expected.
+
+    When adding or modifying the transaction monitoring workflow definition, tests should be added to ensure that the
+    steps are configured correctly.
+    """
+
+    @classmethod
+    def get_context(cls):
+        with open('cdk.json') as f:
+            context = json.load(f)['context']
+
+        # Suppresses lambda bundling for tests
+        context['aws:cdk:bundling-stacks'] = []
+
+        return context
+
+    def remove_dynamic_tokens_numbers(self, definition: dict) -> dict:
+        """
+        Helper function to replace dynamic numbers from the tokens with static placeholders in a definition.
+
+        Here is an example of a state machine definition that contains tokens:
+        {'Next': 'TranscriberChoiceStep',
+         'Parameters': {'MessageBody': {'input.$': '$', 'taskToken.$': '$$.Task.Token'},
+                        'QueueUrl': '${Token[TOKEN.317]}'},
+         'Resource': 'arn:${Token[AWS.Partition.8]}:states:::sqs:sendMessage.waitForTaskToken',
+         'TimeoutSeconds': 1123200,
+         'Type': 'Task'}
+
+         Notice sometimes the token is embedded in a string, and sometimes it is a standalone value.
+         We need to account for both cases here.
+
+        the dynamic token numbers are removed from the string so the tests are stable.
+        """
+        # this matches the token pattern so we can replace the numbers
+        token_pattern = re.compile(r'\$\{Token\[([^\]]+)\]\}')
+
+        def replace_tokens(value):
+            if isinstance(value, dict):
+                return {k: replace_tokens(v) for k, v in value.items()}
+            if isinstance(value, list):
+                return [replace_tokens(v) for v in value]
+            if isinstance(value, str):
+
+                def strip_numbers(match):
+                    token_content = match.group(1)
+                    parts = token_content.split('.')
+                    stripped_parts = [part for part in parts if not part.isdigit()]
+                    return '${Token[' + '.'.join(stripped_parts) + ']}'
+
+                return token_pattern.sub(strip_numbers, value)
+            return value
+
+        return replace_tokens(definition)
+
+    def test_workflow_generate_process_transaction_history_lambda_with_permissions(self):
+        transaction_monitoring_stack = self.app.pipeline_stack.prod_stage.transaction_monitoring_stack
+        transaction_monitoring_stack_template = Template.from_stack(transaction_monitoring_stack)
+
+        compacts = transaction_monitoring_stack.node.get_context('compacts')
+        for compact in compacts:
+            lambda_properties = self.get_resource_properties_by_logical_id(
+                transaction_monitoring_stack.get_logical_id(
+                    transaction_monitoring_stack.compact_state_machines[
+                        compact
+                    ].transaction_processor_handler.node.default_child
+                ),
+                transaction_monitoring_stack_template.find_resources(CfnFunction.CFN_RESOURCE_TYPE_NAME),
+            )
+
+            self.assertEqual('handlers.transaction_history.process_settled_transactions', lambda_properties['Handler'])
+
+            handler_role_logical_id = transaction_monitoring_stack.get_logical_id(
+                transaction_monitoring_stack.compact_state_machines[
+                    compact
+                ].transaction_processor_handler.role.node.default_child
+            )
+            # get the policy attached to the role using this match
+            # "Roles": [
+            #     {
+            #         "Ref": "<role logical id>"
+            #     }
+            # ]
+            policy = next(
+                policy
+                for policy_logical_id, policy in transaction_monitoring_stack_template.find_resources(
+                    'AWS::IAM::Policy'
+                ).items()
+                if handler_role_logical_id in policy['Properties']['Roles'][0]['Ref']
+            )
+
+            # We need to ensure the lambda can only read the secret for its compact
+            self.assertIn(
+                {
+                    'Action': 'secretsmanager:GetSecretValue',
+                    'Effect': 'Allow',
+                    'Resource': _generate_expected_secret_arn(compact),
+                },
+                policy['Properties']['PolicyDocument']['Statement'],
+            )
+
+    def test_workflow_generates_expected_process_transaction_history_lambda_invoke_step(self):
+        aslp_transaction_history_proccessing_workflow = (
+            self.app.pipeline_stack.prod_stage.transaction_monitoring_stack.compact_state_machines['aslp']
+        )
+
+        self.assertEqual(
+            {
+                'InputPath': '${Token[Payload]}',
+                'Next': 'aslp-CheckProcessingStatus',
+                'Parameters': {'FunctionName': '${Token[TOKEN]}', 'Payload.$': '$'},
+                'Resource': 'arn:${Token[AWS.Partition]}:states:::lambda:invoke',
+                'ResultPath': '$',
+                'Retry': [
+                    {
+                        'BackoffRate': 2,
+                        'ErrorEquals': [
+                            'Lambda.ClientExecutionTimeoutException',
+                            'Lambda.ServiceException',
+                            'Lambda.AWSLambdaException',
+                            'Lambda.SdkClientException',
+                        ],
+                        'IntervalSeconds': 2,
+                        'MaxAttempts': 6,
+                    }
+                ],
+                'TimeoutSeconds': 900,
+                'Type': 'Task',
+            },
+            self.remove_dynamic_tokens_numbers(
+                aslp_transaction_history_proccessing_workflow.processor_task.to_state_json()
+            ),
+        )
+
+    def test_workflow_generates_expected_choice_step(self):
+        aslp_transaction_history_proccessing_workflow = (
+            self.app.pipeline_stack.prod_stage.transaction_monitoring_stack.compact_state_machines['aslp']
+        )
+
+        self.assertEqual(
+            {
+                'Choices': [
+                    {
+                        'Next': 'aslp-ProcessingComplete',
+                        'StringEquals': 'COMPLETE',
+                        'Variable': '$.Payload.status',
+                    },
+                    {
+                        'Next': 'aslp-ProcessTransactionHistory',
+                        'StringEquals': 'IN_PROGRESS',
+                        'Variable': '$.Payload.status',
+                    },
+                    {
+                        'Next': 'aslp-BatchFailureNotification',
+                        'StringEquals': 'BATCH_FAILURE',
+                        'Variable': '$.Payload.status',
+                    },
+                ],
+                'Default': 'aslp-ProcessingFailed',
+                'Type': 'Choice',
+            },
+            self.remove_dynamic_tokens_numbers(
+                aslp_transaction_history_proccessing_workflow.check_status.to_state_json()
+            ),
+        )
+
+    def test_workflow_generates_expected_batch_failure_notification_step(self):
+        aslp_transaction_history_proccessing_workflow = (
+            self.app.pipeline_stack.prod_stage.transaction_monitoring_stack.compact_state_machines['aslp']
+        )
+
+        self.assertEqual(
+            {
+                'Next': 'aslp-ProcessingComplete',
+                'Parameters': {
+                    'FunctionName': '${Token[TOKEN]}',
+                    'Payload': {
+                        'compact': 'aslp',
+                        'recipientType': 'COMPACT_OPERATIONS_TEAM',
+                        'template': 'transactionBatchSettlementFailure',
+                    },
+                },
+                'Resource': 'arn:${Token[AWS.Partition]}:states:::lambda:invoke',
+                'ResultPath': '$.notificationResult',
+                'Retry': [
+                    {
+                        'BackoffRate': 2,
+                        'ErrorEquals': [
+                            'Lambda.ClientExecutionTimeoutException',
+                            'Lambda.ServiceException',
+                            'Lambda.AWSLambdaException',
+                            'Lambda.SdkClientException',
+                        ],
+                        'IntervalSeconds': 2,
+                        'MaxAttempts': 6,
+                    }
+                ],
+                'TimeoutSeconds': 900,
+                'Type': 'Task',
+            },
+            self.remove_dynamic_tokens_numbers(
+                aslp_transaction_history_proccessing_workflow.email_notification_service_invoke_step.to_state_json()
+            ),
+        )
diff --git a/backend/multi-account/requirements.txt b/backend/multi-account/requirements.txt
index ff90a86db..6f5a59538 100644
--- a/backend/multi-account/requirements.txt
+++ b/backend/multi-account/requirements.txt
@@ -16,7 +16,7 @@ aws-cdk-asset-node-proxy-agent-v6==2.1.0
     # via aws-cdk-lib
 aws-cdk-cloud-assembly-schema==38.0.1
     # via aws-cdk-lib
-aws-cdk-lib==2.173.2
+aws-cdk-lib==2.173.4
     # via -r multi-account/requirements.in
 cattrs==24.1.2
     # via jsii

From 7ca275db9bf2713540d45c206d623b331089b281 Mon Sep 17 00:00:00 2001
From: landonshumway-ia <landon@inspiringapps.com>
Date: Mon, 6 Jan 2025 08:59:08 -0600
Subject: [PATCH 08/18] Remove mock resources from persistent stack (#421)

This is part two of the mock resource cleanup. Now that the API ands
Ingest stacks are no longer referencing the mock data resources, we can
safely delete them from the persistent stack.

### Requirements List
- As part of the deployment to the production environment, after the
stacks have finished deploying this update, a developer with the proper
permissions will need to delete the following tables/buckets manually:

- MockLicenseTable
- LicenseTable
- MockBulkUploadsBucket

### Description List
- Removed mock and deprecated license table resources
- Removed mock uploads bucket references

### Testing List
- local deployment to sandbox environment to ensure stack updates deploy
successfully
- Code review

Closes #110
---
 .../python/delete-objects/requirements-dev.in |  1 -
 .../python/delete-objects/requirements.in     |  2 -
 .../python/license-data/handlers/__init__.py  |  0
 .../function/test_data_model/__init__.py      |  0
 .../tests/function/test_handlers/__init__.py  |  0
 .../license-data/tests/unit/__init__.py       |  0
 .../tests/unit/test_data_model/__init__.py    |  0
 .../test_data_model/test_schema/__init__.py   |  0
 .../tests/unit/test_handlers/__init__.py      |  0
 .../stacks/persistent_stack/__init__.py       | 42 -------------
 .../persistent_stack/bulk_uploads_bucket.py   |  4 +-
 .../stacks/persistent_stack/license_table.py  | 63 -------------------
 12 files changed, 1 insertion(+), 111 deletions(-)
 delete mode 100644 backend/compact-connect/lambdas/python/delete-objects/requirements-dev.in
 delete mode 100644 backend/compact-connect/lambdas/python/delete-objects/requirements.in
 delete mode 100644 backend/compact-connect/lambdas/python/license-data/handlers/__init__.py
 delete mode 100644 backend/compact-connect/lambdas/python/license-data/tests/function/test_data_model/__init__.py
 delete mode 100644 backend/compact-connect/lambdas/python/license-data/tests/function/test_handlers/__init__.py
 delete mode 100644 backend/compact-connect/lambdas/python/license-data/tests/unit/__init__.py
 delete mode 100644 backend/compact-connect/lambdas/python/license-data/tests/unit/test_data_model/__init__.py
 delete mode 100644 backend/compact-connect/lambdas/python/license-data/tests/unit/test_data_model/test_schema/__init__.py
 delete mode 100644 backend/compact-connect/lambdas/python/license-data/tests/unit/test_handlers/__init__.py
 delete mode 100644 backend/compact-connect/stacks/persistent_stack/license_table.py

diff --git a/backend/compact-connect/lambdas/python/delete-objects/requirements-dev.in b/backend/compact-connect/lambdas/python/delete-objects/requirements-dev.in
deleted file mode 100644
index 17377230b..000000000
--- a/backend/compact-connect/lambdas/python/delete-objects/requirements-dev.in
+++ /dev/null
@@ -1 +0,0 @@
-moto[s3]>=5.0.12, <6
diff --git a/backend/compact-connect/lambdas/python/delete-objects/requirements.in b/backend/compact-connect/lambdas/python/delete-objects/requirements.in
deleted file mode 100644
index 75cf54179..000000000
--- a/backend/compact-connect/lambdas/python/delete-objects/requirements.in
+++ /dev/null
@@ -1,2 +0,0 @@
-boto3>=1.34, <2
-aws-lambda-powertools>=2.29.1, <3
diff --git a/backend/compact-connect/lambdas/python/license-data/handlers/__init__.py b/backend/compact-connect/lambdas/python/license-data/handlers/__init__.py
deleted file mode 100644
index e69de29bb..000000000
diff --git a/backend/compact-connect/lambdas/python/license-data/tests/function/test_data_model/__init__.py b/backend/compact-connect/lambdas/python/license-data/tests/function/test_data_model/__init__.py
deleted file mode 100644
index e69de29bb..000000000
diff --git a/backend/compact-connect/lambdas/python/license-data/tests/function/test_handlers/__init__.py b/backend/compact-connect/lambdas/python/license-data/tests/function/test_handlers/__init__.py
deleted file mode 100644
index e69de29bb..000000000
diff --git a/backend/compact-connect/lambdas/python/license-data/tests/unit/__init__.py b/backend/compact-connect/lambdas/python/license-data/tests/unit/__init__.py
deleted file mode 100644
index e69de29bb..000000000
diff --git a/backend/compact-connect/lambdas/python/license-data/tests/unit/test_data_model/__init__.py b/backend/compact-connect/lambdas/python/license-data/tests/unit/test_data_model/__init__.py
deleted file mode 100644
index e69de29bb..000000000
diff --git a/backend/compact-connect/lambdas/python/license-data/tests/unit/test_data_model/test_schema/__init__.py b/backend/compact-connect/lambdas/python/license-data/tests/unit/test_data_model/test_schema/__init__.py
deleted file mode 100644
index e69de29bb..000000000
diff --git a/backend/compact-connect/lambdas/python/license-data/tests/unit/test_handlers/__init__.py b/backend/compact-connect/lambdas/python/license-data/tests/unit/test_handlers/__init__.py
deleted file mode 100644
index e69de29bb..000000000
diff --git a/backend/compact-connect/stacks/persistent_stack/__init__.py b/backend/compact-connect/stacks/persistent_stack/__init__.py
index 99b4d05ad..350162f09 100644
--- a/backend/compact-connect/stacks/persistent_stack/__init__.py
+++ b/backend/compact-connect/stacks/persistent_stack/__init__.py
@@ -20,7 +20,6 @@
 from stacks.persistent_stack.compact_configuration_upload import CompactConfigurationUpload
 from stacks.persistent_stack.data_event_table import DataEventTable
 from stacks.persistent_stack.event_bus import EventBus
-from stacks.persistent_stack.license_table import LicenseTable
 from stacks.persistent_stack.provider_table import ProviderTable
 from stacks.persistent_stack.provider_users import ProviderUsers
 from stacks.persistent_stack.provider_users_bucket import ProviderUsersBucket
@@ -102,11 +101,6 @@ def __init__(
 
         self.data_event_bus = EventBus(self, 'DataEventBus')
 
-        # Both of these are slated for deprecation/deletion soon, so we'll mark included resources for removal
-        self._add_mock_data_resources()
-        self._add_deprecated_data_resources()
-
-        # The new data resources
         self._add_data_resources(removal_policy=removal_policy)
 
         self.compact_configuration_upload = CompactConfigurationUpload(
@@ -176,42 +170,6 @@ def __init__(
             self.provider_users.node.add_dependency(self.user_email_notifications.email_identity)
             self.provider_users.node.add_dependency(self.user_email_notifications.dmarc_record)
 
-    def _add_mock_data_resources(self):
-        self.mock_bulk_uploads_bucket = BulkUploadsBucket(
-            self,
-            'MockBulkUploadsBucket',
-            mock_bucket=True,
-            access_logs_bucket=self.access_logs_bucket,
-            encryption_key=self.shared_encryption_key,
-            removal_policy=RemovalPolicy.DESTROY,
-            auto_delete_objects=True,
-            event_bus=self.data_event_bus,
-        )
-
-        # These dummy exports are required until we remove dependencies from the api stack
-        # see https://github.com/aws/aws-cdk/issues/3414
-        self.export_value(self.mock_bulk_uploads_bucket.bucket_name)
-        self.export_value(self.mock_bulk_uploads_bucket.bucket_arn)
-
-        self.mock_license_table = LicenseTable(
-            self, 'MockLicenseTable', encryption_key=self.shared_encryption_key, removal_policy=RemovalPolicy.DESTROY
-        )
-
-        # These dummy exports are required until we remove dependencies from the api stack
-        # see https://github.com/aws/aws-cdk/issues/3414
-        self.export_value(self.mock_license_table.table_name)
-        self.export_value(self.mock_license_table.table_arn)
-
-    def _add_deprecated_data_resources(self):
-        self.license_table = LicenseTable(
-            self, 'LicenseTable', encryption_key=self.shared_encryption_key, removal_policy=RemovalPolicy.DESTROY
-        )
-
-        # These dummy exports are required until we remove dependencies from the api stack
-        # see https://github.com/aws/aws-cdk/issues/3414
-        self.export_value(self.license_table.table_name)
-        self.export_value(self.license_table.table_arn)
-
     def _add_data_resources(self, removal_policy: RemovalPolicy):
         self.bulk_uploads_bucket = BulkUploadsBucket(
             self,
diff --git a/backend/compact-connect/stacks/persistent_stack/bulk_uploads_bucket.py b/backend/compact-connect/stacks/persistent_stack/bulk_uploads_bucket.py
index 6b31a363e..e40db18b3 100644
--- a/backend/compact-connect/stacks/persistent_stack/bulk_uploads_bucket.py
+++ b/backend/compact-connect/stacks/persistent_stack/bulk_uploads_bucket.py
@@ -27,7 +27,6 @@ def __init__(
         *,
         access_logs_bucket: AccessLogsBucket,
         encryption_key: IKey,
-        mock_bucket: bool = False,
         event_bus: EventBus,
         **kwargs,
     ):
@@ -49,8 +48,7 @@ def __init__(
         )
         self.log_groups = []
 
-        if not mock_bucket:
-            self._add_v1_ingest_object_events(event_bus)
+        self._add_v1_ingest_object_events(event_bus)
 
         QueryDefinition(
             self,
diff --git a/backend/compact-connect/stacks/persistent_stack/license_table.py b/backend/compact-connect/stacks/persistent_stack/license_table.py
deleted file mode 100644
index ce1bd32e7..000000000
--- a/backend/compact-connect/stacks/persistent_stack/license_table.py
+++ /dev/null
@@ -1,63 +0,0 @@
-from aws_cdk import RemovalPolicy
-from aws_cdk.aws_dynamodb import Attribute, AttributeType, BillingMode, ProjectionType, Table, TableEncryption
-from aws_cdk.aws_kms import IKey
-from cdk_nag import NagSuppressions
-from constructs import Construct
-
-
-class LicenseTable(Table):
-    """DynamoDB table to house license data"""
-
-    def __init__(
-        self,
-        scope: Construct,
-        construct_id: str,
-        *,
-        encryption_key: IKey,
-        removal_policy: RemovalPolicy,
-        **kwargs,
-    ):
-        super().__init__(
-            scope,
-            construct_id,
-            encryption=TableEncryption.CUSTOMER_MANAGED,
-            encryption_key=encryption_key,
-            billing_mode=BillingMode.PAY_PER_REQUEST,
-            removal_policy=removal_policy,
-            point_in_time_recovery=True,
-            partition_key=Attribute(name='pk', type=AttributeType.STRING),
-            sort_key=Attribute(name='sk', type=AttributeType.STRING),
-            **kwargs,
-        )
-        self.cj_name_index_name = 'cj_name'
-        self.cj_updated_index_name = 'cj_updated'
-        self.ssn_index_name = 'ssn'
-
-        self.add_global_secondary_index(
-            index_name=self.cj_name_index_name,
-            partition_key=Attribute(name='compactJur', type=AttributeType.STRING),
-            sort_key=Attribute(name='famGivMid', type=AttributeType.STRING),
-            projection_type=ProjectionType.ALL,
-        )
-        self.add_global_secondary_index(
-            index_name=self.cj_updated_index_name,
-            partition_key=Attribute(name='compactJur', type=AttributeType.STRING),
-            sort_key=Attribute(name='dateOfUpdate', type=AttributeType.STRING),
-            projection_type=ProjectionType.ALL,
-        )
-        self.add_global_secondary_index(
-            index_name=self.ssn_index_name,
-            partition_key=Attribute(name='ssn', type=AttributeType.STRING),
-            sort_key=Attribute(name='licenseHomeProviderId', type=AttributeType.STRING),
-            projection_type=ProjectionType.KEYS_ONLY,
-        )
-        NagSuppressions.add_resource_suppressions(
-            self,
-            suppressions=[
-                {
-                    'id': 'HIPAA.Security-DynamoDBInBackupPlan',
-                    'reason': 'We will implement data back-ups after we better understand regulatory data deletion'
-                    ' requirements',
-                },
-            ],
-        )

From f32cad7e88783316b00039e342ad306bc3ecdbbe Mon Sep 17 00:00:00 2001
From: John Sandoval <jsandoval81@users.noreply.github.com>
Date: Thu, 9 Jan 2025 10:08:39 -0700
Subject: [PATCH 09/18] path-to-regexp dependency update (#432)

### Requirements List
- `yarn install --ignore-engines`

### Description List
- Address
https://github.com/csg-org/CompactConnect/security/dependabot/63

### Testing List
- `yarn test:unit:all` should run without errors or warnings
- `yarn serve` should run without errors or warnings
- `yarn build` should run without errors or warnings
- Code review

Closes #431
---
 webroot/yarn.lock | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/webroot/yarn.lock b/webroot/yarn.lock
index d9b789b13..a92f9faeb 100644
--- a/webroot/yarn.lock
+++ b/webroot/yarn.lock
@@ -6399,9 +6399,9 @@ executable@^4.1.1:
     pify "^2.2.0"
 
 express@^4.17.3:
-  version "4.21.1"
-  resolved "https://registry.yarnpkg.com/express/-/express-4.21.1.tgz#9dae5dda832f16b4eec941a4e44aa89ec481b281"
-  integrity sha512-YSFlK1Ee0/GC8QaO91tHcDxJiE/X4FbpAyQWkxAvG6AXCuR65YzK8ua6D9hvi/TzUfZMpc+BwuM1IPw8fmQBiQ==
+  version "4.21.2"
+  resolved "https://registry.yarnpkg.com/express/-/express-4.21.2.tgz#cf250e48362174ead6cea4a566abef0162c1ec32"
+  integrity sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA==
   dependencies:
     accepts "~1.3.8"
     array-flatten "1.1.1"
@@ -6422,7 +6422,7 @@ express@^4.17.3:
     methods "~1.1.2"
     on-finished "2.4.1"
     parseurl "~1.3.3"
-    path-to-regexp "0.1.10"
+    path-to-regexp "0.1.12"
     proxy-addr "~2.0.7"
     qs "6.13.0"
     range-parser "~1.2.1"
@@ -9694,10 +9694,10 @@ path-scurry@^1.10.2:
     lru-cache "^10.2.0"
     minipass "^5.0.0 || ^6.0.2 || ^7.0.0"
 
-path-to-regexp@0.1.10:
-  version "0.1.10"
-  resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.10.tgz#67e9108c5c0551b9e5326064387de4763c4d5f8b"
-  integrity sha512-7lf7qcQidTku0Gu3YDPc8DJ1q7OOucfa/BSsIwjuh56VU7katFvuM8hULfkwB3Fns/rsVF7PwPKVw1sl5KQS9w==
+path-to-regexp@0.1.12:
+  version "0.1.12"
+  resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.12.tgz#d5e1a12e478a976d432ef3c58d534b9923164bb7"
+  integrity sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==
 
 path-to-regexp@^1.7.0:
   version "1.9.0"

From 20f31154b3c282b3f249782b512a548ee31fa505 Mon Sep 17 00:00:00 2001
From: John Sandoval <jsandoval81@users.noreply.github.com>
Date: Fri, 10 Jan 2025 10:38:25 -0700
Subject: [PATCH 10/18] Frontend/Fix pw input validation messages (#430)

### Requirements List
- _None_

### Description List
- Move message augmentation to after message evaluation
- Update frontend to match latest backend pw requirements (length only)
- Add tests

### Testing List
- `yarn test:unit:all` should run without errors or warnings
- `yarn serve` should run without errors or warnings
- `yarn build` should run without errors or warnings
- Code review
- Fill out the change-password section of the account page to ensure
correct validation behavior
    - No need to actually submit the change

Closes #410
---
 .../ChangePassword/ChangePassword.ts          |  7 ----
 .../Forms/InputPassword/InputPassword.spec.ts | 40 +++++++++++++++++++
 .../Forms/InputPassword/InputPassword.ts      | 12 +++---
 3 files changed, 46 insertions(+), 13 deletions(-)

diff --git a/webroot/src/components/ChangePassword/ChangePassword.ts b/webroot/src/components/ChangePassword/ChangePassword.ts
index b52d3ba8b..6752ba03c 100644
--- a/webroot/src/components/ChangePassword/ChangePassword.ts
+++ b/webroot/src/components/ChangePassword/ChangePassword.ts
@@ -100,15 +100,8 @@ class ChangePassword extends mixins(MixinForm) {
                 validation: joiPassword
                     .string()
                     .min(12)
-                    .minOfSpecialCharacters(1)
-                    .minOfLowercase(1)
-                    .minOfUppercase(1)
-                    .minOfNumeric(1)
                     .doesNotInclude([
                         this.user.email,
-                        this.user.firstName,
-                        this.user.lastName,
-                        'password',
                     ])
                     .messages({
                         ...this.joiMessages.string,
diff --git a/webroot/src/components/Forms/InputPassword/InputPassword.spec.ts b/webroot/src/components/Forms/InputPassword/InputPassword.spec.ts
index 0bf65c800..aaa6877cf 100644
--- a/webroot/src/components/Forms/InputPassword/InputPassword.spec.ts
+++ b/webroot/src/components/Forms/InputPassword/InputPassword.spec.ts
@@ -7,10 +7,15 @@
 
 import { expect } from 'chai';
 import { mountShallow, mountFull } from '@tests/helpers/setup';
+import MixinForm from '@components/Forms/_mixins/form.mixin';
 import InputPassword from '@components/Forms/InputPassword/InputPassword.vue';
 import ShowPasswordEye from '@components/Icons/ShowPasswordEye/ShowPasswordEye.vue';
 import HidePasswordEye from '@components/Icons/HidePasswordEye/HidePasswordEye.vue';
 import { FormInput } from '@models/FormInput/FormInput.model';
+import Joi from 'joi';
+import { joiPasswordExtendCore } from 'joi-password';
+
+const joiPassword = Joi.extend(joiPasswordExtendCore);
 
 describe('InputPassword component', async () => {
     it('should mount the component', async () => {
@@ -51,4 +56,39 @@ describe('InputPassword component', async () => {
         expect(input.attributes().type).to.equal('password');
         expect(wrapper.findComponent(HidePasswordEye).exists()).to.equal(true);
     });
+    it('should show password requirements', async () => {
+        const { joiMessages } = (await mountShallow(MixinForm)).vm;
+        const formInput = new FormInput({
+            validation: joiPassword
+                .string()
+                .min(12)
+                .minOfSpecialCharacters(1)
+                .minOfLowercase(1)
+                .minOfUppercase(1)
+                .minOfNumeric(1)
+                .doesNotInclude([
+                    'password',
+                ]),
+        });
+        const wrapper = await mountFull(InputPassword, {
+            props: {
+                formInput,
+                joiMessages,
+            },
+        });
+        const pwRequirements = wrapper.findAll('.password-requirement');
+
+        expect(pwRequirements[0].text()).to.equal('Must be at least 12 characters');
+        expect(pwRequirements[0].classes('is-valid')).to.equal(false);
+        expect(pwRequirements[1].text()).to.equal('Must have at least 1 special character');
+        expect(pwRequirements[1].classes('is-valid')).to.equal(false);
+        expect(pwRequirements[2].text()).to.equal('Must have at least 1 lowercase character');
+        expect(pwRequirements[2].classes('is-valid')).to.equal(false);
+        expect(pwRequirements[3].text()).to.equal('Must have at least 1 uppercase character');
+        expect(pwRequirements[3].classes('is-valid')).to.equal(false);
+        expect(pwRequirements[4].text()).to.equal('Must have at least 1 number');
+        expect(pwRequirements[4].classes('is-valid')).to.equal(false);
+        expect(pwRequirements[5].text()).to.equal('Must not include your username or other common strings');
+        expect(pwRequirements[5].classes('is-valid')).to.equal(false);
+    });
 });
diff --git a/webroot/src/components/Forms/InputPassword/InputPassword.ts b/webroot/src/components/Forms/InputPassword/InputPassword.ts
index e6fe956c3..669874684 100644
--- a/webroot/src/components/Forms/InputPassword/InputPassword.ts
+++ b/webroot/src/components/Forms/InputPassword/InputPassword.ts
@@ -58,12 +58,6 @@ class InputPassword extends mixins(MixinInput) {
                         .replace(/{#limit}/g, limit)
                         .replace(/{#min}/g, min);
 
-                    if (limit === 1 || min === 1) {
-                        ruleDesc = ruleDesc
-                            .replace(/characters$/, 'character')
-                            .replace(/numbers$/, 'number');
-                    }
-
                     if (inputValue) {
                         const matchValidationError = validationErrors.find((error) => error.message === ruleDesc);
 
@@ -72,6 +66,12 @@ class InputPassword extends mixins(MixinInput) {
                         }
                     }
 
+                    if (limit === 1 || min === 1) {
+                        ruleDesc = ruleDesc
+                            .replace(/characters$/, 'character')
+                            .replace(/numbers$/, 'number');
+                    }
+
                     requirements.push({
                         description: ruleDesc,
                         isValid: ruleEval,

From 235c8ce74f9d61eaa4f359ffc550ddf62b2096e7 Mon Sep 17 00:00:00 2001
From: John Sandoval <jsandoval81@users.noreply.github.com>
Date: Fri, 10 Jan 2025 12:15:39 -0700
Subject: [PATCH 11/18] Frontend/permission api updates (#428)

### Requirements List
- _None_

### Description List
- Change compact-level `read` permission to `readPrivate`
- Add state-level `readPrivate` permission
- Omit compact permission in server payload if current user isn't
compact admin (rather than sending `false`)
- Don't re-send permissions as `false`
- Updated licensee model tests for slightly improved coverage

### Testing List
- `yarn test:unit:all` should run without errors or warnings
- `yarn serve` should run without errors or warnings
- `yarn build` should run without errors or warnings
- Code review
- Make sure to have 3 users created for yourself (this will be helpful
with testing many PRs; should be able to use UI if needed):
    - A compact admin
    - A state admin (same compact)
    - A non-state admin (same compact)
- Ensure compact admin can set / update all types of permissions for
users
- Ensure state admin can set / update all types of permissions for users
in their state(s)
- Ensure non-state admin can't perform user management

Closes #325
---
 .../components/Users/UserInvite/UserInvite.ts | 53 ++++++----
 .../Users/UserRowEdit/UserRowEdit.ts          | 88 ++++++++++++-----
 webroot/src/locales/en.json                   |  1 +
 webroot/src/locales/es.json                   |  1 +
 .../models/Licensee/Licensee.model.spec.ts    | 40 ++++++++
 webroot/src/models/Licensee/Licensee.model.ts |  6 +-
 .../models/StaffUser/StaffUser.model.spec.ts  | 45 +++++----
 .../src/models/StaffUser/StaffUser.model.ts   | 99 ++++++++++++-------
 8 files changed, 230 insertions(+), 103 deletions(-)

diff --git a/webroot/src/components/Users/UserInvite/UserInvite.ts b/webroot/src/components/Users/UserInvite/UserInvite.ts
index becf5eb97..be105c6ec 100644
--- a/webroot/src/components/Users/UserInvite/UserInvite.ts
+++ b/webroot/src/components/Users/UserInvite/UserInvite.ts
@@ -34,13 +34,13 @@ interface PermissionOption {
 
 enum Permission {
     NONE = 'none',
-    READ = 'read',
+    READ_PRIVATE = 'readPrivate',
     WRITE = 'write',
     ADMIN = 'admin',
 }
 
 interface PermissionObject {
-    isRead?: boolean;
+    isReadPrivate?: boolean;
     isWrite?: boolean;
     isAdmin?: boolean;
 }
@@ -134,7 +134,7 @@ class UserInvite extends mixins(MixinForm) {
     get userPermissionOptionsCompact(): Array<PermissionOption> {
         return [
             { value: Permission.NONE, name: this.$t('account.accessLevel.none') },
-            { value: Permission.READ, name: this.$t('account.accessLevel.read') },
+            { value: Permission.READ_PRIVATE, name: this.$t('account.accessLevel.readPrivate') },
             { value: Permission.ADMIN, name: this.$t('account.accessLevel.admin') },
         ];
     }
@@ -148,6 +148,7 @@ class UserInvite extends mixins(MixinForm) {
     get userPermissionOptionsState(): Array<PermissionOption> {
         return [
             { value: Permission.NONE, name: this.$t('account.accessLevel.none') },
+            { value: Permission.READ_PRIVATE, name: this.$t('account.accessLevel.readPrivate') },
             { value: Permission.WRITE, name: this.$t('account.accessLevel.write') },
             { value: Permission.ADMIN, name: this.$t('account.accessLevel.admin') },
         ];
@@ -350,8 +351,8 @@ class UserInvite extends mixins(MixinForm) {
         if (compactPermission) {
             if (compactPermission.isAdmin) {
                 permission = Permission.ADMIN;
-            } else if (compactPermission.isRead) {
-                permission = Permission.READ;
+            } else if (compactPermission.isReadPrivate) {
+                permission = Permission.READ_PRIVATE;
             }
         }
 
@@ -361,21 +362,23 @@ class UserInvite extends mixins(MixinForm) {
     setCompactPermission(permission: Permission): PermissionObject {
         const response: PermissionObject = {};
 
-        switch (permission) {
-        case Permission.NONE:
-            response.isRead = false;
-            response.isAdmin = false;
-            break;
-        case Permission.READ:
-            response.isRead = true;
-            response.isAdmin = false;
-            break;
-        case Permission.ADMIN:
-            response.isRead = true;
-            response.isAdmin = true;
-            break;
-        default:
-            break;
+        if (this.isCurrentUserCompactAdmin) {
+            switch (permission) {
+            case Permission.NONE:
+                response.isReadPrivate = false;
+                response.isAdmin = false;
+                break;
+            case Permission.READ_PRIVATE:
+                response.isReadPrivate = true;
+                response.isAdmin = false;
+                break;
+            case Permission.ADMIN:
+                response.isReadPrivate = true;
+                response.isAdmin = true;
+                break;
+            default:
+                break;
+            }
         }
 
         return response;
@@ -389,6 +392,8 @@ class UserInvite extends mixins(MixinForm) {
                 permission = Permission.ADMIN;
             } else if (statePermission.isWrite) {
                 permission = Permission.WRITE;
+            } else if (statePermission.isReadPrivate) {
+                permission = Permission.READ_PRIVATE;
             }
         }
 
@@ -400,14 +405,22 @@ class UserInvite extends mixins(MixinForm) {
 
         switch (permission) {
         case Permission.NONE:
+            response.isReadPrivate = false;
+            response.isWrite = false;
+            response.isAdmin = false;
+            break;
+        case Permission.READ_PRIVATE:
+            response.isReadPrivate = true;
             response.isWrite = false;
             response.isAdmin = false;
             break;
         case Permission.WRITE:
+            response.isReadPrivate = true;
             response.isWrite = true;
             response.isAdmin = false;
             break;
         case Permission.ADMIN:
+            response.isReadPrivate = true;
             response.isWrite = true;
             response.isAdmin = true;
             break;
diff --git a/webroot/src/components/Users/UserRowEdit/UserRowEdit.ts b/webroot/src/components/Users/UserRowEdit/UserRowEdit.ts
index 1d10458cb..da82b4edb 100644
--- a/webroot/src/components/Users/UserRowEdit/UserRowEdit.ts
+++ b/webroot/src/components/Users/UserRowEdit/UserRowEdit.ts
@@ -37,13 +37,13 @@ interface PermissionOption {
 
 enum Permission {
     NONE = 'none',
-    READ = 'read',
+    READ_PRIVATE = 'readPrivate',
     WRITE = 'write',
     ADMIN = 'admin',
 }
 
 interface PermissionObject {
-    isRead?: boolean;
+    isReadPrivate?: boolean;
     isWrite?: boolean;
     isAdmin?: boolean;
 }
@@ -145,7 +145,7 @@ class UserRowEdit extends mixins(MixinForm) {
     get userPermissionOptionsCompact(): Array<PermissionOption> {
         return [
             { value: Permission.NONE, name: this.$t('account.accessLevel.none') },
-            { value: Permission.READ, name: this.$t('account.accessLevel.read') },
+            { value: Permission.READ_PRIVATE, name: this.$t('account.accessLevel.readPrivate') },
             { value: Permission.ADMIN, name: this.$t('account.accessLevel.admin') },
         ];
     }
@@ -163,6 +163,7 @@ class UserRowEdit extends mixins(MixinForm) {
     get userPermissionOptionsState(): Array<PermissionOption> {
         return [
             { value: Permission.NONE, name: this.$t('account.accessLevel.none') },
+            { value: Permission.READ_PRIVATE, name: this.$t('account.accessLevel.readPrivate') },
             { value: Permission.WRITE, name: this.$t('account.accessLevel.write') },
             { value: Permission.ADMIN, name: this.$t('account.accessLevel.admin') },
         ];
@@ -347,8 +348,8 @@ class UserRowEdit extends mixins(MixinForm) {
         if (compactPermission) {
             if (compactPermission.isAdmin) {
                 permission = Permission.ADMIN;
-            } else if (compactPermission.isRead) {
-                permission = Permission.READ;
+            } else if (compactPermission.isReadPrivate) {
+                permission = Permission.READ_PRIVATE;
             }
         }
 
@@ -358,21 +359,23 @@ class UserRowEdit extends mixins(MixinForm) {
     setCompactPermission(permission: Permission): PermissionObject {
         const response: PermissionObject = {};
 
-        switch (permission) {
-        case Permission.NONE:
-            response.isRead = false;
-            response.isAdmin = false;
-            break;
-        case Permission.READ:
-            response.isRead = true;
-            response.isAdmin = false;
-            break;
-        case Permission.ADMIN:
-            response.isRead = true;
-            response.isAdmin = true;
-            break;
-        default:
-            break;
+        if (this.isCurrentUserCompactAdmin) {
+            switch (permission) {
+            case Permission.NONE:
+                response.isReadPrivate = false;
+                response.isAdmin = false;
+                break;
+            case Permission.READ_PRIVATE:
+                response.isReadPrivate = true;
+                response.isAdmin = false;
+                break;
+            case Permission.ADMIN:
+                response.isReadPrivate = true;
+                response.isAdmin = true;
+                break;
+            default:
+                break;
+            }
         }
 
         return response;
@@ -386,6 +389,8 @@ class UserRowEdit extends mixins(MixinForm) {
                 permission = Permission.ADMIN;
             } else if (statePermission.isWrite) {
                 permission = Permission.WRITE;
+            } else if (statePermission.isReadPrivate) {
+                permission = Permission.READ_PRIVATE;
             }
         }
 
@@ -397,14 +402,22 @@ class UserRowEdit extends mixins(MixinForm) {
 
         switch (permission) {
         case Permission.NONE:
+            response.isReadPrivate = false;
+            response.isWrite = false;
+            response.isAdmin = false;
+            break;
+        case Permission.READ_PRIVATE:
+            response.isReadPrivate = true;
             response.isWrite = false;
             response.isAdmin = false;
             break;
         case Permission.WRITE:
+            response.isReadPrivate = true;
             response.isWrite = true;
             response.isAdmin = false;
             break;
         case Permission.ADMIN:
+            response.isReadPrivate = true;
             response.isWrite = true;
             response.isAdmin = true;
             break;
@@ -458,15 +471,44 @@ class UserRowEdit extends mixins(MixinForm) {
         };
         const stateKeys = Object.keys(formValues).filter((key) => key.startsWith('state-option'));
 
+        // Server endpoints may not be idempotent so the frontend needs to handle statefulness;
+        // e.g. if the user's server permisson is already false, we may get a server error if we try to send false again.
+        const existingCompactPermission = this.getCompactPermission(this.rowUserCompactPermission);
+
+        if (existingCompactPermission !== Permission.READ_PRIVATE && !compactData.isReadPrivate) {
+            delete compactData.isReadPrivate;
+        }
+        if (existingCompactPermission !== Permission.ADMIN && !compactData.isAdmin) {
+            delete compactData.isAdmin;
+        }
+        // End: Handle compact statefulness
+
         stateKeys.forEach((stateKey) => {
             const keyNum = stateKey.split('-').pop();
             const stateAbbrev = formValues[`state-option-${keyNum}`];
             const statePermission = formValues[`state-permission-${keyNum}`];
-
-            compactData.states.push({
+            const stateData = {
                 abbrev: stateAbbrev,
                 ...this.setStatePermission(statePermission),
-            });
+            };
+
+            // Server endpoints may not be idempotent so the frontend needs to handle statefulness;
+            // e.g. if the user's server permisson is already false, we may get a server error if we try to send false again.
+            const existingStatePermission = this.getStatePermission(this.userStatePermissions.find((permission) =>
+                permission.state?.abbrev === stateAbbrev) || null);
+
+            if (existingStatePermission !== Permission.READ_PRIVATE && !stateData.isReadPrivate) {
+                delete stateData.isReadPrivate;
+            }
+            if (existingStatePermission !== Permission.WRITE && !stateData.isWrite) {
+                delete stateData.isWrite;
+            }
+            if (existingStatePermission !== Permission.ADMIN && !stateData.isAdmin) {
+                delete stateData.isAdmin;
+            }
+            // End: Handle state statefulness
+
+            compactData.states.push(stateData);
         });
 
         return compactData;
diff --git a/webroot/src/locales/en.json b/webroot/src/locales/en.json
index 4b3851e92..5b13435e3 100644
--- a/webroot/src/locales/en.json
+++ b/webroot/src/locales/en.json
@@ -566,6 +566,7 @@
         "accessLevel": {
             "none": "None",
             "read": "Read",
+            "readPrivate": "Read Private",
             "write": "Write",
             "admin": "Admin"
         },
diff --git a/webroot/src/locales/es.json b/webroot/src/locales/es.json
index 30fe96e61..db94682af 100644
--- a/webroot/src/locales/es.json
+++ b/webroot/src/locales/es.json
@@ -566,6 +566,7 @@
         "accessLevel": {
             "none": "Ninguno",
             "read": "Lectura",
+            "readPrivate": "Leer datos privados",
             "write": "Escritura",
             "admin": "Administración"
         },
diff --git a/webroot/src/models/Licensee/Licensee.model.spec.ts b/webroot/src/models/Licensee/Licensee.model.spec.ts
index a2d02d615..d8b074149 100644
--- a/webroot/src/models/Licensee/Licensee.model.spec.ts
+++ b/webroot/src/models/Licensee/Licensee.model.spec.ts
@@ -242,4 +242,44 @@ describe('Licensee model', () => {
 
         expect(transmit.id).to.equal(licensee.id);
     });
+    it('should create a Licensee with null address fallbacks', () => {
+        const data = {
+            address: null,
+        };
+        const licensee = new Licensee(data);
+
+        // Test field values
+        expect(licensee.address).equal(data.address);
+
+        // Test methods
+        expect(licensee.residenceLocation()).to.equal('');
+    });
+    it('should create a Licensee with empty state name fallbacks', () => {
+        const licensee = new Licensee();
+
+        // Test methods
+        expect(licensee.getStateListDisplay(['', '', ''])).to.equal('');
+    });
+    it('should create a Licensee with empty license & privilege object state name fallbacks', () => {
+        const licensee = new Licensee({
+            licenses: [null],
+            privileges: [null],
+        });
+
+        // Test methods
+        expect(licensee.licenseStatesDisplay()).to.equal('');
+        expect(licensee.privilegeStatesDisplay()).to.equal('');
+        expect(licensee.privilegeStatesAllDisplay()).to.equal('');
+    });
+    it('should create a Licensee with empty license & privilege string state name fallbacks', () => {
+        const licensee = new Licensee({
+            licenseStates: null,
+            privilegeStates: null,
+        });
+
+        // Test methods
+        expect(licensee.licenseStatesDisplay()).to.equal('');
+        expect(licensee.privilegeStatesDisplay()).to.equal('');
+        expect(licensee.privilegeStatesAllDisplay()).to.equal('');
+    });
 });
diff --git a/webroot/src/models/Licensee/Licensee.model.ts b/webroot/src/models/Licensee/Licensee.model.ts
index 21a9915fd..8cd57d343 100644
--- a/webroot/src/models/Licensee/Licensee.model.ts
+++ b/webroot/src/models/Licensee/Licensee.model.ts
@@ -142,7 +142,7 @@ export class Licensee implements InterfaceLicensee {
         let stateNames: Array<string> = [];
 
         if (this.licenses?.length) {
-            stateNames = this.licenses.map((license: License) => license.issueState?.name() || '');
+            stateNames = this.licenses.map((license: License) => license?.issueState?.name() || '');
         } else {
             stateNames = this.licenseStates?.map((state: State) => state.name()) || [];
         }
@@ -155,7 +155,7 @@ export class Licensee implements InterfaceLicensee {
         let stateNames: Array<string> = [];
 
         if (this.privileges?.length) {
-            stateNames = this.privileges.map((privilege: License) => privilege.issueState?.name() || '');
+            stateNames = this.privileges.map((privilege: License) => privilege?.issueState?.name() || '');
         } else {
             stateNames = this.privilegeStates?.map((state: State) => state.name()) || [];
         }
@@ -167,7 +167,7 @@ export class Licensee implements InterfaceLicensee {
         let stateNames: Array<string> = [];
 
         if (this.privileges?.length) {
-            stateNames = this.privileges.map((privilege: License) => privilege.issueState?.name() || '');
+            stateNames = this.privileges.map((privilege: License) => privilege?.issueState?.name() || '');
         } else {
             stateNames = this.privilegeStates?.map((state: State) => state.name()) || [];
         }
diff --git a/webroot/src/models/StaffUser/StaffUser.model.spec.ts b/webroot/src/models/StaffUser/StaffUser.model.spec.ts
index e0e7a6334..a3f5b7942 100644
--- a/webroot/src/models/StaffUser/StaffUser.model.spec.ts
+++ b/webroot/src/models/StaffUser/StaffUser.model.spec.ts
@@ -17,7 +17,7 @@ chai.use(chaiMatchPattern);
 
 const { expect } = chai;
 
-describe('User model', () => {
+describe('Staff User model', () => {
     before(() => {
         const { tm: $tm, t: $t } = i18n.global;
 
@@ -64,11 +64,12 @@ describe('User model', () => {
             permissions: [
                 {
                     compact: new Compact({ type: CompactType.ASLP }),
-                    isRead: true,
+                    isReadPrivate: true,
                     isAdmin: true,
                     states: [
                         {
                             state: new State({ abbrev: 'co' }),
+                            isReadPrivate: true,
                             isWrite: true,
                             isAdmin: true,
                         },
@@ -89,10 +90,11 @@ describe('User model', () => {
         expect(user.permissions).to.matchPattern([
             {
                 compact: new Compact({ type: CompactType.ASLP }),
-                isRead: true,
+                isReadPrivate: true,
                 isAdmin: true,
                 states: [
                     {
+                        isReadPrivate: true,
                         isWrite: true,
                         isAdmin: true,
                         '...': '',
@@ -103,10 +105,10 @@ describe('User model', () => {
         expect(user.accountStatus).to.equal(data.accountStatus);
         expect(user.getFullName()).to.equal(`${data.firstName} ${data.lastName}`);
         expect(user.getInitials()).to.equal('FL');
-        expect(user.permissionsShortDisplay()).to.equal('Read, Admin');
+        expect(user.permissionsShortDisplay()).to.equal('Read Private, Admin');
         expect(user.permissionsFullDisplay()).to.matchPattern([
-            'ASLP: Read, Admin',
-            'Colorado: Write, Admin',
+            'ASLP: Read Private, Admin',
+            'Colorado: Read Private, Write, Admin',
         ]);
         expect(user.affiliationDisplay()).to.equal('ASLP');
         expect(user.statesDisplay()).to.equal('Colorado');
@@ -117,7 +119,6 @@ describe('User model', () => {
             permissions: [
                 {
                     compact: new Compact({ type: CompactType.ASLP }),
-                    isRead: false,
                     isAdmin: true,
                     states: [
                         {
@@ -145,11 +146,10 @@ describe('User model', () => {
             permissions: [
                 {
                     compact: new Compact({ type: CompactType.ASLP }),
-                    isRead: false,
-                    isAdmin: false,
                     states: [
                         {
                             state: new State({ abbrev: 'co' }),
+                            isReadPrivate: true,
                             isWrite: true,
                             isAdmin: true,
                         },
@@ -160,9 +160,9 @@ describe('User model', () => {
         const user = new StaffUser(data);
 
         expect(user).to.be.an.instanceof(StaffUser);
-        expect(user.permissionsShortDisplay(CompactType.ASLP)).to.equal('Write, Admin');
+        expect(user.permissionsShortDisplay(CompactType.ASLP)).to.equal('Read Private, Write, Admin');
         expect(user.permissionsFullDisplay()).to.matchPattern([
-            'Colorado: Write, Admin',
+            'Colorado: Read Private, Write, Admin',
         ]);
         expect(user.affiliationDisplay(CompactType.ASLP)).to.equal('Colorado');
         expect(user.statesDisplay(CompactType.ASLP)).to.equal('Colorado');
@@ -172,22 +172,17 @@ describe('User model', () => {
             permissions: [
                 {
                     compact: new Compact({ type: CompactType.ASLP }),
-                    isRead: false,
-                    isAdmin: false,
                     states: [
                         {
                             state: new State({ abbrev: 'xx' }),
-                            isWrite: false,
                             isAdmin: true,
                         },
                         {
                             state: new State({ abbrev: 'co' }),
-                            isWrite: false,
                             isAdmin: true,
                         },
                         {
                             state: new State({ abbrev: 'md' }),
-                            isWrite: false,
                             isAdmin: true,
                         },
                     ],
@@ -218,12 +213,13 @@ describe('User model', () => {
             permissions: {
                 aslp: {
                     actions: {
-                        read: true,
+                        readPrivate: true,
                         admin: true,
                     },
                     jurisdictions: {
                         co: {
                             actions: {
+                                readPrivate: true,
                                 write: true,
                                 admin: true,
                             },
@@ -249,10 +245,11 @@ describe('User model', () => {
                     })),
                     '...': '',
                 },
-                isRead: true,
+                isReadPrivate: true,
                 isAdmin: true,
                 states: [
                     {
+                        isReadPrivate: true,
                         isWrite: true,
                         isAdmin: true,
                         '...': '',
@@ -265,10 +262,10 @@ describe('User model', () => {
         expect(user.userType).to.equal(AuthTypes.STAFF);
         expect(user.getFullName()).to.equal(`${data.attributes.givenName} ${data.attributes.familyName}`);
         expect(user.getInitials()).to.equal('FL');
-        expect(user.permissionsShortDisplay()).to.equal('Read, Admin');
+        expect(user.permissionsShortDisplay()).to.equal('Read Private, Admin');
         expect(user.permissionsFullDisplay()).to.matchPattern([
-            'ASLP: Read, Admin',
-            'Colorado: Write, Admin',
+            'ASLP: Read Private, Admin',
+            'Colorado: Read Private, Write, Admin',
         ]);
         expect(user.affiliationDisplay()).to.equal('ASLP');
         expect(user.statesDisplay()).to.equal('Colorado');
@@ -279,11 +276,12 @@ describe('User model', () => {
             permissions: [
                 {
                     compact: CompactType.ASLP,
-                    isRead: true,
+                    isReadPrivate: true,
                     isAdmin: true,
                     states: [
                         {
                             abbrev: 'co',
+                            isReadPrivate: true,
                             isWrite: true,
                             isAdmin: true,
                         },
@@ -302,12 +300,13 @@ describe('User model', () => {
             permissions: {
                 [CompactType.ASLP]: {
                     actions: {
-                        read: true,
+                        readPrivate: true,
                         admin: true,
                     },
                     jurisdictions: {
                         co: {
                             actions: {
+                                readPrivate: true,
                                 write: true,
                                 admin: true,
                             },
diff --git a/webroot/src/models/StaffUser/StaffUser.model.ts b/webroot/src/models/StaffUser/StaffUser.model.ts
index 6107f48bb..26b9bceeb 100644
--- a/webroot/src/models/StaffUser/StaffUser.model.ts
+++ b/webroot/src/models/StaffUser/StaffUser.model.ts
@@ -18,13 +18,14 @@ import { User, InterfaceUserCreate } from '@models/User/User.model';
 // ========================================================
 export interface StatePermission {
     state: State;
+    isReadPrivate: boolean;
     isWrite: boolean;
     isAdmin: boolean;
 }
 
 export interface CompactPermission {
     compact: Compact;
-    isRead: boolean;
+    isReadPrivate: boolean;
     isAdmin: boolean;
     states: Array<StatePermission>;
 }
@@ -55,7 +56,7 @@ export class StaffUser extends User implements InterfaceStaffUserCreate {
 
     public permissionsShortDisplay(currentCompactType?: CompactType): string {
         let { permissions } = this;
-        let isReadUsed = false;
+        let isReadPrivateUsed = false;
         let isWriteUsed = false;
         let isAdminUsed = false;
         let display = '';
@@ -67,20 +68,20 @@ export class StaffUser extends User implements InterfaceStaffUserCreate {
 
         permissions?.forEach((compactPermission: CompactPermission) => {
             const {
-                isRead,
-                isAdmin,
+                isReadPrivate: isCompactReadPrivate,
+                isAdmin: isCompactAdmin,
                 states
             } = compactPermission;
 
-            if (isRead || isAdmin) {
+            if (isCompactReadPrivate || isCompactAdmin) {
                 // If the user has compact-level permissions
-                if (isRead && !isReadUsed) {
-                    const readDisplay = this.$t('account.accessLevel.read');
+                if (isCompactReadPrivate && !isReadPrivateUsed) {
+                    const readPrivateDisplay = this.$t('account.accessLevel.readPrivate');
 
-                    display += (display) ? `, ${readDisplay}` : readDisplay;
-                    isReadUsed = true;
+                    display += (display) ? `, ${readPrivateDisplay}` : readPrivateDisplay;
+                    isReadPrivateUsed = true;
                 }
-                if (isAdmin && !isAdminUsed) {
+                if (isCompactAdmin && !isAdminUsed) {
                     const adminDisplay = this.$t('account.accessLevel.admin');
 
                     display += (display) ? `, ${adminDisplay}` : adminDisplay;
@@ -89,9 +90,19 @@ export class StaffUser extends User implements InterfaceStaffUserCreate {
             } else {
                 // Otherwise look for state-level permissions
                 states?.forEach((statePermission) => {
-                    const { isWrite, isAdmin: isStateAdmin } = statePermission;
+                    const {
+                        isReadPrivate: isStateReadPrivate,
+                        isWrite: isStateWrite,
+                        isAdmin: isStateAdmin
+                    } = statePermission;
 
-                    if (isWrite && !isWriteUsed) {
+                    if (isStateReadPrivate && !isReadPrivateUsed) {
+                        const readPrivateDisplay = this.$t('account.accessLevel.readPrivate');
+
+                        display += (display) ? `, ${readPrivateDisplay}` : readPrivateDisplay;
+                        isReadPrivateUsed = true;
+                    }
+                    if (isStateWrite && !isWriteUsed) {
                         const writeDisplay = this.$t('account.accessLevel.write');
 
                         display += (display) ? `, ${writeDisplay}` : writeDisplay;
@@ -122,18 +133,18 @@ export class StaffUser extends User implements InterfaceStaffUserCreate {
         permissions?.forEach((compactPermission: CompactPermission) => {
             const {
                 compact,
-                isRead,
-                isAdmin,
+                isReadPrivate: isCompactReadPrivate,
+                isAdmin: isCompactAdmin,
                 states
             } = compactPermission;
 
-            if (isRead || isAdmin) {
+            if (isCompactReadPrivate || isCompactAdmin) {
                 let accessLevels = '';
 
-                if (isRead) {
-                    accessLevels += this.$t('account.accessLevel.read');
+                if (isCompactReadPrivate) {
+                    accessLevels += this.$t('account.accessLevel.readPrivate');
                 }
-                if (isAdmin) {
+                if (isCompactAdmin) {
                     const adminAccess = this.$t('account.accessLevel.admin');
 
                     accessLevels += (accessLevels) ? `, ${adminAccess}` : adminAccess;
@@ -143,11 +154,21 @@ export class StaffUser extends User implements InterfaceStaffUserCreate {
             }
 
             states?.forEach((statePermission) => {
-                const { state, isWrite, isAdmin: isStateAdmin } = statePermission;
+                const {
+                    state,
+                    isReadPrivate: isStateReadPrivate,
+                    isWrite: isStateWrite,
+                    isAdmin: isStateAdmin
+                } = statePermission;
                 let stateAccessLevels = '';
 
-                if (isWrite) {
-                    stateAccessLevels += this.$t('account.accessLevel.write');
+                if (isStateReadPrivate) {
+                    stateAccessLevels += this.$t('account.accessLevel.readPrivate');
+                }
+                if (isStateWrite) {
+                    const stateWriteAccess = this.$t('account.accessLevel.write');
+
+                    stateAccessLevels += (stateAccessLevels) ? `, ${stateWriteAccess}` : stateWriteAccess;
                 }
                 if (isStateAdmin) {
                     const stateAdminAccess = this.$t('account.accessLevel.admin');
@@ -193,12 +214,12 @@ export class StaffUser extends User implements InterfaceStaffUserCreate {
         permissions?.forEach((compactPermission: CompactPermission) => {
             const {
                 compact,
-                isRead,
-                isAdmin,
+                isReadPrivate: isCompactReadPrivate,
+                isAdmin: isCompactAdmin,
                 states
             } = compactPermission as CompactPermission;
 
-            if (isRead || isAdmin) {
+            if (isCompactReadPrivate || isCompactAdmin) {
                 // If the user has compact-level permissions
                 const compactAbbrev = compact.abbrev();
 
@@ -206,10 +227,14 @@ export class StaffUser extends User implements InterfaceStaffUserCreate {
             } else {
                 // Otherwise look for state-level permissions
                 states?.forEach((statePermission) => {
-                    const { isWrite, isAdmin: isStateAdmin } = statePermission;
+                    const {
+                        isReadPrivate: isStateReadPrivate,
+                        isWrite: isStateWrite,
+                        isAdmin: isStateAdmin
+                    } = statePermission;
                     const stateName = statePermission.state.name();
 
-                    if ((isWrite || isStateAdmin) && !stateNames.includes(stateName)) {
+                    if ((isStateReadPrivate || isStateWrite || isStateAdmin) && !stateNames.includes(stateName)) {
                         stateNames.push(statePermission.state.name());
                     }
                 });
@@ -239,10 +264,10 @@ export class StaffUser extends User implements InterfaceStaffUserCreate {
             const { states } = compactPermission as CompactPermission;
 
             states?.forEach((statePermission) => {
-                const { isWrite, isAdmin } = statePermission;
+                const { isReadPrivate, isWrite, isAdmin } = statePermission;
                 const stateName = statePermission.state.name();
 
-                if ((isWrite || isAdmin) && !stateNames.includes(stateName)) {
+                if ((isReadPrivate || isWrite || isAdmin) && !stateNames.includes(stateName)) {
                     stateNames.push(statePermission.state.name());
                 }
             });
@@ -275,7 +300,7 @@ export class StaffUserSerializer {
             const { actions = {}, jurisdictions = {}} = json.permissions?.[compactType] || {};
             const compactPermission: CompactPermission = {
                 compact: CompactSerializer.fromServer({ type: compactType }),
-                isRead: actions?.read || false,
+                isReadPrivate: actions?.readPrivate || false,
                 isAdmin: actions?.admin || false,
                 states: [],
             };
@@ -283,6 +308,7 @@ export class StaffUserSerializer {
             Object.keys(jurisdictions).forEach((stateCode) => {
                 compactPermission.states.push({
                     state: new State({ abbrev: stateCode }),
+                    isReadPrivate: jurisdictions[stateCode]?.actions?.readPrivate || false,
                     isWrite: jurisdictions[stateCode]?.actions?.write || false,
                     isAdmin: jurisdictions[stateCode]?.actions?.admin || false,
                 });
@@ -298,14 +324,18 @@ export class StaffUserSerializer {
         const serverData: any = {};
         // Prepare state permissions for server request
         const deserializeStatePermission = (statePermission, jurisdictions) => {
+            const hasStateReadPrivateSetting = Object.prototype.hasOwnProperty.call(statePermission, 'isReadPrivate');
             const hasStateWriteSetting = Object.prototype.hasOwnProperty.call(statePermission, 'isWrite');
             const hasStateAdminSetting = Object.prototype.hasOwnProperty.call(statePermission, 'isAdmin');
 
-            if (hasStateWriteSetting || hasStateAdminSetting) {
+            if (hasStateReadPrivateSetting || hasStateWriteSetting || hasStateAdminSetting) {
                 const actions: any = {};
 
                 jurisdictions[statePermission.abbrev] = { actions };
 
+                if (hasStateReadPrivateSetting) {
+                    actions.readPrivate = statePermission.isReadPrivate;
+                }
                 if (hasStateWriteSetting) {
                     actions.write = statePermission.isWrite;
                 }
@@ -316,17 +346,17 @@ export class StaffUserSerializer {
         };
         // Prepare compact permissions for server request
         const deserializeCompactPermission = (compactPermission) => {
-            const hasCompactReadSetting = Object.prototype.hasOwnProperty.call(compactPermission, 'isRead');
+            const hasCompactReadPrivateSetting = Object.prototype.hasOwnProperty.call(compactPermission, 'isReadPrivate');
             const hasCompactAdminSetting = Object.prototype.hasOwnProperty.call(compactPermission, 'isAdmin');
             const hasStates = Boolean(compactPermission.states?.length);
 
-            if (hasCompactReadSetting || hasCompactAdminSetting) {
+            if (hasCompactReadPrivateSetting || hasCompactAdminSetting) {
                 const actions: any = {};
 
                 serverData.permissions[compactPermission.compact] = { actions };
 
-                if (hasCompactReadSetting) {
-                    actions.read = compactPermission.isRead;
+                if (hasCompactReadPrivateSetting) {
+                    actions.readPrivate = compactPermission.isReadPrivate;
                 }
                 if (hasCompactAdminSetting) {
                     actions.admin = compactPermission.isAdmin;
@@ -349,6 +379,7 @@ export class StaffUserSerializer {
             serverData.permissions = {};
 
             data.permissions.forEach((compactPermission) => {
+                serverData.permissions[compactPermission.compact] = {};
                 deserializeCompactPermission(compactPermission);
             });
         }

From 32788eced0375035f2478be3a1d9f8223b0af834 Mon Sep 17 00:00:00 2001
From: Dana Stiefel <35410938+ChiefStief@users.noreply.github.com>
Date: Mon, 13 Jan 2025 11:55:09 -0700
Subject: [PATCH 12/18] Feat/military affiliation (#426)

### Requirements List
- A working LicenseeUser account

### Description List
- Added in Military Status page
- Added in Update Military Status page
- Added in store + network modules needed to facilitate pages'
functionality
- Updated Licensee model and serializer to capture military affiliations
api implementation
- Added military affiliations model and serializer
- Edited `FinalizePrivilegePurchase` page and
`SelectedStatePurchaseInformation` component to refer to both the state
and user's military status to make a military discount determination
- Fixed bug in `InputRadioGroup` component causing multi-line labels to
break layout
- Added / updated tests as needed

### Testing List
- `yarn test:unit:all` should run without errors or warnings
- `yarn serve` should run without errors or warnings
- `yarn build` should run without errors or warnings
- Code review
- On both mock and real api and in all screen sizes:
1) click on the view military status button to view your status page
2) Click edit info to go the doc upload page
3) Fill out the form, confirm it does not allow submission with no
select choice and no / invalid document selection
4) Submit
5) View your updated military status (real api only)
6) Go through the privilege purchase flow and notice military
affiliation discount is being applied
7) Return to the military status screen; try ending your military status
8) Status should now be inactive
9) Go back through privilege purchase flow, confirm military affiliation
is no longer being applied

Closes #281

Notes:

- The real API system only saves one document upload submission per day.
It will replace a prior submission in the day with your most recent one
- The document upload is eventually consistent so your status may not
immediately update. I've found it to take ~1 second but theoretically it
could be longer.

---------

Co-authored-by: Dana Stiefel <dana@inspiringapps.com>
---
 .../components/Forms/InputFile/InputFile.ts   |   6 +-
 .../InputRadioGroup/InputRadioGroup.less      |   7 +-
 .../MilitaryDocumentRow.less                  |  37 +++
 .../MilitaryDocumentRow.spec.ts               |  23 ++
 .../MilitaryDocumentRow.ts                    |  14 ++
 .../MilitaryDocumentRow.vue                   |  22 ++
 .../SelectedStatePurchaseInformation.less     |   2 +-
 .../SelectedStatePurchaseInformation.ts       |   8 +-
 .../SelectedStatePurchaseInformation.vue      |   2 +-
 webroot/src/locales/en.json                   |  38 ++-
 webroot/src/locales/es.json                   |  38 ++-
 .../models/Licensee/Licensee.model.spec.ts    | 145 ++++++++++-
 webroot/src/models/Licensee/Licensee.model.ts |  32 ++-
 .../MilitaryAffiliation.model.spec.ts         |  99 ++++++++
 .../MilitaryAffiliation.model.ts              |  70 ++++++
 webroot/src/network/data.api.ts               |  24 ++
 webroot/src/network/mocks/mock.data.api.ts    |  32 ++-
 webroot/src/network/mocks/mock.data.ts        |   2 +-
 webroot/src/network/userApi/data.api.ts       |  52 ++++
 webroot/src/network/userApi/interceptors.ts   |   3 +-
 .../FinalizePrivilegePurchase.ts              |  16 +-
 .../LicenseeDashboard/LicenseeDashboard.less  |  36 ++-
 .../LicenseeDashboard/LicenseeDashboard.ts    |  16 ++
 .../LicenseeDashboard/LicenseeDashboard.vue   |  23 +-
 .../pages/MilitaryStatus/MilitaryStatus.less  | 137 +++++++++++
 .../MilitaryStatus/MilitaryStatus.spec.ts     |  19 ++
 .../pages/MilitaryStatus/MilitaryStatus.ts    | 229 ++++++++++++++++++
 .../pages/MilitaryStatus/MilitaryStatus.vue   | 123 ++++++++++
 .../MilitaryStatusUpdate.less                 |  74 ++++++
 .../MilitaryStatusUpdate.spec.ts              |  19 ++
 .../MilitaryStatusUpdate.ts                   | 161 ++++++++++++
 .../MilitaryStatusUpdate.vue                  |  53 ++++
 .../PurchaseSuccessful.less                   |   2 +-
 .../SelectPrivileges/SelectPrivileges.less    |   2 +-
 .../SelectPrivileges/SelectPrivileges.vue     |   4 +-
 webroot/src/router/routes.ts                  |  12 +
 webroot/src/store/user/user.actions.ts        |  53 ++++
 webroot/src/store/user/user.mutations.ts      |  32 ++-
 webroot/src/store/user/user.spec.ts           | 204 ++++++++++++----
 39 files changed, 1790 insertions(+), 81 deletions(-)
 create mode 100644 webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.less
 create mode 100644 webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.spec.ts
 create mode 100644 webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.ts
 create mode 100644 webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.vue
 create mode 100644 webroot/src/models/MilitaryAffiliation/MilitaryAffiliation.model.spec.ts
 create mode 100644 webroot/src/models/MilitaryAffiliation/MilitaryAffiliation.model.ts
 create mode 100644 webroot/src/pages/MilitaryStatus/MilitaryStatus.less
 create mode 100644 webroot/src/pages/MilitaryStatus/MilitaryStatus.spec.ts
 create mode 100644 webroot/src/pages/MilitaryStatus/MilitaryStatus.ts
 create mode 100644 webroot/src/pages/MilitaryStatus/MilitaryStatus.vue
 create mode 100644 webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.less
 create mode 100644 webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.spec.ts
 create mode 100644 webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.ts
 create mode 100644 webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.vue

diff --git a/webroot/src/components/Forms/InputFile/InputFile.ts b/webroot/src/components/Forms/InputFile/InputFile.ts
index cde358950..12c1d4dba 100644
--- a/webroot/src/components/Forms/InputFile/InputFile.ts
+++ b/webroot/src/components/Forms/InputFile/InputFile.ts
@@ -5,7 +5,11 @@
 //  Created by InspiringApps on 7/8/2020.
 //
 
-import { Component, mixins, toNative } from 'vue-facing-decorator';
+import {
+    Component,
+    mixins,
+    toNative
+} from 'vue-facing-decorator';
 import { reactive } from 'vue';
 import MixinInput from '@components/Forms/_mixins/input.mixin';
 import UploadFileIcon from '@components/Icons/UploadFile/UploadFile.vue';
diff --git a/webroot/src/components/Forms/InputRadioGroup/InputRadioGroup.less b/webroot/src/components/Forms/InputRadioGroup/InputRadioGroup.less
index 6254d2aee..966788b00 100644
--- a/webroot/src/components/Forms/InputRadioGroup/InputRadioGroup.less
+++ b/webroot/src/components/Forms/InputRadioGroup/InputRadioGroup.less
@@ -39,11 +39,14 @@
         label {
             display: flex;
             align-items: center;
+            margin-left: 3rem;
             font-weight: @fontWeightLight;
             cursor: pointer;
 
             &::before {
-                display: inline-block;
+                position: absolute;
+                top: 0;
+                left: -3rem;
                 width: 2.0rem;
                 height: 2.0rem;
                 margin: 0 0.3rem 0 0;
@@ -60,7 +63,7 @@
         input[type='radio']:checked + label::after {
             position: absolute;
             top: 0.4rem;
-            left: 0.4rem;
+            left: -2.6rem;
             display: block;
             width: 1.4rem;
             height: 1.4rem;
diff --git a/webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.less b/webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.less
new file mode 100644
index 000000000..efbaf721d
--- /dev/null
+++ b/webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.less
@@ -0,0 +1,37 @@
+//
+//  MilitaryDocumentRow.less
+//  InspiringApps modules
+//
+//  Created by InspiringApps on 4/30/2021.
+//
+
+.example-row {
+    display: flex;
+    flex-direction: column;
+    padding: 0.8rem 0;
+    border-bottom: 0.1rem solid @midGrey;
+
+    @media @tabletWidth {
+        flex-direction: row;
+    }
+
+    .cell {
+        flex-basis: 0;
+        flex-grow: 1;
+        flex-shrink: 1;
+        color: @veryDarkGrey;
+
+        &.is-header {
+            display: none;
+            font-weight: @fontWeightBold;
+
+            @media @tabletWidth {
+                display: flex;
+            }
+        }
+
+        .cell-title {
+            font-weight: @fontWeightBold;
+        }
+    }
+}
diff --git a/webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.spec.ts b/webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.spec.ts
new file mode 100644
index 000000000..76b2d8d57
--- /dev/null
+++ b/webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.spec.ts
@@ -0,0 +1,23 @@
+//
+//  MilitaryDocumentRow.spec.ts
+//  InspiringApps modules
+//
+//  Created by InspiringApps on 4/30/2021.
+//
+
+import { expect } from 'chai';
+import { mountShallow } from '@tests/helpers/setup';
+import MilitaryDocumentRow from '@components/MilitaryDocumentRow/MilitaryDocumentRow.vue';
+
+describe('MilitaryDocumentRow component', async () => {
+    it('should mount the component', async () => {
+        const wrapper = await mountShallow(MilitaryDocumentRow, {
+            props: {
+                item: {},
+            }
+        });
+
+        expect(wrapper.exists()).to.equal(true);
+        expect(wrapper.findComponent(MilitaryDocumentRow).exists()).to.equal(true);
+    });
+});
diff --git a/webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.ts b/webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.ts
new file mode 100644
index 000000000..d455c593c
--- /dev/null
+++ b/webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.ts
@@ -0,0 +1,14 @@
+//
+//  MilitaryDocumentRow.ts
+//  InspiringApps modules
+//
+//  Created by InspiringApps on 4/30/2021.
+//
+
+import { Component, Prop, Vue } from 'vue-facing-decorator';
+
+@Component
+export default class MilitaryDocumentRow extends Vue {
+    @Prop({ required: true }) item!: any;
+    @Prop({ default: false }) isHeaderRow?: boolean;
+}
diff --git a/webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.vue b/webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.vue
new file mode 100644
index 000000000..3223b0755
--- /dev/null
+++ b/webroot/src/components/MilitaryDocumentRow/MilitaryDocumentRow.vue
@@ -0,0 +1,22 @@
+<!--
+    MilitaryDocumentRow.vue
+    InspiringApps modules
+
+    Created by InspiringApps on 4/30/2021.
+-->
+
+<template>
+    <li class="example-row">
+        <div class="cell" :class="{ 'is-header': isHeaderRow }">
+            <span v-if="$matches.phone.only" class="cell-title">{{ $t('military.fileName') }}:</span>
+            {{ item.name }}
+        </div>
+        <div class="cell" :class="{ 'is-header': isHeaderRow }">
+            <span v-if="$matches.phone.only" class="cell-title">{{ $t('military.dateUploaded') }}:</span>
+            {{ item.date }}
+        </div>
+    </li>
+</template>
+
+<script lang="ts" src="./MilitaryDocumentRow.ts"></script>
+<style scoped lang="less" src="./MilitaryDocumentRow.less"></style>
diff --git a/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.less b/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.less
index 825fa8f06..18e73faa1 100644
--- a/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.less
+++ b/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.less
@@ -64,7 +64,7 @@
                     height: 4rem;
                     margin: -1rem -1.2rem 0 0;
                     padding: 0;
-                    color: white;
+                    color: @white;
 
                     @media @tabletWidth {
                         margin: 0 -1.2rem 0 0;
diff --git a/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.ts b/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.ts
index 2e4706b8d..1164fc91d 100644
--- a/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.ts
+++ b/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.ts
@@ -110,7 +110,7 @@ class SelectedStatePurchaseInformation extends mixins(MixinForm) {
     }
 
     get militaryDiscountText(): string {
-        return this.$t('licensing.militaryDiscountText');
+        return this.$t('military.militaryDiscountText');
     }
 
     get jurisprudenceModalTitle(): string {
@@ -149,8 +149,12 @@ class SelectedStatePurchaseInformation extends mixins(MixinForm) {
         return this.selectedStatePurchaseData?.isMilitaryDiscountActive || false;
     }
 
+    get shouldApplyMilitaryDiscount(): boolean {
+        return Boolean(this.isMilitaryDiscountActive && this.licensee?.isMilitary());
+    }
+
     get subTotal(): string {
-        const militaryDiscount = this.isMilitaryDiscountActive
+        const militaryDiscount = this.shouldApplyMilitaryDiscount
             && this.selectedStatePurchaseData?.militaryDiscountAmount
             ? this.selectedStatePurchaseData?.militaryDiscountAmount : 0;
 
diff --git a/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.vue b/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.vue
index ec0088bfe..ae14387ed 100644
--- a/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.vue
+++ b/webroot/src/components/SelectedStatePurchaseInformation/SelectedStatePurchaseInformation.vue
@@ -30,7 +30,7 @@
                 <div class="info-row-label">{{commissionFeeText}}</div>
                 <div class="expire-date-value">${{currentCompactCommissionFeeDisplay}}</div>
             </div>
-            <div v-if="selectedStatePurchaseData.isMilitaryDiscountActive" class="info-row sub-row">
+            <div v-if="shouldApplyMilitaryDiscount" class="info-row sub-row">
                 <div class="info-row-label">{{militaryDiscountText}}</div>
                 <div class="expire-date-value">-${{militaryDiscountAmountDisplay}}</div>
             </div>
diff --git a/webroot/src/locales/en.json b/webroot/src/locales/en.json
index 5b13435e3..2c632b655 100644
--- a/webroot/src/locales/en.json
+++ b/webroot/src/locales/en.json
@@ -477,6 +477,7 @@
     "licensing": {
         "license": "License",
         "licensingListTitle": "Licensing Data",
+        "attestation": "Attestation",
         "searchTitle": "Begin a search",
         "searchSubtext": "Enter at least one field to search for licensing data.",
         "licenseExpiredMessage": "Your license has expired.",
@@ -498,7 +499,6 @@
         "state": "State",
         "issued": "Issued",
         "expirationDate": "Expiration date",
-        "militaryDiscountText": "Military Discount",
         "expireDate": "Expire Date",
         "expires": "Expires",
         "selectPrivileges": "Select privileges",
@@ -553,6 +553,42 @@
             }
         ]
     },
+    "military": {
+        "militaryStatusTitle": "Military status",
+        "updateMilitaryStatusTitle": "Update military status",
+        "viewMilitaryStatus": "View military status",
+        "militaryDiscountText": "Military Discount",
+        "affiliationType": "Affiliation Type",
+        "previouslyUploadedDocuments": "Previously Uploaded Documents",
+        "endMilitaryAffiliation": "End military affiliation",
+        "editInfo": "Edit info",
+        "noUploadedDocuments": "No uploaded documents",
+        "endAffiliationModalTitle": "Are you sure you want to end your military affiliation?",
+        "endAffiliationModalContent" : "This action cannot be undone, but if needed, you can go through the confirmation process again.",
+        "noGoBack": "No, go back",
+        "yesEnd": "Yes, end my affiliation",
+        "affiliationAttestationOptions": [
+            {
+                "name": "I hereby attest and affirm that I am an active-duty military member, defined as a person with a full-time duty status in the active uniformed service of the United States, including members of the National Guard and Reserve on active duty orders.",
+                "value": "militaryMember"
+            },
+            {
+                "name": "I hereby attest and affirm that I am the legal spouse of an active-duty military member, defined as a person with a full-time duty status in the active uniformed service of the United States, including members of the National Guard and Reserve on active duty orders.",
+                "value": "militaryMemberSpouse"
+            }
+        ],
+        "affiliationTypes": {
+            "militaryMember": "Active-duty military member",
+            "militaryMemberSpouse": "Active-duty military spouse",
+            "none": "N/A"
+        },
+        "documentProofLabel": "Upload proof of military affiliation*",
+        "successLongProcess": "Submit successful, your status may take a minute to process",
+        "submitFail": "Error uploading document",
+        "fileInstructions": "Only 1 file (PDF, docx, png, jpeg only)",
+        "fileName": "File name",
+        "dateUploaded": "Date uploaded"
+    },
     "account": {
         "accountTitle": "Account",
         "usersListTitle": "Users",
diff --git a/webroot/src/locales/es.json b/webroot/src/locales/es.json
index db94682af..a7449a09e 100644
--- a/webroot/src/locales/es.json
+++ b/webroot/src/locales/es.json
@@ -477,6 +477,7 @@
     "licensing": {
         "licensingListTitle": "Datos de licencia",
         "searchTitle": "Iniciar una búsqueda",
+        "attestation": "Atestación",
         "searchSubtext": "Introduzca al menos un campo para buscar datos de licencia.",
         "searchLabel": "Buscar",
         "searchPlaceholderName": "Introducir nombre",
@@ -491,7 +492,6 @@
         "issueDate": "Fecha de asunto",
         "expireDate": "Fecha de caducidad",
         "expirationDate": "Fecha de caducidad",
-        "militaryDiscountText": "Descuento Militar",
         "lastUpdate": "Última carga",
         "license": "Licencia",
         "licenseExpiredMessage": "Su licencia ha caducado.",
@@ -553,6 +553,42 @@
             }
         ]
     },
+    "military": {
+        "militaryStatusTitle": "Estado militar",
+        "updateMilitaryStatusTitle": "Actualizar el estado militar",
+        "militaryDiscountText": "Descuento Militar",
+        "viewMilitaryStatus": "Ver estado militar",
+        "affiliationType": "Tipo de afiliación",
+        "previouslyUploadedDocuments": "Previously Uploaded Documents",
+        "endMilitaryAffiliation": "Parar afiliación militar",
+        "editInfo": "Editar información",
+        "noUploadedDocuments": "No documentos cargados",
+        "endAffiliationModalTitle": "¿Está seguro de que desea poner fin a su afiliación militar?",
+        "endAffiliationModalContent" : "Esta acción no se puede deshacer, pero si es necesario, puedes volver a realizar el proceso de confirmación.",
+        "noGoBack": "No, regresa",
+        "yesEnd": "Sí, terminar mi afiliación",
+        "affiliationAttestationOptions": [
+            {
+                "name": "Por la presente doy fe y afirmo que soy un miembro militar en servicio activo, definido como una persona con un estado de servicio de tiempo completo en el servicio uniformado activo de los Estados Unidos, incluidos los miembros de la Guardia Nacional y la Reserva en servicio activo.",
+                "value": "militaryMember"
+            },
+            {
+                "name": "Por la presente doy fe y afirmo que soy el cónyuge legal de un miembro militar en servicio activo, definido como una persona con estatus de servicio de tiempo completo en el servicio uniformado activo de los Estados Unidos, incluidos los miembros de la Guardia Nacional y la Reserva en activo. órdenes de servicio.",
+                "value": "militaryMemberSpouse"
+            }
+        ],
+        "affiliationTypes": {
+            "militaryMember": "Miembro militar en servicio activo",
+            "militaryMemberSpouse": "Esposo militar en servicio activo",
+            "none": "N/A"
+        },
+        "documentProofLabel": "Cargar prueba de afiliación militar",
+        "successLongProcess": "Enviado correctamente, su estado puede tardar un minuto en procesarse",
+        "submitFail": "Error al cargar el documento",
+        "fileInstructions": "Sólo 1 archivo (sólo PDF, docx, png, jpeg)",
+        "fileName": "Nombre del archivo",
+        "dateUploaded": "Fecha de carga"
+    },
     "account": {
         "accountTitle": "Cuenta",
         "usersListTitle": "Usuarios",
diff --git a/webroot/src/models/Licensee/Licensee.model.spec.ts b/webroot/src/models/Licensee/Licensee.model.spec.ts
index d8b074149..24dd1ccf4 100644
--- a/webroot/src/models/Licensee/Licensee.model.spec.ts
+++ b/webroot/src/models/Licensee/Licensee.model.spec.ts
@@ -11,6 +11,7 @@ import { CompactType } from '@models/Compact/Compact.model';
 import { Licensee, LicenseeStatus, LicenseeSerializer } from '@models/Licensee/Licensee.model';
 import { Address } from '@models/Address/Address.model';
 import { License, LicenseOccupation, LicenseStatus } from '@models/License/License.model';
+import { MilitaryAffiliation } from '@models/MilitaryAffiliation/MilitaryAffiliation.model';
 import { State } from '@models/State/State.model';
 import i18n from '@/i18n';
 import moment from 'moment';
@@ -41,17 +42,19 @@ describe('Licensee model', () => {
         expect(licensee.address).to.be.an.instanceof(Address);
         expect(licensee.dob).to.equal(null);
         expect(licensee.ssn).to.equal(null);
-        expect(licensee.isMilitary).to.equal(false);
         expect(licensee.occupation).to.equal(null);
         expect(licensee.licenseStates).to.be.an('array').that.is.empty;
         expect(licensee.licenses).to.be.an('array').that.is.empty;
         expect(licensee.privilegeStates).to.be.an('array').that.is.empty;
         expect(licensee.privileges).to.be.an('array').that.is.empty;
+        expect(licensee.militaryAffiliations).to.be.an('array').that.is.empty;
         expect(licensee.lastUpdated).to.equal(null);
         expect(licensee.status).to.equal(LicenseeStatus.INACTIVE);
 
         // Test methods
         expect(licensee.nameDisplay()).to.equal('');
+        expect(licensee.isMilitary()).to.equal(false);
+        expect(licensee.aciveMilitaryAffiliation()).to.equal(null);
         expect(licensee.residenceLocation()).to.equal('Unknown');
         expect(licensee.dobDisplay()).to.equal('');
         expect(licensee.ssnMaskedFull()).to.equal('');
@@ -74,7 +77,7 @@ describe('Licensee model', () => {
             address: new Address(),
             dob: '2020-01-01',
             ssn: 'test-ssn',
-            isMilitary: true,
+            militaryAffiliations: [new MilitaryAffiliation()],
             occupation: LicenseOccupation.AUDIOLOGIST,
             licenseStates: [new State()],
             licenses: [
@@ -101,7 +104,6 @@ describe('Licensee model', () => {
         expect(licensee.address).to.be.an.instanceof(Address);
         expect(licensee.dob).to.equal(data.dob);
         expect(licensee.ssn).to.equal(data.ssn);
-        expect(licensee.isMilitary).to.equal(data.isMilitary);
         expect(licensee.occupation).to.equal(data.occupation);
         expect(licensee.licenseStates).to.be.an('array').with.length(1);
         expect(licensee.licenseStates[0]).to.be.an.instanceof(State);
@@ -117,6 +119,8 @@ describe('Licensee model', () => {
         // Test methods
         expect(licensee.nameDisplay()).to.equal(`${data.firstName} ${data.lastName}`);
         expect(licensee.residenceLocation()).to.equal('Unknown');
+        expect(licensee.isMilitary()).to.equal(false);
+        expect(licensee.aciveMilitaryAffiliation()).to.equal(null);
         expect(licensee.dobDisplay()).to.equal('1/1/2020');
         expect(licensee.ssnMaskedFull()).to.equal(data.ssn);
         expect(licensee.ssnMaskedPartial()).to.equal('test-ss-ssn');
@@ -128,7 +132,115 @@ describe('Licensee model', () => {
         expect(licensee.privilegeStatesDisplay()).to.equal('Unknown');
         expect(licensee.occupationName()).to.equal('Audiologist');
     });
-    it('should create a Licensee with specific values through serializer', () => {
+    it('should create a Licensee with specific values (active military) through serializer', () => {
+        const data = {
+            providerId: 'test-id',
+            npi: 'test-npi',
+            givenName: 'test-firstName',
+            middleName: 'test-middleName',
+            familyName: 'test-lastName',
+            homeAddressStreet1: 'test-street1',
+            homeAddressStreet2: 'test-street2',
+            homeAddressCity: 'test-city',
+            homeAddressState: 'co',
+            homeAddressPostalCode: 'test-zip',
+            dateOfBirth: moment().format(serverDateFormat),
+            ssn: '000-00-0000',
+            licenseType: LicenseOccupation.AUDIOLOGIST,
+            licenseJurisdiction: 'co',
+            militaryAffiliations: [{
+                affiliationType: 'affiliationType',
+                compact: 'aslp',
+                dateOfUpdate: '2025-01-07T23:50:17+00:00',
+                dateOfUpload: '2025-01-03T23:50:17+00:00',
+                documentKeys: ['key'],
+                fileNames: ['file.png'],
+                status: 'active'
+            }],
+            licenses: [
+                {
+                    id: 'test-id',
+                    compact: CompactType.ASLP,
+                    type: 'license-home',
+                    jurisdiction: 'co',
+                    issueDate: moment().format(serverDateFormat),
+                    renewalDate: moment().format(serverDateFormat),
+                    expireDate: moment().subtract(1, 'day').format(serverDateFormat),
+                    licenseType: LicenseOccupation.AUDIOLOGIST,
+                    status: LicenseStatus.ACTIVE,
+                },
+            ],
+            privilegeJurisdictions: ['co'],
+            privileges: [
+                {
+                    id: 'test-id',
+                    compact: CompactType.ASLP,
+                    type: 'privilege',
+                    jurisdiction: 'co',
+                    issueDate: moment().format(serverDateFormat),
+                    renewalDate: moment().format(serverDateFormat),
+                    expireDate: moment().subtract(1, 'day').format(serverDateFormat),
+                    licenseType: LicenseOccupation.AUDIOLOGIST,
+                    status: LicenseStatus.ACTIVE,
+                },
+            ],
+            dateOfUpdate: moment().format(serverDateFormat),
+            status: LicenseeStatus.ACTIVE,
+        };
+        const licensee = LicenseeSerializer.fromServer(data);
+
+        // Test field values
+        expect(licensee).to.be.an.instanceof(Licensee);
+        expect(licensee.id).to.equal(data.providerId);
+        expect(licensee.npi).to.equal(data.npi);
+        expect(licensee.firstName).to.equal(data.givenName);
+        expect(licensee.middleName).to.equal(data.middleName);
+        expect(licensee.lastName).to.equal(data.familyName);
+        expect(licensee.dob).to.equal(data.dateOfBirth);
+        expect(licensee.ssn).to.equal(data.ssn);
+        expect(licensee.occupation).to.equal(data.licenseType);
+        expect(licensee.address).to.be.an.instanceof(Address);
+        expect(licensee.licenseStates).to.be.an('array').with.length(1);
+        expect(licensee.licenseStates[0]).to.be.an.instanceof(State);
+        expect(licensee.licenses).to.be.an('array').with.length(1);
+        expect(licensee.licenses[0]).to.be.an.instanceof(License);
+        expect(licensee.privilegeStates).to.be.an('array').with.length(1);
+        expect(licensee.privilegeStates[0]).to.be.an.instanceof(State);
+        expect(licensee.privileges).to.be.an('array').with.length(1);
+        expect(licensee.privileges[0]).to.be.an.instanceof(License);
+        expect(licensee.lastUpdated).to.equal(data.dateOfUpdate);
+        expect(licensee.militaryAffiliations).to.be.an('array').with.length(1);
+        expect(licensee.militaryAffiliations[0]).to.be.an.instanceof(MilitaryAffiliation);
+        expect(licensee.status).to.equal(data.status);
+
+        // Test methods
+        expect(licensee.isMilitary()).to.equal(true);
+        expect(licensee.aciveMilitaryAffiliation()).to.matchPattern({
+            affiliationType: 'affiliationType',
+            compact: 'aslp',
+            dateOfUpdate: '2025-01-07T23:50:17+00:00',
+            dateOfUpload: '2025-01-03T23:50:17+00:00',
+            documentKeys: ['key'],
+            fileNames: ['file.png'],
+            status: 'active'
+        });
+        expect(licensee.nameDisplay()).to.equal(`${data.givenName} ${data.familyName}`);
+        expect(licensee.residenceLocation()).to.equal('Colorado');
+        expect(licensee.dobDisplay()).to.equal(
+            moment(data.dateOfBirth, serverDateFormat).format(displayDateFormat)
+        );
+        expect(licensee.ssnMaskedFull()).to.equal(`###-##-####`);
+        expect(licensee.ssnMaskedPartial()).to.equal(`###-##-0000`);
+        expect(licensee.lastUpdatedDisplay()).to.equal(
+            moment(data.dateOfUpdate, serverDateFormat).format(displayDateFormat)
+        );
+        expect(licensee.lastUpdatedDisplayRelative()).to.be.a('string').that.is.not.empty;
+        expect(licensee.licenseStatesDisplay()).to.equal('Colorado');
+        expect(licensee.privilegeStatesAllDisplay()).to.equal('Colorado');
+        expect(licensee.privilegeStatesDisplay()).to.equal('Colorado');
+        expect(licensee.occupationName()).to.equal('Audiologist');
+    });
+    it('should create a Licensee with specific values (inactive military) through serializer', () => {
         const data = {
             providerId: 'test-id',
             npi: 'test-npi',
@@ -142,9 +254,26 @@ describe('Licensee model', () => {
             homeAddressPostalCode: 'test-zip',
             dateOfBirth: moment().format(serverDateFormat),
             ssn: '000-00-0000',
-            militaryWaiver: true,
             licenseType: LicenseOccupation.AUDIOLOGIST,
             licenseJurisdiction: 'co',
+            militaryAffiliations: [{
+                affiliationType: 'affiliationType',
+                compact: 'aslp',
+                dateOfUpdate: '2025-01-07T23:50:17+00:00',
+                dateOfUpload: '2025-01-03T23:50:17+00:00',
+                documentKeys: ['key'],
+                fileNames: ['file.png'],
+                status: 'inactive'
+            },
+            {
+                affiliationType: 'affiliationType',
+                compact: 'aslp',
+                dateOfUpdate: '2025-02-07T23:50:17+00:00',
+                dateOfUpload: '2025-02-03T23:50:17+00:00',
+                documentKeys: ['key'],
+                fileNames: ['file.png'],
+                status: 'inactive'
+            }],
             licenses: [
                 {
                     id: 'test-id',
@@ -186,7 +315,6 @@ describe('Licensee model', () => {
         expect(licensee.lastName).to.equal(data.familyName);
         expect(licensee.dob).to.equal(data.dateOfBirth);
         expect(licensee.ssn).to.equal(data.ssn);
-        expect(licensee.isMilitary).to.equal(data.militaryWaiver);
         expect(licensee.occupation).to.equal(data.licenseType);
         expect(licensee.address).to.be.an.instanceof(Address);
         expect(licensee.licenseStates).to.be.an('array').with.length(1);
@@ -198,9 +326,14 @@ describe('Licensee model', () => {
         expect(licensee.privileges).to.be.an('array').with.length(1);
         expect(licensee.privileges[0]).to.be.an.instanceof(License);
         expect(licensee.lastUpdated).to.equal(data.dateOfUpdate);
+        expect(licensee.militaryAffiliations).to.be.an('array').with.length(2);
+        expect(licensee.militaryAffiliations[0]).to.be.an.instanceof(MilitaryAffiliation);
+        expect(licensee.militaryAffiliations[1]).to.be.an.instanceof(MilitaryAffiliation);
         expect(licensee.status).to.equal(data.status);
 
         // Test methods
+        expect(licensee.isMilitary()).to.equal(false);
+        expect(licensee.aciveMilitaryAffiliation()).to.equal(null);
         expect(licensee.nameDisplay()).to.equal(`${data.givenName} ${data.familyName}`);
         expect(licensee.residenceLocation()).to.equal('Colorado');
         expect(licensee.dobDisplay()).to.equal(
diff --git a/webroot/src/models/Licensee/Licensee.model.ts b/webroot/src/models/Licensee/Licensee.model.ts
index 8cd57d343..e6f3e55a8 100644
--- a/webroot/src/models/Licensee/Licensee.model.ts
+++ b/webroot/src/models/Licensee/Licensee.model.ts
@@ -9,8 +9,15 @@ import deleteUndefinedProperties from '@models/_helpers';
 import { dateDisplay, relativeFromNowDisplay } from '@models/_formatters/date';
 import { Address, AddressSerializer } from '@models/Address/Address.model';
 import { License, LicenseOccupation, LicenseSerializer } from '@models/License/License.model';
+import { MilitaryAffiliation, MilitaryAffiliationSerializer } from '@models/MilitaryAffiliation/MilitaryAffiliation.model';
 import { State } from '@models/State/State.model';
 
+/**
+ * This model is used to represent both get one and get all server responses
+ * the params: licenses, privileges and militaryAffiliations are not present on get all responses
+ * those params will be therefore be empty arrays on such objects
+ */
+
 // ========================================================
 // =                       Interface                      =
 // ========================================================
@@ -28,8 +35,8 @@ export interface InterfaceLicensee {
     address?: Address;
     dob?: string | null;
     ssn?: string | null;
-    isMilitary?: boolean;
     occupation?: LicenseOccupation | null;
+    militaryAffiliations?: Array <MilitaryAffiliation>;
     licenseStates?: Array<State>;
     licenses?: Array<License>;
     privilegeStates?: Array<State>;
@@ -52,11 +59,11 @@ export class Licensee implements InterfaceLicensee {
     public address? = new Address();
     public dob? = null;
     public ssn? = null;
-    public isMilitary? = false;
     public occupation? = null;
     public licenseStates? = [];
     public licenses? = [];
     public privilegeStates? = [];
+    public militaryAffiliations? = [];
     public privileges? = [];
     public lastUpdated? = null;
     public status? = LicenseeStatus.INACTIVE;
@@ -186,6 +193,18 @@ export class Licensee implements InterfaceLicensee {
     public statusDisplay(): string {
         return this.$t(`licensing.statusOptions.${this.status}`);
     }
+
+    public isMilitary(): boolean {
+        // The API does not return the affiliations in the get-all endpoint therefore all users will appear unaffiliated
+        // if only that endpoint has been called
+        return this.militaryAffiliations?.some((affiliation) => ((affiliation as MilitaryAffiliation).status as any) === 'active') || false;
+    }
+
+    public aciveMilitaryAffiliation(): MilitaryAffiliation | null {
+        // The API does not return the affiliations in the get-all endpoint therefore all users will appear unaffiliated
+        // if only that endpoint has been called
+        return this.militaryAffiliations?.find((affiliation) => ((affiliation as MilitaryAffiliation).status as any) === 'active') || null;
+    }
 }
 
 // ========================================================
@@ -208,12 +227,12 @@ export class LicenseeSerializer {
             }),
             dob: json.dateOfBirth,
             ssn: json.ssn,
-            isMilitary: json.militaryWaiver || false,
             occupation: json.licenseType,
             licenseStates: [] as Array<State>,
             licenses: [] as Array<License>,
             privilegeStates: [] as Array<State>,
             privileges: [] as Array<License>,
+            militaryAffiliations: [] as Array<MilitaryAffiliation>,
             status: json.status,
             lastUpdated: json.dateOfUpdate,
         };
@@ -244,6 +263,13 @@ export class LicenseeSerializer {
             });
         }
 
+        // In get-one responses, server returns military affiliation ojects, does not in get-all
+        if (Array.isArray(json.militaryAffiliations)) {
+            json.militaryAffiliations.forEach((serverAffiliation) => {
+                licenseeData.militaryAffiliations.push(MilitaryAffiliationSerializer.fromServer(serverAffiliation));
+            });
+        }
+
         return new Licensee(licenseeData);
     }
 
diff --git a/webroot/src/models/MilitaryAffiliation/MilitaryAffiliation.model.spec.ts b/webroot/src/models/MilitaryAffiliation/MilitaryAffiliation.model.spec.ts
new file mode 100644
index 000000000..074d9ceab
--- /dev/null
+++ b/webroot/src/models/MilitaryAffiliation/MilitaryAffiliation.model.spec.ts
@@ -0,0 +1,99 @@
+//
+//  User.model.spec.ts
+//  InspiringApps modules
+//
+//  Created by InspiringApps on 4/12/2020.
+//
+import { MilitaryAffiliationSerializer, MilitaryAffiliation } from '@models/MilitaryAffiliation/MilitaryAffiliation.model';
+import { dateDisplay } from '@models/_formatters/date';
+import i18n from '@/i18n';
+
+import chaiMatchPattern from 'chai-match-pattern';
+import chai from 'chai';
+
+chai.use(chaiMatchPattern);
+
+const { expect } = chai;
+
+describe('User model', () => {
+    before(() => {
+        const { tm: $tm, t: $t } = i18n.global;
+
+        (window as any).Vue = {
+            config: {
+                globalProperties: {
+                    $tm,
+                    $t,
+                }
+            }
+        };
+    });
+    it('should create a MilitaryAffiliation with expected defaults', () => {
+        const militaryAffiliation = new MilitaryAffiliation();
+
+        expect(militaryAffiliation).to.be.an.instanceof(MilitaryAffiliation);
+        expect(militaryAffiliation.affiliationType).to.equal(null);
+        expect(militaryAffiliation.compact).to.equal(null);
+        expect(militaryAffiliation.dateOfUpdate).to.equal(null);
+        expect(militaryAffiliation.dateOfUpload).to.equal(null);
+        expect(militaryAffiliation.documentKeys).to.equal(null);
+        expect(militaryAffiliation.fileNames).to.equal(null);
+        expect(militaryAffiliation.status).to.equal(null);
+
+        // Test methods
+        expect(militaryAffiliation.dateOfUpdateDisplay()).to.equal('');
+        expect(militaryAffiliation.dateOfUploadDisplay()).to.equal('');
+    });
+    it('should create a MilitaryAffiliation with specific values', () => {
+        const data = {
+            affiliationType: 'affiliationType',
+            compact: 'aslp',
+            dateOfUpdate: '2025-01-07T23:50:17+00:00',
+            dateOfUpload: '2025-01-03T23:50:17+00:00',
+            documentKeys: ['key'],
+            fileNames: ['file.png'],
+            status: 'active'
+        };
+
+        const militaryAffiliation = new MilitaryAffiliation(data);
+
+        expect(militaryAffiliation).to.be.an.instanceof(MilitaryAffiliation);
+        expect(militaryAffiliation.affiliationType).to.equal(data.affiliationType);
+        expect(militaryAffiliation.compact).to.equal(data.compact);
+        expect(militaryAffiliation.dateOfUpdate).to.equal(data.dateOfUpdate);
+        expect(militaryAffiliation.dateOfUpload).to.equal(data.dateOfUpload);
+        expect(militaryAffiliation.documentKeys).to.matchPattern(data.documentKeys);
+        expect(militaryAffiliation.fileNames).to.matchPattern(data.fileNames);
+        expect(militaryAffiliation.status).to.equal(data.status);
+
+        // Test methods
+        expect(militaryAffiliation.dateOfUpdateDisplay()).to.equal(dateDisplay(data.dateOfUpdate));
+        expect(militaryAffiliation.dateOfUploadDisplay()).to.equal(dateDisplay(data.dateOfUpload));
+    });
+    it('should create a MilitaryAffiliation with specific values through MilitaryAffiliation serializer', () => {
+        const data = {
+            affiliationType: 'affiliationType',
+            compact: 'aslp',
+            dateOfUpdate: '2025-01-07T23:50:17+00:00',
+            dateOfUpload: '2025-01-03T23:50:17+00:00',
+            documentKeys: ['key'],
+            fileNames: ['file.png'],
+            status: 'active'
+        };
+
+        const militaryAffiliation = MilitaryAffiliationSerializer.fromServer(data);
+
+        expect(militaryAffiliation).to.be.an.instanceof(MilitaryAffiliation);
+        expect(militaryAffiliation.affiliationType).to.equal(data.affiliationType);
+        expect(militaryAffiliation.compact).to.equal(data.compact);
+        expect(militaryAffiliation.dateOfUpdate).to.equal(data.dateOfUpdate);
+        expect(militaryAffiliation.dateOfUpload).to.equal(data.dateOfUpload);
+        expect(militaryAffiliation.documentKeys).to.matchPattern(data.documentKeys);
+        expect(militaryAffiliation.fileNames).to.matchPattern(data.fileNames);
+        expect(militaryAffiliation.status).to.equal(data.status);
+
+        // Test methods
+        expect(militaryAffiliation.dateOfUpdateDisplay()).to.equal(dateDisplay(data.dateOfUpdate));
+        expect(militaryAffiliation.dateOfUploadDisplay()).to.equal(dateDisplay(data.dateOfUpload));
+    });
+});
diff --git a/webroot/src/models/MilitaryAffiliation/MilitaryAffiliation.model.ts b/webroot/src/models/MilitaryAffiliation/MilitaryAffiliation.model.ts
new file mode 100644
index 000000000..6afae4cec
--- /dev/null
+++ b/webroot/src/models/MilitaryAffiliation/MilitaryAffiliation.model.ts
@@ -0,0 +1,70 @@
+//
+//  MilitaryAffiliation.model.ts
+//  InspiringApps modules
+//
+//  Created by InspiringApps on 4/12/20.
+//
+
+import deleteUndefinedProperties from '@models/_helpers';
+import { Compact } from '@models/Compact/Compact.model';
+import { dateDisplay } from '@models/_formatters/date';
+
+// ========================================================
+// =                       Interface                      =
+// ========================================================
+export interface InterfaceMilitaryAffiliationCreate {
+    affiliationType?: string | null;
+    compact?: Compact | null;
+    dateOfUpdate?: string | null;
+    dateOfUpload?: string | null;
+    documentKeys?: Array<string> | null;
+    fileNames?: Array<string> | null;
+    status?: string | null;
+}
+
+// ========================================================
+// =                        Model                         =
+// ========================================================
+export class MilitaryAffiliation implements InterfaceMilitaryAffiliationCreate {
+    public affiliationType? = null;
+    public compact? = null;
+    public dateOfUpdate? = null;
+    public dateOfUpload? = null;
+    public documentKeys? = null;
+    public fileNames? = null;
+    public status? = null;
+
+    constructor(data?: InterfaceMilitaryAffiliationCreate) {
+        const cleanDataObject = deleteUndefinedProperties(data);
+
+        Object.assign(this, cleanDataObject);
+    }
+
+    // Helpers
+    public dateOfUpdateDisplay(): string {
+        return dateDisplay(this.dateOfUpdate);
+    }
+
+    public dateOfUploadDisplay(): string {
+        return dateDisplay(this.dateOfUpload);
+    }
+}
+
+// ========================================================
+// =                      Serializer                      =
+// ========================================================
+export class MilitaryAffiliationSerializer {
+    static fromServer(json: any): MilitaryAffiliation {
+        const data: any = {
+            affiliationType: json.affiliationType,
+            compact: json.compact,
+            dateOfUpdate: json.dateOfUpdate,
+            dateOfUpload: json.dateOfUpload,
+            documentKeys: json.documentKeys,
+            fileNames: json.fileNames,
+            status: json.status
+        };
+
+        return new MilitaryAffiliation(data);
+    }
+}
diff --git a/webroot/src/network/data.api.ts b/webroot/src/network/data.api.ts
index 1ebff2bd1..748679f4e 100644
--- a/webroot/src/network/data.api.ts
+++ b/webroot/src/network/data.api.ts
@@ -173,6 +173,30 @@ export class DataApi {
         return userDataApi.postPrivilegePurchases(data);
     }
 
+    /**
+     * POST Upload Military Document Intent for Authenticated Licensee user.
+     * @return {Promise<object>} Intent response object containing presigned S3 url and necessary params to upload document.
+     */
+    public postUploadMilitaryDocumentIntent(data: any) {
+        return userDataApi.postUploadMilitaryDocumentIntent(data);
+    }
+
+    /**
+     * POST Upload Military Affiliation Document for Authenticated Licensee user.
+     * @return {Promise<object>} Document upload response object.
+     */
+    public postUploadMilitaryAffiliationDocument(postUrl: string, documentUploadData: any, file: File) {
+        return userDataApi.postUploadMilitaryAffiliationDocument(postUrl, documentUploadData, file);
+    }
+
+    /**
+     * PATCH Cancel Military Affiliation.
+     * @return {Promise<object>} Purchase response object.
+     */
+    public endMilitaryAffiliation() {
+        return userDataApi.endMilitaryAffiliation();
+    }
+
     // ========================================================================
     //                              EXAMPLE API
     // ========================================================================
diff --git a/webroot/src/network/mocks/mock.data.api.ts b/webroot/src/network/mocks/mock.data.api.ts
index 36642eb76..d222d9233 100644
--- a/webroot/src/network/mocks/mock.data.api.ts
+++ b/webroot/src/network/mocks/mock.data.api.ts
@@ -13,7 +13,7 @@ import { PrivilegePurchaseOptionSerializer } from '@models/PrivilegePurchaseOpti
 import {
     userData,
     staffAccount,
-    stateUploadRequestData,
+    uploadRequestData,
     licensees,
     users,
     pets,
@@ -52,7 +52,7 @@ export class DataApi {
     // Get state upload request configuration.
     public getStateUploadRequestConfig(compact: string, state: string) {
         return this.wait(500).then(() => ({
-            ...stateUploadRequestData,
+            ...uploadRequestData,
             compact,
             state,
         }));
@@ -185,6 +185,34 @@ export class DataApi {
         return this.wait(500).then(() => ({ message: 'Successfully processed charge', transactionId: '120044154134' }));
     }
 
+    // Post Upload Military Document Intent
+    public postUploadMilitaryDocumentIntent(data) {
+        return this.wait(500).then(() => ({
+            ...data,
+            documentUploadFields: [{
+                url: 'url.com',
+                fields: {
+                    some: 'asd'
+                }
+            }]
+        }));
+    }
+
+    // Post Upload Military Document
+    public postUploadMilitaryAffiliationDocument(postUrl: string, documentUploadData: any, file: File) {
+        return this.wait(500).then(() => ({
+            status: 204,
+            postUrl,
+            documentUploadData,
+            file
+        }));
+    }
+
+    // Patch end military affiliation
+    public endMilitaryAffiliation() {
+        return this.wait(500).then(() => ({ success: true }));
+    }
+
     // ========================================================================
     //                              EXAMPLE API
     // ========================================================================
diff --git a/webroot/src/network/mocks/mock.data.ts b/webroot/src/network/mocks/mock.data.ts
index 349c223d3..e126d9431 100644
--- a/webroot/src/network/mocks/mock.data.ts
+++ b/webroot/src/network/mocks/mock.data.ts
@@ -101,7 +101,7 @@ export const staffAccount = {
     },
 };
 
-export const stateUploadRequestData = {
+export const uploadRequestData = {
     upload: {
         url: `https://example.com`,
         fields: {
diff --git a/webroot/src/network/userApi/data.api.ts b/webroot/src/network/userApi/data.api.ts
index 6b94caf81..d7862c63a 100644
--- a/webroot/src/network/userApi/data.api.ts
+++ b/webroot/src/network/userApi/data.api.ts
@@ -255,6 +255,58 @@ export class UserDataApi implements DataApiInterface {
 
         return serverResponse;
     }
+
+    /**
+     * POST Upload Military Document Intent for Authenticated Licensee user.
+     * @return {Promise<object>} Intent response object containing presigned S3 url and necessary params to upload document.
+     */
+    public async postUploadMilitaryDocumentIntent(data: any) {
+        const serverResponse: any = await this.api.post(`/v1/provider-users/me/military-affiliation`, data);
+
+        return serverResponse;
+    }
+
+    /**
+     * POST Upload Military Affiliation Document for Authenticated Licensee user.
+     * @return {Promise<object>} Document upload response object.
+     */
+    public async postUploadMilitaryAffiliationDocument(postUrl: string, documentUploadData: any, file: File) {
+        const formData = new FormData();
+        const s3FieldOrder = [ // S3 is picky about the order of the FormData fields
+            'key',
+            'x-amz-algorithm',
+            'x-amz-credential',
+            'x-amz-date',
+            'x-amz-signature',
+            'x-amz-security-token',
+            'policy',
+        ];
+
+        s3FieldOrder.forEach((field) => {
+            formData.append(field, documentUploadData[field]);
+        });
+        formData.append('file', file);
+
+        return axios.post(postUrl, formData, {
+            headers: {
+                'Content-Type': 'multipart/form-data',
+                Accept: '*/*',
+
+            }
+        });
+    }
+
+    /**
+     * PATCH Cancel Military Affiliation.
+     * @return {Promise<object>} Purchase response object.
+     */
+    public async endMilitaryAffiliation() {
+        const serverResponse: any = await this.api.patch(`/v1/provider-users/me/military-affiliation`, {
+            status: 'inactive'
+        });
+
+        return serverResponse;
+    }
 }
 
 export const userDataApi = new UserDataApi();
diff --git a/webroot/src/network/userApi/interceptors.ts b/webroot/src/network/userApi/interceptors.ts
index 89fb80646..f17a73f5e 100644
--- a/webroot/src/network/userApi/interceptors.ts
+++ b/webroot/src/network/userApi/interceptors.ts
@@ -20,7 +20,8 @@ export const requestSuccess = () => async (requestConfig) => {
     const licenseeUserEndPoints = [
         '/v1/provider-users/me',
         '/v1/purchases/privileges/options',
-        '/v1/purchases/privileges'
+        '/v1/purchases/privileges',
+        '/v1/provider-users/me/military-affiliation'
     ];
     const { headers, url } = requestConfig;
     let authToken;
diff --git a/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.ts b/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.ts
index e2fa4e51b..826d63386 100644
--- a/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.ts
+++ b/webroot/src/pages/FinalizePrivilegePurchase/FinalizePrivilegePurchase.ts
@@ -20,7 +20,8 @@ import MockPopulate from '@components/Forms/MockPopulate/MockPopulate.vue';
 import { Compact } from '@models/Compact/Compact.model';
 import { State } from '@models/State/State.model';
 import { FormInput } from '@models/FormInput/FormInput.model';
-import { LicenseeUserPurchaseSerializer } from '@models/LicenseeUser/LicenseeUser.model';
+import { LicenseeUser, LicenseeUserPurchaseSerializer } from '@models/LicenseeUser/LicenseeUser.model';
+import { Licensee } from '@models/Licensee/Licensee.model';
 import { PrivilegePurchaseOption } from '@models/PrivilegePurchaseOption/PrivilegePurchaseOption.model';
 import Joi from 'joi';
 
@@ -64,6 +65,14 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
         return this.$store.state.user;
     }
 
+    get user(): LicenseeUser | null {
+        return this.userStore.model;
+    }
+
+    get licensee(): Licensee | null {
+        return this.user?.licensee || null;
+    }
+
     get currentCompact(): Compact | null {
         return this.userStore?.currentCompact || null;
     }
@@ -191,7 +200,8 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
             }
 
             return includes;
-        });
+        }).map((option) =>
+            ({ ...option, isMilitaryDiscountActive: option.isMilitaryDiscountActive && this.licensee?.isMilitary() }));
     }
 
     get selectedStatePurchaseDisplayDataList(): Array<object> {
@@ -250,7 +260,7 @@ export default class FinalizePrivilegePurchase extends mixins(MixinForm) {
     }
 
     get militaryDiscountText(): string {
-        return this.$t('licensing.militaryDiscountText');
+        return this.$t('military.militaryDiscountText');
     }
 
     get totalPurchasePrice(): number {
diff --git a/webroot/src/pages/LicenseeDashboard/LicenseeDashboard.less b/webroot/src/pages/LicenseeDashboard/LicenseeDashboard.less
index b2bc16526..7f68ad7f8 100644
--- a/webroot/src/pages/LicenseeDashboard/LicenseeDashboard.less
+++ b/webroot/src/pages/LicenseeDashboard/LicenseeDashboard.less
@@ -39,8 +39,42 @@
             text-align: center;
         }
 
-        .obtain-priv-btn {
+        .button-block {
+            display: flex;
+            flex-direction: row;
             margin-top: 2rem;
+
+            .view-military-btn {
+                margin-right: 1rem;
+
+                &:deep(input) {
+                    padding-right: 1rem;
+                    padding-left: 1rem;
+                }
+
+                @media @tabletWidth {
+                    margin-right: 2rem;
+
+                    &:deep(input) {
+                        padding-right: 2.4rem;
+                        padding-left: 2.4rem;
+                    }
+                }
+            }
+
+            .obtain-priv-btn {
+                &:deep(input) {
+                    padding-right: 1rem;
+                    padding-left: 1rem;
+                }
+
+                @media @tabletWidth {
+                    &:deep(input) {
+                        padding-right: 2.4rem;
+                        padding-left: 2.4rem;
+                    }
+                }
+            }
         }
     }
 
diff --git a/webroot/src/pages/LicenseeDashboard/LicenseeDashboard.ts b/webroot/src/pages/LicenseeDashboard/LicenseeDashboard.ts
index a51d48f0f..54028f171 100644
--- a/webroot/src/pages/LicenseeDashboard/LicenseeDashboard.ts
+++ b/webroot/src/pages/LicenseeDashboard/LicenseeDashboard.ts
@@ -10,6 +10,7 @@ import HomeStateBlock from '@/components/HomeStateBlock/HomeStateBlock.vue';
 import LicenseCard from '@/components/LicenseCard/LicenseCard.vue';
 import PrivilegeCard from '@/components/PrivilegeCard/PrivilegeCard.vue';
 import InputButton from '@components/Forms/InputButton/InputButton.vue';
+import { Compact } from '@models/Compact/Compact.model';
 import { License, LicenseStatus } from '@models/License/License.model';
 import { Licensee } from '@models/Licensee/Licensee.model';
 import { State } from '@models/State/State.model';
@@ -49,6 +50,14 @@ export default class LicenseeDashboard extends Vue {
         return this.licensee.licenses || [];
     }
 
+    get currentCompact(): Compact | null {
+        return this.userStore?.currentCompact || null;
+    }
+
+    get currentCompactType(): string | null {
+        return this.currentCompact?.type || null;
+    }
+
     get userFullName(): string {
         let name = '';
 
@@ -172,6 +181,13 @@ export default class LicenseeDashboard extends Vue {
         console.log('Starting Privilege Purchase Flow!');
     }
 
+    viewMilitaryStatus() {
+        this.$router.push({
+            name: 'MilitaryStatus',
+            params: { compact: this.currentCompactType }
+        });
+    }
+
     checkIfLicenseActive(license: License) {
         let isLicenseActive = false;
 
diff --git a/webroot/src/pages/LicenseeDashboard/LicenseeDashboard.vue b/webroot/src/pages/LicenseeDashboard/LicenseeDashboard.vue
index e9190d5de..9903d2a14 100644
--- a/webroot/src/pages/LicenseeDashboard/LicenseeDashboard.vue
+++ b/webroot/src/pages/LicenseeDashboard/LicenseeDashboard.vue
@@ -9,13 +9,22 @@
     <div class="licensee-dashboard-container">
         <div class="top-block">
             <div class="welcome-user">{{welcomeText}}, {{ userFullName }}</div>
-            <InputButton
-                :label="obtainPrivButtonLabel"
-                aria-label="obtatin privilege"
-                class="obtain-priv-btn"
-                :isEnabled="!isPrivilegePurchaseDisabled"
-                @click="startPrivPurchaseFlow"
-            />
+            <div class="button-block">
+                <InputButton
+                    :label="$t('military.viewMilitaryStatus')"
+                    :aria-label="$t('military.viewMilitaryStatus')"
+                    :isTransparent="true"
+                    class="view-military-btn"
+                    @click="viewMilitaryStatus"
+                />
+                <InputButton
+                    :label="obtainPrivButtonLabel"
+                    :aria-label="$t('licensing.obtainPrivileges')"
+                    class="obtain-priv-btn"
+                    :isEnabled="!isPrivilegePurchaseDisabled"
+                    @click="startPrivPurchaseFlow"
+                />
+            </div>
         </div>
         <div class="license-section">
             <div class="home-state-section">
diff --git a/webroot/src/pages/MilitaryStatus/MilitaryStatus.less b/webroot/src/pages/MilitaryStatus/MilitaryStatus.less
new file mode 100644
index 000000000..45119ec61
--- /dev/null
+++ b/webroot/src/pages/MilitaryStatus/MilitaryStatus.less
@@ -0,0 +1,137 @@
+//
+//  MilitaryStatus.less
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/20/2024.
+//
+.military-status-container {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    padding: 2rem;
+
+    @media @tabletWidth {
+        padding: 4rem;
+    }
+
+    .end-affiliation-modal {
+        :deep(.modal-container) {
+            max-width: 90vw;
+            padding: 2rem;
+
+            @media @tabletWidth {
+                max-width: 60rem;
+                padding: 4rem;
+            }
+
+            .end-affiliation-modal-content {
+                padding-top: 1rem;
+                overflow-y: hidden;
+                color: black;
+
+                .action-button-row {
+                    display: flex;
+                    flex-direction: row;
+                    justify-content: flex-end;
+                    margin-top: 4rem;
+                    margin-bottom: -2rem;
+
+                    .yes-end-button {
+                        margin-left: 1rem;
+
+                        &.input-container {
+                            input {
+                                border: @midRed;
+                                background-color: @midRed;
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    .military-status-content-container {
+        width: 100%;
+
+        @media @desktopWidth {
+            width: unset;
+        }
+
+        .military-status-title {
+            margin-bottom: 1.4rem;
+            font-size: @h1FontSize;
+        }
+
+        .core-info-block {
+            display: flex;
+            flex-direction: column;
+            padding: 1rem;
+            border-radius: 14px;
+            background-color: @white;
+
+            @media @tabletWidth {
+                padding: 2rem;
+            }
+
+            @media @desktopWidth {
+                width: 69rem;
+            }
+
+            .info-row {
+                display: flex;
+                flex-direction: row;
+                padding-bottom: 1.2rem;
+            }
+
+            .chunk {
+                display: flex;
+                flex-direction: column;
+                padding: 1.4rem;
+
+                &.affiliation-type {
+                    @media @tabletWidth {
+                        margin-left: 6rem;
+                    }
+                }
+
+                .chunk-title {
+                    color: @darkGrey;
+                    font-weight: @fontWeightBold;
+                    font-size: 1.4rem;
+                }
+
+                .chunk-text {
+                    font-size: 1.6rem;
+                }
+
+                .prev-doc-table {
+                    min-height: 33vh;
+                    margin-top: 1rem;
+                }
+            }
+
+            .button-row {
+                display: flex;
+                flex-direction: row;
+                justify-content: space-between;
+
+                .end-aff-button {
+                    margin-bottom: -1rem;
+                    margin-left: 1rem;
+
+                    &:deep(input) {
+                        color: @midRed;
+                        font-size: 1.5rem;
+                        text-decoration: underline;
+                    }
+                }
+
+                .edit-info-button {
+                    margin-right: 1rem;
+                    margin-bottom: 1rem;
+                }
+            }
+        }
+    }
+}
diff --git a/webroot/src/pages/MilitaryStatus/MilitaryStatus.spec.ts b/webroot/src/pages/MilitaryStatus/MilitaryStatus.spec.ts
new file mode 100644
index 000000000..b79a59875
--- /dev/null
+++ b/webroot/src/pages/MilitaryStatus/MilitaryStatus.spec.ts
@@ -0,0 +1,19 @@
+//
+//  MilitaryStatus.spec.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/20/2024.
+//
+
+import { expect } from 'chai';
+import { mountShallow } from '@tests/helpers/setup';
+import MilitaryStatus from '@pages/MilitaryStatus/MilitaryStatus.vue';
+
+describe('MilitaryStatus page', async () => {
+    it('should mount the page component', async () => {
+        const wrapper = await mountShallow(MilitaryStatus);
+
+        expect(wrapper.exists()).to.equal(true);
+        expect(wrapper.findComponent(MilitaryStatus).exists()).to.equal(true);
+    });
+});
diff --git a/webroot/src/pages/MilitaryStatus/MilitaryStatus.ts b/webroot/src/pages/MilitaryStatus/MilitaryStatus.ts
new file mode 100644
index 000000000..4283f9bd8
--- /dev/null
+++ b/webroot/src/pages/MilitaryStatus/MilitaryStatus.ts
@@ -0,0 +1,229 @@
+//
+//  MilitaryStatus.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/20/2024.
+//
+
+import { Component, mixins } from 'vue-facing-decorator';
+import { reactive } from 'vue';
+import MixinForm from '@components/Forms/_mixins/form.mixin';
+import ListContainer from '@components/Lists/ListContainer/ListContainer.vue';
+import InputButton from '@components/Forms/InputButton/InputButton.vue';
+import InputSubmit from '@components/Forms/InputSubmit/InputSubmit.vue';
+import MilitaryDocumentRow from '@components/MilitaryDocumentRow/MilitaryDocumentRow.vue';
+import Modal from '@components/Modal/Modal.vue';
+import { Compact } from '@models/Compact/Compact.model';
+import { FormInput } from '@/models/FormInput/FormInput.model';
+import { LicenseeUser } from '@/models/LicenseeUser/LicenseeUser.model';
+import { Licensee } from '@/models/Licensee/Licensee.model';
+import { MilitaryAffiliation } from '@/models/MilitaryAffiliation/MilitaryAffiliation.model';
+
+@Component({
+    name: 'MilitaryStatus',
+    components: {
+        InputButton,
+        InputSubmit,
+        ListContainer,
+        MilitaryDocumentRow,
+        Modal
+    }
+})
+export default class MilitaryStatus extends mixins(MixinForm) {
+    //
+    // Data
+    //
+    shouldShowEndAffiliationModal = false;
+
+    //
+    // Lifecycle
+    //
+    created() {
+        this.initFormInputs();
+    }
+
+    //
+    // Computed
+    //
+    get userStore(): any {
+        return this.$store.state.user;
+    }
+
+    get user(): LicenseeUser {
+        return this.userStore?.model;
+    }
+
+    get currentCompact(): Compact | null {
+        return this.userStore?.currentCompact || null;
+    }
+
+    get currentCompactType(): string | null {
+        return this.currentCompact?.type || null;
+    }
+
+    get licensee(): Licensee | null {
+        return this.user?.licensee || null;
+    }
+
+    get statusTitleText(): string {
+        return this.$t('licensing.status').toUpperCase();
+    }
+
+    get status(): string {
+        let militaryStatus = '';
+
+        if (this.licensee) {
+            militaryStatus = this.licensee.isMilitary() ? this.$t('licensing.statusOptions.active') : this.$t('licensing.statusOptions.inactive');
+        }
+
+        return militaryStatus;
+    }
+
+    get affiliationTypeTitle(): string {
+        return this.$t('military.affiliationType').toUpperCase();
+    }
+
+    get affiliationType(): string {
+        let militaryStatus = '';
+
+        if (this.licensee) {
+            const activeAffiliation = this.licensee.aciveMilitaryAffiliation() as any;
+            const isMilitary = this.licensee.isMilitary();
+
+            if (isMilitary && activeAffiliation?.affiliationType === 'militaryMember') {
+                militaryStatus = this.$tm('military.affiliationTypes.militaryMember');
+            } else if (isMilitary && activeAffiliation?.affiliationType === 'militaryMemberSpouse') {
+                militaryStatus = this.$tm('military.affiliationTypes.militaryMemberSpouse');
+            } else {
+                militaryStatus = this.$tm('military.affiliationTypes.none');
+            }
+        }
+
+        return militaryStatus;
+    }
+
+    get previouslyUploadedTitle(): string {
+        return this.$t('military.previouslyUploadedDocuments').toUpperCase();
+    }
+
+    get militaryDocumentHeader(): any {
+        return { name: this.$t('military.fileName'), date: this.$t('military.dateUploaded') };
+    }
+
+    get endAffiliationModalTitle(): string {
+        return this.$t('military.endAffiliationModalTitle');
+    }
+
+    get endAffiliationModalContent(): string {
+        return this.$t('military.endAffiliationModalContent');
+    }
+
+    get backText(): string {
+        return this.$t('military.noGoBack');
+    }
+
+    get yesEndText(): string {
+        return this.$matches.phone.only ? this.$t('common.yes') : this.$t('military.yesEnd');
+    }
+
+    get listId(): string {
+        return 'military-affiliations';
+    }
+
+    get sortOptions(): Array<any> {
+        // Sorting not API supported
+        return [];
+    }
+
+    get affiliations(): Array<any> {
+        let affiliations: any = [];
+
+        if (this.licensee && this.licensee?.militaryAffiliations) {
+            affiliations = (this.licensee.militaryAffiliations)
+                .map((militaryAffiliation: MilitaryAffiliation) => {
+                    const affiliationDisplay = { name: '', date: '' };
+
+                    if (militaryAffiliation.fileNames && (militaryAffiliation.fileNames as Array<string>).length) {
+                        affiliationDisplay.name = militaryAffiliation.fileNames[0] || '';
+                        affiliationDisplay.date = militaryAffiliation.dateOfUploadDisplay();
+                    }
+
+                    return affiliationDisplay;
+                });
+        }
+
+        return affiliations;
+    }
+
+    //
+    // Methods
+    //
+    initFormInputs(): void {
+        this.formData = reactive({
+            submitEnd: new FormInput({
+                isSubmitInput: true,
+                id: 'submit-end',
+            }),
+        });
+    }
+
+    goBack() {
+        if (this.currentCompactType) {
+            this.$router.push({
+                name: 'LicenseeDashboard',
+                params: { compact: this.currentCompactType }
+            });
+        }
+    }
+
+    startEndAffiliationFlow() {
+        this.shouldShowEndAffiliationModal = true;
+    }
+
+    closeEndAffilifationModal() {
+        this.shouldShowEndAffiliationModal = false;
+        this.$store.dispatch('setModalIsOpen', false);
+    }
+
+    async confirmEndMilitaryAffiliation() {
+        this.closeEndAffilifationModal();
+        await this.$store.dispatch('user/endMilitaryAffiliationRequest');
+        await this.$store.dispatch('user/getLicenseeAccountRequest');
+    }
+
+    sortingChange() {
+        // Sorting not API supported
+        return false;
+    }
+
+    paginationChange() {
+        // Pagination not API supported
+        return false;
+    }
+
+    editInfo() {
+        if (this.currentCompactType) {
+            this.$router.push({
+                name: 'MilitaryStatusUpdate',
+                params: { compact: this.currentCompactType }
+            });
+        }
+    }
+
+    focusTrap(event: KeyboardEvent): void {
+        const firstTabIndex = document.getElementById('no-back-button');
+        const lastTabIndex = document.getElementById(this.formData.submitEnd.id);
+
+        if (event.shiftKey) {
+            // shift + tab to last input
+            if (document.activeElement === firstTabIndex) {
+                lastTabIndex?.focus();
+                event.preventDefault();
+            }
+        } else if (document.activeElement === lastTabIndex) {
+            // Tab to first input
+            firstTabIndex?.focus();
+            event.preventDefault();
+        }
+    }
+}
diff --git a/webroot/src/pages/MilitaryStatus/MilitaryStatus.vue b/webroot/src/pages/MilitaryStatus/MilitaryStatus.vue
new file mode 100644
index 000000000..b92085bca
--- /dev/null
+++ b/webroot/src/pages/MilitaryStatus/MilitaryStatus.vue
@@ -0,0 +1,123 @@
+<!--
+    MilitaryStatus.vue
+    CompactConnect
+
+    Created by InspiringApps on 12/20/2024.
+-->
+
+<template>
+   <div class="military-status-container">
+    <div class="military-status-content-container">
+        <InputButton
+            :label="$t('common.back')"
+            :aria-label="$t('common.back')"
+            :isTextLike="true"
+            :shouldHideMargin="true"
+            class="back-btn"
+            @click="goBack"
+        />
+        <div class="military-status-title">
+            {{ $t('military.militaryStatusTitle') }}
+        </div>
+        <div class="core-info-block">
+            <div class="info-row">
+                <div class="chunk">
+                    <div class="chunk-title">{{statusTitleText}}</div>
+                    <div class="chunk-text">{{status}}</div>
+                </div>
+                <div class="chunk affiliation-type">
+                    <div class="chunk-title">{{affiliationTypeTitle}}</div>
+                    <div class="chunk-text">{{affiliationType}}</div>
+                </div>
+            </div>
+            <div class="chunk">
+                <div class="chunk-title">{{previouslyUploadedTitle}}</div>
+                <div class="prev-doc-table">
+                    <ListContainer
+                        :listId="listId"
+                        :listData="this.affiliations"
+                        :listSize="this.affiliations.length"
+                        :sortOptions="sortOptions"
+                        :sortChange="sortingChange"
+                        :pageChange="paginationChange"
+                        :excludeSorting="true"
+                        :excludeTopPagination="true"
+                        :excludeBottomPagination="true"
+                        :isServerPaging="false"
+                        :emptyListMessage="$t('military.noUploadedDocuments')"
+                        :isLoading="$store.state.user.isLoadingAccount"
+                    >
+                        <template v-slot:headers>
+                            <MilitaryDocumentRow
+                                :item="militaryDocumentHeader"
+                                :isHeaderRow="true"
+                            />
+                        </template>
+                        <template v-slot:list>
+                            <MilitaryDocumentRow
+                                v-for="(record, index) in this.affiliations"
+                                :key="index"
+                                :item="record"
+                            />
+                        </template>
+                    </ListContainer>
+                </div>
+            </div>
+            <div class="button-row">
+                <InputButton
+                    :label="$t('military.endMilitaryAffiliation')"
+                    :aria-label="$t('military.endMilitaryAffiliation')"
+                    :isTextLike="true"
+                    :shouldHideMargin="true"
+                    class="end-aff-button"
+                    @click="startEndAffiliationFlow"
+                />
+                <InputButton
+                    :label="$t('military.editInfo')"
+                    :aria-label="$t('military.editInfo')"
+                    :shouldHideMargin="true"
+                    class="edit-info-button"
+                    @click="editInfo"
+                />
+            </div>
+        </div>
+    </div>
+         <Modal
+            v-if="shouldShowEndAffiliationModal"
+            class="end-affiliation-modal"
+            :closeOnBackgroundClick="true"
+            :showActions="false"
+            :title="endAffiliationModalTitle"
+            @keydown.tab="focusTrap($event)"
+            @keyup.esc="closeEndAffilifationModal"
+            @close-modal="closeEndAffilifationModal"
+        >
+            <template v-slot:content>
+                <div class="end-affiliation-modal-content">
+                    {{endAffiliationModalContent}}
+                    <form @submit.prevent="confirmEndMilitaryAffiliation">
+                        <div class="action-button-row">
+                            <InputButton
+                                id="no-back-button"
+                                class="no-back-button"
+                                :label="backText"
+                                :aria-label="backText"
+                                :isTransparent="true"
+                                :onClick="closeEndAffilifationModal"
+                            />
+                            <InputSubmit
+                                class="yes-end-button"
+                                :formInput="formData.submitEnd"
+                                :label="yesEndText"
+                                :aria-label="yesEndText"
+                            />
+                        </div>
+                    </form>
+                </div>
+            </template>
+        </Modal>
+   </div>
+</template>
+
+<script lang="ts" src="./MilitaryStatus.ts"></script>
+<style scoped lang="less" src="./MilitaryStatus.less"></style>
diff --git a/webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.less b/webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.less
new file mode 100644
index 000000000..56d2fee5d
--- /dev/null
+++ b/webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.less
@@ -0,0 +1,74 @@
+//
+//  MilitaryStatusUpdate.less
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/20/2024.
+//
+.update-military-status-container {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    padding: 2rem;
+
+    @media @tabletWidth {
+        padding: 4rem;
+    }
+
+    .update-military-status-content-container {
+        width: 100%;
+
+        @media @desktopWidth {
+            width: unset;
+        }
+
+        .update-military-status-title {
+            margin-bottom: 1.4rem;
+            font-size: @h1FontSize;
+        }
+
+        .core-info-block {
+            display: flex;
+            flex-direction: column;
+            padding: 2rem 2rem 0 2rem;
+            border-radius: 14px;
+            background-color: @white;
+
+            @media @desktopWidth {
+                padding: 3rem 3rem 1rem 3rem;
+            }
+
+            @media @desktopWidth {
+                width: 69rem;
+            }
+
+            .document-section {
+                padding-top: 4rem;
+                border-top: 1px solid @lightGrey;
+            }
+
+            .title-row {
+                padding-bottom: 2rem;
+                font-weight: @fontWeightBold;
+                font-size: 2.4rem;
+            }
+
+            .file-instructions {
+                margin-top: -1.4rem;
+                padding-bottom: 2rem;
+                color: @veryDarkGrey;
+            }
+
+            .button-row {
+                display: flex;
+                flex-direction: row;
+                justify-content: flex-end;
+
+                :deep(.input-submit-container) {
+                    display: flex;
+                    align-items: flex-end;
+                    justify-content: center;
+                }
+            }
+        }
+    }
+}
diff --git a/webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.spec.ts b/webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.spec.ts
new file mode 100644
index 000000000..452d68071
--- /dev/null
+++ b/webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.spec.ts
@@ -0,0 +1,19 @@
+//
+//  MilitaryStatusUpdate.spec.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/20/2024.
+//
+
+import { expect } from 'chai';
+import { mountShallow } from '@tests/helpers/setup';
+import MilitaryStatusUpdate from '@pages/MilitaryStatusUpdate/MilitaryStatusUpdate.vue';
+
+describe('MilitaryStatusUpdate page', async () => {
+    it('should mount the page component', async () => {
+        const wrapper = await mountShallow(MilitaryStatusUpdate);
+
+        expect(wrapper.exists()).to.equal(true);
+        expect(wrapper.findComponent(MilitaryStatusUpdate).exists()).to.equal(true);
+    });
+});
diff --git a/webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.ts b/webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.ts
new file mode 100644
index 000000000..227062005
--- /dev/null
+++ b/webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.ts
@@ -0,0 +1,161 @@
+//
+//  MilitaryStatusUpdate.ts
+//  CompactConnect
+//
+//  Created by InspiringApps on 12/20/2024.
+//
+
+import { Component, mixins } from 'vue-facing-decorator';
+import { reactive, computed } from 'vue';
+import MixinForm from '@components/Forms/_mixins/form.mixin';
+import InputRadioGroup from '@components/Forms/InputRadioGroup/InputRadioGroup.vue';
+import InputFile from '@components/Forms/InputFile/InputFile.vue';
+import InputButton from '@components/Forms/InputButton/InputButton.vue';
+import InputSubmit from '@components/Forms/InputSubmit/InputSubmit.vue';
+import { Compact } from '@models/Compact/Compact.model';
+import { FormInput } from '@/models/FormInput/FormInput.model';
+import Joi from 'joi';
+
+@Component({
+    name: 'MilitaryStatusUpdate',
+    components: {
+        InputSubmit,
+        InputRadioGroup,
+        InputFile,
+        InputButton
+    }
+})
+export default class MilitaryStatusUpdate extends mixins(MixinForm) {
+    //
+    // Lifecycle
+    //
+    created() {
+        this.initFormInputs();
+    }
+
+    //
+    // Computed
+    //
+    get userStore(): any {
+        return this.$store.state.user;
+    }
+
+    get currentCompact(): Compact | null {
+        return this.userStore?.currentCompact || null;
+    }
+
+    get currentCompactType(): string | null {
+        return this.currentCompact?.type || null;
+    }
+
+    get attestationTitleText(): any {
+        return `${this.$t('licensing.attestation')}*`;
+    }
+
+    get statusOptions(): any {
+        return this.$tm('styleGuide.statusOptions');
+    }
+
+    get affiliationTypeOptions(): any {
+        return this.$tm('military.affiliationAttestationOptions');
+    }
+
+    get documentProofLabel(): any {
+        return this.$t('military.documentProofLabel');
+    }
+
+    //
+    // Methods
+    //
+    initFormInputs(): void {
+        this.formData = reactive({
+            affiliationType: new FormInput({
+                id: 'affiliation-type',
+                name: 'affiliation-type',
+                shouldHideLabel: true,
+                label: computed(() => this.$t('military.affiliationType')),
+                validation: Joi.string().required().messages({ ...this.joiMessages.string }),
+                valueOptions: this.affiliationTypeOptions.map((option) => ({ ...option })),
+            }),
+            document: new FormInput({
+                id: 'document',
+                name: 'document',
+                label: computed(() => this.$t('military.documentProofLabel')),
+                placeholder: computed(() => this.$t('military.documentProofLabel')),
+                value: [],
+                shouldHideLabel: true,
+                validation: Joi.array().min(1).max(1).messages(this.joiMessages.files),
+                fileConfig: {
+                    accepts: [`application/pdf`, `application/vnd.openxmlformats-officedocument.wordprocessingml.document`, `image/png`, `image/jpeg`],
+                    allowMultiple: false,
+                    maxSizeMbPer: 100,
+                    maxSizeMbAll: 100,
+                },
+            }),
+            submit: new FormInput({
+                isSubmitInput: true,
+                id: 'submit',
+            }),
+        });
+
+        this.watchFormInputs();
+    }
+
+    goBack() {
+        if (this.currentCompactType) {
+            this.$router.push({
+                name: 'MilitaryStatus',
+                params: { compact: this.currentCompactType }
+            });
+        }
+    }
+
+    async handleSubmit() {
+        this.validateAll({ asTouched: true });
+
+        if (this.isFormValid) {
+            this.startFormLoading();
+            let uploadResponse;
+
+            const documentUploadData = this.transformFormDataToUploadIntent(this.formData);
+
+            if (!this.isFormError) {
+                uploadResponse = await this.$store.dispatch('user/uploadMilitaryAffiliationRequest', documentUploadData);
+            }
+
+            if (!this.isFormError) {
+                this.isFormSuccessful = true;
+            }
+
+            this.endFormLoading();
+
+            this.resetForm(uploadResponse?.status === 204);
+        }
+    }
+
+    resetForm(isSuccessful) {
+        this.formData.document.value.length = 0;
+        this.formData.affiliationType.value = null;
+        this.isFormLoading = false;
+        this.isFormSuccessful = false;
+        this.isFormError = false;
+
+        if (isSuccessful) {
+            this.$nextTick(() => {
+                this.updateFormSubmitSuccess(this.$t('military.successLongProcess'));
+            });
+        } else {
+            this.$nextTick(() => {
+                this.updateFormSubmitError(this.$t('military.submitFail'));
+            });
+        }
+    }
+
+    transformFormDataToUploadIntent(formData) {
+        const affiliationType = formData.affiliationType.value;
+        const document = formData.document.value[0];
+        const fileNames = [ document.name ];
+
+        return { affiliationType, fileNames, document };
+    }
+}
diff --git a/webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.vue b/webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.vue
new file mode 100644
index 000000000..09483eabd
--- /dev/null
+++ b/webroot/src/pages/MilitaryStatusUpdate/MilitaryStatusUpdate.vue
@@ -0,0 +1,53 @@
+<!--
+    MilitaryStatusUpdate.vue
+    CompactConnect
+
+    Created by InspiringApps on 12/20/2024.
+-->
+
+<template>
+    <div class="update-military-status-container">
+        <div class="update-military-status-content-container">
+            <InputButton
+                :label="$t('common.back')"
+                :aria-label="$t('common.back')"
+                :isTextLike="true"
+                :shouldHideMargin="true"
+                class="back-btn"
+                @click="goBack"
+            />
+            <div class="update-military-status-title">
+                {{ $t('military.updateMilitaryStatusTitle') }}
+            </div>
+            <div class="core-info-block">
+                <form @submit.prevent="handleSubmit">
+                    <div class="title-row">
+                        {{attestationTitleText}}
+                    </div>
+                    <div class="attestation-section">
+                        <InputRadioGroup :formInput="formData.affiliationType" />
+                    </div>
+                    <div class="document-section">
+                        <div class="title-row">
+                            {{documentProofLabel}}
+                        </div>
+                        <div class="file-instructions">
+                            {{ $t('military.fileInstructions') }}
+                        </div>
+                        <InputFile :formInput="formData.document" />
+                    </div>
+                    <div class="button-row">
+                        <InputSubmit
+                            :formInput="formData.submit"
+                            :label="$t('common.submit')"
+                            :aria-label="$t('common.submit')"
+                        />
+                    </div>
+                </form>
+            </div>
+        </div>
+   </div>
+</template>
+
+<script lang="ts" src="./MilitaryStatusUpdate.ts"></script>
+<style scoped lang="less" src="./MilitaryStatusUpdate.less"></style>
diff --git a/webroot/src/pages/PurchaseSuccessful/PurchaseSuccessful.less b/webroot/src/pages/PurchaseSuccessful/PurchaseSuccessful.less
index d6140f51e..d97f88726 100644
--- a/webroot/src/pages/PurchaseSuccessful/PurchaseSuccessful.less
+++ b/webroot/src/pages/PurchaseSuccessful/PurchaseSuccessful.less
@@ -24,7 +24,7 @@
     .purchase-success-core {
         padding: 2rem;
         border-radius: 20px;
-        background-color: white;
+        background-color: @white;
 
         @media @desktopWidth {
             width: 70rem;
diff --git a/webroot/src/pages/SelectPrivileges/SelectPrivileges.less b/webroot/src/pages/SelectPrivileges/SelectPrivileges.less
index 27f78ac5c..83c057ed0 100644
--- a/webroot/src/pages/SelectPrivileges/SelectPrivileges.less
+++ b/webroot/src/pages/SelectPrivileges/SelectPrivileges.less
@@ -80,7 +80,7 @@
             margin-top: -1rem;
             padding: 2rem;
             border-radius: 20px;
-            background-color: white;
+            background-color: @white;
 
             @media @tabletWidth {
                 width: 72rem;
diff --git a/webroot/src/pages/SelectPrivileges/SelectPrivileges.vue b/webroot/src/pages/SelectPrivileges/SelectPrivileges.vue
index bbfa5a522..3433b6dd4 100644
--- a/webroot/src/pages/SelectPrivileges/SelectPrivileges.vue
+++ b/webroot/src/pages/SelectPrivileges/SelectPrivileges.vue
@@ -67,14 +67,14 @@
                 <InputButton
                     :label="cancelText"
                     :isTextLike="true"
-                    aria-label="cancel"
+                    :aria-label="cancelText"
                     class="icon icon-close-modal"
                     @click="handleCancelClicked"
                 />
                 <div class="right-cell">
                     <InputButton
                         :label="backText"
-                        aria-label="go back"
+                        :aria-label="backText"
                         class="back-button"
                         :isTransparent="true"
                         @click="handleBackClicked"
diff --git a/webroot/src/router/routes.ts b/webroot/src/router/routes.ts
index 42b873db5..17958135e 100644
--- a/webroot/src/router/routes.ts
+++ b/webroot/src/router/routes.ts
@@ -80,6 +80,18 @@ const routes: Array<RouteConfig> = [
         component: () => import(/* webpackChunkName: "licenseeDashboard" */ '@pages/LicenseeDashboard/LicenseeDashboard.vue'),
         meta: { requiresAuth: true, licenseeAccess: true, },
     },
+    {
+        path: '/:compact/MilitaryStatus',
+        name: 'MilitaryStatus',
+        component: () => import(/* webpackChunkName: "militaryStatus" */ '@pages/MilitaryStatus/MilitaryStatus.vue'),
+        meta: { requiresAuth: true, licenseeAccess: true, },
+    },
+    {
+        path: '/:compact/MilitaryStatus/Update',
+        name: 'MilitaryStatusUpdate',
+        component: () => import(/* webpackChunkName: "militaryStatusUpdate" */ '@pages/MilitaryStatusUpdate/MilitaryStatusUpdate.vue'),
+        meta: { requiresAuth: true, licenseeAccess: true, },
+    },
     {
         path: '/:compact/Privileges/SelectPrivileges',
         name: 'SelectPrivileges',
diff --git a/webroot/src/store/user/user.actions.ts b/webroot/src/store/user/user.actions.ts
index e07cf3960..7ebdd77af 100644
--- a/webroot/src/store/user/user.actions.ts
+++ b/webroot/src/store/user/user.actions.ts
@@ -276,4 +276,57 @@ export default {
     postPrivilegePurchasesFailure: ({ commit }, error: Error) => {
         commit(MutationTypes.POST_PRIVILEGE_PURCHASE_FAILURE, error);
     },
+    uploadMilitaryAffiliationRequest: ({ commit, dispatch }, documentData) => {
+        commit(MutationTypes.UPLOAD_MILITARY_AFFILIATION_REQUEST);
+
+        const documentIntentData = { ...documentData };
+
+        delete documentIntentData.document;
+        return dataApi.postUploadMilitaryDocumentIntent(documentIntentData).then((intentServerResponse) => {
+            const postUrl = intentServerResponse.documentUploadFields[0].url;
+            const uploadFields = intentServerResponse.documentUploadFields[0].fields;
+
+            if (postUrl && uploadFields && documentData.document) {
+                const documentUploadData = { ...uploadFields };
+
+                return dataApi.postUploadMilitaryAffiliationDocument(postUrl, documentUploadData, documentData.document)
+                    .then((uploadServerResponse) => {
+                        if (uploadServerResponse?.status === 204) {
+                            dispatch('uploadMilitaryAffiliationSuccess');
+
+                            return uploadServerResponse;
+                        }
+
+                        throw new Error('Document Upload Failed');
+                    });
+            }
+
+            throw new Error('Missing fields for Document upload');
+        }).catch((error) => {
+            dispatch('uploadMilitaryAffiliationFailure', error);
+            return error;
+        });
+    },
+    uploadMilitaryAffiliationSuccess: async ({ commit }) => {
+        commit(MutationTypes.UPLOAD_MILITARY_AFFILIATION_SUCCESS);
+    },
+    uploadMilitaryAffiliationFailure: async ({ commit }, error: Error) => {
+        commit(MutationTypes.UPLOAD_MILITARY_AFFILIATION_FAILURE, error);
+    },
+    endMilitaryAffiliationRequest: ({ commit, dispatch }) => {
+        commit(MutationTypes.END_MILITARY_AFFILIATION_REQUEST);
+        return dataApi.endMilitaryAffiliation().then((serverResponse) => {
+            dispatch('endMilitaryAffiliationSuccess');
+            return serverResponse;
+        }).catch((error) => {
+            dispatch('endMilitaryAffiliationFailure', error);
+            return error;
+        });
+    },
+    endMilitaryAffiliationSuccess: async ({ commit }) => {
+        commit(MutationTypes.END_MILITARY_AFFILIATION_SUCCESS);
+    },
+    endMilitaryAffiliationFailure: async ({ commit }, error: Error) => {
+        commit(MutationTypes.END_MILITARY_AFFILIATION_FAILURE, error);
+    },
 };
diff --git a/webroot/src/store/user/user.mutations.ts b/webroot/src/store/user/user.mutations.ts
index dff6846a7..178366e91 100644
--- a/webroot/src/store/user/user.mutations.ts
+++ b/webroot/src/store/user/user.mutations.ts
@@ -34,7 +34,13 @@ export enum MutationTypes {
     SET_ATTESTATIONS_ACCEPTED = '[User] Set Attestations Accepted',
     POST_PRIVILEGE_PURCHASE_REQUEST = '[User] Post Privilege Purchase Request',
     POST_PRIVILEGE_PURCHASE_SUCCESS = '[User] Post Privilege Purchase Success',
-    POST_PRIVILEGE_PURCHASE_FAILURE = '[User] Post Privilege Purchase Failure'
+    POST_PRIVILEGE_PURCHASE_FAILURE = '[User] Post Privilege Purchase Failure',
+    UPLOAD_MILITARY_AFFILIATION_REQUEST = '[User] Post Military Affiliation Request',
+    UPLOAD_MILITARY_AFFILIATION_SUCCESS = '[User] Post Military Affiliation Success',
+    UPLOAD_MILITARY_AFFILIATION_FAILURE = '[User] Post Military Affiliation Failure',
+    END_MILITARY_AFFILIATION_REQUEST = '[User] Patch Military Affiliation Request',
+    END_MILITARY_AFFILIATION_SUCCESS = '[User] Patch Military Affiliation Success',
+    END_MILITARY_AFFILIATION_FAILURE = '[User] Patch Military Affiliation Failure'
 }
 
 export default {
@@ -146,4 +152,28 @@ export default {
         state.isLoadingPrivilegePurchaseOptions = false;
         state.error = error;
     },
+    [MutationTypes.UPLOAD_MILITARY_AFFILIATION_REQUEST]: (state: any) => {
+        state.isLoadingAccount = true;
+        state.error = null;
+    },
+    [MutationTypes.UPLOAD_MILITARY_AFFILIATION_SUCCESS]: (state: any) => {
+        state.isLoadingAccount = false;
+        state.error = null;
+    },
+    [MutationTypes.UPLOAD_MILITARY_AFFILIATION_FAILURE]: (state: any, error: Error) => {
+        state.isLoadingAccount = false;
+        state.error = error;
+    },
+    [MutationTypes.END_MILITARY_AFFILIATION_REQUEST]: (state: any) => {
+        state.isLoadingAccount = true;
+        state.error = null;
+    },
+    [MutationTypes.END_MILITARY_AFFILIATION_SUCCESS]: (state: any) => {
+        state.isLoadingAccount = false;
+        state.error = null;
+    },
+    [MutationTypes.END_MILITARY_AFFILIATION_FAILURE]: (state: any, error: Error) => {
+        state.isLoadingAccount = false;
+        state.error = error;
+    },
 };
diff --git a/webroot/src/store/user/user.spec.ts b/webroot/src/store/user/user.spec.ts
index 18fc38519..013c87d99 100644
--- a/webroot/src/store/user/user.spec.ts
+++ b/webroot/src/store/user/user.spec.ts
@@ -161,6 +161,111 @@ describe('Use Store Mutations', () => {
 
         expect(state.refreshTokenTimeoutId).to.equal(timeoutId);
     });
+    it('should successfully upload military affiliation request', () => {
+        const state = {};
+
+        mutations[MutationTypes.UPLOAD_MILITARY_AFFILIATION_REQUEST](state);
+
+        expect(state.isLoadingAccount).to.equal(true);
+        expect(state.error).to.equal(null);
+    });
+    it('should successfully upload military affiliation failure', () => {
+        const state = {};
+        const error = new Error();
+
+        mutations[MutationTypes.UPLOAD_MILITARY_AFFILIATION_FAILURE](state, error);
+
+        expect(state.isLoadingAccount).to.equal(false);
+        expect(state.error).to.equal(error);
+    });
+    it('should successfully upload military affiliation success', () => {
+        const state = {};
+
+        mutations[MutationTypes.UPLOAD_MILITARY_AFFILIATION_SUCCESS](state);
+
+        expect(state.isLoadingAccount).to.equal(false);
+        expect(state.error).to.equal(null);
+    });
+    it('should successfully end military affiliation request', () => {
+        const state = {};
+
+        mutations[MutationTypes.END_MILITARY_AFFILIATION_REQUEST](state);
+
+        expect(state.isLoadingAccount).to.equal(true);
+        expect(state.error).to.equal(null);
+    });
+    it('should successfully end military affiliation failure', () => {
+        const state = {};
+        const error = new Error();
+
+        mutations[MutationTypes.END_MILITARY_AFFILIATION_FAILURE](state, error);
+
+        expect(state.isLoadingAccount).to.equal(false);
+        expect(state.error).to.equal(error);
+    });
+    it('should successfully end military affiliation success', () => {
+        const state = {};
+
+        mutations[MutationTypes.END_MILITARY_AFFILIATION_SUCCESS](state);
+
+        expect(state.isLoadingAccount).to.equal(false);
+        expect(state.error).to.equal(null);
+    });
+    it('should successfully post privilege purchase request', () => {
+        const state = {};
+
+        mutations[MutationTypes.POST_PRIVILEGE_PURCHASE_REQUEST](state);
+
+        expect(state.isLoadingPrivilegePurchaseOptions).to.equal(true);
+        expect(state.error).to.equal(null);
+    });
+    it('should successfully post privilege purchase success', () => {
+        const state = {
+            arePurchaseAttestationsAccepted: true,
+            selectedPrivilegesToPurchase: ['ky'],
+        };
+
+        mutations[MutationTypes.POST_PRIVILEGE_PURCHASE_SUCCESS](state);
+
+        expect(state.isLoadingPrivilegePurchaseOptions).to.equal(false);
+        expect(state.arePurchaseAttestationsAccepted).to.equal(false);
+        expect(state.selectedPrivilegesToPurchase).to.equal(null);
+        expect(state.error).to.equal(null);
+    });
+    it('should successfully post privilege purchase failure', () => {
+        const state = {};
+        const error = new Error();
+
+        mutations[MutationTypes.POST_PRIVILEGE_PURCHASE_FAILURE](state, error);
+
+        expect(state.isLoadingPrivilegePurchaseOptions).to.equal(false);
+        expect(state.error).to.equal(error);
+    });
+    it('should successfully get privilege purchase information request', () => {
+        const state = {};
+
+        mutations[MutationTypes.GET_PRIVILEGE_PURCHASE_INFORMATION_REQUEST](state);
+
+        expect(state.isLoadingPrivilegePurchaseOptions).to.equal(true);
+        expect(state.error).to.equal(null);
+    });
+    it('should successfully get privilege purchase information failure', () => {
+        const state = {};
+        const error = new Error();
+
+        mutations[MutationTypes.GET_PRIVILEGE_PURCHASE_INFORMATION_FAILURE](state, error);
+
+        expect(state.isLoadingPrivilegePurchaseOptions).to.equal(false);
+        expect(state.error).to.equal(error);
+    });
+    it('should successfully get privilege purchase information success', () => {
+        const state = {};
+
+        mutations[MutationTypes.GET_PRIVILEGE_PURCHASE_INFORMATION_SUCCESS](state);
+
+        expect(state.isLoadingPrivilegePurchaseOptions).to.equal(false);
+        expect(state.error).to.equal(null);
+    });
 });
 describe('User Store Actions', async () => {
     it('should successfully start login request', () => {
@@ -477,31 +582,7 @@ describe('User Store Actions', async () => {
             [MutationTypes.POST_PRIVILEGE_PURCHASE_FAILURE, error]
         );
     });
-    it('should successfully get privilege purchase information request', () => {
-        const state = {};
-
-        mutations[MutationTypes.GET_PRIVILEGE_PURCHASE_INFORMATION_REQUEST](state);
-
-        expect(state.isLoadingPrivilegePurchaseOptions).to.equal(true);
-        expect(state.error).to.equal(null);
-    });
-    it('should successfully get privilege purchase information failure', () => {
-        const state = {};
-        const error = new Error();
-
-        mutations[MutationTypes.GET_PRIVILEGE_PURCHASE_INFORMATION_FAILURE](state, error);
-
-        expect(state.isLoadingPrivilegePurchaseOptions).to.equal(false);
-        expect(state.error).to.equal(error);
-    });
-    it('should successfully get privilege purchase information success', () => {
-        const state = {};
-
-        mutations[MutationTypes.GET_PRIVILEGE_PURCHASE_INFORMATION_SUCCESS](state);
 
-        expect(state.isLoadingPrivilegePurchaseOptions).to.equal(false);
-        expect(state.error).to.equal(null);
-    });
     it('should successfully save attestations accepted', () => {
         const state = {};
 
@@ -517,34 +598,71 @@ describe('User Store Actions', async () => {
 
         expect(state.selectedPrivilegesToPurchase).to.matchPattern(selected);
     });
-    it('should successfully post privilege purchase request', () => {
-        const state = {};
+    it('should successfully start end military affiliation request', () => {
+        const commit = sinon.spy();
+        const dispatch = sinon.spy();
 
-        mutations[MutationTypes.POST_PRIVILEGE_PURCHASE_REQUEST](state);
+        actions.endMilitaryAffiliationRequest({ commit, dispatch });
 
-        expect(state.isLoadingPrivilegePurchaseOptions).to.equal(true);
-        expect(state.error).to.equal(null);
+        expect(commit.calledOnce).to.equal(true);
+        expect(commit.firstCall.args).to.matchPattern([MutationTypes.END_MILITARY_AFFILIATION_REQUEST]);
     });
-    it('should successfully post privilege purchase success', () => {
-        const state = {
-            arePurchaseAttestationsAccepted: true,
-            selectedPrivilegesToPurchase: ['ky'],
+    it('should successfully start end military affiliation success', () => {
+        const commit = sinon.spy();
+
+        actions.endMilitaryAffiliationSuccess({ commit });
+
+        expect(commit.calledOnce).to.equal(true);
+        expect(commit.firstCall.args).to.matchPattern(
+            [MutationTypes.END_MILITARY_AFFILIATION_SUCCESS]
+        );
+    });
+    it('should successfully start end military affiliation failure', () => {
+        const commit = sinon.spy();
+        const error = new Error();
+
+        actions.endMilitaryAffiliationFailure({ commit }, error);
+
+        expect(commit.calledOnce).to.equal(true);
+        expect(commit.firstCall.args).to.matchPattern(
+            [MutationTypes.END_MILITARY_AFFILIATION_FAILURE, error]
+        );
+    });
+    it('should successfully start upload military affiliation document request', () => {
+        const commit = sinon.spy();
+        const dispatch = sinon.spy();
+        const documentData = {
+            affiliationType: 'militaryMemberSpouse',
+            document: {
+                name: 'WyldPets_Backdrop1.jpeg'
+            },
+            fileNames: ['WyldPets_Backdrop1.jpeg']
         };
 
-        mutations[MutationTypes.POST_PRIVILEGE_PURCHASE_SUCCESS](state);
+        actions.uploadMilitaryAffiliationRequest({ commit, dispatch }, documentData);
 
-        expect(state.isLoadingPrivilegePurchaseOptions).to.equal(false);
-        expect(state.arePurchaseAttestationsAccepted).to.equal(false);
-        expect(state.selectedPrivilegesToPurchase).to.equal(null);
-        expect(state.error).to.equal(null);
+        expect(commit.calledOnce).to.equal(true);
+        expect(commit.firstCall.args).to.matchPattern([MutationTypes.UPLOAD_MILITARY_AFFILIATION_REQUEST]);
     });
-    it('should successfully post privilege purchase failure', () => {
-        const state = {};
+    it('should successfully start upload military affiliation document success', () => {
+        const commit = sinon.spy();
+
+        actions.uploadMilitaryAffiliationSuccess({ commit });
+
+        expect(commit.calledOnce).to.equal(true);
+        expect(commit.firstCall.args).to.matchPattern(
+            [MutationTypes.UPLOAD_MILITARY_AFFILIATION_SUCCESS]
+        );
+    });
+    it('should successfully start upload military affiliation document failure', () => {
+        const commit = sinon.spy();
         const error = new Error();
 
-        mutations[MutationTypes.POST_PRIVILEGE_PURCHASE_FAILURE](state, error);
+        actions.uploadMilitaryAffiliationFailure({ commit }, error);
 
-        expect(state.isLoadingPrivilegePurchaseOptions).to.equal(false);
-        expect(state.error).to.equal(error);
+        expect(commit.calledOnce).to.equal(true);
+        expect(commit.firstCall.args).to.matchPattern(
+            [MutationTypes.UPLOAD_MILITARY_AFFILIATION_FAILURE, error]
+        );
     });
 });

From b6edd2719d1243c8e937f18de794d1722f2eae5a Mon Sep 17 00:00:00 2001
From: landonshumway-ia <landon@inspiringapps.com>
Date: Mon, 13 Jan 2025 16:05:12 -0600
Subject: [PATCH 13/18] Feat/Add Attestations API Endpoint (#422)

---
 backend/bin/compile_requirements.sh           |  38 +--
 backend/bin/run_tests.sh                      |   1 +
 backend/bin/sync_deps.sh                      |   2 +
 .../compact-connect/compact-config/aslp.yml   |  74 ++++++
 .../compact-connect/compact-config/coun.yml   |  74 ++++++
 .../compact-connect/compact-config/octp.yml   |  74 ++++++
 backend/compact-connect/docs/README.md        |   6 -
 .../docs/api-specification/latest-oas30.json  | 225 +++++++++++++++++-
 backend/compact-connect/docs/design/README.md |  47 +++-
 .../JURISDICTION_COMPACT_ONBOARDING.md        |  62 +++++
 .../lambdas/python/attestations/.coveragerc   |  10 +
 .../python/attestations/handlers/__init__.py  |   0
 .../attestations/handlers/attestations.py     |  42 ++++
 .../python/attestations/requirements-dev.in   |   1 +
 .../python/attestations/requirements-dev.txt  |  70 ++++++
 .../python/attestations/requirements.in       |   1 +
 .../python/attestations/requirements.txt      |   6 +
 .../python/attestations/tests/__init__.py     |  27 +++
 .../attestations/tests/function/__init__.py   |  54 +++++
 .../tests/function/test_attestations.py       |  70 ++++++
 .../lambdas/python/common/cc_common/config.py |   6 +
 .../common/cc_common/data_model/client.py     |   6 +
 .../compact_configuration_client.py           |  68 ++++++
 .../data_model/schema/attestation.py          |  42 ++++
 .../cc_common/data_model/schema/common.py     |  14 ++
 .../cc_common/data_model/schema/privilege.py  |   8 +-
 .../python/common/requirements-dev.txt        |   6 +-
 .../lambdas/python/common/requirements.txt    |   6 +-
 .../api/provider-detail-response.json         |   8 +-
 .../tests/resources/dynamo/attestation.json   |  15 ++
 .../tests/resources/dynamo/privilege.json     |   8 +-
 .../unit/test_data_model/test_data_client.py  |   1 +
 .../handlers/compact_config_uploader.py       |  68 ++++++
 .../custom-resources/requirements-dev.txt     |   6 +-
 .../test_compact_configuration_uploader.py    | 174 ++++++++++++++
 .../python/data-events/requirements-dev.txt   |   6 +-
 .../provider-data-v1/requirements-dev.txt     |   6 +-
 .../tests/function/__init__.py                |   3 +
 .../test_provider_transformations.py          |   1 +
 .../python/purchases/handlers/privileges.py   | 115 +++++++--
 .../python/purchases/requirements-dev.txt     |   6 +-
 .../test_handlers/test_purchase_privileges.py | 210 +++++++++++++++-
 .../test_handlers/test_transaction_history.py |   4 +-
 .../staff-user-pre-token/requirements-dev.txt |   6 +-
 .../python/staff-users/requirements-dev.txt   |   6 +-
 backend/compact-connect/requirements-dev.txt  |   6 +-
 backend/compact-connect/requirements.txt      |  10 +-
 .../stacks/api_stack/v1_api/api.py            |   9 +
 .../stacks/api_stack/v1_api/api_model.py      |  72 ++++--
 .../stacks/api_stack/v1_api/attestations.py   |  86 +++++++
 ...transaction_history_processing_workflow.py |  10 +-
 .../app/test_api/test_attestations_api.py     |  99 ++++++++
 .../COMPACT_CONFIGURATION_UPLOADER_INPUT.json | 164 +++++++++++++
 ...GET_ATTESTATION_BY_ID_RESPONSE_SCHEMA.json |  36 +++
 .../PURCHASE_PRIVILEGE_REQUEST_SCHEMA.json    |  29 ++-
 .../purchasing_privileges_smoke_tests.py      |  68 +++++-
 backend/multi-account/requirements.txt        |   8 +-
 57 files changed, 2147 insertions(+), 133 deletions(-)
 create mode 100644 backend/compact-connect/lambdas/python/attestations/.coveragerc
 create mode 100644 backend/compact-connect/lambdas/python/attestations/handlers/__init__.py
 create mode 100644 backend/compact-connect/lambdas/python/attestations/handlers/attestations.py
 create mode 100644 backend/compact-connect/lambdas/python/attestations/requirements-dev.in
 create mode 100644 backend/compact-connect/lambdas/python/attestations/requirements-dev.txt
 create mode 100644 backend/compact-connect/lambdas/python/attestations/requirements.in
 create mode 100644 backend/compact-connect/lambdas/python/attestations/requirements.txt
 create mode 100644 backend/compact-connect/lambdas/python/attestations/tests/__init__.py
 create mode 100644 backend/compact-connect/lambdas/python/attestations/tests/function/__init__.py
 create mode 100644 backend/compact-connect/lambdas/python/attestations/tests/function/test_attestations.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/compact_configuration_client.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/attestation.py
 create mode 100644 backend/compact-connect/lambdas/python/common/tests/resources/dynamo/attestation.json
 create mode 100644 backend/compact-connect/stacks/api_stack/v1_api/attestations.py
 create mode 100644 backend/compact-connect/tests/app/test_api/test_attestations_api.py
 create mode 100644 backend/compact-connect/tests/resources/snapshots/GET_ATTESTATION_BY_ID_RESPONSE_SCHEMA.json

diff --git a/backend/bin/compile_requirements.sh b/backend/bin/compile_requirements.sh
index f21f9095e..0b4f0a965 100755
--- a/backend/bin/compile_requirements.sh
+++ b/backend/bin/compile_requirements.sh
@@ -1,21 +1,23 @@
 set -e
 
-pip-compile --no-emit-index-url --upgrade multi-account/requirements-dev.in
-pip-compile --no-emit-index-url --upgrade multi-account/requirements.in
-pip-compile --no-emit-index-url --upgrade compact-connect/requirements-dev.in
-pip-compile --no-emit-index-url --upgrade compact-connect/requirements.in
-pip-compile --no-emit-index-url --upgrade compact-connect/lambdas/python/common/requirements-dev.in
-pip-compile --no-emit-index-url --upgrade compact-connect/lambdas/python/common/requirements.in
-pip-compile --no-emit-index-url --upgrade compact-connect/lambdas/python/custom-resources/requirements-dev.in
-pip-compile --no-emit-index-url --upgrade compact-connect/lambdas/python/custom-resources/requirements.in
-pip-compile --no-emit-index-url --upgrade compact-connect/lambdas/python/data-events/requirements-dev.in
-pip-compile --no-emit-index-url --upgrade compact-connect/lambdas/python/data-events/requirements.in
-pip-compile --no-emit-index-url --upgrade compact-connect/lambdas/python/provider-data-v1/requirements-dev.in
-pip-compile --no-emit-index-url --upgrade compact-connect/lambdas/python/provider-data-v1/requirements.in
-pip-compile --no-emit-index-url --upgrade compact-connect/lambdas/python/purchases/requirements-dev.in
-pip-compile --no-emit-index-url --upgrade compact-connect/lambdas/python/purchases/requirements.in
-pip-compile --no-emit-index-url --upgrade compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.in
-pip-compile --no-emit-index-url --upgrade compact-connect/lambdas/python/staff-user-pre-token/requirements.in
-pip-compile --no-emit-index-url --upgrade compact-connect/lambdas/python/staff-users/requirements-dev.in
-pip-compile --no-emit-index-url --upgrade compact-connect/lambdas/python/staff-users/requirements.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras multi-account/requirements-dev.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras multi-account/requirements.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/requirements-dev.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/requirements.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/attestations/requirements-dev.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/attestations/requirements.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/common/requirements-dev.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/common/requirements.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/custom-resources/requirements-dev.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/custom-resources/requirements.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/data-events/requirements-dev.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/data-events/requirements.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/provider-data-v1/requirements-dev.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/provider-data-v1/requirements.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/purchases/requirements-dev.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/purchases/requirements.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/staff-user-pre-token/requirements.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/staff-users/requirements-dev.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras compact-connect/lambdas/python/staff-users/requirements.in
 bin/sync_deps.sh
diff --git a/backend/bin/run_tests.sh b/backend/bin/run_tests.sh
index be08e41af..5ee69511f 100755
--- a/backend/bin/run_tests.sh
+++ b/backend/bin/run_tests.sh
@@ -25,6 +25,7 @@ if [[ "$LANGUAGE" == 'python' || "$LANGUAGE" == 'all' ]]; then
     pytest --cov=. --cov-config=.coveragerc tests
   ) || exit "$?"
   for dir in \
+    compact-connect/lambdas/python/attestations \
     compact-connect/lambdas/python/custom-resources \
     compact-connect/lambdas/python/data-events \
     compact-connect/lambdas/python/provider-data-v1 \
diff --git a/backend/bin/sync_deps.sh b/backend/bin/sync_deps.sh
index 9c09b3e98..4e6f33021 100755
--- a/backend/bin/sync_deps.sh
+++ b/backend/bin/sync_deps.sh
@@ -8,6 +8,8 @@ pip-sync \
   multi-account/requirements.txt \
   compact-connect/requirements-dev.txt \
   compact-connect/requirements.txt \
+  compact-connect/lambdas/python/attestations/requirements-dev.txt \
+  compact-connect/lambdas/python/attestations/requirements.txt \
   compact-connect/lambdas/python/common/requirements-dev.txt \
   compact-connect/lambdas/python/common/requirements.txt \
   compact-connect/lambdas/python/custom-resources/requirements-dev.txt \
diff --git a/backend/compact-connect/compact-config/aslp.yml b/backend/compact-connect/compact-config/aslp.yml
index 48ea61585..b0a38c397 100644
--- a/backend/compact-connect/compact-config/aslp.yml
+++ b/backend/compact-connect/compact-config/aslp.yml
@@ -8,3 +8,77 @@ compactAdverseActionsNotificationEmails: []
 compactSummaryReportNotificationEmails: []
 
 activeEnvironments: ["test"]
+
+attestations:
+  - attestationId: "jurisprudence-confirmation"
+    displayName: "Jurisprudence Confirmation."
+    description: "For displaying the jurisprudence confirmation."
+    text: |-
+      I understand that an attestation is a legally binding statement. I understand that providing false information on this application could result in a loss of my licenses and/or privileges. I acknowledge that the Commission may audit jurisprudence attestations at their discretion.
+    required: true
+    locale: "en"
+  - attestationId: "scope-of-practice-attestation"
+    displayName: "Scope of Practice Attestation"
+    description: "For displaying the scope of practice attestation."
+    text: |-
+      I hereby attest and affirm that I have reviewed, understand, and will abide by this state's scope of practice and all applicable laws and rules when practicing in the state. I understand that the issuance of a Compact Privilege authorizes me to legally practice in the member jurisdiction in accordance with the laws and rules governing practice of my profession in that jurisdiction.
+
+      If I violate the practice act, the appropriate board may take action against my Compact Privilege, which may result in the revocation of other Compact Privileges I may hold. I will also be prohibited from obtaining any other Compact Privileges for a period of at least two (2) years.
+    required: true
+    locale: "en"
+  - attestationId: "personal-information-home-state-attestation"
+    displayName: "Personal Information Home State Attestation"
+    description: "For declaring that the applicant is a resident of the state they have listed as their home state."
+    text: |-
+      I hereby attest and affirm that this is my personal and licensure information and that I am a resident of the state listed on this page.*
+    required: true
+    locale: "en"
+  - attestationId: "personal-information-address-attestation"
+    displayName: "Personal Information Address Attestation"
+    description: "For declaring that the applicant is a resident of the state they have listed as their home state."
+    text: |-
+      I hereby attest and affirm that the address information I have provided herein and is my current address. I further consent to accept service of process at this address. I will notify the Commission of a change in my Home State address or email address via updating personal information records in this system. I understand that I am only eligible for a Compact Privilege if I am a licensee in my Home State as defined by the Compact. If I mislead the Compact Commission about my Home State, the appropriate board may take action against my Compact Privilege, which may result in the revocation of other Compact Privileges I may hold. I will also be prohibited from obtaining any other Compact Privileges for a period of at least two (2) years.*
+    required: true
+    locale: "en"
+  - attestationId: "not-under-investigation-attestation"
+    displayName: "Not Under Investigation Attestation"
+    description: "For declaring that the applicant is not currently under investigation."
+    text: |-
+      I hereby attest and affirm that I am not currently under investigation by any board, agency, department, association, certifying body, or other body.
+    required: true
+    locale: "en"
+  - attestationId: "under-investigation-attestation"
+    displayName: "Under Investigation Attestation"
+    description: "For declaring that the applicant is currently under investigation."
+    text: |-
+      I hereby attest and affirm that I am currently under investigation by any board, agency, department, association, certifying body, or other body. I understand that if any investigation results in a disciplinary action, my Compact Privileges may be revoked.
+    required: true
+    locale: "en"
+  - attestationId: "discipline-no-current-encumbrance-attestation"
+    displayName: "No Current Discipline Encumbrance Attestation"
+    description: "For declaring that the applicant has no encumbrances on any state license."
+    text: |-
+      I hereby attest and affirm that I have no encumbrance (any discipline that restricts my full practice or any unmet condition before returning to a full and unrestricted license, including, but not limited, to probation, supervision, completion of a program, and/or completion of CEs) on ANY state license.
+    required: true
+    locale: "en"
+  - attestationId: "discipline-no-prior-encumbrance-attestation"
+    displayName: "No Discipline Encumbrance For Prior Two Yeats Attestation"
+    description: "For declaring that the applicant has no encumbrances on any state license within the last two years."
+    text: |-
+      I hereby attest and affirm that I have not had any encumbrance on ANY state license within the previous two years from date of this application for a Compact Privilege.
+    required: true
+    locale: "en"
+  - attestationId: "provision-of-true-information-attestation"
+    displayName: "Provision of True Information Attestation"
+    description: "For declaring that the applicant has provided true information."
+    text: |-
+      I hereby attest and affirm that all information contained in this privilege application is true to the best of my knowledge.
+    required: true
+    locale: "en"
+  - attestationId: "military-affiliation-confirmation-attestation"
+    displayName: "Military Affiliation Confirmation Attestation"
+    description: "For declaring that the applicant's military affiliation documentation is accurate."
+    text: |-
+      I hereby attest and affirm that my current military status documentation as uploaded to CompactConnect is accurate.
+    required: true
+    locale: "en"
diff --git a/backend/compact-connect/compact-config/coun.yml b/backend/compact-connect/compact-config/coun.yml
index 5bf632e89..9a02de0bf 100644
--- a/backend/compact-connect/compact-config/coun.yml
+++ b/backend/compact-connect/compact-config/coun.yml
@@ -7,3 +7,77 @@ compactOperationsTeamEmails: []
 compactAdverseActionsNotificationEmails: []
 compactSummaryReportNotificationEmails: []
 activeEnvironments: []
+
+attestations:
+  - attestationId: "jurisprudence-confirmation"
+    displayName: "Jurisprudence Confirmation."
+    description: "For displaying the jurisprudence confirmation."
+    text: |-
+      I understand that an attestation is a legally binding statement. I understand that providing false information on this application could result in a loss of my licenses and/or privileges. I acknowledge that the Commission may audit jurisprudence attestations at their discretion.
+    required: true
+    locale: "en"
+  - attestationId: "scope-of-practice-attestation"
+    displayName: "Scope of Practice Attestation"
+    description: "For displaying the scope of practice attestation."
+    text: |-
+      I hereby attest and affirm that I have reviewed, understand, and will abide by this state's scope of practice and all applicable laws and rules when practicing in the state. I understand that the issuance of a Compact Privilege authorizes me to legally practice in the member jurisdiction in accordance with the laws and rules governing practice of my profession in that jurisdiction.
+
+      If I violate the practice act, the appropriate board may take action against my Compact Privilege, which may result in the revocation of other Compact Privileges I may hold. I will also be prohibited from obtaining any other Compact Privileges for a period of at least two (2) years.
+    required: true
+    locale: "en"
+  - attestationId: "personal-information-home-state-attestation"
+    displayName: "Personal Information Home State Attestation"
+    description: "For declaring that the applicant is a resident of the state they have listed as their home state."
+    text: |-
+      I hereby attest and affirm that this is my personal and licensure information and that I am a resident of the state listed on this page.*
+    required: true
+    locale: "en"
+  - attestationId: "personal-information-address-attestation"
+    displayName: "Personal Information Address Attestation"
+    description: "For declaring that the applicant is a resident of the state they have listed as their home state."
+    text: |-
+      I hereby attest and affirm that the address information I have provided herein and is my current address. I further consent to accept service of process at this address. I will notify the Commission of a change in my Home State address or email address via updating personal information records in this system. I understand that I am only eligible for a Compact Privilege if I am a licensee in my Home State as defined by the Compact. If I mislead the Compact Commission about my Home State, the appropriate board may take action against my Compact Privilege, which may result in the revocation of other Compact Privileges I may hold. I will also be prohibited from obtaining any other Compact Privileges for a period of at least two (2) years.*
+    required: true
+    locale: "en"
+  - attestationId: "not-under-investigation-attestation"
+    displayName: "Not Under Investigation Attestation"
+    description: "For declaring that the applicant is not currently under investigation."
+    text: |-
+      I hereby attest and affirm that I am not currently under investigation by any board, agency, department, association, certifying body, or other body.
+    required: true
+    locale: "en"
+  - attestationId: "under-investigation-attestation"
+    displayName: "Under Investigation Attestation"
+    description: "For declaring that the applicant is currently under investigation."
+    text: |-
+      I hereby attest and affirm that I am currently under investigation by any board, agency, department, association, certifying body, or other body. I understand that if any investigation results in a disciplinary action, my Compact Privileges may be revoked.
+    required: true
+    locale: "en"
+  - attestationId: "discipline-no-current-encumbrance-attestation"
+    displayName: "No Current Discipline Encumbrance Attestation"
+    description: "For declaring that the applicant has no encumbrances on any state license."
+    text: |-
+      I hereby attest and affirm that I have no encumbrance (any discipline that restricts my full practice or any unmet condition before returning to a full and unrestricted license, including, but not limited, to probation, supervision, completion of a program, and/or completion of CEs) on ANY state license.
+    required: true
+    locale: "en"
+  - attestationId: "discipline-no-prior-encumbrance-attestation"
+    displayName: "No Discipline Encumbrance For Prior Two Yeats Attestation"
+    description: "For declaring that the applicant has no encumbrances on any state license within the last two years."
+    text: |-
+      I hereby attest and affirm that I have not had any encumbrance on ANY state license within the previous two years from date of this application for a Compact Privilege.
+    required: true
+    locale: "en"
+  - attestationId: "provision-of-true-information-attestation"
+    displayName: "Provision of True Information Attestation"
+    description: "For declaring that the applicant has provided true information."
+    text: |-
+      I hereby attest and affirm that all information contained in this privilege application is true to the best of my knowledge.
+    required: true
+    locale: "en"
+  - attestationId: "military-affiliation-confirmation-attestation"
+    displayName: "Military Affiliation Confirmation Attestation"
+    description: "For declaring that the applicant's military affiliation documentation is accurate."
+    text: |-
+      I hereby attest and affirm that my current military status documentation as uploaded to CompactConnect is accurate.
+    required: true
+    locale: "en"
diff --git a/backend/compact-connect/compact-config/octp.yml b/backend/compact-connect/compact-config/octp.yml
index 863c1c1d1..0da0fb513 100644
--- a/backend/compact-connect/compact-config/octp.yml
+++ b/backend/compact-connect/compact-config/octp.yml
@@ -7,3 +7,77 @@ compactOperationsTeamEmails: []
 compactAdverseActionsNotificationEmails: []
 compactSummaryReportNotificationEmails: []
 activeEnvironments: ["test"]
+
+attestations:
+  - attestationId: "jurisprudence-confirmation"
+    displayName: "Jurisprudence Confirmation."
+    description: "For displaying the jurisprudence confirmation."
+    text: |-
+      I understand that an attestation is a legally binding statement. I understand that providing false information on this application could result in a loss of my licenses and/or privileges. I acknowledge that the Commission may audit jurisprudence attestations at their discretion.
+    required: true
+    locale: "en"
+  - attestationId: "scope-of-practice-attestation"
+    displayName: "Scope of Practice Attestation"
+    description: "For displaying the scope of practice attestation."
+    text: |-
+      I hereby attest and affirm that I have reviewed, understand, and will abide by this state's scope of practice and all applicable laws and rules when practicing in the state. I understand that the issuance of a Compact Privilege authorizes me to legally practice in the member jurisdiction in accordance with the laws and rules governing practice of my profession in that jurisdiction.
+
+      If I violate the practice act, the appropriate board may take action against my Compact Privilege, which may result in the revocation of other Compact Privileges I may hold. I will also be prohibited from obtaining any other Compact Privileges for a period of at least two (2) years.
+    required: true
+    locale: "en"
+  - attestationId: "personal-information-home-state-attestation"
+    displayName: "Personal Information Home State Attestation"
+    description: "For declaring that the applicant is a resident of the state they have listed as their home state."
+    text: |-
+      I hereby attest and affirm that this is my personal and licensure information and that I am a resident of the state listed on this page.*
+    required: true
+    locale: "en"
+  - attestationId: "personal-information-address-attestation"
+    displayName: "Personal Information Address Attestation"
+    description: "For declaring that the applicant is a resident of the state they have listed as their home state."
+    text: |-
+      I hereby attest and affirm that the address information I have provided herein and is my current address. I further consent to accept service of process at this address. I will notify the Commission of a change in my Home State address or email address via updating personal information records in this system. I understand that I am only eligible for a Compact Privilege if I am a licensee in my Home State as defined by the Compact. If I mislead the Compact Commission about my Home State, the appropriate board may take action against my Compact Privilege, which may result in the revocation of other Compact Privileges I may hold. I will also be prohibited from obtaining any other Compact Privileges for a period of at least two (2) years.*
+    required: true
+    locale: "en"
+  - attestationId: "not-under-investigation-attestation"
+    displayName: "Not Under Investigation Attestation"
+    description: "For declaring that the applicant is not currently under investigation."
+    text: |-
+      I hereby attest and affirm that I am not currently under investigation by any board, agency, department, association, certifying body, or other body.
+    required: true
+    locale: "en"
+  - attestationId: "under-investigation-attestation"
+    displayName: "Under Investigation Attestation"
+    description: "For declaring that the applicant is currently under investigation."
+    text: |-
+      I hereby attest and affirm that I am currently under investigation by any board, agency, department, association, certifying body, or other body. I understand that if any investigation results in a disciplinary action, my Compact Privileges may be revoked.
+    required: true
+    locale: "en"
+  - attestationId: "discipline-no-current-encumbrance-attestation"
+    displayName: "No Current Discipline Encumbrance Attestation"
+    description: "For declaring that the applicant has no encumbrances on any state license."
+    text: |-
+      I hereby attest and affirm that I have no encumbrance (any discipline that restricts my full practice or any unmet condition before returning to a full and unrestricted license, including, but not limited, to probation, supervision, completion of a program, and/or completion of CEs) on ANY state license.
+    required: true
+    locale: "en"
+  - attestationId: "discipline-no-prior-encumbrance-attestation"
+    displayName: "No Discipline Encumbrance For Prior Two Yeats Attestation"
+    description: "For declaring that the applicant has no encumbrances on any state license within the last two years."
+    text: |-
+      I hereby attest and affirm that I have not had any encumbrance on ANY state license within the previous two years from date of this application for a Compact Privilege.
+    required: true
+    locale: "en"
+  - attestationId: "provision-of-true-information-attestation"
+    displayName: "Provision of True Information Attestation"
+    description: "For declaring that the applicant has provided true information."
+    text: |-
+      I hereby attest and affirm that all information contained in this privilege application is true to the best of my knowledge.
+    required: true
+    locale: "en"
+  - attestationId: "military-affiliation-confirmation-attestation"
+    displayName: "Military Affiliation Confirmation Attestation"
+    description: "For declaring that the applicant's military affiliation documentation is accurate."
+    text: |-
+      I hereby attest and affirm that my current military status documentation as uploaded to CompactConnect is accurate.
+    required: true
+    locale: "en"
diff --git a/backend/compact-connect/docs/README.md b/backend/compact-connect/docs/README.md
index 12a5cf928..a53d57eef 100644
--- a/backend/compact-connect/docs/README.md
+++ b/backend/compact-connect/docs/README.md
@@ -9,15 +9,9 @@ look [here](./design/README.md).
 The Audiology and Speech Language Pathology, Counseling, and Occupational Therapy compact commissions are collectively building a system to share professional licensure data between their state licensing boards to facilitate participation in their respective occupational licensure compacts. To date, this system is solely composed of a mock API.
 
 ## Table of Contents
-- **[Mock API](#mock-api)**
 - **[How to use the API bulk-upload feature](#how-to-use-the-api-bulk-upload-feature)**
 - **[Open API Specification](#open-api-specification)**
 
-## Mock API
-[Back to top](#compact-connect---technical-user-guide)
-
-This system includes a mock license data API that has two functions: A synchronous license data validation endpoint that can allow users to test their data against the expected data schema and an asynchronous bulk upload function that can allow for uploading a large file to be asynchronously processed. Currently, neither endpoint has any back-end processing and data is immediately discarded. If you wish to test out these endpoints, **please make a point to only send artificial data**.
-
 ## How to use the API bulk-upload feature
 [Back to top](#compact-connect---technical-user-guide)
 
diff --git a/backend/compact-connect/docs/api-specification/latest-oas30.json b/backend/compact-connect/docs/api-specification/latest-oas30.json
index 14d6938d3..108c97e9a 100644
--- a/backend/compact-connect/docs/api-specification/latest-oas30.json
+++ b/backend/compact-connect/docs/api-specification/latest-oas30.json
@@ -2,7 +2,7 @@
   "openapi": "3.0.1",
   "info": {
     "title": "LicenseApi",
-    "version": "2024-12-02T19:04:58Z"
+    "version": "2025-01-03T17:38:01Z"
   },
   "servers": [
     {
@@ -74,6 +74,133 @@
         }
       }
     },
+    "/v1/compacts/{compact}/attestations": {
+      "options": {
+        "parameters": [
+          {
+            "name": "compact",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "204 response",
+            "headers": {
+              "Access-Control-Allow-Origin": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "Access-Control-Allow-Methods": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "Access-Control-Allow-Headers": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
+            "content": {}
+          }
+        }
+      }
+    },
+    "/v1/compacts/{compact}/attestations/{attestationId}": {
+      "get": {
+        "parameters": [
+          {
+            "name": "Authorization",
+            "in": "header",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "compact",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "attestationId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "200 response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SandboLicenxwmHa2Q438IJ"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "SandboxAPIStackLicenseApiProviderUsersPoolAuthorizerEB7523BA": []
+          }
+        ]
+      },
+      "options": {
+        "parameters": [
+          {
+            "name": "compact",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "attestationId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "204 response",
+            "headers": {
+              "Access-Control-Allow-Origin": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "Access-Control-Allow-Methods": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "Access-Control-Allow-Headers": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
+            "content": {}
+          }
+        }
+      }
+    },
     "/v1/compacts/{compact}/credentials": {
       "options": {
         "parameters": [
@@ -561,9 +688,9 @@
         "security": [
           {
             "SandboxAPIStackLicenseApiStaffPoolsAuthorizerD744D6FB": [
-              "aslp/read",
-              "octp/read",
-              "coun/read"
+              "aslp/readGeneral",
+              "octp/readGeneral",
+              "coun/readGeneral"
             ]
           }
         ]
@@ -647,9 +774,9 @@
         "security": [
           {
             "SandboxAPIStackLicenseApiStaffPoolsAuthorizerD744D6FB": [
-              "aslp/read",
-              "octp/read",
-              "coun/read"
+              "aslp/readGeneral",
+              "octp/readGeneral",
+              "coun/readGeneral"
             ]
           }
         ]
@@ -1758,6 +1885,9 @@
                 "actions": {
                   "type": "object",
                   "properties": {
+                    "readPrivate": {
+                      "type": "boolean"
+                    },
                     "read": {
                       "type": "boolean"
                     },
@@ -1774,6 +1904,9 @@
                       "actions": {
                         "type": "object",
                         "properties": {
+                          "readPrivate": {
+                            "type": "boolean"
+                          },
                           "admin": {
                             "type": "boolean"
                           },
@@ -2002,6 +2135,9 @@
                       "actions": {
                         "type": "object",
                         "properties": {
+                          "readPrivate": {
+                            "type": "boolean"
+                          },
                           "read": {
                             "type": "boolean"
                           },
@@ -2018,6 +2154,9 @@
                             "actions": {
                               "type": "object",
                               "properties": {
+                                "readPrivate": {
+                                  "type": "boolean"
+                                },
                                 "admin": {
                                   "type": "boolean"
                                 },
@@ -2085,6 +2224,9 @@
                 "actions": {
                   "type": "object",
                   "properties": {
+                    "readPrivate": {
+                      "type": "boolean"
+                    },
                     "read": {
                       "type": "boolean"
                     },
@@ -2101,6 +2243,9 @@
                       "actions": {
                         "type": "object",
                         "properties": {
+                          "readPrivate": {
+                            "type": "boolean"
+                          },
                           "admin": {
                             "type": "boolean"
                           },
@@ -2432,6 +2577,9 @@
                 "actions": {
                   "type": "object",
                   "properties": {
+                    "readPrivate": {
+                      "type": "boolean"
+                    },
                     "read": {
                       "type": "boolean"
                     },
@@ -2448,6 +2596,9 @@
                       "actions": {
                         "type": "object",
                         "properties": {
+                          "readPrivate": {
+                            "type": "boolean"
+                          },
                           "admin": {
                             "type": "boolean"
                           },
@@ -3066,6 +3217,41 @@
           }
         }
       },
+      "SandboLicenxwmHa2Q438IJ": {
+        "type": "object",
+        "properties": {
+          "dateCreated": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "compact": {
+            "type": "string",
+            "enum": [
+              "aslp",
+              "octp",
+              "coun"
+            ]
+          },
+          "attestationType": {
+            "type": "string"
+          },
+          "text": {
+            "type": "string"
+          },
+          "type": {
+            "type": "string",
+            "enum": [
+              "attestation"
+            ]
+          },
+          "version": {
+            "type": "string"
+          },
+          "required": {
+            "type": "boolean"
+          }
+        }
+      },
       "SandboLicenZpJMDau4cDdN": {
         "required": [
           "message"
@@ -3217,11 +3403,34 @@
       },
       "SandboLicenGA3a6Jf5sr6W": {
         "required": [
+          "attestations",
           "orderInformation",
           "selectedJurisdictions"
         ],
         "type": "object",
         "properties": {
+          "attestations": {
+            "type": "array",
+            "description": "List of attestations that the user has agreed to",
+            "items": {
+              "required": [
+                "attestationId",
+                "version"
+              ],
+              "type": "object",
+              "properties": {
+                "attestationId": {
+                  "type": "string",
+                  "description": "The ID of the attestation"
+                },
+                "version": {
+                  "pattern": "^\\d+$",
+                  "type": "string",
+                  "description": "The version of the attestation"
+                }
+              }
+            }
+          },
           "orderInformation": {
             "required": [
               "billing",
@@ -3239,7 +3448,7 @@
                 "properties": {
                   "number": {
                     "maxLength": 19,
-                    "minLength": 15,
+                    "minLength": 13,
                     "type": "string",
                     "description": "The card number"
                   },
diff --git a/backend/compact-connect/docs/design/README.md b/backend/compact-connect/docs/design/README.md
index afe7b56b7..30279abd1 100644
--- a/backend/compact-connect/docs/design/README.md
+++ b/backend/compact-connect/docs/design/README.md
@@ -6,7 +6,7 @@ Look here for continued documentation of the back-end design, as it progresses.
 - **[Compacts and Jurisdictions](#compacts-and-jurisdictions)**
 - **[License Ingest](#license-ingest)**
 - **[User Architecture](#user-architecture)**
-
+- **[Attestations](#attestations)**
 ## Compacts and Jurisdictions
 
 The CompactConnect system supports multiple licensure compacts and, within each compact, multiple jurisdictions. The
@@ -163,3 +163,48 @@ Licensee users permissions are much simpler as compared to Compact Users. Their
 Once their identity has been verified and associated with a licensee in the license data system, they will only have
 permission to view system data that is specific to them. They will be able to apply for and renew privileges to practice
 across jurisdictions, subject to their eligibility.
+
+
+## Attestations
+[Back to top](#backend-design)
+
+Attestations are statements that providers must agree to when performing certain actions within the system, such as purchasing privileges. The attestation system is designed to support versioned, localized attestation text that providers must explicitly accept.
+
+### Storage and Versioning
+
+Attestations are stored in the compact configuration table with a composite key structure that enables efficient querying of the latest version for a given attestation type and locale:
+
+```
+PK: {compact}#CONFIGURATION
+SK: {compact}#ATTESTATION#{attestationId}#LOCALE#{locale}#VERSION#{version}
+```
+
+This structure allows us to:
+1. Group all attestations for a compact together (via PK)
+2. Sort attestations by type, locale, and version (via SK)
+3. Query for the latest version of a specific attestation in a given locale using a begins_with condition on the SK
+
+### Retrieval and Validation
+
+The system provides a `GET /v1/compacts/{compact}/attestations/{attestationId}` endpoint that returns the latest version of an attestation. This endpoint:
+1. Accepts an optional `locale` query parameter (defaults to 'en').
+2. Returns a 404 if no attestation is found for the given type/locale.
+3. Always returns the latest version of the attestation.
+
+When providers perform actions that require attestations (like purchasing privileges), they must:
+1. Fetch the latest version of each required attestation
+2. Include the attestation IDs and versions in their request
+3. The system validates that:
+   - All required attestations are present
+   - The provided versions match the latest versions
+   - No invalid attestation types are included
+
+### Usage in Privilege Purchases
+
+When purchasing privileges, providers must accept all required attestations. The purchase endpoint:
+1. Validates the attestations array in the request body
+2. Verifies each attestation is the latest version
+3. Stores the accepted attestations with the privilege record
+4. Returns a 400 error if any attestation is invalid or outdated
+
+This ensures that providers always see and accept the most current version of required attestations, and we maintain an audit trail of which attestation versions were accepted for each privilege purchase.
\ No newline at end of file
diff --git a/backend/compact-connect/docs/onboarding/JURISDICTION_COMPACT_ONBOARDING.md b/backend/compact-connect/docs/onboarding/JURISDICTION_COMPACT_ONBOARDING.md
index f0f8012e2..e11658b20 100644
--- a/backend/compact-connect/docs/onboarding/JURISDICTION_COMPACT_ONBOARDING.md
+++ b/backend/compact-connect/docs/onboarding/JURISDICTION_COMPACT_ONBOARDING.md
@@ -172,10 +172,72 @@ compactOperationsTeamEmails: ["<email address>"]
 compactAdverseActionsNotificationEmails: ["<email address>"]
 compactSummaryReportNotificationEmails: ["<email address>"]
 activeEnvironments: ["sandbox", "test"]
+attestations:                                       # Required attestations for the compact
+  - attestationId: "<id>"
+    displayName: "<name>"
+    description: "<description>"
+    text: "<attestation text>"
+    required: true|false
+    locale: "en"
 ```
 At deploy time, if the environment name matches one of the files in the `activeEnvironments` list, these configuration
 files will be written to the database and accessible by the system.
 
+### Configure Compact Attestations
+Each compact must define a set of attestations that providers must accept when purchasing privileges. Attestations are legally binding statements that providers must agree to, and they are versioned to ensure providers always see and accept the most current version. The attestations must be defined in the compact configuration file under the `attestations` field.
+
+The following attestations must be defined for each compact:
+
+1. **Jurisprudence Confirmation** (`jurisprudence-confirmation`)
+   - Confirms understanding that attestations are legally binding and false information may result in license/privilege loss
+
+2. **Scope of Practice** (`scope-of-practice-attestation`)
+   - Confirms understanding and agreement to abide by the state's scope of practice and applicable laws
+   - Acknowledges that violations may result in privilege revocation and two-year prohibition
+
+3. **Personal Information - Home State** (`personal-information-home-state-attestation`)
+   - Confirms residency in the declared home state
+   - Verifies personal and licensure information accuracy
+
+4. **Personal Information - Address** (`personal-information-address-attestation`)
+   - Confirms current address accuracy and consent to service of process
+   - Acknowledges requirement to notify Commission of address changes
+   - Confirms understanding of home state eligibility requirements
+
+5. **Discipline - No Current Encumbrance** (`discipline-no-current-encumbrance-attestation`)
+   - Confirms no current disciplinary restrictions on any state license
+   - Includes probation, supervision, program completion, and CE requirements
+
+6. **Discipline - No Prior Encumbrance** (`discipline-no-prior-encumbrance-attestation`)
+   - Confirms no disciplinary restrictions on any state license within the past two years
+
+7. **Provision of True Information** (`provision-of-true-information-attestation`)
+   - General attestation that all provided information is true and accurate
+
+8. **Not Under Investigation** (`not-under-investigation-attestation`)
+   - Confirms no current investigations by any board or regulatory body
+
+9. **Under Investigation** (`under-investigation-attestation`)
+   - Declares current investigation status
+   - Acknowledges that disciplinary action may result in privilege revocation
+
+10. **Military Affiliation** (`military-affiliation-confirmation-attestation`)
+    - Required only for providers with active military affiliation
+    - Confirms accuracy of uploaded military status documentation
+
+Each attestation in the configuration must include:
+```yaml
+attestations:
+  - attestationId: "<id>"           # Unique identifier for the attestation
+    displayName: "<name>"           # Human-readable name
+    description: "<description>"    # Brief description of the attestation's purpose
+    text: "<attestation text>"     # The full text of the attestation
+    required: true|false           # Whether the attestation is required
+    locale: "en"                   # Language code (currently only "en" supported)
+```
+
+The system automatically handles versioning of attestations. When the text, displayName, description, or required status of an attestation changes, the system will automatically increment the version number. Providers must always accept the latest version of each attestation when purchasing privileges.
+
 
 ## Updating Snapshot Tests to match Configuration Changes
 In order to ensure that the system is functioning as expected, we have tests in place to verify that the configuration
diff --git a/backend/compact-connect/lambdas/python/attestations/.coveragerc b/backend/compact-connect/lambdas/python/attestations/.coveragerc
new file mode 100644
index 000000000..99c409d65
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/attestations/.coveragerc
@@ -0,0 +1,10 @@
+[run]
+data_file = ../../../.coverage
+
+omit =
+  */cdk.out/*
+  */smoke-test/*
+  */tests/*
+
+[report]
+skip_empty = true
diff --git a/backend/compact-connect/lambdas/python/attestations/handlers/__init__.py b/backend/compact-connect/lambdas/python/attestations/handlers/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/backend/compact-connect/lambdas/python/attestations/handlers/attestations.py b/backend/compact-connect/lambdas/python/attestations/handlers/attestations.py
new file mode 100644
index 000000000..6567655b2
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/attestations/handlers/attestations.py
@@ -0,0 +1,42 @@
+from aws_lambda_powertools.utilities.typing import LambdaContext
+from cc_common.config import config, logger
+from cc_common.exceptions import CCInvalidRequestException
+from cc_common.utils import api_handler
+
+
+@api_handler
+def attestations(event: dict, context: LambdaContext):  # noqa: ARG001 unused-argument
+    """Handle attestation requests."""
+    # handle GET method
+    if event['httpMethod'] == 'GET':
+        return _get_attestation(event, context)
+
+    raise CCInvalidRequestException('Invalid HTTP method')
+
+
+def _get_attestation(event: dict, context: LambdaContext):  # noqa: ARG001 unused-argument
+    """
+    Endpoint to get the latest version of an attestation by type.
+
+    :param event: API Gateway event
+    :param context: Lambda context
+    :return: The latest version of the attestation record
+    """
+    compact = event['pathParameters']['compact']
+    attestation_id = event['pathParameters']['attestationId']
+    # If no query string parameters are provided, APIGW will set the value to None, which we need to handle here
+    query_string_params = event.get('queryStringParameters') if event.get('queryStringParameters') is not None else {}
+    locale = query_string_params.get('locale', 'en')
+
+    logger.info(
+        'Getting attestation',
+        compact=compact,
+        attestation_id=attestation_id,
+        locale=locale,
+    )
+
+    return config.compact_configuration_client.get_attestation(
+        compact=compact,
+        attestation_id=attestation_id,
+        locale=locale,
+    )
diff --git a/backend/compact-connect/lambdas/python/attestations/requirements-dev.in b/backend/compact-connect/lambdas/python/attestations/requirements-dev.in
new file mode 100644
index 000000000..5a61b7b0d
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/attestations/requirements-dev.in
@@ -0,0 +1 @@
+moto[dynamodb, s3]>=5.0.12, <6
diff --git a/backend/compact-connect/lambdas/python/attestations/requirements-dev.txt b/backend/compact-connect/lambdas/python/attestations/requirements-dev.txt
new file mode 100644
index 000000000..a878347c1
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/attestations/requirements-dev.txt
@@ -0,0 +1,70 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    pip-compile --no-emit-index-url compact-connect/lambdas/python/attestations/requirements-dev.in
+#
+boto3==1.35.92
+    # via moto
+botocore==1.35.92
+    # via
+    #   boto3
+    #   moto
+    #   s3transfer
+certifi==2024.12.14
+    # via requests
+cffi==1.17.1
+    # via cryptography
+charset-normalizer==3.4.1
+    # via requests
+cryptography==44.0.0
+    # via moto
+docker==7.1.0
+    # via moto
+idna==3.10
+    # via requests
+jinja2==3.1.5
+    # via moto
+jmespath==1.0.1
+    # via
+    #   boto3
+    #   botocore
+markupsafe==3.0.2
+    # via
+    #   jinja2
+    #   werkzeug
+moto[dynamodb,s3]==5.0.26
+    # via -r compact-connect/lambdas/python/attestations/requirements-dev.in
+py-partiql-parser==0.6.1
+    # via moto
+pycparser==2.22
+    # via cffi
+python-dateutil==2.9.0.post0
+    # via
+    #   botocore
+    #   moto
+pyyaml==6.0.2
+    # via
+    #   moto
+    #   responses
+requests==2.32.3
+    # via
+    #   docker
+    #   moto
+    #   responses
+responses==0.25.3
+    # via moto
+s3transfer==0.10.4
+    # via boto3
+six==1.17.0
+    # via python-dateutil
+urllib3==2.3.0
+    # via
+    #   botocore
+    #   docker
+    #   requests
+    #   responses
+werkzeug==3.1.3
+    # via moto
+xmltodict==0.14.2
+    # via moto
diff --git a/backend/compact-connect/lambdas/python/attestations/requirements.in b/backend/compact-connect/lambdas/python/attestations/requirements.in
new file mode 100644
index 000000000..68b7c56e7
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/attestations/requirements.in
@@ -0,0 +1 @@
+# common requirements are managed in the common requirements.in file
diff --git a/backend/compact-connect/lambdas/python/attestations/requirements.txt b/backend/compact-connect/lambdas/python/attestations/requirements.txt
new file mode 100644
index 000000000..13a990a83
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/attestations/requirements.txt
@@ -0,0 +1,6 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    pip-compile --no-emit-index-url compact-connect/lambdas/python/attestations/requirements.in
+#
diff --git a/backend/compact-connect/lambdas/python/attestations/tests/__init__.py b/backend/compact-connect/lambdas/python/attestations/tests/__init__.py
new file mode 100644
index 000000000..fdcc24c2a
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/attestations/tests/__init__.py
@@ -0,0 +1,27 @@
+import os
+from unittest import TestCase
+from unittest.mock import MagicMock
+
+from aws_lambda_powertools.utilities.typing import LambdaContext
+
+
+class TstLambdas(TestCase):
+    @classmethod
+    def setUpClass(cls):
+        os.environ.update(
+            {
+                # Set to 'true' to enable debug logging
+                'DEBUG': 'true',
+                'AWS_DEFAULT_REGION': 'us-east-1',
+                'COMPACT_CONFIGURATION_TABLE_NAME': 'compact-configuration-table',
+                'COMPACTS': '["aslp", "octp", "coun"]',
+                'JURISDICTIONS': '["ne", "oh", "ky"]',
+            },
+        )
+        # Monkey-patch config object to be sure we have it based
+        # on the env vars we set above
+        from cc_common import config
+
+        cls.config = config._Config()  # noqa: SLF001 protected-access
+        config.config = cls.config
+        cls.mock_context = MagicMock(name='MockLambdaContext', spec=LambdaContext)
diff --git a/backend/compact-connect/lambdas/python/attestations/tests/function/__init__.py b/backend/compact-connect/lambdas/python/attestations/tests/function/__init__.py
new file mode 100644
index 000000000..b224762c4
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/attestations/tests/function/__init__.py
@@ -0,0 +1,54 @@
+import json
+import logging
+import os
+
+import boto3
+from moto import mock_aws
+
+from tests import TstLambdas
+
+logger = logging.getLogger(__name__)
+logging.basicConfig()
+logger.setLevel(logging.DEBUG if os.environ.get('DEBUG', 'false') == 'true' else logging.INFO)
+
+
+@mock_aws
+class TstFunction(TstLambdas):
+    """Base class to set up Moto mocking and create mock AWS resources for functional testing"""
+
+    def setUp(self):  # noqa: N801 invalid-name
+        super().setUp()
+
+        self.build_resources()
+
+        self.addCleanup(self.delete_resources)
+
+    def build_resources(self):
+        self.create_compact_configuration_table()
+
+    def create_compact_configuration_table(self):
+        from cc_common.data_model.schema.attestation import AttestationRecordSchema
+
+        self._compact_configuration_table = boto3.resource('dynamodb').create_table(
+            AttributeDefinitions=[
+                {'AttributeName': 'pk', 'AttributeType': 'S'},
+                {'AttributeName': 'sk', 'AttributeType': 'S'},
+            ],
+            TableName=os.environ['COMPACT_CONFIGURATION_TABLE_NAME'],
+            KeySchema=[{'AttributeName': 'pk', 'KeyType': 'HASH'}, {'AttributeName': 'sk', 'KeyType': 'RANGE'}],
+            BillingMode='PAY_PER_REQUEST',
+        )
+
+        with open('../common/tests/resources/dynamo/attestation.json') as f:
+            json_data = json.load(f)
+            # adding four versions of the same attestation to test getting the latest version
+            for i in range(1, 5):
+                json_data['version'] = str(i)
+                # strip off the pk and sk, then using schema to add them
+                json_data.pop('pk')
+                json_data.pop('sk')
+                serialized_data = AttestationRecordSchema().dump(json_data)
+                self._compact_configuration_table.put_item(Item=serialized_data)
+
+    def delete_resources(self):
+        self._compact_configuration_table.delete()
diff --git a/backend/compact-connect/lambdas/python/attestations/tests/function/test_attestations.py b/backend/compact-connect/lambdas/python/attestations/tests/function/test_attestations.py
new file mode 100644
index 000000000..63fb7cfc3
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/attestations/tests/function/test_attestations.py
@@ -0,0 +1,70 @@
+import json
+
+from moto import mock_aws
+
+from . import TstFunction
+
+
+@mock_aws
+class TestGetAttestation(TstFunction):
+    """Test suite for attestation endpoints."""
+
+    def _generate_test_event(self, method: str, attestation_type: str) -> dict:
+        with open('../common/tests/resources/api-event.json') as f:
+            event = json.load(f)
+            event['httpMethod'] = method
+            event['pathParameters'] = {
+                'compact': 'aslp',
+                'attestationId': attestation_type,
+            }
+
+        return event
+
+    def test_get_latest_attestation(self):
+        """Test getting the latest version of an attestation."""
+        from handlers.attestations import attestations
+
+        event = self._generate_test_event('GET', 'jurisprudence-confirmation')
+
+        response = attestations(event, self.mock_context)
+        self.assertEqual(200, response['statusCode'], msg=json.loads(response['body']))
+        response_body = json.loads(response['body'])
+
+        # The TstFunction class sets up 4 versions of this attestation, we expect the endpoint to return version 4
+        # as it's the latest
+        self.assertEqual(
+            {
+                'attestationId': 'jurisprudence-confirmation',
+                'compact': 'aslp',
+                'dateCreated': '2024-06-06T23:59:59+00:00',
+                # this field is dynamic, so setting it to match the actual response
+                'dateOfUpdate': response_body['dateOfUpdate'],
+                'description': 'For displaying the jurisprudence confirmation',
+                'displayName': 'Jurisprudence Confirmation',
+                'required': True,
+                'text': 'You attest that you have read and understand the jurisprudence '
+                'requirements for all states you are purchasing privileges for.',
+                'type': 'attestation',
+                'version': '4',
+                'locale': 'en',
+            },
+            response_body,
+        )
+
+    def test_get_nonexistent_attestation(self):
+        """Test getting an attestation that doesn't exist."""
+        from handlers.attestations import attestations
+
+        event = self._generate_test_event('GET', 'nonexistent-type')
+
+        response = attestations(event, self.mock_context)
+        self.assertEqual(404, response['statusCode'])
+
+    def test_invalid_http_method(self):
+        """Test that non-GET methods are rejected."""
+        from handlers.attestations import attestations
+
+        event = self._generate_test_event('POST', 'jurisprudence-confirmation')
+
+        response = attestations(event, self.mock_context)
+        self.assertEqual(400, response['statusCode'])
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/config.py b/backend/compact-connect/lambdas/python/common/cc_common/config.py
index 23dbed7a1..ad8af041d 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/config.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/config.py
@@ -39,6 +39,12 @@ def data_client(self):
 
         return DataClient(self)
 
+    @cached_property
+    def compact_configuration_client(self):
+        from cc_common.data_model.compact_configuration_client import CompactConfigurationClient
+
+        return CompactConfigurationClient(self)
+
     @cached_property
     def user_client(self):
         from cc_common.data_model.user_client import UserClient
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/client.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/client.py
index f2564807a..2a1ed1953 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/client.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/client.py
@@ -176,6 +176,7 @@ def _generate_privilege_record(
         jurisdiction_postal_abbreviation: str,
         license_expiration_date: date,
         compact_transaction_id: str,
+        attestations: list[dict],
         original_issuance_date: datetime | None = None,
     ):
         current_datetime = config.current_standard_datetime
@@ -187,6 +188,7 @@ def _generate_privilege_record(
             'dateOfRenewal': current_datetime,
             'dateOfExpiration': license_expiration_date,
             'compactTransactionId': compact_transaction_id,
+            'attestations': attestations,
         }
         schema = PrivilegeRecordSchema()
         return schema.dump(privilege_object)
@@ -199,6 +201,7 @@ def create_provider_privileges(
         license_expiration_date: date,
         compact_transaction_id: str,
         existing_privileges: list[dict],
+        attestations: list[dict],
     ):
         """
         Create privilege records for a provider in the database.
@@ -214,6 +217,7 @@ def create_provider_privileges(
         :param compact_transaction_id: The compact transaction id
         :param existing_privileges: The list of existing privileges for this user. Used to track the original issuance
         date of the privilege.
+        :param attestations: List of attestations that were accepted when purchasing the privileges
         """
         logger.info(
             'Creating provider privileges',
@@ -242,6 +246,7 @@ def create_provider_privileges(
                         jurisdiction_postal_abbreviation=postal_abbreviation,
                         license_expiration_date=license_expiration_date,
                         compact_transaction_id=compact_transaction_id,
+                        attestations=attestations,
                         original_issuance_date=original_privilege_issuance_date,
                     )
                     batch.put_item(Item=privilege_record)
@@ -266,6 +271,7 @@ def create_provider_privileges(
                         jurisdiction_postal_abbreviation=postal_abbreviation,
                         license_expiration_date=license_expiration_date,
                         compact_transaction_id=compact_transaction_id,
+                        attestations=attestations,
                     )
                     # this transaction is idempotent, so we can safely delete the records even if they weren't created
                     delete_batch.delete_item(Key={'pk': privilege_record['pk'], 'sk': privilege_record['sk']})
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/compact_configuration_client.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/compact_configuration_client.py
new file mode 100644
index 000000000..602546f70
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/compact_configuration_client.py
@@ -0,0 +1,68 @@
+from boto3.dynamodb.conditions import Key
+
+from cc_common.config import _Config, logger
+from cc_common.data_model.schema.attestation import AttestationRecordSchema
+from cc_common.exceptions import CCNotFoundException
+
+
+class CompactConfigurationClient:
+    """Client interface for compact configuration dynamodb queries"""
+
+    def __init__(self, config: _Config):
+        self.config = config
+        self.attestation_schema = AttestationRecordSchema()
+
+    def get_attestation(self, *, compact: str, attestation_id: str, locale: str = 'en') -> dict:
+        """
+        Get the latest version of an attestation.
+
+        :param compact: The compact name
+        :param attestation_id: The attestation id used to query.
+        :param locale: The language code for the attestation text (defaults to 'en')
+        :return: The attestation record
+        :raises CCNotFoundException: If no attestation is found
+        """
+        logger.info('Getting attestation', compact=compact, attestation_type=attestation_id, locale=locale)
+
+        pk = f'COMPACT#{compact}#ATTESTATIONS'
+        sk_prefix = f'COMPACT#{compact}#LOCALE#{locale}#ATTESTATION#{attestation_id}#VERSION#'
+        response = self.config.compact_configuration_table.query(
+            KeyConditionExpression=Key('pk').eq(pk) & Key('sk').begins_with(sk_prefix),
+            ScanIndexForward=False,  # Sort in descending order
+            Limit=1,  # We only want the latest version
+        )
+
+        items = response.get('Items', [])
+        if not items:
+            raise CCNotFoundException(f'No attestation found for type "{attestation_id}" in locale "{locale}"')
+
+        # Load and return the latest version through the schema
+        return self.attestation_schema.load(items[0])
+
+    def get_attestations_by_locale(self, *, compact: str, locale: str = 'en') -> dict[str, dict]:
+        """
+        Get all attestations for a compact and locale, keyed by attestation ID.
+        Returns only the latest version of each attestation.
+
+        :param compact: The compact name
+        :param locale: The language code for the attestation text (defaults to 'en')
+        :return: Dictionary of attestation records keyed by attestation ID
+        """
+        logger.info('Getting all attestations', compact=compact, locale=locale)
+
+        pk = f'COMPACT#{compact}#ATTESTATIONS'
+        sk_prefix = f'COMPACT#{compact}#LOCALE#{locale}#ATTESTATION#'
+        response = self.config.compact_configuration_table.query(
+            KeyConditionExpression=Key('pk').eq(pk) & Key('sk').begins_with(sk_prefix),
+            ScanIndexForward=False,  # Sort in descending order to get latest versions first
+        )
+
+        # Group by attestation ID and take the first (latest) version
+        attestations_by_id = {}
+        for item in response.get('Items', []):
+            attestation = self.attestation_schema.load(item)
+            attestation_id = attestation['attestationId']
+            if attestation_id not in attestations_by_id:
+                attestations_by_id[attestation_id] = attestation
+
+        return attestations_by_id
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/attestation.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/attestation.py
new file mode 100644
index 000000000..0c3785cfd
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/attestation.py
@@ -0,0 +1,42 @@
+# ruff: noqa: N801, N815, ARG002  invalid-name unused-argument
+# We diverge from PEP8 variable naming in schema because they map to our API JSON Schema in which,
+# by convention, we use camelCase.
+from marshmallow import pre_dump
+from marshmallow.fields import Boolean, String
+from marshmallow.validate import OneOf, Regexp
+
+from cc_common.data_model.schema.base_record import BaseRecordSchema
+
+ATTESTATION_TYPE = 'attestation'
+SUPPORTED_LOCALES = ['en']
+
+
+@BaseRecordSchema.register_schema(ATTESTATION_TYPE)
+class AttestationRecordSchema(BaseRecordSchema):
+    """Schema for attestation records"""
+
+    _record_type = ATTESTATION_TYPE
+
+    # Provided fields
+    attestationId = String(required=True, allow_none=False)
+    compact = String(required=True, allow_none=False)
+    # verify that version is a string of digits
+    # we store the version as a string, rather than an integer, to avoid
+    # type casting between DynamoDB's Decimal and Python's int types
+    version = String(required=True, allow_none=False, validate=Regexp(r'^\d+$'))
+    dateCreated = String(required=True, allow_none=False)
+    text = String(required=True, allow_none=False)
+    required = Boolean(required=True, allow_none=False)
+    displayName = String(required=True, allow_none=False)
+    description = String(required=True, allow_none=False)
+    locale = String(required=True, allow_none=False, validate=OneOf(SUPPORTED_LOCALES))
+
+    @pre_dump
+    def generate_pk_sk(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
+        """Generate the pk and sk fields for the attestation record"""
+        in_data['pk'] = f'COMPACT#{in_data["compact"]}#ATTESTATIONS'
+        in_data['sk'] = (
+            f'COMPACT#{in_data["compact"]}#LOCALE#{in_data["locale"]}#ATTESTATION#'
+            f'{in_data["attestationId"]}#VERSION#{in_data["version"]}'
+        )
+        return in_data
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/common.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/common.py
index 1010e9cac..fd90d2426 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/common.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/common.py
@@ -1,3 +1,5 @@
+# ruff: noqa: N815 invalid-name
+
 from datetime import UTC, datetime
 from enum import Enum
 
@@ -27,6 +29,18 @@ class S3PresignedPostSchema(Schema):
     fields = Dict(keys=String(), values=String(), required=True, allow_none=False)
 
 
+class AttestationVersionSchema(Schema):
+    """
+    This schema is intended to be used by any object in the system which needs to track which attestations have been
+    accepted by a user (i.e. when purchasing privileges).
+
+    This schema is intended to be used as a nested field in other schemas.
+    """
+
+    attestationId = String(required=True, allow_none=False)
+    version = String(required=True, allow_none=False)
+
+
 def ensure_value_is_datetime(value: str):
     """
     Checks a string value is always returned as a datetime string, even if it is a date string.
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege.py
index a60dae34a..fe53c7a23 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege.py
@@ -1,12 +1,12 @@
 # ruff: noqa: N801, N815, ARG002  invalid-name unused-argument
 
 from marshmallow import pre_dump, pre_load
-from marshmallow.fields import UUID, Date, DateTime, String
+from marshmallow.fields import UUID, Date, DateTime, List, Nested, String
 from marshmallow.validate import Length, OneOf
 
 from cc_common.config import config
 from cc_common.data_model.schema.base_record import BaseRecordSchema, CalculatedStatusRecordSchema, ForgivingSchema
-from cc_common.data_model.schema.common import ensure_value_is_datetime
+from cc_common.data_model.schema.common import AttestationVersionSchema, ensure_value_is_datetime
 
 
 @BaseRecordSchema.register_schema('privilege')
@@ -25,6 +25,8 @@ class PrivilegeRecordSchema(CalculatedStatusRecordSchema):
     dateOfExpiration = Date(required=True, allow_none=False)
     # the id of the transaction that was made when the user purchased the privilege
     compactTransactionId = String(required=False, allow_none=False)
+    # list of attestations that were accepted when purchasing this privilege
+    attestations = List(Nested(AttestationVersionSchema()), required=False, allow_none=False)
 
     # Generated fields
     pk = String(required=True, allow_none=False)
@@ -65,3 +67,5 @@ class PrivilegeGeneralResponseSchema(ForgivingSchema):
     # the id of the transaction that was made when the user purchased the privilege
     compactTransactionId = String(required=False, allow_none=False)
     status = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
+    # list of attestations that were accepted when purchasing this privilege
+    attestations = List(Nested(AttestationVersionSchema()), required=False, allow_none=False)
diff --git a/backend/compact-connect/lambdas/python/common/requirements-dev.txt b/backend/compact-connect/lambdas/python/common/requirements-dev.txt
index 0a750e06c..0322fa337 100644
--- a/backend/compact-connect/lambdas/python/common/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/common/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/common/requirements-dev.in
 #
-boto3==1.35.88
+boto3==1.35.92
     # via moto
-botocore==1.35.88
+botocore==1.35.92
     # via
     #   boto3
     #   moto
@@ -35,7 +35,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.25
+moto[dynamodb,s3]==5.0.26
     # via -r compact-connect/lambdas/python/common/requirements-dev.in
 py-partiql-parser==0.6.1
     # via moto
diff --git a/backend/compact-connect/lambdas/python/common/requirements.txt b/backend/compact-connect/lambdas/python/common/requirements.txt
index 95819ee63..a98abe9c5 100644
--- a/backend/compact-connect/lambdas/python/common/requirements.txt
+++ b/backend/compact-connect/lambdas/python/common/requirements.txt
@@ -6,9 +6,9 @@
 #
 aws-lambda-powertools==2.43.1
     # via -r compact-connect/lambdas/python/common/requirements.in
-boto3==1.35.88
+boto3==1.35.92
     # via -r compact-connect/lambdas/python/common/requirements.in
-botocore==1.35.88
+botocore==1.35.92
     # via
     #   boto3
     #   s3transfer
@@ -17,7 +17,7 @@ jmespath==1.0.1
     #   aws-lambda-powertools
     #   boto3
     #   botocore
-marshmallow==3.23.2
+marshmallow==3.23.3
     # via -r compact-connect/lambdas/python/common/requirements.in
 packaging==24.2
     # via marshmallow
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-detail-response.json b/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-detail-response.json
index 65fdda256..c65c255a0 100644
--- a/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-detail-response.json
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-detail-response.json
@@ -64,7 +64,13 @@
       "dateOfRenewal": "2024-11-08T23:59:59+00:00",
       "dateOfUpdate": "2024-07-01T23:59:59+00:00",
       "dateOfExpiration": "2050-06-06",
-      "compactTransactionId": "1234567890"
+      "compactTransactionId": "1234567890",
+      "attestations": [
+        {
+          "attestationId": "jurisprudence-confirmation",
+          "version": "1"
+        }
+      ]
     }
   ],
   "militaryAffiliations": [
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/attestation.json b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/attestation.json
new file mode 100644
index 000000000..bfe467ae9
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/attestation.json
@@ -0,0 +1,15 @@
+{
+  "pk": "COMPACT#aslp#ATTESTATIONS",
+  "sk": "COMPACT#aslp#LOCALE#en#ATTESTATION#jurisprudence-confirmation#VERSION#1",
+  "type": "attestation",
+  "attestationId": "jurisprudence-confirmation",
+  "displayName": "Jurisprudence Confirmation",
+  "description": "For displaying the jurisprudence confirmation",
+  "compact": "aslp",
+  "version": "1",
+  "dateCreated": "2024-06-06T23:59:59+00:00",
+  "dateOfUpdate": "2024-06-06T23:59:59+00:00",
+  "text": "You attest that you have read and understand the jurisprudence requirements for all states you are purchasing privileges for.",
+  "required": true,
+  "locale": "en"
+}
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/privilege.json b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/privilege.json
index 1ac8ad154..ffb878d7a 100644
--- a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/privilege.json
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/privilege.json
@@ -9,5 +9,11 @@
   "dateOfRenewal": "2024-11-08T23:59:59+00:00",
   "dateOfUpdate": "2024-07-01",
   "dateOfExpiration": "2050-06-06",
-  "compactTransactionId": "1234567890"
+  "compactTransactionId": "1234567890",
+  "attestations": [
+    {
+      "attestationId": "jurisprudence-confirmation",
+      "version": "1"
+    }
+  ]
 }
diff --git a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_data_client.py b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_data_client.py
index 13165b85d..d8b24f6b8 100644
--- a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_data_client.py
+++ b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_data_client.py
@@ -84,6 +84,7 @@ def test_data_client_deletes_records_if_exception_during_create_privilege_record
                 jurisdiction_postal_abbreviations=['CA'],
                 license_expiration_date=date.fromisoformat('2024-10-31'),
                 existing_privileges=[],
+                attestations=[],
                 compact_transaction_id='test_transaction_id',
             )
 
diff --git a/backend/compact-connect/lambdas/python/custom-resources/handlers/compact_config_uploader.py b/backend/compact-connect/lambdas/python/custom-resources/handlers/compact_config_uploader.py
index eea4c3569..fa99322f8 100755
--- a/backend/compact-connect/lambdas/python/custom-resources/handlers/compact_config_uploader.py
+++ b/backend/compact-connect/lambdas/python/custom-resources/handlers/compact_config_uploader.py
@@ -4,8 +4,10 @@
 
 from aws_lambda_powertools.utilities.typing import LambdaContext
 from cc_common.config import config, logger
+from cc_common.data_model.schema.attestation import AttestationRecordSchema
 from cc_common.data_model.schema.compact import CompactRecordSchema
 from cc_common.data_model.schema.jurisdiction import JurisdictionRecordSchema
+from cc_common.exceptions import CCNotFoundException
 
 
 def on_event(event: dict, context: LambdaContext):  # noqa: ARG001 unused-argument
@@ -40,6 +42,9 @@ def upload_configuration(properties: dict):
     compact_configuration = json.loads(properties['compact_configuration'], parse_float=Decimal)
     logger.info('Uploading compact configuration')
 
+    # upload attestations for each compact
+    _upload_attestation_configuration(compact_configuration)
+
     # upload the root compact configuration
     _upload_compact_root_configuration(compact_configuration)
 
@@ -49,6 +54,67 @@ def upload_configuration(properties: dict):
     logger.info('Configuration upload successful')
 
 
+def _upload_attestation_configuration(compact_configuration: dict) -> None:
+    """Upload attestation configurations to the provider table.
+    :param compact_configuration: The compact configuration
+    """
+    attestation_record_schema = AttestationRecordSchema()
+    for compact in compact_configuration['compacts']:
+        compact_name = compact['compactName']
+
+        logger.info('Loading attestations', compact=compact_name)
+        for attestation in compact['attestations']:
+            attestation['compact'] = compact_name
+            attestation['type'] = 'attestation'
+            # set the dateCreated to the current date
+            attestation['dateCreated'] = config.current_standard_datetime.isoformat()
+
+            # Try to get the latest version of this attestation
+            try:
+                latest_attestation = config.compact_configuration_client.get_attestation(
+                    compact=compact_name,
+                    attestation_id=attestation['attestationId'],
+                    locale=attestation['locale'],
+                )
+                # Check if any content fields have changed
+                content_changed = (
+                    any(
+                        # Compare stripped values to ignore leading and trailing whitespace changes
+                        latest_attestation[field].strip() != attestation[field].strip()
+                        for field in ['displayName', 'description', 'text']
+                    )
+                    or latest_attestation['required'] != attestation['required']
+                )
+                if content_changed:
+                    # Increment version if content changed
+                    attestation['version'] = str(int(latest_attestation['version']) + 1)
+                    logger.info(
+                        'Content changed, incrementing version',
+                        attestation_id=attestation['attestationId'],
+                        new_version=attestation['version'],
+                    )
+                else:
+                    # No changes, skip upload
+                    logger.info(
+                        'No content changes detected, skipping upload',
+                        attestation_id=attestation['attestationId'],
+                    )
+                    continue
+            except CCNotFoundException:
+                # No existing attestation, use version 1
+                attestation['version'] = '1'
+                logger.info(
+                    'No existing attestation found, inserting attestation using version 1',
+                    attestation_id=attestation['attestationId'],
+                )
+
+            serialized_attestation = attestation_record_schema.dump(attestation)
+            # Force validation before uploading
+            attestation_record_schema.load(serialized_attestation)
+
+            config.compact_configuration_table.put_item(Item=serialized_attestation)
+
+
 def _upload_compact_root_configuration(compact_configuration: dict) -> None:
     """Upload the root compact configuration to the provider table.
     :param compact_configuration: The compact configuration
@@ -60,6 +126,8 @@ def _upload_compact_root_configuration(compact_configuration: dict) -> None:
         compact['type'] = 'compact'
         # remove the activeEnvironments field as it's an implementation detail
         compact.pop('activeEnvironments')
+        # remove attestations as they are handled separately
+        compact.pop('attestations', None)
 
         serialized_compact = schema.dump(compact)
 
diff --git a/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt b/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt
index 0c8224935..5adca2322 100644
--- a/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/custom-resources/requirements-dev.in
 #
-boto3==1.35.88
+boto3==1.35.92
     # via moto
-botocore==1.35.88
+botocore==1.35.92
     # via
     #   boto3
     #   moto
@@ -33,7 +33,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.25
+moto[dynamodb,s3]==5.0.26
     # via -r compact-connect/lambdas/python/custom-resources/requirements-dev.in
 py-partiql-parser==0.6.1
     # via moto
diff --git a/backend/compact-connect/lambdas/python/custom-resources/tests/function/test_handlers/test_compact_configuration_uploader.py b/backend/compact-connect/lambdas/python/custom-resources/tests/function/test_handlers/test_compact_configuration_uploader.py
index c315d7333..15b870d14 100644
--- a/backend/compact-connect/lambdas/python/custom-resources/tests/function/test_handlers/test_compact_configuration_uploader.py
+++ b/backend/compact-connect/lambdas/python/custom-resources/tests/function/test_handlers/test_compact_configuration_uploader.py
@@ -13,6 +13,18 @@
 MOCK_CURRENT_TIMESTAMP = '2024-11-08T23:59:59+00:00'
 
 
+def generate_mock_attestation():
+    return {
+        'attestationId': 'jurisprudence-confirmation',
+        'displayName': 'Jurisprudence Confirmation',
+        'description': 'For displaying the jurisprudence confirmation',
+        'text': 'You attest that you have read and understand the jurisprudence requirements '
+        'for all states you are purchasing privileges for.',
+        'required': True,
+        'locale': 'en',
+    }
+
+
 def generate_single_root_compact_config(compact_name: str, active_environments: list):
     return {
         'compactName': compact_name,
@@ -21,6 +33,7 @@ def generate_single_root_compact_config(compact_name: str, active_environments:
         'compactAdverseActionsNotificationEmails': [],
         'compactSummaryReportNotificationEmails': [],
         'activeEnvironments': active_environments,
+        'attestations': [generate_mock_attestation()],
     }
 
 
@@ -189,3 +202,164 @@ def test_compact_configuration_uploader_raises_exception_on_invalid_jurisdiction
 
         with self.assertRaises(ValidationError):
             on_event(event, self.mock_context)
+
+    @patch('cc_common.config._Config.current_standard_datetime', datetime.fromisoformat(MOCK_CURRENT_TIMESTAMP))
+    def test_compact_configuration_uploader_uploads_attestations(self):
+        """Test that attestations are correctly uploaded to DynamoDB."""
+        from handlers.compact_config_uploader import on_event
+
+        event = {
+            'RequestType': 'Create',
+            'ResourceProperties': {
+                'compact_configuration': json.dumps(generate_mock_compact_configuration()),
+            },
+        }
+
+        on_event(event, self.mock_context)
+
+        # Query for all attestations in the aslp compact
+        attestation_response = self.config.compact_configuration_table.query(
+            Select='ALL_ATTRIBUTES',
+            KeyConditionExpression=Key('pk').eq('COMPACT#aslp#ATTESTATIONS')
+            & Key('sk').begins_with('COMPACT#aslp#LOCALE#en#ATTESTATION#jurisprudence-confirmation'),
+        )
+
+        self.assertEqual(1, len(attestation_response['Items']))
+        attestation = attestation_response['Items'][0]
+
+        expected_attestation = {
+            'pk': 'COMPACT#aslp#ATTESTATIONS',
+            'sk': 'COMPACT#aslp#LOCALE#en#ATTESTATION#jurisprudence-confirmation#VERSION#1',
+            'type': 'attestation',
+            'attestationId': 'jurisprudence-confirmation',
+            'displayName': 'Jurisprudence Confirmation',
+            'description': 'For displaying the jurisprudence confirmation',
+            'version': '1',
+            'dateCreated': MOCK_CURRENT_TIMESTAMP,
+            'dateOfUpdate': MOCK_CURRENT_TIMESTAMP,
+            'text': 'You attest that you have read and understand the jurisprudence requirements for all '
+            'states you are purchasing privileges for.',
+            'required': True,
+            'locale': 'en',
+            'compact': 'aslp',
+        }
+
+        self.assertEqual(expected_attestation, attestation)
+
+    def test_compact_configuration_uploader_raises_exception_on_invalid_attestation(self):
+        """Test that invalid attestation configurations raise validation errors."""
+        from handlers.compact_config_uploader import on_event
+
+        mock_configuration = generate_mock_compact_configuration()
+        # Make the attestation invalid by removing a required field
+        del mock_configuration['compacts'][0]['attestations'][0]['required']
+
+        event = {
+            'RequestType': 'Create',
+            'ResourceProperties': {
+                'compact_configuration': json.dumps(mock_configuration),
+            },
+        }
+
+        with self.assertRaises(ValidationError):
+            on_event(event, self.mock_context)
+
+    def _when_testing_attestation_field_updates(self, field_to_change, new_value):
+        from handlers.compact_config_uploader import on_event
+
+        original_attestation = generate_mock_attestation()
+        # First upload - should create version 1
+        event = {
+            'RequestType': 'Create',
+            'ResourceProperties': {
+                'compact_configuration': json.dumps(generate_mock_compact_configuration()),
+            },
+        }
+        on_event(event, self.mock_context)
+
+        # Modify the attestation text and upload again
+        mock_configuration = generate_mock_compact_configuration()
+        mock_configuration['compacts'][0]['attestations'][0][field_to_change] = new_value
+
+        event = {
+            'RequestType': 'Update',
+            'ResourceProperties': {
+                'compact_configuration': json.dumps(mock_configuration),
+            },
+        }
+        on_event(event, self.mock_context)
+
+        # Query for all attestations in the aslp compact
+        attestation_response = self.config.compact_configuration_table.query(
+            Select='ALL_ATTRIBUTES',
+            KeyConditionExpression=Key('pk').eq('COMPACT#aslp#ATTESTATIONS')
+            & Key('sk').begins_with('COMPACT#aslp#LOCALE#en#ATTESTATION#jurisprudence-confirmation'),
+        )
+
+        # Should have two versions
+        self.assertEqual(2, len(attestation_response['Items']))
+
+        # Sort by version to get latest
+        attestations = sorted(attestation_response['Items'], key=lambda x: int(x['version']))
+
+        # Check version 1
+        self.assertEqual('1', attestations[0]['version'])
+        self.assertEqual(original_attestation[field_to_change], attestations[0][field_to_change])
+
+        # Check version 2
+        self.assertEqual('2', attestations[1]['version'])
+        self.assertEqual(new_value, attestations[1][field_to_change])
+
+    @patch('cc_common.config._Config.current_standard_datetime', datetime.fromisoformat(MOCK_CURRENT_TIMESTAMP))
+    def test_compact_configuration_uploader_handles_attestation_versioning_when_updating_text(self):
+        """Test that attestation versioning works correctly when content changes."""
+        self._when_testing_attestation_field_updates('text', 'New text')
+
+    @patch('cc_common.config._Config.current_standard_datetime', datetime.fromisoformat(MOCK_CURRENT_TIMESTAMP))
+    def test_compact_configuration_uploader_handles_attestation_versioning_when_updating_description(self):
+        """Test that attestation versioning works correctly when content changes."""
+        self._when_testing_attestation_field_updates('description', 'New description')
+
+    @patch('cc_common.config._Config.current_standard_datetime', datetime.fromisoformat(MOCK_CURRENT_TIMESTAMP))
+    def test_compact_configuration_uploader_handles_attestation_versioning_when_updating_display_name(self):
+        """Test that attestation versioning works correctly when content changes."""
+        self._when_testing_attestation_field_updates('displayName', 'New Display Name')
+
+    @patch('cc_common.config._Config.current_standard_datetime', datetime.fromisoformat(MOCK_CURRENT_TIMESTAMP))
+    def test_compact_configuration_uploader_handles_attestation_versioning_when_updating_required_field(self):
+        """Test that attestation versioning works correctly when content changes."""
+        self._when_testing_attestation_field_updates('required', False)
+
+    @patch('cc_common.config._Config.current_standard_datetime', datetime.fromisoformat(MOCK_CURRENT_TIMESTAMP))
+    def test_compact_configuration_uploader_skips_upload_when_no_changes(self):
+        """Test that attestation is not uploaded when content hasn't changed."""
+        from handlers.compact_config_uploader import on_event
+
+        # First upload - should create version 1
+        event = {
+            'RequestType': 'Create',
+            'ResourceProperties': {
+                'compact_configuration': json.dumps(generate_mock_compact_configuration()),
+            },
+        }
+        on_event(event, self.mock_context)
+
+        # Upload again with no changes
+        event = {
+            'RequestType': 'Update',
+            'ResourceProperties': {
+                'compact_configuration': json.dumps(generate_mock_compact_configuration()),
+            },
+        }
+        on_event(event, self.mock_context)
+
+        # Query for attestations
+        attestation_response = self.config.compact_configuration_table.query(
+            Select='ALL_ATTRIBUTES',
+            KeyConditionExpression=Key('pk').eq('COMPACT#aslp#ATTESTATIONS')
+            & Key('sk').begins_with('COMPACT#aslp#LOCALE#en#ATTESTATION#jurisprudence-confirmation'),
+        )
+
+        # Should still only have one version
+        self.assertEqual(1, len(attestation_response['Items']))
+        self.assertEqual('1', attestation_response['Items'][0]['version'])
diff --git a/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt b/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt
index 215683e2c..3ae3b58cb 100644
--- a/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/data-events/requirements-dev.in
 #
-boto3==1.35.88
+boto3==1.35.92
     # via moto
-botocore==1.35.88
+botocore==1.35.92
     # via
     #   boto3
     #   moto
@@ -33,7 +33,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.25
+moto[dynamodb,s3]==5.0.26
     # via -r compact-connect/lambdas/python/data-events/requirements-dev.in
 py-partiql-parser==0.6.1
     # via moto
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt b/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt
index 94ad2078b..41e54500f 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/provider-data-v1/requirements-dev.in
 #
-boto3==1.35.88
+boto3==1.35.92
     # via moto
-botocore==1.35.88
+botocore==1.35.92
     # via
     #   boto3
     #   moto
@@ -35,7 +35,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.25
+moto[dynamodb,s3]==5.0.26
     # via -r compact-connect/lambdas/python/provider-data-v1/requirements-dev.in
 py-partiql-parser==0.6.1
     # via moto
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py
index 86ad11e83..0b2554705 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py
@@ -180,4 +180,7 @@ def _generate_providers(self, *, home: str, privilege: str, start_serial: int, n
                 license_expiration_date=date(2050, 6, 6),
                 compact_transaction_id='1234567890',
                 existing_privileges=[],
+                # This attestation id/version pair is defined in the 'privilege.json' file under the
+                # common/tests/resources/dynamo directory
+                attestations=[{'attestationId': 'jurisprudence-confirmation', 'version': '1'}],
             )
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py
index 7adb549c1..d48f3f0e2 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py
@@ -90,6 +90,7 @@ def test_transformations(self):
             license_expiration_date=date(2050, 6, 6),
             compact_transaction_id='1234567890',
             existing_privileges=[],
+            attestations=[{'attestationId': 'jurisprudence-confirmation', 'version': '1'}],
         )
 
         from cc_common.data_model.schema.military_affiliation import MilitaryAffiliationType
diff --git a/backend/compact-connect/lambdas/python/purchases/handlers/privileges.py b/backend/compact-connect/lambdas/python/purchases/handlers/privileges.py
index eb8d383d6..b16210a20 100644
--- a/backend/compact-connect/lambdas/python/purchases/handlers/privileges.py
+++ b/backend/compact-connect/lambdas/python/purchases/handlers/privileges.py
@@ -1,4 +1,5 @@
 import json
+import os
 from datetime import date
 
 from aws_lambda_powertools.utilities.typing import LambdaContext
@@ -20,6 +21,26 @@
 from cc_common.utils import api_handler
 from purchase_client import PurchaseClient
 
+# List of attestations that are always required
+REQUIRED_ATTESTATION_IDS = [
+    'jurisprudence-confirmation',
+    'scope-of-practice-attestation',
+    'personal-information-home-state-attestation',
+    'personal-information-address-attestation',
+    'discipline-no-current-encumbrance-attestation',
+    'discipline-no-prior-encumbrance-attestation',
+    'provision-of-true-information-attestation',
+]
+
+# Attestations where exactly one must be provided
+INVESTIGATION_ATTESTATION_IDS = [
+    'not-under-investigation-attestation',
+    'under-investigation-attestation',
+]
+
+# Attestation required for users with active military affiliation
+MILITARY_ATTESTATION_ID = 'military-affiliation-confirmation-attestation'
+
 
 def _get_caller_compact_custom_attribute(event: dict) -> str:
     try:
@@ -109,30 +130,90 @@ def _determine_military_affiliation_status(provider_records: list[dict]) -> bool
     return latest_military_affiliation['status'] == MilitaryAffiliationStatus.ACTIVE.value
 
 
+def _validate_attestations(compact: str, attestations: list[dict], has_active_military_affiliation: bool = False):
+    """
+    Validate that all required attestations are present and are the latest version.
+
+    :param compact: The compact name
+    :param attestations: List of attestations from the request body
+    :param has_active_military_affiliation: Whether the user has an active military affiliation
+    :raises CCInvalidRequestException: If any attestation is not found, not the latest version,
+    or validation rules are not met
+    """
+    # Get all latest attestations for this compact
+    latest_attestations = config.compact_configuration_client.get_attestations_by_locale(compact=compact)
+
+    # TODO: We were asked not to enforce attestations until the frontend is updated # noqa: FIX002
+    #       to pass them in the request body. For now, we will simply check whatever
+    #       attestation is passed in to make sure it is the latest version. This conditional
+    #       should be removed once the frontend is updated to pass in all required attestations.
+    if os.environ.get('ENFORCE_ATTESTATIONS') == 'true':
+        # Build list of required attestations
+        required_ids = REQUIRED_ATTESTATION_IDS.copy()
+        if has_active_military_affiliation:
+            required_ids.append(MILITARY_ATTESTATION_ID)
+
+        # Validate investigation attestations - exactly one must be provided
+        investigation_attestations = [a for a in attestations if a['attestationId'] in INVESTIGATION_ATTESTATION_IDS]
+        if len(investigation_attestations) != 1:
+            raise CCInvalidRequestException(
+                'Exactly one investigation attestation must be provided '
+                f'(either {INVESTIGATION_ATTESTATION_IDS[0]} or {INVESTIGATION_ATTESTATION_IDS[1]})'
+            )
+        required_ids.append(investigation_attestations[0]['attestationId'])
+
+        # Check that all required attestations are present
+        provided_ids = {a['attestationId'] for a in attestations}
+        missing_ids = set(required_ids) - provided_ids
+        if missing_ids:
+            raise CCInvalidRequestException(f'Missing required attestations: {", ".join(missing_ids)}')
+
+        # Check for any invalid attestation IDs
+        invalid_ids = provided_ids - set(required_ids)
+        if invalid_ids:
+            raise CCInvalidRequestException(f'Invalid attestations provided: {", ".join(invalid_ids)}')
+
+    # Verify all provided attestations are the latest version
+    for attestation in attestations:
+        attestation_id = attestation['attestationId']
+        latest_attestation = latest_attestations.get(attestation_id)
+        if not latest_attestation:
+            raise CCInvalidRequestException(f'Attestation not found: "{attestation_id}"')
+        if latest_attestation['version'] != attestation['version']:
+            raise CCInvalidRequestException(
+                f'Attestation "{attestation_id}" version {attestation["version"]} '
+                f'is not the latest version ({latest_attestation["version"]})'
+            )
+
+
 @api_handler
 def post_purchase_privileges(event: dict, context: LambdaContext):  # noqa: ARG001 unused-argument
     """
     This endpoint allows a provider to purchase privileges.
 
-    The request body should include the selected jurisdiction privileges to purchase and billing information
-    in the following format:
+    The request body should include the selected jurisdiction privileges to purchase, billing information,
+    and attestations in the following format:
     {
         "selectedJurisdictions": ["<jurisdiction postal abbreviations>"],
         "orderInformation": {
-        "card": {
-            "number": "<card number>",
-            "expiration": "<expiration date>",
-            "cvv": "<cvv>"
+            "card": {
+                "number": "<card number>",
+                "expiration": "<expiration date>",
+                "cvv": "<cvv>"
+            },
+            "billing":  {
+                "firstName": "testFirstName",
+                "lastName": "testLastName",
+                "streetAddress": "123 Test St",
+                "streetAddress2": "", # optional
+                "state": "OH",
+                "zip": "12345",
+            }
         },
-        "billing":  {
-            "firstName": "testFirstName",
-            "lastName": "testLastName",
-            "streetAddress": "123 Test St",
-            "streetAddress2": "", # optional
-            "state": "OH",
-            "zip": "12345",
-        }
-      }
+        "attestations": [{
+            "attestationId": "jurisprudence-confirmation",
+            "version": "1"
+        }]
     }
 
     :param event: Standard API Gateway event, API schema documented in the CDK ApiStack
@@ -213,6 +294,9 @@ def post_purchase_privileges(event: dict, context: LambdaContext):  # noqa: ARG0
     license_expiration_date: date = license_record['dateOfExpiration']
     user_active_military = _determine_military_affiliation_status(user_provider_data['items'])
 
+    # Validate attestations are the latest versions before proceeding with the purchase
+    _validate_attestations(compact_name, body['attestations'], user_active_military)
+
     purchase_client = PurchaseClient()
     transaction_response = None
     try:
@@ -232,6 +316,7 @@ def post_purchase_privileges(event: dict, context: LambdaContext):  # noqa: ARG0
             license_expiration_date=license_expiration_date,
             compact_transaction_id=transaction_response['transactionId'],
             existing_privileges=existing_privileges,
+            attestations=body['attestations'],
         )
 
         return transaction_response
diff --git a/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt b/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
index eaf0b0e15..a9e6b089c 100644
--- a/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/purchases/requirements-dev.in
 #
-boto3==1.35.88
+boto3==1.35.92
     # via moto
-botocore==1.35.88
+botocore==1.35.92
     # via
     #   boto3
     #   moto
@@ -33,7 +33,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.25
+moto[dynamodb,s3]==5.0.26
     # via -r compact-connect/lambdas/python/purchases/requirements-dev.in
 py-partiql-parser==0.6.1
     # via moto
diff --git a/backend/compact-connect/lambdas/python/purchases/tests/function/test_handlers/test_purchase_privileges.py b/backend/compact-connect/lambdas/python/purchases/tests/function/test_handlers/test_purchase_privileges.py
index 225a698eb..845988093 100644
--- a/backend/compact-connect/lambdas/python/purchases/tests/function/test_handlers/test_purchase_privileges.py
+++ b/backend/compact-connect/lambdas/python/purchases/tests/function/test_handlers/test_purchase_privileges.py
@@ -1,4 +1,5 @@
 import json
+import os
 from datetime import UTC, date, datetime
 from unittest.mock import MagicMock, patch
 
@@ -13,11 +14,41 @@
 TEST_PROVIDER_ID = '89a6377e-c3a5-40e5-bca5-317ec854c570'
 
 MOCK_TRANSACTION_ID = '1234'
-
-
-def _generate_test_request_body(selected_jurisdictions: list[str] = None):
+ALL_ATTESTATION_IDS = [
+    'jurisprudence-confirmation',
+    'scope-of-practice-attestation',
+    'personal-information-home-state-attestation',
+    'personal-information-address-attestation',
+    'discipline-no-current-encumbrance-attestation',
+    'discipline-no-prior-encumbrance-attestation',
+    'provision-of-true-information-attestation',
+    'not-under-investigation-attestation',
+    'military-affiliation-confirmation-attestation',
+    'under-investigation-attestation',
+]
+
+
+def generate_default_attestation_list():
+    return [
+        {'attestationId': 'jurisprudence-confirmation', 'version': '1'},
+        {'attestationId': 'scope-of-practice-attestation', 'version': '1'},
+        {'attestationId': 'personal-information-home-state-attestation', 'version': '1'},
+        {'attestationId': 'personal-information-address-attestation', 'version': '1'},
+        {'attestationId': 'discipline-no-current-encumbrance-attestation', 'version': '1'},
+        {'attestationId': 'discipline-no-prior-encumbrance-attestation', 'version': '1'},
+        {'attestationId': 'provision-of-true-information-attestation', 'version': '1'},
+        {'attestationId': 'not-under-investigation-attestation', 'version': '1'},
+    ]
+
+
+def _generate_test_request_body(
+    selected_jurisdictions: list[str] = None,
+    attestations: list[dict] = None,
+):
     if not selected_jurisdictions:
         selected_jurisdictions = ['ky']
+    if attestations is None:
+        attestations = generate_default_attestation_list()
 
     return json.dumps(
         {
@@ -33,6 +64,7 @@ def _generate_test_request_body(selected_jurisdictions: list[str] = None):
                     'zip': '12345',
                 },
             },
+            'attestations': attestations,
         }
     )
 
@@ -44,6 +76,25 @@ class TestPostPurchasePrivileges(TstFunction):
     purchasing a privilege in kentucky.
     """
 
+    def setUp(self):
+        from cc_common.data_model.schema.attestation import AttestationRecordSchema
+
+        super().setUp()
+        # set the feature flag to enable the attestation validation feature
+        # this should be removed when the feature is enabled by default
+        os.environ.update({'ENFORCE_ATTESTATIONS': 'true'})
+        # Load test attestation data
+        with open('../common/tests/resources/dynamo/attestation.json') as f:
+            test_attestation = json.load(f)
+            # put in one attestation record for each attestation id
+            for attestation_id in ALL_ATTESTATION_IDS:
+                test_attestation['attestationId'] = attestation_id
+                test_attestation.pop('pk')
+                test_attestation.pop('sk')
+                serialized_data = AttestationRecordSchema().dump(test_attestation)
+
+                self.config.compact_configuration_table.put_item(Item=serialized_data)
+
     def _load_test_jurisdiction(self):
         with open('../common/tests/resources/dynamo/jurisdiction.json') as f:
             jurisdiction = json.load(f)
@@ -133,10 +184,14 @@ def _when_testing_military_affiliation_status(
         )
         event = self._when_testing_provider_user_event_with_custom_claims()
         self._load_military_affiliation_record_data(status=military_affiliation_status)
-        event['body'] = _generate_test_request_body()
+        attestations = generate_default_attestation_list()
+        # add the military affiliation attestation if active
+        if military_affiliation_status == 'active':
+            attestations.append({'attestationId': 'military-affiliation-confirmation-attestation', 'version': '1'})
+        event['body'] = _generate_test_request_body(attestations=attestations)
 
         resp = post_purchase_privileges(event, self.mock_context)
-        self.assertEqual(200, resp['statusCode'])
+        self.assertEqual(200, resp['statusCode'], resp['body'])
 
         purchase_client_call_kwargs = mock_purchase_client.process_charge_for_licensee_privileges.call_args.kwargs
         self.assertEqual(expected_military_parameter, purchase_client_call_kwargs['user_active_military'])
@@ -265,7 +320,7 @@ def test_purchase_privileges_invalid_if_existing_privilege_expiration_matches_li
         event['body'] = _generate_test_request_body()
 
         resp = post_purchase_privileges(event, self.mock_context)
-        self.assertEqual(200, resp['statusCode'])
+        self.assertEqual(200, resp['statusCode'], resp['body'])
 
         # now make the same call with the same jurisdiction
         resp = post_purchase_privileges(event, self.mock_context)
@@ -314,7 +369,7 @@ def test_purchase_privileges_allows_existing_privilege_purchase_if_license_expir
 
         # now make the same call with the same jurisdiction
         resp = post_purchase_privileges(event, self.mock_context)
-        self.assertEqual(200, resp['statusCode'])
+        self.assertEqual(200, resp['statusCode'], resp['body'])
         response_body = json.loads(resp['body'])
 
         self.assertEqual({'transactionId': MOCK_TRANSACTION_ID}, response_body)
@@ -377,7 +432,7 @@ def test_post_purchase_privileges_adds_privilege_record_if_transaction_successfu
         event['body'] = _generate_test_request_body()
 
         resp = post_purchase_privileges(event, self.mock_context)
-        self.assertEqual(200, resp['statusCode'])
+        self.assertEqual(200, resp['statusCode'], resp['body'])
 
         # check that the privilege record for ky was created
         provider_records = self.config.data_client.get_provider(compact=TEST_COMPACT, provider_id=TEST_PROVIDER_ID)
@@ -398,6 +453,7 @@ def test_post_purchase_privileges_adds_privilege_record_if_transaction_successfu
         self.assertEqual(TEST_PROVIDER_ID, str(privilege_record['providerId']))
         self.assertEqual('active', privilege_record['status'])
         self.assertEqual('privilege', privilege_record['type'])
+        self.assertEqual(len(generate_default_attestation_list()), len(privilege_record['attestations']))
         # make sure we are tracking the transaction id
         self.assertEqual(MOCK_TRANSACTION_ID, privilege_record['compactTransactionId'])
 
@@ -427,3 +483,141 @@ def test_post_purchase_privileges_voids_transaction_if_aws_error_occurs(
         mock_purchase_client.void_privilege_purchase_transaction.assert_called_once_with(
             compact_name=TEST_COMPACT, order_information={'transactionId': MOCK_TRANSACTION_ID}
         )
+
+    @patch('handlers.privileges.PurchaseClient')
+    def test_post_purchase_privileges_validates_attestation_version(self, mock_purchase_client_constructor):
+        """Test that the endpoint validates attestation versions."""
+        from handlers.privileges import post_purchase_privileges
+
+        self._when_purchase_client_successfully_processes_request(mock_purchase_client_constructor)
+
+        event = self._when_testing_provider_user_event_with_custom_claims()
+        attestations = generate_default_attestation_list()
+        # Use an old version number
+        attestations[0]['version'] = '0'
+        event['body'] = _generate_test_request_body(attestations=attestations)
+
+        resp = post_purchase_privileges(event, self.mock_context)
+        self.assertEqual(400, resp['statusCode'])
+        response_body = json.loads(resp['body'])
+
+        self.assertEqual(
+            {'message': f'Attestation "{attestations[0]['attestationId']}" version 0 is not the latest version (1)'},
+            response_body,
+        )
+        mock_purchase_client_constructor.assert_not_called()
+
+    @patch('handlers.privileges.PurchaseClient')
+    def test_post_purchase_privileges_validates_attestation_exists_in_list_of_required_attestations(
+        self, mock_purchase_client_constructor
+    ):
+        """Test that the endpoint validates attestation existence."""
+        from handlers.privileges import post_purchase_privileges
+
+        self._when_purchase_client_successfully_processes_request(mock_purchase_client_constructor)
+
+        event = self._when_testing_provider_user_event_with_custom_claims()
+        attestations = generate_default_attestation_list()
+        # Use an attestation that doesn't exist
+        attestations.append({'attestationId': 'nonexistent-attestation', 'version': '1'})
+        event['body'] = _generate_test_request_body(attestations=attestations)
+
+        resp = post_purchase_privileges(event, self.mock_context)
+        self.assertEqual(400, resp['statusCode'])
+        response_body = json.loads(resp['body'])
+
+        self.assertEqual(
+            {'message': 'Invalid attestations provided: nonexistent-attestation'},
+            response_body,
+        )
+
+    @patch('handlers.privileges.PurchaseClient')
+    @patch('cc_common.config._Config.current_standard_datetime', datetime.fromisoformat('2024-11-08T23:59:59+00:00'))
+    def test_post_purchase_privileges_stores_attestations_in_privilege_record(self, mock_purchase_client_constructor):
+        """Test that attestations are stored in the privilege record."""
+        from handlers.privileges import post_purchase_privileges
+
+        self._when_purchase_client_successfully_processes_request(mock_purchase_client_constructor)
+
+        event = self._when_testing_provider_user_event_with_custom_claims(license_expiration_date='2050-01-01')
+        event['body'] = _generate_test_request_body()
+
+        resp = post_purchase_privileges(event, self.mock_context)
+        self.assertEqual(200, resp['statusCode'], resp['body'])
+
+        # check that the privilege record for ky was created with attestations
+        provider_records = self.config.data_client.get_provider(compact=TEST_COMPACT, provider_id=TEST_PROVIDER_ID)
+        privilege_record = next(record for record in provider_records['items'] if record['type'] == 'privilege')
+
+        self.assertEqual(generate_default_attestation_list(), privilege_record['attestations'])
+
+    @patch('handlers.privileges.PurchaseClient')
+    def test_post_purchase_privileges_validates_investigation_attestations(self, mock_purchase_client_constructor):
+        """Test that exactly one investigation attestation must be provided."""
+        from handlers.privileges import post_purchase_privileges
+
+        self._when_purchase_client_successfully_processes_request(mock_purchase_client_constructor)
+
+        event = self._when_testing_provider_user_event_with_custom_claims()
+
+        # Test with no investigation attestation
+        mock_attestation_list_copy = generate_default_attestation_list()
+        mock_attestation_list_copy.remove({'attestationId': 'not-under-investigation-attestation', 'version': '1'})
+        event['body'] = _generate_test_request_body(attestations=mock_attestation_list_copy)
+        resp = post_purchase_privileges(event, self.mock_context)
+        self.assertEqual(400, resp['statusCode'])
+        self.assertIn('Exactly one investigation attestation must be provided', json.loads(resp['body'])['message'])
+
+        # Test with both investigation attestations
+        attestations = [
+            {'attestationId': 'not-under-investigation-attestation', 'version': '1'},
+            {'attestationId': 'under-investigation-attestation', 'version': '1'},
+        ]
+        event['body'] = _generate_test_request_body(attestations=attestations)
+        resp = post_purchase_privileges(event, self.mock_context)
+        self.assertEqual(400, resp['statusCode'])
+        self.assertIn('Exactly one investigation attestation must be provided', json.loads(resp['body'])['message'])
+
+    @patch('handlers.privileges.PurchaseClient')
+    def test_post_purchase_privileges_validates_military_attestation(self, mock_purchase_client_constructor):
+        """Test that military attestation is required when user has active military affiliation."""
+        from handlers.privileges import post_purchase_privileges
+
+        self._when_purchase_client_successfully_processes_request(mock_purchase_client_constructor)
+        self._load_military_affiliation_record_data(status='active')
+
+        event = self._when_testing_provider_user_event_with_custom_claims()
+        event['body'] = _generate_test_request_body()
+
+        resp = post_purchase_privileges(event, self.mock_context)
+        self.assertEqual(400, resp['statusCode'], resp['body'])
+        self.assertIn('military-affiliation-confirmation-attestation', json.loads(resp['body'])['message'])
+
+        # Add military attestation and verify it works
+        event_body = json.loads(event['body'])
+        event_body['attestations'].append(
+            {'attestationId': 'military-affiliation-confirmation-attestation', 'version': '1'}
+        )
+        event['body'] = json.dumps(event_body)
+
+        resp = post_purchase_privileges(event, self.mock_context)
+        self.assertEqual(200, resp['statusCode'], resp['body'])
+
+    # TODO - remove this test once the feature flag is removed # noqa: FIX002
+    @patch('handlers.privileges.PurchaseClient')
+    def test_post_purchase_privileges_should_not_validate_attestations_if_flag_not_set(
+        self, mock_purchase_client_constructor
+    ):
+        """Test that military attestation is required when user has active military affiliation."""
+        from handlers.privileges import post_purchase_privileges
+
+        os.environ.update({'ENFORCE_ATTESTATIONS': 'false'})
+
+        self._when_purchase_client_successfully_processes_request(mock_purchase_client_constructor)
+        self._load_military_affiliation_record_data(status='active')
+
+        event = self._when_testing_provider_user_event_with_custom_claims()
+        event['body'] = _generate_test_request_body(attestations=[])
+
+        resp = post_purchase_privileges(event, self.mock_context)
+        self.assertEqual(200, resp['statusCode'], resp['body'])
diff --git a/backend/compact-connect/lambdas/python/purchases/tests/function/test_handlers/test_transaction_history.py b/backend/compact-connect/lambdas/python/purchases/tests/function/test_handlers/test_transaction_history.py
index f36490a67..4160974b7 100644
--- a/backend/compact-connect/lambdas/python/purchases/tests/function/test_handlers/test_transaction_history.py
+++ b/backend/compact-connect/lambdas/python/purchases/tests/function/test_handlers/test_transaction_history.py
@@ -201,9 +201,7 @@ def test_process_settled_transactions_returns_in_progress_status_with_pagination
         """Test that method returns IN_PROGRESS status with pagination values when more transactions are available."""
         from handlers.transaction_history import process_settled_transactions
 
-        self._when_purchase_client_returns_paginated_transactions(
-            mock_purchase_client_constructor
-        )
+        self._when_purchase_client_returns_paginated_transactions(mock_purchase_client_constructor)
 
         event = self._when_testing_non_paginated_event()
         resp = process_settled_transactions(event, self.mock_context)
diff --git a/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt b/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt
index 59c66d880..d383e3f7e 100644
--- a/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.in
 #
-boto3==1.35.88
+boto3==1.35.92
     # via moto
-botocore==1.35.88
+botocore==1.35.92
     # via
     #   boto3
     #   moto
@@ -33,7 +33,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.0.25
+moto[dynamodb,s3]==5.0.26
     # via -r compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.in
 py-partiql-parser==0.6.1
     # via moto
diff --git a/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt b/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt
index 8bdda48cb..baa4f2bfb 100644
--- a/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt
@@ -4,9 +4,9 @@
 #
 #    pip-compile --no-emit-index-url compact-connect/lambdas/python/staff-users/requirements-dev.in
 #
-boto3==1.35.88
+boto3==1.35.92
     # via moto
-botocore==1.35.88
+botocore==1.35.92
     # via
     #   boto3
     #   moto
@@ -39,7 +39,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   werkzeug
-moto[cognitoidp,dynamodb,s3]==5.0.25
+moto[cognitoidp,dynamodb,s3]==5.0.26
     # via -r compact-connect/lambdas/python/staff-users/requirements-dev.in
 py-partiql-parser==0.6.1
     # via moto
diff --git a/backend/compact-connect/requirements-dev.txt b/backend/compact-connect/requirements-dev.txt
index 239bc25b4..ef9e6bc8a 100644
--- a/backend/compact-connect/requirements-dev.txt
+++ b/backend/compact-connect/requirements-dev.txt
@@ -64,9 +64,9 @@ pluggy==1.5.0
     # via pytest
 py-serializable==1.1.2
     # via cyclonedx-python-lib
-pygments==2.18.0
+pygments==2.19.0
     # via rich
-pyparsing==3.2.0
+pyparsing==3.2.1
     # via pip-requirements-parser
 pyproject-hooks==1.2.0
     # via
@@ -86,7 +86,7 @@ requests==2.32.3
     #   pip-audit
 rich==13.9.4
     # via pip-audit
-ruff==0.8.4
+ruff==0.8.6
     # via -r compact-connect/requirements-dev.in
 six==1.17.0
     # via
diff --git a/backend/compact-connect/requirements.txt b/backend/compact-connect/requirements.txt
index abaf6f803..bdc771299 100644
--- a/backend/compact-connect/requirements.txt
+++ b/backend/compact-connect/requirements.txt
@@ -8,17 +8,17 @@ attrs==24.3.0
     # via
     #   cattrs
     #   jsii
-aws-cdk-asset-awscli-v1==2.2.216
+aws-cdk-asset-awscli-v1==2.2.218
     # via aws-cdk-lib
 aws-cdk-asset-kubectl-v20==2.1.3
     # via aws-cdk-lib
 aws-cdk-asset-node-proxy-agent-v6==2.1.0
     # via aws-cdk-lib
-aws-cdk-aws-lambda-python-alpha==2.173.4a0
+aws-cdk-aws-lambda-python-alpha==2.174.0a0
     # via -r compact-connect/requirements.in
-aws-cdk-cloud-assembly-schema==38.0.1
+aws-cdk-cloud-assembly-schema==39.1.38
     # via aws-cdk-lib
-aws-cdk-lib==2.173.4
+aws-cdk-lib==2.174.0
     # via
     #   -r compact-connect/requirements.in
     #   aws-cdk-aws-lambda-python-alpha
@@ -33,7 +33,7 @@ constructs==10.4.2
     #   aws-cdk-aws-lambda-python-alpha
     #   aws-cdk-lib
     #   cdk-nag
-importlib-resources==6.4.5
+importlib-resources==6.5.2
     # via jsii
 jsii==1.106.0
     # via
diff --git a/backend/compact-connect/stacks/api_stack/v1_api/api.py b/backend/compact-connect/stacks/api_stack/v1_api/api.py
index ed79e857b..4f49740e0 100644
--- a/backend/compact-connect/stacks/api_stack/v1_api/api.py
+++ b/backend/compact-connect/stacks/api_stack/v1_api/api.py
@@ -4,6 +4,7 @@
 
 from stacks import persistent_stack as ps
 from stacks.api_stack import cc_api
+from stacks.api_stack.v1_api.attestations import Attestations
 from stacks.api_stack.v1_api.bulk_upload_url import BulkUploadUrl
 from stacks.api_stack.v1_api.provider_users import ProviderUsers
 from stacks.api_stack.v1_api.purchases import Purchases
@@ -73,6 +74,14 @@ def __init__(self, root: IResource, persistent_stack: ps.PersistentStack):
         # /v1/compacts/{compact}
         self.compact_resource = self.compacts_resource.add_resource('{compact}')
 
+        # /v1/compacts/{compact}/attestations
+        self.attestations_resource = self.compact_resource.add_resource('attestations')
+        self.attestations = Attestations(
+            resource=self.attestations_resource,
+            persistent_stack=persistent_stack,
+            api_model=self.api_model,
+        )
+
         # /v1/compacts/{compact}/credentials
         credentials_resource = self.compact_resource.add_resource('credentials')
         self.credentials = Credentials(
diff --git a/backend/compact-connect/stacks/api_stack/v1_api/api_model.py b/backend/compact-connect/stacks/api_stack/v1_api/api_model.py
index 5d37cdb47..0e52421a9 100644
--- a/backend/compact-connect/stacks/api_stack/v1_api/api_model.py
+++ b/backend/compact-connect/stacks/api_stack/v1_api/api_model.py
@@ -468,27 +468,7 @@ def patch_provider_user_military_affiliation_request_model(self) -> Model:
 
     @property
     def post_purchase_privileges_request_model(self) -> Model:
-        """Return the purchase privilege request model, which should only be created once per API
-        create a schema that defines the following object example:
-            {
-                "selectedJurisdictions": ["<jurisdiction postal abbreviations>"],
-                "orderInformation": {
-                "card": {
-                    "number": "<card number>",
-                    "expiration": "<expiration date>",
-                    "cvv": "<cvv>"
-                },
-                "billing":  {
-                    "firstName": "testFirstName",
-                    "lastName": "testLastName",
-                    "streetAddress": "123 Test St",
-                    "streetAddress2": "", # optional
-                    "state": "OH",
-                    "zip": "12345",
-                }
-              }
-            }
-        """
+        """Return the purchase privilege request model, which should only be created once per API"""
         if hasattr(self.api, '_v1_post_purchase_privileges_request_model'):
             return self.api._v1_post_purchase_privileges_request_model
         self.api._v1_post_purchase_privileges_request_model = self.api.add_model(
@@ -496,7 +476,7 @@ def post_purchase_privileges_request_model(self) -> Model:
             description='Post purchase privileges request model',
             schema=JsonSchema(
                 type=JsonSchemaType.OBJECT,
-                required=['selectedJurisdictions', 'orderInformation'],
+                required=['selectedJurisdictions', 'orderInformation', 'attestations'],
                 properties={
                     'selectedJurisdictions': JsonSchema(
                         type=JsonSchemaType.ARRAY,
@@ -582,6 +562,29 @@ def post_purchase_privileges_request_model(self) -> Model:
                             ),
                         },
                     ),
+                    'attestations': JsonSchema(
+                        type=JsonSchemaType.ARRAY,
+                        description='List of attestations that the user has agreed to',
+                        items=JsonSchema(
+                            type=JsonSchemaType.OBJECT,
+                            required=['attestationId', 'version'],
+                            properties={
+                                'attestationId': JsonSchema(
+                                    type=JsonSchemaType.STRING,
+                                    max_length=100,
+                                    description='The ID of the attestation',
+                                ),
+                                'version': JsonSchema(
+                                    # we store the version as a string, rather than an integer, to avoid
+                                    # type casting between DynamoDB's Decimal and Python's int
+                                    type=JsonSchemaType.STRING,
+                                    max_length=10,
+                                    description='The version of the attestation',
+                                    pattern=r'^\d+$',
+                                ),
+                            },
+                        ),
+                    ),
                 },
             ),
         )
@@ -983,3 +986,28 @@ def _pagination_response_schema(self):
                 'pageSize': JsonSchema(type=JsonSchemaType.INTEGER, minimum=5, maximum=100),
             },
         )
+
+    @property
+    def get_attestations_response_model(self) -> Model:
+        """Return the attestations response model, which should only be created once per API"""
+        if hasattr(self.api, '_v1_get_attestations_response_model'):
+            return self.api._v1_get_attestations_response_model
+
+        stack: AppStack = AppStack.of(self.api)
+        self.api._v1_get_attestations_response_model = self.api.add_model(
+            'V1GetAttestationsResponseModel',
+            description='Get attestations response model',
+            schema=JsonSchema(
+                type=JsonSchemaType.OBJECT,
+                properties={
+                    'type': JsonSchema(type=JsonSchemaType.STRING, enum=['attestation']),
+                    'attestationType': JsonSchema(type=JsonSchemaType.STRING),
+                    'compact': JsonSchema(type=JsonSchemaType.STRING, enum=stack.node.get_context('compacts')),
+                    'version': JsonSchema(type=JsonSchemaType.STRING),
+                    'dateCreated': JsonSchema(type=JsonSchemaType.STRING, format='date-time'),
+                    'text': JsonSchema(type=JsonSchemaType.STRING),
+                    'required': JsonSchema(type=JsonSchemaType.BOOLEAN),
+                },
+            ),
+        )
+        return self.api._v1_get_attestations_response_model
diff --git a/backend/compact-connect/stacks/api_stack/v1_api/attestations.py b/backend/compact-connect/stacks/api_stack/v1_api/attestations.py
new file mode 100644
index 000000000..358b5bd73
--- /dev/null
+++ b/backend/compact-connect/stacks/api_stack/v1_api/attestations.py
@@ -0,0 +1,86 @@
+from __future__ import annotations
+
+import os
+
+from aws_cdk import Duration
+from aws_cdk.aws_apigateway import LambdaIntegration, MethodResponse, Resource
+from cdk_nag import NagSuppressions
+from common_constructs.python_function import PythonFunction
+from common_constructs.stack import Stack
+
+from stacks import persistent_stack as ps
+
+# Importing module level to allow lazy loading for typing
+from stacks.api_stack import cc_api
+
+from .api_model import ApiModel
+
+
+class Attestations:
+    def __init__(
+        self,
+        *,
+        resource: Resource,
+        persistent_stack: ps.PersistentStack,
+        api_model: ApiModel,
+    ):
+        super().__init__()
+
+        self.resource = resource
+        self.api: cc_api.CCApi = resource.api
+        self.api_model = api_model
+
+        stack: Stack = Stack.of(resource)
+        lambda_environment = {
+            'COMPACT_CONFIGURATION_TABLE_NAME': persistent_stack.compact_configuration_table.table_name,
+            **stack.common_env_vars,
+        }
+
+        # Create the attestations lambda function that will be shared by all attestation related endpoints
+        self.attestations_function = PythonFunction(
+            self.api,
+            'AttestationsFunction',
+            index=os.path.join('handlers', 'attestations.py'),
+            lambda_dir='attestations',
+            handler='attestations',
+            environment=lambda_environment,
+            timeout=Duration.seconds(30),
+        )
+        persistent_stack.shared_encryption_key.grant_decrypt(self.attestations_function)
+        persistent_stack.compact_configuration_table.grant_read_write_data(self.attestations_function)
+        self.api.log_groups.append(self.attestations_function.log_group)
+
+        NagSuppressions.add_resource_suppressions_by_path(
+            stack,
+            path=f'{self.attestations_function.node.path}/ServiceRole/DefaultPolicy/Resource',
+            suppressions=[
+                {
+                    'id': 'AwsSolutions-IAM5',
+                    'reason': 'The actions in this policy are specifically what this lambda needs '
+                    'and is scoped to one table and encryption key.',
+                },
+            ],
+        )
+
+        # GET /v1/compacts/{compact}/attestations/{attestationId}
+        self.attestation_id_resource = self.resource.add_resource('{attestationId}')
+        self._add_get_attestation(
+            attestations_function=self.attestations_function,
+        )
+
+    def _add_get_attestation(
+        self,
+        attestations_function: PythonFunction,
+    ):
+        self.attestation_id_resource.add_method(
+            'GET',
+            LambdaIntegration(attestations_function),
+            method_responses=[
+                MethodResponse(
+                    status_code='200',
+                    response_models={'application/json': self.api_model.get_attestations_response_model},
+                ),
+            ],
+            request_parameters={'method.request.header.Authorization': True},
+            authorizer=self.api.provider_users_authorizer,
+        )
diff --git a/backend/compact-connect/stacks/transaction_monitoring_stack/transaction_history_processing_workflow.py b/backend/compact-connect/stacks/transaction_monitoring_stack/transaction_history_processing_workflow.py
index bc7e7fc1c..8828505c3 100644
--- a/backend/compact-connect/stacks/transaction_monitoring_stack/transaction_history_processing_workflow.py
+++ b/backend/compact-connect/stacks/transaction_monitoring_stack/transaction_history_processing_workflow.py
@@ -3,8 +3,8 @@
 import os
 
 from aws_cdk import ArnFormat, Duration
-from aws_cdk.aws_cloudwatch import Alarm, ComparisonOperator, TreatMissingData
-from aws_cdk.aws_cloudwatch_actions import SnsAction
+from aws_cdk.aws_cloudwatch import Alarm, ComparisonOperator, TreatMissingData  # noqa: F401 temporarily unused
+from aws_cdk.aws_cloudwatch_actions import SnsAction  # noqa: F401 temporarily unused
 from aws_cdk.aws_events import Rule, Schedule
 from aws_cdk.aws_events_targets import SfnStateMachine
 from aws_cdk.aws_iam import Effect, PolicyStatement
@@ -211,7 +211,11 @@ def __init__(
             alarm_description=f'{state_machine.node.path} failed to collect transactions',
             comparison_operator=ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
             treat_missing_data=TreatMissingData.NOT_BREACHING,
-        ).add_alarm_action(SnsAction(persistent_stack.alarm_topic))
+        )
+         # TODO: we have been asked to disable this until all compacts have valid authorize.net # noqa: FIX002
+         #  accounts put into place to avoid unnecessary alerting. Once the system is ready to
+         #  go live, this alarm action should be re-enabled.
+         # .add_alarm_action(SnsAction(persistent_stack.alarm_topic)))
 
     def _get_secrets_manager_compact_payment_processor_arn_for_compact(
         self, compact: str, environment_name: str
diff --git a/backend/compact-connect/tests/app/test_api/test_attestations_api.py b/backend/compact-connect/tests/app/test_api/test_attestations_api.py
new file mode 100644
index 000000000..5914f7b64
--- /dev/null
+++ b/backend/compact-connect/tests/app/test_api/test_attestations_api.py
@@ -0,0 +1,99 @@
+from aws_cdk.assertions import Capture, Template
+from aws_cdk.aws_apigateway import CfnMethod, CfnModel, CfnResource
+from aws_cdk.aws_lambda import CfnFunction
+
+from tests.app.test_api import TestApi
+
+
+class TestAttestationsApi(TestApi):
+    """
+    These tests are focused on checking that the API endpoints for the `/v1/compacts/{compact}/attestations` path
+    are configured correctly.
+
+    When adding or modifying API resources under /attestations/, a test should be added to ensure that the
+    resource is created as expected. The pattern for these tests includes the following checks:
+    1. The path and parent id of the API Gateway resource matches expected values.
+    2. If the resource has a lambda function associated with it, the function is present with the expected
+    module and function.
+    3. Check the methods associated with the resource, ensuring they are all present and have the correct handlers.
+    4. Ensure the request and response models for the endpoint are present and match the expected schemas.
+    """
+
+    def test_synth_generates_attestations_resource(self):
+        api_stack = self.app.sandbox_stage.api_stack
+        api_stack_template = Template.from_stack(api_stack)
+
+        # Ensure the resource is created with expected path
+        api_stack_template.has_resource_properties(
+            type=CfnResource.CFN_RESOURCE_TYPE_NAME,
+            props={
+                'ParentId': {
+                    # Verify the parent id matches the expected '{compact}' resource
+                    'Ref': api_stack.get_logical_id(api_stack.api.v1_api.compact_resource.node.default_child),
+                },
+                'PathPart': 'attestations',
+            },
+        )
+
+    def test_synth_generates_get_attestation_resource(self):
+        api_stack = self.app.sandbox_stage.api_stack
+        api_stack_template = Template.from_stack(api_stack)
+
+        # Ensure the resource is created with expected path
+        api_stack_template.has_resource_properties(
+            type=CfnResource.CFN_RESOURCE_TYPE_NAME,
+            props={
+                'ParentId': {
+                    # Verify the parent id matches the expected 'attestations' resource
+                    'Ref': api_stack.get_logical_id(api_stack.api.v1_api.attestations_resource.node.default_child),
+                },
+                'PathPart': '{attestationId}',
+            },
+        )
+
+        # Ensure the lambda is created with expected code path
+        attestation_handler = TestApi.get_resource_properties_by_logical_id(
+            api_stack.get_logical_id(api_stack.api.v1_api.attestations.attestations_function.node.default_child),
+            api_stack_template.find_resources(CfnFunction.CFN_RESOURCE_TYPE_NAME),
+        )
+
+        self.assertEqual(attestation_handler['Handler'], 'handlers.attestations.attestations')
+
+        # Ensure the GET method is configured with the lambda integration
+        method_model_logical_id_capture = Capture()
+
+        # ensure the GET method is configured with the lambda integration and authorizer
+        api_stack_template.has_resource_properties(
+            type=CfnMethod.CFN_RESOURCE_TYPE_NAME,
+            props={
+                'HttpMethod': 'GET',
+                # the provider users endpoints uses a separate authorizer from the staff endpoints
+                'AuthorizerId': {
+                    'Ref': api_stack.get_logical_id(api_stack.api.provider_users_authorizer.node.default_child),
+                },
+                # ensure the lambda integration is configured with the expected handler
+                'Integration': TestApi.generate_expected_integration_object(
+                    api_stack.get_logical_id(
+                        api_stack.api.v1_api.attestations.attestations_function.node.default_child,
+                    ),
+                ),
+                'MethodResponses': [
+                    {
+                        'ResponseModels': {'application/json': {'Ref': method_model_logical_id_capture}},
+                        'StatusCode': '200',
+                    },
+                ],
+            },
+        )
+
+        # now check the response model matches expected contract
+        get_attestation_response_model = TestApi.get_resource_properties_by_logical_id(
+            method_model_logical_id_capture.as_string(),
+            api_stack_template.find_resources(CfnModel.CFN_RESOURCE_TYPE_NAME),
+        )
+
+        self.compare_snapshot(
+            get_attestation_response_model['Schema'],
+            'GET_ATTESTATION_BY_ID_RESPONSE_SCHEMA',
+            overwrite_snapshot=False,
+        )
diff --git a/backend/compact-connect/tests/resources/snapshots/COMPACT_CONFIGURATION_UPLOADER_INPUT.json b/backend/compact-connect/tests/resources/snapshots/COMPACT_CONFIGURATION_UPLOADER_INPUT.json
index db70391ef..bf8be4c21 100644
--- a/backend/compact-connect/tests/resources/snapshots/COMPACT_CONFIGURATION_UPLOADER_INPUT.json
+++ b/backend/compact-connect/tests/resources/snapshots/COMPACT_CONFIGURATION_UPLOADER_INPUT.json
@@ -11,6 +11,88 @@
       "compactSummaryReportNotificationEmails": [],
       "activeEnvironments": [
         "test"
+      ],
+      "attestations": [
+        {
+          "attestationId": "jurisprudence-confirmation",
+          "displayName": "Jurisprudence Confirmation.",
+          "description": "For displaying the jurisprudence confirmation.",
+          "text": "I understand that an attestation is a legally binding statement. I understand that providing false information on this application could result in a loss of my licenses and/or privileges. I acknowledge that the Commission may audit jurisprudence attestations at their discretion.",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "scope-of-practice-attestation",
+          "displayName": "Scope of Practice Attestation",
+          "description": "For displaying the scope of practice attestation.",
+          "text": "I hereby attest and affirm that I have reviewed, understand, and will abide by this state's scope of practice and all applicable laws and rules when practicing in the state. I understand that the issuance of a Compact Privilege authorizes me to legally practice in the member jurisdiction in accordance with the laws and rules governing practice of my profession in that jurisdiction.\n\nIf I violate the practice act, the appropriate board may take action against my Compact Privilege, which may result in the revocation of other Compact Privileges I may hold. I will also be prohibited from obtaining any other Compact Privileges for a period of at least two (2) years.",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "personal-information-home-state-attestation",
+          "displayName": "Personal Information Home State Attestation",
+          "description": "For declaring that the applicant is a resident of the state they have listed as their home state.",
+          "text": "I hereby attest and affirm that this is my personal and licensure information and that I am a resident of the state listed on this page.*",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "personal-information-address-attestation",
+          "displayName": "Personal Information Address Attestation",
+          "description": "For declaring that the applicant is a resident of the state they have listed as their home state.",
+          "text": "I hereby attest and affirm that the address information I have provided herein and is my current address. I further consent to accept service of process at this address. I will notify the Commission of a change in my Home State address or email address via updating personal information records in this system. I understand that I am only eligible for a Compact Privilege if I am a licensee in my Home State as defined by the Compact. If I mislead the Compact Commission about my Home State, the appropriate board may take action against my Compact Privilege, which may result in the revocation of other Compact Privileges I may hold. I will also be prohibited from obtaining any other Compact Privileges for a period of at least two (2) years.*",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "not-under-investigation-attestation",
+          "displayName": "Not Under Investigation Attestation",
+          "description": "For declaring that the applicant is not currently under investigation.",
+          "text": "I hereby attest and affirm that I am not currently under investigation by any board, agency, department, association, certifying body, or other body.",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "under-investigation-attestation",
+          "displayName": "Under Investigation Attestation",
+          "description": "For declaring that the applicant is currently under investigation.",
+          "text": "I hereby attest and affirm that I am currently under investigation by any board, agency, department, association, certifying body, or other body. I understand that if any investigation results in a disciplinary action, my Compact Privileges may be revoked.",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "discipline-no-current-encumbrance-attestation",
+          "displayName": "No Current Discipline Encumbrance Attestation",
+          "description": "For declaring that the applicant has no encumbrances on any state license.",
+          "text": "I hereby attest and affirm that I have no encumbrance (any discipline that restricts my full practice or any unmet condition before returning to a full and unrestricted license, including, but not limited, to probation, supervision, completion of a program, and/or completion of CEs) on ANY state license.",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "discipline-no-prior-encumbrance-attestation",
+          "displayName": "No Discipline Encumbrance For Prior Two Yeats Attestation",
+          "description": "For declaring that the applicant has no encumbrances on any state license within the last two years.",
+          "text": "I hereby attest and affirm that I have not had any encumbrance on ANY state license within the previous two years from date of this application for a Compact Privilege.",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "provision-of-true-information-attestation",
+          "displayName": "Provision of True Information Attestation",
+          "description": "For declaring that the applicant has provided true information.",
+          "text": "I hereby attest and affirm that all information contained in this privilege application is true to the best of my knowledge.",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "military-affiliation-confirmation-attestation",
+          "displayName": "Military Affiliation Confirmation Attestation",
+          "description": "For declaring that the applicant's military affiliation documentation is accurate.",
+          "text": "I hereby attest and affirm that my current military status documentation as uploaded to CompactConnect is accurate.",
+          "required": true,
+          "locale": "en"
+        }
       ]
     },
     {
@@ -24,6 +106,88 @@
       "compactSummaryReportNotificationEmails": [],
       "activeEnvironments": [
         "test"
+      ],
+      "attestations": [
+        {
+          "attestationId": "jurisprudence-confirmation",
+          "displayName": "Jurisprudence Confirmation.",
+          "description": "For displaying the jurisprudence confirmation.",
+          "text": "I understand that an attestation is a legally binding statement. I understand that providing false information on this application could result in a loss of my licenses and/or privileges. I acknowledge that the Commission may audit jurisprudence attestations at their discretion.",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "scope-of-practice-attestation",
+          "displayName": "Scope of Practice Attestation",
+          "description": "For displaying the scope of practice attestation.",
+          "text": "I hereby attest and affirm that I have reviewed, understand, and will abide by this state's scope of practice and all applicable laws and rules when practicing in the state. I understand that the issuance of a Compact Privilege authorizes me to legally practice in the member jurisdiction in accordance with the laws and rules governing practice of my profession in that jurisdiction.\n\nIf I violate the practice act, the appropriate board may take action against my Compact Privilege, which may result in the revocation of other Compact Privileges I may hold. I will also be prohibited from obtaining any other Compact Privileges for a period of at least two (2) years.",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "personal-information-home-state-attestation",
+          "displayName": "Personal Information Home State Attestation",
+          "description": "For declaring that the applicant is a resident of the state they have listed as their home state.",
+          "text": "I hereby attest and affirm that this is my personal and licensure information and that I am a resident of the state listed on this page.*",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "personal-information-address-attestation",
+          "displayName": "Personal Information Address Attestation",
+          "description": "For declaring that the applicant is a resident of the state they have listed as their home state.",
+          "text": "I hereby attest and affirm that the address information I have provided herein and is my current address. I further consent to accept service of process at this address. I will notify the Commission of a change in my Home State address or email address via updating personal information records in this system. I understand that I am only eligible for a Compact Privilege if I am a licensee in my Home State as defined by the Compact. If I mislead the Compact Commission about my Home State, the appropriate board may take action against my Compact Privilege, which may result in the revocation of other Compact Privileges I may hold. I will also be prohibited from obtaining any other Compact Privileges for a period of at least two (2) years.*",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "not-under-investigation-attestation",
+          "displayName": "Not Under Investigation Attestation",
+          "description": "For declaring that the applicant is not currently under investigation.",
+          "text": "I hereby attest and affirm that I am not currently under investigation by any board, agency, department, association, certifying body, or other body.",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "under-investigation-attestation",
+          "displayName": "Under Investigation Attestation",
+          "description": "For declaring that the applicant is currently under investigation.",
+          "text": "I hereby attest and affirm that I am currently under investigation by any board, agency, department, association, certifying body, or other body. I understand that if any investigation results in a disciplinary action, my Compact Privileges may be revoked.",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "discipline-no-current-encumbrance-attestation",
+          "displayName": "No Current Discipline Encumbrance Attestation",
+          "description": "For declaring that the applicant has no encumbrances on any state license.",
+          "text": "I hereby attest and affirm that I have no encumbrance (any discipline that restricts my full practice or any unmet condition before returning to a full and unrestricted license, including, but not limited, to probation, supervision, completion of a program, and/or completion of CEs) on ANY state license.",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "discipline-no-prior-encumbrance-attestation",
+          "displayName": "No Discipline Encumbrance For Prior Two Yeats Attestation",
+          "description": "For declaring that the applicant has no encumbrances on any state license within the last two years.",
+          "text": "I hereby attest and affirm that I have not had any encumbrance on ANY state license within the previous two years from date of this application for a Compact Privilege.",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "provision-of-true-information-attestation",
+          "displayName": "Provision of True Information Attestation",
+          "description": "For declaring that the applicant has provided true information.",
+          "text": "I hereby attest and affirm that all information contained in this privilege application is true to the best of my knowledge.",
+          "required": true,
+          "locale": "en"
+        },
+        {
+          "attestationId": "military-affiliation-confirmation-attestation",
+          "displayName": "Military Affiliation Confirmation Attestation",
+          "description": "For declaring that the applicant's military affiliation documentation is accurate.",
+          "text": "I hereby attest and affirm that my current military status documentation as uploaded to CompactConnect is accurate.",
+          "required": true,
+          "locale": "en"
+        }
       ]
     }
   ],
diff --git a/backend/compact-connect/tests/resources/snapshots/GET_ATTESTATION_BY_ID_RESPONSE_SCHEMA.json b/backend/compact-connect/tests/resources/snapshots/GET_ATTESTATION_BY_ID_RESPONSE_SCHEMA.json
new file mode 100644
index 000000000..4f58dec9c
--- /dev/null
+++ b/backend/compact-connect/tests/resources/snapshots/GET_ATTESTATION_BY_ID_RESPONSE_SCHEMA.json
@@ -0,0 +1,36 @@
+{
+  "properties": {
+    "type": {
+      "enum": [
+        "attestation"
+      ],
+      "type": "string"
+    },
+    "attestationType": {
+      "type": "string"
+    },
+    "compact": {
+      "enum": [
+        "aslp",
+        "octp",
+        "coun"
+      ],
+      "type": "string"
+    },
+    "version": {
+      "type": "string"
+    },
+    "dateCreated": {
+      "format": "date-time",
+      "type": "string"
+    },
+    "text": {
+      "type": "string"
+    },
+    "required": {
+      "type": "boolean"
+    }
+  },
+  "type": "object",
+  "$schema": "http://json-schema.org/draft-04/schema#"
+}
diff --git a/backend/compact-connect/tests/resources/snapshots/PURCHASE_PRIVILEGE_REQUEST_SCHEMA.json b/backend/compact-connect/tests/resources/snapshots/PURCHASE_PRIVILEGE_REQUEST_SCHEMA.json
index f0f93a2c5..60fac81e8 100644
--- a/backend/compact-connect/tests/resources/snapshots/PURCHASE_PRIVILEGE_REQUEST_SCHEMA.json
+++ b/backend/compact-connect/tests/resources/snapshots/PURCHASE_PRIVILEGE_REQUEST_SCHEMA.json
@@ -146,12 +146,37 @@
         "billing"
       ],
       "type": "object"
+    },
+    "attestations": {
+      "description": "List of attestations that the user has agreed to",
+      "items": {
+        "properties": {
+          "attestationId": {
+            "description": "The ID of the attestation",
+            "maxLength": 100,
+            "type": "string"
+          },
+          "version": {
+            "description": "The version of the attestation",
+            "maxLength": 10,
+            "pattern": "^\\d+$",
+            "type": "string"
+          }
+        },
+        "required": [
+          "attestationId",
+          "version"
+        ],
+        "type": "object"
+      },
+      "type": "array"
     }
   },
   "required": [
     "selectedJurisdictions",
-    "orderInformation"
+    "orderInformation",
+    "attestations"
   ],
   "type": "object",
   "$schema": "http://json-schema.org/draft-04/schema#"
-}
\ No newline at end of file
+}
diff --git a/backend/compact-connect/tests/smoke/purchasing_privileges_smoke_tests.py b/backend/compact-connect/tests/smoke/purchasing_privileges_smoke_tests.py
index a67d0495e..f000909b7 100644
--- a/backend/compact-connect/tests/smoke/purchasing_privileges_smoke_tests.py
+++ b/backend/compact-connect/tests/smoke/purchasing_privileges_smoke_tests.py
@@ -1,10 +1,9 @@
-# ruff: noqa: T201  we use print statements for smoke testing
 #!/usr/bin/env python3
 import time
 from datetime import UTC, datetime
 
 import requests
-from config import config
+from config import config, logger
 from smoke_common import (
     SmokeTestFailureException,
     call_provider_users_me_endpoint,
@@ -18,9 +17,10 @@
 
 
 def test_purchasing_privilege():
-    # Step 1: Purchase a privilege through the POST '/v1/purchases/privileges' endpoint.
-    # Step 2: Verify a transaction id is returned in the response body.
-    # Step 3: Load records for provider and verify that the privilege is added to the provider's record.
+    # Step 1: Get latest versions of required attestations - GET '/v1/compact/{compact}/attestations/{attestationId}'.
+    # Step 2: Purchase a privilege through the POST '/v1/purchases/privileges' endpoint.
+    # Step 3: Verify a transaction id is returned in the response body.
+    # Step 4: Load records for provider and verify that the privilege is added to the provider's record.
 
     # first cleaning up user's existing privileges to start in a clean state
     original_provider_data = call_provider_users_me_endpoint()
@@ -35,7 +35,7 @@ def test_purchasing_privilege():
                 f'{compact}#PROVIDER#privilege/{privilege["jurisdiction"]}#'
                 f'{datetime.fromisoformat(privilege["dateOfRenewal"]).date().isoformat()}'
             )
-            print(f'Deleting privilege record:\n{privilege_pk}\n{privilege_sk}')
+            logger.info(f'Deleting privilege record:\n{privilege_pk}\n{privilege_sk}')
             dynamodb_table.delete_item(
                 Key={
                     'pk': privilege_pk,
@@ -45,6 +45,39 @@ def test_purchasing_privilege():
             # give dynamodb time to propagate
             time.sleep(1)
 
+    # Get the latest version of every attestation required for the privilege purchase
+    required_attestation_ids = [
+        'jurisprudence-confirmation',
+        'scope-of-practice-attestation',
+        'personal-information-home-state-attestation',
+        'personal-information-address-attestation',
+        'discipline-no-current-encumbrance-attestation',
+        'discipline-no-prior-encumbrance-attestation',
+        'provision-of-true-information-attestation',
+        'not-under-investigation-attestation',
+    ]
+    military_records = [
+        record for record in original_provider_data.get('militaryAffiliations', []) if record['status'] == 'active'
+    ]
+    if military_records:
+        required_attestation_ids.append('military-affiliation-confirmation-attestation')
+    compact = original_provider_data.get('compact')
+    attestations_from_system = []
+    for attestation_id in required_attestation_ids:
+        get_attestation_response = requests.get(
+            url=f'{config.api_base_url}/v1/compacts/{compact}/attestations/{attestation_id}',
+            headers=get_provider_user_auth_headers_cached(),
+            params={'locale': 'en'},
+            timeout=10,
+        )
+
+        if get_attestation_response.status_code != 200:
+            raise SmokeTestFailureException(f'Failed to get attestation. Response: {get_attestation_response.json()}')
+
+        attestation = get_attestation_response.json()
+        logger.info(f'Received attestation response for {attestation_id}: {attestation}')
+        attestations_from_system.append({'attestationId': attestation_id, 'version': attestation['version']})
+
     post_body = {
         'orderInformation': {
             'card': {
@@ -64,6 +97,7 @@ def test_purchasing_privilege():
             },
         },
         'selectedJurisdictions': ['ne'],
+        'attestations': attestations_from_system,
     }
 
     headers = get_provider_user_auth_headers_cached()
@@ -93,8 +127,28 @@ def test_purchasing_privilege():
         raise SmokeTestFailureException(f'No privilege record found for today ({today})')
     if matching_privilege['compactTransactionId'] != transaction_id:
         raise SmokeTestFailureException('Privilege record does not match transaction id')
+    if not matching_privilege.get('attestations'):
+        raise SmokeTestFailureException('No attestations found in privilege record')
+    for attestation in matching_privilege['attestations']:
+        matching_attestation_from_system = next(
+            (
+                attestation_from_system
+                for attestation_from_system in attestations_from_system
+                if attestation_from_system['attestationId'] == attestation['attestationId']
+            ),
+            None,
+        )
+        if not matching_attestation_from_system:
+            raise SmokeTestFailureException(f'No matching attestation found for {attestation["attestationId"]}')
+        if attestation['version'] != matching_attestation_from_system['version']:
+            raise SmokeTestFailureException('Attestation version in privilege record does not match')
+        if attestation['version'] != attestations_from_system[0]['version']:
+            raise SmokeTestFailureException(
+                f'Attestation {attestation['attestationId']} version in privilege record '
+                f'does not match latest version in system'
+            )
 
-    print(f'Successfully purchased privilege record: {matching_privilege}')
+    logger.info(f'Successfully purchased privilege record: {matching_privilege}')
 
 
 if __name__ == '__main__':
diff --git a/backend/multi-account/requirements.txt b/backend/multi-account/requirements.txt
index 6f5a59538..e14cecfc1 100644
--- a/backend/multi-account/requirements.txt
+++ b/backend/multi-account/requirements.txt
@@ -8,15 +8,15 @@ attrs==24.3.0
     # via
     #   cattrs
     #   jsii
-aws-cdk-asset-awscli-v1==2.2.216
+aws-cdk-asset-awscli-v1==2.2.218
     # via aws-cdk-lib
 aws-cdk-asset-kubectl-v20==2.1.3
     # via aws-cdk-lib
 aws-cdk-asset-node-proxy-agent-v6==2.1.0
     # via aws-cdk-lib
-aws-cdk-cloud-assembly-schema==38.0.1
+aws-cdk-cloud-assembly-schema==39.1.38
     # via aws-cdk-lib
-aws-cdk-lib==2.173.4
+aws-cdk-lib==2.174.0
     # via -r multi-account/requirements.in
 cattrs==24.1.2
     # via jsii
@@ -24,7 +24,7 @@ constructs==10.4.2
     # via
     #   -r multi-account/requirements.in
     #   aws-cdk-lib
-importlib-resources==6.4.5
+importlib-resources==6.5.2
     # via jsii
 jsii==1.106.0
     # via

From a7e4f5e1f7651c30e94fcf6d1d48d2b1bd728736 Mon Sep 17 00:00:00 2001
From: Justin Frahm <justin@inspiringapps.com>
Date: Fri, 17 Jan 2025 11:54:26 -0700
Subject: [PATCH 14/18] Feat/license event records (#434)

### Description List
- Added `licenseUpdate` and `privilegeUpdate` record types
- Added change detection and update record creation on license ingest
and privilege purchase processes
- Updated provider detail response to present change history in license
and privilege objects

Closes #
#186
---
 .gitignore                                    |    3 +
 .../bin/create_provider_user.py               |   70 +
 .../compact-connect/bin/generate_mock_data.py |    7 +-
 .../docs/api-specification/latest-oas30.json  | 3236 ++++++++++-------
 backend/compact-connect/docs/design/README.md |   56 +-
 .../docs/design/high-level-arch-diagram.pdf   |  Bin 0 -> 105252 bytes
 .../docs/design/license-events-diagram.pdf    |  Bin 0 -> 29163 bytes
 .../docs/design/license-ingest-diagram.pdf    |  Bin 34992 -> 29741 bytes
 .../docs/design/users-arch-diagram.pdf        |  Bin 49210 -> 47169 bytes
 .../email-notification-service/README.md      |    8 +-
 .../email-notification-service-lambda.ts      |    2 +-
 .../lambdas/nodejs/lib/email-service.ts       |   26 +-
 .../lambdas/python/common/cc_common/config.py |    5 +-
 .../data_model/{client.py => data_client.py}  |  267 +-
 .../cc_common/data_model/schema/__init__.py   |   10 +-
 .../data_model/schema/base_record.py          |   58 +-
 .../cc_common/data_model/schema/common.py     |   62 +-
 .../cc_common/data_model/schema/compact.py    |  102 -
 .../data_model/schema/compact/__init__.py     |   59 +
 .../data_model/schema/compact/api.py          |   15 +
 .../data_model/schema/compact/record.py       |   41 +
 .../cc_common/data_model/schema/fields.py     |   56 +
 .../data_model/schema/jurisdiction.py         |  156 -
 .../schema/jurisdiction/__init__.py           |   85 +
 .../data_model/schema/jurisdiction/api.py     |   37 +
 .../data_model/schema/jurisdiction/record.py  |   60 +
 .../cc_common/data_model/schema/license.py    |  153 -
 .../data_model/schema/license/__init__.py     |   53 +
 .../data_model/schema/license/api.py          |  147 +
 .../data_model/schema/license/ingest.py       |   61 +
 .../data_model/schema/license/record.py       |  129 +
 .../data_model/schema/military_affiliation.py |   87 -
 .../schema/military_affiliation/__init__.py   |   20 +
 .../schema/military_affiliation/api.py        |   43 +
 .../schema/military_affiliation/record.py     |   41 +
 .../cc_common/data_model/schema/privilege.py  |   71 -
 .../data_model/schema/privilege/__init__.py   |    0
 .../data_model/schema/privilege/api.py        |   79 +
 .../data_model/schema/privilege/record.py     |  115 +
 .../data_model/schema/provider/__init__.py    |    0
 .../data_model/schema/provider/api.py         |   68 +
 .../{provider.py => provider/record.py}       |   76 +-
 .../cc_common/data_model/schema/user.py       |    3 +-
 .../lambdas/python/common/cc_common/utils.py  |   12 +-
 .../lambdas/python/common/tests/__init__.py   |    2 +-
 .../python/common/tests/function/__init__.py  |  161 +-
 .../common/tests/function/test_data_client.py |  322 ++
 .../test_data_model/test_user_client.py       |    4 +-
 .../tests/resources/api/license-post.json     |    8 +-
 .../api/provider-detail-response.json         |   84 +-
 .../resources/api/provider-response.json      |    2 +-
 .../tests/resources/dynamo/compact.json       |    2 +-
 .../tests/resources/dynamo/jurisdiction.json  |    2 +-
 .../resources/dynamo/license-update.json      |   36 +
 .../tests/resources/dynamo/license.json       |   12 +-
 .../dynamo/military-affiliation.json          |    2 +-
 .../resources/dynamo/privilege-update.json    |   22 +
 .../tests/resources/dynamo/privilege.json     |   10 +-
 .../tests/resources/dynamo/provider.json      |    6 +-
 .../common/tests/resources/dynamo/user.json   |    2 +-
 .../tests/resources/ingest/message.json       |    8 +-
 .../unit/test_data_model/test_data_client.py  |   38 +-
 .../unit/test_data_model/test_paginated.py    |    6 +-
 .../test_schema/test_base_record.py           |    4 +-
 .../test_schema/test_license.py               |  107 +-
 .../test_schema/test_military_affiliation.py  |    4 +-
 .../test_schema/test_privilege.py             |    8 +-
 .../test_schema/test_provider.py              |    8 +-
 .../tests/unit/test_sanitize_provider_data.py |   41 +-
 .../handlers/compact_config_uploader.py       |    4 +-
 .../data-events/handlers/data_events.py       |    2 +-
 .../tests/function/test_handlers.py           |    6 +-
 .../provider-data-v1/handlers/__init__.py     |   25 +-
 .../provider-data-v1/handlers/bulk_upload.py  |    6 +-
 .../provider-data-v1/handlers/ingest.py       |   96 +-
 .../provider-data-v1/handlers/licenses.py     |    4 +-
 .../handlers/provider_users.py                |    4 +-
 .../provider-data-v1/handlers/providers.py    |    4 +-
 .../provider-data-v1/license_csv_reader.py    |    4 +-
 .../tests/function/__init__.py                |    6 +-
 .../function/test_data_model/test_client.py   |   22 +-
 .../test_provider_transformations.py          |   17 +-
 .../function/test_handlers/test_ingest.py     |  587 ++-
 .../test_handlers/test_provider_users.py      |    2 +
 .../function/test_handlers/test_providers.py  |   20 +-
 .../tests/function/test_license_csv_reader.py |    4 +-
 .../tests/unit/test_license_csv_reader.py     |    4 +-
 .../python/purchases/handlers/privileges.py   |   12 +-
 .../function/test_handlers/test_patch_user.py |    2 +-
 .../stacks/api_stack/v1_api/api_model.py      |   73 +-
 ...transaction_history_processing_workflow.py |   19 +-
 backend/compact-connect/tests/app/base.py     |    1 +
 .../PROVIDER_USER_RESPONSE_SCHEMA.json        | 1228 +++++--
 93 files changed, 5934 insertions(+), 2698 deletions(-)
 create mode 100755 backend/compact-connect/bin/create_provider_user.py
 create mode 100644 backend/compact-connect/docs/design/high-level-arch-diagram.pdf
 create mode 100644 backend/compact-connect/docs/design/license-events-diagram.pdf
 rename backend/compact-connect/lambdas/python/common/cc_common/data_model/{client.py => data_client.py} (57%)
 delete mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact/__init__.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact/api.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact/record.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/fields.py
 delete mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction/__init__.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction/api.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction/record.py
 delete mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/__init__.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/api.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/ingest.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/record.py
 delete mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation/__init__.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation/api.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation/record.py
 delete mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege/__init__.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege/api.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege/record.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider/__init__.py
 create mode 100644 backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider/api.py
 rename backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/{provider.py => provider/record.py} (52%)
 create mode 100644 backend/compact-connect/lambdas/python/common/tests/function/test_data_client.py
 create mode 100644 backend/compact-connect/lambdas/python/common/tests/resources/dynamo/license-update.json
 create mode 100644 backend/compact-connect/lambdas/python/common/tests/resources/dynamo/privilege-update.json

diff --git a/.gitignore b/.gitignore
index c9cd3fba4..970004fc9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,9 @@
 # Idea
 .idea
 
+# VS Code
+.vscode
+
 #OS
 .DS_Store
 .tmp
diff --git a/backend/compact-connect/bin/create_provider_user.py b/backend/compact-connect/bin/create_provider_user.py
new file mode 100755
index 000000000..f0263ea5a
--- /dev/null
+++ b/backend/compact-connect/bin/create_provider_user.py
@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+"""Provider user generation helper script. Run from `backend/compact-connect`.
+
+Note: This script requires the boto3 library and the environment variable:
+# The provider user pool id
+USER_POOL_ID=us-east-1_7zzexample
+
+The CLI must also be configured with AWS credentials that have appropriate access to Cognito
+"""
+
+import json
+import os
+import sys
+
+import boto3
+from botocore.exceptions import ClientError
+
+with open('cdk.json') as context_file:
+    _context = json.load(context_file)['context']
+
+COMPACTS = _context['compacts']
+USER_POOL_ID = os.environ['USER_POOL_ID']
+
+
+cognito_client = boto3.client('cognito-idp')
+
+
+def create_cognito_user(*, email: str, compact: str, provider_id: str):
+    sys.stdout.write(f"Creating new provider user, '{email}', in {compact}")
+
+    def get_sub_from_attributes(user_attributes: list):
+        for attribute in user_attributes:
+            if attribute['Name'] == 'sub':
+                return attribute['Value']
+        raise ValueError('Failed to find user sub!')
+
+    try:
+        user_data = cognito_client.admin_create_user(
+            UserPoolId=USER_POOL_ID,
+            Username=email,
+            UserAttributes=[
+                {'Name': 'email', 'Value': email},
+                {'Name': 'custom:compact', 'Value': compact},
+                {'Name': 'custom:providerId', 'Value': provider_id},
+            ],
+            DesiredDeliveryMediums=['EMAIL'],
+        )
+        return get_sub_from_attributes(user_data['User']['Attributes'])
+
+    except ClientError as e:
+        if e.response['Error']['Code'] == 'UsernameExistsException':
+            user_data = cognito_client.admin_get_user(UserPoolId=USER_POOL_ID, Username=email)
+            return get_sub_from_attributes(user_data['UserAttributes'])
+        raise
+
+
+if __name__ == '__main__':
+    from argparse import ArgumentParser
+
+    parser = ArgumentParser(
+        description='Create a provider user',
+        epilog='example: bin/create_provider_user.py -e justin@example.org -c octp -p ac5f9901-e4e6-4a2e-8982-27d2517a3ab8',  # noqa: E501 line-too-long
+    )
+    parser.add_argument('-e', '--email', help="The new user's email address", required=True)
+    parser.add_argument('-c', '--compact', help="The new user's compact", required=True, choices=COMPACTS)
+    parser.add_argument('-p', '--provider-id', help="The new user's associated provider id", required=True)
+
+    args = parser.parse_args()
+
+    create_cognito_user(email=args.email, compact=args.compact, provider_id=args.provider_id)
diff --git a/backend/compact-connect/bin/generate_mock_data.py b/backend/compact-connect/bin/generate_mock_data.py
index dd8f0e76c..f7c19a351 100755
--- a/backend/compact-connect/bin/generate_mock_data.py
+++ b/backend/compact-connect/bin/generate_mock_data.py
@@ -23,16 +23,17 @@
 COMPACTS = _context['compacts']
 LICENSE_TYPES = _context['license_types']
 
+
 os.environ['COMPACTS'] = json.dumps(COMPACTS)
 os.environ['JURISDICTIONS'] = json.dumps(JURISDICTIONS)
 
-from cc_common.data_model.schema.license import LicensePostSchema  # noqa: E402
+from cc_common.data_model.schema.license.api import LicensePostRequestSchema  # noqa: E402
 
 # We'll grab three different localizations to provide a variety of names/characters
 name_faker = Faker(['en_US', 'ja_JP', 'es_MX'])
 faker = Faker(['en_US'])
 
-schema = LicensePostSchema()
+schema = LicensePostRequestSchema()
 
 FIELDS = (
     'ssn',
@@ -59,7 +60,7 @@
 
 
 def generate_mock_csv_file(count, *, compact: str, jurisdiction: str = None):
-    with open('mock-data.csv', 'w', encoding='utf-8') as data_file:
+    with open(f'{compact}-{jurisdiction}-mock-data.csv', 'w', encoding='utf-8') as data_file:
         writer = DictWriter(data_file, fieldnames=FIELDS)
         writer.writeheader()
         for row in generate_csv_rows(count, compact=compact, jurisdiction=jurisdiction):
diff --git a/backend/compact-connect/docs/api-specification/latest-oas30.json b/backend/compact-connect/docs/api-specification/latest-oas30.json
index 108c97e9a..c49f99f74 100644
--- a/backend/compact-connect/docs/api-specification/latest-oas30.json
+++ b/backend/compact-connect/docs/api-specification/latest-oas30.json
@@ -2,7 +2,7 @@
   "openapi": "3.0.1",
   "info": {
     "title": "LicenseApi",
-    "version": "2025-01-03T17:38:01Z"
+    "version": "2025-01-15T17:49:42Z"
   },
   "servers": [
     {
@@ -145,7 +145,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicenxwmHa2Q438IJ"
+                  "$ref": "#/components/schemas/SandboLicenJwkX1M19iehD"
                 }
               }
             }
@@ -262,7 +262,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/SandboLicenM3v1DQsiYo0I"
+                "$ref": "#/components/schemas/SandboLicenQmuWrxvHrNne"
               }
             }
           },
@@ -274,7 +274,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicennsxzW9stMafI"
+                  "$ref": "#/components/schemas/SandboLicenCKI8MYY04rNP"
                 }
               }
             }
@@ -440,7 +440,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/SandboLicenOBKe66xJrnUY"
+                "$ref": "#/components/schemas/SandboLicensqVdeqIDiTUV"
               }
             }
           },
@@ -452,7 +452,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicenZpJMDau4cDdN"
+                  "$ref": "#/components/schemas/SandboLicenBHELNobWpOAZ"
                 }
               }
             }
@@ -546,7 +546,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicenC0IHjjHMelH4"
+                  "$ref": "#/components/schemas/SandboLicenkelmvshNMdxq"
                 }
               }
             }
@@ -667,7 +667,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/SandboLicenZtKJxTXXg5UL"
+                "$ref": "#/components/schemas/SandboLicenkzXEuzbeBMcD"
               }
             }
           },
@@ -679,7 +679,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicenWHrz3Lh8eYZP"
+                  "$ref": "#/components/schemas/SandboLicenk4wMidJp4tSI"
                 }
               }
             }
@@ -765,7 +765,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicenDdBuFYJj4W5C"
+                  "$ref": "#/components/schemas/SandboLicenPWICF4WAig5B"
                 }
               }
             }
@@ -850,7 +850,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicenAYFFIt5ce2HI"
+                  "$ref": "#/components/schemas/SandboLicennisEwvBxWQhC"
                 }
               }
             }
@@ -881,7 +881,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/SandboLicenzMeGyfqdYCbr"
+                "$ref": "#/components/schemas/SandboLicenDIQiicBLz4mm"
               }
             }
           },
@@ -900,7 +900,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicenUL01PEWATEUT"
+                  "$ref": "#/components/schemas/SandboLicenq0WHjwuOL0r5"
                 }
               }
             }
@@ -985,7 +985,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicenUL01PEWATEUT"
+                  "$ref": "#/components/schemas/SandboLicenq0WHjwuOL0r5"
                 }
               }
             }
@@ -1067,7 +1067,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/SandboLiceneEbMkNNP0wku"
+                "$ref": "#/components/schemas/SandboLicenNYOXdr8q1V6F"
               }
             }
           },
@@ -1086,7 +1086,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicenUL01PEWATEUT"
+                  "$ref": "#/components/schemas/SandboLicenq0WHjwuOL0r5"
                 }
               }
             }
@@ -1148,7 +1148,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicenDdBuFYJj4W5C"
+                  "$ref": "#/components/schemas/SandboLicenPWICF4WAig5B"
                 }
               }
             }
@@ -1202,7 +1202,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/SandboLicencgqVAvZnWkMG"
+                "$ref": "#/components/schemas/SandboLicenVl4LxvKwNI3S"
               }
             }
           },
@@ -1214,7 +1214,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicenKugXONwl77RZ"
+                  "$ref": "#/components/schemas/SandboLicenXS5uvP2iI0Bd"
                 }
               }
             }
@@ -1266,7 +1266,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/SandboLicenvclXpdeW3Y28"
+                "$ref": "#/components/schemas/SandboLicen3bd9q60ck5Mk"
               }
             }
           },
@@ -1278,7 +1278,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicenYgKyaZjnxxpR"
+                  "$ref": "#/components/schemas/SandboLicenyYKFQAIjlFCn"
                 }
               }
             }
@@ -1334,7 +1334,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/SandboLicenGA3a6Jf5sr6W"
+                "$ref": "#/components/schemas/SandboLicendmj7qfw2x1tR"
               }
             }
           },
@@ -1346,7 +1346,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicen2gYLvhizuSaW"
+                  "$ref": "#/components/schemas/SandboLicenTrpoUes4Xu35"
                 }
               }
             }
@@ -1402,7 +1402,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicenIlcgezTgAmMg"
+                  "$ref": "#/components/schemas/SandboLicenicEElMwlVowu"
                 }
               }
             }
@@ -1482,7 +1482,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicenUL01PEWATEUT"
+                  "$ref": "#/components/schemas/SandboLicenq0WHjwuOL0r5"
                 }
               }
             }
@@ -1526,7 +1526,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/SandboLicenj65itQcZP12q"
+                "$ref": "#/components/schemas/SandboLicencwCJNumn5Our"
               }
             }
           },
@@ -1545,7 +1545,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboLicenUL01PEWATEUT"
+                  "$ref": "#/components/schemas/SandboLicenq0WHjwuOL0r5"
                 }
               }
             }
@@ -1563,7 +1563,188 @@
   },
   "components": {
     "schemas": {
-      "SandboLicenWHrz3Lh8eYZP": {
+      "SandboLicenBHELNobWpOAZ": {
+        "required": [
+          "message"
+        ],
+        "type": "object",
+        "properties": {
+          "message": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "SandboLicenkzXEuzbeBMcD": {
+        "required": [
+          "query"
+        ],
+        "type": "object",
+        "properties": {
+          "pagination": {
+            "type": "object",
+            "properties": {
+              "lastKey": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "type": "string"
+              },
+              "pageSize": {
+                "maximum": 100,
+                "minimum": 5,
+                "type": "integer"
+              }
+            },
+            "additionalProperties": false
+          },
+          "query": {
+            "type": "object",
+            "properties": {
+              "providerId": {
+                "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
+                "type": "string",
+                "description": "Internal UUID for the provider"
+              },
+              "jurisdiction": {
+                "type": "string",
+                "description": "Filter for providers with privilege/license in a jurisdiction",
+                "enum": [
+                  "al",
+                  "ak",
+                  "az",
+                  "ar",
+                  "ca",
+                  "co",
+                  "ct",
+                  "de",
+                  "dc",
+                  "fl",
+                  "ga",
+                  "hi",
+                  "id",
+                  "il",
+                  "in",
+                  "ia",
+                  "ks",
+                  "ky",
+                  "la",
+                  "me",
+                  "md",
+                  "ma",
+                  "mi",
+                  "mn",
+                  "ms",
+                  "mo",
+                  "mt",
+                  "ne",
+                  "nv",
+                  "nh",
+                  "nj",
+                  "nm",
+                  "ny",
+                  "nc",
+                  "nd",
+                  "oh",
+                  "ok",
+                  "or",
+                  "pa",
+                  "pr",
+                  "ri",
+                  "sc",
+                  "sd",
+                  "tn",
+                  "tx",
+                  "ut",
+                  "vt",
+                  "va",
+                  "vi",
+                  "wa",
+                  "wv",
+                  "wi",
+                  "wy"
+                ]
+              },
+              "ssn": {
+                "pattern": "^[0-9]{3}-[0-9]{2}-[0-9]{4}$",
+                "type": "string",
+                "description": "Social security number to look up"
+              }
+            },
+            "description": "The query parameters"
+          },
+          "sorting": {
+            "required": [
+              "key"
+            ],
+            "type": "object",
+            "properties": {
+              "key": {
+                "type": "string",
+                "description": "The key to sort results by",
+                "enum": [
+                  "dateOfUpdate",
+                  "familyName"
+                ]
+              },
+              "direction": {
+                "type": "string",
+                "description": "Direction to sort results by",
+                "enum": [
+                  "ascending",
+                  "descending"
+                ]
+              }
+            },
+            "description": "How to sort results"
+          }
+        },
+        "additionalProperties": false
+      },
+      "SandboLicenVl4LxvKwNI3S": {
+        "required": [
+          "affiliationType",
+          "fileNames"
+        ],
+        "type": "object",
+        "properties": {
+          "affiliationType": {
+            "type": "string",
+            "description": "The type of military affiliation",
+            "enum": [
+              "militaryMember",
+              "militaryMemberSpouse"
+            ]
+          },
+          "fileNames": {
+            "type": "array",
+            "description": "List of military affiliation file names",
+            "items": {
+              "maxLength": 150,
+              "type": "string",
+              "description": "The name of the file being uploaded"
+            }
+          }
+        },
+        "additionalProperties": false
+      },
+      "SandboLicenkelmvshNMdxq": {
+        "required": [
+          "fields"
+        ],
+        "type": "object",
+        "properties": {
+          "fields": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
+          },
+          "url": {
+            "type": "string"
+          }
+        }
+      },
+      "SandboLicenk4wMidJp4tSI": {
         "required": [
           "pagination"
         ],
@@ -1874,29 +2055,40 @@
           }
         }
       },
-      "SandboLiceneEbMkNNP0wku": {
+      "SandboLicennisEwvBxWQhC": {
         "type": "object",
         "properties": {
-          "permissions": {
+          "pagination": {
             "type": "object",
-            "additionalProperties": {
+            "properties": {
+              "prevLastKey": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "type": "object"
+              },
+              "lastKey": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "type": "object"
+              },
+              "pageSize": {
+                "maximum": 100,
+                "minimum": 5,
+                "type": "integer"
+              }
+            }
+          },
+          "users": {
+            "type": "array",
+            "items": {
+              "required": [
+                "attributes",
+                "permissions",
+                "userId"
+              ],
               "type": "object",
               "properties": {
-                "actions": {
-                  "type": "object",
-                  "properties": {
-                    "readPrivate": {
-                      "type": "boolean"
-                    },
-                    "read": {
-                      "type": "boolean"
-                    },
-                    "admin": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "jurisdictions": {
+                "permissions": {
                   "type": "object",
                   "additionalProperties": {
                     "type": "object",
@@ -1907,270 +2099,39 @@
                           "readPrivate": {
                             "type": "boolean"
                           },
-                          "admin": {
+                          "read": {
                             "type": "boolean"
                           },
-                          "write": {
+                          "admin": {
                             "type": "boolean"
                           }
-                        },
-                        "additionalProperties": false
+                        }
+                      },
+                      "jurisdictions": {
+                        "type": "object",
+                        "additionalProperties": {
+                          "type": "object",
+                          "properties": {
+                            "actions": {
+                              "type": "object",
+                              "properties": {
+                                "readPrivate": {
+                                  "type": "boolean"
+                                },
+                                "admin": {
+                                  "type": "boolean"
+                                },
+                                "write": {
+                                  "type": "boolean"
+                                }
+                              },
+                              "additionalProperties": false
+                            }
+                          }
+                        }
                       }
-                    }
-                  }
-                }
-              },
-              "additionalProperties": false
-            }
-          }
-        },
-        "additionalProperties": false
-      },
-      "SandboLicennsxzW9stMafI": {
-        "required": [
-          "message"
-        ],
-        "type": "object",
-        "properties": {
-          "message": {
-            "type": "string",
-            "description": "A message about the request"
-          }
-        }
-      },
-      "SandboLicenC0IHjjHMelH4": {
-        "required": [
-          "fields"
-        ],
-        "type": "object",
-        "properties": {
-          "fields": {
-            "type": "object",
-            "additionalProperties": {
-              "type": "string"
-            }
-          },
-          "url": {
-            "type": "string"
-          }
-        }
-      },
-      "SandboLicenOBKe66xJrnUY": {
-        "maxLength": 100,
-        "type": "array",
-        "items": {
-          "required": [
-            "dateOfBirth",
-            "dateOfExpiration",
-            "dateOfIssuance",
-            "dateOfRenewal",
-            "familyName",
-            "givenName",
-            "homeAddressCity",
-            "homeAddressPostalCode",
-            "homeAddressState",
-            "homeAddressStreet1",
-            "licenseType",
-            "ssn",
-            "status"
-          ],
-          "type": "object",
-          "properties": {
-            "homeAddressStreet2": {
-              "maxLength": 100,
-              "minLength": 1,
-              "type": "string"
-            },
-            "npi": {
-              "pattern": "^[0-9]{10}$",
-              "type": "string"
-            },
-            "homeAddressPostalCode": {
-              "maxLength": 7,
-              "minLength": 5,
-              "type": "string"
-            },
-            "givenName": {
-              "maxLength": 100,
-              "minLength": 1,
-              "type": "string"
-            },
-            "homeAddressStreet1": {
-              "maxLength": 100,
-              "minLength": 2,
-              "type": "string"
-            },
-            "militaryWaiver": {
-              "type": "boolean"
-            },
-            "dateOfBirth": {
-              "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-              "type": "string",
-              "format": "date"
-            },
-            "dateOfIssuance": {
-              "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-              "type": "string",
-              "format": "date"
-            },
-            "ssn": {
-              "pattern": "^[0-9]{3}-[0-9]{2}-[0-9]{4}$",
-              "type": "string"
-            },
-            "licenseType": {
-              "type": "string",
-              "enum": [
-                "audiologist",
-                "speech-language pathologist",
-                "speech and language pathologist",
-                "occupational therapist",
-                "occupational therapy assistant",
-                "licensed professional counselor",
-                "licensed mental health counselor",
-                "licensed clinical mental health counselor",
-                "licensed professional clinical counselor"
-              ]
-            },
-            "dateOfExpiration": {
-              "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-              "type": "string",
-              "format": "date"
-            },
-            "homeAddressState": {
-              "maxLength": 100,
-              "minLength": 2,
-              "type": "string"
-            },
-            "dateOfRenewal": {
-              "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-              "type": "string",
-              "format": "date"
-            },
-            "familyName": {
-              "maxLength": 100,
-              "minLength": 1,
-              "type": "string"
-            },
-            "homeAddressCity": {
-              "maxLength": 100,
-              "minLength": 2,
-              "type": "string"
-            },
-            "middleName": {
-              "maxLength": 100,
-              "minLength": 1,
-              "type": "string"
-            },
-            "status": {
-              "type": "string",
-              "enum": [
-                "active",
-                "inactive"
-              ]
-            }
-          },
-          "additionalProperties": false
-        }
-      },
-      "SandboLicenj65itQcZP12q": {
-        "type": "object",
-        "properties": {
-          "attributes": {
-            "type": "object",
-            "properties": {
-              "givenName": {
-                "maxLength": 100,
-                "minLength": 1,
-                "type": "string"
-              },
-              "familyName": {
-                "maxLength": 100,
-                "minLength": 1,
-                "type": "string"
-              }
-            },
-            "additionalProperties": false
-          }
-        },
-        "additionalProperties": false
-      },
-      "SandboLicenAYFFIt5ce2HI": {
-        "type": "object",
-        "properties": {
-          "pagination": {
-            "type": "object",
-            "properties": {
-              "prevLastKey": {
-                "maxLength": 1024,
-                "minLength": 1,
-                "type": "object"
-              },
-              "lastKey": {
-                "maxLength": 1024,
-                "minLength": 1,
-                "type": "object"
-              },
-              "pageSize": {
-                "maximum": 100,
-                "minimum": 5,
-                "type": "integer"
-              }
-            }
-          },
-          "users": {
-            "type": "array",
-            "items": {
-              "required": [
-                "attributes",
-                "permissions",
-                "userId"
-              ],
-              "type": "object",
-              "properties": {
-                "permissions": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "type": "object",
-                    "properties": {
-                      "actions": {
-                        "type": "object",
-                        "properties": {
-                          "readPrivate": {
-                            "type": "boolean"
-                          },
-                          "read": {
-                            "type": "boolean"
-                          },
-                          "admin": {
-                            "type": "boolean"
-                          }
-                        }
-                      },
-                      "jurisdictions": {
-                        "type": "object",
-                        "additionalProperties": {
-                          "type": "object",
-                          "properties": {
-                            "actions": {
-                              "type": "object",
-                              "properties": {
-                                "readPrivate": {
-                                  "type": "boolean"
-                                },
-                                "admin": {
-                                  "type": "boolean"
-                                },
-                                "write": {
-                                  "type": "boolean"
-                                }
-                              },
-                              "additionalProperties": false
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "additionalProperties": false
+                    },
+                    "additionalProperties": false
                   }
                 },
                 "attributes": {
@@ -2209,16 +2170,210 @@
         },
         "additionalProperties": false
       },
-      "SandboLicenzMeGyfqdYCbr": {
+      "SandboLicendmj7qfw2x1tR": {
         "required": [
-          "attributes",
-          "permissions"
+          "attestations",
+          "orderInformation",
+          "selectedJurisdictions"
         ],
         "type": "object",
         "properties": {
-          "permissions": {
-            "type": "object",
-            "additionalProperties": {
+          "attestations": {
+            "type": "array",
+            "description": "List of attestations that the user has agreed to",
+            "items": {
+              "required": [
+                "attestationId",
+                "version"
+              ],
+              "type": "object",
+              "properties": {
+                "attestationId": {
+                  "maxLength": 100,
+                  "type": "string",
+                  "description": "The ID of the attestation"
+                },
+                "version": {
+                  "maxLength": 10,
+                  "pattern": "^\\d+$",
+                  "type": "string",
+                  "description": "The version of the attestation"
+                }
+              }
+            }
+          },
+          "orderInformation": {
+            "required": [
+              "billing",
+              "card"
+            ],
+            "type": "object",
+            "properties": {
+              "card": {
+                "required": [
+                  "cvv",
+                  "expiration",
+                  "number"
+                ],
+                "type": "object",
+                "properties": {
+                  "number": {
+                    "maxLength": 19,
+                    "minLength": 13,
+                    "type": "string",
+                    "description": "The card number"
+                  },
+                  "cvv": {
+                    "maxLength": 4,
+                    "minLength": 3,
+                    "type": "string",
+                    "description": "The card cvv"
+                  },
+                  "expiration": {
+                    "maxLength": 7,
+                    "minLength": 7,
+                    "type": "string",
+                    "description": "The card expiration date"
+                  }
+                }
+              },
+              "billing": {
+                "required": [
+                  "firstName",
+                  "lastName",
+                  "state",
+                  "streetAddress",
+                  "zip"
+                ],
+                "type": "object",
+                "properties": {
+                  "zip": {
+                    "maxLength": 10,
+                    "minLength": 5,
+                    "type": "string",
+                    "description": "The zip code for the card"
+                  },
+                  "firstName": {
+                    "maxLength": 100,
+                    "minLength": 1,
+                    "type": "string",
+                    "description": "The first name on the card"
+                  },
+                  "lastName": {
+                    "maxLength": 100,
+                    "minLength": 1,
+                    "type": "string",
+                    "description": "The last name on the card"
+                  },
+                  "streetAddress": {
+                    "maxLength": 150,
+                    "minLength": 2,
+                    "type": "string",
+                    "description": "The street address for the card"
+                  },
+                  "streetAddress2": {
+                    "maxLength": 150,
+                    "type": "string",
+                    "description": "The second street address for the card"
+                  },
+                  "state": {
+                    "maxLength": 2,
+                    "minLength": 2,
+                    "type": "string",
+                    "description": "The state postal abbreviation for the card"
+                  }
+                }
+              }
+            }
+          },
+          "selectedJurisdictions": {
+            "maxLength": 100,
+            "type": "array",
+            "items": {
+              "type": "string",
+              "description": "Jurisdictions a provider has selected to purchase privileges in.",
+              "enum": [
+                "al",
+                "ak",
+                "az",
+                "ar",
+                "ca",
+                "co",
+                "ct",
+                "de",
+                "dc",
+                "fl",
+                "ga",
+                "hi",
+                "id",
+                "il",
+                "in",
+                "ia",
+                "ks",
+                "ky",
+                "la",
+                "me",
+                "md",
+                "ma",
+                "mi",
+                "mn",
+                "ms",
+                "mo",
+                "mt",
+                "ne",
+                "nv",
+                "nh",
+                "nj",
+                "nm",
+                "ny",
+                "nc",
+                "nd",
+                "oh",
+                "ok",
+                "or",
+                "pa",
+                "pr",
+                "ri",
+                "sc",
+                "sd",
+                "tn",
+                "tx",
+                "ut",
+                "vt",
+                "va",
+                "vi",
+                "wa",
+                "wv",
+                "wi",
+                "wy"
+              ]
+            }
+          }
+        }
+      },
+      "SandboLicenCKI8MYY04rNP": {
+        "required": [
+          "message"
+        ],
+        "type": "object",
+        "properties": {
+          "message": {
+            "type": "string",
+            "description": "A message about the request"
+          }
+        }
+      },
+      "SandboLicenq0WHjwuOL0r5": {
+        "required": [
+          "attributes",
+          "permissions",
+          "userId"
+        ],
+        "type": "object",
+        "properties": {
+          "permissions": {
+            "type": "object",
+            "additionalProperties": {
               "type": "object",
               "properties": {
                 "actions": {
@@ -2287,285 +2442,224 @@
               }
             },
             "additionalProperties": false
+          },
+          "userId": {
+            "type": "string"
           }
         },
         "additionalProperties": false
       },
-      "SandboLicenIlcgezTgAmMg": {
+      "SandboLicenTrpoUes4Xu35": {
         "required": [
-          "items",
-          "pagination"
+          "transactionId"
         ],
         "type": "object",
         "properties": {
-          "pagination": {
-            "type": "object",
-            "properties": {
-              "prevLastKey": {
-                "maxLength": 1024,
-                "minLength": 1,
-                "type": "object"
-              },
-              "lastKey": {
-                "maxLength": 1024,
-                "minLength": 1,
-                "type": "object"
-              },
-              "pageSize": {
-                "maximum": 100,
-                "minimum": 5,
-                "type": "integer"
-              }
-            }
+          "message": {
+            "type": "string",
+            "description": "A message about the transaction"
           },
-          "items": {
-            "maxLength": 100,
-            "type": "array",
-            "items": {
-              "type": "object",
-              "oneOf": [
-                {
-                  "required": [
-                    "compactCommissionFee",
-                    "compactName",
-                    "type"
-                  ],
-                  "type": "object",
-                  "properties": {
-                    "compactCommissionFee": {
-                      "required": [
-                        "feeAmount",
-                        "feeType"
-                      ],
-                      "type": "object",
-                      "properties": {
-                        "feeAmount": {
-                          "type": "number"
-                        },
-                        "feeType": {
-                          "type": "string",
-                          "enum": [
-                            "FLAT_RATE"
-                          ]
-                        }
-                      }
-                    },
-                    "type": {
-                      "type": "string",
-                      "enum": [
-                        "compact"
-                      ]
+          "transactionId": {
+            "type": "string",
+            "description": "The transaction id for the purchase"
+          }
+        }
+      },
+      "SandboLicensqVdeqIDiTUV": {
+        "maxLength": 100,
+        "type": "array",
+        "items": {
+          "required": [
+            "dateOfBirth",
+            "dateOfExpiration",
+            "dateOfIssuance",
+            "dateOfRenewal",
+            "familyName",
+            "givenName",
+            "homeAddressCity",
+            "homeAddressPostalCode",
+            "homeAddressState",
+            "homeAddressStreet1",
+            "licenseType",
+            "ssn",
+            "status"
+          ],
+          "type": "object",
+          "properties": {
+            "homeAddressStreet2": {
+              "maxLength": 100,
+              "minLength": 1,
+              "type": "string"
+            },
+            "npi": {
+              "pattern": "^[0-9]{10}$",
+              "type": "string"
+            },
+            "homeAddressPostalCode": {
+              "maxLength": 7,
+              "minLength": 5,
+              "type": "string"
+            },
+            "givenName": {
+              "maxLength": 100,
+              "minLength": 1,
+              "type": "string"
+            },
+            "homeAddressStreet1": {
+              "maxLength": 100,
+              "minLength": 2,
+              "type": "string"
+            },
+            "militaryWaiver": {
+              "type": "boolean"
+            },
+            "dateOfBirth": {
+              "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+              "type": "string",
+              "format": "date"
+            },
+            "dateOfIssuance": {
+              "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+              "type": "string",
+              "format": "date"
+            },
+            "ssn": {
+              "pattern": "^[0-9]{3}-[0-9]{2}-[0-9]{4}$",
+              "type": "string"
+            },
+            "licenseType": {
+              "type": "string",
+              "enum": [
+                "audiologist",
+                "speech-language pathologist",
+                "speech and language pathologist",
+                "occupational therapist",
+                "occupational therapy assistant",
+                "licensed professional counselor",
+                "licensed mental health counselor",
+                "licensed clinical mental health counselor",
+                "licensed professional clinical counselor"
+              ]
+            },
+            "dateOfExpiration": {
+              "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+              "type": "string",
+              "format": "date"
+            },
+            "homeAddressState": {
+              "maxLength": 100,
+              "minLength": 2,
+              "type": "string"
+            },
+            "dateOfRenewal": {
+              "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+              "type": "string",
+              "format": "date"
+            },
+            "familyName": {
+              "maxLength": 100,
+              "minLength": 1,
+              "type": "string"
+            },
+            "homeAddressCity": {
+              "maxLength": 100,
+              "minLength": 2,
+              "type": "string"
+            },
+            "middleName": {
+              "maxLength": 100,
+              "minLength": 1,
+              "type": "string"
+            },
+            "status": {
+              "type": "string",
+              "enum": [
+                "active",
+                "inactive"
+              ]
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "SandboLicencwCJNumn5Our": {
+        "type": "object",
+        "properties": {
+          "attributes": {
+            "type": "object",
+            "properties": {
+              "givenName": {
+                "maxLength": 100,
+                "minLength": 1,
+                "type": "string"
+              },
+              "familyName": {
+                "maxLength": 100,
+                "minLength": 1,
+                "type": "string"
+              }
+            },
+            "additionalProperties": false
+          }
+        },
+        "additionalProperties": false
+      },
+      "SandboLicenNYOXdr8q1V6F": {
+        "type": "object",
+        "properties": {
+          "permissions": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "object",
+              "properties": {
+                "actions": {
+                  "type": "object",
+                  "properties": {
+                    "readPrivate": {
+                      "type": "boolean"
                     },
-                    "compactName": {
-                      "type": "string",
-                      "description": "The name of the compact"
+                    "read": {
+                      "type": "boolean"
+                    },
+                    "admin": {
+                      "type": "boolean"
                     }
                   }
                 },
-                {
-                  "required": [
-                    "jurisdictionFee",
-                    "jurisdictionName",
-                    "jurisprudenceRequirements",
-                    "postalAbbreviation",
-                    "type"
-                  ],
+                "jurisdictions": {
                   "type": "object",
-                  "properties": {
-                    "militaryDiscount": {
-                      "required": [
-                        "active",
-                        "discountAmount",
-                        "discountType"
-                      ],
-                      "type": "object",
-                      "properties": {
-                        "active": {
-                          "type": "boolean",
-                          "description": "Whether the military discount is active"
-                        },
-                        "discountAmount": {
-                          "type": "number",
-                          "description": "The amount of the discount"
+                  "additionalProperties": {
+                    "type": "object",
+                    "properties": {
+                      "actions": {
+                        "type": "object",
+                        "properties": {
+                          "readPrivate": {
+                            "type": "boolean"
+                          },
+                          "admin": {
+                            "type": "boolean"
+                          },
+                          "write": {
+                            "type": "boolean"
+                          }
                         },
-                        "discountType": {
-                          "type": "string",
-                          "description": "The type of discount",
-                          "enum": [
-                            "FLAT_RATE"
-                          ]
-                        }
-                      }
-                    },
-                    "postalAbbreviation": {
-                      "type": "string",
-                      "description": "The postal abbreviation of the jurisdiction"
-                    },
-                    "jurisprudenceRequirements": {
-                      "required": [
-                        "required"
-                      ],
-                      "type": "object",
-                      "properties": {
-                        "required": {
-                          "type": "boolean",
-                          "description": "Whether jurisprudence requirements exist"
-                        }
+                        "additionalProperties": false
                       }
-                    },
-                    "jurisdictionName": {
-                      "type": "string",
-                      "description": "The name of the jurisdiction"
-                    },
-                    "jurisdictionFee": {
-                      "type": "number",
-                      "description": "The fee for the jurisdiction"
-                    },
-                    "type": {
-                      "type": "string",
-                      "enum": [
-                        "jurisdiction"
-                      ]
                     }
                   }
                 }
-              ]
+              },
+              "additionalProperties": false
             }
           }
-        }
+        },
+        "additionalProperties": false
       },
-      "SandboLicenKugXONwl77RZ": {
+      "SandboLicenDIQiicBLz4mm": {
         "required": [
-          "affiliationType",
-          "dateOfUpdate",
-          "dateOfUpload",
-          "documentUploadFields",
-          "status"
-        ],
-        "type": "object",
-        "properties": {
-          "dateOfUpload": {
-            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-            "type": "string",
-            "description": "The date the document was uploaded",
-            "format": "date"
-          },
-          "affiliationType": {
-            "type": "string",
-            "description": "The type of military affiliation",
-            "enum": [
-              "militaryMember",
-              "militaryMemberSpouse"
-            ]
-          },
-          "fileNames": {
-            "type": "array",
-            "description": "List of military affiliation file names",
-            "items": {
-              "type": "string",
-              "description": "The name of the file being uploaded"
-            }
-          },
-          "dateOfUpdate": {
-            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-            "type": "string",
-            "description": "The date the document was last updated",
-            "format": "date"
-          },
-          "status": {
-            "type": "string",
-            "description": "The status of the military affiliation"
-          },
-          "documentUploadFields": {
-            "type": "array",
-            "description": "The fields used to upload documents",
-            "items": {
-              "type": "object",
-              "properties": {
-                "fields": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "type": "string"
-                  },
-                  "description": "The form fields used to upload the document"
-                },
-                "url": {
-                  "type": "string",
-                  "description": "The url to upload the document to"
-                }
-              },
-              "description": "The fields used to upload a specific document"
-            }
-          }
-        }
-      },
-      "SandboLicen2gYLvhizuSaW": {
-        "required": [
-          "transactionId"
-        ],
-        "type": "object",
-        "properties": {
-          "message": {
-            "type": "string",
-            "description": "A message about the transaction"
-          },
-          "transactionId": {
-            "type": "string",
-            "description": "The transaction id for the purchase"
-          }
-        }
-      },
-      "SandboLicenM3v1DQsiYo0I": {
-        "required": [
-          "apiLoginId",
-          "processor",
-          "transactionKey"
-        ],
-        "type": "object",
-        "properties": {
-          "apiLoginId": {
-            "maxLength": 100,
-            "minLength": 1,
-            "type": "string",
-            "description": "The api login id for the payment processor"
-          },
-          "transactionKey": {
-            "maxLength": 100,
-            "minLength": 1,
-            "type": "string",
-            "description": "The transaction key for the payment processor"
-          },
-          "processor": {
-            "type": "string",
-            "description": "The type of payment processor",
-            "enum": [
-              "authorize.net"
-            ]
-          }
-        },
-        "additionalProperties": false
-      },
-      "SandboLicenvclXpdeW3Y28": {
-        "required": [
-          "status"
-        ],
-        "type": "object",
-        "properties": {
-          "status": {
-            "type": "string",
-            "description": "The status to set the military affiliation to.",
-            "enum": [
-              "inactive"
-            ]
-          }
-        },
-        "additionalProperties": false
-      },
-      "SandboLicenUL01PEWATEUT": {
-        "required": [
-          "attributes",
-          "permissions",
-          "userId"
+          "attributes",
+          "permissions"
         ],
         "type": "object",
         "properties": {
@@ -2640,382 +2734,342 @@
               }
             },
             "additionalProperties": false
-          },
-          "userId": {
-            "type": "string"
           }
         },
         "additionalProperties": false
       },
-      "SandboLicencgqVAvZnWkMG": {
+      "SandboLicenicEElMwlVowu": {
         "required": [
-          "affiliationType",
-          "fileNames"
+          "items",
+          "pagination"
         ],
         "type": "object",
         "properties": {
-          "affiliationType": {
-            "type": "string",
-            "description": "The type of military affiliation",
-            "enum": [
-              "militaryMember",
-              "militaryMemberSpouse"
-            ]
-          },
-          "fileNames": {
-            "type": "array",
-            "description": "List of military affiliation file names",
-            "items": {
-              "maxLength": 150,
-              "type": "string",
-              "description": "The name of the file being uploaded"
+          "pagination": {
+            "type": "object",
+            "properties": {
+              "prevLastKey": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "type": "object"
+              },
+              "lastKey": {
+                "maxLength": 1024,
+                "minLength": 1,
+                "type": "object"
+              },
+              "pageSize": {
+                "maximum": 100,
+                "minimum": 5,
+                "type": "integer"
+              }
             }
-          }
-        },
-        "additionalProperties": false
-      },
-      "SandboLicenDdBuFYJj4W5C": {
-        "required": [
-          "birthMonthDay",
-          "compact",
-          "dateOfBirth",
-          "dateOfExpiration",
-          "dateOfUpdate",
-          "familyName",
-          "givenName",
-          "homeAddressCity",
-          "homeAddressPostalCode",
-          "homeAddressState",
-          "homeAddressStreet1",
-          "licenseJurisdiction",
-          "licenseType",
-          "licenses",
-          "privilegeJurisdictions",
-          "privileges",
-          "providerId",
-          "ssn",
-          "status",
-          "type"
-        ],
-        "type": "object",
-        "properties": {
-          "privileges": {
+          },
+          "items": {
+            "maxLength": 100,
             "type": "array",
             "items": {
               "type": "object",
-              "properties": {
-                "licenseJurisdiction": {
-                  "type": "string",
-                  "enum": [
-                    "al",
-                    "ak",
-                    "az",
-                    "ar",
-                    "ca",
-                    "co",
-                    "ct",
-                    "de",
-                    "dc",
-                    "fl",
-                    "ga",
-                    "hi",
-                    "id",
-                    "il",
-                    "in",
-                    "ia",
-                    "ks",
-                    "ky",
-                    "la",
-                    "me",
-                    "md",
-                    "ma",
-                    "mi",
-                    "mn",
-                    "ms",
-                    "mo",
-                    "mt",
-                    "ne",
-                    "nv",
-                    "nh",
-                    "nj",
-                    "nm",
-                    "ny",
-                    "nc",
-                    "nd",
-                    "oh",
-                    "ok",
-                    "or",
-                    "pa",
-                    "pr",
-                    "ri",
-                    "sc",
-                    "sd",
-                    "tn",
-                    "tx",
-                    "ut",
-                    "vt",
-                    "va",
-                    "vi",
-                    "wa",
-                    "wv",
-                    "wi",
-                    "wy"
-                  ]
-                },
-                "dateOfExpiration": {
-                  "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-                  "type": "string",
-                  "format": "date"
-                },
-                "compact": {
-                  "type": "string",
-                  "enum": [
-                    "aslp",
-                    "octp",
-                    "coun"
-                  ]
-                },
-                "providerId": {
-                  "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
-                  "type": "string"
-                },
-                "type": {
-                  "type": "string",
-                  "enum": [
-                    "privilege"
-                  ]
-                },
-                "dateOfIssuance": {
-                  "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-                  "type": "string",
-                  "format": "date"
-                },
-                "dateOfUpdate": {
-                  "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-                  "type": "string",
-                  "format": "date"
+              "oneOf": [
+                {
+                  "required": [
+                    "compactCommissionFee",
+                    "compactName",
+                    "type"
+                  ],
+                  "type": "object",
+                  "properties": {
+                    "compactCommissionFee": {
+                      "required": [
+                        "feeAmount",
+                        "feeType"
+                      ],
+                      "type": "object",
+                      "properties": {
+                        "feeAmount": {
+                          "type": "number"
+                        },
+                        "feeType": {
+                          "type": "string",
+                          "enum": [
+                            "FLAT_RATE"
+                          ]
+                        }
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "enum": [
+                        "compact"
+                      ]
+                    },
+                    "compactName": {
+                      "type": "string",
+                      "description": "The name of the compact"
+                    }
+                  }
                 },
-                "status": {
-                  "type": "string",
-                  "enum": [
-                    "active",
-                    "inactive"
-                  ]
+                {
+                  "required": [
+                    "jurisdictionFee",
+                    "jurisdictionName",
+                    "jurisprudenceRequirements",
+                    "postalAbbreviation",
+                    "type"
+                  ],
+                  "type": "object",
+                  "properties": {
+                    "militaryDiscount": {
+                      "required": [
+                        "active",
+                        "discountAmount",
+                        "discountType"
+                      ],
+                      "type": "object",
+                      "properties": {
+                        "active": {
+                          "type": "boolean",
+                          "description": "Whether the military discount is active"
+                        },
+                        "discountAmount": {
+                          "type": "number",
+                          "description": "The amount of the discount"
+                        },
+                        "discountType": {
+                          "type": "string",
+                          "description": "The type of discount",
+                          "enum": [
+                            "FLAT_RATE"
+                          ]
+                        }
+                      }
+                    },
+                    "postalAbbreviation": {
+                      "type": "string",
+                      "description": "The postal abbreviation of the jurisdiction"
+                    },
+                    "jurisprudenceRequirements": {
+                      "required": [
+                        "required"
+                      ],
+                      "type": "object",
+                      "properties": {
+                        "required": {
+                          "type": "boolean",
+                          "description": "Whether jurisprudence requirements exist"
+                        }
+                      }
+                    },
+                    "jurisdictionName": {
+                      "type": "string",
+                      "description": "The name of the jurisdiction"
+                    },
+                    "jurisdictionFee": {
+                      "type": "number",
+                      "description": "The fee for the jurisdiction"
+                    },
+                    "type": {
+                      "type": "string",
+                      "enum": [
+                        "jurisdiction"
+                      ]
+                    }
+                  }
                 }
-              }
+              ]
             }
+          }
+        }
+      },
+      "SandboLicenQmuWrxvHrNne": {
+        "required": [
+          "apiLoginId",
+          "processor",
+          "transactionKey"
+        ],
+        "type": "object",
+        "properties": {
+          "apiLoginId": {
+            "maxLength": 100,
+            "minLength": 1,
+            "type": "string",
+            "description": "The api login id for the payment processor"
           },
-          "licenseJurisdiction": {
+          "transactionKey": {
+            "maxLength": 100,
+            "minLength": 1,
+            "type": "string",
+            "description": "The transaction key for the payment processor"
+          },
+          "processor": {
             "type": "string",
+            "description": "The type of payment processor",
             "enum": [
-              "al",
-              "ak",
-              "az",
-              "ar",
-              "ca",
-              "co",
-              "ct",
-              "de",
-              "dc",
-              "fl",
-              "ga",
-              "hi",
-              "id",
-              "il",
-              "in",
-              "ia",
-              "ks",
-              "ky",
-              "la",
-              "me",
-              "md",
-              "ma",
-              "mi",
-              "mn",
-              "ms",
-              "mo",
-              "mt",
-              "ne",
-              "nv",
-              "nh",
-              "nj",
-              "nm",
-              "ny",
-              "nc",
-              "nd",
-              "oh",
-              "ok",
-              "or",
-              "pa",
-              "pr",
-              "ri",
-              "sc",
-              "sd",
-              "tn",
-              "tx",
-              "ut",
-              "vt",
-              "va",
-              "vi",
-              "wa",
-              "wv",
-              "wi",
-              "wy"
+              "authorize.net"
             ]
+          }
+        },
+        "additionalProperties": false
+      },
+      "SandboLicenXS5uvP2iI0Bd": {
+        "required": [
+          "affiliationType",
+          "dateOfUpdate",
+          "dateOfUpload",
+          "documentUploadFields",
+          "status"
+        ],
+        "type": "object",
+        "properties": {
+          "dateOfUpload": {
+            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+            "type": "string",
+            "description": "The date the document was uploaded",
+            "format": "date"
           },
-          "compact": {
+          "affiliationType": {
             "type": "string",
+            "description": "The type of military affiliation",
             "enum": [
-              "aslp",
-              "octp",
-              "coun"
+              "militaryMember",
+              "militaryMemberSpouse"
             ]
           },
-          "homeAddressStreet2": {
-            "maxLength": 100,
-            "minLength": 1,
-            "type": "string"
+          "fileNames": {
+            "type": "array",
+            "description": "List of military affiliation file names",
+            "items": {
+              "type": "string",
+              "description": "The name of the file being uploaded"
+            }
           },
-          "npi": {
-            "pattern": "^[0-9]{10}$",
-            "type": "string"
-          },
-          "homeAddressPostalCode": {
-            "maxLength": 7,
-            "minLength": 5,
-            "type": "string"
-          },
-          "givenName": {
-            "maxLength": 100,
-            "minLength": 1,
-            "type": "string"
-          },
-          "homeAddressStreet1": {
-            "maxLength": 100,
-            "minLength": 2,
-            "type": "string"
-          },
-          "militaryWaiver": {
-            "type": "boolean"
-          },
-          "dateOfBirth": {
+          "dateOfUpdate": {
             "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
             "type": "string",
+            "description": "The date the document was last updated",
             "format": "date"
           },
-          "privilegeJurisdictions": {
+          "status": {
+            "type": "string",
+            "description": "The status of the military affiliation"
+          },
+          "documentUploadFields": {
             "type": "array",
+            "description": "The fields used to upload documents",
             "items": {
-              "type": "string",
-              "enum": [
-                "al",
-                "ak",
-                "az",
-                "ar",
-                "ca",
-                "co",
-                "ct",
-                "de",
-                "dc",
-                "fl",
-                "ga",
-                "hi",
-                "id",
-                "il",
-                "in",
-                "ia",
-                "ks",
-                "ky",
-                "la",
-                "me",
-                "md",
-                "ma",
-                "mi",
-                "mn",
-                "ms",
-                "mo",
-                "mt",
-                "ne",
-                "nv",
-                "nh",
-                "nj",
-                "nm",
-                "ny",
-                "nc",
-                "nd",
-                "oh",
-                "ok",
-                "or",
-                "pa",
-                "pr",
-                "ri",
-                "sc",
-                "sd",
-                "tn",
-                "tx",
-                "ut",
-                "vt",
-                "va",
-                "vi",
-                "wa",
-                "wv",
-                "wi",
-                "wy"
-              ]
+              "type": "object",
+              "properties": {
+                "fields": {
+                  "type": "object",
+                  "additionalProperties": {
+                    "type": "string"
+                  },
+                  "description": "The form fields used to upload the document"
+                },
+                "url": {
+                  "type": "string",
+                  "description": "The url to upload the document to"
+                }
+              },
+              "description": "The fields used to upload a specific document"
             }
+          }
+        }
+      },
+      "SandboLicenJwkX1M19iehD": {
+        "type": "object",
+        "properties": {
+          "dateCreated": {
+            "type": "string",
+            "format": "date-time"
           },
-          "type": {
+          "compact": {
             "type": "string",
             "enum": [
-              "provider"
+              "aslp",
+              "octp",
+              "coun"
             ]
           },
-          "ssn": {
-            "pattern": "^[0-9]{3}-[0-9]{2}-[0-9]{4}$",
+          "attestationType": {
             "type": "string"
           },
-          "licenseType": {
+          "text": {
+            "type": "string"
+          },
+          "type": {
             "type": "string",
             "enum": [
-              "audiologist",
-              "speech-language pathologist",
-              "speech and language pathologist",
-              "occupational therapist",
-              "occupational therapy assistant",
-              "licensed professional counselor",
-              "licensed mental health counselor",
-              "licensed clinical mental health counselor",
-              "licensed professional clinical counselor"
+              "attestation"
             ]
           },
-          "licenses": {
+          "version": {
+            "type": "string"
+          },
+          "required": {
+            "type": "boolean"
+          }
+        }
+      },
+      "SandboLicen3bd9q60ck5Mk": {
+        "required": [
+          "status"
+        ],
+        "type": "object",
+        "properties": {
+          "status": {
+            "type": "string",
+            "description": "The status to set the military affiliation to.",
+            "enum": [
+              "inactive"
+            ]
+          }
+        },
+        "additionalProperties": false
+      },
+      "SandboLicenyYKFQAIjlFCn": {
+        "required": [
+          "message"
+        ],
+        "type": "object",
+        "properties": {
+          "message": {
+            "type": "string",
+            "description": "A message about the request"
+          }
+        }
+      },
+      "SandboLicenPWICF4WAig5B": {
+        "required": [
+          "birthMonthDay",
+          "compact",
+          "dateOfBirth",
+          "dateOfExpiration",
+          "dateOfUpdate",
+          "familyName",
+          "givenName",
+          "homeAddressCity",
+          "homeAddressPostalCode",
+          "homeAddressState",
+          "homeAddressStreet1",
+          "licenseJurisdiction",
+          "licenseType",
+          "licenses",
+          "privilegeJurisdictions",
+          "privileges",
+          "providerId",
+          "ssn",
+          "status",
+          "type"
+        ],
+        "type": "object",
+        "properties": {
+          "privileges": {
             "type": "array",
             "items": {
               "type": "object",
               "properties": {
-                "compact": {
-                  "type": "string",
-                  "enum": [
-                    "aslp",
-                    "octp",
-                    "coun"
-                  ]
-                },
-                "homeAddressStreet2": {
-                  "maxLength": 100,
-                  "minLength": 1,
-                  "type": "string"
-                },
-                "npi": {
-                  "pattern": "^[0-9]{10}$",
-                  "type": "string"
-                },
-                "homeAddressPostalCode": {
-                  "maxLength": 7,
-                  "minLength": 5,
-                  "type": "string"
-                },
-                "jurisdiction": {
+                "licenseJurisdiction": {
                   "type": "string",
                   "enum": [
                     "al",
@@ -3073,87 +3127,333 @@
                     "wy"
                   ]
                 },
-                "givenName": {
-                  "maxLength": 100,
-                  "minLength": 1,
-                  "type": "string"
-                },
-                "homeAddressStreet1": {
-                  "maxLength": 100,
-                  "minLength": 2,
-                  "type": "string"
-                },
-                "militaryWaiver": {
-                  "type": "boolean"
-                },
-                "dateOfBirth": {
+                "dateOfExpiration": {
                   "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
                   "type": "string",
                   "format": "date"
                 },
-                "type": {
+                "compact": {
                   "type": "string",
                   "enum": [
-                    "license-home"
+                    "aslp",
+                    "octp",
+                    "coun"
                   ]
                 },
-                "dateOfIssuance": {
-                  "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-                  "type": "string",
-                  "format": "date"
-                },
-                "ssn": {
-                  "pattern": "^[0-9]{3}-[0-9]{2}-[0-9]{4}$",
+                "providerId": {
+                  "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
                   "type": "string"
                 },
-                "licenseType": {
-                  "type": "string",
-                  "enum": [
-                    "audiologist",
-                    "speech-language pathologist",
-                    "speech and language pathologist",
-                    "occupational therapist",
-                    "occupational therapy assistant",
-                    "licensed professional counselor",
-                    "licensed mental health counselor",
-                    "licensed clinical mental health counselor",
-                    "licensed professional clinical counselor"
-                  ]
+                "history": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "compact": {
+                        "type": "string",
+                        "enum": [
+                          "aslp",
+                          "octp",
+                          "coun"
+                        ]
+                      },
+                      "previous": {
+                        "type": "object",
+                        "properties": {
+                          "licenseJurisdiction": {
+                            "type": "string",
+                            "enum": [
+                              "al",
+                              "ak",
+                              "az",
+                              "ar",
+                              "ca",
+                              "co",
+                              "ct",
+                              "de",
+                              "dc",
+                              "fl",
+                              "ga",
+                              "hi",
+                              "id",
+                              "il",
+                              "in",
+                              "ia",
+                              "ks",
+                              "ky",
+                              "la",
+                              "me",
+                              "md",
+                              "ma",
+                              "mi",
+                              "mn",
+                              "ms",
+                              "mo",
+                              "mt",
+                              "ne",
+                              "nv",
+                              "nh",
+                              "nj",
+                              "nm",
+                              "ny",
+                              "nc",
+                              "nd",
+                              "oh",
+                              "ok",
+                              "or",
+                              "pa",
+                              "pr",
+                              "ri",
+                              "sc",
+                              "sd",
+                              "tn",
+                              "tx",
+                              "ut",
+                              "vt",
+                              "va",
+                              "vi",
+                              "wa",
+                              "wv",
+                              "wi",
+                              "wy"
+                            ]
+                          },
+                          "dateOfExpiration": {
+                            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                            "type": "string",
+                            "format": "date"
+                          },
+                          "compact": {
+                            "type": "string",
+                            "enum": [
+                              "aslp",
+                              "octp",
+                              "coun"
+                            ]
+                          },
+                          "providerId": {
+                            "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
+                            "type": "string"
+                          },
+                          "type": {
+                            "type": "string",
+                            "enum": [
+                              "privilege"
+                            ]
+                          },
+                          "dateOfIssuance": {
+                            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                            "type": "string",
+                            "format": "date"
+                          },
+                          "dateOfUpdate": {
+                            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                            "type": "string",
+                            "format": "date"
+                          },
+                          "status": {
+                            "type": "string",
+                            "enum": [
+                              "active",
+                              "inactive"
+                            ]
+                          }
+                        }
+                      },
+                      "jurisdiction": {
+                        "type": "string",
+                        "enum": [
+                          "al",
+                          "ak",
+                          "az",
+                          "ar",
+                          "ca",
+                          "co",
+                          "ct",
+                          "de",
+                          "dc",
+                          "fl",
+                          "ga",
+                          "hi",
+                          "id",
+                          "il",
+                          "in",
+                          "ia",
+                          "ks",
+                          "ky",
+                          "la",
+                          "me",
+                          "md",
+                          "ma",
+                          "mi",
+                          "mn",
+                          "ms",
+                          "mo",
+                          "mt",
+                          "ne",
+                          "nv",
+                          "nh",
+                          "nj",
+                          "nm",
+                          "ny",
+                          "nc",
+                          "nd",
+                          "oh",
+                          "ok",
+                          "or",
+                          "pa",
+                          "pr",
+                          "ri",
+                          "sc",
+                          "sd",
+                          "tn",
+                          "tx",
+                          "ut",
+                          "vt",
+                          "va",
+                          "vi",
+                          "wa",
+                          "wv",
+                          "wi",
+                          "wy"
+                        ]
+                      },
+                      "updatedValues": {
+                        "type": "object",
+                        "properties": {
+                          "licenseJurisdiction": {
+                            "type": "string",
+                            "enum": [
+                              "al",
+                              "ak",
+                              "az",
+                              "ar",
+                              "ca",
+                              "co",
+                              "ct",
+                              "de",
+                              "dc",
+                              "fl",
+                              "ga",
+                              "hi",
+                              "id",
+                              "il",
+                              "in",
+                              "ia",
+                              "ks",
+                              "ky",
+                              "la",
+                              "me",
+                              "md",
+                              "ma",
+                              "mi",
+                              "mn",
+                              "ms",
+                              "mo",
+                              "mt",
+                              "ne",
+                              "nv",
+                              "nh",
+                              "nj",
+                              "nm",
+                              "ny",
+                              "nc",
+                              "nd",
+                              "oh",
+                              "ok",
+                              "or",
+                              "pa",
+                              "pr",
+                              "ri",
+                              "sc",
+                              "sd",
+                              "tn",
+                              "tx",
+                              "ut",
+                              "vt",
+                              "va",
+                              "vi",
+                              "wa",
+                              "wv",
+                              "wi",
+                              "wy"
+                            ]
+                          },
+                          "dateOfExpiration": {
+                            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                            "type": "string",
+                            "format": "date"
+                          },
+                          "compact": {
+                            "type": "string",
+                            "enum": [
+                              "aslp",
+                              "octp",
+                              "coun"
+                            ]
+                          },
+                          "providerId": {
+                            "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
+                            "type": "string"
+                          },
+                          "type": {
+                            "type": "string",
+                            "enum": [
+                              "privilege"
+                            ]
+                          },
+                          "dateOfIssuance": {
+                            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                            "type": "string",
+                            "format": "date"
+                          },
+                          "dateOfUpdate": {
+                            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                            "type": "string",
+                            "format": "date"
+                          },
+                          "status": {
+                            "type": "string",
+                            "enum": [
+                              "active",
+                              "inactive"
+                            ]
+                          }
+                        }
+                      },
+                      "type": {
+                        "type": "string",
+                        "enum": [
+                          "privilegeUpdate"
+                        ]
+                      },
+                      "dateOfUpdate": {
+                        "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                        "type": "string",
+                        "format": "date"
+                      },
+                      "updateType": {
+                        "type": "string",
+                        "enum": [
+                          "renewal",
+                          "deactivation",
+                          "other"
+                        ]
+                      }
+                    }
+                  }
                 },
-                "dateOfExpiration": {
-                  "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                "type": {
                   "type": "string",
-                  "format": "date"
-                },
-                "homeAddressState": {
-                  "maxLength": 100,
-                  "minLength": 2,
-                  "type": "string"
-                },
-                "providerId": {
-                  "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
-                  "type": "string"
+                  "enum": [
+                    "privilege"
+                  ]
                 },
-                "dateOfRenewal": {
+                "dateOfIssuance": {
                   "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
                   "type": "string",
                   "format": "date"
                 },
-                "familyName": {
-                  "maxLength": 100,
-                  "minLength": 1,
-                  "type": "string"
-                },
-                "homeAddressCity": {
-                  "maxLength": 100,
-                  "minLength": 2,
-                  "type": "string"
-                },
-                "middleName": {
-                  "maxLength": 100,
-                  "minLength": 1,
-                  "type": "string"
-                },
                 "dateOfUpdate": {
                   "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
                   "type": "string",
@@ -3169,414 +3469,702 @@
               }
             }
           },
-          "dateOfExpiration": {
-            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+          "licenseJurisdiction": {
             "type": "string",
-            "format": "date"
+            "enum": [
+              "al",
+              "ak",
+              "az",
+              "ar",
+              "ca",
+              "co",
+              "ct",
+              "de",
+              "dc",
+              "fl",
+              "ga",
+              "hi",
+              "id",
+              "il",
+              "in",
+              "ia",
+              "ks",
+              "ky",
+              "la",
+              "me",
+              "md",
+              "ma",
+              "mi",
+              "mn",
+              "ms",
+              "mo",
+              "mt",
+              "ne",
+              "nv",
+              "nh",
+              "nj",
+              "nm",
+              "ny",
+              "nc",
+              "nd",
+              "oh",
+              "ok",
+              "or",
+              "pa",
+              "pr",
+              "ri",
+              "sc",
+              "sd",
+              "tn",
+              "tx",
+              "ut",
+              "vt",
+              "va",
+              "vi",
+              "wa",
+              "wv",
+              "wi",
+              "wy"
+            ]
           },
-          "homeAddressState": {
+          "compact": {
+            "type": "string",
+            "enum": [
+              "aslp",
+              "octp",
+              "coun"
+            ]
+          },
+          "homeAddressStreet2": {
             "maxLength": 100,
-            "minLength": 2,
+            "minLength": 1,
             "type": "string"
           },
-          "providerId": {
-            "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
+          "npi": {
+            "pattern": "^[0-9]{10}$",
             "type": "string"
           },
-          "familyName": {
-            "maxLength": 100,
-            "minLength": 1,
+          "homeAddressPostalCode": {
+            "maxLength": 7,
+            "minLength": 5,
             "type": "string"
           },
-          "homeAddressCity": {
+          "givenName": {
             "maxLength": 100,
-            "minLength": 2,
+            "minLength": 1,
             "type": "string"
           },
-          "middleName": {
+          "homeAddressStreet1": {
             "maxLength": 100,
-            "minLength": 1,
+            "minLength": 2,
             "type": "string"
           },
-          "birthMonthDay": {
-            "pattern": "^[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-            "type": "string",
-            "format": "date"
+          "militaryWaiver": {
+            "type": "boolean"
           },
-          "dateOfUpdate": {
+          "dateOfBirth": {
             "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
             "type": "string",
             "format": "date"
           },
-          "status": {
-            "type": "string",
-            "enum": [
-              "active",
-              "inactive"
-            ]
-          }
-        }
-      },
-      "SandboLicenxwmHa2Q438IJ": {
-        "type": "object",
-        "properties": {
-          "dateCreated": {
-            "type": "string",
-            "format": "date-time"
+          "privilegeJurisdictions": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "enum": [
+                "al",
+                "ak",
+                "az",
+                "ar",
+                "ca",
+                "co",
+                "ct",
+                "de",
+                "dc",
+                "fl",
+                "ga",
+                "hi",
+                "id",
+                "il",
+                "in",
+                "ia",
+                "ks",
+                "ky",
+                "la",
+                "me",
+                "md",
+                "ma",
+                "mi",
+                "mn",
+                "ms",
+                "mo",
+                "mt",
+                "ne",
+                "nv",
+                "nh",
+                "nj",
+                "nm",
+                "ny",
+                "nc",
+                "nd",
+                "oh",
+                "ok",
+                "or",
+                "pa",
+                "pr",
+                "ri",
+                "sc",
+                "sd",
+                "tn",
+                "tx",
+                "ut",
+                "vt",
+                "va",
+                "vi",
+                "wa",
+                "wv",
+                "wi",
+                "wy"
+              ]
+            }
           },
-          "compact": {
+          "type": {
             "type": "string",
             "enum": [
-              "aslp",
-              "octp",
-              "coun"
+              "provider"
             ]
           },
-          "attestationType": {
-            "type": "string"
-          },
-          "text": {
+          "ssn": {
+            "pattern": "^[0-9]{3}-[0-9]{2}-[0-9]{4}$",
             "type": "string"
           },
-          "type": {
+          "licenseType": {
             "type": "string",
             "enum": [
-              "attestation"
+              "audiologist",
+              "speech-language pathologist",
+              "speech and language pathologist",
+              "occupational therapist",
+              "occupational therapy assistant",
+              "licensed professional counselor",
+              "licensed mental health counselor",
+              "licensed clinical mental health counselor",
+              "licensed professional clinical counselor"
             ]
           },
-          "version": {
-            "type": "string"
-          },
-          "required": {
-            "type": "boolean"
-          }
-        }
-      },
-      "SandboLicenZpJMDau4cDdN": {
-        "required": [
-          "message"
-        ],
-        "type": "object",
-        "properties": {
-          "message": {
-            "type": "string"
-          }
-        },
-        "additionalProperties": false
-      },
-      "SandboLicenZtKJxTXXg5UL": {
-        "required": [
-          "query"
-        ],
-        "type": "object",
-        "properties": {
-          "pagination": {
-            "type": "object",
-            "properties": {
-              "lastKey": {
-                "maxLength": 1024,
-                "minLength": 1,
-                "type": "string"
-              },
-              "pageSize": {
-                "maximum": 100,
-                "minimum": 5,
-                "type": "integer"
-              }
-            },
-            "additionalProperties": false
-          },
-          "query": {
-            "type": "object",
-            "properties": {
-              "providerId": {
-                "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
-                "type": "string",
-                "description": "Internal UUID for the provider"
-              },
-              "jurisdiction": {
-                "type": "string",
-                "description": "Filter for providers with privilege/license in a jurisdiction",
-                "enum": [
-                  "al",
-                  "ak",
-                  "az",
-                  "ar",
-                  "ca",
-                  "co",
-                  "ct",
-                  "de",
-                  "dc",
-                  "fl",
-                  "ga",
-                  "hi",
-                  "id",
-                  "il",
-                  "in",
-                  "ia",
-                  "ks",
-                  "ky",
-                  "la",
-                  "me",
-                  "md",
-                  "ma",
-                  "mi",
-                  "mn",
-                  "ms",
-                  "mo",
-                  "mt",
-                  "ne",
-                  "nv",
-                  "nh",
-                  "nj",
-                  "nm",
-                  "ny",
-                  "nc",
-                  "nd",
-                  "oh",
-                  "ok",
-                  "or",
-                  "pa",
-                  "pr",
-                  "ri",
-                  "sc",
-                  "sd",
-                  "tn",
-                  "tx",
-                  "ut",
-                  "vt",
-                  "va",
-                  "vi",
-                  "wa",
-                  "wv",
-                  "wi",
-                  "wy"
-                ]
-              },
-              "ssn": {
-                "pattern": "^[0-9]{3}-[0-9]{2}-[0-9]{4}$",
-                "type": "string",
-                "description": "Social security number to look up"
-              }
-            },
-            "description": "The query parameters"
-          },
-          "sorting": {
-            "required": [
-              "key"
-            ],
-            "type": "object",
-            "properties": {
-              "key": {
-                "type": "string",
-                "description": "The key to sort results by",
-                "enum": [
-                  "dateOfUpdate",
-                  "familyName"
-                ]
-              },
-              "direction": {
-                "type": "string",
-                "description": "Direction to sort results by",
-                "enum": [
-                  "ascending",
-                  "descending"
-                ]
-              }
-            },
-            "description": "How to sort results"
-          }
-        },
-        "additionalProperties": false
-      },
-      "SandboLicenYgKyaZjnxxpR": {
-        "required": [
-          "message"
-        ],
-        "type": "object",
-        "properties": {
-          "message": {
-            "type": "string",
-            "description": "A message about the request"
-          }
-        }
-      },
-      "SandboLicenGA3a6Jf5sr6W": {
-        "required": [
-          "attestations",
-          "orderInformation",
-          "selectedJurisdictions"
-        ],
-        "type": "object",
-        "properties": {
-          "attestations": {
+          "licenses": {
             "type": "array",
-            "description": "List of attestations that the user has agreed to",
             "items": {
-              "required": [
-                "attestationId",
-                "version"
-              ],
               "type": "object",
               "properties": {
-                "attestationId": {
+                "compact": {
                   "type": "string",
-                  "description": "The ID of the attestation"
+                  "enum": [
+                    "aslp",
+                    "octp",
+                    "coun"
+                  ]
                 },
-                "version": {
-                  "pattern": "^\\d+$",
+                "homeAddressStreet2": {
+                  "maxLength": 100,
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "npi": {
+                  "pattern": "^[0-9]{10}$",
+                  "type": "string"
+                },
+                "homeAddressPostalCode": {
+                  "maxLength": 7,
+                  "minLength": 5,
+                  "type": "string"
+                },
+                "jurisdiction": {
                   "type": "string",
-                  "description": "The version of the attestation"
-                }
-              }
-            }
-          },
-          "orderInformation": {
-            "required": [
-              "billing",
-              "card"
-            ],
-            "type": "object",
-            "properties": {
-              "card": {
-                "required": [
-                  "cvv",
-                  "expiration",
-                  "number"
-                ],
-                "type": "object",
-                "properties": {
-                  "number": {
-                    "maxLength": 19,
-                    "minLength": 13,
-                    "type": "string",
-                    "description": "The card number"
-                  },
-                  "cvv": {
-                    "maxLength": 4,
-                    "minLength": 3,
-                    "type": "string",
-                    "description": "The card cvv"
-                  },
-                  "expiration": {
-                    "maxLength": 7,
-                    "minLength": 7,
-                    "type": "string",
-                    "description": "The card expiration date"
-                  }
-                }
-              },
-              "billing": {
-                "required": [
-                  "firstName",
-                  "lastName",
-                  "state",
-                  "streetAddress",
-                  "zip"
-                ],
-                "type": "object",
-                "properties": {
-                  "zip": {
-                    "maxLength": 10,
-                    "minLength": 5,
-                    "type": "string",
-                    "description": "The zip code for the card"
-                  },
-                  "firstName": {
-                    "maxLength": 100,
-                    "minLength": 1,
-                    "type": "string",
-                    "description": "The first name on the card"
-                  },
-                  "lastName": {
-                    "maxLength": 100,
-                    "minLength": 1,
-                    "type": "string",
-                    "description": "The last name on the card"
-                  },
-                  "streetAddress": {
-                    "maxLength": 150,
-                    "minLength": 2,
-                    "type": "string",
-                    "description": "The street address for the card"
-                  },
-                  "streetAddress2": {
-                    "maxLength": 150,
-                    "type": "string",
-                    "description": "The second street address for the card"
-                  },
-                  "state": {
-                    "maxLength": 2,
-                    "minLength": 2,
-                    "type": "string",
-                    "description": "The state postal abbreviation for the card"
+                  "enum": [
+                    "al",
+                    "ak",
+                    "az",
+                    "ar",
+                    "ca",
+                    "co",
+                    "ct",
+                    "de",
+                    "dc",
+                    "fl",
+                    "ga",
+                    "hi",
+                    "id",
+                    "il",
+                    "in",
+                    "ia",
+                    "ks",
+                    "ky",
+                    "la",
+                    "me",
+                    "md",
+                    "ma",
+                    "mi",
+                    "mn",
+                    "ms",
+                    "mo",
+                    "mt",
+                    "ne",
+                    "nv",
+                    "nh",
+                    "nj",
+                    "nm",
+                    "ny",
+                    "nc",
+                    "nd",
+                    "oh",
+                    "ok",
+                    "or",
+                    "pa",
+                    "pr",
+                    "ri",
+                    "sc",
+                    "sd",
+                    "tn",
+                    "tx",
+                    "ut",
+                    "vt",
+                    "va",
+                    "vi",
+                    "wa",
+                    "wv",
+                    "wi",
+                    "wy"
+                  ]
+                },
+                "givenName": {
+                  "maxLength": 100,
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "homeAddressStreet1": {
+                  "maxLength": 100,
+                  "minLength": 2,
+                  "type": "string"
+                },
+                "militaryWaiver": {
+                  "type": "boolean"
+                },
+                "dateOfBirth": {
+                  "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                  "type": "string",
+                  "format": "date"
+                },
+                "history": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "compact": {
+                        "type": "string",
+                        "enum": [
+                          "aslp",
+                          "octp",
+                          "coun"
+                        ]
+                      },
+                      "previous": {
+                        "type": "object",
+                        "properties": {
+                          "homeAddressStreet2": {
+                            "maxLength": 100,
+                            "minLength": 1,
+                            "type": "string"
+                          },
+                          "npi": {
+                            "pattern": "^[0-9]{10}$",
+                            "type": "string"
+                          },
+                          "homeAddressPostalCode": {
+                            "maxLength": 7,
+                            "minLength": 5,
+                            "type": "string"
+                          },
+                          "givenName": {
+                            "maxLength": 100,
+                            "minLength": 1,
+                            "type": "string"
+                          },
+                          "homeAddressStreet1": {
+                            "maxLength": 100,
+                            "minLength": 2,
+                            "type": "string"
+                          },
+                          "militaryWaiver": {
+                            "type": "boolean"
+                          },
+                          "dateOfBirth": {
+                            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                            "type": "string",
+                            "format": "date"
+                          },
+                          "dateOfIssuance": {
+                            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                            "type": "string",
+                            "format": "date"
+                          },
+                          "ssn": {
+                            "pattern": "^[0-9]{3}-[0-9]{2}-[0-9]{4}$",
+                            "type": "string"
+                          },
+                          "licenseType": {
+                            "type": "string",
+                            "enum": [
+                              "audiologist",
+                              "speech-language pathologist",
+                              "speech and language pathologist",
+                              "occupational therapist",
+                              "occupational therapy assistant",
+                              "licensed professional counselor",
+                              "licensed mental health counselor",
+                              "licensed clinical mental health counselor",
+                              "licensed professional clinical counselor"
+                            ]
+                          },
+                          "dateOfExpiration": {
+                            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                            "type": "string",
+                            "format": "date"
+                          },
+                          "homeAddressState": {
+                            "maxLength": 100,
+                            "minLength": 2,
+                            "type": "string"
+                          },
+                          "dateOfRenewal": {
+                            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                            "type": "string",
+                            "format": "date"
+                          },
+                          "familyName": {
+                            "maxLength": 100,
+                            "minLength": 1,
+                            "type": "string"
+                          },
+                          "homeAddressCity": {
+                            "maxLength": 100,
+                            "minLength": 2,
+                            "type": "string"
+                          },
+                          "middleName": {
+                            "maxLength": 100,
+                            "minLength": 1,
+                            "type": "string"
+                          },
+                          "status": {
+                            "type": "string",
+                            "enum": [
+                              "active",
+                              "inactive"
+                            ]
+                          }
+                        }
+                      },
+                      "jurisdiction": {
+                        "type": "string",
+                        "enum": [
+                          "al",
+                          "ak",
+                          "az",
+                          "ar",
+                          "ca",
+                          "co",
+                          "ct",
+                          "de",
+                          "dc",
+                          "fl",
+                          "ga",
+                          "hi",
+                          "id",
+                          "il",
+                          "in",
+                          "ia",
+                          "ks",
+                          "ky",
+                          "la",
+                          "me",
+                          "md",
+                          "ma",
+                          "mi",
+                          "mn",
+                          "ms",
+                          "mo",
+                          "mt",
+                          "ne",
+                          "nv",
+                          "nh",
+                          "nj",
+                          "nm",
+                          "ny",
+                          "nc",
+                          "nd",
+                          "oh",
+                          "ok",
+                          "or",
+                          "pa",
+                          "pr",
+                          "ri",
+                          "sc",
+                          "sd",
+                          "tn",
+                          "tx",
+                          "ut",
+                          "vt",
+                          "va",
+                          "vi",
+                          "wa",
+                          "wv",
+                          "wi",
+                          "wy"
+                        ]
+                      },
+                      "updatedValues": {
+                        "type": "object",
+                        "properties": {
+                          "homeAddressStreet2": {
+                            "maxLength": 100,
+                            "minLength": 1,
+                            "type": "string"
+                          },
+                          "npi": {
+                            "pattern": "^[0-9]{10}$",
+                            "type": "string"
+                          },
+                          "homeAddressPostalCode": {
+                            "maxLength": 7,
+                            "minLength": 5,
+                            "type": "string"
+                          },
+                          "givenName": {
+                            "maxLength": 100,
+                            "minLength": 1,
+                            "type": "string"
+                          },
+                          "homeAddressStreet1": {
+                            "maxLength": 100,
+                            "minLength": 2,
+                            "type": "string"
+                          },
+                          "militaryWaiver": {
+                            "type": "boolean"
+                          },
+                          "dateOfBirth": {
+                            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                            "type": "string",
+                            "format": "date"
+                          },
+                          "dateOfIssuance": {
+                            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                            "type": "string",
+                            "format": "date"
+                          },
+                          "ssn": {
+                            "pattern": "^[0-9]{3}-[0-9]{2}-[0-9]{4}$",
+                            "type": "string"
+                          },
+                          "licenseType": {
+                            "type": "string",
+                            "enum": [
+                              "audiologist",
+                              "speech-language pathologist",
+                              "speech and language pathologist",
+                              "occupational therapist",
+                              "occupational therapy assistant",
+                              "licensed professional counselor",
+                              "licensed mental health counselor",
+                              "licensed clinical mental health counselor",
+                              "licensed professional clinical counselor"
+                            ]
+                          },
+                          "dateOfExpiration": {
+                            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                            "type": "string",
+                            "format": "date"
+                          },
+                          "homeAddressState": {
+                            "maxLength": 100,
+                            "minLength": 2,
+                            "type": "string"
+                          },
+                          "dateOfRenewal": {
+                            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                            "type": "string",
+                            "format": "date"
+                          },
+                          "familyName": {
+                            "maxLength": 100,
+                            "minLength": 1,
+                            "type": "string"
+                          },
+                          "homeAddressCity": {
+                            "maxLength": 100,
+                            "minLength": 2,
+                            "type": "string"
+                          },
+                          "middleName": {
+                            "maxLength": 100,
+                            "minLength": 1,
+                            "type": "string"
+                          },
+                          "status": {
+                            "type": "string",
+                            "enum": [
+                              "active",
+                              "inactive"
+                            ]
+                          }
+                        }
+                      },
+                      "type": {
+                        "type": "string",
+                        "enum": [
+                          "licenseUpdate"
+                        ]
+                      },
+                      "dateOfUpdate": {
+                        "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                        "type": "string",
+                        "format": "date"
+                      },
+                      "updateType": {
+                        "type": "string",
+                        "enum": [
+                          "renewal",
+                          "deactivation",
+                          "other"
+                        ]
+                      }
+                    }
                   }
+                },
+                "type": {
+                  "type": "string",
+                  "enum": [
+                    "license-home"
+                  ]
+                },
+                "dateOfIssuance": {
+                  "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                  "type": "string",
+                  "format": "date"
+                },
+                "ssn": {
+                  "pattern": "^[0-9]{3}-[0-9]{2}-[0-9]{4}$",
+                  "type": "string"
+                },
+                "licenseType": {
+                  "type": "string",
+                  "enum": [
+                    "audiologist",
+                    "speech-language pathologist",
+                    "speech and language pathologist",
+                    "occupational therapist",
+                    "occupational therapy assistant",
+                    "licensed professional counselor",
+                    "licensed mental health counselor",
+                    "licensed clinical mental health counselor",
+                    "licensed professional clinical counselor"
+                  ]
+                },
+                "dateOfExpiration": {
+                  "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                  "type": "string",
+                  "format": "date"
+                },
+                "homeAddressState": {
+                  "maxLength": 100,
+                  "minLength": 2,
+                  "type": "string"
+                },
+                "providerId": {
+                  "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
+                  "type": "string"
+                },
+                "dateOfRenewal": {
+                  "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                  "type": "string",
+                  "format": "date"
+                },
+                "familyName": {
+                  "maxLength": 100,
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "homeAddressCity": {
+                  "maxLength": 100,
+                  "minLength": 2,
+                  "type": "string"
+                },
+                "middleName": {
+                  "maxLength": 100,
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "dateOfUpdate": {
+                  "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                  "type": "string",
+                  "format": "date"
+                },
+                "status": {
+                  "type": "string",
+                  "enum": [
+                    "active",
+                    "inactive"
+                  ]
                 }
               }
             }
           },
-          "selectedJurisdictions": {
+          "dateOfExpiration": {
+            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+            "type": "string",
+            "format": "date"
+          },
+          "homeAddressState": {
             "maxLength": 100,
-            "type": "array",
-            "items": {
-              "type": "string",
-              "description": "Jurisdictions a provider has selected to purchase privileges in.",
-              "enum": [
-                "al",
-                "ak",
-                "az",
-                "ar",
-                "ca",
-                "co",
-                "ct",
-                "de",
-                "dc",
-                "fl",
-                "ga",
-                "hi",
-                "id",
-                "il",
-                "in",
-                "ia",
-                "ks",
-                "ky",
-                "la",
-                "me",
-                "md",
-                "ma",
-                "mi",
-                "mn",
-                "ms",
-                "mo",
-                "mt",
-                "ne",
-                "nv",
-                "nh",
-                "nj",
-                "nm",
-                "ny",
-                "nc",
-                "nd",
-                "oh",
-                "ok",
-                "or",
-                "pa",
-                "pr",
-                "ri",
-                "sc",
-                "sd",
-                "tn",
-                "tx",
-                "ut",
-                "vt",
-                "va",
-                "vi",
-                "wa",
-                "wv",
-                "wi",
-                "wy"
-              ]
-            }
+            "minLength": 2,
+            "type": "string"
+          },
+          "providerId": {
+            "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
+            "type": "string"
+          },
+          "familyName": {
+            "maxLength": 100,
+            "minLength": 1,
+            "type": "string"
+          },
+          "homeAddressCity": {
+            "maxLength": 100,
+            "minLength": 2,
+            "type": "string"
+          },
+          "middleName": {
+            "maxLength": 100,
+            "minLength": 1,
+            "type": "string"
+          },
+          "birthMonthDay": {
+            "pattern": "^[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+            "type": "string",
+            "format": "date"
+          },
+          "dateOfUpdate": {
+            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+            "type": "string",
+            "format": "date"
+          },
+          "status": {
+            "type": "string",
+            "enum": [
+              "active",
+              "inactive"
+            ]
           }
         }
       }
diff --git a/backend/compact-connect/docs/design/README.md b/backend/compact-connect/docs/design/README.md
index 30279abd1..6698f810c 100644
--- a/backend/compact-connect/docs/design/README.md
+++ b/backend/compact-connect/docs/design/README.md
@@ -6,7 +6,9 @@ Look here for continued documentation of the back-end design, as it progresses.
 - **[Compacts and Jurisdictions](#compacts-and-jurisdictions)**
 - **[License Ingest](#license-ingest)**
 - **[User Architecture](#user-architecture)**
+- **[Data Model](#data-model)**
 - **[Attestations](#attestations)**
+
 ## Compacts and Jurisdictions
 
 The CompactConnect system supports multiple licensure compacts and, within each compact, multiple jurisdictions. The
@@ -164,6 +166,58 @@ Once their identity has been verified and associated with a licensee in the lice
 permission to view system data that is specific to them. They will be able to apply for and renew privileges to practice
 across jurisdictions, subject to their eligibility.
 
+## Data Model
+[Back to top](#backend-design)
+
+Data for the licensed practitioners is housed primarily in a single noSQL (DynamoDB) table, using a
+[single table design](https://aws.amazon.com/blogs/database/single-table-vs-multi-table-design-in-amazon-dynamodb/).
+The design of the data model is built around expected access patterns for practitioner data, with two main priorities
+in mind:
+1) Compact data should always be partitioned. This means that, whenever querying the database, it should not be possible
+   to query for data that may contain records for more than one compact in the response. The intent here is that
+   CompactConnect should have a deliberately partitioned experience in its data, from the UI, to the API, and all the
+   way down to the database layer, where a user must always be explicit about which compact's data they are interacting
+   with.
+2) As much as is practical, an access pattern for retrieving practitioner data should be satisfied in a single query.
+   DynamoDB is designed to have single-millisecond latency for queries, at any scale. If we want a fast, performant
+   API, we should leverage that performance by deliberately crafting our records so that any set of records we expect
+   our users to want should be retrieved in a single query.
+
+### Provider records
+
+Provider (practitioner) records are stored in the database with each provider having their own partition key, for
+example: `"pk": "aslp#PROVIDER#89a6377e-c3a5-40e5-bca5-317ec854c570"`. This allows for the partition to be retrieved
+if a user is armed with only a compact and the identifier for the provider. From there, the provider's data is split
+into records of multiple types that are distinguished by their sort key:
+
+Primary information about a provider, as deduced mostly from license data provided by states, is stored in their
+`provider` type record and includes things like their name, home address, and date of birth. The provider record uses
+a sort key like `"sk": "aslp#PROVIDER"`.
+
+Each license associated with a provider has the data submitted by a state saved in a record with a sort key like
+`"sk": "aslp#PROVIDER#license/oh#"`. This example record would be for a license in Ohio. Each license a state uploads
+that is associated with this provider can then be returned by a query for that provider's partition, with a query
+key condition that specifies a sort key starting with `aslp#PROVIDER#license/`.
+
+Similarly, privileges to practice granted to the provider for a state are stored in a record with a sort key like
+`"sk": "aslp#PROVIDER#privilege/ne#"`. This example record represents a privilege granted to practice in Nebraska.
+The sort key pattern for privileges allows all privilege records to be queried by a sort key starting with
+`aslp#PROVIDER#privilege/`.
+
+In addition to recording the current state of the provider, their licenses and privileges, CompactConnect also stores
+historical data for providers, starting the day they are first added to the system. This historical data allows
+interested parties to determine the status of a provider's ability to practice in any given member state on any given
+day in the past. Any time a provider's status, date of expiration, renewal, or other values like name are changed,
+a supporting record is created to track the change. For changes to a license, the record is stored with a sort key like
+`aslp#PROVIDER#license/oh#UPDATE#1735232821/1a812bc8f`. This sort key will uniquely represent one particular change,
+the time it was effective in the system, and the contents of that change. The last segment of the key is the POSIX
+timestamp of the second the change was made followed by a hash of the previous and updated values. Similarly, a change
+to a privilege will be represented with a record stored with a sort key like
+`aslp#PROVIDER#privilege/ne#UPDATE#1735232821/1a812bc8f`.
+
+A query for a provider's partition and a sort key starting with `aslp#PROVIDER` would retrieve enough records to
+represent all of the provider's licenses, privileges and their complete history from when they were created in
+the system.
 
 ## Attestations
 [Back to top](#backend-design)
@@ -207,4 +261,4 @@ When purchasing privileges, providers must accept all required attestations. The
 3. Stores the accepted attestations with the privilege record
 4. Returns a 400 error if any attestation is invalid or outdated
 
-This ensures that providers always see and accept the most current version of required attestations, and we maintain an audit trail of which attestation versions were accepted for each privilege purchase.
\ No newline at end of file
+This ensures that providers always see and accept the most current version of required attestations, and we maintain an audit trail of which attestation versions were accepted for each privilege purchase.
diff --git a/backend/compact-connect/docs/design/high-level-arch-diagram.pdf b/backend/compact-connect/docs/design/high-level-arch-diagram.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..eda1cf59cace655464383a50a514574f087bf740
GIT binary patch
literal 105252
zcmZVlbx>W+6EzBl5Fofa93Z&6TX1)GJ-EATa0~A4?hxGF-Q67y?jO(ZdvD!(>;BWT
zr)$lwy{mepSFa(J7Z#;uq+^F6?e**R?+xe;gkdCPAhb2KfZ^exS9Z4p(#so|0v+jv
zY@KbK2pQ?6%#9tjn7<&3I(&REKpW%#pe+CI5NV)|sgoHYGdmM2JH4p6l@ri`UewCK
z2`CISvNZ;Njd65x02)}sxMiGoj8&bt*5NPn>&0eTRPpQz75v14Ec1d5hF=f%#<f9<
z>}{;NuqG~s9by}8{Om+C`av+NJXxqb$*LEzyljb3L=g+u8GzjL(-9yG+Cl`^4>sVM
zp!el`Mdm;18j}-sJp8htqXXk1eM~!|n#FVoMC`Yl<gT5Cw@=^Csp8MOWZ!)L!>f0!
zc%H0a=FZn<(muV<%dWSsV&8|UkC(^KUA^}W^QWWFw>#grjV^V-+r8dL-?c9y|Mk`<
zd&bA@r@GJU+QL#~;?>*rOXFE@6#%i=F3Dtg&(F#?tHL!)2BhoLL*V{Io{OJ!lpJ|L
z;0|^yw-5dU9n$Bw?h|UidSkaZta_thN>_(x;@inpGQr3F2;IuZQozUAiIw%;SXaK>
zSeH3NvF|Ir+-Hq)_50Q5+pDkr%a*JZe<k;rm21+*Wrg`)pPEOmv(p<4pyA!`WTpOZ
zICu16LRP_Ol8{D_<+fmPe13ui-@Ff|UiVzv(tW&vfXfQ4@EF3A6!Nvfaox{jZH~40
zup_Km4!9oSvHRTKbkbchU1>Hc_0NQQ8`XilUO{uzeCZ7e>#mFdTNFBq4Ve$_;Xr~#
zIX4@IKa#Vp1<#<R<ib<q@15BwFDjTYmKp)r`wIjWeF=Uy3QhpMG_~yQ)8@3z&qI?x
zj#m7Vs7nndrKMrgqXd?<1*_W@y}}`@=1datQKlUS(4Y@-<kS>(K3<sEOvNF1+9!hw
z{v~CyGlG}8+A30_coRX|s9G68>LQ7=>v0kk9|{$t0mlt#0GNzHTj)ixP`?Y;M}`*b
zMxzYk4O^n)FBRPtjinoTo#sx@*NY2tKyggQp$U#ay@csjf9$~@7l9+DK`ODk{vMnm
zt|FQt_@M-d3*SEyP@Tr?+CGd}q~)eQ2m(V)*L30CC<ewlM7~UxA4t=s#GO-eWb+Fu
zSnAv|*fdQDDwzx?EeSaTQU@G=uMw!bND3&p?c}jBY~jmGq6Uu6yJ2nvM~L_6wOoFO
z5U88z${Nx9*lUfHB>5OkVl?33XSJuZWKW~ue}PM&p8Io`P$7`^-5aBIi|p4D71?jl
zLE(JSdVgyjnbn}mD3*`$y)Fosl2%r!h0L6owSjV~KYG$WglotRLCb-3&~V={0V`5b
z080mtBt;#oPO|^Im`?l(A5SQrUJ86`A`{WdKdNZ`*o;f|IMTxKG3kMBz%ysXR(>=x
z{vOTzS`(^K+4FB_X1EKtqqoti8crJeM(80fGl$*Fiqdf+;mdSX-MP(vl6}E`cyXoR
zK91riFc$dgd`4}=G+7O@L+GH`Ui!3d1~?kwk4!3Ui;6bRu7OO>1zGv;b{3@O2wl*#
z?7$06)Ip&>x}eqSvApR5^-h7cMop4HRhk4{5#nc}LPwKMj*`F7XT@=<n8p|Nj22Ll
zK@J6os;TY0<Ju54%QZ@;f915RouC8>91faOM1yhvjtoF%YHh1JRS#hq_xaWgI##vV
z?}JA&AraS6Sq8If{<=IZH;bV~PEFkTmhI#%cw%6IqPfRdzp&W+4b_5%5?A{6l#5i!
zoTjwEaiUUH163$}-q~onUCH3&z5INxYOZvRFSB(?wphwF<`J>@`DD@FjwRJ9{{iz8
z#361awh_$2ni=0IRx$J#YpMF7@}bG&ef{S}SH&aW@sz3U0ieVg&Ucwo7SA2Wy{jOq
z#&7Ag)XgM|5i{<8?&hw%lyA0a2=x${<)~UZgU6AL4GQCV(_$(ZwP<S0P7l=PgJll8
z=s5SEco5%Bevh^C)aWmqzX)7kW}Cj`XN@@-1})XWOXWAH*TE~b70IbDkpTe14{{_#
zsGa7>gISWeprXq2e>_CCy@9lDBsSZQCQM$30H@}D?&Xm&*A~y6_GkhHPBnM-4b`Zo
zZ@5|JX-$Vo9~`x@TzHsV6x_k~D|7?Ik3v&)bICQ#$0H+b>M;uCwpZK<1ZPrn*IvJH
zX4w>HyG@Pahgl3Ir(Cd}1Fjk4Oh=6m$+BVa6GHk$i}o-srj}KD6Xy(MPaY-{91xe6
z$hPj3)=2K+vpyl&W|k5Zu?s0wG05h&VpWy`dS>7}qIa)hY56CuQW{zn+E$kd_T-0q
zX45?`c2#@Vq}7@tXUo?IYEKLcznRue{u>9y5+4eWRuGZHJ&!J6Ca_>-Uf|gC#txSz
ze9TnHe5Sm<2h!bm<dLYP*Ux24iHieeJ*d>XiZU9!;+{t&mMkt#vre|*=D``%kkytu
zX!3h*EDFvoSFk~cCQC|2nN(0O2Qq4&0#L^#=^>RZc}<DEPVXtCrK~OI=EQ7WMV)P`
zMSoCQ|L!ZnNF+TL4W+VVsdW#w@6SaP|GqjhP0dhJnryf-KaKHH9?h1UP_^$Ms!&Y3
zc^GaC!5R~E)Bn!?E3vROP&FI{iN-mWW6FSud0(FK@Anvgjc-PY$ulJGl)T_)IL%zg
zttL)(ir@fEW<s_ROGshZR+GPBb4pweCz}Ggxum^S3$y=-8x~ixovQVnYoOwJ$y{Ty
ziPbpI;m7@XalGgYI;>_m4hiVUk&@8{r;PG<X1qh7%gJqu@Ithcq?E~iv;`<J)PG+e
zn{)?TU1d}dLkBZNRxQ$O2}2Jw($>ff;W8wvv>IzZX1<mh{Sg~|Yc8Ui>ZNU)Q>Rr@
zQB1Ig)TfrAny|yMpr-7%az5#}lD-Pxf^1#MX6$ZXp<-^)Xd4;@6}*gEM$k6yxTL~=
zRP}PAEu;4Cv@lg#?$df&T<%jfNu;NJ&umlf^M=2GSVA*)(@^@V!N1u6;go8pV2b%!
zMoVa?$tJGlPylRZe*rME(gv6#4(mN<Daed*J~uE}m^YX|v%}pKi-un**B+_--X>jV
z>bR^=RcoJMYV~4QIWG!FcTyU-GA%Ppj@kh)=5!^NoG2mbei~3Opo=9@c@D4~f|Vm)
z4y;swlv63@!2!iAh;-ZSo?y!r2UER}xnNKE!(M?O${*|`IYj4@9V)$wHzIKaQ!Sn{
z1)*CSzH>l0|E!g;r=qNqG@kkQ?OmR+qbLt>kRr(=m>x_`LkUo|P#h}2-w<_RvK~D#
zG{>d2pwgV5)q6!44heST54>kyRx+(IqV`E1V;OkoY8kJkt-{TK%bwmQ0h~&e4V6_w
zBi37)ZBMcQWxdD8=Md|0K;>wxR;sSQ>zN2NN;&rld05>mlhTS+)V*DjPv;9eyYAmF
zydRqnt{wH~2TX2!IsL&^Ww_faQ|M*XudM(<%(XBDe!Q;`#L(0-DpjYy`X5(U_EovD
z#Q#DVYe;C2Xp~!9APTg*XAsKiT;og~?#aq<up6ay)==ZcydSmm9E15A(S1f2io`Ht
zbsC!lJS1inH>4Mn<x`#fBUFCw$sp+G!NgnGRI1wWDr4O+_p<NzDqDkPhuy4h!gL9t
zX-N>Jubv$?30veUjS!YC+Yqr)PDgQmR9E7wez&JKHy=xiA8aPjEHr#okrG{6y<r1_
zo_S)5m{=avUDAmET)=!jDnH5X<?_`{3@2h&63e=Br$YpdH0BtKm&fvLkU0fNpN$wb
z#{ub99+=BvE?Kd?G7#jf{`u_ewz1_|68m({xLEg#SrRuWF5BzMdZ>dF#b=Qz^^A(2
z1{&6d0b#Zj_-3<Ual_05;Vgb5!Om9)4I*^2zMENg94cvznL6#*Yhm(j&IEBQ+=5#7
zlIXnN-J}li40UM&PVb(RsZ0&oEsB|gh^e=Ti$+&YNYf%gp17Ndy*5{pS1KJxth-~Y
zM)wx`vQbaHP=lRN_q-)n0_8=%gS^MsE0eQ~J9|a${FI-0jd@!$J!!K@2HAA?NVSfs
zWtB?zNt>!O$f1q}vvjaT@1tmnGB}n@^n}W%4gF9p-YTnymYgp-ah+)eFVdJQwP=MK
z6TGS_+Geao2UZ1;*4#%9=D{7Giu?I-FDty5DKRzoibu-m35xHv1)z)cqS#i0#5MN6
z-6j9<&+lFyCIA}qJ=jf`_dc;adM7V`Fh`1wbk^zPx~4=NgtqDs0m%P+y!yCXpyoZj
zyZ8xKuA;bqpV@FNpgkrPDYXg9n``|*zY5JsQq13MT}Bb8B(NQE<4AK8+$QVoO1MEv
zt{2~PNxMQW-=oe3@}w3YdE)*mF|Yn<p~TUTsY0k+5#zv}ruIQ^Ic1}HIN_cO`C!HT
z@%S>wzwv7Ju{?&M;G<id_6(HiQP~*h#F-hA*#qIn-*hcyUoKX@Z;!pxJ-gGcozq(*
zc0xc1-JYa_-Q2b=K*mMe3bt_9^#N1EJ&H}T&+RlS=b&&R8-DpE|Kiom+^Y;nN!V+V
z#Oabmpw{T6Vr2{4_|Dwu)g_z6YFx3<m1KGzi-}iH^;|TbAQR%WytOG3%YO4yr&R|;
z-XMh#@&dwLA(dmq!yeyYz@BO~04enC69pULT5tRy_=jH28T0at!*8wPivK#E`Skmw
z^F)B>x$UU)eoxNGLqGV++>@~3vI(kqbSs|ttKE3ek67M#$XNqqv|jXF6-FHY&-Vy-
z_Fwzu&PlQHoc{X5U7xKln{naaf(kjFvQ&Ziwn4FQHk3X1(!FfsGd+Q*TfWwoPVfY^
z8|``<XybD&@l^Uhf9rFPs-DY#E<e+ax14kWFEf?L%(qKnFowrpzxmxjeNUrjIRW?C
zG_8Ae$~TMrx24AIAJXoVA@}^zEw}q|yqU@F`boY<*Jt3{rlp6ih)Cf(5B&kL#h-fk
zjJhYVH2q`z@sT{w@y%fY%}Cl->I$|`bA>%xW;Q<m)~6s@*dcT-F%en1Fy>y%*)2Er
zjMnxJ&y$I+rL(0NZ}9s4$3XPdi8J?l=M4hw_2hOK*tWSX&pQtMxYOE_Emldmu}6u3
z56vj`M^m@8j|}4sc&xKQy1t3QdQKgj_Mq)&X6URGwHpl02RrO3NO;<7jPYW{M5&<W
z?S<&~yh@EnJFhiBRi$@nklv+=*)Avn*Rf@(yT7nh{>UNQ<hP^H{n&fwHxF;;kGu(u
z$D6w*@Ah*v*$js0hCdFlp9q~cE25VM)M;kKm5;wLY8^-fU<H0cvo=^!`imt7V5WKO
zAm_K6_6MGm41?P0dDsi#dV+6C|C-_oy_r2993&j7Z`R3rED}Q_lP~7$&wFTyk~bN1
zPLebsZh1SuIVo<$S@5#WrGr8hjfgKiiGUax!^6rn%92tz!fAh+1e2l9i1l|5(--Y_
z12%qBN^e3rqdaO&8JeK{P-&^C6)W{`=s`=C8!S|0Hc;OVVl~%q_h*va_l84xHne`9
zT5OOl5G+_QYv@al5gm_CRvN%u47$Z--Z*p*PtCg<u*faYHt>vaPSVJ9PYD#1NnnrP
zP3cHxO`_X*i>`>Rf>no3n2zS{<!W5EW45TR;u2N+RUyGtBELB`WK6ygu6!12zUg2*
zx-RUjD+{5^F;Qrk@}x*Ftu$|Wm?5yGt%?;d*$O=uc}sifO>XQ4Horl->5uvfg}QaL
z@NI*+p6WPm48}+zcC+VK--5~L8oUdc5AOl%IfzT@vkldR_w+oyDkKXYIsu<*al)i0
zKc|*(=*TfJ7Sl=u%~%{`P;_snY*(sBo#%I8i8y`)W@MD$NTU<WGM@Bxw>YX}poolp
zFxM6=)AVuuaC<p=<h$*(4fOfH{-W*5)F_=AYKj_n*t92Y#?C}6?@7XT?obE;_w8mw
zlZ7OL?qE&{&AgT#%rc6UJ|*!SFWgQpcC0pgn$JHV!F{oLrWtYhse^1nmDvMy;dEA8
zDguc&C&Dz`3``v-uu2*Z>F#5$S)p1Gh7$rmauf)go}zXN?TqYOq@)6`!u0rVL?{1I
zBNmdvN9?akrY^?jSq~Ret3hToe<fXjE{@lZn?}uo0cX;Zm{*J8-QStqtC3LbXX}Jh
zcSU@u(1WI690MFqd<*{$lzK?iCq+OW0;lb~rw*P-xWG>7Tl^h?g^RdBWM3FB(x_uQ
z!ISn)P=|r&!#5n@!LwVhb$m<Du%&Z>(J}|y+BL1!YZ&q5uBhh81W%qKa~_$ZoN3g8
z!x-p2B&!Y&;aS~(njT|_T&I`_G|w0WNK+THZ1I467Q;pvaDWZ!V1k)7x4rlK<2>OI
zAbN=)I(P+2e>h#=mg=d>iPb`ZndkW7vMswOPFP`1IK93N3x$qbc*_{GA9fI}y&4DO
z35B2{hSM=QbWhqzf8!l?CFP~J+x3Rh#RvTlO745L<wal9;^vEWCGUm)1#jj1!XB-s
zwcdH7Sfexm*VEdtx*5a@p@q_Ul&<yMxjy>nLA}M^47xgxAkZi*#)mNbR|7@kjlFWb
zhX=s`P|kBlqLo?rRXX^$=@}(y6Te57B{Abq*dc<2E0)=HK??}pwq9~(7y1#$p;J*4
zq1n2A$F@|Vles9l!0S+VaVMUoAY+r!MyqA&*qO)h`x|5O=0<MoCNuFWvoStL10t-z
z7IBHez;r)-bdJmUhga9$*JgPp=-6iT=+L%e!@lM{XywYoa<1sObzi7mT76Kxj{g@<
zvsT_CaVcL&=m>=aeP5VN_b0jekk<^@Ja)cIw>pLCs5K}-EhV-58wRe6BtFQ)R?9W#
zlz2B}fMwKm-LW>eV<y*=cQ8lca_Hoxnmy3b3kW2%dlm3h&9AAXgTD%Uvibky%UVJQ
zAu?G;Wn@$Qag(ggnm`#(*8RApD1qBD#M-fuC$*Jg@1v@d$(A$O9FB;UVc+ISov-cY
zFsot%pVH>mtsnE1cg08Uf%bAl^Sb4&c`N?n(fEI^rmgq^#P=+#_|r$@72Ef2Z-7q(
zxN8^rE1SxOGpN2VGkz=cNqP+DA-vc6-RW!{bF9U77Ikty<26(!RB5E<oL_hA`+hE>
z{G`{nm(jkoCOy5>VrMH@k)aS}tLQ^ag42TL*GwCj*TiT~?yV>2=RqSM|E|v!GoFIh
ziA#@;2kS-Wp;aZMpfdH1HWMzgsuio2J%{j<3=OGkO+r!(D*P9$0W@zVp`zWNQ+bR(
zG^j^6g+`b$eK3o^l`(+pbc1vz3KOE7S<21-Fg3>Oz;}vMww9tDY3xEFetR|EtAb^)
z04H}8_nU#*TZ0>P68D)$zmT!-lAW;$W^vZt*Sh{S2sjzNB=F$aC0HfMan_sNG?l<b
zyqiE(4a_n*-ms|Af`3Tes)TGq*>hDgbSm$$VSU=Dgskky=T5ski4N$nW%=jRT3A(^
zlAt|C!MCl~i2b8!WjK^l*SXKL--5Zsg&+IivB?T@?(%2#l}Z=8JXO%s--DI9;Wi)W
zqWb#G%!_j?Q`4!;%ni<S$VwuJFpH7kveR+FY!iiAHmQj~X8w3^cn6b%0$DO|=ft%2
zM1MbP0iTMp^dVIQZ^~+73tPC=I$kWcmK7?4afyYX%FwzgBnA3mmtEg)H+w|8{6t&{
zC%CWp?h|T~uW_#XZJkedY%hks!*01}B>efZOn7HwwzdT5LpE`sDyeZkqU0?MhnAhm
zg=M047iO1xC#leV?IeW5e88t-sBlJ*cv>%2|04oSOU4TAzDM;7?^UMR&pjc*DxmR8
zt(NR3AZc#Phn@3~;w0E;mKihItZ_4pHMbQ2EJ`>T2?3YH`I~F@ceq~uz2T)-9r{p<
z?IJB%fzDU|-9gn0!MU&^?4OqwXKLwWtd)zgh2dl!c|l#T^?#H>9%>{aKw8?y@({{5
zlkx61hCs~iHt`zKu`1MIm~&pD74jb->x^W|%0-CWl>vVS{J4_~CHRzo)ysGolb;FK
zxcj)tYDsuCnGpcC^Ouj`=^9nk5<TZT-NkuXxN2NU{;2<0?Y_z4%R<Ef<km6vs*B+)
zo8u)ZeR{e1;&G$eoHWY#l(}k*{uhfgl2~V8G$+3C3i?w#DQfx?YpqF@+m<ZN2J4j<
zA@{$KvYle3DVO(3p_%&0y>t51=Vnt=!okyNC(P-vOk(KI6?}VzRcIVnnz-|lhG_`^
z-k$QXVmBU@9+g$RXsh<um$@;lKj#h~)GRt34eT2+CEb6ZIm5&+s9jb|?34OYs)P%9
zl<TCc#Zp%PVtJ4Nrj>)>19{nAT?V5Zc1?CmQW2FbME-0zf*R4w$qcX+2i#2vEvcCQ
zcJ5k2#&OBgVyzt_StirXHK-Uf;X0L$+WuQr9~Dx!Oxm2cTr$~5aJg~S>uu*I5k13k
z;5owq1>%70%$A)4r(zhMcwF4hFl4``(PS?r{%OV)m8m%8L+*=4NE!C*UUA_Smm;R_
zk$tm_&Zd_Kf%|P;D&RQN2ic9o0olzfB6WJ;Pqu(G7NSi0mCqoXlE?a0rf4wq`qN!^
zs6r|Zs(>MS;xRa09?|XJ@Lg^yjQXQr)V(W%DnzK8FqPY+EK(7ccQZ|kmVAwk>&1S6
zNZ%9;xlri=>~$zz+N+1$4Zb^OEL-Q->8sWwm)B_<f)~o96z_*zS3y-S&qtJo26qRo
z!`$+a^u=Vx?BNYzSi%pLGpRux1^?2b-^iWK{8lhj`JbQTgm;-`cNooCVnmnTY{!~8
z2K=C3(VC{6?SR`~>0wpzoQFYV>_)oB4Ozh!Xk}8bq+4{IvYK={oTaLrFQ-)KYt@=C
z^A)-)nuU?!2xA`Fk&3>#OY1SrdACE_GERI4%pl64m%6d}U~s0!6QtTUKmp|?X4yG{
z^CYv0(M=$b(8JUpoO%qQdsvfs-dR}3<!_Z?_6}$s=QINVS~h2!Q?X!yy0kWCW*IzI
zmD0d5ZTw;^VF4_H3{5+a5d)$|;{vyPh7$tpGz0rNEBaM*ZjsjD)~nqA5F}M!lAfWP
zrF~22+hWJXutxCE`kaC;Un!i5=}6ZOMGz!LUIsF%y%|k4m;u?aI!rH?r1`D^lH8Bs
zp2NsOE?O+BJR2ConwiFQ4)EK0=)&LEhNHBV;#pF@vPVLPU59uDAKSCT_AOt>kId6Y
zwo4*0xT?%JMS{r_@E9YH6ptD7N3l++%k)2EY}RC-_^L4anFJ~X8Iwz5jr<@Ix#xm@
zH5#cLZ3RrEaQNq$<1wk*Q`9c`;b+DhB*aaL6VpaHH&xu%_dM>SJRkS%Imuspxs%UT
zWGi#EX8SrqjCi##_~U!YU<n2WnR-l)-xeeClqCa%YW?QlgE{|bs=ptnrP1OHy#)>;
zkO#TzgEv=`*ExCys00;d3977>lIvNiw!=~?JHVKz`t8O!>IO9ZVIp=9bkqoTR#Iyl
zU%=PleTicL_DgGO;FBrcN>3fY;~&k1S0p=3LgYWh_0<w5hV4+xQjgkY9R9p)Pix`I
zI@~ay%GJ=tvs6jb<aL~Oa5dy;vwzJgtc~1oAY0}ztIW2+Hx`Xw%27b)e;W&gtHpPY
zn4WLILwW+#0*poLdY;vuEpP4wh!Y;mX6H=H&9_JRiaJcofpK2OJf>Ondh>Lx$7#bx
zrhV&f>7$%NNnR}#ovV#WE(<Sh*4md?wXc&4u2pI-RpovAwTz1p;MwvFNHO=o<fg6(
zl@RmOB>8OBkH25BhngghfhQF+&T=;_?S1+<EWL3xe|6|u28FYLe+-*4fB!o_-D+|Q
zBE$82RIA-o9Et3hlq;>oYH>luOjZk;(>r^NO*{mG%;{#=ZRugxyWvFN(LFyx(Jh)F
zM<%8TSlqyg<j)t4@{Y?~3f_dmB0+CSndjcbf;%5_+Kds3x*CeJYJRzX%mHwQ+lCbP
z4-Q(XirCC?dRsLwPMHAm-5_k3x=^`*gA0j2ol*cm3j;33`472(yqtn9Bo^3*gCz+^
zE<OTa&!efQVuzzv41fQWNL+=01&4%8FNj1!)r)?_Iiz32<vBcgDew(-;M&HWZ<yal
zVv@$n-5{=rRHGonYc<OWUk?ZSsV9h^0i=pV6u?<3ZMmXXnNm%H+@&#!k&k5JJ~QlC
zpAeHK)&MnP{%ooNMcdW2Euotz35m2wpADXN5Saf#g+BVTOX5A*MALmsg0#bHD-MMM
zl}{i~o^d43sPNzNw5<&TjSHl?aKSg|Y-mD?vS6P<1(CrSFF~hP!aEVIT4q{O>>E53
z@ic)n^L=80PK$y?35-MWR2oR-1nFZ2V?n8mc7lQ``yMwU89dYY97Vn}`htNtnAy^c
zX+^c_F3HdBcVh_xz2IOcj?Y+CQhCYLK7q8vg1~+|>?l`1tP*IAibza6Dkvez^rUdd
zbR-yh&!+f#z@f?TlOPY-?hcG)7C(p5y*1_;s=jw%eM`^1^$A#cCN;P~A_A;}sG&3>
z_hFbJu_p96*`(ddsp_(w^S7jtfH13|UHz{OmyW(WPchCG77*m+7BQS-6si%7Z?V!{
zqBO{4YhCJXy|u1y?mk~VoQ6@j=0BscX_v}a$78tsJt9mu0li0RMS&uxjxKE<EBc~@
z!T}hBRMn2YANYiV+$9%jjw>Z2`F;qQKLtrgi%f;{T-Q?ui_?fzU%D$yWpwEO@VkC~
z1z8U*rkl8|6iXA!T>CGI7=0i`O}ygAAjOa9x?t2WQwMJVkP`=A&4=1yu^--WK9PV}
zIrv<JOfi98A6X)ycQEC#RHLX9J@-%SQPMogFIIn@-7+{Z;Uco7E<&Ln9K$aG8NXZD
zrB8^l#W>u4Tv+oA)uK!!NE4UwNtUAwmFX9^Wmk;R0>DiGhoTXUTMX5jcswr*C%?36
zqTLP0l{Bv1^16B0CQ_z`*ivz};fvldkdIh83LQVmllZ!|mK|?s2_u*5P*GpUvC{*B
zJi75}>tvT|x!IpUX-%#5beYa46;h@;TxYWy$&;;4iwDegbe6FbcYec%nr2_yF#Vjn
zkU~pohxYM>)g!R<S<-wX`QXZGd&XPChd`_JatuW4t-)tNPMm%RrK@n!lNmDi3gLRm
zC%!oZ6?V08o7zV1b(+5S%JTUUeaLTZ`EkJj|H%4zR%~@(s+{W!HPJ<YVDYh(IX`fu
z<F)yJ8=sFqySG)(SO3=s7S_}0g*t0QSdAM@bm0%?T7I-0c3FN*i6F1Ce(KzA{bzgu
zt^f0FNj9#terC6Nb_O1P%4+NQvR7Ri2fexOp0Xjfm_<3Dc*F)#hHg{Z$1*vz*4JS}
zjutZrqax}P`xJ_QGgZ*XyRV-15*%my;4=1K<d8o-81~Lxrx=c?fTtLBNmR$^Pa#TX
zJsIH(w}bEfK|L(cL>lmeeTT#rlCzMTvkf-m2P8*4HZ%|s)7=ksgf!WWoJqz1Zy-a&
z{HRh2k!N6XtT|YeGD{{7(_})4{{#;3?I%2ujC!zO&c3Je4@TrH+=M@mG#fH*ltZ#;
z<KM7%j?pL3O1|k)AVVO`O17hmNQT%>BmnXwVM#kQvk3()#0W$HD6EF25(`A10NSAj
zydt#}#c%V}M)8cANWg7n55oQ|Ct0-E^@yJ##qpxoe}zKFR8X5ZU_{^xyY-jF6_^$D
ze-(!P4poG%K&}mqB<Gw6WdQ`ZiG_VT-VUZ2__-@Qrr<+gr%Z)KgL5uGL!Aj&SV0)n
z3NYJ`L0#uHH0~Hyi<|zPmGdW-NhBO`#DD|aWEWAAEG^J3bC&Fiq7rHYoC(64eDoOI
zU@`&;-vP~>u-}5LmR;mwCqZ1cD1r?aMS85o%9sv2T${37L1J@u0AW2x+^291j=Ukc
zW$?rVw7W3;tS5duk_VO#r_akJP?f~-`}_V2o9niNW_LR>%9ydV!)op7g~YxN7|&fd
z@YhLzJHoE$6A#DU?#Vf1yk?`KUgryFA-THK%X{^}a-yoG55W&73I0V8t{(FgA-~wr
z49%NV87%lG-#>7Bj1qGE2!IrBP2YTM1|%1^`<9(~pPIh{io+tPnFhaE$j|$dD@INm
zgj>mR&`FQqGTJp>_hi0L&!eZ&it~um1!4IQ@IX@-{T7R&z-|1hHm0;-^b133D*ZV_
zoFEr1t~Fe$Cot=t!bIg6Mp;1%lz0y8O1h(lc;C<<&2lzPgvwL_M0~E}FSC7>lAxN5
z^iW^Yu0JdVzbJ()`JZ95qhi#5AVIIL?ojFX!e<3sZW9t6rSaH-Y`~&iiy-9{_mR$#
z>iDG5_6!zUxmwwQhw@Pyb?(igNV+@`Ar18+y^^=ogu2@GD6Z!68;e2{KUL*w$S2Aw
zYqhbPtf&b<x&6|*ui(UcZRdGUaWHsKagk8}CEiY(-JcWrBc58;F~NKPo=doAqI`e-
z(v-z`_ok_CvV7<R#?)Wb<zRf1LYvozYLD)jy%>%>VhGSOy~k<U@ppp!tfzY_g+~_4
z{;aPD{Xue-mn`zoI;%(h1?LrzjJe1FnR8vn^OW)MF2W-(T2PJzeqg1HGXhn#g<^r+
zFnD?})Ciuq8BFwH68JNaW+0*YA0`fpY>S@bHI7;_Fs!&qS3)N}-1_^uN6Bl$pfYhH
zt0owyopbwEuy^^*ZWTvzMSy94iwk&9(#~03iqPQ+U#S7Y@+-qG-`+2=%}d`*6>)X~
zUJJg~sW`({BMEzU4?(1RNV1J2N|9G5YK-y-Rk5sy{o&{2TJ^BXEGm|uo2kc8Rt!sf
z5q)R!T~EZ25btU#UVMN{t_=_AGW<nC6|O?B55|c{v&~x})Vi%L-g$HwVVlOzYYI9b
z0m(N<n+#Cbs}>=~3u!j0H1z3cIs8?1wve0lQL^=qqwxAWcsr;J-%L62Z*CrRT4No(
zym<uPIZ2mzYBs#*fJG5UDjR~6tzn+OlV`znSi4Q#3RKp?fA{E~VHo3~`H`7hl5c?(
zUUB+=GE@GA!G?<rsePbqMRL2<B}@`cSgpft>FB}XxLO?Y0@9=mvGWx*QAVx!F&r3u
z8^TUIby90;mY!mpF$h(hEQ)tFaVyJGT{ZWKK_lz0;)=ldBp>Y52CZhR2&|%x=YJ0$
zyYQ3L-ZICQy+)S3bet6gm%|2o_?+hs+McB07pIgJyOkmM&%eJRR<S6C1mbN5{q=gW
z^fryMhX9JtZOfW+uN>%IiE5?4TJUzun~79-Feuc&F=FC*S0Xy&Xy(3vRCY_LdSqn%
z@E?Brl|w-mT?^u<SzYRUv~)HMPR)s0e)l*Q3)5gQi>EeT7>X^2u2f8SOXHaP0}Bi8
zk7T<0{zo`Ogb`K1w~D^<=C*$(P5qw8l-a&PABkKol>VOy)&W&xSaFz<vIToXbZk^H
zIU#ZfqEM#Hv%u}4%C0-k0gS!qiD~NetU!?>eP;soqSr3hz4U@SU-MXn`N;9hRXgiR
z>~ip}#YKr5tof#3?9ORS>k^w;K0$~Rmzd=s)ao(Z72*vOa;7M2m^Fv3EHKcZ7UF0j
zPW}dCwp}wZym|U|0<pcUzZG(+VqV;;Z~g7wII*8CLoL2@m$tyYkqX^5_b5HvZ7b4Q
z#;6{HxE6lQPj5<~;Bv>EH$T0fZT?NO@arW?##kI<KnZHgHM@J$P9QT!Df_f`3mU{3
ze>KMl|EeEP5GwtvOiOe|Bd*z|K0F+*UEtxUCWZQE?2%^4SCxo-E$N6{8>V%1)n3vj
z$KA-(wY|da3xfTBLCEz+byex%HwE4Cs@Q<CjbG(uEl<%UU(y(iD*bm;F<f>{iM~{C
zoX>-=DJH+S#e39I_*9$D=RD=EGq%8c<SjYnZgw_=ZM1e67k|BO(U=%hwPHcof{_4M
z=Co9Q;gmkzrd<9$h|`uxvs7jEnyLcvNJ(XsESBBI^U~q0e7Ri1Y}uAQoicjtlVVF;
z!G>Ri*Aic6n`)60=qi94X}qogbC8*8$>3fG=VRjt#6fhjSaY2DKCVo&;&{JSWB@*&
zj@df@lr{?K@x^X{^WxN2T>=NVNKHhIhf#&!4;Dl%69Q{N8Wzu6UMFC%9YQ+qy3wCi
zS37`}DXyspPPZm+Dtb?`1J(^CcNs%E*Q?W>Q_2Zh4wzs(qwk8uR-eBJc*{e}-ZZx~
z_QXWC$~~5IRe#X<`^*n&+Br4yWvrA+?Bjd|Tv>v{kkA1umHAyk2oh25tUewN&*t`#
zc|I!`?_GYsP@zl}k{;G-zuSMotkg-&1VK7!3}Zk4;D;>}*az>E#i5CcB+M^qMP=_0
z^b}x@y2EzEVn2){cmOoaQXRy2DJV@<fAPHC{fc3fgBLr&6H`_L>O_aeJN!1ufv9<A
z*15eQA%FEXN;wqkUiU@^<@O*J+Yt`!cX#!DkGVlF%%sQM)mpLCIkF6Pa*#ZePM>=t
z;r~Ev<@9c_yjxy&H7(D%_)58_vei57oGR2&RXgozAaq-ziE@?F{}6BUo7sxyX7OLM
zBa>6T)G6ZV{*MjHn*6P0BGsm#T&#ep`>aOMSJ-p{nJzz=)c^-C%m>eNFxAfBqs|Xp
z)?c7oNF({AVrmw(LBXDv7^?Q*iff#z51y4K9)2ZeUf3_dV5hF8Z_wc==2x8h_l}+3
z{=N-<n2NU^i>GIGtlp+g7~1iWqr2$xcdV~9b$Z8yp)b}@UR?a(%(+h6=U{H_VAn2o
zbjluF?cB24C`CMD*KP*dzXw}(?SymP<5m^>^fhkTU9fBW+HyK{?YuzS{*#o47B+n7
zEdN+DR(n@lSNRlDdv{&%ReR^3EOK4=R5Mw5DE%1XF8jO-KmD|M8+_P-qW+L#<%`<%
z6-hx<eyygwrEK`1p7qL^^_5AJ%e~c$J?vBYu>9`*E6TTOnO*g%I_+ug<W;Tm^J4zJ
zeDSks^+OsWb4O2hMepqM!s)%yd`osgFa05t_1$P0iD8jh=XS66fb`Xz<$a@ilNnR1
zZMzPZu1&AwQmwig+FRzSF7{WlfxdJM+6swv4BB%+hw7J2R3T8as4((gAr?X4Ros8v
z{kg@fXxuD+iXoX<`UxrR-7L@L3R`HC%i_fLzCoLC*)M`0;%Toy{u%BVw=jp;prE<5
zr-Vhh5qB6^k-%nlyJI5R-2Y6-T?oJH^)Gjp)}C)((L7K%yI<K{rQX(}+-YraYgGND
z>A5Shan}0QSIV&v9os31JQJwbt9w!gwl%7MQf9q1YWSa>H<r+R_H&GLLwEqsj5ppw
z{7XxlnX8DW2Jy<Gs(5s2_pb2AP`fcwvaN>dMjqdds*o1>stmD^{+>bfv<%U^T`Cs!
zC1&?K9o9I(yur7a>x_bu@^S`Yd{Q3iU3DoLJXh>2B61jxWADvfd{rL_zjygk;ltm`
zG-XkRANKk|xT!OA&jSKLqpN(^b7Fq{)BOHs-S8_UbdrNi=VWYxJteef9#S^hsf0c%
z%joo4*~2N#jX=6$?OMHKn0@TmP^Sk1GlH2!1|8_RL<VsuQaH1P|I=|F_JJTBcO$0&
znd!EXbu!GPbESO6NSVIs!V?-!3U060KI;uSkWc&5K`1SzovicMM2MxHjri@&Qoq`d
z7n0WGCc`b|dxyFHEy-JlxtA@;oByoh)vTg`=~J>|TgBODWdq$=kvDbWSgZM#@=<{3
zDw^x5cG8^u)9=#!(I>Ym&k;l2@CJ9_9u)A73bqa>MLmdH{N%*kqGpp{ALhG%7>FPX
zf;#KA1)Xwq<o<#4{s-fh)DSkkEwpv_eu4;X#jh?d6EjNOz;0WMv!tN(#E@45;_411
zlj=G;6$N?r9s(kt*gh#oZiDQ}!dI!!@sHUUow-AOd4Dx)zJ5)rH24ChLeZ6CmPLl<
zR<MIb_8gWGcnN3L85VpyXK=~75Uztk?M<ysKScw4s6?vf=^(0<SuZrLv(`9tD`QP7
z;zQ(Q6smUr$h7aIq081Z3y+N-v@PdfRRY<#MAaR>;EA#j7u`u-lJYhbqM@P{U>;i-
zH8K-xD#y#uRt%!CPZHl)bu?s$-<eZ|G0ZO2caKHK>Z`YB!b8e!W<6M}1ms+@L#_X)
zi(4H|u@B~%asiLf*=exV^uWW#UA0_zafnJaip)`bMi%449pyx@c6}*;UjlypFhM`I
zN(0&;*8vPT*z9rWRAg|P={$0Egue~*u^<xwqn@IkwPktwl<jVpHkc5%in>p`3bK5b
zE975Jnd~D@`wWV`o*L()o7z2f>lbN$8GgwmLvWQ&9x3D#d1O2k)0Ve3W&WPAIAt!E
zIoDbo&J_r#5rBg_3aC>iVH=T}o37Q!5p?{WIu<&5X$JbXXA&3R>U&&XKEGcTfVhgW
zKP1ibPvca|{cL|$C>^Q^%FD*ag%83~kvQ_dTF_5Wif{n+7bhHYh=9M6a4*?<Zf~Jq
zpD#jZ9d+YKVj2mI=Cq^g&HA<j@tSDEGJ<Ph=Gesi7waPb_fH)`*1EK4i>T<LRv)0+
znMOLi%9ln_J83HQbxre4L5vq`H!`nDK*M1(Ymb!#7g|Y`9>1=9uZ3^U&Hn$8qA0!-
zWxaw?Vb(%$diI(M!Imbmc01~8RxFNTdJC7d6Je%}&3<jA|0xui-&Vl}>xNBrmyZ-t
zt>GIz%7Hf8v@~fB)>KW<YEImEf~&uH`$~WQ01vLnHV@PFv{WexbN{IATC=t)@wQH{
zJ$E8J@jK8^-K1R%Zfiy}LY#hb4UJ&q17KFd7PS68<@BF-)1P;y6jNHKPjL7H?tQD%
z!jG!MVTW*H3UcL)r;j}J-#ifm5sNukB22$P?~rex(s36uzME*LpR?~#UAAu?9o@f7
z{B!KWUa}p8e>Yig+lst(wHaJdTStY|#NM)(Q_spXH>%wc+nptAGGOxyy;%4~(v+J5
zGvpN}d0=`$fE8YE^>u)=kmOn2mox1;Z!Ny9;~7xXnP;)qe%P4bRFEi~{5mlnMoX5k
z#P+i(8$H^!8rOW}4_=-)jp)B0m9m{C{zfNcX3QcUE%Wp0s|!wx*ZH7lhhB@oN^=X}
zjM4FIrS-v`Y=nkc^wn*_W9)h1iS&718tvl7t)tP)MRBr#>~)wom7{ViOPOJRXM1sx
zU8&zIAacvYYMyu0@ajNop!pjdCY8P%Tu;`n%Tf|%{m*VnN+GSSTdUhkGvd1~*eeqJ
z?5At9>k62nIXy};TP?h!XW*%<r6Fz|{{IW>DZkh-v;U)QxRn?NTwS~KS0jTQ{h?b2
zLvtFppZ<qhGx5z;9iJkxt(wj;?r=;GlQO-GO3A`x(P4DH&}7<M7sOBo%P%>0mN0RA
zO73F-mlm^wn|V@v?8q<D^+@T#!*<@;@xg@0G<CdW+PQU~y1(lmd;RB+M{fDehU?mp
zR7qRwh4;L*E%C?&=6sb$ikFrp*dr<Fzb*M!Uun^GdfAStfl_a#Z96f@^Cn>ToS>}d
z67TBE3DfV%y8~gCj1Qim6zuFAUD_wLtj|()2$h#_N*K0aA7K@(-zcZmK7QaYPF&AM
zqMLs}YI+M#{Qqy0uwtBkHs*YKaB1OojIK_y!5`k)ejc0<;E<h#w~z5bfucPNnZ`IA
z4DT)Y$=Yk?SVtCU-}9iwFv1)S5~r<*n9b;z&Dv;!V#FmkyRsf4=I8Lsj!;7&H$g8o
z$ZLq5TUXnbO8l(eyGrr=i@aNU4yLVOgG;R4{|wg=?hlw3b48tQ37VoF6rQlfb{LE5
z*8-)Y08LPjA)%RL^X~cJGW4N!iyl|?J1D2ts)@KaWCro$75t>Ov^SJ5CCNdc0l{}V
z3B3VazBv)>P9|@g6zl~X3)VucrIeDUi;OW|m4^?h%N89qsUE!g`)$5c#aMSo9ge$R
z%ei4Rtz8BAglDIk!!y`w&xi9s<_amluE-y5T#EzmEH|=hS;0Fuo6l9CXP{ki=T_I0
zkL@{_<|B36*P?hmTE)$Tn1Fgc+E!kV?etZ{Tz+s8P#RMLs7!Zyo#tjcMmJbxK|Taz
z;qANfuI8wmo1>_EXLw@B&>=PEnUr6eIo783Depo8{<U3yX#(zsRPzT7B2P=0nj{J_
zTN}hqOa7(h^9GY8uJ=6Zn)qhC$YprH&l=Aq0<x>Kveiy%<y5#f6cVFdtH$JsCsLd3
z^-SK~v?x!sH!m|+zunR&#`QCqDvc109!q@bNOct%=rOL<I@twSpRZ&;FX(;Ww?1D#
z-{?P22#!8A*3u<C`Kv5^g$|Mwa)A0#qpAB>f~{R2)VBnRc76QMpI9G8Sbb>mu%E{t
zl*_&u!O#3rpF|lSm!BH<);4ET+`Q`%0F2AyA@?cM(u;;tLOuS&ZdI8Z5!O*^2qxQ1
zZ5UEPG9fTQKi{YPMJtZ?82<3I*Vw7*HOxY94I^5W;=weau6e1Rd2XXau>qHuLub~L
zpp|<$w7V*Y0go{r1cX3-j>KPLf`4x~!*j#dsX?`=PZuWzo$1$Ydxa$XdKllQY>8u%
zuw`r9#lq?w(SBS)bL?cnoo*P~Car5Oq02V%&Kr)1q(gA(QsF?Yuh%#T!MX{=VzyT7
zaQjbrKQAO^kaf`~Xv*pe(ox#^+k*jQ6_~#rQ4}DiA=(M^R6;C6NRu~)4mG1nSX@I7
zr4?%5^m|BI76`l4uptfa@Qi3#fh`&P@miBJiI($Fw-ffMe%)&d@EeQlm#q@tQDIlv
zrCCnYlNr$nZOdT%C2?tZ2}$TQS&@=?Xl&P@&W-J^s?NEc5;7XV6EYP*1BH&j$cNZ;
z5Hk{J_uNFg^>@p8`d1f%iPumP6K@EgWWUoe#R1##zCedoMLfK_s$0ngqhw;}<&Wp(
zft)Jk@BM0j?{+9?*@;|B5en8%jON~%u;j_}lSzXH$xhL0Av`l<v9M4>|Fl7(I(GcL
z=iTZ=vZULeY5qidk<Hkp=c%AU6X&^5?=iD8XtO6trpjN&+-+wY;T^=FmiYYZBlQfw
zEv-!6Xl>^XzBN!Y%LG~_+On=i;H4GX`ZgIT*SWU)HmJvT<uvlLg}K%F^f1s&-|2nx
zo)~eJW}D@5J5im@J)Y?(w#w(KewK`EdzHbuBuDg$Hx_i^ub3+(OY)V4Li7>}p#~~@
zVA+13ARkWmV@>Z2|7jb|dyUz0b~R_mm2Nx%s*Z3C%&?iC8LRNth(?=@3OGT>QtG8K
zLcx`kH%eEyoVf+CndGUprN_2mVr=<ghOmL5r#MyU#$}Jrcwv<1sqf{#ND@}-rOIg&
z?0W|Aq($LR8yGM~mm4OK4%Q$yn%~Z$#og-cK1V0UkL_trNaNfQyI@$MF%jR;{e2*2
zs9RBTPt>dDxi(euy+=bL_vPXaYjthv*>v8nQ2=5x1d?mG<G+4u2EmtTw%RNr;2d}4
zJLybsG6`BfVCY}cl1O3#Ii^>jUPG5oz#|%vFoNG0bBb|J2KI40&m-LW^}WLXCw3)6
z&^G)^L~G>jIc*2D#BVL|zj|%&L>0L0f34!A7VAtra;a;Q8}%KelE0BMLG&v~Ivwkb
zDKJoGaHgkxiwGGP9&Lag42eY#TA;$S0vDE0EMxg)97w3KW27D)LE;>LMpe63`#t<#
z<@iy_yopn8?#{lMVgbmJfR~3^v>DR5*ipt`TTwE&Ohqo`{5>$XWO=DXE-@7k%Z-5w
zpJmreE6Hlm;z8s>eNp`P2&+8UJ{27VVi`k`1Qu$fbOk2YM9ZnU!-$N;E6EBk#)v7~
zcMgn*f-Nb}Y)|tg1eoYM71zsb=$a|B6QtNzV9J#%_FxLJ0ic!h@#HqukpL!Wxw4G`
z8qjo!<GDN{XSsnMJsxPYaWA^46Ysv1lU+yk6ch0*(dT;cfC-;dT0AxW&ChyTcwCbv
zUMw(ePzv#w)6M4|uVRcm^;`MjX|4p;hK-}*h7Y?~#TPN`P<QA;DX6ao#pzm4u+Qaa
zIJ<@?JzJ6*9XIbibGYNNi!+1a;#qO@(?qzjl+G_aA3@z)5X!aH!>HkGNX36p*=o#t
zTi$ng%#c5f#|h;oBy>IIkidbZS?ncz?C1B$xX&dW{KAk@39~5MYBrwp8Wu(KDt0ob
z4JYc&{sy=g($_~kmTC{LmJElBN1Ze8^tRvcEce*5N@8>f&InzUm$aO3-drH=8`xgE
zE!PDK&(#|9v^Ec%ZJl&xv|G|+!v#ae{hwS<dD6lZZK48s>(0St)ajVDv~bjDa{1)s
z64k@1N(4q`Wp;s3orY#`{fuZO$Tj4vzbg&$a#5lp^iPoFf;}1);9|Y<s!%%T*=wda
zA{(IV!r`23yZr$Nwzb492~~-`HR^HCIA-g}!o?V7{a`$^;a-14X35z4^Oq|kYhD7<
z(svN?q$N{aQ$y!q=p#ts#Asx8ZEEtNCDG7I#avrEhVm#L?2$G=?x8-~8r$~<^C2^v
z1`WD><4yR;O;qontkiD{h9)8^mH9}XjnVDs7_VsIw*valA;Z0qgnMu6Kf#RoVS=0D
zezNA|mkprGT<$_Q+6mQ`;OaZb-vEO)x}~(U=x+(kaXMk=+JJCTEX|g+cX?uw&>{la
zVv|MwmCQ8x1K>vh3ouFLR)0NYW?p=)CVec#XvOHJ?m6t415+uXtAv=-gnQw7TaKCT
zDjDT$HJXr^!b;RH=_O59aJ+*Hc=is#J8}S=NiX$1(7SjSmeFA^`^8Mrno|kkP#i+H
zpT^>Q!l#rVEE1N!5fx(I9Y((TGzUzK-;JEi=^46S=nb|pb<jUU+q+S;lYOs@jI*8#
z0APKITpR9crYQ4J(lDOYtEOf4_ufVuiV81dwc_A_R&Fkg!V+bl5SG%xo+mJJhy;?C
z3nuISm;x$4AJ0*A;ex+2`(2FV*t$M7n0M7`Ae(db+^M9z4XTy?!haI(#IHPkQqSpQ
z7yF}k89e_IoA|HW!_Hph@480tC71)mUokk(hCKxvR!wmpJ9OkBxnHt9ob>+FnwwRy
zkQ*x7I8L}kGHb0#aD|fdTzSt8*<D8Nu)rI*Hs>R-vq`(q<qe7h;z-3^qN*n9)AU`R
zOv=kz;vrY(uC!ezKb-fZ?fafH%ncOnhcF-C-M4a=Wp50gn`nrbt)^`W2^x}1jq8eR
zhgRHl?8C^a&qG@FQ-dn9rd*0tmg+A`__-exeAsn<+(YKe^%~?=To2u+6Y|{?r!M0+
zary7xDytj?bDRtr8E<Xn-;TB|P2wDZe(0h9swlps`hNsAbkN#^4&#*q;Y)yDL|t0)
z0j3+Qiyla?+0n_akoW=)tcV&FBJfYMKG}S$+7}d+uiBmZ{{bR2F>_%Zi*u7d*$Qw%
zYzCytpXuIUq{%7J+K~Kj9j<%(Zrju2f+JTfgs_G*5k0@KEX*#OtTa(S7y={BP-E!d
zt(o%=v$mx_%{<DrEp(bm%u!F(KHrh`5**yR+?sKP9ep_f-%V6MLPx?DXfUS%Yc+<^
zUmshJyAY+Xsd4ep&)?|ql3;7iI^y-V<cH-Yhw9t#YjbuxF?31Ii*&b;cpa~*Vw4Kz
zv!2KeFjf6C%Th%(;7G41;?f~wXrJRfyt}#OmmN*3Ts8xuOo~tOA+=nJcX6lF(Y)(c
z?1$asbhF3u#6??+cUR*~$V|w_>Q6cB`0B+vAO0M@)#FS>E+FsJr7$@s)6@$oxO>Oe
z$`gw#+oc<lFVJf1xG~rVm@jirjk{3*Do<5@pvHY49h|PV%6LhP%9cu5;@zmWx}(O;
z>^goMkQ3GEs+*~{a+&~k)!nGTNxmjVeT~*zG3%WDA8NwCN^j+u`<z>QCG;WsW-_z8
zfJ_=C+#ZK5%5^m)o0;as8r@TQHXG@<9*VT1^5!u@qSa#07AekYVY3=L)@k97E3Eja
z;zkWoT`9NO?cOYdE&p|$L`>K0UUdU_9&9N9RT2LeXhGrJe;BVy;hfh43pWOO-Y5Hs
zc!;G>?&nQ%>ecxW^bPG5I2o1lKe#dka`eKy2`F=3xYB2XNr@6AC0oZIWuYu;Y)nk$
zXs@udiT^*g-T}yxpljEindY=@+qP}noaVG`+qP}nwr$%s?w;?v=RfzxIT1T5N?BD|
zxg&GsTJL%)qdGyP!-M7;t5D>1qZ&-RniFJQKH!u6B_pc2D6yLX<1x{f&*Fk0Y$i`!
z3msgq|A%tTfi@<%p7o9c+wnQcDql{k+HVD;jfw@<;BD#tA0yRXsQ^D=js_j*>M%Me
zR=DXW|9I0mLxU`pVEAxb@j9l1yT8c=^jxm~vUGY^li7T(={`5pHD=(EBQAWJb8Zd2
zHq(Nzpf=M3XGl<+_@rpc!oy4lFTR{J;a%cph!*C^^Grwfu!lu<qS#6kLa4N<&hARw
zi}8)k4r&k|m7w;O3FH)6=9kh1iLM=6YcmIl>_ahCP3%jZ$LABo<?7nWBID6&QEvmP
zS@M_~Im8pG20cn5<!=kdAdasi|4Hc+Lfi>Q9@zaV4$i-;dhDdFcn7<O+&c%(i}uH&
zI0eV&`}<M*%cd&({py68tso$gq$p*pz9}PxKDYQT;EJQQ863bM1f#oyR|G49`}vhp
zy~%!)$XkNX!MragFW`m-{((MTNLYM0JM>qW!|yzIMf-+rj64@^9wQ#OU{$#KL_AB)
zO&;L=Tg9bPzP2l(#hJLSF4}29MX`s915^g0xL5BZ=})`Zth%$6Z!<$S7@ZP}{Q?3c
zQ4f24ZcDPOY*`|#bBjO-TdMcns-cbFoUqS_40`E9ZFlq}4Jp{0t?!)HtNHUb#iE~O
zqF|g0W9Uj(rqM^Tk$0uNMABMJyKy8$=_Fn<9sanU4wuNQ$H?dn(G!B6o!^|+Ys*J6
zy3v-p#j#$}Vp7tjxJ2TEiaAZj?CB;{9vUN|K>h^1krJ9k^9zOIxuC?yHNkV!9xwVs
zmUR-o$x<+vN<@8Iy|sV~aj;#X`3~1;fJ;dPW=Q=(RTq<kH%ATYoa`YxEbacteUKB6
zD7-lzsDi&EA^tEH9Na{wuzm090lq%Y>Pok=hSK8B;)43LcL8RdJLOc)%<{VC&iFdr
z)nGUf8dcC4zzyp&Yv5K#3u4?QAPd+Qqxuja`!)yl9VtM6Y3fQr^p^W&NHU}y^A||O
z3eIILO=tm6k|b+-&knk(B*26a=OiyC6%+zEDS)3~)=eW&5JsJ>>Uj@W-aFXwUGD_Z
zZl=1&z%M&sp569>1vyyVpXpa)-8c;XHDuWDW*8st%&DJ>{$$^5w|7C-rKSmiH!{Px
zNTL+vrV`VnCl<wf+G<ieg1<;VIdY1@xJU@BdFbd5Ma(B}2Sclx)#6x~iUj<^)rf$J
zr6U6M=<#@eql-48=z2ZV!J*cPR%as#h(P*VI3Xck@E@h2q2M2U=|DVU0VQHF4vWM6
zmKob0up3Yx&ay`zmYOOc*|U=dQM1nl_QXWf9aNKgSSI(!c3H@!LM#~UJv$kUegoyU
zW<d2aw{;~PIhbShVOGUDTkm;=R-g5&U_S0m4cz7C+?`G%uAKhjd4Iq7?yC2mq}#X+
z7u(uVjt)`m5&t803|$^*sTfokbhK~PI<pNnX;)sS?Fi4l8y3a}P@5VLnyV{RM#KX=
zPQwDCk46&5ZBbt}OJ@a&owC5kAX2m`T^&r-JhzaIua&2Rl1)rCGfE}=!GT@W>25-0
z=}f5@nd}yM3pyd^@Q7YzL%#=C@-;jy)_st|q0coC7*Zn%BP<a#=%we@*3rzJt~4zU
z;AfDU!dJXFgf1$`R1zJn+Ww~F>{(JAL#@_KapyE(!!AB%#hDK?>6)9(kve;tOK(UR
zPxGa1JU}HxdIlxd!Y-z*5}i_*ohmYuK0-LL9GWTCewL-({nLUhyq8foZ{Xf_xtUg;
zsD4c^qW$ew%rr#d+Z1`0Tt5i{_+Yki-WZyLivY=@)(0K&s_DJFTb$dAK=JBoyZ?2<
zZ2Z)4?r$q<ab~SZAL2YqaKB1MLD}tMG5T~!Z4xIEAz;&JsRi^|Lxw|gIK<*2p?ZlY
zH=xj3EWGI;NSZ6*TCz3%gam-}A@%^}Upg$o1N-~PNeH(fgmz4uCc7#mAp!7!!X$>k
z;PfE^Mz7SsyeOw~f5d2J^dQ6MQCXDScqF8B^L(s-kVY+PQW5V#=4chxTNv2pF=D{q
z5DT@a$jbSZXQS4K8V<$BFosDMi(?=Yng{Z!2ko|>WS8|$<%oWAXP}Xeh!xO&V4(k)
zTphxm-DIQlq<idrSkcp{G?~BA3MgLeYqAMqi53o6n!j!Cvk?K6HOk}vkr;|K@QO}|
zw^3)U9u!^gCzQDZO=!3a!52<^f|_TVi{e$_PAzQjPy3fEX@gA!G-wAy*6rImK_81`
z>`0U9Ef;U@I|3nl*w^0t01X0Q5eG5CHHsAu8Cj^?3MP$MD^TWQ6`E=Yj8W75G55ld
zsB|6^bsTfcOJ&V4<)?O&%OtUlbt936x}fh&qQUvRf%`s*-oZ=_y=JNo_6RH@svASK
z-pM}Fe@c4+izmb`GXlq<|1tJWoEr!(g<%pswl3Zc!FG?2_|g1|ui8LDlh(5wQ=h<$
zB5PYcNPKzVnbvXMYn>g{$WjoD6b`wM$BNhnP~Ks+0p|f0L%Y7{OUy9Z`!mciWJUkk
zL3#D8y?>L+1f%M?|1S+@NR>gg2=;*}E3b-KXio(6US2d}H!cpAz|!2}muz(uDr|6#
z%>G%<KyK_`o5Y2Vv<l-)W5U$(o<E;sTZ}XG(RG`mL|Klwv7&}LxDJ0dn)e9dA7J3y
zaXY&oX5HTeyb7XSBQ9w=loD=QwOp|6fXkuy^boad$yiJ5y)3eWRn#rOT@w?n50#Vt
z$n^r*33F?jbOQ4fb<r}TC)!(_zbC{_V_%EKw;LYp8*~|T86DKSg>4n24GCnHxTX0u
z&q!ss_*U*wGnt%1(vTUuK&Hrs)83$zs7#Pp%b2i2UpeT!6x~`O6)OMDl(;`I*Y|nt
z4RLn{2sBdF)&Y8sG*?9Vdlf(+y?QBkkNQEWz7=ESk(%uTT|-$vy)77?s(K@S(rxfj
z_kjO*vR~ErRB;nYvho>@SK03PT@u>r)gf@jr{7}z;7I*YJn&gRw0c`Iic<HpQX^do
zSQ>|(0yL8~nG58hxTvB}SaXa_8`i1pF7=G~@E&9b$eISP%={@9%F&%e(^je|$)=AC
zxcR*z3BnD^SbUTvK%H_ZKHLF#R<6?^4t`&NVq|j4e?{Mx*{EO4aR+k?d21*|E{!+;
zygS1I=C3h8)Nx*5*u~-q%e!bJgAiQanc;AOD$@qa>FiH`Y9osi4^!fGU20w!`dl&i
zZ7_&xK>61Kfe~*dPg+1LC)K&jH-D=+E9B;@VrAA?W((6*Q~Rppd>Sf;eT}FJ@*x@+
z5dYqSkz_rm5JYqgY=j+ai1^*QzzkPkC0ND0wcIA)O^goK6%N!s$Pjs*pDvLrao><J
zOLS8lA1IS%!|Ru`z@t(53DdhB9oX~)MC`5JPkW4B_due_ae{4<1=~aKuU|wGM%v^N
z&QY$rU}^W|noLFa#!@I6baBc@EaD)~!_*5~VM*joP^F`3IiTz-6^HFL@U|-_R$JB5
zo&@?qFqjE&nrjQNV8zB@6FfO9#}By(Va+=_|4RvTW(DN3bXj!I*L6DlMfJ862T{B@
z|4S0YCUC|1{+^Qi0>FE4Q=Xa+oY8H>=XPQvmCC8w6X-wc!;GNy==Y1mYX&%#)8Yd7
z9z|2&<wX>MQ<VtPhc0E{`!VBVtQC0+t&oWseyPYi=B`ugM@wlFn(9SU_KT?{o;zcI
z<QuJtq|oW(Rhk-w7EH=8EKb<6RsM7$DW@;~P;;{}_amJJoqKP(QWp#gI~ffp`9TS-
zuJiSDa(OUVt5R6H*oBV*164~}VRk^VFB)Wgg)`pdT;{Br-sUeqPws!x#OYBg?XaH7
z-L)PC-EKX-A0(&(l?0Dvuhz*W-Gg*G0?DNZLJWN=FalBW!qI$m&h#7dyG}99SVQa9
zF;4rnjUMr~@|C00wCA3P+Mp)NWIu93K}a_kEL^UO=-p!h{*nPRf?O;gvI37K>FizO
zJ4wrF67-m8#K^N>t-{UJ1o*(^Ptb#Di)jAtRb8W)vq73vGrhDzlAzcIG)dGDQ*5*3
z3p@$ahZuwOOKipp>ij{EX!HP6D}f+lI8myoLE6Rpl;#k@e+ps(2G@llCVC)&X8M9q
z^dYQSV7YyjAGlE_b4kZcj%ErmBuN?lI2641yM+7{d_KtnP;9?QpWZ=lr=mMfV_FbL
z|FlK^iTfQI00Ta_-@`^?O^+p^PCO)bl^jQ=FKmU-J~Wt~aI+2-!+9%Nq`IFh#lN__
zek(b)kJFnYN_PSe)nyIrkJDZ7&j#^cUhOtU%Zk*E!*ks*F<9PD_TaGOi`HexpyBo!
zwbag*dwYB#-b_c+IWxvqqikcX9cqCQ4ZHR(Y;{LG-x_FYZ_#XavNkx71st+&-FCJ%
z$UYV6<8ge?d?B9ydn<WmuDB%YJ`##!mp4p%>VL{OKr3zy*Ihtm!L1|`tvknA=l~c_
zI{8217-rpkB5}G8;^UpUU$%+7MhU|P0Z;j#&R!<C%Ju{!xRbHsUoQ_B0OX{W*&HJK
zRX48Nhjtmwu-rc46r*+PTtUxnCEH*FsK5;>xB9^Z05{lAe#mzo1XRX%F=v>T9Z(xy
zO(S0Ck2nWXFL5_&uiv!E*66PlS$VA8?jLb;Yul7w;$~0RDBT52ANGT^>auOufQK@l
z`=q&*v?AHOM)<ekne;+jsG&>cHLBd%t@eRXA5oM^0>|wk4y$W-<;H36rDeU`pZst`
z4A`Z*`FKODYrcB5D|rPD;{FmR5rNZH5KMczE9v$US3Z5kR0LRk=`D>KiFQ(3>Q8o<
z&)gnzDE`kGQFo4R(>cMkt7-V$9;39-x^+n2!%GI(-9j=@_-rRk$!RXqBV(3eL;^u}
z?+>yhdwgbGhz&-NEMy5%_~v_J1wbleirXjqC83fsEg9g%xA$m2!Fb<Hx%}zWEnDH3
zLc*j8Q}F07A_M9GGYRy?9w=vl+=5%<l>;A026MCpzkOeQ+7Of~Zdi0gug92C<hZX1
zWP&Gh=gK|L{=;6_FDt=AnUI7Am{<crM0|3!ccFlS4{{;RT0_JMGSZ;9k=V$asVf_C
zYx%zZ{+_`kKIw`48@Y>u&u!OreH&6Zi8e%VBYplr$RU+Z{e@;X3}N?cDyWD7o1Zsx
z0=3ljH!nK_q+fU#X0Y}MFPiEw$K&191=31L^L{Aj5w-iwEGxg|VyQC**aU8bXx=lB
z)YTe)aDu|N3<kkmQm4ydrehmJ(HJQPE=>rKy=f{Mb5C8pOb?sRee2pk*m3TNJYF51
zPJ-fe`dAi@LBy9H+2#y(HJJvAa#YrRxKZ0%cYE7_EFZ{Pi+jCH8=U)9sIGAsSi;}I
zedC+3rEjAROTZc&8DxEc`gH9IQv0X0rjU03oECZuLX<Ur1Esg8m-PbTS$lxSWPGFv
zOAU9u!$j$dcp0)YCBMWora50{phJC(EJdMTL`V_5|8~%Gock7-t1gO2N$A|nKu=#g
zF4EOVDJ{C!C~mU=ZbK2<NI@|d9dUMs$#O31M@G(mxM|EIxX2r9&q;uBDgEc<YWSkL
zK@o%WY$ASU!ngk3X;q$A^Lfn1=Ikr3dR30*zDhdtiq0(pin<5-DWDUG^<MTvJt_cQ
z0F8V%TIAx7O^G<7YL7TOe)g^``8N%7OJ0uq`6i0+X<YRnLcKxlLNnFt8)%ZNC!nr7
zJPjSbtL4^usmrV(jkitIK;x}lKM{=E0;B}A@5V9JrXHcG?*G?oknHO6HPYDzRGaGc
z5IRU=A5)Rqpp2L<_-MOv-D&QdU`}@u{X57W^rKeB?PiJN+PBeoXHZp*v!V13qIg3K
z$7{$#$u3tX#m$n*Q>n1(gsbatEx_2u(D1%x8K44uP%C{`8PqgYQJ@ES<H(MU{zXOH
zVQh6fY*jyTw%&eJ;fK&mF*nfBo#iTP>FbU*_d%Dcs131vl|~ntKfc@py@09Sgnivs
zy8g1nVIj1{v9Ut9f`dOFDzJ_)BnGcJ63Ds(Wx@6YN{{XOS<xC(+~F%Ny4~}ZZ~X%h
zEhD$qo1bN^K|jUpNrQA9!(2(RyE#`|2b@?#pU8?PnP@H57*d+#gT?+$la&+yg&O;1
zKGjh;V`E{So$h6(Uz8?ekvU`MH#f-V@&#z*kPFM>9oJ$GE%{q&BX64two`VNn+v5K
z>K%3#4LS~xtzQi@XRA<ppQ2g89tuEe->Z(lz6Y3fpHo~VM-ep+9zV**9MmkO|I!tK
zgaDJBzM}dZZ__8<TaUDXXYW=azR*_pB7<xzoCO?W{ik&mPSVckZ6^3*YBSC;)s7ya
zA+!~_L6cZ({%@O%+5#l{C~Zgo$I*lTf7zV#|F*K+Ng58Duk(LfIkh?AT_1H`JUUbS
zn7g(TYy;&O#<HxVkDN96tvbP3vI5Utb_Z9kl#-*n)B#TUcxcF=^*=2fQ}(Zg#bC42
zn*XCih5?w4ouoIk8!hEt-jctQ6HCNc`Z|GYenSNx=tHdRh%KfFNt)L(yUwOAt?X$Z
znbnp(5NRz!44c2)Y3O<lLFhhCYf22+{1i`zv@osMg(ni@J`DK`Fes)GFc{L1wjigT
zDoCSP?TC<(G!)}q;?kKI((Gui=5ar)e!HY5)(nX$kj5p3Tb&cCfwi&8Q|lu!bL?=5
zk(W9St+)%Ru?j1e0Ik6cg7(U-rndYb^D?Pvzh)QnN;B7a9MqI({pELG6Waq&6?Of+
z*|POK@K?QbmkbrUaTEuhQU-TC0Xn|}5pfQDZhD7?Y|9(g97Bl!W^F)-ll5pfo)E;v
zvx0~y_LbF7#*5(M3CVV;{-J*Jt4doft#=d>@MfM~h3Qpt#V|XbK-gND%EG)$ZxnW^
zQ)KxQKj3gPg5Og1KpDsAcO&TRlVE*p_*qV>Uql&}qyTfp0XK3Qt>v9!|H9`!&c{AC
zlGWyfSFsmvLw-aJ_c+=z7s$y-(EYg`>ISAph*W@~KT$jg@T9Yl|3a5p|8h$33P-7u
z*)Tyhd{eLf9vEA<)^x>mpLQ;XN;lPIyr+?M%~Ttlf7Byx`T1(R*UkCa+-<tGtJHIs
z+Wpm!D?KRly&p}G?RjvoI@xaDV35n3&Qcht;x;Y;wT23M2h6e)PEyya_~Z#@f%Qo#
z)0%vXa#4CqoumG$p`k_l;Xp(ZTyD!R>Z&^xdElsQh-h{jsg|vQNjrf(L&eod*agSA
z2nDPG?h>iYHAg2DU$3W%v+5Ughn0l!vUo2k4p*U4aH;a*O#KXNR!T^$6VmvEzTd(!
zM~y%}@z<UuHhA%T&KIp&pt7dfYJ}@*B0h^zoigyNgp{vE>VeDIRI&j|A>7C%dwl3q
zV1bGd+MgrC?uMs-OPLGdIBBS8lF=wC|K%2IR9D!I9(v9MCsxikC0)&QJcB+QR(V`D
zqfW&JNrX$Tf+>or9y_#QXg_6IMmPcHxR!c}i$+I(azD*k`(FCo+>27a#5a=79?MY|
zrsBLp4f}FTO>jKo0X8~@uiz)WSVV@J+@a@;T=(IFW{(XxHM0#th;XM59SZfWF#Yk5
zd$J^7Ad5mntsN<5Dnk;LG@$69UtkT4<k+U_{BQFRhDga7J^YbR+_7^+?~lu5TR@US
znljcPrr0Jh=#{j!7|TH$OOT?zlzZlKfnwUIl2)P=-DD!6Hx=PyV=a#lL}#Q?9Mg*+
z?4FDYol&~e88nB_zQ$gO-FZZca#^TN53k_{g1r%4CPteJ)%tco?Q!$WhC`=fcN3v*
z`<|AO(5;b82Mv?&HhOaAf?Rd$i0Kk*z!OwZ)?XC!*zBP%%m&PUunOxX*Yn|&-4rRr
ztA2Kt8KvC9P=wvSOwnsBUeMt=%Yvy#4bX+5!yYz=#`Liea~NL8@@LXh>f@rav$1e5
z<T|4&&_GU2poG)J%evb(V+83PUJWf>@T~!R&=)Rc<Yrq>hvhS-deZ3pga-YeEHOng
za2om$eQyXY@*<P$cP}~H6qHS>(-#;4>)AG?7}tSC)r>4@ichXxx}Ucjy9%6wv*=+{
zat=Xxj7XWeCs4vBWKWDps&|o`WuwxsLx}-~5(M72$I#85i_^0A`DCwqV4y=v$7%5#
z*?w3j!H$cA#ewPgkHd_%nkuN44w}_b4}_VFy~?t3)sIOs-Z#<vEfiT1CrKeRQ75E`
z!loBizJ#09^xks1RSqBlvU8LP<#eXt%#Nsm)QMB!J1pY<F47Lpfb<iT>zX^sUoyqa
zUybsj_9FYBHMM7TVaQenBbRoNi=L29+kTtPJLUaXDb~FUFXUdM`Me8vs#Ut;pp|N5
zof6jDxw-aEY-9X^QX4qpYxKdNK#n5Nr|?4p?1~xr#TO$wn-#sq+?<6lu8-p7kap1a
zul)uXM#+}|q3IB-lJ_VV5Qw(EBfC=cl+0#)>9gJ&mWqj+OFr=)EmT?$d_cKCM1P6Z
zjl5e*TENna)2o{cencrvz<>BLc1PB0e4)u5R#0iq3>pqqpN#n56L44LQA<{NC?dbC
z4s$FshjM<G%GRX)fD&gr=4GZoo9hEMzC<Dk^d9><VX__ARjN`V=#D{5PD86g<b9rZ
zxXF)hOOzmq=O^%`#f3B+sEz$Sog>d%ef4$SQK?zVSxXQZIXo2UB1XAS;@3HqDzdvs
zZw2nSL3hg;h1sO_&bg;m{fX_#)xNoJyzRW@v?298G}(Z`N>8nQg=isPv=b8j(C7sY
z!?b?~rna=A)q`Vj`7x63$v#+WR<M!{6_md<e*KPRa`iE?{$$X$9B#J0!S{=AcwUI+
zYH4fdjQ;rmflsRUO*ZN|50waV>&=8GF=9EJe7Zi7|BDt=sx{E>IM9+A!Nnf`^vq!O
zA3F_kV=QkZ3%7x+?F>rNc?ix%4zyZc7Gg^PuAV>Rj9lwqeDf%H{L>-|p71Y!^84Vr
zdAPT%;Qe5_<Km&}@>a*KtRn{va}R>t*J3zq7{E2up_9O@2J-(R)6(^U7q!NW>Ni|q
zs-16_%?Ff&*P1WoOd&ucoD55$`)TBFP|{AJ5t><O0J%BirRfU#0UDG4A7WY-fSA^L
zX7Jpkt(E?+Albc9KC9$N916MM1ZnoIF>2o`%jAfyac<kXjUI$ruA`aLZE9b|vD$4(
z$|;HrW|ae>0yZ+WHP~Wgc+#*KweUqsF_g=}Dm=NR*W%uo*JBg(v^|ri>4h4Gr#J>z
zfs+(#f{8gxt>(2F(ZEVqrv%`n&D!kN^_4W<E~se050f@c%k{pG{WvRVBVJtG!P-uc
zPoPLgu+s6Uw)bmP8v%xd4i`@sOZhEHq_+o}0f3~X{TGtvitwxjfTSr5K)EWGtmH57
z?FpF^4J!s%A<@Zw@>b{rAZb!IwYEaseWgubCgmEWbFTBswYIyH!GuS{<E49$l>O*e
zrdYX*$o9g&FVN($E4BY&(z4Vu-BSWvXj2)gPuRU_|3b}^Puz@PoR007o(WIT=x1tJ
z)R9XMwq2oVhl65>0Vh4*^RJ3G5-cvxL|C&k>3{W*fdVLLvxUYfZ#C>Op=p)CU>HVt
z5EB0Ml?B;!vuyhYTW$hDsC=7xd)REX{&bI?I<N~VaLV*<gJr#HN(JsU6E>ZxcTxV6
zp}MlJ$n70d%imW4tr$-8=~W?aKumJJ)oRa}{(o}}4pL(G?^}D%TnBtSvYHq|HE8<@
zRR)v&YCVXyPDvH=Bm8Pr$vP{D%l*l5WJC-ZkTW9x)VhRR7Rh^!CPY^5KoUyT>i%-4
zsU>&$Yi#H`FDtKiAEEz@Qh}oem8f?2D`YT4|3hWs0;6gPBgXQ;JXq2XM7PAm2u4=j
z_s;6&Y(vjtr1k@G3^EpX7Of04skfzw?GR+Cgun1uFA7BZt#Cn%2Vp(L2vz&XWDN|W
z;CM}I@0iX^jWK~AF^ZK2=~Jq~Ca8}*c^WbjQ@u;Mq5g>LrI@1DFaVa;^FOe(svsFx
zPZzVB!2Lncv@E~D>FVegyTKFue8KH_R7P-TipBc^w}QkcVbO&Fvjc|`kSB=)XJp+m
z!3F%|LA!h`mEN2irLWobXDnL@{l{(}9PmTeg2*)hq|CiP;^HUM*qD7v_+Ontx4^}c
zOeLlGLtp<syM0+KTgWgC|AmMWz%O)RUfr;9qt5F)mz3HKs|O;$tCmgRQ~-LmIEwsX
zW`ILu{E%^`$l0m}<2+A&=>ULAi}^1q%?kE4tM-3DY3>LRN|-d9Hs!WNa7#>ZrdBtB
z{$Y`GuPLH;19qY`mg0e3K*42%kvhi*ZwTATFI@xA|9EM-UZLF_5Cve-08rY^Wadl$
z5bQdJNAMDxx2V7OV@jE=1~mf_?(E~X#j2^qNmp9i^R-9Wt97^9{l@Hx`>nD=lT|~p
zeS}lT;)(Z=xvt}!y^c&Z2j$pd5)yuV0EijJ^x0&afjV>C2jVWT28mZd^0Ch()tEWU
ztmX{F_=U_}E*a$CxIA;$Iwql)*#wZA!d{p8yCB7cP-cO(5KfVfs=zhZHI*v5j@|J$
zRNH*9B#}38CGGMJ?(h!AmpMI`mb$Z)c^h^G=g*|@&|y#!k=()jEu#7euE-5C7FzG;
z*G8E)UD>zt()*11`SMc40NF@Tq>2}UXLlmg+657oDZKP)GE9*jonQT&%nMrjxtcMb
zWFuB^0iIDzHeac2=Y(Z;!fVGL={m6}y)E-Uavz8^--v+zVzBir{{BSjDUp^-h(HUV
zjQCAxnf*sFh?o;c`j3GQqHveuttyenl=8`AA5Deg+$*(qI@hstcp$tagGe5DH=@Vf
zcxFRr-HmulqmW<-GKvV<D6D*ur9gn6!q$2C7MSXJ*uk{xcLxD`%T6pLR+ZE7OAz%C
zww%qt4QU01reJXdBQp^ptTOeG(W^W__%U^*H14iVbJM%nM(}DM#aS&D<=J=N6`71t
za(M?aUOEH0&NBuj@}me|zruwPq&ZT%HBFwLCL}Z!C&S!L{r6wj>bQ^ma!292;}82S
z8mgc#<OECkVQ|U_MB-lyQCu^TcGgq(SWNe0ksP{e`Xfbuq=aRWbGR4pyqan}OdG4j
zzB0yV&gE%D2L{5Cko(^S4yJx3|3EZQ8j%ZqxR9%LyANqOf<0aW5=}$=f@0J{8^+tf
z_vGl&|3QW9y1qKThv6dKGwvg-Ln{cUdoxDHair`KE1zD_Kn5<;NGhx`>_<Bgzq?Gb
z`qvhHecX7*i(#K56e6@LXwQC2qdHXw%N%T~p5&(lsq{|b=-h)it;5uSO`2>#C>Sp~
zyp+)(>f76sxz!JL_zWq&9-wJ(5XyQ8b~!P1im-I2q*^Y@t_%bZVLl0#p55XQ4}?8`
z`INLBimmunv_A(ceTD-;&mmkk=)2SzNEZ#4(9$~uKOS;!%J;(GtcP|7Z<om+U&O?Z
zH}qWSo*fc^PSaFLCuKsI<zEg0GWdB@>Zr&OyLKRNnQS;i`v|2y5=?(<-v;_3D6nIa
zlrq4eggREV+*y3#Osm`o<H#@sA@WX5CxlH5l;BWklz-b}i{WN@x_AZcw(9r|A8&l<
z(DvG4JcA}NAeUR??Z^WSa0o-4NJn^@;K>${y62=S0fSBlWC(e5?@=%Cs8&HT_o&L3
zYb>|+YJw9gDp-|NF8p2knd>Y`si!S6pz#M*oZnuiHSuf{{CV;3WD27Sg|dfy1cE@3
zSmpRRr2KV(?1H%J{H-+ciQ2WFzfiuxKzq%=D!qnWv#IX}QOzM<jl)ym^Wr7yN9L`n
z5N6!JI~#-uLrdn!vbj`HIQrH@V;xym9+m{{_qi`=L}1LcCJ0cCQ5^h1XGsQKc2V&b
zuAm+jFKDEC0n9%W?#Ez)s_O;|tE%h2I}x{P5vz*k(<K%Si6jZP7%7KVH{tiSSVG^}
zAS6*-1^v|+ZgEEgL}N*g<7+H>KEyt;wyRwr8>eY0W|><tRB0!kdGn{gXVU0>_y?0g
zt?^x87~abFdzo1^N_Xmhfkv;KjD%6tpN77c5ZO~gc9G%OH>J0AkVKqjz65gInse}0
zjkem+f^IWs!FV{iW@DnFxPP!++b3OZBVd=Ry<I9GlDxzs{HgCJvcWy$G^1eu9iL^o
zP>hPbV@mT_DU9kwEd0%5Sf*QE2tWSQtVA}hP1jEwWfSPuFmAeOd#Qj88}lzh<;J1g
zWR&O!MeBu%I5wAh8>fC56CjjsCsQy+>ApFDU3R|YY~9_-{wFy<JC(;~1mjZk4DF&P
z3-?4MX5r8!*PXmvP#n7qpZN|^(ZBNTO8|mqfJ8Akt6J@1)I)q09=~(AlyFEa`uEa&
zcG6qT-(a?nh((IKa>Jk`fbk5Yt;qW55AN*ZF!J2rN1Tm)awqjUUJ5J5;e8OzTal}b
z^66Aa(ecg9s9)m$VU&xrUeyFq5pCk>Q1mAbIx$7C39hc<2Qy3xcE7nBvyrw79gx0S
z!xPP>M4o#`c?;46(KlK)#p}c0vuK(M5+}vEs#K0VPTZ%Zq?Iew$7IvR^BkuMBV26(
zb43ob4Hv5q)TP0B3!;0I)PP6TF%aI}kjWKJP}lrzmJ!Ti<Y^DV{YS$X3ob@Aluea9
z<g^)gCy~sE0mV7ScOe5#hA)Q}Dz*C4@)}F~<2@;}2QzixNMJNh%;t)KKrG&BA{Y$X
zg}EQ|`jmpAeJ<<l8ufinYcfncLD~(Vd<(#|^dxD1u$BU8@c3|(c3bAY$9ga_{oEmz
zjDa0qMm+LM<lCIdaw#)O_dUNgHAtOWZ5*fL70uQ@xI+KHoTM0D3T2i)PBie#LhL6i
z1^rPE_DJRa!!-ld+%Z<I?#8jOSI1bu_By|+&X_gDvhpI9i7nk&OfXIlZr{V1(|B)u
znWrx#n=}QvrW^4`Iy!*~+R)nw$ho@p_iduOduZ*xzm6$#Wfi50d{tUFwq;>5p>OdM
zJc)viks`o~Pi3P678uk75B5m@-vMHWXSC;d6vDc{898h>0;?r=0BeafN9Z?JtvN-Z
zH}!CD0bM&Y8q-{bi7|oKFEm^c6(p5%n+Ev#0>>JtRyxyP7~a$J&g{&sRS4AyZOT=!
z8dor144K8FPlWQk2%edQv0~(tU~e(S+oo-sUbFXs49zOoQ2o(WBnzmliXEawR*Tbu
z#-zuptKy7gsIW;opN+vJ{LiEI;&ZFF1zkC=jTNO2T4>H3pD0e!@h#<o&o>Vl8Hn*&
zLko^vU4ppBkliqW*C^LKr3_`{7f%a4_NcHL@f_AwY-fYqo_&qJ$Mis73cOWSv#DX0
zt?$!N!&poHOgNUWzWEkc%UBFP$O|CmSbxvr6sx2MS$rAGgGhX2(u$=O)H4m{6<gn&
zkC00rXXgi$b00pXo~MxMA=MP7@mZDtaV6PmN=SFyh&CoRM7?GFWn2O~XV))$n(52f
zuD2zc>FPoIVDN<@1vM2u?LIU~eRKEBK3eT9a*9+neL$XCGnv0jiR560E4m;*<T9cM
z3aXyh3s=W0d49j<G2#|E*Gde0iq~f?4Kzm=Ggn~K55+zvY0co6mwfPuh&GgEG~^Y-
zwW&GfIs3UYNi<Fj?Lihb!ODuR&T`u1Gw!WKLbKsYsbq8|UDl&|8fadnij*@@=h5GK
zSdcy8C@841i<Gp81VudodK4!EZPEjw^SRhJPRy8C&f3FiHR!73{n`#%oyi{}65;bo
zRpM)6(3WG}b&S^urkmm7+<>g36u&G(9{f$Z`t#wMYw(Q16h?m33Y2hLm6@L@hV;Z3
z!68IJxy4*Cb}F>}+j_&2dr8Tmm0MZE*kD+awu3FemEC>j*v56&dAkK7AbCrFGFq6W
ze84qS2)xm8eBc`<NhOf={Of%^hx88?0W^cEIv=1-+f4&eJ92HxKwC%IBPu8;odaTK
zmKL~WI;UHhe>!y8=nx|C*aTm`$==S~xBY?1YtZvV^I~~=>ze#lV<aT<d%L#5VS@Qv
zTR8d|fDFBZdG4&g1U4VL|HK^K{SIZ`ja^WR3p;qF*72gUCM2Fb->xCaKI|l#cK@Rz
z00;U(87df4W>`5KUn0JVF=~(R=d&0S>q}jqO+8pd@+<6`u^jG-ru&wGj=q*V0=>Nm
zfA+m`9p(y0KZ6FB%~LK4f1tD?wzf@KZvHq5)cZkfEY|F=NL}~W)x8<c!+efI^D=H%
zcT4WYm^2sO90SKM#@iV<A?5i2?UE_=v>BMR-_;ArkC|b#ZohGs-0oyOnM%J>$&;&T
z;B`)Ph4D6;jsj5d;GXMmeVnfk#S3VF{+I6je9+SabX5X>k>?~)d~WoWjlDYPd7l-e
znvlqkz^l7;v97c*cfHDCJrO4c8R_lDr{YTvxS#T!09%%=y*#WRR29)eO2tL)s8rz(
zSr1vIM1k^1d|t@8Gv+E1c98OEEVemAIplwJWD4Xa5mTS-91$a~t0+y98AzGjd>5n-
z2K#-KuhE)TjJGY~CVQ{Qw{`pps}g06ax!P068}}4U){znca<01mls%$kCt+eZ|Cw=
zX*)iooSmq}7|#dLqww$%k30B)n~NHhb=%wQ7g_qcg={F4=h;asC{;_Oj9eNQn%PEb
zC1C$zJG!%=nW_pX-{&agJnSirf)!{koO8NzEhEW0#=GQru$2t(Y|F+;ODXvH<<{n6
zYIxliUewaOpsjTZ4(k|IcVupqM_zpk<Xr|k$<BNz^`2GqHFCD}@ye9Nijr%SJ{Qq!
zzK*>hb{nJp)HtL>J!y85H*Qn$JF~Y;O1aP^>$)_naICH8^>P8k?j8g?XT?i{`LdBl
z@v?X1GbIB#TTmPSTve;9GEJ(2uI>8lOW)jp$EcHxVqNX=gkh}ulmVhx&AdHpJ?*jA
zJt1e@1E7qqUekA`V7?xd#Jv{kYAk{J-jp-f;XX?EhQc@M{&TQ?qjj)eKJ{{jZ?LZ7
zy*|>syE@XWn)%h}H?(!SSG^cg4&%vkcc~ogHLF(Z?DiDibW|3e9qHlTDd#;aSNn`|
zLc5kxF5~s@9MWf-DsI3x9fZ4}r-i#ZwY}ZsmhGcG-haea1?}6%S~mw7!XB>?Zg&a)
z_qLeEAI`8hZpqc(o4@UuFS5b`S0#9=3E`$PfDK>i|F?Qvje~NFL%RGwvrEs=?>otl
zMfsgb!tEhWjE@zeuFrK{E&+EJXhH@Nk$0acjjXMWMK(>$&%5iB`8#V2Db3<HdiEVx
zWsm!d{shU=f}uD+g0G|g%guCBo{V)HoFQ&YG*a{wYW{;RNM>KD)`7vp;zq9vMcBDF
z(oWvZbI<vwF3PDkJi+4C-(1PqC!VgJ6}bMKP}L&L%)<Mvx#FJ*Q2@nl@0Kb89zhfm
z@g}3&G^P(?#+{kDYUQ){nWg)`i?myIGU~%n`y0-?n0z|?LhVUM>xnoGJYSB%?x%_{
zfE!r4y~xd&5B~U)itt2Yx7~-j5~{)3PY0(=vuo05NxNP-m^|&6SqpuYfwup2!;~8l
z8&*WtMT0^}!4diMe&;ri_^6ysh-kkjK_&gRVAKvI#bN?9mrU6O=l(cy_0Z%}3f^JZ
z`_#A;vvmNMP^yLBXLYQo$lEL9B>5-6myEKcIjQL59LW{PiD>Q_Fm)+Pk?heVZ*J58
z#wFr;pW#QF{7E!U1QsKOppr6y1s0<RgGW_@-<=Hx#}!Qwp@`${z~W<V-a<I30=a!D
zZfkh*60)XRAqa-%KQPGP&``v*nxOd=r}%C((r-M&Plz5@S*={*KQzc?DyLQ{fX>ua
zidi01+w;mE1AmY+o2EZAvKxqQ`AYS;kHzH2Zn~3=02FwwngJF$?r%)BUk&$h5yX_a
z=ItDd%>&=F*Lzt~=MFH&bJcGb4l*U8nA1+3`TrR#b~?)kj>N+l+=~}@os-IV8iC0W
z*1b|G`K~A(fqG&ZcmGsxwBrD=9M_@-G%e_2Y0#Alb@U!}f-Hmo_}OU2N{}7MTG9o8
z4s*0<j^qNFr2(5;4}l2N=Cya=?;a1(-hFRxH5v^^QjUJNhpqXX$GE^9Fc?F>-3B-K
zY<<GP$No?&ixU?+tJ~yqF3K$31Ck>0@i>Ome~$ufh3z5(?(J$Pc;?rxu2p)$d1&4L
z!9mW_)eH%L*ugyF2}k}k^~+pTIc)ta{I3XwCFthYyPX;6?Ha*zudFBSn(#i9i{ZIx
zdK?q;{cobOd|gPBynIMzis>I^vL9Hu3Q(99kHUlFC@(k#i_J9zvVqt9TGDL|KG#2W
zikDGuxO1wZZFQVe%@$o$+1X!iN6H|T$V}!Klazzwu$}QLIXndcB{cY-IzhU?R?QV(
zuYPU&^E|E|?CIx0CQ)I#I;bA-j3f?(L$`gRE<;^FTFhK_H?29S`)`2pK6YwhZfO1Z
z%TZIL!3Hzgh8WS96uxO+X;i{vJzR4IWAWsSQ2ZB1@_v}AhKD}=P1aKA7FihoYiWV?
zx?N#AA*z+EG2&H}>RYOvzKnloTFfW0t)G(NGuBPyoq}2VDM-JIsID|cA&_^N#8Gn#
zo`B<wx;)*X2215c)gk|2@Cc;C=7*ZBSmGW<N4#Dzeb{l1c`4Lc-i599&<3ZGyDuHF
zu#{CyP6vPn1bxVwkfwvUj>%*nFt@J^r+Hp78WNq`Hy*?wB{feiC0oBSmpk`P;$1E7
zzjbh(J12!L!C0pK>RuZ?yk^nX94D;`3C=ZEM9B<p&^u->b-heta{8EuQC~8_7;J3Z
z%<e!O8{;)2ON>y)z;TYvB}25KypkV0U{dFJ-)1e<bd{EoKEK1aX{NoJ48dKL)tH9C
z(5+p=f2P(?n}asQ2w?T=tx}GYX(>ybCfda4BXWXW2p`VKeHv{w?*>Cx*N_G&Gl8cg
z+B42&5~n0Pq~JZ{wAcTUiPF^bPrE_FpDu++jdH47l0UE)?`U{IAw#7~Ct$vJ7n;xW
zGeEcyafWSVU{m3!!0yZCVC!G#pU-CjPO`fzENWN&5`ZtNvarfPO`7D^`OCtpt{Dhy
zqpVQH6$KJ$D*rH{CIrLsZ9dd4`!t^-E6(<vj$O;mxlR5%JMPA@IE5vX%js@~^?qez
z*wExXdfa;Ti!j4)y#1RS!rnI8ZIr~Dcfv?(xS2sy?Mk@S!i#I2IO7swstS`7le_X<
z1R~oUq-J$u>Ir7K{&<L;oQ0eflG<xifKyWl@5kju%Wb>EhS;z>YiIdjsw3a`%92NZ
zq>i?mf#Jb%LpIJkhfNl;WN=j4PFM6wu{0pX{4!dPP4n!FnWb@oHQA0H%+uf5vDQ>b
z4c1_wXSTE&Dhcp;9__Q%O(9Pp7PP105$|Or!={nJ2xqzQ*dA5;Ndu*pc&9E?D*iSD
zZ<Aq|3oY|$Lh-%{yV5C)^_LsJ$M}t)krTk*^%}m*B;y6V5b=^;cAEQumryxv*;BV*
zY>t^d8{A23x9x>AEcj!iIXeA8&AF6XBM*^f7kr(BTjRd|Oy*RHl(ejPiTcbGiB$<Y
z#NixN@=_7|c!hk+(m!(Vh@dNxZIinfG57i;U3m4+H3sXrLH(bjLaI%QN++-jU}u~q
z?{R(Z$H~J|@kdhyd(_(L{MT*vw04qXL{WR1YJ@D*;FAI%Qii1X9%%C9Prk<J5_#g&
zw7<%!xj~orEf!$=nMZV+dbSn8r$-?Gts<IeAicu9Y6&}IY5Ht8lP5m<1W%g?y4)P(
zx+}VYry6mhBC3<n(2-B;DJ1$jti!m@(V0bp8%}EXZY=uSQ5`c#=PG$={6LyIbI5E+
z3de%qeYJ5tfvW_ouv3911a?OS+v{}c?;EBS)xJ(nG{+^05facx_w<%o4}>FeZ40A2
zNaT7iwcNhu&l<UlzlNak0ab|JVaWAtA4+=Y8wQKBi|2MFvIx!Bv0+`tty!OARnL`y
z*%zuT&Q*M)Fy8VjOR5d4oQLB_j@zWVRnOSgb<fR5zbZtBZ!@wL&pVz>GxM)=A5XhD
zH=S`?uAPP;hedDuN~yzIC=^<u&O7AHp#ttJrh)YRKMrww@rUe$!CMRn9%PeBxOSuR
z!pa$#0I>vOV>Ecu095Z)`7oPn!Kf%p8Ae_z)ssv+>7|fi1ekUS_bbnlWE3%n=(Y5s
zSN?;S1_X;uwE4}E+b2;R9ToqRM}B33v(^=Gi7dlGoKI)#PQovpZxbWmj}ujiNvqH6
zjj7&i&ZG2Ib`64Oe^);i^3D7{@JSW@?U?gUw&9)L(85~fD0Zj{zKpxyh%fUO=s>B4
zM8~y5k`N-hf3igBByy6rJ(MXiFQdtDph|zDPO`UQpmrWe+qCJ?>e@A$0TTnIiS<Hs
zLrmo+wE#RsFH{jA!XN-aGj#@9;88)jG})Yt94RQ=fYnqK{iL8^S9H5$7ScCOn04~#
zN9$8hx)DSEGXW6JPg1~a3|3Z!5Spc?fi42RZ+|2@KqYB6)VH<e2qvQV$54Fn2r1zO
z>oOY<)<WDpib$k7SFa(sDb#3D41f1=L@3G-b(fafY|m7d59yMwJM8i7E=mMi^AA60
zf)&=EDA0Z<j*#^+G!hx1ZsKs1y+B#$wr#%rWmH79ETma6$#WA?c08mMRILZCqUmgj
zdyc8^a&u6vxQvovRU0_ysg-AqF=Gl|N#pQ~Jl&(mi%2hDsC}Ug2hJ>X=6c&b>=YhT
z`5~<f4_t_2i)3`N^!KlElF!3fL!Ad<<}Kd(MsK0&l<aRFX%;6jpUFNyrCl4TPIQvP
zKc`b;^thmU(Bk}oEj87IHhWA{!2S|rJV~o6Zveibv(?MDli<I|ueU+_YnqU^|M;g1
zg3DC64zLJ_GMvj4Cl<ICD$d7mL`Xyv^53#Bxlt~8>bs=PfhpHs<Cw|DzxQQ9zb6Vr
z@+4{aLU_--dfcw2xx~qo+iPqv7RE-QppmmuSQ!s5Q)f)OyAK@qS|$yk#LW8k!Xs{v
z(|<t_!vX^1H|0AU6F-XhC#aLcjaQH7;(b2<s3I7k0O`pgt4<lYPHAN!dmUoB2-mcq
zsnG$^k;a-MvoIpYvB>#1VnIN*%ZO4DNp1ft;!fYk{`aS<U%pMZOL?D!VVdMG;Hxsj
z(R^S+e-dlx4~cX19i&m`csws$JrCw8U}BqY(?CP0n~O^czP9eZYQK9-8`N!$p*!34
z<NF47+4TRtsOGe^TFAexadRlg8?->uD#{d>cLj4bRzQ-bHd#1V746i}ijz=D1H-(E
zr=P_a6m5lwBlpRc@s9)>vF7FzfM=JpICEHMuCBnrvjjgv41MaVe)vJ|1Hf}+{1E!o
zz=~nVjhpzgaifyf`t6?_Ry~s54`nMCvCU5xB5CxJ8`Vvmyv{KJ1=6Zzss)#hzNX&M
zFrGT?gU`maCBXuEA&JHx1czH7JDs5k6tl7&Q;Kc(7!&k@KdavNWdGJ8zst7A1}gDF
z^23iF>d0N(vIYV-SUmhLGoE7)eq}Vwo|F2q&0QXg*n?B4h!hfSZ*m#f!8j(34zdEs
z`dd$sAH;`s))vBz($^j<n~vv4cF_7QJue!V3MoiwyM69WI-JWDNf$7wE=YZ4dj4KL
zpBanXE>Xx2D0V$w+_t);U*;^%$PSnK?cIyGywTn=Ad9Zz*oL1{IaeGl4+DIgvx||t
zlMrq9M9I9XwPsYR1hJ@^8a+q@%&awet_Iu###LQ%s&!cfHwsJL=pL)0SO&vhYGl-z
zJMm78tjopJC{-i)ccrs@!<oO=FE^ql&*BVVWB7!odwcffI3p2<`FVD6y>IaBa@ASd
zp8{#a7Ptk!tF{r|mN7ltMPM9-U><{d&yYxK;~Q{7cqc)PdM}O~FxP3Rp@vGh1d&6E
zHCb0KtnVPTAXla(?ATBoOVX)8V>Mv~w_ds7Dlh7#DNxG@y#*6I%@#~BBaeXIB|5U@
zEs`0-ES=%Q649eXPm&(OS*KiaLc2is!q+YAZR=~n@2QhCfam6v6dfOg|3u4!{-TRe
z^^+8Q;LuD@jv8IUJ#Ob73gTF<+BKpTLFo5WffLhHX8v`NUwfW&yN%nrjhgSi#wUY0
zVq$@JUh0@}KIIS#7)nxT7#t@iw<$g&M`f|yMoQzqDLGy#Or0jCO5?5-N1cr|s9^Wb
zO-ybd>HoM@>Sp(YVH_Zfje!%W3sfa`5Xghm2(t0nd<@306aEf4HWIQ6=nKO`ArjgW
z1l|LVRYrh<#=>-I3q<WJ^*x>-2HMr~c0j{i`3bW_wB3{IYZ%yB{@hekg^z`?!fI#(
z&6Q+pwVUf9>1%jTy^Et2(ijo}ji52m3_Jx73^IE4%0LcO{1;(w4Cy_v8;t>3=0>ug
zP~eCkmTY9&PXsvrq^~8RUB%!=YtS+1lR^IQ&q}<$H)~KMUedY58Me6mCD4`?u1<~q
zJw<#dPF19CW%_<Ul4jt*967u2WH_{cFD}d|4&D9F+&iNX&~K)wI~>*9D3=3fsmk{;
zRcxXKOFacKG2GFPdRhi@NXv7~6HzG02>jJ(wVvyHLIrU3l28c(-(Tt9K%S|s`k{6D
z6gTA(I{OG=arQqaN60{M35p&}0^||0{?yq)zqzFn+Y9{qi_~FUkR;~3`|TMcw`ECf
zjkU7$q7fD^Y)t(u*DMT{XXX}d6s}pJ7Bj>&@o!J?3XiEj@iLe4;aFz7e=CZ6vD;@_
zQ`a<NZ);JQvc)xFiCFt8teGye3Z<DA!g{`HMUvD{rL5B7lA7qn(7+DvFjE&R`X+(n
zB5O?E0+&y@9@%|R#ogjoI!0u15N%=Mm$8XxLE6SzjrzaU`A_7U%CoLJ3Z|5JhbdNO
z{x;k(S`MDH_0YUjMjw)bH2NYmCTqAAvvX*tgQg~?*8=GZ$+9s;hONNTmp>bKeEHe5
zm22r$D8vd}03>lAhOu6CL5jI7vrQ#xAHKg4MaOc*vPEO!^To>t-b}l4M*|Q#visaR
z4vT9vQMioMQ0bvmRfxLk{!SzE;cKH65<nU|C<VBU$9CblwsBiO&}G4Fll?ef*BjS3
z_}N&Xekz&Zuj49dnlBUt_=Q?Mn8X&8QHy+m2+Y6#D%!D2s*@x<S3`lqS?%~sTRy2>
zLGoP@ubu1icbk<`_L)vQHLW<|J>at;vmeKrr6%&0ezVs>p8_-b=R0`a17ZQplh^)}
zdqWMSdvN;|-}vq<kIUVZTxBAN>h75t!BPuVUZYAq7oW`;218_Cp5^wqNEg~6I-M;L
zebbA6Ev8r6b@bs=*?1#UEKZuGNHLU*^lCX+rpTq@)0DZ1Pr{T<#9n2_Ze&X_v?PN<
zJ1uPlRD5>}{kF(uMhqU>M<Bexe8IU;+>b1bRu6GqF3~v*sj9oTlBHa0bK<#C-{~cE
z0!+$a)@8J&)(#yVbHoU8C`yI&d8V_O-=YH>Q-IX17hV33DI2ml%8;i!**Oo`<NL(`
zyjE1a+g+2GG1M6e0f_+r7NXI_t3c4waLq*lVo(35g?3|}sN_k9Pq^OJYz$kU-J~PM
zLQ{#^09Qnay&R-6m+&)|q+fXLTu!~Me`=6Q*CgFc3zR*7MrEpuxv%oLUr#M+vczPE
zL<8h0Xp>xmNQn!g0(V6fY*q52I<&joab&gD3$Ty}_$UYA@jEeBdig|2(o!(zsa=AP
z0)otFn{9(Z3tTKsZ&W(n3m<s-Gb|fo#p;DyUgX7;3+EgAT?WyZ!%-B0Wh7Mdadc}*
zVY_53MTG{ceY6qvkb!0=BK3Y%(j}y-pxq87B84rD<jg~)n7^;Az+O`@-a9P4JPs`H
zEw$^7COoApq13)&11G<nTUwTm#K+%k!xzOUN1%j~C*7$^J7KxawQ!PK@daw$O#I|g
zFPBxeGhtun@{GRZ+t1l8#+TJo+ddD^|LBrl#EmT*o#3kc`n93jRRvSjQ|-L_3c97Z
zbfpN(JH|eLAr@l6n{i}tMtbq|3hBgi@Rxm<cQ3=Gdqdj-LaMXcx%m?rTh(6RdA-m_
zfs!%A;oH>HoRIO+-qvrnRt{y%t(2HFCs`|1pC}{$V`eaIXW&eaHi*bUbxF7thc5{c
zp?$*mzPw${zXD&?At%sz!qSfPp#lf!+=NIRA{@eIw}B7Z7u173z_aEW?>=Pd|KaYf
z<D%@gK5kJ2Y3ZT6Yld#5QyS^+PU(=6m_bVEZjh92kQSsR1tg@qOL)iooaa90z4d)Q
zJow+sKMXUhwRU{>+H3!~u8SEq>z7ooK-$JUChpz`)6RKvas4{fNcsTFVpiCTGt8*O
z!t?R$=@s=wAj+YPOgxy-PL~_~^g1fHfN{PosQuh2_Z2@e>PW_<H}dDiQEoQp6?G$@
z2LQ?=c%=QehEA<xR6T`j4OW=uK1~_*uAjb8IY~#L3o$c-%ZJ~lBjvAnn6x^&lJv;C
zh^NgKXE=W`k_ytBn!*KIk7qY>6^VZ1c`TMPd%5`@zdV2>Lh|LNym1P%dMlz${MHnE
z#t*8o9x&o`7q}qZYanY19!aIRpB=x_ydiKB*Z8E1dk#j&sqf)Ua)^p%%1d_EB|vkk
zrnk|%cLQH27$l>*R5*FW#cZ>##bJ?(NFQnf7hwwCuzuhSO<?|3g7Od*@+^xxYAcsH
zH68~BMWopRHuO!6tcP#!b-Ci0oCX*aEB)v?^C8*R{zN~yj7WLJG5P#~haQ{pN_;UF
zui(V@(vfXjT{1Dj@0+|DPK@LL7Nqm1j8z&vZem*BsRBaqjz8I*GIGZp(Q`~MrI_Ns
zNDH&mVR3z*GvhQUFt0?=qWfn0B@2GK2J4dCA%86Y(5q1eO`f48(u9w#Mch*1x-}V<
zlY{AF*5(_@OKfKw13s6kyJHQa#H$Ut(xmPT47Dx3u}L!Y7CI`4s%fDrqN}5>sN<dD
zZ(&vxqq`DRs41W~J2BOhKVyuO&V4iSw27PM-EuYFdO|yv^1i{VgfNa%tsN=3{Bly}
z$7g!|gZs)^Rc{yV`m(~w@E8iU$aifFMx)t0^9ni2uDaQ)he2FW$%d`XIJNGexXZc7
zGC%1wzsS;jNnclZK_9$E>55jtM<G7w+8n=7rn|@8xvW%>pK*&NEM(4*7I3piw|@1e
z{vs%&mAM=p0kC|IEZkc1<wu^>=XZeyPu1k~G8AQZ-KgD`1!Y#IaM{!w8HO5k1@`=E
za%&epy@u~5<hE@2_`NGIh>I9eS<qqq&~jGr)bl8>_v{Q|1*!F_<VmuzX}icP{Sng{
zu|C-&Wy+kyl5I)xaNCiXxi!h=LAaW&S!4Au9Tjdf9;%!tm-ML7feCUQz&Rs96Btk~
z5f%PUMH`I_YKj5el`wW^E-%nSk5%B!<861r;Rc_QHI%Y+zyrp5q{y7wHg$(l7*ei>
zsPLB(fcV~Q#}~AW9^eW$=_mCXJ=u_qQO1)B-W_g(J|2=@TfXI!(QJp5LX?%H7~YbV
z;UxAVh9{Q}b^g6|PxLH-t9sd;DgDHIZyZVvKLzD{?eh#OzD^s)?Lktqe_chhQh1gL
z-%)wIAy`55_z|_v;O-Et=-4yER>Fe{NgvySiR)0VQPKHl<Cz-9I`M(rk1{}TQ7PSc
zx7Ob6EN7L`^ra?I#dW3M1Gd91zFwu2eGd((c3BM}tk~5Eruh04Lh%4!^1+3|F4nbE
z$?iMV3dXgQ_(!vy{%hWJl0l2;l8k2^Jh;vTt51sfU{Y&a$KIX3UZ69(u9O#hM*3~b
z^bP9M+t01H6jPOb7|}ZLG@G0sZ@(=8m$HQY#EyX1=PfGG;w>-g?Bq5%udB6>l%xui
z+(XEQvZ~jKS7Ovh-9TfoRBtGQT?Jj*?o?R}@qA8=&my??1Chgb)-c&q0~srfp@NIi
zK80YQ@@`gvgk`u#u22pEZ*KOp5EjloEBh$jMEMYJ(+ucchdbZNU&fg|;Dw>ZVRc^c
zpvhGGgs_E<9MP1odZCG1^LmG|xIg7JZm-{Gtt#KbCk-XoaxcopO<*jmki}DV8g%kK
zoZ_uN83yZ@TtKwJ23F*}12_b0;k`x_kb1Xs<(X-G{h-gUAul=f%ipT6b{KxL=v@CC
z3Xl{zYv!R4X_wf12uT071o<|`GpVHvsjCV=K@60_j`ir{T4eK{QGFL(vo6e5+EIz!
zpxiqcPIW#iRBY7eTPh_R54Ts_ZsJ^-RFz9VZfjBU{i8-z>P4XG;rG6-8#r@&4(Yrk
z?W-)k%<czM-yhIL3}T-XiPoWXFC^H^nsoMkB4v9;h*d1KkcVOa<Q0=~ak3bKz*t<n
z2s}TRsOXyyrVe8<?QgXuD*do-skC(`m@<6U7Q^)E=9F}=7&V>aib4C_{q@9gv5C)p
zE9;-5mooDmjWz281UorsAFGiL%YCx$&3N2r?w-O40%KL}!XToKZ(u9;2Z(xj2+R`<
zc#CoLXff!w`<BXWMN;S3CpCl;c!qkd9{5=j-}-Na6P;xGorI^_QHIR-=AXJ++2^00
zx>?(EIq~w01Kxb?(UTA-$~5b-$Sbl5<H07M8WbBDdNmRYzvK<}<^1wqMjS;(Oxy7q
zV4GjMnn+`NHteco8pDisph>dXxFt&TRHM5hJF|<fX^*0Gk8GE&Nl4ZmO;AwQ{p{#i
zZW2kIf^&sSJ1L2mwO<Nn_|z?MCbu(2jxbXgbx%e>WE=OnIKU}0bnSVt+^#*26j9#*
z&I<v#&!baD4If+t7`ujqiY`hUYzY{VxNPyxOxXemR3{NjqAkvb@e|C9tA+#yD15>P
z)3sSWgiJ5Pr~0qj8I9>(hwU+QKkzFOVhc<7(b_n`wHcu)eI~dR*}AG5XZgtd=7@iI
z_f5GITL(^13~9}UqT6jedD-Z$Tw3CDgBS279FevkFQ~|+=TA8m``SwUmLGqyDSEq3
zpb(%LMkP<XT9xv$e>_VF43U!UrM_(LQ^RZ;KzZyt3}+J%VUk$rb0HBI&GvX^aNHY+
zjz6%aG2=)SXKIw5H$yLI506Fi{PfM`TtvfBgZ3O9Hd%{u3Ey`1)`&vuW|X#vx$it#
z?R$d0xmao91Y3rukHPl9Nu%Vk{dM6nDo9Ghu6_R2>y|K=O81wn@-r54v&YT3-#eeP
zIKH>iM+*;Jg+90Q7L_yQ>XOSg_!En@tz+lvnOH94$H*i8-0h(~*MlAAoEn!Y?Y>Y(
z`XCXu7)@l-0Vn4qV&FRQkz0{<!l7M3cDWH2HQEx4%ObXiLsQL+_{<A&ur6P<{-sKf
zeD)>_cC_GTT6ix!yt4X}4ZpUS564s@X*k#Bn)~nz=u9uednXs<#3bxjj~@IejrvHu
zl;$-vCW5%^NONe@^rJg;8KR|z7Bt17bi`5%I$jdrcK?!M=mlwstk#+-5G)N*u2caV
zPZJJRy;F&!o50eP1{6s8t{LYahQ}L4<^NciD)nAFP>ULMG~X*+#yVs&hQAn$J-s}R
zb-ij0v22UHgkiE9L!*t)zwj5Ns`u@0$O)~IUf{4k`B7(g_1T`dwun33TZibW1lNhs
zF7CMJ_#^WJ66)t=))UV?Z26^<m|GWyB;QbxOf!&7b6xZj?{E+EiS~MnGlggvtWubt
z#~ejp^uV|UUtRPrI*cA;!r=)evo|xlkNPOA3`Si=t-KZ~n#a<i^>IhJmguKE8n(Ki
zwqqJtN$Ka|dHei}cHW%E<CV>KFQPe+YS9L80-gvj5H_9jn^e`amc?SLV>>UjNgoC<
z#`D6L@Ta7>@FUm(v2`)cB*ssjBh$6mY)j#T>BjJ07$T<o5fyu5GF-5Wm?7-W#W^4U
z6ftOmKT)8lv#n@h3#cWZoyZx6l{jh}xPHYK?pDn$Mm&h2PV<+>%1kTCRi~)LmRNo(
z@~T5QZjZb!j9R!TWi*rwp6>J^V}Uo!OCOV9mZ-K(rNdscgdnxnkkBrLAwTtzKI<=f
zbq^?U9AO~H2<-(9G}(#8xAE3S6}`w&Z?F|G7_EX-U@xADH__&8JW%HhQxi7+8WC=~
z=+zw-`9$}H;3)zxFSdDK`|8VdS|0b#ky#EU#8kzGg2&2=Z?UN#G0J++8#E{<kjz34
zi%nm}Y!i4~MJu?Qdt3~?apT?Djk?bgZ%i?xaxWQ?z4_;|!Tb6vmnSf`nCVmono80|
z*Ss1SrkD&My2#SQ2lm4tn_)u>`#FOO;qnj^ru__!9PHdyVV|jtQlCh}TY1vA*aF`S
zOSugIiSBj6ZChGM8Z|XI-DXURp2{QoW>R$2$nVGA7!lQpsKlt1<Lx;vl<ge?Qki`B
zXQ!9el)&i}0eU1zHIftBJRgc&57&Dy+k}}t94RaztXbM0*`6#U?bg7n@s#vor1O@T
zF4$8P@1;(J1jjJ%T}-#{X`NIF<peIoOR<5y^4Oin)916pz0q?&zIrn`l!XOB4WnU2
zd5WY9DPk+pjbI(X84EuCqF7O+z(*Xk)M|)o*UYnU@TU2Q|I)lP^w#3yYA+IAK)X{X
zZJ2yjN>FUFDeZ^Ricp@<i*}5|uG2Fxj}hrMTVU$e0hfNHGxXD>&V@YbuM;Bc7JQzw
zI67OhU|l7)V<lUh5uI%9I(TKOGNl)FxG&I#ncm@jsQG3#<7U?Rb<rCjJ$$v(4u13j
z@FYp$%Eil};Tc!=t8w{>_!@X2Ro*=Fi6N#Nu7#zZsp^DVS)Ah&LLTC@Yqg^Fh9@5}
zjXkiM5jH2Ey5exMud%6zB46uRItzSf3c_-xXQ^Uv-lohugtH8M@mN=Qq!RNA66Y#5
z;=O3K)`Cl~vxFluJpiuz1~AVYvSJ8)GKMZs6Y^2`^S&&^*ac&-z4XvFe|2POGCSNh
z-lP93o4D<y9?a?&=`QAJvGH~YK#*a$&R`wQo`5><{lV(K3w`WW)-!h`o(weD9{GrY
z@+l0Yb;lFj`L+aGj&Bpm;$EoQSKAs*^5M>&pn;J$R0A<{Us%3!<$o-QVRr1NjhS`G
zynGo*@Rr5ed(;7?hei-jOHe5);sC+p(I8EQckvCQaV*AdkSGJ4vPnU2!7Bq%x`#ay
z^|QeCgAeJtkRHtOF-7q%Hnhin-Q4A@s_7wL&Ulo#zgh7Mc_=o(-J&kP%?Y*^_uhJc
zpiAa<kVw5!XJ^%4pPqho5v`e&)SNZWos8f4P+u)ALV^s?Tw3!(rk*`s;A~$*1@99Z
zrDS{N0`hVks;Ro$<cq${;Rtg@P~>cW4|zNaRrPB)=425&oE?RwhuhwUN9~;$xG#MC
z*gp7KQt(fHX>BacYtdZF$PUmtM!@OTl~c4sddHyCe09RQ@DY=OHL;ljWo%9?yob+X
z6|AAu_zowFDNp^$SpRIKNHZ#m=gLPNETUMy8rIzl+?inWFcP~XJ8{Lgz2~d`=~8PK
zt+zjfTB15>5l!t(oL!tu4Q+qEvNy6q<RAr-{`}6*&mw1PXYOJFeZD_C8;gXcjf<%h
zi-e7#i>a8YvAv0@pdjMEE!|UgbY<;l>u~1R)E%7tu>kMM>B6vp0MgIKGs4<f5sm%b
zj&D0_eN9Xn10NnOhpa?nX;XWw7s;pOB#8T`C>^KnHC-suhJEo9u)4vMN1Z=L<KBpe
zFB{r}Q#riaD-$AY<s;iZ8F6=XKi(kX(MNu*54|H3-ox3+`&srBfBtQ5g-K34B_l?T
z5Rbc$1cEWTagLu)#%=n|m-fXGhSA&GhEVG0oOkE3`qy?UDdMW-GIEeQa|cym=>)oR
zoWYZ!A5U?7pFHXxV_cG^BG&3;&pKhb)uPKV<U~yI<)*%+m;u1&`-Hs2Fisunnk&|U
z<Z;;%eBW%InPQEVhZEF(mZ!wb;JB!MFvya2(e*t~gVqwi`^G}0SdQj{4F5^%RX0m%
z6A}RSq4qqs_1>X!BidlD(!{=~H-k0#?NEExx%qyo4xz80z#isFHdy^s>}h^ZJT?C(
zVjgr_LTpG)A%;KM_1HsUF}c@xk3duyVz=j_Pd(1uS}EAKX;HVghl7l^bqFshu%*fK
zeXqzJM{7epu=?Wyv``uYAcvAK6|uP<C_S<yeJz%4lXc+Y`I3v^IqvBbIW<`NTk}Z5
zSBP*K7CrjRPrXA!Nb9ey;>C-!6E(-b(jr>fi7+Y{8(&r`6~^ql+pskbBpgzvF3mNi
zX&Tey8a9xfc;s8!Zim1v5j#A<g2m_;F_v*muIRD1$9{v@EukunyomIK!DC21>LPZy
z?o(4>NB@&zo8*chMA04Gq2XTBQh1D8xznyPJ&mtz$;HlwS@?W6uyCSn^<PY+oW~mz
zO_WNj;#sB}{e!{-fmV1N<G%EtE-YGT^N@x{rHHfT-(bN9Q3Ng4FSI^AB2#cnei?Ac
ztA)kUJ~3rx2AI1V<^<M;+jK`<(WN)GQ0uRLLMlm%-;kdrndMWv^;AibAP<`}O7^J6
zdG1iUL4y&t5%LzTv(ZoD+X?c(&Ieh<>D&|_0$psXdhR9$_>L|MP||bo;nKU=6~<NM
zY*=Z|P-Q8Kvl5jL!kz<mtE4Zh=)#L{I>)8nM2D34klF$tR%r8X)QHUNSavc+i7k9C
z{}PU9<!-CjxTqP9?~8^3{cEc(xj*&waq_OBAZ~}IhiMsBK#`n`%7z}M=xa&JU6LHM
zVVPH`JG_|&m(^P}d;XoKwLWN+G@RlR8yXBGEBHV{!U&{FTa&YJb~1tJml`L}@b~Qu
z4<7J|2y_UG3j-<$B?8^Xl8tupket#asaJ!Nbxi7ZYVv~}7E1QYxCS6G8OC1C^n*`#
z&NA4zXsyqMyF<El&dgWFY|K*YExV1IGv4l4R$E@$J+2g){-8_EllNfMgq#i?J<>V|
zQ8EzN%TH%VY>|03&kvXPg`Y8QLolJ|+teWcaA^uM&ZCC{{mHq;AHD=OfBL)|?mKF^
zSfK4>NiLNM8@2O5hU(!hLY1}_!h2VdNF}|U`SWURxElUV0ghLsXP+i}tai*#TY3mr
zhZ_-E%`CiZhmm1~nPz318+UVeVIEeR8;qX^pel`AeH<pyd4trbZz4kVg88(O6_9}a
zsph2ygwB9ZKQrz5#{p+NWxOcI408icMA*d0GVz)(?lEhh*fjBP5v@WNEMC9L;F!=>
z?T9Pnlgc5+r#oUl^;$GSq<V#XTweSoY3ikUVxf0r(vRU9v219&k4c?iZ!n>c2EeFx
zwPV2%)?-wKZ#>hpc?RbRa(TA4Mk1ibJa!bxr9>XfLw>W4=6`h%%Q0QR;Y0nT#RnK6
zVJV#_KbAA>PdG&F7MMxV=#Z)#!|zD%yPc0ir-TXCkjT^~;G1i#V^N}ii3i8up86sD
z)5giVnI`ISO=7BIQGTy#1bQPGmb69h4b3P9X}?!5@)uhQ=xxQ}`09$?k7h4){NcY}
zusg;#`AAVy4-rK9_feMMoWXw&IyQI9&J-A9;}}}upPRlE6hU1Ik`lB+3?9u=&eElG
z3f~CPz;#rkq#}0&7Go;{2_6RwAkE2QiJP!8AStU#s;`Ot==Jq|w>kJ`ZP%6hFvNw+
z(b-$A{Q(w%8!HAZ$rAG1=~Ptr@y&#oQHa6`It$CSUCG{jdh<&yV$FSvQfu0WB?BK4
zgkCM54tQBT5a!Cx=;2O8iO1wXnL%4tOf>9g>g5kjK(#E2B7T5Sm@02==xYe5DuJzr
zz^L7Pb~>*vuNj1N(chYCV$^%B*;$VYUxf+r0@T-LBXHhf`0FA1v|Y8Y9DZsTXEGs7
z6ppXQ-CA(lyh5iDy`-Q#2xfAB6_b%Y1U3j;v*96XpoSw8gO#PcmQ;|X@C_3CBCqi3
z@d@;iwhw5Z9E;S|ot}Nr&`RFt56pfV&`^23keWwC*%FYp3nTXoFRv~%dOw>zEZyrE
zk7(o@CKigIOuhGFg*ojM^|6>PUe9SGf~Lghn3zW4jTbo47f<QHpM&xhA4;Xew|95O
zHy+r0<NlsNHBfw3m;Auw3e~a--4>mIViC&)^=ZDc(gWo40=Z~knIHJNaAV`mPBphX
zZ<QXpJZbVvh1JD*XZ2QnyLZa%!5Wzz_+b=c&!rAkX7quv_wJdvf6(i6QruU>6`VpI
zd<l9HL<EDY#5Z6wfIgZsmgWx?4ipTEy%HgHij69QTA^hf=ONnq)GJ|{ABLPnOlG-T
zQ=F4vAD$B?KJWFaq}L9UJ6Y1T@0vo+k)z1!mL^riO?_LR*zZZ!%@6luE);bVm$gpz
z>{met-%u~bUQLqj<m;?^9V;TRSZy4<pO}AM6gsgDo9H)-e;IRuLZ8XG5QMmyyX%29
zT%yC$<g2`j7w-3NsPsGL`ibfgf3c_XZsKaX)B!A!NGt5)%8QGslX?WY0fg--fh3Bx
z%7zgP_X-*4BJ}rE(ehJRJzvS*QlY-Yl+p|V^BJPRG!=S|cusuRQb&e$DtI!D5wz?q
z;I8tB93racyskGR?O|gf$Cu)SmW@8I+H8^9&HkC<wg1#DHnn2*2yj5+=|az1dZ;}p
zCHGRsO2O0KgY3=g6&SCh0qr$*n9wR+v1P}s!1l<4dY0)&2u{h?4sY9AMtVj*?-*Ur
zHJ~RtKW73bCTp&w*w!uw*QO?^=X3`7bYgKoK;(~rEou2O&LYXhbqW$)k@I^5=_+iD
zFDJrMNh5LR$sw4YvvZ2)(AAP2292X#Y^u4QRl^q%nBh2|o$kc8_Sw0>V$V9qwb*W{
z-5}^B4a<zrc#s#KlsNV<GmUwhY)?vdm)Lz}gXYIfM-88DQ&s>^3vJY<!scpPGE68M
z`55Bp5k(d0^v#W61!+d$B)sXj#T(?9(Xx&o1oAiMAy;1Ayap+4fN#T?y3eqpvM-u6
z26h%Q6lhauVos#dIjo9sbc$zMF5XOrGwLcWyQmb$e6UeCdvA2&{?*7`Jf-aVa3qgA
z>@csA_^L~-=~Y~Y$yRKhhy*C>Hd-9!%iu~$(uU##bX?zqj|u{Z{abtafpOJ0hJtSm
z+=`WxHd>OrhPDOIv|l`XC>c37y6H?$kE?)$n_j;-=5^?r?@>1!zvhdPo&;;hQ#ZR>
z*<f;g@U?}N0y(~3@BE_uXr))qU9W6lolA`c@kh+*%nxzp3)qe5TB~rXJ+OVS%*^+F
z*D6IJy|~j^jS4~3#2)maP3YCmA(h3Us^`6~7n;}%kGYOqDa`nn92w3D70?)$C}k?+
zD!Dts&nqAw<f>*!KSTFYuTiO^xeshRl+45dM4$ariKuD2<yp3gF1dK-$sV7+sr5yI
zaCTjy_3yt}Sj#w{V6nqe1nwY0|3HM;v}f|&-WPOuJT)X=>7P?oz7-D~e<tbs=pBwD
z;Ryc#82u61grt!{K1|Iqg``CxOOe$LL4VK}l=Z$FtwG#uIvxi2T1=4}s+Al7PHcY`
zCFC}bCb+X@iuCgfTkqQ*Z!C+rvYD&0ycG^|bki`Kjb`!}a~gVMtY<>aQ&=?UvYe9|
z1QkV`8>^oFCv#_DHqTb}njcIQgP@Zk&V}gr0h2Xb;oK2RF3y!h;rkOTY2z1C?Jl&W
zuz3#-RJ_xxg13k+anf#yZfCaN=DWx~*%U{8av529PL^WRBC0R;rq6SmFM;@S4$H&S
z$fFh?Zp%&oGF`%#XUP!7Bb=PiLnlLi@cL<;{<U_32L~#=$k(PPAE#I((&Vjz-V>IZ
zFWf#T`1+3c*Ru%Qf6gMxrq1>+os3PLNm-$9DzhjWI+@zJkb?gDLDkU6nMH*~)ZWeo
z`lhos`_Fetf1YHNby=R9nphf&*t=^3p+AE_9IT`uAdp*^Mb*Q>6zay@lttLi&K_!|
z3q8^N`w+wl{ndXTf<z3RO(md?S)@#DTuogpjSX2;UK+XlH2&!U^e;bu{f4+5^ju_V
zXU?K-X(w#wZ23Pw|Hm)a|K^uT#NNi_51e!Vug(>WY%CpLn*M=*p8wVV&&L0G4A9R>
z`uE8HH9_L;E|MxP&_gGS$a5BXdna2%8x~PvQV=tc#n|xYxBm<-=qC(!u>H&OzwLe!
zbsxL`!t;M?>o4(s;(4EV|8+F~-{SptZ2pVr|Fi9XQTu<k{Vyp0&$j;s-2c^<^^P3<
zb8cAg$k6Y`nDw3<vEGrR-^RQnOTV?fBTv7K(H&X(#qN$A{bKhA46)vkp?}6?yC*+v
zcjV`ncz0yyck{^h2mG+zk)L1Mdrx-Q?#T|@J=tOV19sT%$qxHH*<rsYJM4eJ4*MUl
z!+uY8*zd^>`yJW&-5O!PBR{{jy(2^aTqErF<cH&){BYcpA818<uX=>zj_mw%TsZE@
z4aYsX;rIh?IR1bejyrPmJLWj<$j<L<Iq%5NZ*A|%5a%5k`fbd6a>RK@j(!{Sjx7Dw
z_KrOLlY7oTV2Se&SmL}ROaE*y*Bv?f#qORAaov%jU*g@9AFey{^Gm!tvh$1G9l7}(
zb6kJG4%Z*B!*x$~xbMi$@A}GpPky-X$q)BE`Qg4JKfmqc9U1zq?HxJ#Cx6^`Wat;W
zJM#03-96dixg$IOjK_0FZhkkWJa=U0x3+iW=eM?hz!1+LFvN3DhIsDC&~N*CM~;4L
zdq<XjXA6~k?^oc0fOjP7pCp2Se}EGR_y;_JfPVlK2>1s?fq?f!3IzNEra-_yfC>cs
z6RPeiRsRCVy>)8PpHKz5BUQgP_fLod-I1tYqu!S$&>d;|HR2sf`ql7`6#Zg&Uy&Mg
zSC#tLh<7CDSHt_#!+J-0evNova#-(64(ol%VZ9?czulbft5AdPDpCJ7>Rol}-y7eN
zqTd_ek)+=n-<Kw~JJR&~sP`r6uB!F#qu!CKUsle2b!*Ulg=^4#m21$SNY~J-lJ8m8
z-Bq~$?X=uiy$1b>d=0v*e*Fs!?DwVUuIlw~2kE{NHt4Pz_V1(KF)#fxNcUB;LHCui
zLHE_NL3b6if9>OacelIB*uO@+V_o#yxxA~0{YzBNJD%BoAN9Tjao#r<-BrZ?wV!v~
z(S9|&?{0Qi{rcC4_sv1~Rjxtzm99ZtcckZ+KHgWn265e&ocqexAg=q8!*ySB{zSb7
z-BrH+bxQ7-e||B%t9bpZ;T`GuZSJ|Rd=0v*e*OEX_pPY8??}<_qu!CE-y7d?C;Pqe
z9dps|jqga*Z;kIOYlHqo*9QHGunpq5Z*JnbFI9h{X@l-7YJ={oYX7p}dG1KluZDLd
z>7RzI_tmml@2X}0j$PJ2(X(0qM9*gZ6Fr;tPxNfo|JJkreJ3m{^y+aS^y+RC=v}cO
zHVz<*h^33OqN$Upy{&`2-OuaMxuKVdTbf(Aka9sk{q>&NzpuWQw*7hG`CnJHYA6_4
znHsyW{Ohh-=ymP3&d_^r6`i1$tsA@8JCTAopcl5=*gH9sf_@hd`q@icJLred_6Q38
z>sM7A42?~p4qYvcO(mTSJ^t%fUA>*T9sexgQ@C$T?HIJ}7|H=uiUCwPu(BDjvQh|f
z&k$U{5p7zzOH*S?VNIT0xYe@3N&`NIoF9pb{r~ODFA?Nro$8#A)I75>Y~c2EWNqr2
zCA~P+ehq&cKz{jP_Vn9eozR$9iuN`!xmLBAn?oJNn3v`@CArr7ydBT4!IqD;w&}>V
zvgiD%T&ioPw8g4epL=x@#ZPn^Mxu`-v3t$G(HD@H40~bSfq#k4yUk6m1)tXM7f#&x
zCiF!H&;H2pkbkqJnEmA8#&D!j`J=G)63#fx5j5j+w6OJvB-Aq{ErGyhDKUFvckK;K
zLoSSwMt~m14=DjxO7v!U@Ou7cIYZbwk%pKMZfloV)x)NW<95PRYV_u>-AifGBtfxC
zS+%oAJR=GdMt&G0V7wOJm29GN(XjPu&L-N+k#lW1vAu~y@0;v{c;T@5;zd#UbV#d;
z!m(?x9aCy5pGG6su}qVI!m)3Eepd69K7TzQ=19DjtJ?AS4hnO0=sMVDwY6_!ySTjz
z9o+|y?M!_w^}94b`p8hzo^M*?99+DZ*l{qY^Dff~d|*Er`KA2qHRh$WxdWY;*g{bk
zexi$wBOdf6!x_VIv#kUAUoSrtSUVy>U)dy|$@A->Q<39OoB22vS_9KV*BecJe#DBu
z4SllmHOn0OkqF*`juG^G(y-9_3i2ujdUQkhDW4n_Ik^vZwfDsn^pUqU;fL^}p`jvg
z)sCBb#K_4nmDEQlhStJDMO@U52ef6y#Dp8@KfTWq6ElQoOc2Hy3k_YDIYAjt6H<{B
z!^$hlYN{0z!>Z^C$1?(fLqqM@_izOW2FS^?k|UOM&uH{;sK~>Wu6JXWO_j*A09}u=
ziB_MYkFaz-_w)@(3#FBDjBV*6godq_p3f1gO@J;Uw7ywc^Z6_q@^IN3U!wQ4=+SKk
zU&M-`EeKc%R(hdCPTq&!Pi=rrMIN(VVe|0k8`817x%QyI&`|zD+?c9_XJTS$<CXH)
zaI_;{QdfEH2A<h)jqone_siN@FX=G!^?8l>(VL(2uZKu|%@sQMktMeGk@XS}!);>-
zh5G5p`*Miy>(0P4xaF{QQw<3rk)_7tCTWFZ3C3)a%$^p!#T}|FHzT|su*xjD%mVf-
z=*_WJf%wRIXHrd5VGB7lo(yp#Xv2m>ko}L)7F0k=)31L}g)E94YcXbT(fImp3?OBT
z*>|%xcpi4h^C8n@;Tq%V3OKS}mYS#5tY)^iLScy;sm7$qE)&dMNN9d(clhnu9&f*s
zj6T@ZWv8=m9Z6w>t6P3+t#?{8P*Y6*m8r}3&c1?<b*%xilg%Icc0)ZH8?)t*(iC<)
zpAoNA*HnHa@gJG(;!l5=LYqJ>FTo_CZoq22{<+ZSKwLYE%Lq@G%aV1**ugQ`Co;k+
zwGl2};#d;e@+59N4uGzPa{?Q>j}cieOFL_W713!}kD-HR#CVNzkBZkN9AmcighBi{
zK7`p)B_s64ZPiO<9SItI8m6&x%+NvFb$X*|t#d7XeF)l3(1t)Z2Z<|dr9ES?h7SJ-
zNe63#5z}dCkC6k2z!H@|WEorea#lk^T`mD@;)>O0x^P`>2-E9wOhaN))^n!M$boM3
zRl?3!BQ`O=(5guQa$Y=!UEE|6#E!5=RSL|s!I4)zAwX0zmnf4iWa{4W<)DK4R^4Qk
ze|GyilHHpWQege{=9bCI%r{Ez^X<+W$F|Pd;UJ;lWhK&WSzAk+xjCM03Cd{*v^{v*
zJ4jN8)l+fZt_xk8m(xTuaLey!s&v;qL-<yj&9-ih0<<q&rkZn7*rQKbpwFFxn*(?u
z*YY{cA<bJ<PKz%nxoS-b_ODw>b0utUJIwZyGGuj4U?lwj)${s%5m>0TT;}-Zv|IJg
zr4kp%xt`FvHQXTCT}9nbL-jd1XQNmpSC3C%;`bc&#ik6OxREay4b2@><T(wx&%iqf
zH6g>DEbHvf`?K80KP+SR%s0-$A6f+Uv%7hek+)%=u><%B6W9r=kFV;Je71wgzvWCr
zE?hS#4kOHf9Cd}av4Tb+?P+kh^1&QaL}_q=vIRQgCwmElzGUIaY+)V2?xf0R)l)0D
zHIS+@4^~9FJWu3qdaHAm{GGxai8P-O7dYGx!<-(-gwic30|wm>e|kb#Ly&|pWqM*a
zr>N0D@EWhic>EB9!TXRUP7z7SiP>B38a12||L5DiXbJ0}Whq;f)~#8`Oa2}7`1ec5
z%ohHfdx2;efnlb{vB!0N>B!wUiml;A^V{+Djb6NJ(Y_zOBT3>;06XnN#~aoM?=+$W
z64pSzI`Sy3W2GYF-K#eBpviBeW>)5<fi4nlte3(ybzSM65T=ZksZgs5HTKp})Hf*1
z3IWr^Ec9j9y7Ce6S8s1&JB2yOx)>upBtBnj&17lSXr8}-n_E*z&=!L~5Yci{2h};y
z%K|P7!47Py&60j@oKy4`IM^e?gWwC`<WXp!AB59=F{_I<SW1|<gEG<s*7S3}<hC(h
zVjRwhtpD`>N8`iqHje&o(BvToxWcOzv81SaA+xEbz_uo5+;_#Vkg$1yV)=n4I)3<V
zW5?5X2EuR&%b-?}ET?tR5cy1(xXaUKkt}5cZgF~^{`Iw|gByGhUAt*VZK@OBm<#7T
z&`BXJwdXE6TmE{<!l$8Yu3GvQVK5!BGq^WhA<~2}j`*<5Kr97AR6^N|`!T~$A5+V4
zeyo7Tgf433!HzR{dsKN213nu}#&o{x(cO!Lwfe^c#aW7yTu9-cEQHAtzJVrRX&!Av
zr)*IMKCEnm{~W|$FeMYjTmsFLZ_fAkKrR(cj*h(BNscW`vh+LLkFb;5bcocv1kF53
z{p?p?j2sL)b_%UZy+enbB`oe$M#82w@fc30rD#ebm5Ldl9J=Brwg;<76MUUlXvd78
za$<%^w0<9vimZk0Ug|Avo8MK@9qphT+Fzrpl-fITJ+EafL<u<{K8l^JbS!+gzXS5f
zOsOIHgqn|oJH&bk(t`SNhKrMG&F_yilOSP1NX5I5+4G7&7KITqLcqUivcS1WXxF@!
z&FfTs+96;z9o?2+YMLxgz$7(y8e6_MF#7ROQ$k3hsVWudLU&RSDkOczpd+QSHgz!6
z@C;lcXYhK>+|hE+&USnMwvy<FT3VY$B%S-RqGms0nyk=C*a(}FFL(7a+&CX30FNc<
zQ+RsZHpr#WU?W+14hBtkM#$hPt<ZLvmJPgNfTXvgh&dNK*^jumiI>74z&7ad-pt0P
zMHo^A4C-w37l8au!Q;3Q1+wj~B$(6=qesFsvkO9SXSp~O&ms){z8J|qSQZ#163pH5
zs+N_5@4|I4F7IJXNASXWSvAm+1%sm<Gma-8u>jk@o*$a7d<tlYvitb9p<x40KT3Aj
z7y6uRHLz`jVO@Ub_v*lLFb}VeBU-m7qIz|w_)Pj?JY~AFaj%Lw_seWf=uX&$&UGfb
ziNzCd_4T^|-#Qa({ZV03`una43E)gNUkxR@c$^cu8wYYpui-4_V-|8qYI$w}@B0T=
zgg>M2y@C^sw{*B5BQm4nw=({4J(1k56E+4wKGnF6<k2Y<4eH?V`#7953cr8e?nee@
z5{I^&sS3I^lhxE!lMF(eZl=Bmq}ymw1>Z)7>$M<pb4_Kz2MP$>^myUvoWMhhtwKt&
zmC-bwhfap1%S_aU9IY6~+jM{XSeSAyUQO|uIXe;JnvnDDW-YfBqve~Ih|H+?V~8$G
z$ordD(Q3Ki#8uYreU7DOP`B0w&F(W#>T4BC?#Il#l@Q<1bHa+QVbdiP0hfgAiVe|a
zw8FEj+Y^U#lyB|(9c_3XL^T&dnU<3zD@-7joif>vw-MG3bAE;ygC~-~_Or_Reay-{
zw^Tw$Sm!Vwcl6w-NHyF2KD-|LKA+h4cDPv$S~8$7s1YFRih;bMR-FS%$oF2^il-F&
z4}6yY0d|X3`2Y{W`k^1v13y#aA+*cpv^&#tU~2r9B>U>~GeCmt2Y2_e(oS*brwfLk
zM1?HR?XoWt(ZHH2IL<~l>dr^KR*++7mv*HAXr04ZS3%;5tZNq8pZ>IrnK_#vVr?pt
z#*PmeB|JUM$VBJcB(K}Y78(a8W~mdqMK-e^AKQZ3;Oj?k*0sHj1;t*!z2<wl(E_pa
z4`Ip+N<|y9B4%14lF-|LD}4i9#-Ib=O`uESF}q15T~~o#vSXa@SEl24g@qJ(P)7w0
zJBbG({es*a6O6P8=dlNPr9lye*ChpyR-ZqnH!Ak@ijj=PVN*Q3_I~;!w}rZVhQ}+p
z>H-;VOt$kXr)yYz6y70(?t7=u${1P8f_|azOA|wc@TP}9Xl`E)R48P-S2~68xB+OS
zua(uZ8>FTUX2w^>C`r5;XZkUh)<^c`*-};l4|Djmk<q0-6F{qnP_*?8gg%T|f3^_=
z84wC52R4%dahKamqrIB8I^ae#{l?B(G_j5p^Ew324S>t#V`naM<jWHxt+GF*lI1C6
zd!<B-ak(hz7B6`6BJ@C5bF+*tZsa5^Exq$JFEK`R$Vh@GmZv{RwJi+``e5e-=RiYY
zBC`m}{)O1<Zz4{@(Kg6n#5u<_MH|`Y&-d*otx<zpS9;{Nkx8WO+SY;l9&ASSt<=!!
z2mWfY-Ef5*4mT3Z4Qo}VrUdUqeJmD)bpZh2j2dD{ks$9Xd*x~fGmn(`8-j?aU+325
zT0IeD!RabB4hmEGgqrO$gk$Uy+us8@f4k1o$=bksfME=BiGIXPtT{kSqv@wL5GuQS
zg~L_~q|fLeq})AEQ^kHR=(!49gzF&J8UV}K$$oj6c8XI}7X`#2xd;nUjp?A9hH*Q?
zbKDoELFixK+%6{}b_&U5<ai{b^F~W#M!!^RAS&nd$G!_zb{-aAY}J*!)<ANo+vOL$
zWqTlFaTmL=m3AH)Q{a|aU+Tz@UddCq!1S07X>IYnm#S_m12hqj0^5%f511{1E@5!-
zZ+M~Y<nSs_AmuX>EKdNoWzc<YnKV}Jg{gdqkxbdd48R^YileP&dI>)%|MF>46!mu|
zI3cRZX#<I`dFgEX%U3opmR04w6%AI%nV5<2256}{yts`-0=%8cS&6zb5Wsk3eI@Q;
zLJYu|De6T`bO>Ta0;R02>|AzdvP#HpF1eiKa!=MuP(~MW--{C%7-*Np)~HY^aM2~U
z)glqTyG%_a6m3I#7rvwJT>=6<<(|k^@jr=whP89b0A5rFU=JJ0%UEfjCOmyR7tAFh
z?gF@q0?1EGe#e7Wyzq^SnH|02%9U@<NBjy=I3FWZ=j=G*84GmZK1seP?FuR%ACa25
zm0a<#t-~@HABU)Hb=E+1^l5W?CWr?Cm$D5Qz+NHxHE5MhwEY?$91Z?9s?^*}Rgpee
zv~Z}yd~67WJqD0ebaf&G(xDr1H~@Ttl~nxE(%w$RRbEQUa?^JeWqMza*xyn?aqBkV
z;s+q>l2>0zqTTfO9ew*2Jdo4bvjG&;4A6o^h7G0L5mI*&f}CNq%YYUijb2Lx%HnN-
zS|~HA@gdEzwb~}c`hfoRnWh5BuER#g{JQLRE>riGOI=EIn=p)M_i>kw9ryCl6YLe%
zO2}zKM(nwivss<i!3fE0RH3XG3iWs!YXj$jiXKEqZ1cRG7&AP~uT3~|Q6_B31}LZ$
zz>6FiBP3t&O0qXSqkSI+jw}#?_b_Q7d5IoDe8gxw!uz;yy_YJdxz7OD{H#e5=oH;q
zsMs|aKeVBZJQ<U(IELg20M&Ht(;D8euLA|;o4Bojp09-444dMbn227-2So^IA~#DT
zuRx3b(7meYwCqn=xYI-u%u5aj50=5`s|4{WeFRWPG|0H8ld|(x2D=F@#QnNPe|a(Z
z>18V-f@Fh&2f4YuyaKgj%K%R|d3|sN+7e=1Ax<W~++JMM{7Q-H_1BG7K*C27PNm4k
zy9t;0)<&onKb;sOT`JDU!F3>gtVtt$t%rw9zy{EVhYqQj<bD7m<||ov)MaqkU`-i5
z@}#w+CPl0!860Fq2k(vRRGVSdvl-kDJ_@*qYCtKCy)1a~v7xpCs%Tkf1m~5E7qcZ3
zG@~Mkoyq(~iSTsN4%oM)Jpe&<$*O(jkzreCyM_O`KlNwC&Kc96ZK1dfLCIUOO=MG7
zm_}_?nwf#O+3GXgeCKV+Zhpi<R_t20R=~O)424eC#&M&~NCY%B8rro^xJ3LNi2q0e
zs6ie#f|LCiF4hMw8y@;El?`1`9kovZsreu?`x0mQrhLvt2Ojl9R^->}AEDDeg@hJ6
zHcHj0dm7{RB3Zn2K^u9fq9-@Pfc<7Jo`Vjj-(nCR<Eqo(_(7lqPDDITJZHd&jJ7e~
z<nqTVLS{Qsh2$ZC9ujn@3|RO95FL@PrYyk(M`3OWaVS@CxLl*ppnld!Ur@#=A;*Po
z+5go;K#I6d{QjrVnjPV<@`$MMJW)N4eecnr4X<w3a|Z(IgZQrzxmIK0zK$BQq<zDC
z(%pK+*cqO4IBZ=0q|yg25FW6iUB~35lg477)mWXFzh{UV&lffHtSD85%u*G)*IX`{
z(?KgBcWu0#a;o&Mb^fKt0$+3Y_XLqD$O|F7$T)^ILk9Z~0=;npk3wfhja<g_1mb8j
zABFT2OPw%$7_o|a(P04mf?H;f@|qdlezn^`gid)xbEb$rfu>RLW-f$EozjOqq@8@=
z6c3r$AZp0KA+6XJufj6dHnx9p3Et@uKsTbQ8W~Q-=iu^nG`KUl9+aT?2|@di1CT1&
zv^ygVyqPnH4$Dp-5gZseYYudOB`gT}Oo{q5WQ2^*Q6zcD@X;g7Wph1c%>Yvu)1?kv
z3fwR*XJcR{mW>5$AX^y8r~kOX2^3G*VFU2Dkt#%1BzDr!6G|x9*hEUp^4J)Y)+_-V
z@Z(0_g~dOF=uplNM6?Gfmy_vFI7^V#JxlKo<#@`VWsdg}kc@=8?hHWYtQmi-6xs0t
z4#4izwr&MYmehI+(1qmA#s!Bd)Bf5UHPCtSp${{~#Is_HR8tp6g!admE6cj?$a#0#
z7?ANR0J<ps>z_Ke2qc&>paW+lLN^sPWaz+bdA37_bGys-SGa0GvTRdmM0-o>I1&=K
zjRh2Yob308c)E%1KG4M6DXSmvNddg!pUiDTmMOBR`>{VH_y{_6O5neTyvN9fdBb?I
z=9t}R9s@NQ-(Xm3ez`;zs)h`JKNaxbIN5`?x`gJxcR}ZC`sYw{Sb;QxrUe7rA0Z!V
zKt5CXFn*0wsLsoZ=P?~OaN%IgX22|C1Jolk6LCXWC~pp!S>{g;{y)Qda~l{4qY@Ap
z42QP=dzj3DPKlkxhSRmP%lJ0E<{)16!O}>-Q@l`Y=?JaAk>kfPc9teVs{KAE(UjKk
zwqq4K(nkN9A`dk@?6a8uC7Q+Ta-#H(Z#n|ZBV(eB|02a!`k#Fd?lGF9$0sKG+deE_
zDKHZp>eZJ!|J}o;XAQ`W%RIcsYJ>t^J4}}UuighE9iIUBr>Nx};+&?wLDx2;ggR6o
z`k4;kC~%{Beap{FJz#5=odGF7xxlM{GZNoo%m!bf{iNi2A<qdLg_FM2bag^sWG4A%
zhWpq0H;DwpA7V}%8S+s8Ql!1Z`~OX8)gbF8kW(cP>6izS<|naNYIYm?1TKP6@NEIY
zd!k*QB4n?{c4(~tt+_Z8lwQ}>GTEqH%MrmYFZlc`vOu>PMs04#dMEf~c=}}x2le<I
z;Bp1%LMrc1^mo%W?d@eT(gR7Vpe|Hh;@)su0u|`-|22L-<o_8zG-I|fbA~a?G=Sie
zO}Y2Y$9<ZROz3iB5q!HYO)>OyAB&vZ?>AauU2?qsaK5tvS}HbOj3&39K6gv^*NCp7
z(f)frz2O3nT<ZAKyDYv3kK7mlF%3V(b`1Mh9pI+VtwVLa=Pm{s5FP57!7^TBMSO=?
z%ssggis80r&;$@tL2fDfA2Ph%r+O*%ye&amj16vUc3?}GgcE2F9oh=e0~f2MvS)s_
z%cYEwU*N6hjn$$rV8n>6g*dyCy{;}AF6&?qx<axnLUiY~B;rwUFOnktEj;@5Q%iQs
zAs*2E2>y_^2A~J7!iNjoc${UPhe{C-s`DN<mOyu^M0vgTl;L<qiwrtcK#dQhth^U(
znyz(K=*6K#aHO{A?*wC@U1~~0?XZTf(PWFrV?aHGe*v%!%za{Gn)7q_8Qg~MKG3nC
zvS!K#Hz<6KGk+qlhxZc2M2sT=I!~_UT?HW913mhNF+Fkt$#-2|uoSo$WxgncW>{pL
zjq7r%UlaKt-4D{+4f?eDEkZ_kJav+WgdM;zq|1j<?O$m^D%1fSHS3BoWG!P7o^R;E
z>3Qsc2FUmc7o3XB(={I1JhTH8E(;Lh|1@Il@vL&%3K1!<C(-6+ic0^7{sMPZJy+U3
z(jD2KL$LIy&tRSPu#|Njlnd*zIcijwrjt&9-19$8XttdesdC4Es&@p)B<6uM^BPR`
z#)wLz8de_(3So~zYql!rDVhHg9?#s^>R^bA+psRl+rPBOp#l~UIj*<{atbJ=wwL9n
z?CUY+LzREJS=%wia8aP+ogM})PySUlA|Z&L?tV3phY_e@H3I5bN6O-F0Qp-ISrQp4
zW?1nDN207%(lI025kB%XbWFX6>*)4`lm(i)yv#C%{=<3^ID!PHgzTD#H2J=K!%BNr
zajw}f$Crc>=g4rf6WS6)-PV1x9|A23Uz^Cob0zFL0=y~8tlb;2X>1?<to29cKJ@hF
zVo*33fFv!Qc?qst`7Q_@b_+1`#WJ<k0gG$^#<0^#Dz~G5Z<dN+1l};{sMJ-#>`xcK
zZg6IHd?UChAnd1yK%2C*{E#9(hWB>T1wVgOcZox+bRM-s4MY9tp|cM10dz>D)H;p+
zXZsGi+!zrxq;MNviK4W9)%H3bxr4gfa6h7*8|eICE&7!5ud@i)8%`A0s@(t85l$t$
zUB{<IR5wf^d7aPrXQSLLu<>DJ&}5EL7_Ra6TBJrz$c&zfi~U4P)XoUkpCitL+!E`=
z?2Ja0nDg8Wn4m}I>po|^t}JOoW*|>wyI1c6<Wg#0gIsk62e5VD_EPm4l$(4uWly1&
zwdwEUX|BV83lwi%rtUR7)?F${nT9`-G95PpHj6ZUasf1`HW_&xZWYvW!7{X}x-(Y_
zt|G*PaFX5{LWT^=#V*<Z-j*{8@zCU{Yre0f=;<H@wv$&_hK#rse(>ufZoPok|1_R)
zP9J-_JZ;D+Yu~(C#p>zPi%)RTd3coi7B&6>zT7!o-BDQsL;|d!YURYmlaD+3(V)E3
z;54*jU*G7Ud4R9E53BVl?u-HS`1a$&xw{m0RkAbK0|TI(iFqY<qNiH>h*u8qvq&kY
zoY%Fc&0a(!iJyt{?;rSUj-x|@p^p00O7(kl9zBa}KgKw?c-21KwGw^xl$QZ@)+K=;
zK_?H+ci#AR6wtz&0BR%sxk^9vTj&uzPa``^AS(;*GVt$O0fii(jf~am6PblJTu+B{
z!xBL9)I)Lcz?tB#S$sY^n$X!{ya^YmuN%u4^!RHZmk>O4z;`HSnqGLH>B#$R@h-&x
zOItv0X0>)AYJSSiJt`N<$gK|&3lVj@OcG-ZomZWP>rTq(0HtPkF4hbhac<3K(fEfS
zUHb$U3_f8?K*bB$943puce?O(AWJu8t?7E)yDFGL0O7mqV6zZBw6KuZ@Hoy{4YKn}
z*Ko5(Ut05?kxii~0P0iPsk27arQ8Houaj0JDE!2sPkxMf%=1DFH~`Iy<Z9@DZy}0u
zD=>O*=i}NV=xiVSP?gj9)MnTn+ci~)>im(j_DgT6w-K2=FiDS0FbnxL^Q0kx;}5+V
zB5g-r7@AYQ>#Mg!R6&nRJLTCETmlWD6vw#RZwPi^nq48op#f=&xDt4Cr+@lhwX}}~
zBh@=49Ofjv(UV6pdu(&%<r3m29R(-6N}D0F1V8!cHFG{*0NR>e$OYGI$KC^ozaitB
z#^hrKg#^{?_;WxvH*~hbj-?s@t}_Efi&89WOx>@$LbftG_M<+dkL3|kduSn}O0^1l
zF8jow-qK=5KJ;*tD~vi<-3iKk+^LPkOLFEg_ra3yGcz}FH_8nU>4B(4(T0i(XORET
z_7Bl!$G3FZq+4mjl|iV>kg5Sf*iE1?LbD5YBq^f!*%8{^{h_Spblzycl6P^l(Co<p
z(0*k^{Yt*Hl1sjb+<-kkdJX92LqPP3;C+$=!N67UPrn$JkN&f|O_+I!RP6eDd(dBR
zz3YOlQm@_xey;6WFE4HH)F%L|_@jzahKWkoy@9)p4G$yH)<$L`-Kz499trcg7QGyV
zPq>=jR;|qM)m+DxxP+1-m<K_{ttHUujP%uhorc#ebFxy=j+`!?yTBty$YbE%336ea
zuF5PF3o#5B&ouEgs<zZcyA?O>>ghxmm6altK|0)P%}-Zq+G?DTy=rZ^%I3v}-@|<U
zm+u0|jT`SazC8loEb9kUp+dG9*@DpPnO-hxA5>?_m?2pKqO)%8R5Q2GT-Tw3oGDh~
z!Q15K9!|3b-Q^#T6&?Au1M{ccbtvme-m*5-O)TkCnY)GfJ$-EcfeWw+T{6)Vy?<xZ
zoR<yuvObTA#LQ1oB;bN}pL5#ASHPi;_0#}Z8tq}~FJDec>3FZQO<di!1uH5M_-RKz
zmN15y8EeSxHZAddzf({Tf}B88w6_6Xs(8Y*Z1T50qSNlL7!b=HM^&ZKlm(+_5%teP
zBE%5b(z$h>yu%ifas_CKb<>St>{x5>bbpR8EdQDFipc(x^NNBJeZUnQ+&0)>xar-d
zq*S|`E@9$@O*OxMLt8YL$9b<iQraN>J`pp9A2pev-Qs6XiGMpHz`6T=CejU+KwPcc
zA*7^pfNrS{nO?STc+AKKPp$i#Mu@H1SF<Ft>!`j*uc6CDwj~?lI(6DxtTH2qN|0LM
zq`F)F?nz)6A_{ZRr||fA`m;?xJw?et2EDR3)I|jv0Z@|{S`z(sQ{xkFIYr1&XH$w;
zlXz{YjJm0TKO=FAOChgM(@&1{zR@sU(a-uUU>NYTZ!<psSwStw$z`lhYUAyaL`qVZ
zwZ{yTVbmm4LP~<F6XMMr@Koa*;wbfUw6d&-1iD>2=_!PC#k(*}fEpMJ2Mbyf5$(5$
z3J1=xY~fN;)(3vXgq(QFrtB}LWD?k)ene&t_%!nk$8Qr<1Ne+YZnjxol8^t>!FP-x
z=yKSr05E>ENpJrK19t&&NN0`B3J+gX@RZlE3}J#(!+Sm@rE%lf|Bbu=n3;tKVWJTX
zjps2CZ8@y`wy|}Z5A69_-p#OT<$a)gUvM0iHse77c@~25`W?yhaO1=0r>C5Cu=K@U
z&u_*JZG^?k3IwXA1`>8pL_Bc_p0rc`oFdPDi^Oo&i;aNL?<FWFo{o4-zVf-HSr-b3
zRZvqo?)PP`v6jP(^LW%)m5BnYj2Yhcf_XplGPEE;QmrYb|4>zZnlFa;E)FDmoaOtf
zeFYYblrb7)T+}s{6^{B5>_jN2$Jdf@2+tNnC1u-X>f&MA&wHXdrNzfcA$a+<4kUfa
zl{?<quY}2z*Uz}BV#)V)RY9OTuKFFKXz39#E=diK!7Ag-Di)QL?2OjmJd&o@OE5O+
zv0k7sO~>$h3Wd=sOMp|S@)r`&4kaqOT<GPwvuXg^8VpsbGzT9Y(@&dYF)lvGQ6&6a
zY??3e-fb!;ZJvQ84nKvio#h)Wzu%HT$?f#h0|jo1Sut8a(iq5F3i1$(tjM+04@t{N
zC(zrN4<OFJSge7UgK7kE#Z8b+UlY0&n{=ka&rOp54|i`J701%`jgoMH2oi#Ou;4Jb
zLkKW91P=~_JHee0LU2fMhcLk4kf1?>C-~s*gG+FS+rv5M`JQ)u@85Ubby?LzRae)p
zUsdheCB1vs1>@Vio{f!=gtbi<SdKOuJJ^^rC46QXd`67P?yxkqn6UN(`bBz7_~<YE
z5n#uI-j)OEQl4a%E_=R)NxnZTXm~waiIri|l`7I{#GCQ?UCLeP4~@(r3T#uBw;Cht
z+#c;yQKvtklthb2{C*@EZcTKy7UCAUY|owl)RzHMPz~9Ymg)Fh@y`N^d55QUW1{Fm
zw!hAUL&Em_OIc=)Ydi6k+1Ot`CPK~wzl4A4G{*gVc=}}t{<31!q!=3j=3y%S9Q{-a
z&UM-HnR1Oh(Q;5~zbb3NgeIZ3wG^0d>i_0jx1^->o>~0h{8xZ6>)tGh{)dO`oyfs-
zm+QaUCU7$H^_K3he#<I@(8}gEbJt{G)WBC;T)EpIbxQ^lxYkVp@QSAj{ey2e$uFle
z6#ETDam2a;f^=N(I5V?LQjQ-~in1YxI3j)eSwdjw5C@a0;H*!r<C>C56P;ekEmWTa
zXU-BAC32>+!xm#;1D`YBlf$wynJ1S&oe5x;Sr^~l$XfR9d~Dy($eY<|NZ~z>`MC=e
z{+he5?|EED^H1tOh1Pkre+nnxs7_k>i|+ffYDzlxQS&i~3fqEGZNg64vO5=hfK9Di
zdbtTve~Fs--J1|A$=R>=pxc>6K41>qJhcP4a$neG8Lf``)-4wVgPsJeoJ*(jox<;g
zH7}0uLjDZ64~Ry;9H7|UILjz(9^bbbGX0}KY#L&6aBeca1oIZQ^&pVxIt_^HmWh}+
zJ<V?|C_g5~e1IM#dUv+Fq}IXfaE{n&zr*fG&f)9Y+0nF}pYe#YF3-9#oSc0#QBtTT
zVa@i@CC9tmF<&K6vdt2dyrHoBZv9XCwi3!F_u}V2B$zKR)yOt&R<HGvj`<fu?{8=k
zo?%m!Z}<w5KLe^(YC%3dS|~Dq{{!kh0o$+<)p_$v2LVc80T|YtC_sTQ$lw38(u$<+
z6E*^;1&{EzE&-gVc-+*nxskW(akeqCXmw8-vg{fUJ6XV#2?EyLaH2RERHXC{B0zjk
zD&<%+f1)Ml<2Y(JAcR41?d^9&2N`6TFvmdCd+NozPDCVvCIWs>$)DUK>t7P%YTF+V
zU?G2eAGVLU`bC`OeW@n!?4IK61CLl-L&}?f!|B&UBZv-|Ow03VR6xGvI8H1Za*dma
z_@R=cBMBI(H1~FRi2Bi!qumF~zo=|`rEQWey+ER;iMaYbnNr?%CnoR+Nq&RjGGdp%
z(csR{2@_a_;i+ydsm_-Hv40_B8BfBWkHhzaXnz6~6Y3x9v3-H(v4D>89w-{_P452q
z(E*$z=w=_NCn?kmO%<YXAUJm))TY>DEojHQY_B*2q(Rt*O`PXenA>r&@j5UD;=%j*
z+`Qu5jw6g0?t=yq4ZTv`>zU1H?oIc!<qatjM^GbFpLt}?l(9)NIx;P2?v2PuQ98pV
zk&TPY*z)%`d&sO+3OOe3Jou8O0-m`yAfNCWu1#T2B8=PEZ&f}+mO87`?`3v7-K9&#
zAQFugonOPP^Seg)@q|gzJ%G2D?xIGacV{Ls{{;2EqTUY8EquBG_9+#mj7L`d@tjw~
zZj3(7-QQrm*}Z&_<$Kv%QF~ADwYCfgMjuoh^=cXkI3Flmhp<urfqOL)4;th4Mkj>k
z25S<IY!m#PQfO1F;^otdEM#IvSv{GH=fmQUeWs9U+eY1v`z&SeD0j?&_N57bGXd}Y
zZOrZ`umiad!zbVowxAR-Qg>hq1HzT&E!q#Bcg3<8!D!zD=0q=Z1m@1R_utCiJ!4oL
zX_FG<OFdf?t@!*LSIKNll~9c)CyY=bua86@1s9&geMxqz?bnNO7#8X~lTM}-<kH>n
z3{a8l$9-z9*5ZiNHZ-z}F;{CnSj`OGpgw!J8MTrgAG+bNQUTsd$3`cTmO9Q@OP^dI
zKSL)10~(9p_b0E?=XmR0(d2Mc3L3xbb8)ZXt$Rb0;|S4cG2swyfX<P%&zwsgCnPG%
z$_$)oqq`*<nw`Z$CoDpC)!c+lG2Q<v)eL*g)TClrA)~<URbKfu_EtsdQ+T-F>tfSy
z+Z#~wq5;{6%<>_9OOMH;wy7ds?kws&Hv!&BC}Q;*@^EaNip_S@d)L$A?)Si$dnp!1
z*H(IcO{;&7=H#T#0ygldNkC%Tj}4&{iUp@{@>q^^zMzOX9dwSg^2y(aHwi2q3b|Ru
z1J*a6V2s=29>P1^-oov#FAGm6lj!>bb{{tNq$Ifdy_FS@Z_i{63|gX1#}R2TA|o6g
z{CM;BVU2|C*nYA8*w>4i#;M~#(w!~@sa=p($?e1xql(L7Q?QC@1zr;OBzh?+EZ4Sj
z>gdPzAf)1Hk}1gz&$?t#hU|VPznX76`jw+#=4il+TjI-UC;3Z>iX-`-d>eQIK{v9F
zH3-e&!NrPo`9(>xtgv8LKX(e2&CBXZd-|%$Cw`9zhY6<L07U%$B=KGPK}~Y|wbi~;
zgW)<m<y@>al37sO3SnzBJ~oCtmQErBd~`}nQ08lAYRyV!wUC?gCWf#5k<9kRbnMtP
zvCry!HO)0HZuk=Yu;xtiP3r-62k9S%U0LIAGS+T=1G?SLm*A5H+1Bz(znXdDm|<NK
zZjI660l4kkhGHSSo9c^Q-J*TZ?U~r5{;kaNXSk(fUCB3hMY@anF?eb;mk#;W3K2{U
zxl+d`sTl@`(Ls0%*MQ#ZQRN)fH?bnki!n)>oIz7;?kt3x$TtR>dh0bM`9X9d;E`&+
z-E{dLJRh1Im_=8)I=L4_MQU}*qD4K!V<#*W%xAwAA5SD37W)2oqx|&p!_d%XgSfNP
zWbC7`&}KtJ>RnH0Sm+~jf?>REMqId*GIi-i1fV%fRSa)wT<yci3JrZ2d3kkO0tIwj
zeRfeV?mc9?^lIaPswxP24MC<;{RpVGb_vM?I<8}LHV_IxomJ5IH|D(uZa{60yfIZU
ze?5BS^HmB^-6%<+zV;WzRUOqjV!eG_324hsfREU&u#rBAql}jkazMd`AaG18&alu>
z%E;x1OjJHJG~qM(SuaG7+<}y{FK@=)%$G6HJZIdp3K0Yz&-Hw49RYY&<;GS08!|&>
z<4d5|T7Y6KqmGPl-wPTVqwmpsAVB@qw@}F2;cpNBXCXyo%;5!G)Z!WL7Y-eni%~q>
zF9mXqu#ZMh0Oi>{L*OKbz|c^z`&)r-&ssnkm-;}`1A8Sb)Qa`s+$!QgN{T18&R|em
z01ua*&S8QI1W1Qc*2KaWLDszV4%`Pzsx-O@1c~r0R6g-#P<rS_#`s%sz-lklcMK1=
z^fz;Ffv;Cpw-ZeczpgpSjrBV;@Ok)i8r?5$iK-WQUcMV)p;~5n=B~7v<9e73G~Q_m
z!2Lo7KposlbX*sV81asPOG)hm3j^lNaTlNkih<on=9cZ>5T2%yagn8k(A&n7L^xH5
z?b4E~D;A%HV~m6Iw3GWl4IplBO9+zSY-PcNz{8_mZzoJ)ktf|vtvop`R-NV=*AAjE
zsG}M7;e?y0!=U!>p{&|9F6MdjW$l!C(-C*I+P{u5v;Z~KaeZ)SgQ6(#9$`ml2P5Hj
zXfZbQHd-?YPPMtE7tyMrW14p>D^Oi0kkbO0Gq36-I1s?hFY0Ry+ZdVRt5eJoH<>fn
z01B!-Yxql6^y@fpoqmqEF~WRwG1XHDGhep{AO7Ge(~SfR2NalZ42m>?X`2^bB$?O3
zjVe#Mn3ZHM`bJpnTqULUXCZh}SxU7r#EL!?CPLGutO=Ihvpc;%(DkS<&5Ajo!>;lC
zDK<0sqFDg~M^YbdW5<$IH>cp(riCS>>hLt$^3THy-)_04mwQAqI1|H%v7)^$V`0xH
zh)$LQhM(|Cs+6ug({&!&IK>aLE~o1YbthIpXb641b2FUwA{&{8lC{v~c?{@|7;jwh
z0B>x`T*vp6ew)fPn?&3!n4#M44lFJdPm%gKt?)CS?wv>1GJQgiatX;ZT|@0Ds0f#d
z%!AZy)e7{FLE^l-D1)KfccLp5wxD%Hjr%40cyFOC8K!S={%*criO0CHu}S~li&^^H
z7D2<)ClyO`(IdB>x?C0?NfDgMr}AX_WP?J=IJY^aJj+k4zo{nNjXfs9AN6S9$Ht*;
ze6)?&Z?ri*FkQZwgm`iakC74FdEmb!g!$H*1|;)ah-F9Ky4DG)uyv`C*f&0kH~ltN
zmGLIyVf1cE({if~ai3aa2ZG166O)g87&3m>tVrQLpxLaKIHI{eVC*d+XnPpYw?n3n
z^3&cS0pk>VBvaQ8DiTzD)KPgUq&qvr>pE#8?;@)SdoL}_$j<ufwHht?S=PXm(Yl(F
z7df5%X_38F{pWlfx`Ksu2b>IhEv%+@hZ5NBPn{;gXs=^Jsgf+b<p|s+ZC*R85mXvu
zbV{R5sfL$@Vqdz)C-cA}b=|NwEgW;1Tsrb>N0aeui(D?4-Wh=EP(tiAD!Rd0TSl4}
zuQ>{HU?p?zBTu@AbEoz<+R@N-I80oAw#Xkg4<s0YJp{>0CzD)>8h_=Ru~9X5mxzV_
zB@onm75oKFzz+HWi|=yOgq6+0iFU%tp+e`k|L<ETx8&-eWwj4G++xKJSf_)txwBlU
zHyx>I)lok`(0G$zd)75hB?2n3C7&VsfYM?CwHTm}BCpW2OnHN7?6g3Ou*hjSESJ7z
z^dP=^G?*GbZx&zH$5r3E-(BftHdu9SZ`{;sK2Ul6>uTX!YbQ3S2q@3!5TsZ|uz{8-
zRGjXuVnlzJJ&}^5h~F*23w^22O&E?A1|cH>87$?IML7)47Tpgb7~ThYF<_hKHFuGx
zQ<%O%;*glEX6qW}s<e?PBh-sZ)5dQ5-ts%<>7(zplRqjwPdfCg>1Rdj+Qk{&41<2i
z`<Y4xn1xOD-5fuFZT1+;A}P=`>nIb;M|9M>N>J30YT67o_THc~uVGBtZp<<ll|u#1
zUH$pp{o`~rwqYa7-z)p-(y5c@z1u?{lGmtqVyF4_WEg+W?d;cU$JL9PHr;}FoqgaG
z{)PSJsJNg$x~M0<;nP5QPUZGS*V2c?4W|PV?7E6Pr@qC7r%o$`%u~jdDk(=#V|kv2
z2c}-C!glofNdx1m1QfBq-=Xr0-a29%P>dzP={1j?1z$BVD`3-7lhn?4rG8)M&;~&c
z2GQzNQO7zw3Uo4*O{6XHaV>YT)y_ZOY7c~ouAxu;@JPz^?&niYg6F~T*?3Cc-1fF_
z1?|4wboS>KJ6$$<>U4X!9TpRb_i5M;G58hc%3YqNE8LOYnV$pV{>7egYv9`Or6!W}
zx<!AB-8*zY^QgZF%ByAObV}ALPPllDm>4l`P;sf@3vOJEpEoYXMXd9yQ1B53g-O(O
z3^a7-!{W^~JWHfmJZ!$7Gd|~mMiXv?R*XBM-MxK(lw_oOUBa|N9wl|a!hoonw34c(
zST1T`qXBXJA{4yNwS3>hrJF;<R>M}LE^Rpq*JXK#A$V>3z+v>2D2Cm6D}=G%)Tvj?
z=_i<WOH0*_qO<A+!glyMd5!2-7O3!bmd>#BO`-0=@ab^54a;!UOshE2Vi%hR-a<FU
zr(qFM2c7B>_+E%n4X3crvjxz+Ng8f-ae=!Mh=tKVCqA#U>q}8&=Gs}#pvlTRUXB7i
zJ4H2nX>y*A0URi41?Xh{ZL+E67MnsUhFmRk-2*Ju6SG@$2HtA@5uAnjt8?C(By7@t
zg?4Kds%qunPJ$GDy`S$NlJlrWwI@<JE5Bm2n2(Do>qO|=Prsqhi0lrfnIMhRwc|r^
zDf&Js<Y`T^`|Tu@?PX$K0PfqA2$BaQnm_LuPQmwCHL*N*N3Em&juIqj?S1E)EAsx~
z5KuKHpGYv1X2v%+5G-WP_S;4F!x*$*<Tb>qyMMg|*>L6}I~=3}fibp8Lcgj4h8giu
z&iwQjr-(6`69CR8;xT=wzGd_6;@d=`>Kt0~xgdmzFb%WFV*^WH>*r@AulJ(s`8yHI
zU+B&j$%RkQ^WGW)yTi0ab4<yy+E4llio4gk4fVjhaVJS7YC%z-G=z_9CWloLRF^8E
zY;wBOMt?tJT2%(CtHT>Cm1bA6Xo@m2(B9gSo4htZ^t~bA?Hw_>QcvKBoENa;eG%|H
zd(=b$6_fd=3E5Z&jsVstHTIwx9%`pf#+_Pb_w$hC4fyv@qp+XnJwkQ?tH6MNuopCI
zTJBPtg}0}#Y!T6~tkJ;W)sa|sFKIOJ#HYB4<$pxiDVf92iJrL?L$U9K*Q%>&+;n3O
z5`M31me28oA0|}4?!MVbuAV9kU=zNedt1#?^+iSjRDzVfcv&FpK_aI7Rwd>L%<_t_
z(M5Pg{VX)BWj~2OO;|Xg`RZsEzsJ@_F~dw%{}Zy{(Q|0YiMs>(`uXimR~@qYaQJSV
ze#-XXXKjWQ3~o5qSaymYH1z2lIAfKyJ_1j?j9%4FQuT63=fsE<C$iK?a(bRbv?h9x
zPDrsv{Pul2-&U9dTgaDqIo?z%NIOfuCPT-dfQ{fXbEL7WJ%j#(h2mbToUCd;`j&;0
z_e<1-m0%ltq980l9~YUq%JIg8DILPvDI)wd*-+U~FhD?<!9T$W;zZ#~te?TNU!=*N
z!&=rV>*_(SAWAd=dHr61qSTF|pz{+Y=sS{i@TkDVa$esDHW3#yG^qwQJHE4N-C`Eg
z?A~3^5sjw|ptlHDE2X15{gIu+g&Vs5+2s`@r@hmzYnAy_za%}!j!dmn%?K~NRJ7{k
z)lJab_NlocnRW}ok1=x?cI%s`b%83i*cADq)stY+gWWk}M)TiOGo2}|uYX8aq-kaB
zt_l}0p%X2&PF7XgU!&P^1^k%1{A~;-+3mA>JnbXov98MXh=}S%*3d%d*>(t}OD1Wg
zQo9MBH>wmrwj3y#(hRiAw!CcvivPZN8ef&H9}NjOoN|&FEY-&*T5O$+KXT1D^yi*4
zsb^@2tVbvMa*_6M<T~VhU?Xfkmqgu;I!F*Fd=*z<V2&4LrA+)n-5zU6vQh224l1~&
z8t?FI)-1Z5RmUaIG-wltY|JkL!^Eh2=;NQ2DnS_x>xaoY;6We#pD(sUxPx!x$F$ij
zf|(quJ(7=D&gK~5Cfq`oMN~r#BfAplBlD=*+pQ2f#IGrFtd~hpvIzdL%1(RlZr?4?
z)niHXbDy;q=Pj$C-ztK0_*swF8avt{hmyYXE8mg{D%<-Cf93bjF%DOFH9w%K+0Aj4
zoG_mDkvhYQ_!2M4TUqxmS?^6qRA(^EFSA5_bCNw(2Q1v@|En(85_HB?4C!Ez=*rlo
zT@$lfyTXoJ9;U76jBl_~dL*aB6>!B=zY7s7iUjk!H#W#U;D=>*&N}l=YUyuLr%Hg~
zk27x!O>(73Kf=EV;~FKUtI%nvj?L~5m}~{*<MSuuC$UR@DJ{NZCE64?+dl0_5Z(zh
zHQk~HS?|B=IJrcCV!7<zxpbWX_#&dD-I7UjjpiS#Q-Rc;U9Bx@2EkPc)w7&?3S19U
zRYy6GlJdQE6k~H45|;XBOp>$PSKoh)ej@WdIffYuf42(IvN{cGKwTrm7nRNN93vaa
zlIKspe2R*O?jkeV(9qro+xU|e-Z!`BDtv>&9l&(Syx&^qYE+%f_3KCLsEPB?>FiPf
z(?(4}Yt>n3G?bE-Nz%1a`7tb9p>S}s(|RGa-d%c~ikNu9WGmTQXbW^Cx1dt^JU=s<
zw6C$f?tLSzgZGsyKrH!z6;5;Ir*oME_&N1cTBaa~&ASOx8woZ(!Z^+Wm1Hv9xlRy>
z`Qk94vp7~A%$EP~q=qlq3tDK1_42oOpNwT6aRE;JZ`xiiDoyYT3($rVqWr(pO;+K1
zxP*9UTl|~dr<{?1&UVT<K8o>jTz%wAg-_mVj-VqjT)S=Q1!L2%p(XX17PyL<Y$MkN
zW`2{5uQ_Kd*J4-XjERjzk7!P}$d{VK4l&{`Y2M^8(!S8v4u;(jRdVYph8I4Hjhmbf
zJrL#Bm+jTbu`VuE?W5n96MkEQc14$wSRU|O=-VV#zITrSB{Qn;{0W*gd%gmRP8P`1
z$1`DsvGf}RrQl8f0CbUA`l(xu)n5B9+>V)q-<syGuRqP3@Hf6EM3(v|F4_WC_ghr8
z_v<Vz`5Jvy-TR73hW5H-LOhsIU)aw^278hyKVlVM71GLN&%CLEA8ss7;J}!?3=J7E
z8NtnJDqzKgr(cc{^d&c+>|qeL`cpNnl*uU%jTnVT?N!2<5vurDh<7wKFU2ppY&bbl
zTxeL=3@AXXC@yOF&}ZtS8G3$PMLJi#-bMIj6G5%AY9m;Ift{ltTs^+~C@Kv1rL)5y
zd^Eug3>*IF&TTp$R}*QY+#iqj3o@V3UV)M%2fvFO%xhM+;H=~^SSS4-Sau4H(d}6J
zAiA-K4|YY@=8WHVJUDttsu+G>s?Nq|O7x8#HT>YFUuNfpG7h`H3!IgJW_tV&j=c=c
z+V6+h>Oo%C6zsIWAk$c%q^pvNKFHxFpXTl`hImn@9vv!}Ra)UZ%G1%uMWDlHQS?L2
zkGHKcOvg$~$U;Q(nRcA0C9p>vK&)-XhM^9+jg65u`CZfII(=jtmqm@(+EQMuLlg)?
zxc&1WYsU}UC&r-I(RiOx^Ktz*3boIRo&*BvzZ9nt69!sKU{|(*cI9fL+VXJNbP`W3
zbgY5&Kcu&_Mk*s?onz`{ea<2E3Ca2tBSX7($!<ZaxXFaMdN?LJ_4c_lvh{-Ab&<>y
z&^k(Osdsudi=c9mM0h!Dfdy2VjXm?k2Bai;b^+Q(hqieuJ_Y7ayvam4GyCo48WY+C
zi{Xn4w5)3hu$go~ME*6g-D*r%$aFTKFcwFv86{|%81Asl>y^6p1lmTPk5(wQT%{$#
zB;126atn_33j_uej`m-7lwVUbIiUX+iPDm3UJ8psp1NdU-viL#Ujwnpp5Vf&m*u8Z
z(T`rcUfuNcSaBQT?3zM9YXv#D0Bsy|j%@;p2P$ekZ%a#SH<iL-a}n|Z)55?+Be}im
z#hA?XN8nrA(c<I-Z$|N;3h4-VX*g1vl-qTV^oy%_3=0={y61Y6{(>Y%+f1QX0^eiw
zndlB>F+qusxhxtfdj^MMDvO5xNyG|{HS{f}i6}%Et4k18x@w&C8jllzg9R0zs+E4?
ziPr&lZ-2eUbV%0>cF_E{n;$Rh5x6DmV)GH0aVp4Yw)`J(HnNf_=B~(07Q1vbH?%r|
zF``37oHO>=RnmA7R84NjjKo#sPtsT4RsagImM9wg{E4e~!&5Xqt2OFBxMFA{b1~~U
zS3s5Ic1-_wikf%6=P|^6PvN^~OKi~+9Hw3W6QnD-ATmAg3T8fG5F46K->~W!N081x
z4Ny(W3VjGvI>ORvrG(kF7y^ikoN^i`VmT7;*>qq$h)^vJ>SU$RSNz;s!V>w!C7BTT
z-X)%-JmiqO?wuAvy(X}gKnV}r0EPo8{%xsMG)lCB@m7;WZ1$JG{!@E?Qi-a8_i6gB
z_Vg&{iU3&>v+*kZWR0pmLirFz+Q&veT`d-(!(6YOLaNyCPj$rn;$jA^oD8{@Q~^zE
zuM7-hfyF1rfNW*-7;L3<QGkyD`wU^?3rkM}0#WaIa#Jkl4@ts}8Hhuwb|J)r6=2E1
zpGdB5D_3BYuNB0~Z^9@Wm#l8OV%g~WsTuPlZ^NRa(*2RaNoxt&eerTj#DH#p^`bsQ
zb84ON2)zeKEi;gywM9nb`f!e8ZjC4Tl<>ffmsp;ps@#*9Sdm>yo5q5I-OWeTV$S%U
zE$6(Yw9K++!1e6m`wF!GA))Hmdq$sh?V2`XJgwI;F=ot&c!S*?*gpGO*N$-`)S9&J
z^NSE2equso$I$Tu?OL;$Yj~`^2@E7qb%1;GgQ@;W8iET}OQdyB32a^Ea$Rv6P|}{u
zgUbeXRUmn&Cxdb%b9p781KBBkLV63FMSHj_XnNR4f9x5=-uJ2qZ0+p_v`oE}wXmNi
z&LllgpK`Oibjm~xA|>BFx9=STRlsU=-z)t*E31eJAS^$f3ua$j%Qbx25O5`y({T-2
z958k#sek&EB0q1Fki2m49yp_rZ#N*kba*k>f*BiTA@i>iBIJ0jaPGdSM}5#plbYZj
zThbLBT~G{2FB_db7GPkM)HWNKiYm@mhFhY5Sb^^Oc@OW&i6u~Ww>4u>@k2yN!Fk;g
z$6PAFGa={`Tfl-8@%x8>?q(P4usOK1F&>Yd8gpdtJ}I(i7dh??co)zR@sXNxe&e}s
zFYE&!v@hIT!)nS?dqsA8p8L_O$}(;%!n%(**^%;KfeD(bau~}kh2Z4!88sWZ=d@>3
z(&&;*F<U&lOXPy6(YAlY^GWUK+aNiLKcG5&4efQv+D=_|xd`Pd()}`>U^`?2<s{^O
zI$}RSI5JNyhRGT0+*xZcyN7`H%e|w{?$&A>z<McP#ZQg-a^6HADZdbWT~!R4C*c8!
zxO4tgOyWgm5jq6G3SDu&;5TfVhGU9O4u185Au?Bg>%h~crwE!BxAv-}Q6SZ=rY<a+
z<b7BR=wJLraY?hLyX07WqzF(o>)cvZ@+rEWeql&DMZ^aU;ZF>(XlzZ5chs-E-f5_R
zp^8sn5&HlFAuHS29AGqFfYAy&AX;dme5BRgqd5ShL8i$%7!(O5ne;-)c&QBt0}P4_
zESz&P1h>+(#wosXnHmEn$QIWCYuc(^NqJ|B2LC4Eb=ly9wO8?n?r#89m*zn3Il#tF
z(|4`ay_%Qgi4o)~-5f^csp=X?Obqb&1`aS`OZhrzqANc`c3uA036o;i+@;`&R;{3q
zqE8T|_LfA0pKP{}3Yj2t%~jXTiSRY;(Ejs!g(rHu$9(?EgIwWW9tRn4kDokKLnf&b
z2=%jX?xWX65u&%+sm?B2<JtM>+M8dy-=s>2yZHd$K)Y8pRG(XBFVOS&beNK+k3;rQ
z!Jh!(eyL!t;l(uv$y{}x9LYq?x=rRTjvBlFtRNJ=9;8F8*>Ub8mK(f6zVd`PeBd0f
zt;1ia3pLDHsJqUa<;U=Ys1AFk2$=5SefpP}hgOy*KP3ZBS*!TtDi-IwIx%kwzHotx
z*8H|*m}t3kho-meK$t8obkFnB&kSN!zi9`0=T+3|DFGS&{yQa)9JvN*2S(VNJgy?K
zjhbZQ6{8Q|&ShFRQ}RC-5TyAez|(glqte1`K>K6)!ie%6NendWGfdZ6QyjaQS6CEu
zpDeH6kT}_aZho8jC8CdHfq3r6J!a@uP?=NYVKwxD3)lG>@WOglfV{YQU0&c?J$&I)
zc6%dHghzvuJXnwmBX@rXyM{NYX*bsyZUUt}P{vMe3^*K+wFQltG-H?|;W14-8Oa>i
z0FN2jy~%(&zMOEu{?eQ=RQ}6gVv)vy4{H0SXX`H8;Av1;Iq%c}&VI}MAMMo)s(#um
zO(vH9au=dxy{eR_UtU64p~+{@7N}J(mCZI*mm1p(9wD?2Tmz-||6CV#K1%uSVyW-W
z#$54rKQ=>3zQ@3pB&hWAa3Wj0YW^qB71Uk#&yeT{3?y*R&noRz4CbvMU{*6bOn5{|
zib?P*CW!Bgt>CaGnaZi_F&BBj2=rz7Jd^NQzzDj!kyV84QT*9Exo0GU(!Uq%Rb#ro
z%p0Jcq6MQ*w1%{rV2^x=&%zqX)Y1f3Qu02h+??!6ip%UWWa97b@EctWxRam7K_g*V
z!d&IM!n;-hzFJBO;Rg2kT(EbhI%X8xmcGZLmbE<shX9NgzE@!i2-aCmthHcP4ye++
zv0#XDUail?>tQ)=nIc}B&cJZpzQp6XdCV+3Q$^dD8|kg%oMpX+_BW{<{#DEyp{1A0
zE^$K7U9d56fRXsPyQje2O=Mt?(ha`jfJR5{P6pSu9d)1l{OX4&V1mT$QCvKssr3Uy
zS#xBkmS}Z8A!pbT_&#awYz=^<L=O=0@eNI#B7?T|^37%5cv)s_am3`b$!Qo#THO!Q
z{M5)xWp{ZSz>CLwU&lvj`b>^cR_-~onk&_VM%d`m_Ou5lPKC6<Scj=QZwxo<CJPi#
zIJJacCgHm!sbk;sS<CGG!F?@KVFJve1+LDrD(v7N_wTSCr&)eQu?^x^2#P3{*f>h}
z;%8z!8#B+<o-?1Xe@iFm4WdT2==Tld>A3H<z<~0oA$|}t|Ess2`Q*{vOR+&+a6npN
z=O`;Wk#^9V&6AL)!-C5%%UVr}Gm{iU%gOmf14)oM-x`wm%@HJ5cIJ1-Q!!+<CqhX3
z`XEm42<$50FiKPF!mF7r7GdK`%B2Dwjb-*56m{h6_6D$UlWMy6ij)HtQS*DkM1eEH
zoh(S9_?5s~UJX0Kr@v4)qTib^N>;Qp1vCF6QjSEJS4~gx$Y$xY)H*a1>V-cm(nxL1
z(|qBY08z=-zntjecwx{K(0}xhjgRcT;C-bC3+0Of)*s|!Xb9=B5*xhHMCVR5gS-SW
z*-J&fcKbx;JvUUB34YwgqV*F3rB232%1xC-cyO&&y!)iht7=Z#0KW^lsTK)zBCSlP
zn@$KTfvUairSfEv%#S3FA(J?X<ok*Ck2I6%5#U9ldud|Dq{Zh$T7-g;YTdMnA$rhL
z7Ufh{equ%Q#$4co$0FD%9jqO_9mIx|7*uS~ll@2TlMtzD&Jhy@6VbIz5`C?AuQ}w7
zNOa8_j1>#2ffUnX@5W4AaFdCU=*kmSt#R1Cwx8w{MUh0Xp|M%bFMgMwF^<S23@S|4
z7CEC6v;1cK=B3-@Tg;dD60_30%7J3Hf>)xN6Z%7-cy9?MD1upuRJh)jkVj#>ysaPd
z?e{ltBEr*24SWk^3bj46<WsucCzL^6)Y83H)f}dVheeFHx$1)9GHCvZA~nWNs=;!D
z&920X(!1}1lExrD1;fF?$J$j{ApZMeu|rSt11W0a-)v9Lm`X}i;xM2mX(aQw0$=p$
zBy3G4terQjYGtx+X4Rb;JKqo0A+1#m)<%DTi8hlyI6yJu(EM9QZvH@L0pZN!w3)hA
zv;=x3un%Vb@K(m8@EjV6IpWu6|J_ua%KP53$)%g;i%91e86~bvHN731bwnZ6f1@+}
z%bGK}XQrQ==rQ3;7?Wr(+=#HL?HD<;2xy387l1~o-h7mOb?`J7hMpFh>gC1b^420Y
zyy2LQnAzeIZ@Cw-LzPBr!SQ+I4*~lNWXX&;psfpXhOchaPw;{*yL4EFAvNKho%r<q
zgE+*BZgvS*Em~W7mR8y}`+fH3A;9MjnFXuV+D9wY?|e*d6E+*$gL^H;R3j9a3R}m0
zvB2tVolmB+ZJiF7$jonK-`wt9JYuIsX0*Toy(22V{w$Z8^*xR!PZ{z(KS$ezlCYxg
zb8N2ICMcQNMuA}XcZ_Q>4+T5JOyj3_Oh|^$h3~Xh!EhL%!C?6<`!iB$=F1Y*k=0tj
zJ{MY;fjua-$VNfmQHWH(WW4RQkgdnL2}yM_3?MqN%UT8e8ser2Q&-o0{E)lnM66hy
zVxF+$JRqKN#>SXi>4A}`+NZ9gA-nD|KAQ8o-b~sVqqq|-o;I2^2(DpNnbi`IKD`s6
zXl1(26R_v(IOyYKa^DFXc=AQVggfF|8$TDByWUcJEPZt^5?ocrbR>*Ql`y2PPBx4@
zu84D9RC_nmo~|}dMXEm}(x6OA@Zf1NKl}X@j6VT>*WKuMtNEg~q>{${!Xqu3UMp91
zpE<&|<`uacI&{;##^;;u%h~2uY1RtslY}a}-uS}bq>SC(8427LPsWDQGIC;tY(b^j
z6nyJ0#7Z31Q#x~$YL=12(%UcxZ9B*8AAAi#7HV7AW5Tu#;>_}e!o-UD1=cw5)-CKS
z?~x&v&EDhm$g;MYYWC)s<AEC9?$9ZZZ%bZ6y6QgVbfRC2+1Ky#I*ebl&D_b{O&<T*
zsrP0XP9C3z`fQZUHJOEmPjHiiM`r9Izm2=c;5t{eKeGmvMC+}@)ZmQQl-r~p&em_~
z$d~z<gSH4rD~~YxLB<P}G$&y&AlK)(^uJ)o*zHJ-2X7`sQL7UTU`@?*iF^~#W(Wn>
zycLi+&jieiO}#u-Y>Vpj1Y&Ws+?F{&xIjW8@I?inPr-UH@R7C)@TmBfk06{KK!8St
zNZNT)Rrx8>4w=}+>GPHrDJi<`3WpD=<(Pn_GvBbZV_&oQP}xz))L#rpB@LCL@I!V{
z+%IM<;#(aJ$5K)`W(0_!Gr-^(@IN9WH1x0E%su<Vc({*;HAf*&aB)R*iwoNEX=uEy
z;xyxlz+s`wYJ(Am=k#xAXe74CvhS*qcGOzb9BF_2fxQA^`3^aTjSh+d%A7MDdZ`!;
z^M-)R3Fx=paZ+zeZBl3`4QpcGGr*EsPKDAkhNOe8A}vi$v3(2ycWx&S4NbjT#*h(q
zGFVC~2z-z}5{v`Xob(R9#|8(|Dw|2YkHY=`%`?F{*JN2KsjcE1<PB=FIjqa4fB`qv
zU&<#X8`<p|G&Ee(M_$N$3c&{uKx)JRnmPu`xCnj#<tr^*(b{BXspGlt;fxC$@=`n&
z-@`W$9nA7ltJWtT>*eGDoF79szJA+Um)aN7{|gs>W|QFf;-IPy6VN;}7eYLh6%pl#
zc#dmekMo1!2o-61?$WU`jT49Bt^RZ1>8a^HvLhVeO*7IMpXpqq^~T~aJa3vy3yXz}
z3eei(gm~D7o_+s(y<lw|SU;$jJ|}60)H|=K8l!fReBNW;)bTmomN!ItJ?_{dJ^Xo7
z$|c6IRf4Bx{Ki~W%b3FU=mEMYJgqRmB6fVk3~5EMQ+JkQGw9FwbNH40yY5^Z=fw*V
z_|?JQ@cI_%juMTxs4`eQk$W;l>KNNg{6Mm}l}5gbFrp<$cK;{fqpS-U#t<Og0n>Ps
z1^F<RQaZBYmOcS&)(Pr~ElX9g1NNjkt0x1cj@|2^!!{W>Sf`Y@r6~KO0imW51~O9H
zKi9$Ht=5AqIa0-)j+~|Q)(ghvfYHT2!Y9S<c4Rx8G`b|pGTO!BI~BE|R#E58aNaFp
zWyvrxj0OJ|uDuG|invg#F~9_(?K}4n_lP-3DXRA^n3wJhmS>+-cyawex5_ud>FF+~
z0T(=z6#suSeJOPeyGF&{N#K5B?qKHP>TGUekMuc0Y@Tra_i<eR*gfS$nihTX&vPg!
zC|L_vS#y_Ja~GMjmzhY<W!A#oy}Qi%`_963);th(ku`gPVhBSq23*noZ#jxVK8hjW
zVD}yv(r*C779wK}Va6@{IxU;JE$jL%>pJ%i@awj$>9uSaBZF&y2k(EkG6CWS`M}M)
zySx9bApd2Y_uqmDa0~GMw*gmmB@-9h7k}G&Rr}w}tNxccS9LdttCy2G$NvkqTlF~P
z9L&r;&CUKX;;JU|`UP+x$KP$EX7ImRmPHms4|&iXaH0U<IDx~$?l0hQB2MH57=lJ#
zT)=^8$cqy=1O<6<b0HlkAJPG5g#Zq)q6|1L;4m2E1=vCd94Bxb1M=bmj&nj@oPa6#
z`|BU-f9Lsk`v0c*9~A%Q{twmv(D{e%zi9qN_jj&;Bl%BW_Za`d^FQ+a54wM-|6A67
zss4-NZ)E@G@gEHTl;!W-?#p2Cf4JRqdUwuRazqjTlL@}YtmlZ|*U}HmW#@MRa|%yi
zC-tScSSU=-PiWK2jjV3&xHvxqddL4~{}w-s`kY=LAMfn!bW+8iE+dNbTl`U$2KJZZ
zcI;+JB%bU*Cmanko9u<eo%VOr@~JRTfF*g8h^>%7#b(uJ$iw&J#r*pmsnM9D*&<JN
zf;~7mQk9?9H9A~wqAVV4^#>?npwU?>iBqG{m1mAnEO_I~1da<aNS?J_<x}CKoD}r#
zM?~aP5uorIHkny%+*(~)Kd4y2f=ZtCROV9=qmT`#Foo`sK=7^NwD;2n{z}G$zVZ=)
z>RD6q-b|vLuahX{_=IJ8XVX7|`*qf-W)nPu-*mFR%tqUIJ8jxmh>_~yKkfSb#lv9L
z?017C4E2L=9r3NExf7|TY&p{W-@iBYP=;<8nsU6%wstHS+~;*iM<YEAmr%Zn^xF#T
zqTkZ>_HjQwJU+hQj+Z(U8EQPw+31`y@H`Yk6;OLun!_<KZmCI)(!C?%OAo8HgwZj+
zH$B^-0Z9%j7j~fjl$)F#tleM8;P*qI3_V<@_ER9@DEy83v&Ysa_;%Na3m=8Dkuzi?
zppXBr_cG&5$3(Ec_y>T`0?z#;2c=@I+FnUSSL%UryX{Cv-r4Bd1LGj;O9tvED0-|0
z#~&F{?6~{%X@K|;|LhSG3I&u3$&4JL{nTa+6f0`C@XYV$k5G1o^BKu<AH1S44{!FH
zKMsEQiiJu2SbXaU<&8{Ij^n28!}q%N_<5T6C|gaVZbSTjDJVl~MI_locIp@?CmKxh
z3(rvm8uMS{py2XsM>LzGi=qgmvy9gVNK`VS)G?kK2tjr5QS|Xq!3+F;Q7A)(;mY1?
zL#XfLa^f=k;~xCnoSl)oOT<S*;deY6)~nxm@Uy=mfP(1>$_L9_Mii+(e37v^C@(Hz
z@X_8s8kAE-3H{TfooAVgha&6yH1;zPbr9tSL1!F_+!`+(Iqo#+XHg0NPWpK08N}7d
zGoRyT;`ro&Oa$>9UZ&wCQ3=Nro?zlR9Kc_@1IFR`g!BiV?KJ$w6GA-qH1o%?>o6)7
z4fw1LZBF5pEiUxx6(yIq#M$#9I*2QdC!ss!rRWeN;Qgf+I1GBi6G3b*?sYq?Gm?Zs
zE)1!<>9|mEv?fL)1xMCoicD@AAn%Jps!lrEtkg|2>N8}T@*STIfgn}8z@1HIzZUL-
zPwnv2I4(+M=4E^UroHetkZy(i!oEhs#Sasn5>GRy$WVA9-cx9&_onbjuU^Jd_RKLG
z>JwV9o-%VJq3(n=9|;rp@z-$iJpUNz>&Tk4x5T1sP7f$dKg~C!pQSasyyEPzYLE+t
zN9<Vc<8(bBspm?4L)ZE31z1msHFC|+tco9tDO8MF_8na)Tr19E#B$GQODTuzSWLEX
zdWHBI)c)l_{@`@WsLHb(4{%VvBlTx0&S?vdVEq32ug(P88AdL@&l$)?AXS~YZeSN|
z_pQG?SjP%eo1<P?bXY|+S({a;2c&XI?PFR~cbWjOcV06_TBIpv)iBm`<wIhEfV!Hf
zeE9^LAViJ@KFZ&x|BTByZMfe{1ioq~XYyvCk@3m!(!|PQEwUN6F32$c(KfbxAiu{>
zSCKxKQW}tpz+k=-<Qoj|kP$X##%yZ1s=YP9X6S6`L&zAF82x<FYRLfB+ivtVsVX*j
zpZg}-9Rp9hEauaQ*VNL@%|&imlc_+44vxA{5(li3=H0MM`rWB>?9r!F;jy+GS1blJ
zt*XtzblZ3XaAp><JzHTAlZr`Inq9K`2l8Dk!uehjOTVLull3-^KC2w1;oDc&Uv*av
z!?U+_3T;LDzgXO)*aTK|zF0}xZ273#aS;X|_g3}p+YsSnGEXGmRUV@-ND9OWK-3%s
z_{^W^bfHS4xL>=F+9}{Z%KEwn5*>T;xNu^93kwrVIw^I=ivQ@2W}7PCuzxO5Y`No<
zjhe|CT|JQ#nxcMus%2!xjZH}W34i(Hiv5ksT-DqCkEPLE%9s+&<mNEU++TmXudHqJ
zpB<yGS>(uV4eL$RfKxo)eUCoD(`lxsbKg>ivyy?#Rp2vUirTC^=O(c2IbJ`OnK=*e
zJDCjrcC6-#W&U0Ms`v%D>9%ea$?ZOrjzpK!=r7*{52j2m{k2nN^}%+j$UQuhA*<-T
zj6>MQT<>NJ=E`=n1;lO)54-xEL}Kj0s2i6b;lctVVw;{EvhpYqli%=zddm~4_acg#
zQyCbBK^n9#z-PZ~J;K-CTJj(&msZ)9KZa}!w;dlo#?ZYo>N2THI!Q97dcdhkARCNY
z(v%%IGMw|hgz5)#(B6^H$4?uv!m?p-QJNC@Ly?=Q@27Ba;)~1_!{cnt-ZtMh6Uw_7
zKVp0Pc4=9;J2gB=+k*Jq&L3-Q&5ad&vYgt-^6g(*e%I1Yz!<=1p>JR+;?sp${tq{>
z7t~bb@(;-f*YKi&Z^@5ee}eB3{%9X3AFZN$8gP65p=);hC*sGNoPRt_VqN)MKrl9)
zc#i6IhFH55Oy4DG{Cu22jyJ)`fPf(S;E(vjhz&hK(njZE2zu$C2^<cq)vBt`Cy==Q
zrMk$1Ntjo<O&l`$pn^LnWgQ-qc!aU96jFrYzWn2(Yq7lbg74C^vped#ucoxOm$+Y-
z`&E}5_l<_K50BBe(b1VEFh;O;e|h1$DY0~H+&aZHsVuab`LMIYDoZUDIORI=9$7Pd
zWrs9aYTeC0El(+HAvZDgr#y#rcwjN5HrkuFRV|nqN55<gO=SU^;u9$A)_luFhZLMq
zDdIi+hj3vAq%hl>XETg<>+hybW7t_eNLEV}vETJLV4Bmva*61h!{_CXf$Iau0=w}j
zq3|Z^K3G7;rT!(q0cGkYx#9A*tMbhr6FOSDrzuYn{>9r55eDu<>iGD#-|@~AD&Fx|
z>x{?LTfbX3^ufk6YIBc%4)tko0?$W`!qmhGZso#HB({o8VN)W5M?3q^Z_nw3rm0dt
zSi-YRaW6@P9t&e9=p>r^ReY<?V!BzWI$^~{CV#AcC;<hG&K6-bmRT?GJJ2hHcexGD
z(!bu>)UF)9dTf(a`EzhcZqgRk3s*Fa390E8>|Uw501{ulCf<v$S1vDhFT!Ycty!Qq
zN;j8Ry$cH#7ZnU+*N#dIF2L_>RTbaic3oCz+tywhg!2SR+iE0s3l6SSseS~iFxaO~
zeaqk5AW)7sZ*A#4+2d8eo9}rA{4&8Uitt80rLi^P$5)tP>ir8wS&pjcl1EmV-PT9Q
z%I^&5yxi0r%&^~CoThH#FzUiTK@|K6VPamXZK9L;L10v!?%^2G;*jAjIVF>{CBrdD
zZ^x?ufNq=PN%h?EQ#mrY`ZVC^(+76EwlLI^XYG0vkYuLUVp5b9YBFRgJ0Q-_?I(T{
zB!97p@Jin(Tu|T3hu4M;=6a2lGF^I(_MF|t@-2)J%h}_$EfBml`I&=vNHTm>hDf)0
zKNkI^j4$3i;X9ml-8vK=IjaN>BeEOE2k$a@FVrq)J*VVUk(IO2_~p0f`f2wZ^A<G1
zW6BD{#SzL-)|AtmwO1`wi$%PH5RTkB$B_EPol1qbS;>a8!v+~I-LZm`dJ&XA6?&rr
zu>u(Mn{HB!?0==@<O&&5$lcxf05&+bTokn=YNo9x)!rZT$Ml$H+VH*D!FFYPkh)w@
z%G!AOq%oi^{ZiC@DH2|l24a%O2`t`mB?y4+;?$MYP}STjHmzhdytMJ2-7i}@Ky_QM
z>G$J{e0kKpkmN6O!TC~7ti2s$>eg$-u%pyMIjAAULSN8d`zqC5jQNfhwy<r^72uui
zO<^ruKMhL;W)XXjPr^ckFJx9D5A6*Kd`M-=`tcg-Dak#QH10|!cE$ytl06ri&B!hl
z9AdoXt`qy!-ZXl{&N$6T5fk62l5y8S?xj+a4&p4Dl9(o0JrOtR*zosUi-dP5L|sNu
zKj>9rE==qvmP>2c)RJ@=$k!0xI+?<&$VPY)dS~nGSiZ$|$agMhlqNG*qG9HXI=xNx
zeA-sT+~fjlp6)lo+SS=nUl7|9l^EfRx(xUkg?GTpvtQ~cNjX+V`vrG(wy&*`ymEVl
zQA;bc!|xNppt7c@CT(7h^Y<fbS7<bbbD-zag-ibm-5uk;Z$@IjY8d?V9Zs`~Fy3eu
z>P69UIOoIEIZu2SH+@?@D>X?&?ap}U@Xz2yq0*(}+tPL3?OrB-?b=VGg=Zu?J$cT8
z5xh;u&6?DF0r3PrI3?8JneHEEF3YOWd71K_Gm;y6(A;uwIAV?>tL<)n?sCiR6L|s#
zyC=@-x$ViOW~CRe0)mChq^V*4J7<Q-j)pRCC%@`NxpAqKoql!<u|1Wg$uaAub)yoZ
zM|DtVpfuVkU~c+=lV@|qmO|Zw=VD&o=)K_Hr_<veEiq}~;QW;J!f(H7l)k^s#TWn3
z;w7(L=gW$#cXkNORl4WeT~m)m<|$K|7c7t0V!p~F{LZ$;Wx|i)(dVa$_P&yX<ePcI
z4NDgJ*6Uu$@r72hlXN$A(Rt#>V#?EP2+6QXkv;%YhQ|Q0UlKrwSw9FcFxno!KUdBX
zeK{g?z{P~Y(uG;qc=zZeAYp6g(x;GRvdlr@=U(41N5kiZTknKRH7!A#xh{YTwTFz~
zaO>H;a%T30f>86Yq`7c<dEAdvr`vOQqfe2EO6rfu_RqHP^x4z6RU;!Q0?xRKFfz5T
z`sc*+wl!5l(UO$DkSe!XiW51N6=06EFtN`fdJe9&J1PxR)gwRYQb|~4pJzU6{WBYP
zdHHR5bv%o1|B|NYYsXD*1(nHHfvsD%L&8Uj;&gMLzYTX-ZKo$}njG>*MX#tVEf)%=
z)-D|E8L6IGoX?9Q*0rmmw^AP=maR0e_-|ciBD9))3L7{Av0lHXsTZ#G#ljsoLZARN
z@Kf7YS=<V=#vTu!r3)_pI8wAN^*QmofU>ro!_=78LB9~wmyCZhg>!9o(`d+RJQ`yg
zzH|sujZTPK-f7kVjRbom)3lG)cUI#$Kazc2!_Vd|)?5SHqq2qiMRo8L3_|vQ1T{+!
zHuarddDGl7{}>*cC{v^93We9ai}8@JKWy4RIpaXbRb<BqiPAdpO;0T<T|X+G8S%|f
z+<IK?EF-rIY*1-XpAC<UCx5G!>66kX_Yz8eqOl3|0w#QDbHe(Os9$F7==is5S%(+J
z7pkAjUsJ6$Ckmdde^Jn^4p<g+vs(5NQyb828X8%v`_lX}#}_Yk0+?B^7+#8PTKm#c
z9+mFWO>9c`3S~OY`z0do%J)+acvLqOP7WCglu!pfh%eE7_RI;+39OI%VJD-T+}JaE
zl94t2)+xj%QPsU?h+enLpKS%@kE&;~83KH7{vscgrEj-o<%=Hor^?(1c?OorWwzVY
zspyT}1+Gi5s}a+K_14W(4wRd5|4fNx=|6tz7@H9B1~5nTvH|l#jP#{cxRIP}Bznuw
z%w?-T9{6tjK`%QJnIfM<OVzC=3t*N~E&O!}vy5bLEY>^FPP}}_oxL?lqGRsYc12cH
z^bV^I55|Sw^wvc&TfazeX4GJ=NMd_3%gAO$Z_<m+-nZ}KFm%DAt*hYg8ERk8TiDpz
zA**lqpp*I(&!DZlw9P&`!BmsI-Yf{d+Y;!Lcx{PDzE%>bbV$@1898IVvLbbz<JGI>
zyBd*8$q{Qbmm`9(ENY7k$qU1L@=mzHo~lqe<&QyKDyZ{_)i`IFEzs6X+?VtGc2zy6
z7l#>IzEF3=*9StZFapz2H5&YF*eP+84I%!%xfx0M#3p8ujR5&H-`mm{)eGW0n!l01
zG<Z2!D<oTUpzQ1~gC!RqLTP{JxOtcQq!SXUEB0oYxVr502et9DVxwAhrBA1&C{&|e
zR%O@<w2&(Mp2+62POF-I!yS`wpB;Ntj(*3I2x92(vIR;g$$s9==EeZb#7E7i8UI3%
zoh!&XjMzR6HAeND!i&Ri{8)|gw~pq5#rQZiTjdu|e|vItzJ``&&y+@voq1PtGEclZ
z?5CarR(^dKf!zfHMX+$;n#t_i8+rN$Y$mWhDrKLMtooT+z|O7j7n;`@XKH%|9Ervq
zR=stwQ3ivn=5NH+F`N^43xzh@;tF>Y8sXN~k%^5-*f(Bw((^tX2)vHD4^ke$()7JB
zI4(2)8!-Xw19)H-Z^ocjxGc`^^6OGA*AcyW<g<eZsy9M?jXpk;lcrUp1*(9k!4?H~
zR<2#YnQ=7vuENpuTl2e*X%u|&5w48JxoMRV+S#u(Wg)&hX+i)Fxl1H?@KtrA`fo8m
zVN)KV*O0?Pqdc2uCm9;o5o$sEz|u)@jhO9ni{a{cHxj<_=nFgewyF1d4mGDu!xbm6
zO174Z)cPTobs_!jv*E(7Zka1J#xrOQ_rx=@Z+YVB=8sh&_~^lqs>0vd%O!Ce&*RPM
z8jp>_;EOtFP4O8=!2UleZ%pq;V*8ZWoLhRSbQ3~R5T?3tQ6bLhz9!$;Vn%PW=TO8$
zfE`j2JFLo-l_5NTgr{PNPaOFvqKSib3yDwSNuAlYUJQ(tL1L66`CK@tjuAH|G`P?=
zECkTzmnHf>lgUQ-Pp$E(4HWrKiTl%XIv9_i?3V9D!S(x()`;jQTH~4mFi4@poukpa
z`)js@ZsHWnMp6r?yZ{$H=`3&zLg-5-^>fIV1u5K}p+I=H>)`bqMOlK<VXDOV;i`kD
zTT`c1cq*h`b|Zg*H}5E4MRwiNg+)#BV&Ig*akM}1<Ko8jv*xd8GJ^e9_Sy7wb@eSo
zVCN~MI;pu_1}zt{AMdDyVe|DoVb&C}a3{5X;f(t78CNwG6(*Ohm?Um+7K3P1<5ipe
zXmf0A(_6-U07H!#$GBF0&0Vv}Ten;zg(aL){w#vb=*eIf@W>wK7TH0(Eh_rRaF1XN
z+s%SxDEwFLL``GOcN15U6T^h77}RmHehuifbYzXvSFFS)gOij@iEkamf*$hvy#3$9
zeo=Q=t*XRMo_|+Y$CW&5waS@V7`!<H7(eFB^5hDNh=kt_XLkQT%>8#zl+W@9i~@=v
zs3=J?7?2#6oP)w5Ig8}Duw+4&90iF>kStl2jN~L4C1(~SCj&W3hJ}Uu@IB{u&pATf
zs{6-V^-7hy)jQME)7{hEGtca2$2HR}pHMpVc7M@%UB|Y0?-BU76_I1|;9+~0i#J4L
z)jNJx26sZL&H3~R5P0{}S-^upuj$U%T!^fg?e`3y>717M#QRk|;NKK7?cq0_nVILl
z<?%`NgP091%EX=l`d88ixqmnmnG?%Vc=D%R9eiLN!m&3%NsnIk4@TydC^sZbbH8t7
zL%cW`M5q)O^-B%PL9!`iLV!He0sS?Z!7%6N?dILvJ^~(<YEN*>ozz4P;ygg8-tEun
z7hJIN&3DT~h!_4MCDvsIl6^8zGAP#Z=4CqY4BnvA!gvx&;E1-%O-bJHui*vDJUCKg
zU$BjIiSC3)uxgt}sMc~uSvPjtwn3+3lQg#VYX#NU^YolT@<w}48q|wo&-WzTpiLgN
zUPiS__H`e}v=!2dQHkl%QVEK1zF%?N;Q6OwF+QISBL>`SwfH^n70gJ~oQ6eh^xNCQ
z126F0DTHghqZj5)r`hiB){B8f@8W%Y_QB?|L?TCo;6yOrIt_PZO<>q=pgbGu-h(<@
zyL7W>R)HwIITmdwbkA!*z3+wGfmG0;Lz2`b1+R{HOQHVjf%5qyWl*Dnz6DIKI1t-~
zt9!L!S}cLpXNnTI{E+6!QR5Tc26onUP@xd}b<DF{MT!RkqDso|ZK6omT`|8yD%as=
zs#+Ra<z$;5>dW~vn}P1-)=+zR;48~;63FT;G8fgTy4%#CwaJ>SzM;#AWDrlWleJPv
zK*PoLfJ;hgyL5SOBuPuXBkuh4Q`?F_UQqV-iQBALp3@C@9DaUk_m0u=nuc_T$OA;t
zUW0~Kqxrr0&6nH{+&j^xyq|r-L>GfHmYcX})lu6)ga~66JNK<cB`&#UqiRYz8Y{9t
z{57A%>2KSUgQjqgf^#e77gJYAL+*4VeX71WY|f+Hv9Z!TlwU~dkE)?AaEK6(woC2l
z^qL-gakPHN0`{u^FxBMGsoA>Rc@OA)l&_q<Vusg^tg89s+!br#knal`Nh8;Wy)QT8
z@F_IqG5V2Z@2orTNK#EkqP!WZx_!Kyfr`Bgni8|u2caIH<P)bV98%3Ps<WcfE>v1)
zxPMXBY4Y2#O!m&NkyY{Yp5nRSk7y=tWt|mnojq-u;ZP|`08c}7zC5HEC`O4d=PNJb
zS9&~AFSZp`gOPYByUQ#(hfn>oEl+5k1zE98d!z@$Uvy%f(ljQdh<9bt`Z`+wF-@&6
z6ob*mlnYp`7OZT?-*I^{ar9$45bcrtY`2(dewVCjF|Q_2q+0*|;w{&@>X}8WZ6}dw
z<?c2EcM{sKRBvDZILMh0d1mXde|V^-EwM2+TI!rGKkx5j=^EX5ikMEgC6q^26%g!G
za?;~W68{#*D_s8E&m(^Ad)xj#Q*q-^fQF4bkT1UPB`OhngoreWCt39FNNfj`@;7#_
zxug3|m&SuK(HvM?Mi3NxUqaT|+IQ`-ow?pR_ClW4?M7jqdQ*)uqS*7W*JC*wg3PJO
z9Y}KlQ=StHPlyE?P5Be8nHoOovu>+E#)RlIOmPkf-e<reMHFK;9C~PbaJL(pz*PHA
zJ=mS%nU+2<`pBV<5{#9^KwbHx{NH9fW1Ac_swgM@cO=}YmrWc@3QffK(u>seJPjQV
zB7$C{VqSzHr^|j3S#Ci#`-v}<rWLouYwshH!eu#ljmOYOdv?@L4ClBLX;@Ex8DLyM
zP%%tL9gX}+0!w7D+@{^dG1Jdbg+KP9$dK105~yT<fZKFF#{kb!c~hY(JAMIHen}$k
z<GZuNJUgceky|BRgr*Ta$;B#Ew(mSJ&-S0lXkxd9TbO_*tZFv;8IrW#?15e>O2ti^
zYPK_2SiVFdZomQgUN^p)mG3n2R<4iA)R{l9gT7rS$1D`|-F9(n+995H)G)|F&W(k-
zE^l=p+bBamLvsS`#2>cG!tC?55L3*(&@t&+kE2uqqh>V{L~01xz6|W}DR^70O`A%6
zPQJ5q$2MZ6@%D|;$#x*yE|zjR+_G$*V#iB#{Jy8ImW~LpHsDABCAnjt(W_U9^?=(A
zG=0BND_Wm!SoA#8Kl0UDExE@HP6(fdfifEt2K*M9>>VG)V+q&ceC4L?<v&^5(OL7B
zNA1;R2GGlRiPP7U6rOu_wVXA~-1u|R>mcN1@AdiM+~tC-9p`tq=MyO*|Mw{6S@GlH
zbZRU3Ty4t0*o*!*9J4i$AEz%|))jn;@2DEW-8<!hpGy$3P8dm6)c3LKR^48eamhuy
z^b8o4qb_oCZ@dDOvA-vo(6BAZOc`!H_37fsN6^zqD4i3ffvUI>fsE@7@~|un6p%km
za^9+I>Ynp7`GPgLhS6h%{*BzCpMI^OOECu(;uNJWC8Us<hX{T${;nQtH(4RqNI5)D
z?GC^7K<=<^zWS%rklQg?>Og}IBg13y^V;RDMMnIUx8EmJJqGukTKZ-Ml03^ANM6J-
zb~J2gw<k!TUYJw{s+9AOvOISiFX-7R{5*(^x_4`21e5!y3t6LWbpUa6TK>3itMx#}
zdpoQ7DcB_>+13J0Lkk?~^>Tj(@R0BGi&AsGRW2MH*78w%Dr24Y62`BNF=!;ZsvLr(
zc1*dcX&HXTl52jVIkp6SDbCiq%l(#pHYK;@JWC>CY(RY=0nzkmaCn~PIXtJatf}5|
z{RBVrwXaa`NLD}6SGR>v@na*$jFwNds0=lSNio%d5|!+sYYh(=&0<LIYSD2-m}<Mw
zl$-=ROYTGZ-ZC-a;WqA4-woe9?@mJCkB22P$e>5IqebV~!jVefkS(E`xP%8>{j)LC
z8q=S6J|Yf(F@lmlaxSbso|fgsm&)=Xd@FJiD%;mhvt8YhXIEDgXr-R;6ur<I(?!<5
z$FtfbcDhXpN}BfBqUtZznG^4xYhe5J?CGlf*CbmyV3?wCq{b89SY1>4V^SIP3R(Xj
zp8SWTpm}=}9{wYx#~%YD=H#a`54$S5BJJEBHOlSD#)!^sh9h}GGH1n~o!j&_L_{DL
zV9e-Ug{2QzHXPB(Dush%-Id?v=Oqdl`?FH~GWGZkh1&eupwU#kSuZyx<MRn=5h3du
z_^m<;V^)ouI}#Y5UZs0m)Wh;w4hxn`lWn@v9b4guVB}3fE1f0AEt|I|t0SFxCdy2_
z=(I2L9T9xfzx^<t8+tV<<;2<bNctlDwz9l7r|wxQxjY3?OdI@~_p#oShj$@^<fNj>
z6knAcl_WN|9}-W~5Cpu5Y#HQ@Sw)IWmel$@iISOuG0@|qSF>8Fl;9nj>>8&JZE?>*
zXEh`?Nn~-=T0Es1D=+MP0U?8r!bxNfdOvxr^airjX%4;DLK6B6`vF@SSTgIVw?}nh
z^TP?56SCL&CQhcN*_@`<s!r`{B?Pr!OCKzaE>rF8(@AgFn$IAYWKD;sUt`AIgQ<Wh
zrVLE-Ubcw|Si_dhK<<viVeSE<lzz43NhgzEn|$$I;AtcRUN#{-E4+8aRwq#3<#B{R
zlijuA0L5+a!#>-tuh+*vgCq0kQUf?BGcO+9K7Lv1J_mK!Z>wx=-7?Livi;&Q%$z~!
zZb|FMK)p3&;^Z+dU*a$m3|5b_yY*_AtPy|MvTM-sjqLYh;298B)+YpgC_-MpmybZ%
z-k7B7=ETg{piojkY)aM>8UuLJJ0~)6)&>L`uSVW0#MG$@ma=Lox4Wb4#6S<0cb#`~
zaDwDay+7}U5`O1t{=~16;Qw&1G`dyAh*?(o{f$Y3mwWWGM-YA&;kw2Z|MdsSsL+x(
zA`>TDO9R42lwWHH{_xBi+#_VeTI29#y|q!Q_ide&SVpUE4gDlYGb!Os?fl1!l;5&O
zfi$?f@H#%ixi6n~#Ql`r->yD9=9)xg4vlZ5@#|#u40)vH7b*x*yz0y4SW@Uh&X~&7
zz?RkB7`lI&MWK)@Vm4B`9(Ai{D-Q{3I#yE8`wr|P8T{|mj%{m%r4kvi7bu;~H_v&l
z6<ZmapX|Ft{`s7ACn&P{S?kYC3Z6fckx8Xuvgc)pDxp-Xlh-143iUGuE^3+;aAok(
zR%}=&ckuxK3YFKp;+t(NJ+t+q=o+m9$K|!v*@uY-&reeaKI?pRNkVVAr=F};MAFjc
zN^8RK;=@$aIG32_cl#$Eegff95n1-B=ZHQp6AxBx+15*ZeX$G~(FzKDfbjj6e;?sv
z!0!cvl7jFUgWHjr{%J#EZHyU@NM%+bLU#Z2?lGy%g*9pocuY*J@*oW1Gso-Y2E7l$
zTM2GgEjZ|elVLk8{9+tMJpse9<c2kJcI9I;M1xf&)}MbKYqmn|4iTFW54kgt${6wh
z9q~YTd8r|SJu@g%X*iZuNjn+j`$*YiFlJ+d34B<@JqzfmOtZhgjE#_qBn07+H9Rog
zA3V(|AyA|PW8&8)gjA(P0QA=l(S-+2+|*A@h&cu0O!wL3f6~&L5SP0B>{hK?kGu!M
zn{d4qIjryF3Cw;)P%!jv8>7+UYLP`)z3B@$)~lvD_rORR;Bp10$59YfI}y;;LpkEt
zZJ=LjGo8#%Fc~&h!y#{EG(skT4EuS*PWwvw5!^$Fw2kq8+q6i}F%lsO$1-l{M=Y!W
z51jotm*<v{;txNoI}!)0(nZ-jqEl-IlbT)<OTe){oy{uvoHtma9)F+(;oTJ0TwuJB
zeh+vXu;(&<aq<={GxF&P*bn!7%bm1M+!Gk#t2m2ONch%0N)TR~K=aVTijT$y0XYay
zYG<(6V&R|G0(DgAz4Fy{DL$aR>_-I0ilvYS@K*jK!bd5&No4^L4_PVbE{VS?`55fy
zIz<I}Fzhb{$GV;OcAw4kB>@2lFDqjJDbA5MNlRfu{PKA^!e_vM*Q@MhC>i#!Yj)B@
z)R2^16b&KpnG}C>8l9-f3(1<*up5UxwdS)T?}#yG6a?j>uv+f*H$7fYRotJt(UN0<
zx_25E#($>^#}`(@My)7sKVM;f8{@O!#b6@BMS6I-G8(HTW_byaeHq>(iXl?Y7bW(T
z38IGK`o^0y8Ud)u6#y>9_#B|Iv5h`TVZ`?Jr8x~pp;v{Ok1--<PkMu?8ut!2_U|sL
zVaRMwO6x_<1+Dtz4yKDDC}~?%L)oJ2u-6)oav2x&KNyw}(3Yr7b*`_k=lsUhVZzIT
z4xDcEGmodAXELSR+r@`WImxxGSFS#lh)vLz&!TPONqu@;4<F$$ED`6SCb{2$NA)7q
z+4X}%Ut7(#A`Wia*|D2+eD!#JSPlZ?!JIiur1vq>$<b)~NV&O*mzpdO=1svPOuYH$
z@%URw?aEYdPn2|iWw^oQSi4MN%90ynaZ&{S7q4d2tP|Aep<>o4i*nU@>v9ePE0Z=|
zj4zd9Vh2t)t2OvmgupO4;<l^TGui1Nx><D#!L-2S9BwR%^k$WMd&+lC;=sd^qyZc#
z`dBVfy|*E!!jb?&CX6atedGI;AxEgHuQ1_`&lErTQh)(}>K)EcFQ@pH2RV`kuoLei
zj!#eUZ|vzVk;6{Co@dj@r?1#qk%wk^Jng(O<n)xT?QVFM?OxKWVRVZxgUI8T)626S
z(Us`Ah2u3J-c%f1si^9q`lE-6oj0WvZnfu73MK2T99Z^=Wp=@{WlJ}SB&Wd3_KdOB
z#Q2NG<I5}^AF4-yTT)DM)%SY&5Mz;%ia59Q2GUc{T>!=XxSbr_^8VTID`B6*vqf_K
zW80Q^=lgoR)Fgl054ZOB;R3ezDOq0}`hQjS_&r$x$t-RVe?gv`yImeHb#d}%2QT}q
zL0fi`5&gdS8HUVi>%qZzy@n#EYXTON?{8=HIy0XFQxukf`@EPz`)7wgsd4ETKNc2_
z#?!w_qN-NIaD1J=oD&Mf9|eYrV$7V9zG6fxC=+3v?fukx8Ld`^<I6DLG=-CJo@GLS
zVeRcxelH-ilLmv&^BBS!JuCs-L@Ew1%4$w(GQxl++gFd8it&0iVhjmY)1jqgh=2=9
z*sCs%#2C)6-|Y(*{<_gpY>#S}7vuhO8^cPkaCtfgfuXWq=qw>7h=)-n22Fn1t%{N7
zQj{_w6@lg3N&-+-z1QoKx>PaVoIH=fk|5T{X99@qv>GhpXd?sQ29oFK0^{B~aL=g5
zob~)Dr-Tq=YTe&FUUWSY%Qx9vX+(46;cX1IL-`Mg4Hhg6yYbLlYJsAdzSH&>xWj`^
z<2QV#aW1~A)U9JmWOM;R6L@(Y5Nr1gBg*w{?BoFk-R=@&#dA!Fg?`l}nadYsq@v*?
zjLKvV8F3$L6dq>AtS3v<9FLbD#*p3I4#F_G={W|J-#&tC?KXzgyvTYiClfJ-Srhh-
zwg>P^yIO?f%a|6vwNiwGK`{77b&L@c<6~}p8hr|8OY4aKMfU3Y4d1(?Mc~{8dbhfd
zWFmMOnmS|%2E!EyR;l<D@Xm2>r88%n9OJVk1m4q+5Kn5dz$nd$1G(?YvqqFl-S#E5
zw1D@7ErC{UON3SOfW?DH-E+onKqKQj@<i4`elhwULapIFqwb*y3>^e;&h~1ZDFO=`
zKGu=fFh<mle6{MF#^c2%;Q&;pF_fVQw(;#d1?_Jt(UtJPRx72HU#^t`U>|iV+Y;|w
ziipJ^^9Hi0YymvB2vr9=(RSo5SWZGg=hDENAzPG{-^>&h!i0lJ{bLd`T^U?pv6QbN
zL@(<w@h>v>dNOD7#N&OCtcRkZV3cy9>Hb1c6vBo<O{avSFfCpuVK0Y+wkvxU#LTAp
ztquW!eZ$LC29rpuQRO%TXW=U$kU#iqcb>d(f;^A<b-zjkT=Jd_{e8btn8xyXEM2>w
zl^Z;?UA03b4yl`khs-XR-(SWgwDy3@{X-lY7k%vhL@4=<(G(3r%^?<~jP3N;eOW*7
z`-X!G@NfYjDdo(dWY_nUv4<r`Xz#qtI{-0<Q)kC8RZvMIJ@9p2ItWbBBEC%^2NmZV
zZzR-dI?W0!-a)dn>~Dt5?Iv4wDnomMa?l`V5*cwmH~k=X_4nuLNY+D?(4G}&M(-&^
zgzA-MuC!uF<3L71pnOaLg;SEgzL8t!mffV9re=ksJq&o-5R}Zq91#@u?3Maw4`^Vk
z<py^J4#<5m0-3I8Fz&Zrpyhx^f;64aCpGbCeIsNoCSO0grSrKaA;#^A)>yK#^Y(=6
z>qYM>kBWSrm19RWo7<&}QxU@jLZHDunzj|3zzDt!YrW2Vy@<K&n6;JP-JicsnaaGz
zEj&)rYV<qhcc|>*$FR-OQQg@J>+!~kwHA)ZHU6h-H-ihjTuk=a9u||k?qrFzxo(a<
zC{lh{&h%*W563S@@;AoR{q5h)e$5<JaQAT4^zCYfKNEb?aX7?!tEs-sV;m;FK{PTR
zpTxNoqT>a?1iX5m^tz;g|1O!}{eyP}11h$LIaUu6KDY@b6m)UVpb+O0ut7DPd@tV8
z9XjRNPuBXhE^b7Nw1Rs(8-}{~o-+_tp{PQ$@(#LpNDK5H8>o!#6o!i<-><CI!KI_3
z$cny`bIB%}q-M-@Q@#J?W`y7D%4Qr?>1nHt+sp66`UZtie=5zPSYqo#!yUlu8ZI`9
zEIe3GNiv`rflQh@nb%r&KU)Q}n#FMSChR4eCglVUSShqgY8vW31IB*xXJp;XRlymq
zaGNXGt|0YRV@AOXE#-^(SY7$}RlPAX-pJRKIk;tCMq9v|``9AhXL<MaX9;AYz%*lf
zRf~Hu4~`dOR}jtA+Nc7ATxO)j9c>*s*uvUQb8=`V!FJ?%0URV$;S-5iiAXyhZRrRR
zO8({Jw#{ngvq3~Pfv$o)?K3km@G?OYGFg$Ye^;!USe+0n2E%67=2P*lf<}~=%iEz7
z#Fbs`_cHN)<&8;#6!UXH<M9zARPHZ6kdYkXLRwL6<&kxUTv^Z_^8BTbX9b8?M;H8+
z#3k&B$tFBby$|>Pgz)B@+ej%BZ*|(aRxCLlnG92(sRF$NBfL2r&wqdTgXuKVTo|&f
zrfrc?a8GB}(DIF>LNX$r?Cu3c>sy|m1O|HcS`u#q_YXGo6nYTij6?`p@?8z^2PM>d
zl;f@LLEClwSJdS?=Yxr)5J&`t3C~g|C#TG5H(yf7m*6;GQmess8&U53NFQBh@cSlI
zq%`}Fm-})&@PZ&Ah&I*Yu$rj`b(xNVm4<E#yUYQILMuBlP((0a_?f@V-F>b~Ia|@P
zRb>^%%f1{C_8$UI*;EDKl^ic~+ErOeJVr4Khvu>wO#4MuJE1mlk2B;_y?0A(^>#*H
z#AMTzo=hkIy!qbb`>dAoZ>Z4f`cVCMQRb6d2CJseVPBXf!^)R<hdZGAUkpc}m2p(I
zl9GZ+g{oF&-pn?5?JN8gGJ7m)+2i-{`)UP3>lPJZmCWtEg=CglaOBM=W9;DsN@?ER
zzEu5VmCZZ7$v=<Zo9r(Lha)Bz^>b^N+=v%8*N2z#){Hcx(`kKftB@m@n%aBzXBH@C
zjR%l6tqOcT3tTA~8gOsp1*jeUGe4_(4#!9`6`;%O9>}oB8Amib*g|$IGFvCz9-dOx
zEH?e#Mqeh7J2q7H$jXiXeKGKZr!IVk>;+#PEs_U5Cxx=Wt>?qeeiu7wWuER^7I*0?
zX|=CFl2(NS$Av8X-63w?75ZI={fuuyZDzs|*~LFvu)*U{iw`GTEt)0Yt83#D$4ZzV
zE;qv&=H^f-!gsb*2rRlz!z{=&KWsjCo+9N+LA(a=?M!1W510bNJ*mbLJ^_bxPe-d^
zB&%y`Rm1ULB4py0O+q_XUY|@j?HL4mKPu%3CohoidJ}B|TAQ1UNR?8<b(0NxUgKe3
zM;$ojz*FYWSw(Dmt4FV^`84JyC0_12eqU2mIG<s;rV$v2C-+>+iVA|^jd%Dh&pvhj
ze9WU{vzn2s=;D>;Fq0EKfyhyX4SbElXm@ZtPh<SUc5Y3M_M=wq(DpnJF-9+i+Y`F+
z#J%(fWAj{_D!GJjF}6-(GAFV>yD|?$Of`60YTD@Y3l1i|-PhBm?&LC&BDOvtSZ7mw
zt2hg09DgwpRk3K3YV)Eb7wZ!p6UrYajN=36F|03^0+Aj`0o`Mb8XiOxs3^-X4|`8v
zZBX2chxO&T$>qA^8hrv<G%2g@>NN1@zkxH4iItuo-U~XKzO5V>-@JceWU(Ie*)WW?
zHKYfS)U<xxWc*DjT-}iUK$vNEIS&Q0)Vg7W4BLTmkwhS+ZfIX<-{JGFKye?~O`gMa
z9jk_f0^`jD)N9FLM<6dY=et1#2@5*~HGQfFw6Wyt`&rQ(xf|`SQ%~eO^GdLcU7_sO
z{NCwIzXyTm!j$U^J==G3nI9syFpr%^JIi6~WLg+&5&MV>IfeCkIz#Q%!UxMYV<S}O
zF<4>bL!#`(2&->9JREIB2h1sB2Z<H}T3^Y~l3HHu)wg8Vg{<Bl&=OBhyZJW|`T#vC
z$>lopmOaM2wRTa(1=(vXJI@_w6JAW`p8LI}8Hscpf0JkfLv_tQq4z_}BYwUio1&l_
zLvS~6a^=rxihx;m>eWbrN1?xXQa4N-c(jD0>MaFYyYV{mJZRKwtpyZvgc`jW=($h7
z#34<F+&nvl_Cf%HSc_yy+oIFl>g*`5F!$+{vRXGABUmOz(&9uOxq0W=Si^&6%SD&P
zZS!%emqKzwQAlH6U2mD*X~2^<NvE_5sOzi~HIy7Yjz50UYO!cjr|O+9p1bkXm-i+^
zef~(QPU~~#h^hHO)hguF6#v$Y!R?1c_YpDu1i70dCr8>@+j8Rt`Pw>C9}wT#Zkled
ztQFhnYtG``ujWNL-KCl$>D_a58Rh=P6tPI&cU*7D3V(IrXQ#-XFJR>*DN{dgHqEVH
zNA?ze&*gN`#sd!*ZC~(1<xrY=ONC)6vZg7sPI+|N9SUE+*j9(v@e`g*>}PNC%Xdb=
zd~V~bYg_*G?mVq#bAInKdmK7OkXv;o^b%Xb6dqwUU8+cFfd`Qtb;&;K)^w^8#t#~+
zQca2M?<gsO&7!@4I1<c2+7fBvCeAH}7teF_owPoF3G>srxra1EM8aS+;yLCJ@aQBu
z1M(oU$BnI^pz?IEhVhnnonybNdRFI>B{uF}nzsiDLOdABdMCRjMKm;U?V}56Tt4$A
zyL;lCstXlm-Jbxh{#dfDr=0sX^{0tEi(ai2zkIOtv31qo)|Et^Y<qBR!|Sv_Yg9Y?
z6{{@M_JKGc(_W~d4@qcyHtVO~G+!ZZGTGj?Xo5J-q&`A~nwy;XYA1C-662UM*{imw
z-&;w~I8W-sw=CGFX?Gh#k?HW}!LOxCk<N<y_fZ8U#Sb-oL|i;deo~WIc(2#TupCLU
zf|#q_R$k1)ZYsKKGTb_U4nc2LX$bK|_H)VH=#bvlgd03S2$Fdtt0+AJRR(X29y+cT
z4i7lS{G^YYe{itQ{ypF>@Vt9-l>fPmr&hI}!})eWbue_*Xc&F$EYq?1@~%teCa8xe
z2Y}WbnSo~I7LS}hJUfv|)gRcEDNoSQr&1(DG~ud0l+ovC`lW2!{N?;q-NXMbJ;s4^
zXwJHKDWDAl<`O^|)~H1Z9o1ZZk>x2R%Vn0FChoa*txS$~LWE|4$ENEJ?<xdJuD?6B
zW*ziyb$wsZB78#|Za{<(TuJV699yljmx2i7xYK)$3&(E_<mr;l1gUi9@pFBr_vs8P
zIWGSEI}9E4`Sj%b`05^*41{-pfKKwxD4c*NfL~Q!aPZ<hNZpBV{9c7RCO{l#BVS2S
z6;X$(g3ql>y}u-NsCq3!U;5`_0{tpnlgmu9yq>@#GaX-lD&)*>1cff@RNkPPl>r89
z7As<-)T;6+I*}~}2Z{$<MXTty4eDl#Cz7FO0bd58jZ#vGB;)J@V8_knBtr+?l`de=
zu*x*_r`S6_Fo|JIbx9LmQ~ub@uAypwr&`ULRtEsJUPuNTyaln1euMhSA!rTmi3Rbq
zFyi|~G>^@ZOGBaZN?T8$rj=?l@p&&Sb2zn|8QRs!&KAu%fLl{TozS=)W+&0f!%tW}
zzw&<H)|w+z1nGMu&&mvS<e4-2bNQ|{J1C|v487bzZ+o)Cl(k{e<RJI`eNa+G5YzZ+
z235x9ioEI^SwHSA+v$)~+$pkAV4(hm%0YP(;mCAUcfUSxsp}JMMB)xe<&cvc=L!3&
z4t@bj{M8)U=u?};vdm^i&Al>5rms`egrzEugu)LIUXI*b<9~d~MBR&mRcGIlah)0R
zBilcSGTFl&rL^`RW>d@*io7B@*UzpQ;VIF7#dmR!x@`qH(g~H&=G>INdG|t#`h@G3
zeH@yp$K7fFp(g#=uyrJ4I$St4HC<@4;ll>Z-GmrLW_$Md9fbvqLl-@t(*Vjg(SXIo
z#vluW*I(M@vS+3k=^BkIn(VJsJqE+r5+&P>XO{~vrdy8cU*(f&Hh%62bpu3z+&|o0
z*aq(98v}QZ<DO`Cz~9{~VsRafBpjZ7sPC|BWb(bi+KJhCUTF;TS<bX9oTl`Z6DZ%H
zzjW$jv1#pj#p)J5NT=f!L`v9($26vC)4BR7xcLEsd_x(2Yalc9*rx8((F|lYb<UWr
zG-S~=NeZctjc?2IP(lagaM(t!CN%ZG7FG+tRlr4)Or|;SaIhDx^BTUS_jKHusVEYe
zQ(}`|Wx@p=*el!(`_Jd3D|rlHWN5am#&XHG2u1iUpVcZCJ#<4B82)VM16jWWErOi(
z<>*OasVNcStD*ZQwU#(X{sV-p9uN^$(tih*e8Lmv1J#9*DXwvv#NLfJy(!+A{U4%L
ziOD`bD9PU&Lw<CF_hy<HaH--XlMqoBjC^VrjHKFc&EMO69PMx{3ex!<Y{Fx+mE3RK
zwvqsdTVgp*S>G@4=&31uEuM=Wysq(+pWeSnIcF9dbU3NtEUZh27@)~1ylhJTYJ<Ej
zy~v=COM#|t75iWvdu6NVLp#(oMzTiy<L)3&a)Fc(oD4m+AGgWd%GEGw9<U<UCdnan
zPLdXk<iawI&6ef+A~VmOEf(l*Q3_Xn$Nu;oUhBy?B|W%z;@qqUee)gZY4s!UCoif5
zN0`SN-=8~E8VpNsvm2Ozdl7-v`<2zeI1x+hWV~|&&TWi{ZEkHTk)Dv1wALskE&Y+a
zCmFD#g)ZQB*XZ^O(^y3*KF`PCy;7Uvn0$c(o7cF|CFWA@l@INC1xqTBQtF^75exZx
z*d5CLw#re{91F?u()*<Xp<68xo@2AoPr_73=X1P-)+~L_Cym@vD>zY?nZhNo13B%G
z#vILV240F;r_k3o#c=ZRGy@eB2*w8AIT-XgJlH;B1kYN}bKCGlXFKqycjlJQXO`1w
z)p}(8E`j~iHmNq*HlPf>&QzK|OVhq0V*&TJK@A_KmUkV}^$LhAQk;$bf-W?ye`%g`
z5&#vPJUw9<W>}l=@|A-lY1;GZ5otS0A6TErY}3f?F}g};%hl|p)Ea&AMC!?mq7Ta2
z^VXj4x<pb|yBB9F$Nh3%+Fnz8bI6IdMfDt}+e%ecxmEh)LvdA#xp}#&-dYMj(nBIn
z*G+*L(`qI424@vZPo_}_&u+3h$Tx`9tL=M?XjNa>RH3Hj)gul$c*WbMBxmENObn-8
zmV|t_N+Q|7nsEsV`X4AOH4`@q7dMsR=Q#*5THT_#ctkI;CeO`0enwu6@XGf#7CgD0
zG6W1@m?C}LlF;MTgr5HC#VT<SDl7s8|6Zg(u)m2wpSlbf3LxXD4su^9*El?@*cyyv
z2Wx6Y*FSE|N>8w|AF3Ie9U#PidHQ9U6WK~U$b;o`@R}L_eX7suO6ufiB}ZGB>b%-d
zk&J&j!dSeL)J?^z4<UtxoPl$wsD{zm0h@IM`PrL}6<}F!-iLNZh-fpW^`1`^ZYTR?
z`OrHl;^`k`VY$35+}Z|)j*GMWjr)7?VUAng82PgZM#{`OgfFUj*Eyc7k?t))(*<%r
zoBF0H!$|anTe5wFUDIyidE8LL18VfonTI*2r@zBgA&@DaZ_DQv%DTO7Mwalp@0DDv
zCEvt2b=-uLX?GUvD1Z~GZ0cKH*65hBW4*o_g4KL>a#ABo4{L+KbZp~U##zh=4sg|}
z3z_5ZvR%%~%6u!1h4Zk(@$u!JiyG-kX<aj=cPqKvU~QCGi0`kJ)SVVp&J6`;dH=K}
zCiEW?`%l^SOxd_F<$w5$ir1}C>D#}{uk>*;v4!t`Pe&0{WZK?9#m6pl46Q$V8$p3S
ztzVTFzW=BlncZ%5+F380{(U@8G&0xH>f*WUQ{kM!$5by}e4oHo4<d`py_}kMTJ+ZH
zli<zgt;K7P`x;GqMsPl>#K(Fpo(|qMocxN*5>X5f9I=|yrqCc_VqfU&641+VBnhy6
zTb^aD)|6au>Y)NENSnwgKpeSDz0H~0%{YI4?ll{+zG`17sXacAG>~o`S!?Dz78CZc
zXiU{B<l5ThPWm3pwlr4sE^A!RB><46H(1eL*-U@YIBRpctfXB$Ul1t&&doON4vRUt
z1(mqh1_>j1l0w}!putL0EM&^d)&%AjrKO}w3s~h__dCfD@qspO0?<KZe8mv&)1)v&
zP4B$ng}Q04@PYkNUiWUE$1_Gn#A@Qyvm4!Sb-(eYQW0oj&E@JU7dHRXz1q!w>k+m7
zkwfeaffqG_?ygoT7W^=7a(0t1XzYVq*nG3PCvqcD%tzuI<|h0xmS=K=j!zPI+f`;~
zZ-gP!HjT+gHM8q))IM5OQ-9ib@I9$+U6C69cXvj`nHgHi!hkKFjUte{{dgb`NyzFk
zjZK6zsJ(pHxf?6!gd^BPc9#+RUg4xEyR-Qb=C67T>G(x=E4JCS4|h!hxux%~?Kk)6
zef@x2s6nau4V#$he#y>vN*Ipd02$k!re)6L@)~7TA6~d{%ulHYGw6MVJmrGE!bh-g
zq)hk4cd?C<5HrG+WZ~qGEPke&rx)3O=Vakw?>Sfw`MH&A(Y;i8M}8@QNX84`d-2=a
zV}yF~C2#>)Ycbv2J`rpqT+vi7R?J(_wejp|!Xr>Pn{;a1@-Z9CVxunjS5ejKy|<r1
zIva(%cYkgN4YcebUAWsx`orMw965M<-sCRG!QBb{b6@&Rc#s^aQCqD3F{#wU@5__h
zb=de`@to~9)Fmz$Nw7r>`OvU{qJPF6@*6I9FvbGDwRX>`5~Q=l@6ydL$gN8+H>*#3
zFcllDdX#}|HpELgpNP#bkloamey7K)EbWr<I~-|KwaRwh1FLq{+59||7wr~826N$5
z%^j3%w(-1~f6&zDirIhqNqBgt1N!NNFtj)g_!;pH^U#9Phrz0!{6mDiNFk1u^BdS2
zNy49mzdz`NepFRX@{^fNBi|hJ1TFr=0;=rNkD`*?Owov8sb6P>Su0ZwPMt!)t!7Z=
z3kMRxbaIG`m%=#ooD63FZU1PyX2U{UP1;dIu6*V_6=cwF%SeVAapG~as!;@Bx`-{s
z!?F;mYFtTVx?Qmvzaku^!?3rMci8`(dh?4Zk4wZ_ZncGnxkk;SrTs}$4YJKPPZV4Z
z?m;M1wg7D1lk<gVK6FCosH#}+M{j;a_T$~Pr|zdgXg!B>rHefoDSji#e1f&h%es<~
zGDN*SVahXY)~CC^CB3IG2)BC$JuZDe144amjH9+*fW*5+gu1k-<^*E*Dy`H#q49$A
z&9R>B_nGw|%hoo&iZj%jYB0kMEX0nGy^|6JCtlmjWa^vqzr4e@qS{tu8I(Qq2QTsx
zazSz@Bb4sDeZY}8n4Bj`zbO>0!XNw;4W+m!w_cB>1;al3M<7{uAo=_vJv)5`TJCtM
zn2Cbm>~D<J3fO%V?2s(>#n-QXi9Q04&X33j-clPSeasupA7!vMUWRW&!z&gKo)7r8
zVj+|$w_>p(R@y*|jx97yG*p;14ndxp=Gfj)v)62X;?O<e^vJlVE$7tc8JrxV8Ld_q
zqRZ$NmS&rr?JiuzAod7s3xLup7n|?huaT_7TJ0*md9J1sF|}3kfyXa|Tw(DketC9?
zTlThh5~<o^(=w%#%rh`8LGl`dRz+NDRzd-xDF;!|9n#V{ix|pB(&U>O!y=kd_x$n5
z8;|Y$ONm$_i-g92uWn~DwAV~Et`X(D+|S6(u@J97i>>R+zgGnd$MGs7=PGfF^QCWD
zz77U<Xk9Uclv$q)#|A9mcZYxA=YPf?jynBJ|Ct+g^z65rY9W#KQ>w|rz4gcMc+MI%
zXbfSWO+%1fbc!UIh05eaS)hj|UawoXDtbuXBjZ=^ew&Z%bu+UbFAwKg*hk3z`0|l{
z5kFUGY^M!+tZcWSyjeWQ^SOd)Enhoz!U^a3c11eRL<sOb_qvfNMoML(M(T=?ouXg`
z`&rpwq(0iOkpxP1p{{FczHO_M^(86|r5Q3{^Y!j~r1RQ68_n#WbdcK!@o@&rDel%h
z3wIULlP1<)?ij`w+x^6{LZ2O#j8Vr4-=Nk97I9m5yZ7Ku#1_pdeU8MoM#Jffyzhs9
z@|-4&QnM1P3Z>+D8+h!k4tZ5eHkqu1@_bDD24!(t9vwnQz=K9bmbr(?74#yP7c<xH
zf7*QHsab=lXJjg4Tar848u!^~h>~r>Uxh7cR*{J%X^ejEdV-4iw&K0wBBZIQNRu8V
zUF9i-r<t>@eD1nsso5`|O2KzzIBK$2&rF)J?w&e{dQstNlw2Ei*2XOQUKQg{RN+1`
z7_;TYMz#f?D2A&iiF)khJ_g+>TMpwo9Lsm3l>h`TNoo?qfC@T%CKBev^bMNf>@i}%
zh|=$60;*2nX`eIEI1F`q#O<GoA+h_jUhlHX#>SGU@1B+KGsMD}WDu0TIJZM#VP=eq
zr0(A#$HqW%D2IC6|3mR)lH(A?c<JqP*v8lh4E!gD@y0f$#1BPPQfDj-KYr<t@&p)I
zKA~J=w=rhUn0of<G2WamDymWdLih6<>~q9O0IicT-IujS#&Iz=7j?rIICTB6e5Zpb
zfnISm7<%45T3L*<@)$qfY;I;=0D}JWevv>`Xce<%u~k_ybXb-E<G}lZP8yRgrQrF+
zk^D%)ZH&!*MbN-1#|>bhpNPz$GynnuM}M9WKz=wlTNnJ0iSZ-LhJ;=kGh+ZpA4e1*
zSBVvLgaTj?D(gDB=?v1CM&tbL-!d;seW)>P$^sa<B`}S`n54vG0AP%-#F+rp14eSO
z;v>|NFwoc9d(~rE%WeX66NAR9UM-Tyt3`qV!*yT27OR^=C;{Wg*8_${tf$uAL#%ih
zEX~cYS@w9suv+{HXm9j<lJC>Q@{O6->WDbW#Y4kJ#_wU=t#7Kk%@W9t&U#MpBT?T6
zy)P;tdBKGyYS}?~p%2!cWeHoh_SfWy<M`H(lhb=O)}b7URD<RjL%nTLtC$h9H5{r3
zvOMri#v#swTb59I9cjND%cC`EVXsVo8fc<>vTP;Nr6Uwe@pRPb9vzmxyu_Y2KlRPv
zKkrc@Ln7`8hvN*WWk1pk&bk^qC^5Fq*Xnix9sm2-Q;*&6Jx-Dc#@a+W(a^OhKPQGp
zuICV8nme&#7Cnb=eH_%f<A5~<fMBrjE2QB}<*pj}PAzkMU-IM2%=K12%c8@pB>oLP
z`g&AS8H`ob&YClJdLGv!GGx`4Z(o((+@+GS$rw>R7Rf=I>@9==EuDi>qK~CO#1pii
zz2~|34aEpQwRjtI<WwJf?k$dQUjo8lPLNkR%-a_?8E_Zeo-hTziW;!Z&(E*rveW%e
z@&C2RH-KO*#;3F{noGmi0YwP{ut}HLS0W-DFF?8=c1}8WZcae~I(A+jUQT@uB{~oX
z7-nbcWNB}w0U$upadEuh)Me)r<OI>Nb8>^Y`7hgp1ob(j>}`!L?En}i&?SV>{~>CD
zE@7GekH5W*y`%aYV^hd~pq>7|%mHMkOHtG~)S<>^mUb5Z9!%QR31Fq`<OqY%UH+%f
z@xtET(d;cS4!a;HCokQl#GL;#BIv(H{C{FbT>r)Y|M!eQm!katF{8`5T$#^*MtiMn
zVg)gE0xTsf$jxWWZN|rCEWl}M&T9f-R&nzEGnOpKM39f0(~Jkg2jS!8698()D=jav
z!PLaWI8+?%P1PYzx*RG}U=9t4tJA;Wy#Op#TVo5zi+{by>i?fbfN|BKoQ9li|NOZE
zh*$v5*1zWWA1Vl-UYh)pKiJ;xQdlsE?q9Njx#;-+=>X=Y`$q;2Fb~~7Mh6-LhL%xx
zGIoLhJ!I7X!;l9sG2o7u<NP;SkeiP8U;gsnQ~<1vj{6$20D$ZDFI)U~Yk(~u_Z7|{
z0YN&!t2{0-!>%C<(t!X(vA?AQV70ieat0u}K!X3$z<-MY;^L#@yUGK^4S<yWOTqu$
z`X4B?t7Kjf9SE4^--3Yn06N#z<{&_SpnuTr{#UIaZaz9-{#V!taM20!ULo@Wuw(*P
zCFcep)_AYB7T~87;JLyBfKTJOsw(bFgtn`y0>t3IDjh#C$E#EjKY;DVeU<ekd>UZP
zD^mnmfcUSWa{^WaobYOUVDi8aSLlFSUL!dG_6DfsO5@7_2KemXbb$50R?+|XJcx^z
zj_>M30erb@Sn%@#7<N|}3xMeOuMT&KYA0}2Q-D7ST%9-{FWoh632?nmVgOQ(>#7-n
zMF5!n?@5Dz1OVc@#)pA03gWxU1yBXgHLbY>=>QS0Fc-WO@M;VI@dLcCX$~w%&^1dK
z#1E_+088%*dv0F3>y{tjY=Gsjv<93Q1i1L$bYM_GVSiJ(FCFmeM1fVq1^DLQt+@bY
z0Yd&wzFh9tP4m*zt`7MRY9IhN_%|2c%OH4_4B`Wp8ZhwR%`X)W;=P9brMGZj)BZ9-
zUelbHpYFO93ygS8m;oXl5XAl#<uVvtbs=Cufq*6PcViHcEI`-j7VwpSr@a4;$RHs0
z0%gz@CV<TV{#VF=_W*123K@tQfam^A2395iRfPbvzRXg8HwJM6=DE(@0JB{a2rmQP
zb@>l;$^9A^2mIk$+XKz73BQ0wK!Dw@$OyPC=&I)f)&YdS+8Ahi)jXF$h4ZS5gMcu0
zP52Pxp}WonfimG5%LBpt5<&BdAV3_vhRg-H>vgsSBGYB8zQP4CB?t%<f71cmfPl3A
zHyH>LK=}BZdRcCOc&`x=nB+A~fZPuP^5frJfW-&my+(yV0t8(XurFN#Set)y0RbuP
zn!Iu8RiJBD8^D|M8o@6snyX~Mzpn{EfCd4jUzLNC?wXhf)K#GC$^}5Ws{sN8lqZ0z
zTwx7}1}vYy$$$<1U2y+TB)AM~S4{?lBhWR)Dqyh7GVBU#9y<Q3>jubw*BAhZ7@%va
zCt#UgXWYvY_Ud>bU^#-WDa-&L16`B;FBjx>K@hO`RnPthjrQOBy8lrWu=D`T*}ta_
z#D36qg#l1{g8sdi`X4TUh}UHipsod7V>2L0UAOpvX#xTKiYUM;06P3l1`K>n^t!Be
zuPF*HHFe!AFQ*CY5dP+UnE|c|g23dji=#l@eU0;gfVg;>jsNC-Y2fR&9zf{1uI2?C
z@De!r3KyUvx~34j3>sH$5Ae9ABmlNhK!U!?81T$%G;+DGy~_FW(BYbG2jC>vWCft%
zHOUOHF6f$72KdM2j_Hbcz-j`juq$Ms;ssr^a|6r;x+atWMfzos`I`&iA;3QBZz_<U
zK-cWJE_a02tOUR=plfyp|AMK$npr@=fY)wm05;c@8<(LDbWLG;xo5a$YYr&uvVi(~
zMgZx$v;{2SYx2`&&H`Phav=I&w_1U!2XtLx0L%coF6IGw=u!!P%Xpc!K-X-L0IhRf
zvv~mW+%;7^khZSd7hX>2s`W27HkXCV6-fa50Qu_*87Ma{&kL^5fv^d>CaVDf{F+Du
zR7uyARhK~M*Bzb!Q~a0PiUI%rbFg=rN&fF(4*=1>JRp<;j&B&Hgt$1lcz{C(Zs1jb
zi-(Cr!_vtH!uZ187C8EIqI+R)X9t{O(Xr9Jw6uWIDL|YdHguAXrcg^KfDChlu)i@g
zXSzI`GJ}~y92pg0rj}-O>h|VNF2;@!I$1kYb|wx0kN)x~>|Y<6LX91rm^fZsN@4HF
zC<lA%WNAkSb~J|CGI7X5+*~dX3>ld?Bw<ca;BzJpMSHXBMg7nGc>dXN{Cj>%z-bOA
z$G>s(xp_G`uLGgKJh0>dPUzH~Y=Ms*-#T5MkNwwg2e_sb>CW0y@)P<T8G<6&-e_^S
zd^y7i#j;G%duw~+iBejUSl&Pf3A3)4wh~7RdgmyaB&d4KS{||R=z*f8m_Q1FqxnRg
z#N8@(HQeKu3!FCk&k}U4bUhcj#i$*A|CuCY_-L`qx|ik|e-csmG~Ex2!4pgWmQ6C_
ztrKDOZ}vKNjM6_WWNKTtYw5>%jxo7!Nt%lY-2Xmf9QBn5$MFUcRX2#SCgX<yrl|L_
zh=lIEQPd9Qb{Fj3<c+uYqiGWT|7`dPmiJ-2wOZ(GNimzGNvwz=FCFfB{@!5ZXNgk4
zZ_Xz#^`ptP#ots?_kJ_$z-Qs&HtIamzyI>%SCjgMMR6<thaxRhT;^Du1m8YD2!?O_
zDyW+K3gSonkls3GaUui0htsL_Cm`5Q1qYAj3;xH%vKzKGoG*PtC-?@r{Jqvw?vVL2
z8e+aB^S;xk`Z~OY>OHp2eFg?@Kp2lFoE9JM25jM+7*%-1-0J8S#x2Jd-8RE7)e*;K
zf~gR0SR}uLhIx{76YTm?q3P0NK~Y5k)yKZnc9MexbvMv^s;@ry35M{LLz8W&%r+}Z
z@z5(2#=J6jq)Z=u80g;eGZ^Q4?J{D75s=wJZCXfPK^^ahX-Y?ED*~g|2>Ytea3(SF
z9h(D?4&zl|lC#4xULp~(FEuB_2_6a=B35C|#G_)>k@o&sFR2^eJ-N0YT$OZP6M>w;
zhBgt}8PTu9`^>NujRI%i-|P6s*)SxDd#4v4Q<v%1{mh9cHXKsHH<Ohgb=S3_%0F9k
zHY;Tq`P?n#y2Htrc~63ZdVw_nA@AR#Lfj7_Q;S{fNs}g3^sAEEpudIb&-&wo$?_sg
z*#@}9Pw=KHk5NQM-_QV=G{nds1mn8VM;>i7Vbqsdd*9Hi;p~~pyTurrJF!aUgr3+E
z<c7I^w80#pK5S-%Zei7*q&FV<N#`h;;ZiE3;!?55N^-t1RSWq3X`2jJb;5{(@1B_&
z=`6-@EM)Vwgq;-Y5OZE484l6wcyeWJs)weg<#{wOOv_8VC6YwHhZ_4&;@_Sy3Y-d&
zHI8b_@)eYLd55yk1p0WA>MQ<>+g$OXn4DpT0ccgy7p7;JodRb<-7jzYAJlbpJ4@h$
zDEf%biyw?Xvm<}<L4web`7BJSw&TT5vg%+}!lS#n<4&xv1Hkt&89qH|n|%5Sv(dK^
zKOA@ZH!Dx{${SJ&@{VuXP_wTI?Z*7&Evz*4<a83Pcav{>r&y<+DLwD~p=R{)%?>L~
z7I}(j16IHal^zy2<7eGZ-S`J@PQcKBpSqtO?9|u?fQcE9xOb7<u1`bAm5lc8i~e9R
z%DU$qB-m&AbnEt+FVjXGV~jQZN=r!hODZC#j;hRt$ASSgw;fA0;ce@(!8X#~2JfCW
z2rTJ*dLZQB`TWT*`+2<Z;KswEp_dbHzApS2xcMAvwiCsv)A?9@Ue1%~<m44rO4nek
z-GjZBlAv2AH&5JJUU<Hf{>DJC8*|+4fA-Y(8?M<so{Whfa?cqnUm3jz#~$31<O!9D
zXT&49KhMg;Rhds>X@vN(D@}2q)%C-~+LPEZ`8Nl@JQ}35IKKWm-HuFW8=Lp^@D%dp
z*<U(do?m$FhurSWec0AIGr7}y(!N<B?tOYvCoZO2VmCO>L5f}^5U0ZQZwbVjwvkNj
z6Ib-dMOx&Rtk{SOUsx-MCg(G}Zzqi~rd|9Qi^qgHgC$s>rY|~hlzi@9t20=_{;W0#
zi@Y{ymx(p`%X}182LBrlwTp3^*$dHAh3#gyy<Zz_#%t)B-w>xI$T1$JO|MGk*Dvsg
zTC~LpdxZyy2WIA?uO@=(j-IX;xOTUodQb3%4Ozi96&2<EitoMhoRrJ@3ml41gdSVi
zFQu|<yioLrcG2XvD4XmwvvYQ$V%~Vc>k(}~3bH60d(eFT$z!^`#9d%~bNl1GqOiHW
zvu#rypZ!}~1O4PM!=~Q3jb6_K$lOwI10ig(<;b$R?&JLD)53$wnf`nIT0u*;_xi_Q
zuH8BFUyY<)oxK|mGHK)%t|}I)8d&;XS72@P0Bv<*dH%`p5vf6m`SSXSdsD-j)^>BM
zLB!-BY;+LDCqAx8vT>)^ZAUhCMbW28&&#!?VR8~SItk;m7}rEsByLwoi>DNVJ#i{V
z*4N6|MZP!Z9^cbEVO=_1Tgz<z$T$0EXmj(2XeG(vr*hHmdMgTD1+B^yrG(zH!8-)#
zIrffiBU<LE7<gfPS^FDW$c(24?&z}g^yZ_yq_TD?W%G4%+l~Fs>9TO}+u-ogO=;cW
z@B*k!8FGySLT<X$@4)wp;i0VqAG2yT*;)p-y@d}e3bee0OSvtQ!uAb3%4ZK!CpkqD
zA9YiisUN(x9D4VNz(!kIt!VFbYJ)Ut5!cg#V<e29MZZ8U;kkB0zcD@i)=^`b9j12Q
z=ElZB*0*OB3G$=8kmLmUwZ(?^?`a$yB@QV<fSyo{@csoo-dexOja^5W+ed!NM6Z*|
z)Uxur7CS@T8LX)ztU7G75Qjn1ic$JTeS^Wl&gb0ei;kkbkZEo9!rXOM)vfyNCPeRI
zL2i@T9Xnk0>B1<ANEiw40$)yy{v-Or(!}{h!*xp~t5<l|Lj5Fa-?pnqMO$y5Jh@}-
zlU9Ty$dqGi<p1cSN4ZFIV?bn+AZq9Eti)S%=^KSn_Peao)-(c`aLmoopYPF|`!rGQ
zN<JU;&v%TS_jeE1^k!zDn*(b<vN-cg^~UT*XmYI{9#&1V(aAqP6t6+siW`(^FK>NK
zG69W$dr_KY<YJS^`^Aw>;!h3+NW)jLSEZTssJ{!)Qbe@)9Q(PDyG!Hi0WlGi&qR=5
z>h+R1+&K-*z_r7r5vO8~EQsuBI?FcZrbqD%R(U{GSyrE2Q9Omo#C&Z;UOBIgqb@H!
zjne2wht<bNIj#9R+;(~__#j$<((>9k<`Fa^KdCC8lq6a>v7k1mr79<C3Y{-zAZqef
z-_Kg#&lZMV40~@@`;K{je`I5=HPbNsq{cw9cI@HAE5jc;hA-pE(CfQaO$NnFS`TGf
z<9?YpU{w4X#kz6oD70>qTcHDedD^kbM%Sz9R5=k+{w<<?tmnDdOm%<Ujp8_e&o8zv
z=Hg>aHs?asqN)ND?UI^B1F_mHSpf$n&}ky<0P3@G3M?FT%)%(b^X42|WsL{UY#F44
z&js5QiEpIo1-sYSlx_-VaFlKuja94k?)Lxe5LM-$kgkqjOl~cj)?@wQI(}@-xed~;
z081B}x%re^gy9_Uq%jh0WP0IP*K2pEd^~?g`ArID^sqI5SoAE^i2e2(w%cEp{s@1Q
zA~AkAIkkeM@|NWs$M`aap=bJqzQIF!P}v|dL|45m#p)~fN42u|v2QjNc;~cu+y>Jb
zZ*Kf*$T6&7YyME^EGTcXc{0f)8lBZ`u30GPI#6w+Q@qvd<;T!vJ|1Vy{Xuw!NWtvX
z<wN60xxc6%f9_#z&S5II>$~y2F!AxQK^c3ky|A#I)qegl+|^_q#EjXGAa-Z}^5di(
zm(BD1hEo;NUiMUm<TdD~JPrQW0@tQm|8QyCXEK^E@AXcKN4n6i{h^T+SA8~7HB;bL
z^htKNebJ_AqS!t{5M*trcy=0nd{o`m?Be2HX`gCM*%K}8)BFKbw7zzAoc}keqkS>f
zu}5i6MN)|-MrVA)5~y_yc<<)Zi9`DvEtPMCGg%E*=cD?)9k)>8?wQsgM)}qxJpX*_
z_H)_)V_mZ9+Ih;bv;AVzaHWm_QfnFc9&-0{)6zLLEzRrxZXd&#iwFWS6OXrt^Yfxy
zMy(Hk%S<Hn**?R{!GHGUFY<#B+Nl?UhNcuwooCt{*-c}&8#b}uHGB9OS^cEowrS)$
zM(ww_`Hx<l9^SIRa<5H7yUFg0XU3d2G@l_1ReLWosx8rppo)hJQ^S0!@~&#pn%qZQ
zxWcJLZ^qo}*Zx19T?teZNg7_|Qa}(qzzbtIjfRjAIbsN|Aj%Pr&|s8BX_5{^a+!37
z0IrIlh)Pg=L5Ec*pix+5#rpykP;^{H2r9@ZE5rkJ@L-uyJZ82!2^e+X%<PiKd)3K*
zc2|9Q|5rcM`}U7(+JoPG_x=69P3bx<j4hq;arFn@ncg+KlkM%hA0Es}w|IC%dZtV5
z(mJjyGQJU~?ws>DqP?SO@cDb<U;m^zTsV-WWXM|&xW01>nZB@>V<zluw^InGwR;Qt
zR@||Jg{N=-lF(;<dw+y5?iMe&FQ+ZqN4QtpjO(jz-7}%jtTo!UFQR2>-Nd>RZx3pi
zM86e-F*eer__hjF>9*rL_bza#CZ=~LkLxZgyJLRDW9gjbRaNvG)%>H8$70GxYt1+F
z=v0gHz!7zOo+FE27G+Osd%tZNd*GV-052%|85|umC!5{UTYV(Haosz<eAhGetrxei
zul|?U^Y2%EbEGVJV%xpzb?5792dgJ7%PgJ#EIyiG?^;DC@9PgMzLw`tAYHAjZK~)$
zTX=1=E8%5kWo<!u|3C7txsD+mo>EC4uhuGJG=;k(VgghXGYB`XLGM;qp{?4=>8dbd
z8C2%<bX#*U;f4_EY^*$<9LLYAi1T$Qnk=Y1{#{FDah}W547GN|JdH<;CL&rRVrojF
zG$$i9oe>&QxaOCIdnuDugbAv%4yp({RoN(2=g1<~07Q8Jv9yr%5>#>$Dp5oIC6MEK
zh>{7h_z)!?>Ze0259p{fq_u`#3{uY$+j@HzJxUDQn=?k0$50*fS2g+sNq6m&KC6)0
zR!F_e9UH6i6SRxafi->A4*6d<%24%uiLo9ulzMVhz!xDhW3fjyZqY@-pz<5K2ocLg
zpbj)GE3w*r$jtv%7lR5{Z;nhd`Y^BwhFX(q+;ffvH8OB%2$u!=Y-DJXf%6UHqw`Jr
zWDE+%NWK&!4Vy7g4TcIn7IcN+$TLl|!8pR9Y_R&5iJ&kSM&Y4i8IZz0Sh0>`AF`QI
zK-YMb9z9qA=zt6a#ib%?d{Gb{kK=QL@Qdd#eVCFEB%Qw~TZ+VIM?;+K3{D^yAIz|(
zD`*O#L<n5q6heVWMpFdgVQ_FC_$O8}8um5`kJF2w89{hGZJ=ic@C<7ljxOc$XspmM
zqb9ft!l$FCghnD|W@dV4`g)6{X(Z6$5lHf(kSG))kRZykL@2Bvie#>O8%8VOW^tr^
z2}XF}FspE?SdL=x8-n6;hAm6vQi0wsmqS7Xh!8v(8Hwyo#^N+2Ae0OXi)7yVWV|_I
zAxQyCfS`}5Ad~sqqCz3b7$u04%c1eaQXz~oV2MP)=jiDf5+GLSq)#7#+k*XI!YDQs
z8Ty;_X8~#$2>4i(GyyD13&JaiT!aV91t^~Jhlw0I3A;T4KEp838^+uloSAs%7?>M_
z+xc+XZ~HgpcfN3;*Tq~6Su}CN{q)%WV4|O<&=+ooGcmO}<O)ntnx2Y6Fpi0VkzqtK
zg-G#*C_Xew0F6RTfI{e`FT_l>0X@a%W&N(UiP&e_#wGas`lf;=7MM(0sF)+iW@~sT
zLoVlYX&fE`b9rz8(I3#`L@I(HMA#pu66g5AsR)&t8UT9C^eKI=`?=9@kqm`J9OVBo
zYND$*YIq<fD^b73_45rZasU;iVXOcb!%zcS34`#N7?yyM5s1JDLolj-^VEoCLofz#
z)UXSJL7xm~AhnsWG$UNZ6N5%IY>066jftRzEynnbFpR!YVCi@vB0yJy)<q5qNfCr4
z7GuPqf$&Y_BbkUaR*LWtfZ7~H226(XWfB3L1)hK&bcbx~zj8tVvI@j$CIGB&{4oX{
z9-2h=1I;OZety`mpD)GNpYioO$s~OYhJ0B=Kpp5yCdKo!5wI^n1_yBR#KWmCP9o#L
z$(R52;7xs0Y!<@%gzJi3#5*}#i;$^SuVj^8XJ&_=33ZD*vLJkvD$*^&eP(F6jkN=z
zz0&Pah4e!8{bO%zCZ0Q#oa3oVVzE|~Rq@L9SMi?NS3hYR)U9f+^}XPG^UeF(n^`e#
ztdD0UGnRhr@^UN;tJuDs<aoCxaO_j3Md?#JI>yJZq}Ei8ORT?q<3x*%@3!3KBa=Ge
zseV0CDH*P|^^W6p^HY)*N7dWyvKNRq!0b&&=cO{yE7W}#-zrO;m5+S(aOvSSZuKSR
zk&d&M)I4luo7G(!aP)P-Uhija)mk>i-|2yH38bn#^^RL+Z~eFK-$AY0H@fuk!8VIX
zr`gFhXubA!8BA|fY<O*}`!=yO&~Y7NUFyy*O<5wVnR3D6=uag?_Q}@*U7);Wy3Gu>
zGUd!}7&((znt{wsg3S|k?3Bf3woR$0cl^EGskd-a&9rlC#ymW6ncbnR)#V1sySM)M
z?PmH1myRDsyy&lcF2UCvcFFHLHOk_x=T`CD{sXQy!B*A-OMEP!ucXvmU|6Owe%8Ib
znCrbW-+9;ChQ}>w@JPY!`p(|GyH|6YH=&7CYuYUBl9f{}8={?_=x$ytSMFTP44CG{
zALXeIO>?Ks8k`mT%&H2-pVSG|hemHmofKjANcl~c{q+X#4-S<Z3z`Xz<;No4q-dH6
z^2DlRgxv{G4@IOU&<<+vcK_^LTpi#PpzXo8-YIgZ2=%<(V4j~{vHhII<2TCC70{Y%
z#j6TlzW(*H*9x_VcfIDc?TOeaJ9O5!>Q$ASvnz`&H->~z8xqpD9Begjf3TFgz?Ztv
z<}U@M>Fb}jP8LecI(x#7H!{<U?M_cR^&k-q^}M9>yQggKT{l<adA7$JZM@&Bbm=Y3
zX|btmwR+RTxL16>x8N7&wN^f3^IqXBbu(=1W9eHK`q&otkm<^9#YopzZecw$=|yqQ
zMP!8~hirGVCveLZ^QcSzR*WF^xJNZ`qw4>uu!tv*X?soJrFblBoPE7%YOT`$mB-^$
zm&cqD6H^_!8d7K1|DdpXnL4uz{N-@*BX+K8(M7_lwf09QXS{M?G<mW&%h|<aIyN#p
zwh%iu2|JXbKhAS3aR{+yZQFoyapRU;4YQLT8F#K`N>)c+T}Q#H@hQP}>akXF`KeRq
zkB*4jAcfS92?1MN-;Q7SdJ^M`Q@{pYK<@T{^`w=Pmv`HqZ}Jb=EM95%<h9xAL#x%Z
zN7<k1-K5C>wYpUmH!$XqGUTVmf#AaQ39Vm)9{^@4ssK1-4cc%(XPULU`+}IT{{Z1T
BHk1GW

literal 0
HcmV?d00001

diff --git a/backend/compact-connect/docs/design/license-events-diagram.pdf b/backend/compact-connect/docs/design/license-events-diagram.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..5a21d0b04448ee9a6948b29f34487a4d44cf1c29
GIT binary patch
literal 29163
zcmZsBQ*b6su=d8r#&)u?ZQHhO+ctM&+qP}nHs9FEpYPPEIye8#Ty!<2r)uVze!5BJ
zg+*x?XxX4i`~CX^`UCrepcx403G56lp}D!~ls)WC=;RH|Oq}S1>|AV}2^i?4ER3DB
zn0{0gb$EH9O>B+-Q)T`?6KNA$GiP%G26kpP20Bp-YiAQjI#Fu_XA@x)BRgZ09~&oU
zM-u}ZX!p#kuBliOjt0`^?`$GgO;_EM9xnRSkZV+MB>Jd1Zhtf&bIah-p+7*xTP-OY
z9ASKTX9>7x8Y&t(SEtp|4bGfd%vdp^Oa*gY(&+Cu2oMA#ABl7;D}J4W!96QG7de@c
z%RlSo%Ei!BUS)5Lf7C@>#y?`f75?{N#pBNR=ML@n3Ex-Lm%G{y-wMR{o!$4RpZ3>)
z-%HB(N6q&|k52LT3qIZVeb48`+pgZ%f?w8G+!?~h^S4aO_tST!-}{LUjYGYi@q3%9
z>vzo6!Wm<a`oYy%wBom~1F45=p>d~4&*feZvNP|?+u|$xEg1iItmCgaH;{+^o*>YS
zCoZdRT7|FI1#C3BZ;#J`?@-f^9;ydF9bIj5-%pMadyiX&)`{=09NKRe8@z9?obu&|
zzY4pm0arCtKp(AefbF=8BGk^BVxE(MuN~Aa&y5JU7{7m}wyXWvTAjFY2@2VGP;5Of
zQF3%JWac4uf%j7M<QU4Zk?4BM5Gz2UYsU7hr5KGEjoO`Ep18YOK?g%LRxq7int9eH
z*xptEYr83QJMx~|PIf9SNOZsh_%!$ocoDdW;E%1wj-+&DpNZ8${}c0zDSh{EIKi&%
zTyq<3^=0g6tW3|eRXyxc_!<|HCv%$Ls{O$hK7DOXs{AWJx)ZWib*N7%MXcVY2vy7A
z+q6UHjR90Rnf3zTOrn(mY`n2nM%IPi>VE#+Kzg>jHlLest6Fqfk0WcXo)yD&J#gI`
zbe0kNevhoGb6>}6&*qKy%M-@Rf>mR@M=QhHU|e^jXu2Ep35jd!MA(O;;wwPlGQ?}B
zHtK|CHj~E37r%C3U4vJ;O}dUo^%EY@Vc-5Rwq;Pl(0(ie2huFl5@QT^2S)5_OF@si
zlVbJIkh>uyLmR6q&gOz|)9>$Uc~|dZ!vt7C*u2y`>|0N{f|~@H-d(!*+Ytpij7X;P
ze+|V0x5LwqM%N=lK(OfFwf3KF?_zr$AG6X*;R4<CqV2FFZik+`_%rZ_0N!kN2qIE0
zeiexH?dDskjM5_N8zS}Tmzvv?2`LPcR#2@-P_{A}GLFMI21aMpz+IbQ<FMCgAHrsg
zW%|!Py{So~2`m7#=}&jzXjw%Snq)szu|<0I7xe+sqL0fe(OoO#tS`k#h!<oU1T?DT
zNwF(H-42ZQpwV&!hHvU?<et(lNzyeS-bPM91u%#;RDUbnujt1`BZcjVe(x_qM4m)Q
z3FQg*T=nM($VL~>p=Ung)MrHPLhHn!BJXYRXiITT|D{}EBwyUiIMgWShS8J)O*_5a
zmqO-wDSEAgki&|eR8xG{4YD(Qnk3X*Y)*4R@zGQVd8-Ri((1B=gRvs_wkz9#OvGv+
zu)<U&oVwp_yVS}NG>i}f7{`;NAgRe?f5R78n{Eh}Kft%eDUrJzb!`otE14^o%}zdp
z-UuArYXzYTn0u6IyWs9Zg9R~qIQZa|38$j027Qv6iwXxxW<lU~V^;1#r9=4R<TX_q
z!C@58WU8z?kOAFYVZ(`Pl&H2YGpcQP{X=WuFMpX_FK)5VDoSG!gHGXW!S*gt9b3yu
z#}RMJArmmnO*FdT53@@-tsp|tF&Qdd-nhI5Oet%fi5ZkxYN@YE+FJ+Nfpa~2m3_i1
z%2sW|@4#kDBtjp7izH`NR94z6!-eSCt2kWKukUI_%;vKHrK!AV4mcQ`UnB6gVdV^N
zXLZGR$S8FVOhiOta9-Qm%jk=e6dr$ltWxgzNiU<12~1^DTjdyBV}r{Z*_uum5FqoG
zItm>72rb%`ePI=?y_P7@UF~)$_p6GH{-qZqZ1I*gECz@my#_>k1P|*;`q9yLc5&Eu
zfAXIv`q-b@LwZd`6fW-rw%j}aZvy1rBuy|*?}Jf+bNxnwrhL`E%W@WGb81)AtUT1<
z-8BrE6|Uf#b;5<(&V|M_RBKr5v~7}etIL^e_W8omiB3rZMUQ2D<XlQ*!}D)+<PDdK
z7AkxBSk~(REv7=pFe@+R{<EsdXC@CB`Zs2Uq3Cri>1Dr>tKOfx^Os51so<2x1{P_A
zpZ<la0xq^(lpgYZHO)yD5L4Sy#K=jBoi=Y3!psL|WDUZ`Ma7&%HAh>Dk5MxyGj9VU
zg*zsSJcEmUN{3rNV6~R!X~0bGP^<!ZWdV?>Rl#c-64Tf*<_}^CodsvmjE}+~9GiuY
zS|RW<(n2>p&$xpR3X78PjKMMS-5}G$-+=!1SZ9*;8n&2WzrrlxIcPM?e2QMkcKH7Z
zZ!gxFSbyW~af!O;ddyPj(%}vV%iz5KIwNW0z$_$H0>s<}IxVR~B8?sEgy$L<l4koc
zp{^biGY45g)Rhf0GGaD>B2zNakOeSb0Af@is(cX5LYUza|B&(K${I9-PM$7zx!DN&
z8AV#RQv1r$HfVrkz5Gl1qwkrXjv=inmT`1(AF*#pC{6BI_G<{ZB$mm>+XtUBhsMW(
zXpVm~!VWBmTaDQp*{Zmh!dR7giZ4AIGEqM!k$jjFUFIvnxa#w!VcKqa3XZQ3;SS{c
zUGM9@NB65_qUZDZyAE#5`JFJ$gO3E+8l}!^6>4mgcPq;KVW@}Rb$SMw;L8+1Y>+~B
zjTtgGet}(yI6C-PC-~Tv1(-DSF`)V;p}#j{vHK&waPi%d<}IdgPeB6RZ{=oWJHj`8
zkxe@XZmiIol<!{xq0sBs=)bqs-r{Fz@~j19`Z8eP_S`<c2a1A5i$JxBZ=24gSPG0>
zKryq2T424auMJh%G`lS_DVEk;BF!uyjZWafzbWnIE}|4T&f1XWgq&pAcm?nD3%<zx
zDi|4SR+Pv<_&6Lr#B=cgCj)9I8`U$7Q04Qom+D}|_UfSfbi=$P^Y<nHseMA5mRv0;
zr`X`olflUyV2{xkeaFE2*|fS-N5Om1-aDF@KO=nlBZ0Y$Ia?N+G6<bfP!hL8g*sXt
z^S5<ky_neLjTERjV~6zguP%AVB19fAhmT^ajJS41;z*rK#3=o1u{-s17BEW!<48X9
zNr*8xJJ42Mp(FR`@l-72sXQXgLe#T_Eh!kk?g7g&G|{T`Y{Ll9oVAe<P}9VwW_{&j
zMrQIE5F|q})|hvDwu$+U*Ab#Q!s1m}Zy|KvOl4Qs81(*ol<^5d=qr_v<~yCW8}3d8
zJ%aa{w6DCh>k=U*or?l3aSJu^y^spvoFX8NL-TYlOr21;yCT|VYey@d2n!KmPq@@i
zOwh&P3IKiOh4~QNFy_CAI>YHgjwfB~c2K&k<l6|HXj~^KYX2HY-O?Etr^Y=o9}Jj$
zv@dBRCt2JI##&}~sICUT!m@-QJ^b~@OlCgTVLjq0BM!2u5{rTO%)-SFETQB8LKa;n
zQg4;KF)zdvV-V_K3^O!gpA0PKcylj|RSWC*I%HCh12R<H)-j%AGWz&JaYBUF*ve=|
zH)?oJQiCN?P?dV_!{yn^l2i(OoSblQBi+=6jA&p>!EsE`p?`<{+K@5Ji(^1!W4uTp
z2+&^A&)%7wjyBF@4g>tmG?hg9m?gv&L8j@2m*YZ%agq{G<pyU*Pomx9j=WSjbBsiJ
z)iC^Kp6S6$pCSSaWtvKQ0tgh{7tkb=4vebNsJT||SyIU1T(Hm|3Qh%p3Pfs#%`|_p
zV|Yz_D6OG({<GEx0Yo6QS<~Ar{1k9Y=A7M*SB#yh4VUpF18TtyAQ_v#^~-my366^6
zoSM4lf?IhlQmkkFq*{-HDIY;xh19M&?{^RajdZqyGM2?YWRqP?_gni-u>Jc@)nVAL
z@p?~3L4;)&EK(R4lOc=rF4S;YgW_!a33Ct7nC{j~N(J53E)zfo1$Ls2^)TtqfCFlu
zSrO<o+cs1k^ZLavESpgieHGW>b&P$qRcQe4*{FfUA}bLeE*B}l^pxtoNkV89v2@h9
zTFYClsIY<`#d2LPZ-$l43cFeagec~N+TghUP|ZX7tK`zvV8@p2X5&hgl-+Wt+o)xO
zcZ(^yNFL5eVngw(*dV&LqJzzF*SuRyJ+v-l+%V+ai_5j+$f9Fw#&TPsV@q=PNN`}$
z$(5_+g>JoLZ1L%>x@>Bp-Z{=PNms$6zGBR3aFg3cTGyqC+N-o=qa>d;7S*Pfv5Upr
zBWK$%+^<6YVkfT2Z_fXhk=Q2&SWvULK?7-48FC_a#+PDC1-8==6IK`B>LFK*uX457
zSzM~%=FnKL<STCyN4UR|qu$8oq8otBrzyIdnTCG@NS>S$F>WhXC1ai_(rrDRN99z~
z4dH9m?b5aZRTZI@tS!&#`8||!CJU{h`~sVEJ<_-{T)XUI8fZ%W%^K;lF*U}8&rFh&
zJ=In|eg*faFjOf=Bo4;lTuH?S4};#xSH<<gb|C98xVOeUs&I=9B0ds*#nBcXsQ9gm
z75j79wRY%*fxIu`BUS4-l#iXcf=I!$tUSfwLyU;K<N>e1m8fRkJ*S;kbFudEWIjex
zMF<@k5(qW~$TXeE6&w(zj6`Ic$WN8k-y-E1h0<Qcx<6=F2&M7|e-+8~0N&{VyKu@&
zYP0X5jnr1N{!)J-e5l0d_e9;?Yp}-BNDX5}tQElO$QU2<enN+U#M-3>HADze2mFAv
zIMCUKGGBOqb7f|#{3V-lw$oU5eohXz3ZCKwLKqJDoZ=kU<DxF5(td)^_i}`G<z)T&
zqRI!N%TSi9Wl}cy7+O<L_@qxe42`HV&4sYO{aldb__0elAqzpuXiLg+guL<8x^H#+
zgxmfsRR*wGjK5WEcc#}*_%@MPLk?w-FyjBUIj$!K4P)yqx7sq1g=~Py&G!7223H&y
zrVZJUA?Nxb=&GG8^uX7&yywIxYvr=Qn1eNTlb68mXHGpc^^!2v8YLFq1&ixvlLxs4
z((Eu8k9ib6_K(PM@DN=0f;S8~Jh-?fe7Z}y1WKI)RVHbXEZxfYs%TuCMgTFzoyNJO
zf?Jr#{aLqag9J~N<Y0N`SOL%c7ZExdqj!9PI5p9Rjmszlt0J~UXPtHHNm||b5sIVF
z%a@_xHN_w0bvMB_2q+&jb{5qliy5dUkJbzpxABNOJIX%Ydc6n0uR>gbxVEzqD$uiS
zLhI`+OVnL0FA1Nmh3gXho%({<63mh{Rht)y9wl*h<EM(ZEanWh)P=I#m<2I~EiGwT
zd_#QKH*X^U3%1RjSED?F6Uh%$DhF<JY|fN@Jwu9aJ`iVX`Wd*91h^6Jbd{dP*rQ^5
zl9$WB+C904j$fndzWplLX&)C<vV7o@O=?EF=n*XRvCb>CP`Qb~1wwS0$~^6nn$k`!
zym^@%zW31xd<O%5rrz${!)|)cqb9du*zef3r-}|@qYlGQ-$h366LkuFYLQMwFN>0O
zI0qdIJUrglV(leSTx!Fja4E6jqxbZeGaRrTwEkkDC(L2E3}J1~!K*Bopy++YM;1-U
z=Tr?D2+=(`j*R$NJ_-iK`27~Rus+n>$3fO=Opml>sL}>|g>>o+Glb)X&Cks7dk~}1
zYgAg_Qc6N?&SM?5jhHkoKock2@SNq^=9H)U$*SVfA7Vv_=`GUAOeZ)oUU)Z))FRTr
zdC}mq;|WH{OB%0|tGfa;zOfd^N2AmEntjtGL^H2{;t*dSMtnl}Z2uvisDG*qQ~IJ`
z-8l1q0K-H2No%nCc<hX%oSfJveqW5@lezhS<k<HV&C}+-j$OAf9Q9gp@r^d+W#j*K
zl6ha|Qq};Y<diw6z@~;9B`dz%`hZee7qa>S&FgqY&UXCH+T-n+N=KdP`|ts0!pELm
z7<)=_t)GG@0qFS7aLY?JG#A%yOT!&K7oIPK?(_Einbg9-SI2eoI+5&WxGMzqv+Z^Z
zqWY4_o-v&+o%*i!;8i+VwzT*+5;}ikcKqs`#D!Gj`lfVy`A~xQP*T0a+3Q*&az;fh
zNrej^0SSH3BT)XJQuW^Ekk4@jzoK`)xR7RZ^UH*1ie063sR({SuR^RicHBepQSk0%
zxDUG-UN=u3HFLPi{tBOW4YyNO8(z1x=+SFup^qvigo`dhF<dYvW8A@HsazX36h<d?
zfOh;^W3F+SQF01d)1R*DwXVgFBxUDqfC}2t;|zb6ik0}`@1gXFV`b+0QkjmAWCy3y
z`{tF|$-v>unZfqGVl4C11E;pH`P=y&fs_Bv3=U$F&YpO{E2~TI)7duEC#ISg7R$*Y
z&}|FPw_6|KE~5sKtDD}uRj`LNe#<kVAe3LGz0lKjl@okQkfHhGja)sXw+J?yn$&tO
zQ`;|zcU#kd)JsjFO42x#z4u@L1gq(onlATG2t+yp_!cQhK3N0q25V;-xcm*V7=EAQ
z#XAgjiieu^460LvsyW2mrUv<u-z6(_Mc!FBWcbKctcqKka2%C2J~r#nL8Be3ChaHW
zY0FySm6VmB?f%XnS(0SXtPi!|eP>`_xEB7$<c}2Y!f7MJ<=92e_lI5sUmzhN5e1lz
z<K59?%;_m5WnazKt8xaPr>E1!{BK{TdI6h&1|cI1WC4n(S{WG}P?HP$p%nnG(p5A~
zlkiOpyK>`Hb4Qt~s<dXxRF;@5&FtEq$<UGkC%@mE$7R~(P*Z5riA{c<Ibme`7*9aG
zUBu0LB`l08*(j<jv6pQ4oJ|Ubymq#5;`F5Z(^5BFUTtEr4r}82kRDPS!DO=!HtYCn
z4DEM#n*Z7WLh{4i^;1PF9N9|UQssM7?LXva(rLQ%W(rgkl+vq}%Mr&%q)A3bny+KA
zKgk~Q%t8!l610tdD~-Mv*iu&CjPX+Hq$xGY+~eVWR<)RU2n`|}$$GWrDlTX<1Kx?s
zOR^4FK3M(EaUjl_tZ(aQ{DT^0d$!WC*)QFTt&*^apt!k20&}};ID2duIR<q3f7)(U
zn3$%64hCcjPK-!?1&3Z3=6mpxFqe+Zk)T01GUo}@vA8d2ZmWAZ9>*5Zf)3mHx*w`Z
zrVxY7)Rodo!y}Qws#0S}w95~VG74w$nCq7x#PoE~0&A2k7~uZ7rF>>CPFYr**1zg&
zFs<c1z*>oaO9XGHScgN~-w>f>1Md#SZxG68)8<i%Zbi=kbnCClc8UHY;vL`RhPKxM
z@6%!1x~YejMxw7@yIqso84R*l|HPQu6zfZss}?K~h=4=hGQJY+Kq2J+4IYdg1hx)D
z+Fq&9i07ZIRN?rtJmN8pzt1r=Vg<v7zyMn&hC4XyT-Pq{g4II>h9wEcJ8Ml&3b(ZM
zp}20klzMB)u(GZuikG=Q@{Yu(zl6Dm?Pqm8fw#ZW`o*Bm<H#$#<sRO?s3D<^g_5_;
za)rh`7pl5opZMEIz0@w{1&u;`g4K}S8ts_80us!Xf-CjDR5()UQLVK$>^uln#pvN2
zEn{5XW*;#H@3hw0%DpJw^>hAq2qnw21tCri`t{)8(QL<kUJXf=;&8@hvn__J#lh&P
z=Zy7QR_{-oYBKRR!(HW-RO?W|Ov_FCU^eG1C%ni;DNsQK{^BbkcGIR5MXZA7T9)P)
z!~XHiTB_WBx7g;;k<eh#4-Ysory3I#^m(a;FopoRnL@@V2y#&@l@&6I>E?X!R1J|z
zE-hD%zer3g?}T^!B8?wM=55JblzZ@|+$6c<){swLppT+DAn>x>6<^=EctvOk&}8Sw
z9wo@~p+_!-(2sGjbJ<${bm$st1M!?F8{(7LvJY=BLHkzG^oBi~XnYB`_zuzJHX|v#
zv&zcG;<<|=Mi&R)&TArP(1B%D_TXp6oj2`SF)swvdmou^b{wOIstTbEpVbXzR;mpC
z?cY>V*fR7T+-AS!tG{JuRgRRppKl5mfkrog<|Ow@l}ye{e#)-3Q%NgdTG5YY9xtyC
zD$}=USLYN>w+H0*we|CgY&*wymXN*OMOow@?TTk(H=D6q@8y=|IkURk_-=Enmyh=%
zJ2-FZ8!j>_H1^rglTKm0!D`i_&S27;%NzgMQA$*D&BdefOl65oofinCkCZ4+ARls2
zu>O+~7Mh@O{N#~U-AXAsu`n|9+t9o+NsaP}e+Z$Bd2jTQtEATRbtrgg+yVmpj;pNL
zVhj79o-T_DYqi&+-JC_ih%NnnbFo0hzvJTYM6MqZMa<9FeLqaIg7?ymp3g96J{IAJ
z!8S|aQ2X?5$hAfwr7rN@`Pf*Zs^h?aP+)rOJI+zOI6_a-eErFcav6D$$CGNz;_{uy
zXvcB!)Af8XXCWeoGrE?WJv#o)AlUDVxMp#}zJI!P*(f_?^Xqmd3-PU`3akHYXE{a9
z^KeFmof+y%D^~59wrTUhU;DMI0s9!jEe^r1ape6Eu_71dZ)Zj#*gwRux@|_bV5(1P
z1-itONx#AME{#FI+4rhiy%_VoUmk{M><&K07O=_Yvb!-Iv!bHTM4}Ev398qdS%Kj`
z^6)@H2j0pLC6)|?U$s+e+aOMZu>cqC%7KT9lYc_W_I=z(q51x?4VRbH-YPzo-he2@
z2C?^wScQUW9ERqT3B?E2z>aE3L$rk~DWw>>@pYSJB3S5|O>fyAeU)B)VhqhVg{J(O
z!So%J&q0V8^5_@@w8?GK-X`em*Co77WLJKL$L;Ia2i+S6S=<-~A#l)lGhz?`dS_NB
zG<!Vm7V+^dXW<PTWDx3s1U`Wza?fzn5mMV-cv}s4<)aj<sj!NSABJJ8sOpz>@`^@-
z85^Gu1Rx-`e9RQlxVe(*xh2Q%euvx;AjHC~SZTGs@gB|fFEw-86@(SC*&?To9;+kh
z`QH_&8FXkjv1D-Hma%9Z%iC7q)vVz!%fQdQPmYBsd{`YFzR?23CSj&`%a^?7J{og2
zQoZU9YP$V>rHTN<7T)WZ_8JuIiLS0nv@W1+7*dWuDQ%lLZ}Qo+Lh>D?-;8;TdmU{s
zn!+h6QF(N0F3&E%E<5*SQ+Y1UdS!<3S*HFgn=>x=RQ6YCJNxb_>gdW*dHXBN+TWJ*
z?|e7xcBz`>yJJuMT*^Af3k)Gm2Cq7l2QkjrST4|Muus<w1qun0m}h9rs!?)N`Zb>|
zH&;foZzkuLKJWWY{eZsy+{zWba}Jwmv5v4vBOXfz_~4Q{V}7J3OS=%a{nZ|$UX8JP
z*_R4^+)aI@?&04<=zmFALi?PPW0(~vCG|l^g3nXZxUMQV4pu^+5&r}haz8~=Xhy!=
zEbyWwl1EzB{rEwcGj_-vMBDcmNvgOrsb#5vSJpknmbeKX`(g5;bC;IH)R8pu)SehP
zHzPzMVrF;OS3RSeP?MwZ;IOctZ<QHGCTSY|DVP&ae$7?3-GLOAg#If7wg~C14PNGm
zF0H4CEF-`zOzCnai8kG|H;2LOUTplkoc2`I&);^N&K&<sUo;EL(O-fBRb?e%W{X`L
zq>iBs)yu!BQS4UNYF|c2NMXUA(hvjVo7Vq0IOGkq>!oghMqA|fq-`zZy=>Gv4OpnM
z7pU|^Sr74VMPyk8lX($ZPKZDXYAq;){#cZE4W$d;)H{Nx^Q(YJy5(D-vm9ZUHhAGN
zDHX*cYqhS7H_`JjdQDs*fILRJgIqY8hO!gn-%tu{WZYjCT3(ixaXd<J9ymhK(YFdX
z`7Z~>1A~CP!?)+KWFKy&g=frqC)3Z>w107MN?6S<HCN)0Z4P;|f`8Di&>9w1Wturj
zLqVh{;G$Ct!JL}v`OaRtd`!>u5thtEaI9cqDLAAi%FyZcCnlTlIU}3#Wgnh!JK~m0
zJI1)2mk8$l$5RXSSqygmwC=n@?43)&sp+}2=hK5v1hyL!HdAR5A&L!x?D<;M8K}ow
z_^DhZOR2Nv3ofs#;u0fiSVbjQ;fre~ydZHV>Y@={xEYoW!D>8Yp^oKO#%m|k5*4W;
z+IN&v0xno*mu^x+Mu|%|tFY5hBhKY0s1hj?{cD@+ea*7iDs$Zl!l4JHdqxt|BLm@}
z`1jRc7x}cx<d0FIHj3*78nhB5uA1@ML~UHT-AI-U4M<cm#xVGI7ojpO!9s&I1^Vsb
zKsZ#=r!j6;A^fVt>qKneF^WrpYZFOG)2zc2wK1{25g=e>Ww|+SPn-;S1Psx)&+O%o
zruGoW!~rY+cE3ok<N5e@uOVQ+A6B;7$#dtRGW0G476G+fcpvr8XOByOrzH>XCG&@=
zS<L$ou+PF4TTi6YBkt_Zoo}w0-zT4sbeA=L7iMm8R%sku4$GIB%j>*ZF(o`hsJs7Y
z(3Mb<VODY1AqX<b9)kA<MI`urtFff(u?u*l(vd<|@?`2{L2fZoF7Q+Cj#Ex)=?t>_
zk4*mk3MvQa;sX+deJTfPyQYIZu-kOXK}ws|I#Sa}WfJQ;Tnop&H-UEdtr++{+Xfi9
z^F2F*<(@)UWg%AQwa95^+)X_auKF=Wy@vJ6`>+B6<vrH;DeuDXPp&Xr(O^k|&OYIH
zQUx&ddbOmkE)YqbqhD}@CVW*fM-TsCj*_rqTg#ge1dZ{lCc+xusDU%)`6qVY<v_gW
z$%6a{EB!Kk`0pQXJeDKCs%~o4A?Q;<1yd^vk{#7LBc1*(wo3oAA!CR^RrmI*8Zg9C
zmX>XZdn98nju6^dWd;DBl-M+3EtHz*V|76O1M{g^KHx|j)@O|QM^XUzgjXwu`e&hd
z&?5>+p{Kbw`FKTHTbPVvU;l*O+xT@Opw@RU?`lihj9Bm0q1im(B~ODLTA%lCRWRq=
zwRx@>g<N;HD#$K?O5ibnzzZ?+xXL>0nc&~iGxiJGi?ZESegn5bwAzvtp*Qv}&#B~U
ztm;3_)KOmdu2nP3TlgCR>Ize401be`1H&3q-Atlb$@zaZTc3>hpZYGqb}T-xM|n%{
zETzJpb7yEEkY!0TcD=d~735d^FN4%7<U^>Ozp+hlmQJC!zPoipMK?u_@jsOPlCFqr
z!8>(-tq}hBmLni{fxw<aCg~Yd=I<Jwxg}hxEt~ExY;b|w4q|>!2D6^u;|Xt&5c%1)
zK8H_tfE~~yYq5*dL*j~UC8Z<mHE{#2ApS{ZzDxOlSG;M~+w2~XI8*6UOP`l~mW{R0
z&(`EzGPJoJg#IKSH+%6v2~3lqRnLCf{Y`5XsGR-0;oMNR{z*sfF~upUAFMVM#K|&v
zfq9avFV(7<?L?cYbmdvN!4>;B1u$FH{COZnd3I;Qwuo@s$4qn&&Y^Kd9QS+Fhfbom
z76+w9mK;2%4`z_B({K7_!@c3d%Bgq3L@LVV)c)OGhD|yp2zGq+<CL60=KPW5z`c6T
zEd!DQuw}=`LA)?M+BmZ*j2CyirT5hNkrRKg+tyRl7Qx-&SXk$GM&8CpD8b?CFs(Z@
z6FN|oa@u1{C_;V8WtFYQyo#$i)4Zb2faLDgtOK(y4UdZU!(IO{t4nS9w%RZ)>X=qb
zjAt$YmmmtH-WLDm=0(1Sa=b}QjwvFWGJLPFAeWS4ZGMOQ%L5#o&ptAQ3ZtmVN)O>8
zG=0wdOaOQ2&Xh5{$CUx`jaeOv;_NaR?SXcjyRrXo#$0*jXo3#h3nC6Hl0P9F!>Tp;
zx|YJ<sl2HFRvyaEf#!Ew^Q^RrcD0nwan!W_RDs-8!1fpE9!tL#rqEMao*w+-lIW?s
zJ|TJN>*JnTP6d8Hww}t7_u>`3Vv<_;`2iVQtm_DTZ)T+8xg&3NvpMv=0<#~wbw+HI
z{M}nJcJtC7EKnaHnH^^{jPvES!aKbG(rd~GLtp0kyj;n-KYjRg+33W@>&c-+q6+=m
zB8~RumR*Hhdf<l()x<=Ru{r*2_ZzscnDGIY#Dyls#Z^R$E%GcoA<i_a-Cw0Qjf+ar
z#vJgb8($pB0$ELW@XhbVWmlH1$Nk((&YaPK5K_%5!6<aGa%9nLN*nB)BOPWJI5iQ_
z5{c<0kG>9!pSkX}(U0b$z$o3Ss?<!K4cvqR0%cm5#nXkhz~3E4D}ETsL-AEW-kn9Z
z$0eJzMija{EUKwyrj^GSlj&w(O$%1aJv139Qo@MC74bN}>mm}n`TEL((ez7nilfd{
zoyJU4%giXe&DSgVcVYk*qD-hKkdB5lgDG*enjqDx0!lm5w6j`gNR^8_7|k%1|E^+8
zlbpXu5V_~pKr~l?82=(wAT-T6xDmCj7Di!U5?;0SqP~(v_L{Gg3mqDBi!D*$t>ykZ
z%pY~;nrp@dkRC?=wJtUBK0E*-O2vehvtTV9ScXi(P7e}oA?Z6uFO$(2Ypsa-)N-V;
zgy3;n{8nP5gXHi@6xcke69V<IfA9N5;8*3iL2oCys16J6TYn%;U0)Qgp(HEk7_Z8x
zyE(s!I4e>kuEB2?kPY{s-XX(0etq{WkzGS1SWw#IOW=UpZb)t}S7LP#U?}d5LiB*&
z_P>B<$oBYmd2bOR5->-M0uW0*wz?Y8%qX>Y$k7tJJ}m>K3WA?fp#3@sR9x-=D|>OC
z__gPsra{4@u_3<Tr+aPX`nc1uu%l$zP;GBGBX!(E)a&uqQDI|dHpm}Syc`?mY2jx-
z9p{$mP|oI5TC5}eY|UQ6mBe5&-kD6`Y|;}}9y8e)_?;K9<nYI;ZM5iLC^m{!11dmj
zlw^F=(Ein;ks2`K)ud1!yb#=&gi=}c?s}a|d)Pg_NOj#y8-`V&#6e^=AeCAmzfy#|
zCjwXbdQVv-1CiYI8v7Z+-Qk-^2)cImGW6epxA)bww6;}#PcI#7+x*|sePG$Jg*Sv?
z7kAAn&i=gH|L{<SOjY6=(=mMU;g**-N5#O`ImjYKBy-pfWof9+azJouawe*qoMV1j
zkrppT-FB_N)+)1okH(>s6qMDxvi3D;zn%BEf+pEl2~_jw$q)+6?Dx7W=~g7F1PGEI
z$gQ-pwdb%dppeAkIz6-b2-rg@K|ex&$j6CRC{3|h>RT+bbfz6$hzBo3vbc_@J%#TZ
z&1IY~Im(&;oQ*+@WDn4%6KWL<2^-Y5^Cord8GS4tm;_i38srYs-i~@&STDs@4(wM*
zlMY~RlG=b1(ASFLhw@4IYH<YIVRRMPhs^JiK1?&-c*@9cSYb^X`W;ie%Oa~1>R8|$
zFh<vj_qJ7XuvxKV@(+|TFO>}jmdO=K3eSUoa7aeHmlal0x%hj+$8+*u-~M8FkNjXF
zskj(z3RMPL@S$}VyXEH`oeC$&>?m<|YpTJ=$QeKf9nX1KnbLgx6U^cMd*{p<hxeH$
zEB4uAaJ;S}c4zV3m^~hD3KRapD+DA<<G2p-v#Eaa8;YthD1|WVcG;}+(QLm8LAU?0
zV_0kEIwiKnmo~7BJ6zwg<+D0z_C8Q=6$MszbgFNfkjB;@#2~{DCOP`j0m_cd+O3<G
zX>X9Z%zxmQ7qV#OjvOjHy&N;B0X!;$jfsdoybEiPp%6|~pIRWu4Hc4qs+qoseSReh
zkp^Tp2%kiqf-@D_U?65DethFE3A^8@12)ZFz-+2r(fD9UOY%EdoO0G$SK1gISE7N^
z|AL8B3Qiz9AeiL_T6fov?p!bJ{Ty+I*)H#UJ7EFZd+bN(JODV4RL;Z0)}#Ypj1is`
zVKV+6q5dKlB}JT2ZaE@_>QOwH7BysDQUMOtQCY&njkoCGw&)l+pNR|X1+Sf2i#y`(
zd*in}97c02i)Kne;j3DD^f}uffqHt<h8f}2QiMd(D6Ff}ydXt<NMqohfh*}){LNR^
zO@gnvZ|x>;D-EyHfRN6O%^+aQC@$LE)J&+Rt0=qH2CjitAha*-sMCWHPWJ@6KDN!W
z>tIP)%G9xH45w@mcA5+DD7YfyV|a`Vp;mXc`w_{Zk^+XR)kwsBki7G|`nHMVK0k7{
zH6PUC!@cg(X1NmbbB*}tBIfDyT5dcNAOE6638I$)UpM&&Kn1rs`=#k93X>i@`7k;O
zOnBDiQ-Shw8xsjwCK>?0i|%8&P7t>hIL-{1z0;#@l^H>D?tQl_u}5S^^iM6();Asx
z1Z`h?1~{f)C^!|;0??_c#kW9CI0>$&9#62R`627zME0VJU(A+Ar04>>orQoW=F?4E
ztWu(=RT@-C*@L)>H}UPijg98Bc;TdA<M^4d15JKIwjag^8xSC0enU>XNO1HMohCKW
z*&jz#$voot(W8)HnWSFUpEjXq1a+DH4N6sd@E5B-QAaf1MMOw2lW`(eP)+0?v<q&7
zhB!`4C%_@1$Rqe2_1iuIGd5m!ra9P~DzFAgb{Qh-Gc^qg{uVVBKMUiR08kc9a38D;
zs|}1OY#jpITlLhuIapL(wVSRM9+T;+b1sS~sIc<!8lsi*EL_;)%9jF>mTFF0B4LZt
z2jpY~dJ)*7i<)I7gJ3fv&ikYxF;;6T(Ph!}Qu_H5w))~2!bfBsptZMCvoxt%nPKuc
zj)N_=4c>@tMI2s=H5w7Lpi9O~7*iM!+T>xd+aN|MC_9u+;-ayXl0s2=Kj3)TYNCxH
zi|H{wswA4tcy~iX+%j&436ds_DBn?({W=X5$Mv{C2ps?M;`tj5y|%OAYnmGi%7SI#
zT-*UnnAV3%&R!9xln~Pi!J#_7qLf75y598*7hhzrj>T(EtHH(7h&kx)Gv$2XE+C)-
zL8DfH3f9+y@+CU?o#|})NV?sLGvI4jHa7^!#%yvF(1wrBlqg$fFBy_Ugqj^qu@4^Z
z!)_Gm8<(2TG&GBe<5!GPF7=dVc)GYLdYOCNjDwvuLp>#r(`{&RoZ_;7u9EC>m16~Z
z%<Lv?Nx)#4f#N4VMAY8p$8MdN_e&K77cdI4PjX9DUPwF87c5f{reys1#QDdW8ysC!
z`1uyf<PvMi>I|jhIAG1@A<A-X6N}9G0j^?t^CV|C{{Yxikfmw64|^l5LX{S7uxp9m
zH&b#hmb9x{^8`l4Af{wN1m8whx8iVfe2(7GL^xORq+8kvDQZ$yU?5j*c7NE)a{om}
z?V33SD`Z4T{NOGCjMz1;G(9j`B1`lTaIpA3u{dMG(*ng;+A6^mrTIBvzn8!4h_f;8
zk%<BByW2Ihk8($wQrvz-)hM}yNqICXDNGCdcO>HBAZD)JF<nc{|5JFm=}L&fZ45}G
zEg4WPX^~2R*0`77A(JuXSyjA<98D~@WsZI3?9p%y%!wy+w&m+ChGCncDQ3WM5_aEr
z-2{l(9`@G)=4AB${*ulE(hkAki6G|#tyWLji8wEtqC^}ESn3<mNT4<@8yx^-1iA2F
zW*&(G6RCYtKJG=LAmI(+6WX7@uH+PKzH{I14o~fhW`}bsMYGbZ`FOu*!inBtq$=Q(
z*opf_HP-Nwt+<uFjA=beo)b3^?1YFG6WzdHLg;?ufxPchw(a6;lcsbXWiUOu{`qV5
z{+AZKIt+NXqUd(a_I%zo9YUS6GM^aMQU>Ol+hBSaBk`vGYRmPdj15%MpAxJRp`dns
z0Hkrke-SNav?P5omKxjQZ?RFkxkg`=McV?u-!+}h-pqn14G@nq#a`J$F>5%TG;!iK
zQ4ZO3rbs476nlf!;GAv<*w(KTHo!?lL9#zV`QO@$!7{jg7+c{xt;2=EyltyR!a+pH
zozsTNfx-EmF!Y=FnWWO@Fl5Ok=-VvGCJoOKyW097pJJ12(`W<}N8A!_iAES*w#0&;
zB5b@laAAwiq`>9WNP5B1@6S`tQ{6S+TsQq49_pqJpq(qBMD-M}(-u_lzk0MPEEB5}
z!l(Ov4Pk4BSk7eU%^pG5t;Diqj>mmV`t_#}rK~7+c1L*geon#iWl}k0C3@d|?8CWK
z_Jq-ELH7Kq=>DlCasIf7giSw+GEMWps=3f2J=lx0T2Z*Ju$XzR{eB*UXGWf<55n$*
z&~ZZvBFnzcwNj%7wf0+c@=@-6TKV&?dSb?;w+Zf!(0*NcQT6OL+jId2+}v~7#!IRH
zev#x;kz|K?tQ+*4J07;d()Rcb=Z=f^^i$S0GrqO{1pM>Xx-j97<0~hsQk3Fctj)ev
zP~wF`mvcSm;4b@odWOfdRj`2GCZ=ZkK3?<+>)x#wGc!BP)OZW)?#r<flCW*odryJd
zO@hA6(ET3FYuF-DR0FkgH^7?{R?JYj^h>wufiVlx94t9TN8dMUG?TwD4eJAMof^Tn
z(sZHs#L+5Q$vV^U;3O)>KK|x<K45}`=pA-M>30-%N7#ITQB-!u*&#13dpL;dFfC7u
zTlHq55yttZFOg9W_T6Ha1k85eman*`edvY_HFD8RL{0`8H!k)CU3(l4uB53u7Q7$a
zz@F1y#H+xdqB~+8%F3TO;$&92gmvLG$jG8Q^;94Okb}G2$w>r%U^)s-q?%@mPE-hu
zyURU1Yf#YWj{JD1fcRwXAXJcBG+F5de;~O^bVS<9G^m~C+6w!pQDA;r7j&AbR-R&j
zDb1`tLbEja<*A`gGdYVO*e7_Wu<qe2cryuRDbU{wXHiAe39451!a06cv|hIU2ItB&
zOwsM$qJE}O<2@aYGsRR^GQuh#WLMBOcWfMY7EAA6e>ROx>5t87sqw~UceN;kQaF-T
z{9-DgwG7vd4cODpjEmzK7F4r`K07huHQ%0PHIu6JqmqBs7OUU>(`})-bQjn%bUWiz
zOp`YjCGBnfi}9LJX=!KFMc<{+h+R)~57_J*vaOMt)I@d|%Cbe)ZS{rfw%JqO3!mtF
zFf!<B-J;TFWO?9f#n6WAn}|FKQQOQL7s0e|wm*awrs9u~WjmlDD<`xQ(e{_#mR#Oo
zB<zrBj7V_5U&(<Ccarb6ly63+@fnE#&mn#`Y+dOfqPOHEgq&2TMTSxT0LR-8`+^i0
z7xXrB*Rg{em4V!zbqIc%wGexYDXn6v!5!T805bo^%8%1mspt2dk?xI9J0uNI<0a|O
z8Njy`;&Ma|T$iu+p$b6wG9J%7{N(m%natrE{kXX}MnI|ytFOs`80nlLy*WGHC@JA|
zDOW17^<`Y3%gdO_QN(Nxyix{{+xo!y3(@`>bQm8-wqC}a-Tq1^yA5|gayBsOhi=Up
z^f~ab8sz)jU(V}2x3wudy?PX~*L|1KyQY1JVU`_IM7(ki0!D@~z}*WiMFifmCe23i
zNs8O8x&u#NtSgU5w8`SPxY2;wu8!dL+P2cH97d8cs;LCVqcaMKnlak2MEr%|Q(F=;
z7sm}vkW!m+6Ah6n<fNzxdPFudBG;Lz74R=;=Be`nJ*SS6&tc`J&%CR~p}p9C^z2Op
z&rq!!<|GGiUvJlZ%-fniWiR!o2Mah2pr70+u*e#*h)KdOlDpXK^~_fd8aE<EG1jhC
z#N~`<Lxt0^47y22(Y6e)tcNpr?X}7q(UsUfb%#nasN)DfDX(wyWsT!5KOjrs2xf;Y
zeOregBp0qK_ApeBO-$d5NeGu4Yc%0tRyPB^`}rPt$UH0Z^0MbZg6cfhYIh4Skwgi3
z%h2G#9_0P%spX(8_oy1Qo`=;EE@_<eygP(ing}6Y*o|J}He%&-`*n!1;}esNhVIu|
z*RzK^Rn|&;m>L#wuek&=MO<|uU4j^PwbXPSK<SW5?8tAG%T25d)g^-|kzL$f=IN2!
zTtOK+%@fJSy!1FlE1$?e)i@JO=<0s?hc#dT@46{_WXpO3{L{9<hAH@{LdIhD#(h8Q
z4VNo9RF>9+1TRE*N;zT=TkCOiFWRWUw;JU{^0w@sA;+*=Nj~q-h!ExZP!^R@L8z3N
z@S(-X2Z!sV3lKLWx7m5z8UHy#N-W|#vet`ni<$3`!Zd@}f|bmuym?*u8D=9N`o&J3
z<bd*=1(x2Hz6F1+x->C>eD5zeo0~b$6NNL|-l7s(@crUR8M<!>*j}sBIh!)i{vEob
zS5doiHo9i+`l8iaEV|}jBV|{lqO^tVYM*foUBE8^XYp5m{pxWD3<1L&<>dV+MUi&g
zQRSKfd0yGPqRz#MEG@4br$w4qL<8BH3%XMmmxV-x=pzrS352dDQt5Xwy8I13Pau~5
zgOlmGs4FF-gUv)~u|X9#cZBk506k%~(+?ya5}0ZLZRkB^?i}6RmH;Dv*1JBE5=>l`
zxARQydF?dG+e>*0F8T_9djAlVRC_Kjk~A>x2!dY*XehOxA-?woKj6c=)MA~oSn4&s
z$LZ#4`NL6GAhP)U_?BK&kNOFwsKHV+;5GXvtXci<Q3Y<EeXt$K557UsaR$%r@<3Xo
zXvp_IrSPnXfm!?cl-pH6N;P?@|9dR@K~%MVOP3$)4K8V^$K4K6R<$_=;60St)=YdT
zcF3IN*};$Us)HrIF%i5IB#u)zx&MdLDoX!hY+?bQYfi{Xn?KMR#P86l`k!rXkGbP7
zaO>&TJ00Ea8`;ZAZPiAOQo4XlBe=LDBreLpgm3QgKw{pY%kcc#(2H;XDE$FUxyP9K
zsI4UNqY`jq{7OYN8T@!3`9$R*u1*M*vWfq}`@>ny@ij^pCob?mKPRiWV)S_fzymG2
zC?fy0`qdve5eL2c^`^W-Fto@cF6mSD!+-y4xBf{hm(s<D2a@E!18U0qIiQkuxU(YL
z3;2JPN$7BE5E+Y)L0FLg1x@)cT3KcK55asIaeaeGpzn0IIR<46^Pb2&(J0-cYur-`
zekPNuNo!Y^+}A4V5NvtiYl%?$@A%>J19V1~UEHQ^8@=uK8o@Stv=8+G{_Tli29Pxx
zHBbTP(-KhsZc*9`w+t8ooyBBtT3;zyN+D5%aYj;C4C{)e-2iQ-Eo6ZbqP+=7uT`#2
zCRVFU@iKA8lrHIje3zZc<YWmV2~zRxWaV(A!tq|(egQbAE**CLwr1z=$|Td(R4mnq
z-&~#6<U+DbRCkfq{lVp!2=C{7P`dT#N_OM3<tIp=xW@GhqR%kvr{h2TYK*g3jI-O@
zfOq(p8SK)}i{lPA@-rkVTq+!^SBST4Uz`?}mDxFxckx4B3tjRi4IC*K#LbLNz_a*U
zDikB0Xee_ovlr~D>0&8SmZnHo5=$fQW)A&bqs}=xIm#`Nv<KTd1Z^<1j&MNDwcbUI
z&U|7z0Y3^D;j;dS)R!a&v+c@Og0NrG7&eu*1|S-LY__c%x!Ghbe3eMQ+XKiNne2~Y
zGhd~5r8$S)P8d`ik7sy_HQ{yD&?|65sd=S@_wGIL5LsSrFlNF)0>|e;0>4V#tiob)
zT@IEHR7pn)>)R<FUCXMzrFE}&@!4}fx!_MTCxu@}fwr>0eBn>?ta`FQ+8?iO&iwI0
zpIV&wTe?5HaAvDE{Nx}WdguIXARfqF{MaBKvKBu(IC8`CKCf_QwaVUG9Qf^uu6JgE
zboK>-xs%#&DsX1Gr-NMrp2`KWL2Ql%1!0D3dP-!*QEfU}EL7eMDBji@3AK&K7e$xv
zVKx^>)%q?@H7p{oiY|&HPvEt1H#&B7d@CD$=~X;5@ElJeuaZ_GX@mZt+Ddz<w=N?`
zG$#98>T7mkuD#OF$CJnO)W50zH;jAcSRj%rw(LqLR!vRsec8suG6H+AhYXV7+m23{
zr5n5uW$*c0mahLyB=vt*_Abbt9CSin08!%xk5YZL$%s4Cz+EKi`V`?Y^@tsss;ad>
z_4D6L&5+AK{~DEVJ+`=e)05((wkF{JUakjT7Syg$k96aq=Ex_q5s=Vl8_W(h==j>l
znIxo;Qn5l+=-Ip5&8>jYH&f>?DX90Z_*_&y_LU`%(W{$<bI1d`h^mk4EX5{^_C<zp
zpTR8n`vk#0R%lA!DlmjxRqdqj==)eTp&fk>kOG~YeyWJpY;)<q!)$ZS4m-6v_nyOE
z!Pw@}C{VT5rh|o$o`ike`kQ3iO3~t2m8)}zVG#VWPolqhJEC*T88_*3Uu<Fc3Mf!&
zGw46{7P7%~DX=CSaqxbSHjNOw-yQL};?UgM$YB10XKUd$vDdW7>K@%kX%hchM8V2w
zh4^Hf^xco$YV@@%(94SnHDY7V%=_F#{nE_)gs9nIkJB~Ch8K3XC3cHnKM{z$af&x|
zC^>zz5l(Tk{d!T~_Ht`&BR~?hn+8{?Gb+*gOmO}B8C~FWWEpMS?!?is)8-bwyf3`*
zn14P?>b?Nw=r=k^e50Z*yU(lRURt;*$bKusA^1Kk!{>cI;C|f3#l(RQ)L_hBM^<5q
zfGiQQjpQ<?k+gmqh-&a_-}{mel`&;9OTSgCUWuHTTjk$ZZmW_gKsjAnP^*F7T~$^d
z$Wvom#kt;}{eWB?L88Y$;OSE4NO<CubbEsM4cxTh;((5IznYis^@+J3CN#)5z%>ns
zoe6e(aSp!nUEwL2A;m2mmUDxBP23;Z@GMrX0d=?aq!tVRcsEl;P=XRu4soJ;rn)@J
zj(+z|D}EqFzsk&h`pw02RZ{XfGkAMu@l7>xu(0qYI>W(p<%g_v{3D4GUb(rlIGGDF
zJsgyGgWhpYuQB9?t%L-aR+VS0$7H>gQOTqb)9_9Om3RP{j{8(bc(4-h7M|@ch&+35
z?l!J>Bsuk0v%)m)HQjhv8UvCvf5W7=ujdTG6*=2i6sU+Q(YYJ<6AL+sD0eASyu(k*
zH!1*E&{V(dy5Bbq`lnmuKsnt^uFhCR)#hq@R$-kf3H*kXK69NeqC#3Jk5#CWFCCth
zAXPQb!%7|06ejR!&cm94eRDLPol)7>CgnX5b`)E^h84r$eFho${gKf3s*^J0k_qqr
zvVF;lO4Li!I7wVY%mNvQtzd&u(UzbD3zn{NclFi;B>?Jh&^pw$13~NfRO{13UM{3X
zVGPyMPP&f~$6m=ogCnHd+h*j#k*W8TBE;Uz&Zm84g(@M}R)7FEWAVmm_;z=MSmzhO
zU-TNU_QZ_&8Aw(@pN03N)7~nC_q3Bk>w9|w+?{6KGY^cnpSSl4xAxT5$#f*Joz|Mu
z<@>MAVJn7vRJX@Ra_jB2a!h1nE%q`<9Pq!Gou2uDL`U~KLR=?%ynwrM#<|eFC<Wag
zVbVgAmX2fSv7{wO&ga*fANpaG-r6Eirwf3_o-{Qrz2^r}RV+d^e)`Sv<9F|H-Z1f*
zr{P~bOEbn$ysI-Rb<uCKAUnWnftFrBP<#QlRPldZXZF<@LkrIzC4Y3El7Rm@(@kAJ
z?j8frRsPQ%&gBVZh$(WYc$<yAv81(KM9lJ5<Oo`E@>+iwZ)>$`w=ZHX?<tv7NFm*m
zpw>$k-L*H<-?KB4L2cI_B7w3+FHH&Ks^R=kOe+@E3QuUl&P}a~4beDTUyUOR@t%fp
zD=3@-YqR<ChxIU!FzspcZn`BWOs+edM!ObxyUUHb0k<a`yxK}DuFFpB_owV7o~}+K
zmm8Ti^{pIEzM`TV*lf|JvXuwipppZRri+^fxtWu{uTV;+yd{%*9^>3CCt7%yuZlbO
z8vX{&Rua@*1r%=8kZqp@C+iKzeA7)OSkeM5MeT$wQWacV#Bq1vcvTl|mHxEgek&`Z
z9}(xRR?vsG2ibm~9OGSF-VUDh-X2We6e^Od-kFl56ZZonSciXaMz7}2eS^3QXZzZ-
zak?)*S646}M!J8Ar^d@Y82o4K1)JkV?_C7HlW1?2;W&harir#ls)4qYPPjzBQeQ$l
zMzQk8jdxXo>f*e9d})@ko)+<#Me72ISdua6qCRr8$izd3Am0*vbtnzt9Z$-Upuu>k
z^E~=Z&~nZE>Z04ETxa>QvXQzOhSiy6;3|=<F@4Rh%CFmGSSM9XRl_L;sm^3k$394Q
z3RQ~wP!s8y2I{@|Yki6eEJM;-f#s_($v~<gFHUwfFfp%bxJrFd++9DPaCp*o*Z%EG
zGs>`J4J+rvKO}X;)vi`|{-DbuH^hgKm2++7L{#YimG&j@P<`+Jq-4)pQZd;=7&Bvr
zk$opy2$5wln2fOvhESFyDcLH!5EYWOqGU^{$Q}t5A=>Oa|2sov>Hqoq)u-3%<KAbU
z?VR&I&w0+d_w`(^=&4#-pgB9!A18@`olfSQxp^t>4fl)D31-Lrj@2%-(Oi+#9s=_@
z@LNWauv1oFkvFdAP45=X)$UB!z~VgRJEC7j6hwEH>&@>P#PHEyVdQq?iJCiN`jjs2
z;JIztp7JzI(TeBppGLAC&Z*#ubU{HP-b%8(5q)sAf6p5c26f!+fEyhhER*8f;^w{Z
zWtR-9tUd0&KLU#+<7JF9&1Q*au;*8{Xf@aofDa_Qol$ipmMv1|p&KSyjQ5h%(Y~+y
z#oTP?_d{e8nUFzEk|)N(-%3WLio1s$_oRLaf(uQlE2c1y#)M`mOY?o~HQ<)b+8z<*
zkW}1o_|Srp=%=0fQvvV&=0?;NURU}&1`Ya#2H+`}tCZOG@BPq~{r=Kq+d~))^}Keu
z(7W6j9|gor?STpFr(Sy^xki(0GzJIJIO{LSofJA%DagU)<b&yh8Z+a(3mADB-Kynp
zA1Z*`m)^`vtmeSQll(hg1Br6(4FK!w#BpHZq7}Vu-!KasT=0HA&vQc+B2DFaeLCV=
zY8#W$LQ)@JSJs6PUfO~~v{n6n+3LVEnNSG|XUOtZ2{nqI?M0XOJyNC2zHU*h#Cw;E
z%1^^JP82+1I@F$WV@7Rs_=uCTiIf{cB-q~FWqaX8@DFg@9;;7}_TJse!1|8y@?E|P
zI?s4lvY>68_v*UU^O&=+!*4s=cK;BriPH_fNiKR4`bw_y4t?687aRk7qFygCbMM>R
zIoFdllBE%J(&(JwGj%?^aym7&VvR#Jd3bSja`yI}SELYO#l|Q0C6B}kVJrrq&x)V*
z+<bZQ_0k7q>f@#fNxyrVMT!K7=jZ@=cDh}9U1ZwP0I|f<{Q~1^j;VB53N)44Ga42e
z5T5J6_#J|jVEyPP$Kz*Z+hhoDs<zo_yIdV&7^Wodwp<#!fuqGLpMJ+q(s?EVIM4K%
zn|Wb=-n9kswXgE}#dcR4_QddmMe-bE$t+neC1GFQTJ1}v9<+Dq-yyae6|+5Knz}mI
zk#F?o(qhm7fjDhQNDcb^*$+o8M8gcfp-X;L?<xm3a&;R#`9h25#1jOXzH`1FkWLb8
zVY*B<Q*zE-B*>xxL0f=CxPGc_V|`ImeOQ9$$0OS6uk?9`-&NgJOg?{u>`3YP-l`vH
zGx~=8<G1!OGQ@gU-50@fv$+(6CCXG0kT338Yb6TKDFn%M_|Ot+MUP0_`au>~SvW{u
zAaM^VW#8mjj+aWfn&dQ@P^SXxNZh~e!E;L|uFfDBvVL!WcwF>_+D@V3w@e`)*d@=h
zIS0$^DpdT`eSS}sOOZ|9w&M2JU!T8yx&LM9OinXS2%??-WZE_}I!?A$Yu|+uXp2x&
z59PvTs5{H}{9W5>Q$9QVQNC^`+SjoVrm7uKmNCf}Cs59fnr_EzAXI8z#VNH<mCPhf
z)6QBS&V*6D98eyTs<?lea4`JZY;{$j-uKBsz4YRsOqrg_3!_SGLOwWY7j&#UnbIW}
zljqt^AT>>V>0Wp5gjj3Q?X#f|xv$rJ82O^G_p+^A4C7#`Z(AzXK7KwKc8Qwd5GS1d
zN&>uyDnPz)f*+cp<r~U1m%e!7Ts$PB+@c<Q;30M8z8Q#gPFKFOvPkGqagan;fcM#{
zyn}O840xV<&72*a2ir{#s50!j@MG}D`S!+;cfqNM7;NvyfKj<P*dcE@-5!zY`CV?y
z^K;&B-@G=sHRpY{Qb-}d<d85oTQseyx)URv+1bvAv%DUBpaJoRT9Dvd&-*2BQdm2*
z2uTFpE7tjLawyFy`rSVA=0k$tkm|dihJ4zczuzk8Zquuf*xjG^N2vu*WJEppN~QWt
zW`0Xm_k0YK$ANS8p<%6WV4t{@P!tPBaML5)*a=P>akR*Zd<~PuK*z|wsmaE)7fOMY
znW5ukNq1G#ch=$#>vs#}7YTS)pS<WIF?@CRBCbPT!Rk_J6BeQB4aQd8Qodwa5&B^y
zpDf`x)JD9pd=KQC1`oYQiwdgb`OP_x9JX2+E%Cq_37tI$byRatzhW`au+FBrK+tMl
zDn?~^h8@eF;h9?Mtc>o{y}ay)TzbgZpAXM-s4ux$lSw{)<m(bsWZ%PAVTLJ<UVX9q
z@uq>-Rb9T1>>VgxLI`Aym&9IXY13)FdQ9TQ?gkdO*yP#Dk55`|b4?f91oSiAJrd2e
zM8_*fQTJMY40dIK?!YXYl3IiOSjyfGFUqJhP8kh*)tB~NxC{ISzCD~2&~Fc#-K*|T
z8I^K$82lh3d6lqqLw;=MG;4;ZZskxup?lPXU^Uz9$Bi|Zy!Jeg$MS`6xc^m^a{3vo
zz%=8}Db)TG-NEXX6pK;{$vktu8J}s)u7;fRh~sx`j4<TyUEst$y)%fS<j<q^H9!lE
z+3~g((8=b0<VOwIL&7~2MO?;8Q?*s9odZ~x=n?ds7cU<?{RpVt0ZCDBk~unY&BUyu
zA=I-Ww~Zk;^UclFwlV)oIh)5{%lD-#mm5COiR)iX+j&d>ipfn;KNU?;K{@@<dhmU#
znyQ<#DOIhiZ*4M=))Qv2mvoQz9Goq?Zggv|s{gRhv-ByazBk@}Z}MPsL7b;~bS}#w
zm!?0>3`$!g>=bw$6ntrC&i0+izkLbk(DAu$!Blr((R$f(X>^%lB#SnNSYl|kV$f=_
zA^7HELvV5A|Ee`)dd#s)iq-#hUgOJi^mb1RY&%0B4lUbFr34&1$`T%!;aIXRCMlxi
zmR>}C;V<#c7-{aZFruulj?4W%-_V3qQ{#WWXIYy2%<hDy&%Vk{z7iaky;;b)1@8q9
zH~)~p(Yn$Fmr~2#8;grR38EJxEXz|{3hP3xEM-j>nRoXwdJAV<Po1?BPi9iKMqTf{
zd}kSEd095mUwQmVgfMSKv1>1U?viUaL_ab3E#VD>zdlI)t@JsaATv&ih_4k2*y*4E
z=NpF%o<9f<KR2+S%Qe|QDfNlor_LsPPv0qia~Z$qW6b90GV9|pC(56{T4JCY3lyu&
z(JdD2|F*LNv$sa{d^q|UyQh)@*_#Jukrinbil1rHwpaD+y#f!=BeTv)r3&N>E@Hp?
zqiR?}ceq2~3$xeB+U`%MB0s5wlxK~!K}C$ae0?8V3Kyiw7Ydv8WL!KV-kp(M3?YYb
z^qKI&s;Xqan=97HCw<L1??COn%Qu?=t#Se)%kZgjmy@-xgh+*BmDLn^G{-HT>-Q_*
zHykLhZI2cnN`~C)pM0-R3B0N!7Q{_m@L68}gEb9r19hegs9vjrV^*Ofl_@+np)z1Q
z=1Zf7fP$93if|3NFq;XJggMXYW~Tn_I5L;}!xjptyb}*IzL;cwsq=JC5!Dp$9PsA%
zmoYr#+NsRW0w2t27SwQIJ$yreMv@^==_WtNM1V$WgtwysSNyKw&zX)40-0Yg=MH{u
zwX&1!&m|j%Tr+nMM@GCw8D2<*J3Kw6l`S$IHP`<dYQG#HtGPX0)|ENza(i0DU{RP)
ztZQsA<Gj$ddwSV-kyQ#>-N6OVv99`~IoBNhVyIO8LUk1rqz$UMne1FgsD5xSh@gy8
zB87I-%Uye<7OLgDXFl!ZCx?=wXK;*jml{>#zqfSrXv*HG*rjOj@gjFfb{`^_*~|Q(
za*s9xyo~Uoy;!j7Q4_Wo{_Hy6v6mw<y4TDL)s-%Jx4|!(cN}|U|J7$u^J=`U<6syo
zTgUe69>yBV!*>@;N8(kC+pV-v;c}>P)vO&CTC@UodeTr`eW)Wlc6{JCH<wz;asPxz
zvBCYl0ap&kDTK0OZ=RwyzIa5K2~F+!@})@R7!^<6WF$BHqy~GWy|7-&_S%`cI*n6&
zuu!p*ASx?HS!{{)fm7kk>OoC{v3Fcs;v}2o?)W!JIxzDoq3a*y<;uc}+rZsOInVI!
z+v&k~uiU?rC8@$IcH1~1*_-AheOF!dsk7rEWxd}t;pvcv&<jeh4!37a2T#!B`PAtX
zs{;+lTo8j|`i75Kb3L!suxrh*MFb}+8&`Xdxu<zy<2d#uKA0O(L3PL}_|;mRla6eE
zMtMPrT=HXUY0HmY{M}in`;c%NmOB102K^DU&I~JQp?(fR*^cqtj1bEfR*&U=uDjov
zPgH(rQ?m4B(ot!)E$^UM2A@}d&*4?Z$XkA{`QkTrLWOV>{K34Jfk2Xku5<f98FzyU
zPhE{djs$(f5eI9v%kOy^bKXySr~q@<ovz(yrr5$*DKBfDhQ)hW%`H$fsE1yHT!!wd
z=#^B8d2%KF^918WwoiS8Ea^M7LRUDx?_ntkH^>$)&N=?AH|dVUYh{CyUUaR#+Fk<-
zROLOvW!lLOt9<e@#Q82}-F%~rZiMXd>Xh*XHKUlJQms8+wX$#W$^}xXKRX9C1l%I`
zTc&_Al=HY@+z#u<8_f44o|p}sMhCr&SrmO{@SfwHjzwnk%R|P4i=zDH6RtIwGaqCF
zB!euO<(rOOv!j;J>mA#PHp1o&?xMb1`L%ynn?+7rJ+nn!_h9!OU%LfX&=q%8&Ft(_
zPV$gzVG>g!WSpjFdQ9R+=}IU^zBY#XK7QMGTcA~es@48QMAiI_&-{<E_q)D@lj}sC
z8dj@LJ#&7UiJT#6sON~v%S?`?#~coL_F`|LvmOglM&uqtbH%Tx29)d=`K*uDRA|iY
z38s7ZJ=Ksw*M~WYa&Sh(&gzyA|3_DDIjfuRzB@lz3bp-#$WF>yNbl|&I{j_vwCcl|
zkx@|PLie=u>**JAZ)Kc%mnnpitY({66k<8M)rxoeXm@81HygA&2uiGR2Nb_^Llf)X
zk!}o8*6v^fpcEbs4-nnWh-L5eLB#b)-yE!sw#A?noe5@Qz`Z0CA&LMY#DV{t|E{73
zR>0w$0l77m^AG^@s%b@(J6aV`4OT~EJ<)iK4GL`FVT~u2;3L-IgRJNwaj4*cT6!3q
zJ=hq7Q^2`ne%}AC$S3h%dPNkSv9|x9T=GAa>sn(mt{&)r(2x92{Y2;g-3Ej>OshRl
zDs!kpz^fVHfkK5~MQyN-vzrqN3szD9iGgiUAhF*a3)xs6ajSAfJZ-@qM3iI^__N05
z8i4+vd|gwQ@xSE$Xmd@P^?#OKgX;gY>>A|$m+Yo-Sp&-dlKW#@*8uLnWH;J`{w0Q>
zTg1?xe1&ciN1J^8OAJA`h@nmPwuqlia$CgCCb_@F4fG#y1N}?fz_y5+KaD?Zi`d!N
zKd`^V4eT#*1KT2Q{@BJXV&{*tTg1;FW&aXGuq|R})0k`#KY#L7{2wqR{+AdM|4R&s
z|0RaRw}_#Q{VM(s_z~YCem2?MB6j{bmRrQnA7%dmL-2pV5PXXm`jgM_zr+#zFL4C_
zOB})f0Y~t^#1Z@-a0LGc9KrtqM~HvG5#k?kgxDgE{)9oq7P0h4*)8JfPqJ%VHqo^{
zg|@*<OUufF_1v6o4A6KpFi?*jY=|b{!5U6L-F3y4KT0cqG|a&U4k+Trk0e9f3Iavi
zRUsfE*7U)uP!JJ3zy%CML;`Rj4k8XK@V+Sc*ER)^P%{v-6cZu+BOpMeY(#$@5lH$-
zYs7jgL;?gQ_S$+XFuBB6tgTfm4k9Iv>sg_IF_J&)j7fq>IoNtu2tXxv)q1M91c)?l
z>#0B(Bdru0s4$TDW@8Wph!pkK^8yP7Y2Iz1ii1cqYCRPRBBg!niNI=1n(*tX5EzIQ
zver`puSlR@PX*#BX_;J41u_eu*Ee<pkXr$&H&TIKByCPNXb=NI{?L(tXPY|**q4yf
zwhbCU(9JGLfJlkxdQK=DL`qB6Q(+Ro*8nzo3jz9(IQ7@_LO}pVHWDGgIQ*drk|5Ij
z-=IJY1S3Z6^;95<1(a;00stdrw;OmNAOIvAc_9EoHoFTPA^?!w$O}V&fYxoK0;nOK
zIjpw^G>nv0t)~Lxu(`*83?A@eqgtT7o4o}lFKO-CpcSySSpksnAU5|690UyJMq2<5
zfWh2I1^Sz`5ngW$nCPTscRdw|AEb@QdMeNZq$OlM6#z3S83Ur%@1qa|(W}*C6eZw0
z5_pU=P8m3~5m1(bib3IG5HTba3P*^+1;K_GJQgjW<m}{vvcZFZLpvN0Y(XL*EsPBs
z=Z*%ccoGlsL|ts{1c~9-*24zvCZOeEgRun}INRa9fRjIv2F^xQka&_s4Ad(>+Bl%x
z@Pc5Hac4IHO%HcG1_x4gLpeAJf{&uTy`0@_-30`}3Lba|;CDf=wzKV@J^bA&2nj{2
z&C&r$Lcl*iqXC0M|L|mM<tPwXJ`C_qz|U^(co0GY0qFbnZH-)$F5Ej+I=^Y-ANf0m
zzr7QWCl4gM0G5wJm~^OG21*M!wwc>Hw`r=<PxPIB5Z`I?w#I^E2i+GF<~pS@y7T+F
z)FUJM55$HQ)kg3iV2ce2KYXjmHZ7|;Qsk%*ty{a^=eiw733|cm=(FPesl2;cK^*WM
z3rO8cy->aneM7U<n46<!6;V|-5tb3Un$47%N)_N%h1(_k%vKIr`xR0=cPvR{&^}kY
zXi23qG~U4Y>QuxTGQ(>sAd^;w52uG{7Y<B3-S#4eJ3R))YQjpl6L;#;G|lBxQwOHP
z^BXg0gxRCUf_E-xU$|~^mBvKu6g%WxUxh-U@s~Z~^V{;o#ji2wbHr0T>U$smewIyK
zty;fv|K42Dx^F**<gb1e<IiSNx%53JfB)V~JI+_J7cdZt^Gyi;=O$P~EZIyzC*BeY
z64`24;tUpO;*TN%D&AIznmI6hDL6OqT$JZNqTpqFlmQ)EkCaiKh<@Ht|G@rz+s(U}
zX?4gekY@L))Eh85SF5bA$!Onoxe|DGJS;`NaC(RLEx`|n@COwP6xbV&K55x75kB00
zkALI?_bzleGv^Kcl*eYSE$gc&b#F#Gt|zivrZo9v!}rq6<ag58;X02leBqS!F|g$m
z*#K!?r6@y+8{@N!(|jEtyKtkirS;b4-MF3YOyY4KUvhad47_KkP@0bqgvJHbOlF!c
zvQIwsdwdFGD$zAtl51S(L)EQuqf7WiXlfbn!1l&739pCSN;2i{JY6U`H8|4NUz$)q
z{Pn8n$lTOX_`K$xm#50vZ>Go0^%vSQ&KB9HRAd!Sx*61)N}1&u!TogwPd_}`+8CXh
zkz6C}tzLIXnmR5*;e8$BZ8mOtevR5biTCrkt_EX#r{Niq3rl=Hmbs;Oyi;drhwlr9
zgfh&|(xquNy;sRU9Cf`N%+Pc2YjQw5UoleFXRt$Hm&{Ab_VgIrgVDla>bqfeMH!SQ
z+Y&rlrn-Eo%w9ZrVE+zPf11Wqlwev=e_n4F^(0-ZOqQmGf7ftE-js70>c9p4z^9M<
zMc<SeX)qW1mJSnaUvbv4Pc}=s&-0H*A9-SXoQvyo<gw38FY3`yp^kDtJ1>p$+vUQ;
zOjLqTAEeY5pkL$<O&sO#yl68$E`N*QdbPO7%GEMCXReRJzr;d#CU~jcFY#m=Rb_)`
zu-YrB-06anh{wCzGHjy`NKMsnQXMEejHLT+<TY7xb7XgS`*UZ=;KcpHv3qK#n|rnP
z9Y)&rYW4c<xsNw_4-rnepC)x(3xYdb@p$M+mE~YrW6Dxz;Wu8n@?Ms)B3!%&Y@#8w
z(_soLe&Ld8t!nfIbVPS6#lgCVb6&<?>CN^v;^L<{IQG)lCx?J>G2T5_tLncL23mMK
zv}ztQET<nrCs`?SGJ9=Tc$+smsdP1Vv}s_xO@s0i(@97+)-JXXtP@?N+h=yowslbs
z<My$-t@d$_1E+c>`~1Ztj^%R9RUUE2zdi5qF@+C3!o`;^nJl;X-{Ml2^C>Ay9cG&|
z)VkY#ac=rlVOjM@iHM?tnl_*Asd%*k_8OmdksEP-uZlCD+|l$>{k+6yej>wLj=lvG
zsNI6%Xld?<Rt;<I7%Z2#pZ0Lyt0etzdSe%obSr#~`kCV$4Mg{NzaFT+G8?B6mA?FN
zdfC^a8{P&*=bV|!H^a%@?sl@A6EpvI?2NJM;$xOcV|Z(?yWW{a`Ne*nMQQCtg684_
zwM9nN>VS~u=km8NW*viR-R{gdmaYoCn%BzMI5d=jFVGX3ju8^OsjqswT<`5z%oGD!
zF=b)rBaH0n&5w#8q+EA3Qj^Y#bv^J{3=a50(n=hLtR|gWC?F{Ryjl5p5_E0ACng9#
z)of{@0+yWBPcW^hUQJ_Ht*+kvd|b7fkt?I!@hcx|0=&a3u6gbRAqlKHu#xT8Q?J#w
ztgNIUMJx*E2vRUM0G$+oib0Sk1wp_gFMBtXli-?`Z8{jxM&nVoC_L)dng$Vv{CYTK
zqOJ9N*^-tc0Bf})8V|BY+hcGt+}t3Htqiv@Tw6@rMG5VIQTK5}8~ErL+W0uyAZ@wj
zWND-cQUoU#C%^=V;Dp7wOA%zaQNTB;&{DuPkqqVrky!AKGTfxaowR;)%hG^A(r&hP
zQu@lOtCGN-47URw?;-^TdwF?@dcj1U-R!{-BoYZ0gMxtywg88SyEhJxB8cGJc}O}|
zwE#V6<A!k|W+Nb?R+P1~2cGEvic_{WzcjmexM4|pZEe74EZT{fgMcBT5Tc(e4RCV#
z#f)<oB{fFW#@Pu>K)C>nVrv<-wf~#d$qBsbCE%y6jg%enu@+ty<>G<`9xoET1q11i
zH2C*VK(`S8BQoQOu#_crk^&aLa)HGVy_5ogU@yZ>5V1wup**m7ZrT5pWl4jHy@JKa
zu3V7x5v{J+SYy<NnA17Ctyoh;+5flMwaM286C_!piJuzR7_t35T3c-2Z{%z+^Q$Fm
zb^bI3AXAEzC!&c7pe!*#6%m7oh#?K3P$@V<N(_G7P)QoRfo-ickUL`Ry#J^48n$)P
zt26I^%dcfzqd{9+O4-@Qg9uU$WmyjojIER%1PMXIZO|e}Nra?`xC8<sg0z!Fh`<3T
z*w`X%B;jZYQj^xpu2-sobH}4_Ht4@mx<;0ybY(!+OhD4qCgBa3+dzZ>{|XVn&94Xp
zyi6v;?L`bBn_e)3tUaIn8NGnL*UJ8n^f|oM7Xq|VZjKr_J7?fbg?Nd!1>xO1fN$J^
ze=Z8Z3b3+~(*kCU02&AEB>)Z^yrCN!t?%p%r0px4HzN$%3+<-ohPFck?;8NG9{?Ja
zG43u{ls7N{r1<+&HEGdN0^%vw*?w)<U2~qLp=>6NfFNKnNdy!ILBL^f7(#Y4#T-m>
zVWqkHKf^N&0Yqnv4;pB&IGEVDUoAH_19oH}sQLeQLt>(jw)-8;35g=jkDV_cW8e9H
zyhQV2nq`r|9aGC(f4!nsuk74rqxnZg&Sh5^ibEB&m?=G((whVh@(1167gPz#XQyAJ
z;DxKpJOtZI8oNbVHuyF8WyRzb7b}*(xfxUV19bfsRkMrOSmg(n1uFjeA2eqIZ*vNN
zp!cVgNVxK0NBQ=aZwZ_=N{^mtinRou2z?!Dza!NCV;q6sf)yOL=eYU8?ss=;89DoS
z{CD0zk{|kJhVxas73=GJ;ZG`0${8Z2cRvZ#hZ!1;-D`ehRZb(6a3)Om$0yo3mqBw)
zwD&WMOxKgomaDhD(7Wt$tHK8>&v)k@Q^LKyZ5@HR9U&a8X$+GN6`o(@dE)P}l-=7`
z-x2h<<NWR~YKIw8>Ay;bDoKX(NQN=sKeCrLUgDhiD5;aW>yRr=R#OCdV&w_CkNX??
zwuydZ7VV=65ev^|uN0_tp_dQ~sPpytCL3|kbhwr$hjKbIaDH+ov02V^7hz~Kf`QrP
Uh9>}MqJc^RK%n8{Q_)rZe=|jN<p2Nx

literal 0
HcmV?d00001

diff --git a/backend/compact-connect/docs/design/license-ingest-diagram.pdf b/backend/compact-connect/docs/design/license-ingest-diagram.pdf
index 8c3c1c2c0d33aa2c3fe0db2f769df2da3f200ac3..6032ce3ebcc2a385440aea276b32bef43b75fdc9 100644
GIT binary patch
delta 24303
zcmaf4gLB}$(|^jV?Otu$wr$(i)%{-Gt8Lr1akXvRw%+^w1@BB|CzEV4n`E<_{UoW4
z1Fbp%iPeN);$&grO6YS(jdO$td}U&2d7`(v0Wted-qkz_Nf<*$SOr`#+|*z`ScWdi
zUYDT}<{5m$i}!21gJ&h>g93T=g?m-lmUpzYJVi+~F(p#5wtd&wZ$C~5W!Yg@PQK4m
zEQ`<0uWA7<jHaG*g}dX^9qADoN64MMw`r|0keAnzp0kRl@9%qt(C=5E<a>;O;q3kV
zZD$&IT?Pa`Hn%@tbG~*3z7H8cKeq|K_6@#_d~c3{kK<E7R^XxMn*;CbaC>R{%S%Zn
z^8i=sOOK}GW9aGBl~Tg0lb25WET(C2wSc7VMCVQd{|jWMZFOCxWhn>~?M-Bys?-<r
zH^WCB=}P0a)Vl-9VGTgARqOFm@)-J^Kl#!_^U#AJfw|NYQ~lSG^9^fbx94+zH)r{1
zx97NwS}rF6gA=#*(*-p5JCo;SNuWf8&O=MiH#+pPC*jw5J1Q;?kYsMZ(hsYn8zV7I
zi5L?^BLUppJIz8{-=sNmL;42@YUO&|c=|e?8Pf5<W`d7_(gC1!KNxDVxnFd5Jsii^
zKpARq5({mEr_t%})VVx_Zi5d`3T+{2_x3^MK{5T0V8jGV5SHq@lT#G~W#)z;F3WDT
z3_r!uB+nl~#jN%N>h%q)`sz|x-e|y94buWoX0?ecgP`Z%0$gmWV6wP9=y<9I)mI2G
zY&?Vzi<V%r5dp2UME`NDOvjlo3cNa)>|4(2sJOU0qfd!b+=p>=-kKa80`JqJgfC8P
z4TeR|hn9Ye)8HhiyNZ;$@Vg9&?Sh#p83v2I_$BV~l8?1iRHGmGtNk{(<ciGDGNk@L
zu}&BIr01c2EwWd}Ca{w;-j@YVgYxv+Y@=*D8`eU-p#th}(}vC**s%033;EzWg?hq_
zc-~+ZzXzpJB;Tab{B#;O$Wq}YOG#}4sXdmEHM$q4%|3@fcNPS(yGb)O3s>cHNfkk+
z|4pDQF_inivF;e)DF@5rRhll<qe4p9%#7|c7kdX!pQO>a>0;o5Tqn}`854HGEvo!D
z|Ie)V9BA<krqut(PX_~PAzuOaO9@1roTw5G9YWraGOShWOqyK^8kb~B*i$$<*73fq
zzsfck>?kQB)d*suEVg;mZ*f%E@+=!wo!i5|AyUb-3bk8JLdnQ%fzT18!0WU;y6c!y
z{bd4$dP%Ilv{5q;oco`sk)ywnk@%I6=ZB;L@!4}#%+ZI1J_}Y2qsxHsWprtBecVbj
z6489jxYE7FA7RJPG9n?O0^30%!9TI13KTeR+s5o^187`P)H6YH7>sBx8C7Jf$%+&M
zrxPup?`R$Ah)DB?6BxuEP6(!AbZ-9kNqU%7Z&%!;O=L5Q!mg_`N;E0JTF>~|?zU9}
z`sxD#ILuo*7r6e)1xWG9r__Hv@p+SdPgPQt_V9V3MPY)mX-Xr3z$RPa^?ut2gt91=
zk><N>2BRk`)p9J=8~j}z#qST@-Qd_}UR;eV?v-3ZMNo$7X_7>!IM5bD04ft%DcANs
zx6i_#i`V~Nkm!dc-MM05^el!v?Ik0SfOhwYi@sDJUFFzhHnrxRkI_)7dJEkow_H0p
z7nDvC6ft=Tlar@r{4}kGFtMZ%N5~{N8t0bVcP#Qy3?*h!iM8sLwh7N4VJ-7XNn6|;
z3{j;TUG;BQ4Er%GT?-znp4r`K?SRH(B~qg)HK$gxa@L1LGH|M7;#S(-G>HPGiWg(%
z3vOGzPQs_8v3^xhcmY*W@ak`Jirh)@)TG9i^&S5t$4m~3y+7A!@IC*xQ2wysYO<PY
z(!qt7@cgLBnE7}9vTvM$5I@hzDj&TnYnY79G9d1nxAFvpth)S@5QCfq@fch*u>{5b
zslVNY+5o*GgG_KS_Y<l)J+RmT#jhkMFA))L960?FQqDUDP@^VNw85~xM8>I<6%-UH
z(>RNjeHQ-0=(4h?J2PV1@r^cOx|FpFMnQI-^^aFiu4gmUjhC9$T+XEN2oa4;bV(3w
zdn)VKZWbgT(tTH;%)2mdWaeyuOk;mhS1Q{uv_X{N>`uDz1Fb<`0{G<=nMhh76CSpW
zcpT4mSPmlhH%5FSa09VT1T|l2>fjN|#gQbR>mXdBZ?J1qikP`6aiQmIf;k1C&sQLA
zf2o)LrfJeE_dD^JTp`VBVO)$OWxZXgqxvipVfUcZ$;A}+H=ke)Y~(}#H&tUKEic+j
z8rX_P(RtQ^+}hNbfLjoy2(GNY$|~-8JJNA8l|${FBZky;T;N2_`oX-f&aOcypUDbK
z$p25etNBb&cagUk`$aNJxCiI+`nZiOB7GH4MccTb|B@x#VBdkdsA)=)#ZPn~C55n1
z-@eGH0)}ZZ<=B}xr5V<G;^aojgu+F=#wdafkU2_jJ8LC-w1LI`ccOno%T>5_0;W#Z
zx-9HOfdRBtM=c*2`UI^4?psuHg_%<-YhxrUJhSAQX^OB22*%v7B4H{FMz>7M{qy(o
z`_VZL1;TU`_kJBA!WeY9o-!NqlCrT%%5(q?;8T*yw?PxDt9DU3AdpmF|K>gSX|T6{
zG4f*)u;uEX9T81#MQv~URGNfBk>qBIb!|tLd@C5r+^TecSE2K6fbdI?fs>l7|M(u!
zKXwhrL!mvJUfq_$|G1fj%T|f;S}aC0zO-P1B&!1AEQ}HQY48mk6FT3(>?kApwXLFo
z$D;Y-@cVnBh-H_Bcb^TB+(b#jYZ`23oa<b1Zi}u7NZS!q=NLNW@fgDz?#sB<<h_te
zGP@C+<Eu$VyD`WjPcZ|@jI=BtB0Jq#jJAFzI>Lx2jyUjoQPNOjEeWQ5vJ#l?0Zogh
z@UlOb5&>d(`w$fuq%lpFqMo$EAloy5`y;C2ev&ndCgdS1iE@*lYMZ5w2pFoi!~|8H
zn(-$kYn&AU;q*g>fKLEdV%QZM1zhvK{(9b@i%Rul3RW!ivzc$=uP3kGu|}I-zsI<9
z#7#7{c8w1-D+uRyxR84^5!4WnL=AH1Oa%M|G81a{g7CRM{6H95=zNhcFttGdGNOk@
z9S-bOq~s?y*TBq$Tge@XP^;$+g0+q-a;2PTRf9h@0<gkgVuSk%<;NVFZGIwcSl-KE
zf?#yFBQZur(Dyms7`pq>d11t9HwivaH?<C3EX}HX2nsgHz(}J7Hl;NmA*KUmrZBL{
z+H~3$&K|}Rnf<4Wi^Fu6QOFdiFm!g=Ev2_BbW@t&l@O|OPystrH!i&~#bt*_DOdwV
z$eH1%DPOeGu~^>G=J3iRbvg)zgFeTpzcaDYq`k!Jt%MI#|8qwj*kRt4I(p=5Qlx^i
z{~$tf?bMGjkC8UR^2N(>VXJvkw?V=!)0R4VEmNt79t>WId*-80QF#r7jXSh=zLt)w
zC4|8XBjZJdLG!nygR1jl&R~|N-c|1;{l`%3u_blu$->n;exTB<NLK1b9jEKWaxD~s
zFqwn_-(D<zQrhpe2>xB5nh&KdJEN@7%6GbFJ~wJ1+(Q5Sxxlq7mqwvN!QMc+nMM{c
z5#^RV<AS^Zcdb2qRGk3GT>bgMzE4BnF&5A64vd1Ve}Byjd=Bgi{QSDB`R?WuJ95Y&
zmT{Mlo2-AIewL53%iiLyR9m1X1=BaLLHgS3#MnVvK!6r)_GK{uixkmmzfBMkd2v!c
z9`iZp)$-f*tXHr!K7G#Z?_UWFsGYvz-=}>y+T`JDenpFto(uxo1WU%d!OPvyeH11U
zcz7&%6har8^Tm!4HE2&RG7)E<cf|gprRMpISPf@Bx~N>4S%iC*faX?@Rnw2@zUFR7
zNok%PFE!7D$l#emJ!07+)h6A82r(%xw)Q=45Q^M~{&We3crVh3w9>750K;|@-cl)X
zi^U=1pmpmw&W;BXA*o({IE&-e(_)wPMlvcqr|g=Fe&U`{R3f-oL79=%?O1E%ow}aI
z!-ocTKBKcHK^iEl(f*3}o+pkHo7JxK_A5URt)__`U*qprGsqvg#4x5s*=U(RaQ}}6
zRA#}zBv?zw`h9N0_CMbaeO_IrYwd2nR9sbW=7w;Uw>Ai1jl@-lXZciEFV1K(6>N{?
zcN_HmxYI4%40x_xIgA5jHg-aab;=a@MbiVwB?YrxOxBtKI)!X#xKS}BykVSwy8KlJ
zQ%|c=24hYu*m5?;cFI8HJIEGW@#40RD<1>IJcS!`pzcaI-C#OF1q2)<RD48g+<3;)
zf7pHI=M?V%vKN!iff=Sws<Kf-tLyzA<;5~ivU<mHXgGGqLo5S{oU^2GPPNHCdSR|e
z{8#=A>I$&J0Qo#wA*EfK=o?(PY1fWvin6=KH4kw$W7~)`O%;lAc5ubK-SkusW{5;#
zk&K+$(QrJj@|oW&XRI<y=E8v)w1Y?F;BOAy9tRqL^f4b;OdX>eeqbT0xCX7iGU^z2
zy)-XOAIuc{)?0@SF_Ig1OnTNTs~||0zOD>YVBH^ZpZwpw<N+@FWeQe;m|%2&{8eCc
z7X4fB2)G;5#(yeLn5`F49Xq=0(YhiL^Uo=+!#bu`G-YBJT7G0u8Zth=Mxu`xkY!f;
ztq3*)N=QcoM<N6QYSsUhtz`$0($%I32T_4$oae8BkaCCrrxY(@Zk@E*qCe&0hdDia
zh7&yzn)la=JwlU$f(>MSN{Bh67|oHgO>CGwMmk+xf@ug^t>v__&IKf*?YOVZuaoW;
zFL}he`;Oz-FF&g;`k#TU6ndAj!gSlGKNGe9Ae`=vQ5Q5W)vZvd^n`Mu*B!U%7LG+a
z#hI7tqp%P%g1P3XLH*@AE->a_oCnJF{s!w%3RqI&4rsKjBz9O^z&Y7x_}O>3RZ0=9
zsg>?0P~kjIG2qv56{f^2*L2_J8tJpfvNk)J;BquO`5tb&;=1S61WH65_5!v2OTN%R
zvj<~kvmWMZ!dIjp<(aq~lgDf#_jSFJOcfd!Txp74=^+D&z4ouy&mT?%L|1$IsGLYf
z=58D1MozK7`cmMX2*g$0Sd603x@%nnweuUEUQbuW7Y_fvIV<s#Mv=VK=1+z&oSmQ?
z8abkqVvHyvowVi*GBG#bg4$!kkH#hdaXqi3nNO7g0gpljcSJC&iv_jz#~9A%)>&iK
z`=M8a3(rGx-k^ZwW^F{fNW?cS9e>E{eB(=LXn=rH#Bii)*@x+TLctF|rybC-Uf6|j
zP!lL4jYEXlMwtxXirL<_(rMhNaV#8s(Zgc0r+JeIF71lnVzLs5Vr~(y_#M$evuEFs
z$+n_r>LH&Sogs36FjgS=9bF`ui-wGE%!-0aapjxYm9(1P8RSp^U8BpEM0#xut4XkL
zWaqv79fI7$%OLA)rwi$D$YmV-`jn%j{CBUXuz<rEty<gupA{Z^4AF)sb}U)$qt~Ko
zMKE<Yc#!k6M$*;3=h%Z-JZ(e(lP`-6DyGpDG!HXDk)#Q2C^$~pGMgQ4Liy|%d(_Ps
ztvWOYmgFFf3OsP^UXelFN*KHU3>T^*Y5o`70d83_OY|F1Z!KNbpl!lOjD=MNjeqdl
z6E<c!0GVE8;iS|#JN@c4v-`ba*?L)FK;S=w(ArR<RCAB}y>vDH1+E4_-l8lu-xTyX
z_4+yF>q98{WjBrh-xJK>N@3;v3;U>enu%l58&6O~`e$h33KiKMf3Y{srde9g@2mRp
z%B2d38m45UX=e8Jss&toSNDwdhXUxr#a>AGn-Ld0#w@$I^h!utOW8^^MXBHSBS`j0
zQWHC6WCsLUC&;@cUWOw;khU13F*jpfmFQz>Y#`bXFbrI@q-)fDT}3|H)QuBI*+8~L
z*Q)^^Go|wZ2FF^M44Q;C)(5U3=JocDLi|rHcdvV7j6hwc<*aD3&ctX?0Yat8BS9LI
zGlA|p<~i0pViq?%$biF=rXq*s@v2CkNeYvFzYk;F=PU|>P@)Uqr8uOv>uID;?X|XQ
zOypQ>|MEUxhKJ#8S)eFiOOT>4-c5x{bP9Mok8+7#jyjv-)n87Lu3VXd=^(dyPySrw
zlc{`VuiNP2!Fl|soEP0J@gBB0-(L^aIQH^jyScGGL8yT&grRTxO*#<a1JB4HCOX&s
zM?n5fz0=cRUxop&{fK0L)5xxMOV9t<vOf?e%1RX2cXC>}`Rk_B2d@CJ%~lR3k(}Oy
zK@3vz6)rV37f`Bp7upVaN<7Eff~qjaLe66hl&=z6Lh{?+m1bVR5#Hr8GIj*Ah@mfM
zg>59UDWN^1eL-Rv$7nqjc6TsrXC&!)H^hbKixGFa4m1NXd(9-_aIrgiDtbh1B1+_@
zs$5NIYJvbId~T%kcW*&0OGoLu)<c)I8DqRsQ!iR-i9HObZD#HYRjM`iu03T)dlm=>
zsbzr2@{>9iiQY)r4ABn^H+_8W+93LsEau7Nr(q)hjDo$FIXn3^HVn=|ti1E-wmXs}
z%+tNOl~X|UuMi?pel5Gcg1>1!>Vz37;$$2u;-Yf~6c?)j3AUC#htD-f#&RzwRwMXk
zYwyDx!oWor*;elhm+?~kAtd{w=0;PL)Vp}NIz0~6<WcbFc1;3{mXvYd<2CZTXDef^
zR_|hnsZ0Bi=8gPONy^2|FE63ehWSo&iaxirzx)7tGj(wVmy-UkcosRh<icfCG$vQ^
z6;zH0+<i!PyS)9MVcrlH?^}5L>z#w8H?Sc|NHpM7_UeZl(pvSnE6Lo%7b^?C=Dp@K
zXgN8hmPSIivXg^{WG?ga0Ba%&59=@g_Ew>iGQcfx5-&f%_RQb998w)sirH)f0%s5M
z@e^=|drx(o@lwRM@yZR>TqGd-W9`*(6ezEkfmoe^IFp}x1W#@gGIR#lgr0UzKRcl#
z{r1$&%jjAH4PN~5pGwmydO1{Sc>b?Eb7fV}dE5S*b0Mj``au4ZKsY<_A$*pGv_mG=
z045Jq<;W?4wZu~Ma>)kSAARCcT9xwb#>l`H8~vE{OB<>nX4|!F>>hShS)0U!G<0L{
zm;6NY58ec5rKv?N&EzwT7ys0K7zsFZ%jE~R()F3?wcL|Q%p&ENKVjwQaKF{+)&-Ri
zXQ>w;<_$1$WIzSgl=V%k>xu&I=~*`PJAU;z@+}5eT&i5r>AF?8;O)wFIc31d7t;eg
zgcXU`lUwVD<<+Y@e>AFA8~Yy-{^-~|4QuA`@jVo_Ob#aETvwc3(B?335U(ZGo?5It
zC7i$|uyn`kaXizzCbYrVwVz#jJCtQGlEPZF^pQwz3?#)KUZgTl^vZ5W9Pp;fu{p)m
z1y8x$#D`Pm*xZ}g01EUyX0Rf0@Sy;x@~Sb5Fk<as0r%vdfJVtH()1H9GL1aK>mPv#
zP3yoB%~Ycp%^d{8e(N#z6K0)Ah~37&^c9Ow#*4<#*GzDjCZGHSo-dWUFB^YmE0z@4
ziW7-yH|Rv9ZHbkrSYvt88z7#zC8?$Jju&2XiZkY0q;-(uEqV))aC8N1DY}7Nb;gch
zd$zJu6;y=Jlnw@8O{fbq$fFs>Vyz=}ob>-h%4P~cQ9zWuil&gc*>J5R%)$5!EeGQZ
zP?_iAV9=S;uOtwgy62;fuw4UG@Z)|;sJvlC3Gt=#DS~OV$m$(>HaoeoI%?Y=87lja
zmlrJz+-MbB*bU8v#51CvIGh1~x4l<zEPCwR`x{0a@h1VAs&;A;BW^#H;#PZn=hr#<
z$Rj0djZ~HA%V5|bBWLP|Y0X^<JvAm{6wlX-|BMQjj+CkgAP>?ZCo^pDXL$KFxkfOq
z{o0KwDK~azuxI}j0@p5He#o|Fv1Wyh%W@YnJyP#rINZF~VMnud(3l3CPtYp3g*dgd
zI2K13*ITJ-=VJXO{B`1z_2;cxTPV@74FP$Qy#f29D~*l7QL6Q-8wwIqn-Uj6&fyY5
zZ#h;SW_--`0>#%@Z^sU%t}ms9s+Xg^4*tNeQP}~;<hRNBL%<&a4u(7@%Zjod`Q5JR
zVtA_W#iGuPXSw4ZvVu3DJ@G;^<5fLlj(FL|&%6|oS3>_su36Mhoa7vOLy$T!(LA^0
z1$(q?R1~_lZ1kk6aSQq!oUE9!8#$N|n3=`@JG|R)NaSS@ayd6dlgvvEhc|$6rHa2b
z8w=CfgC9%ZZphH^^ObmG#I&XAu-dx*LZ+paN5Of<O2z#K4QmYO)va-CK}Xt(gp_?p
zH?m-SkYFq;+h2V3s1;wF<zot2+(X{Mo*gU+w$nWLGx+}U1kOO1MNu=kmm=lEn$f?c
zW`H)3D<9&S+7xyhR<%!Okf($5Ge&GeM?UW@B=%@-#lHm!yTH{p@F`BII9mxTz$6m%
zNHGP?)6ZU?em?=g!4EF5fFnu6*~2n&pk&=`TR*f*-8q!tdv?NKQi7~Afu**a&1oXy
z=I|JSNZVjiZl5?U$4MCr+Hl=*XH!+O;AAI#z|X9uA$Ryvt+=~5NM9pbh!H96u}oE_
zV3Y-pq>$u&Pz6>%dPNJ#YYRpV?O7)?5QX?#z=WF+s8xZp^XqgcsW9rb&${hv!Otb`
zTB)3truASAO$|+vvtcCA0zi~q@fMQ<4>FmlW$n2m**B5(C(F5sh58zotmWfG80J%7
zepiLim_wd+e@n}Bs53N$sNJ6GPxp*3;#{9@e;AVq_$Cb_hBf04a3;Ub>qPtv(*nHW
zqy8CePg{Vh?-2UpZ?JaQwok?^I@|B=ikqtF_X8dZ&HhVNTAH{6*<|~V8pK-LoGor#
z&?*#+|K7$P7^XsQf=(h4P|p3pCI*Na;pD2w>F$SJII;lqgz9TT0k5y?SJ)AiOpW}h
zVchZwxli*XD=AqunE<bQr<OP6+iXi8lM8GMtz!VCT<h_Ca6Ne{G*iB@*SOcwry@+t
z-#BKl45)K)$akCm%XWok2%J+m`Ux%9UgV#1x|x7;@(CY$5+wEbgWO^Ujn4BwV{`63
z^T^)PI4AlF<?V|u1ya=e34N1Y=6|<lzS<Z}eMBf3{AnEMxYsj_)p^cfC>erc@=8G}
zFaV;|9(abVf8t#7KZlDH^x$NAPVe~W)WsL`J=f`mh%@dr!v+|!H_c5OYX8FCG`#QH
z(sAcjZFB4b*Df8ct6r#!8E%Es&UGK_*G$J9>eti_WEjv??f+}v=KPuT>#=)nGF&^l
zMMHHH+R(3ce}UtiNlN(_{4{49&n9=<J1k&a<6Xx0cj#o!r7BEIr599JzxBm-lB;n>
zv%GDg%iU^yRojoglIs`NlQ{#y!#Q+Uz3u=f(7FpNVHbxYFA?>;Z&)HostV@+nboY0
zp)YM!;)xAv{ln8r4YGq4?uIo2VKSjJLvQ_eWoaoIa%=<@R#o_Lq^VO5lZCB;-!X70
zv%zsj0{+SYC-enDb0OP%tLHYg_mnmtqTV1;p_R0ZXO8AVG81Q1@dMsZ)FxT#c6Ik!
z<X09Se7&7mo~~*0@0lUcAFx(dw6Vtz?7gpj;OE%RB0qxtgE*f<A&`b-Hxp)b9V^Fi
zm&9-=RWbU0!#oMTCcX(RQxnw+gP{T%xYEprJu|w?a8RMs@x_`o*SWVe0jVr&7B`-p
z&8OQ>(Q|0<SIO(cspJ#hLzM3C?-Z3iiL8=lN?_lMl9ljP)$F((EIUw-($7}hX0FJ}
z17LwuxB3E2v<mF-Fi?|)Z+INSw)1m8CLueFCqrR(>~#OLv2c$CQWx5%y9xlQs*CuO
zeV@r))T!kUW7<!8H=_&f?t$vVyf6-qO=!;u-*6i#zIa5>tTZ8EQuEPKxQoga(aO+o
zkIu}5f2w-5yHeX4ox0pYTIFVwM=HfmOMp43h>|J}qwTB5x?ywHfDz$#=@&7eEn}^!
zdpKTi9Do06yRwl5(=j`gvIyK*MsB)X>|WIl`%n-wOHLG&IJPZ`yqBz$^;`ZBQz`-_
zsr4G+e%MC*epgWU<7Tz2x|sg{XlSzM{#c*J*?*afv3*Z_Q(cRSeYp}V-21Gqo+FOn
z?+nAIb4=VgvS=eUU+t~1yaSba!VD~FidKW<I@y%}yGAQBN-J!Kkp%FJzQrMW5s!@4
zK>Sc<&3U2bEa1~%YJidY@n}`WHfm8%+wztvQ*(oA`1j{zeDSEE#SL{b269eXY+;oE
zh<Q$D;peGQNG?b+*WsZF*Ul8_4@r^&&>fcDLKk>5D4tj&WMB33k)TpasLnGZWcC+Y
z28zxmKmL6BV0mYa$R9u_wfY*ZKPI&QQp<mI+UiDlGIgydQR)@;Y0GhR!c$`WYNpim
z%6@pG|4HtjS$t8m>gEx~qK=H8n7yizPPH$XmboS4btHH<nrk9=`Y`?h%{U-o5$BMR
zYmcXbDER3+#{3&!=P2m8;Uo5-RUz)ECN@PnKk7@{EwQ}dWds$#62wglTw<_!0G)E7
z4pU!ph2cK6Fh+jl=Im@^_6|DhGBjPT2H${frZhVci3)klu4}4LqNI*eYL#rzp!}T=
za~pyf>;j^JVU<%4aGk9F#-_kZB-RSyg|53d{>VNc8Do{o1g}SsO6d9}@!pQmIvnk8
z*OKBe#ZD}SU*!n&UFZd+ioN4C`9?(B3kHjQIo*v2K~b_{7-eX+UprbX^j~pb7}hIl
zS)Cx_fV2uu(8Mq>FE(u8D`Mc*i3_mxjEDB;FQ}%nfYz!rIC#aer9wz~A~%4cNFJB=
zb2~iJ3GUbggPkp|_V{O2=l(7#q83nnR4MB}fD-E-wp;|_;nd5|bbe<>Qycp1m&A^Z
zW9P#?3q$%q@`|WWBqmF-i;%Y-bcNxQVq;zKn7S4`pez1$3B@mGMSm0v5#%EP&0;jT
zwW*7Tx%KTWKZJ@9&q|vshT@;-PgtWqq)%E}tI=XGj@9Rei%rmC^0y(@EGV7Pxxuw*
zFo;N6z&HWky(AYS7~`Er$NUqbS<b>VqfCoN8DSZOpE8rm1!gramr;!tqfGmAx1}+s
z7}C<kIbz~}OKJo^B8A2JESAQ1CIkz=>1rc4QT2oWHs#y7r~RmL$Rm?#lD5g2u`^pI
ze8?Oe%DgFlAPIr>5D($*?rXwvFu8=EtH!Uk5u5?qLOIaP%P70fjlB22;v(}X;lzw6
zVMLU$!uu7`Lh>2Wf@NGp{rtK1<_LF#V2>?~JLzSI&n+j65n~7dM`zAZfhn#|mTWuD
zeg41Lm`_nttzsq{`L`c*I6XTZo)p_m{^Ew6$R-{-Pe@QEE(i?<^W;|rL&q#N;7alo
z-R(dhOpr(i{mAogKJ&(*anm0L%u=9IxHgjGh%ps2bPkfIJf=+ExcR)S=cp?3@Mi$z
z<30ab53!~I52^ZxquTgA{*Mtt0`9t&1<pS>SR;bsdId6c(6Jk$zT`sX^=L)Z3?Yng
z#%kE}V~aIf=06<V!4@!9l}NL@{w$pJAKd`ITSjQx7d!O%G1%)^TE4>&y)#~FIhosl
z9IV1FtJfYtKiX5{;KK$XxGjt(h~Fo#tyKZi=~}XV=!PoiO_LfD1$9tKHTx3U&H64C
zF;<g)A-3!v8nqgEpGiG|435`fn6c{<su|?6o2-$;Wv!uNw>Id@@(Z;3eZ?D}9T%YR
zg7-c~?c#|Ej=Fu#y_MpLxwM;BTExWzJY~nF`90##>X0TKDIjY${`9%<+f+X}vOqfA
zvw93?hY&8^{>e*|*H!w@iXH^zd=*ZQoq~vXE7MI;aeD$J|2_nFJom~h^2b)=n|$b~
zF84>{7fTwPz-Da_!`v&p5S!o~#~Cm!)6a6vBGEbd)31H_XM^i5y~~3_+zzkj<IaCd
zm=?$sXzF8Ht^^Wy9=8tKrA5gH>xILSC};Kw&-v|sjqD(|5OmAFtM#?*TzJua!9JYT
z)b1P++2{W3jEhS&&R22kJ7o^NZ4&l@|6Xgz7`{tn->-u=1Nw`@)tgHSZVG@&VrDB5
zlQhg4B~^cX6FMsXnZVEWQE^M-&BsT(^%T~ss%)~;v)P)nO%pqVG*f?;cWC7QxU?z9
z;dt)T5PGD_Qb=#Od!f_F|C*PAY4Jb}lQ0W_BJ4F^8+BJ0Z3bCj6Fm-DwMvD^e8XjM
z?rMG1o~sMv<?W&A&B((OY3=}obZaSxF!sJ1{qFg{{n)mTdG0s)8n6mqHjHaM-!|?;
ztD(5O7>eKScI5|Rsa|)N<_Diw%HD{cvCw^`t*}_><K;R@2TI)E;hG2JST<N|oaX=f
z`aCPWU5c4t_H@*3GdlHWZsI#fiZb`O5vO%JEDTFCsfTM+p^fu*;~D|{o5x$X6Q7Bj
z2ziVjdItU5kEPFIB-9ohoebL>@BItGo$jNQm8BM7Y=81vFqqyF3KxP$)6{y3H28%o
zXS$hYZ>Q0eD+5I;7F8yUF0a-LU54&x@}rtT)X4=M&o_3~g!9WYR@Y8VGz9k9oiXjf
ziTvH68n_MLh`Jfw)trD|0=bg!z5}fNkx9N`oi3?P^6!w)<-a);(AdDni_h#D>Vxo0
zAxh8ZO%1A%#e?nk5-Zm+DI;*s-pN%Th~#XS*<aXp&33W)Ep~4=;>;;yF;dV8_e$+T
zheBp@OiL8)JlHlX?BvKt9LA>L**owmVogHyb-Bks35!Lx-&BAWT_xiedhLoUymmVX
z_Ek3nkXhyVOLyw!L1(sSyod3E$R-YJJIgo&;fPMg<V)NMCoyo0u$V4lV~4PHD6rR5
z##m-yr0WyncVVPZ__vm3A)Xc*f{QTwZQRW-O-hBf{k7+3=PHQNui}HYB%3OreBQ^L
z5b@$8)kP44&kK;<RJ(Jfh4PD6c^S+_t(H?y9egPljc(12L&1S#9yZ(5uM{4u`VP6c
zh78ngVe-n<O%X&4&f6i09pHkWHV%p|UZeC<)ZSBy58G@bir}B^M6SoZK;rwL8^y#L
zD0ChW?kv=iMQO22RIuJDw0I%A08fHNYg$LaK?xZ0J^==og%Bcta1qsHS?ck0r3*(U
z&7!PvN(J<q<5<;p3BN(HHF~oO5k(jDYfliIRg_K+WLepOrRzHX2{jQ6iqUQS@JJAu
z+bJZbf(IQE47C3_P|E2_fiS~5ux2lk!l_NaH}WAmBQ6uiEea_=(&^7Mhici+dnd&}
zaoL1d<p$K8nI@KcnR81<n7MGe-_V_abJC^bH}tg-ZXScvtncU`jn~7&cSB@dg%a^C
z?-DvGq>~*<Jq&|uHqfI<mFLYcpZ@n>@&|&p@{|1-MDPxD19Vu7q!9{K9!zkPF<m)<
zjoiv=sPYQ<sc5|&SwVX$^|8;1v>qYPeoHcs@E5R!zTYSF3)Q_dLGk|X)Mc7L>MizQ
zDHlnA$PZRtd6*H=Ho(sinWH7B_>fH4?g!S#I;$dn2j{xQB|j>dsNqD2a~k*G**POh
z_VA+ha$B5D>@Zb<xT0iBhg}#x<x*e{3U+d2Hqmc6M~Rz7!>wd}`0|QcyGd1tc9KSh
zQw6BnMdchil~&yRoy3ChpXOE1dw|WL`&O!Ha+cHQqxY6#W0cQZu43)#<$CNq?Z;m^
zr%}B?<x`|Jk80fKJ^P~~xBFq?S!8x5uxbv(Y&uqR<JCQChM-}p#AH1*uizBH)GZ+V
zf}mt(dm;O}c_~dc1HVw9Djd)F*WDaA2_^93*o&n=)f4=-)Jex9lvtBPUGJo@FDtj3
zIdpabCNfz!i;1jR-?qK5*^7SJJk>T8o7^Oj0X|{n`)**&On1lXM$VTJ*G#Ya21VP#
z$fgz-Tw9KTQ?S(`Qb5W&RBx%@=;(`(#eIv5pQIU$iH)S$)x!4lpXJdH+TMs@yaE*8
zCwLb6vn#Un>jY+Y(z$$v`Dcu9aEkLT$CzYAhMzg$qcrms{*bL<PkywR;LyzT!$ffo
z4=hKx=w`H-&<@u%Ub#4U(q86CqF-NgGVN~`vN#*;@lhNdojRnu7N7UE$Z@-{N%ttt
zrBz>&oK8IS=RyD!U}-(>u%-9oEPxQKhC+__m*ZTT0<<=kltoC}v%}N|PyEzJ`5?(D
z-1FOj>NlC}<G+@gRN`}KbsYp!7Tqz}mqIn0)D%Y_RQ5dN(!Eep;mFa|^suR86L|eu
zhy|CFRk1waYKaKV8${t{2DyT{Myj|z%m||Ds29zN$Ehs?^2a1-v`+pfK*4{QDpWI~
z3)%^_9#GzTebU?P<4Adx<B_!OTSRGn)F>}z)<M*sH~WaDVmCStb3Bl+(WI1P(W0(Z
z9zCR#P6mqC$LZL2-2?MAv0C+auhVf_BnG3qE#n%@{ZcV4&$%^l6q~piynT#DdB-;}
zfuhiGdKh2)xX0hQ<zoNrPv9;7fan$CC(9ZXbvV+`WU~#w#l`vJH3`w2bxcJb<BhGy
z!cGPE59HHkfqc`<&MXIuz8;TAp8&7Xw*)xpc&um$P<e%Vui40WL1gZ^_{Y?<${q~P
z(7$~JH?+&K27(me^Sc^twLVow$RqnV71Vrhn~@pE%gtsRAT?V*fzM=28?|}|^tS)-
zpZm_4th(Cyto2ar<AUf81S>KQc<o2L;?*+6i0)G#;cg0#FZinIL&Gt{@tHJo)Qpg=
z7P(`i-^BmwJ%XNzU5w|E6r@uHNj*@%Q{YPuznU^^Rcig(`F-%qjaTCb($+l`>mO8k
z2a46S+n??akf&|`RN;nOb8v^WYoSG52t{#ODjM}3*J73<zlq|{60#w(CdHAl<4x|F
zX^+JQn85h%9eiezR-+yyPhiszEv%AR5ln0BOj?9~iZ-}L$$QmoIj=h2bn^EVS~NFn
z{-sl{z<l}kVV(WMq1RF~)i(>Y?4U`XULl`L68S+IJkT>;W<Y-Whp*U)YAj2?O=#R%
z?|81oT1Vpcj`PQ#&sgVVa4Ttt-NFTii8b~#<Haw$ph;1p_&*pyzS2XlPydDX%<)+f
zwKE(J&}5vaUDCdysozrI$<9&!0Lt54!2Y0_w%4u;eYD}bXgSyAzc%JDNblt^{{`7v
zr`Wv~ldL#CF$1cN+PSK=1P&XdO1bu-+7dd^=lr#>Qk$c-yt;o2&4Ft${7`g&2#3f+
zNKl5O*FU`uClyDKMM8zetTNFiZz&&eTning`$U%%@qxc(`@4)}V4&_}r`AkMz5b|X
zIWxunoXc0yNVj!#FfX)An>Zd1W<KizOKgC~4XuP~cnAp5LEDQ;qXh@bXNM_f|9-{`
z%2+C|^^=lmzTR%FoJz?^S@gYRXJEiejmVo_U>=l1G{7bE#sOYHpXZDvjuy=oIvArV
zJ+Ah;RwL{71C%g3bTh$b@K#97Gsi`+H`x0?p-aRq9Y1gW%JFUxvu0K_JtbR(82H`R
zMP?<Z?E(z=Uway27?=AUy9`(S&wgKfo|3^t==`G8yeAZM4EeA*xoomCqu2B|Th&^t
z`HwgtUcF4Ac8^y~8pV@F^0@0hu#b`;wx#EoUv$au+GVI70tP10&ecb3)n1d{Te=34
zYezhsPbe-Va<HbP9|~^Gv*@uL#P@NF7RRF<$N<tk8L08r5mwRp-!|~7+TGahwS71&
zdQa3lJTUSJ1`~;E_6=zHol_<57j_9zkruy!rm~%C+I{MJy75;0u|vZE2+wXc8Lfkg
zXh0!o7^U*M;7M_VU(`wGUo1qUZvGF|(M*@94;zrgsM`&TqwR;f$sQ#ZpBUKnHNn3k
z1)>pDB0M!c`6!x5A_R_36?Lmuw3sCRhp)8iE|HYcw)kDHad+|$eRG33X_342)XHgf
z2BcL}8Z-4ylT67~<gq07RE7*|lQ~Q@P4OOAV;H-rusbxJnX&OMm0M^L%DQXzZjR$!
z-4RV5{#qD+oIlPMi0ARy^q<P7@O@zdHbR^CsdP>9Lk+4#F+`gCS}`G?_PTDmgUGfY
z;qs?DF2YFgkl_V1O)*RiX+IVwdS4w<qb*CM{IJBj3zbYA#7~XTR!z`Wr7rWNdXz#Y
zsAxr;eGx|wKeFq5f+1{X&j<Ns((sU}NQli|vIPd8d5M+%2!@BkB(aruWyA^rQs{=P
zO^TnoM|JxYGF7pCn2PCtg3jb>d*+X@xTKo+sH0~aJ{J|%6=`895VK@oKy__4Dhav4
zl8!VDxb4b46sD(xsm*RV+i!_lPX03Y7(#*}>2ZIDU;WoM*#8A4Ny~%a*y6I9S3;zC
zU&yshWQ(PgDLo95biCm`1iCp4;70^fy_e#R_!||R23Kve8JMV1Oo;Q69Q(OTwI<Xv
zFN`NHi=k%2^IbE^rH!m2{q!?pB6L3KE4iwQZ*M`{)uBvYPpiU32#T@u=OPrv*>o4I
ztT|NoeqRs^rv23exVL|J@Dx+c0(Xt{G0tA2A1WRXk>gMc8BW&bTAATM&KrFuYij5?
zN`?3NAN1+&Z<uKMO@hAXmpK!(_Pb@ujFYB~m{*&n;wpldL=j8^QY!nwLb(0oVJv|G
zd25%@!YV&zIgnY_b~|BE^iM96rg?N6GSzprV4)PZ2k2r{Sy3_u%SgDWO`K`bpR!t`
zif|zsjQxop<!{VSu)-yP;7$-EWewHko@$>R46<DTSz9b}kzSlTtbH|)X|)Ve@tv%Z
z$tY!!_mF5N9-cxdyw)^ZU6F+k@?!!$E5tL!&`QhZoszXk>COShgEC9v1pK>NvaF|*
zz1*qxBT~ZTK6%)+$=)Q-50_S%tsy<-r?St1g+<@1s+v6y!6+4g&i-eB5b6+7suPqs
zZJC?Lzg*15U8D%3fenanf(WBX*G82-zj<j_!Z<?^f3+`q)T!bEEYZ^)N*FJGaQ9N|
zBiST}>0((VC<^>2dYjGDy4G@Fu|kgYwnhymzBMEn;Rvd0i&IR`7Y5Vm>(tHQ<xTJ_
zBPNbO5w@T{vky=ybU6plg)7|Q8nZ#r?d!(J>(h2!p@Y0q?oVs?*v;Y-)BS}ppm7Da
z-HF|emh6^4N6KNLU}`s?NlyIV;_<_eSS|{zR`gl=HZF_+AS}xI2Z^SRd1+cm=AVgi
zHs_Qjo^!8Q<h_k3(}_(<>N^^7kB`R|!yxbBh&eWrgGhjVGJ=BGME753;{i+<qzzT!
zf~-}%M#|DyM1v`?t~N4dfhA#48s^1~_@3Fw`ufWQk&JAABD<A|!Cr#}fsaQH!yu3A
zSfy^4k+830@03qFf{xWl$o%key+p-Mwxpkeu!2gWjVNXehUv+O4&nJ!oy9#g6O<B!
z7OK#Hw}8es54O_ULSOEaq{PS0Yc=jhN1ovI>xG;Y#$n$lNB0$z)5E`=wCU<|R`~r|
zE>NJ}K7JI7G7TxNfi`%R$fG}WK3fw}$^17n#B0i~>pb~uIy_rW-FQuhH(?lK&~No|
z4b%s8CZ2dWUWZPfY-18U_O7R%B8H9PKeDWeAAtA=WoEQ7hOw;wxOjfATo4xXMsxH%
zmtKRJd%JR2y#EuVCGFBZ-!i{v0AHV-=X7hb1~Ud2uE=I+zu~*~>gJN~88@58j3Q{^
zQ$gn8_gZ&}bSL+1Z6W8JM00ePYxVlD^_Q4Bl69Wby(a?1a+W!*wz@dv(_<2juDuq_
z0T2A1!eggQRsxF2o;nAcOxEw}`11jUbe>IZpLBMf=yU_>sC~s#PF3#cbX>;%&>^M!
zf8I%s`ru!X599l{!u?g{A<l{ZX5B$;xUJWT-Z2yQC+^+90(U0+C>MVN8-qK|gQ2Y2
zH>~TRTPfifhzW0!@awbxMLIJ~8mmC|gZk!fA0GaO#V8YR>p&pSLiKLn=h6D!KdMXS
z?%~)IbMWSYSe^3OTVmDlul^sC#yx}&+d$xZ6D`@lg2MjW`J(<|Z%47u&!4{FWo2>n
z-kTr6_7^GT0bUIrj$lOr<qPruo#y86W%O#(n*HKx>Fd>zwx!YNf%E{XrV>-vh|60L
z8eo#7xVD!s?F@pmthUG9)g--u?F74=w!s5Gmn$Tdb^lXakVDs++$4XvM{&)SNL7R#
zy!NyByUV((c=)5Qqoe4w3`av&@zbM*ze^EvDX!<eunDKjQSb%Q&@m)CXLLm`{u>v*
zSrZ@PDuQRhB;jQ~#d-j9<CJme*t=JWI_lxzJKYzixEkh&aZlr__NbouB3GgwoM+p1
z(VW0DTpCZvfrk;z1YO0XACwB6;${AdQ-7(~fIu~P*eChBGsT#d?Z)4HJdU>a4R8z3
z<Az@<Ef?9go|~MtGQlkfwq+=XM&kC9Ubd4fT>K&$*zIFBu1SCy!FJLmw^#@AfNC#p
zB>(A=Q$$&w?m*Wup7pG*Cb}01V<(keh3PG4B_{dK5fgG_;~|5p+JW>&Y{rW0t1M*|
z%c1e@8JKRiEuRl%uUKHD@nLz9)|b3Fe=uIG5r-ayCx{e$hmw9So+h>j?yvi>KHDS{
zg7VyOFdDz;K3gCN%g@_jYzk?>DCG3t@y9%s)A+tSrh@De-PV-B6_j6i1}(!&ZTy!M
zHhLJjnQMi}SOC&Son@J9k?vtO7v8BhX*%+KgVnW(P=vh&CAb@(qi1oGaFQvvjPc<X
z&fjsn@WYR0Jy`Slyv$A?x4<Mvr--y`5N}!Bk#SOV17@HNVh~aV{Bt(0*<R;`SxKDC
zF6<8Jaa{f^=5l_8zsvl+(fJHv`W{OCJ<^cvI2rkNHsqQ^MFbx<pgUocbLnD;UK(LN
zX$)cLSoFYFa+Xw=7E-iY@G-9|srZVH&<A#Ktig&(pcw*@yi$(n+y+~Gs|jJcF{reb
z?yrVBgEbJoaaobs?!mT`E+Vx5HbGLR3-iYz>-Fzo$1_iJWS7HxmPEtrQQE_dYiG4u
zsX{hMbaZLSNmx8XM_2lr_%NFG^^H*BpNegdWX|iGtgIAe>UH^enb*2Nkepu>hpmFI
zkV@q_H_)@0bL^18r=NfQ8W7Vs(go^fOxh$8Im-Y#FBz6lbqEk`ogL-bED_ruSR4ew
z(AXlgxi%TM8`dzouBBRnY_aYTHQ*i-5Unv|12+r4S9trtlm1YX()1+pTIzGQSmWLI
z#;@+9zDeB5hQR7TNs!u~41CA9JeF*bCJ9f}CXCb}F}v6%HzejUU99-pj~X-O44MA_
zoFd>s_vAsh(LNQ^wEx1k9PK82IZKr{>(e2UMi0lb{LqowwnxvhTpNTa^HM>(YlXNT
zwRmBo-q2~`*nMfOeiwaGf(&D`!V}v6X0?11DK}!05gYoG>OM<m*SHI>)|3f-Tq(tj
z%w5YYj)Ghx>10xkhA+$52(Lx<3_~x=r617KAv=SogKlv~*L!mgIL`xb`@=$!S|}qK
zPS%Ne;2_^x(E#2iL|(HW`=^R-9I2;wDUZ5oC!F@*Ra#-Y_Gfq_Lycr*ly;ozdIxda
zuR-VzZ3c}(<XmFx?O9xi5+wQ^X1Cz53BLU2zgl{8G$Q>0=J_@dIkFeOQBBR4b<csd
z$hDc%Fc@-TygXtnEE}%8YuyT@wGwS_c^3MzS;X<wwl#9>P1Ot<5&|2AAR6Jz!W)J1
zPs|CmxgEvDaJ6oh{dNyP{c2b)dJ0)-c%`2Bh%~*P_|}lVLCta&Aa{Qxr6F%J<DMt)
zA%^&hW95Q3+viEpH&Maq|0yVF{tir;qUpIqB`rYm^bSH=1UE#j!BF5%p+~b%(QIH@
z>gxuM8`C!QxAps_(Hqj_Fl==x9q)Bqs}C9Mw%O>^ml<Co>h-kq7Z*Kt&5DMh<A5rl
zBQIOxBnQiPj-KYq+6Bd<M{t+_?9dusZ|SQcX`~E*Ni^bhcvn@wo8J1#eE@95dW&4a
zw>@VaZkben$4BWLvR}F>EZ*A>Cc|IbGu<@RnjD_vDnCaP`WZQn_rJhDERIl0Qn{PZ
zAh|lfTAvwIH87ohK(n2gmVvM;F$_mf(^6mGW@X*t#!k|V``z9|IaMF?*vm_t-NbQs
zM$qDv4M>0w?2;kFk+{7W6#@tZ_PO4-eDC7J#KOC`l_ig(%Az*W1Z{D={A<LUxtFQc
ziaOb?@#oJmS;d&_UIZkNSgGM$j>z@v^*{MhaO#8b?C=qub`61~K)x%Zj_FbM#xr<7
z3!R>V9<Ir&!v!oVb-!yg8nfx#7&YTclp1ZakH*l;kgrYOtIr3AYv2iP%3Tkm3(?#4
z8#&}r$Vk&^`36qrxp83bavtA!8}{0Z)Wi|#c-Ml{UVJE{TI8K&>*7%qzTpv*Rp;8x
zHLC9;Ah2ydkM-%j=g|+SIX)%c_dcT>)EXBt;$Z0>cvcPFW8Uw$l6Lb^g^+&CLWTMP
z)(X<ICDS@Z?veDW2b_8KOkBI{tE;@X`UX9`j!aySPu1ZMWf^UFCczq#osX~ngH$0*
z{BD?Zd&V2E=_=vj^jlwNYD(saY;T(m4+o>OJ6(l0iAe^AbdS8~&TO4c{vm+T#af-D
ziSl!*z6Z(69WPcoTX`h_AD{2_;Ck35lc#k>h4fE)O=vGBpt$%nKUEzUR%1oGHLToA
z*<^oB|9h;TY|v^~S#72JIT?fAT55+_+99d?z=*}d^lW_03wBr!jM8@)*?Ez4SWCnH
zCYu_cfB9&5=_^~;&jyKAb@ZPj%^R~7KdIx@r=ATF=0IzYQ9GIA?|!ew&#RQ}iTO!@
zw12lUY6Tnv2d>Qt^C@}ED^c98H{9{&_gKr9!cl~Tx4#hPWze`{38;JL49An!`n<5r
zw8zj8Bn&>@9N-!p@cg=o{H*DeB<O9_QVpi^*r24p=ZKaH@jdl2R4pe-r+5=M;VRMh
zf)+}9bJk^aUf@dyiYdi3X?Dt#hP8t*i}BNH;+7MD64LnprB-SDc5cNPH^=sX?ccn%
z;qgIDpueJcmxw!eyh!y(YA6tw^z#r2vvj94U{;@?%zR@GY!2YVOyT<*jk`pB3KE(k
zu3zAj9Sm!%(`$BH{PKHQPwuWymnMG1*$0$F{bzMU7iMPDce;m|yi+hQKjf*6FnqE3
z5f8{a{}BTdnFhihdZ4rI<&VoS+QAiY>t_B3e6Qu}?dr_nJ_x*4f0tR%i2b|7%D8Vr
zK1JcRJMs;55TYF~W_`hUfc!k}YPPJ*%CZ}=yK%L^XJ^(MD7h@Wid`ohZ;<+jop(he
zWS+uW;P_wW%s2HrJ?E&*YtUDeP2bjj0?%vsE3Eo!3;zT>aTSp$Wj+JtX2T2YeTv~d
zmVmbX?re5pmq@V>SAW59ZLjNJzA_LjDJDW%`HDOKp#0b2@~<iKow>;#nC*Z_^p*%0
zvR-tLGj)$Z`fq7$zs%mJX|Sx$MY+|h4Gu<q&LpzYA&XS{(`vfLUrrT2wO!ExVRsMP
z%HB%(aj>A|0x6Is!p%f7%_v^*bor7p1d>ZHLfV?cCHK0T<-9-w#68eMRF0+<P~#Bm
z|9ujR`f5}tg9j7msAR5<Lu<uxte!gOvHS=x1r>JBJ0(PrGqtcH5eek6xC&%)?~si*
ziRE{W-Ro9yJ&A4K!Ag`;3914rjn4d&Xa5UqYkTO%*AINnkr<z}S666m!!1=iZv)Rl
zT&f+GWi?6}Jj07YO7^8Y8+|iH&d>*gv#ftAYcV+PUCpKJkHVJ8SCR3IF(MN*ZiC|T
zG4%noAM&r+6!KHsGV4QXjYRo=@~2MWb8{6#OqNw{(es@0KN+qVZ6yGDFY5;1t;#+J
zXrJwU7xWjn_$vk2MU})A7JapUz=jU_vdueMJ<YG+$Fpt)BaZpB6niQxdW*PvGI2->
z?^+Pbbc45|g$VjE=2PIBSJ;xb^&M_1Ts^t;^pPRRNMu^(B{EPPx8^gL`}T9DDi6qI
zQ)a-L{xd^PuuifGLUsZKZRZDkw;{&zL*BZf(S2!azMK%r#5YF5a6RQVBv(e=_iOv=
zE_ICqd+v+^J-0Oh`Mng@>+l_H?sbiY)v>9*pQ8^?<n!LN{kGkxM(XwwsbqHcV_(05
zRtHU>qK3hEoC!Pw3O@g@k*|P?vitT1Bm_xm6c|c6Ch3yKp^@$eDG4cY=<bJZq`L$p
zBqXGf5=2lM1ZfaN(L4IS-}>&A|GMkWtXX@`K70T6KKq<!_MY>c^$1EI71Z;f*Ng39
zXQS!r3XSg7rt3`dJCs*;ILVonf953arzr{Qv-icqHNSkno!9eYE4}Kl!~M$fewlhK
z+N9^vGPdhRh!qYc`c@FJf%pjGf~v3K;u%gYCaLxo;jdqM3bsQ>@o_ciov?5&Z=!6B
zhNItijsAyd;46A#w!PPJH6yB<{|cf0v($z@nQ)ZoUZ_Ii%cT*2+`w~;8Hl0xCu%sm
zcvqP~*Y-UnmI<}y`-T@8Y9BA{Osu~b=6dqX<*gWOEge<(i9M_(cT>{}oitp3<zv5n
zf-TZ3T3o3unz-^3SrMsTUc69N(|$;#VUN*(s?n*S<VvDRh_2lBWFz*ReA3pt3pc#V
z<{PiqeoLo>%52WF7q8p<B3jKwf-+;RXWN?T?6DOSe3=wb=8Sawuw|*+6|O8d9c%IS
z=#bc42M;NkoJH2<^4{{}cmKE*-;E#SGvrM7j6+;?wP-hW9M*I}RK7gtie(y-Zv)e8
zP>a=XSnI7fBD*94y+(fcuZ-4JW4eWZY7Fp_n36h+)$!WEo{id-*k4*Yu#7&!X`!)4
zW{{*qL>t}WIZxmvqn7QjpW5oaTom@Ac-_%lU$rw^ZK;q|Dwo{FN1Urm)PqY`z&ygZ
zRcX4YTSQgPzr%Qu)NkHUG5DNWf=vG*G3pijgJ->-nwPhvzNO({^Sm^Ffa>}1bTT22
z=DjC>Z59ll+w-;uZBH-cuCIzg&nEJKx!3<eN17v6Q2R`R5@g)BI^7U{NQ2&wwQkFo
zGsB56ap5j(qipi9(0V~dG%1xLT|K><_nJF@2C+BE#jnv!rk=VBs0N&gG((rwWl)v6
zB33i~r??k4PrslKtSClN5`UF-Nhc6vd(K2>kT~tv>3u6Z;Bt~YF=iw?fMS=`um<jc
zQvGpTG&4;(=tR2LRGRKAFVJi^h9D(Df6e4bbl;J@q1LP{#OR#5n3#ez2Bb{+B|j<F
zi!a}HXYesr9xK^d^id?<n{NS$w{TImEL+T?di}W=jmggfUAU{7xcG<RF8HH0he(}N
z{Hfj!;eGaJ>vsqmlYh?ip2e~P(JmaLnm!IL+>S00S1i1M;klUk>^aFBfmR2MZ`@QL
zz~A3|VQl=BHU2ZUO+f8A-~7^JNYP7C;tFZ6$BVHtMCO@u@iyCp@vK%EaVP93V+K6`
zi_hQGcU@y6rLCMNgdQok4%~Gy=Baz^wbFHvo{24*;zE73b>1qau*#jjE`d0Dn0?-V
zFJ^2rZQjx3^27@_(}PKh<<>=^R_T|budXk<#`Zj&3H*p#2#3ya*wRk?297BMo7hmA
zPkN#O$Mg*b!FTcwPXJ~Q77L>c6htLDs}o<VdE8-Ihf%nyB=bOvo;AA*`%W0{9En;?
zDK5*jOxm4Y7qyD_o@1{Dt|G=?YNf`#HS$N?clQe0+}B3EAwr_hFdX2P{IhW{{m<5j
zr|baRvnYw6e8wD(1d}K4#GWXYnYexzbyD4#S-!)txWa^5x%HtHb@ifpxZ!Sl;qk|{
zTS6TpPNd_T&ozrGj7QC;D!h@k^J&j5i|%a4l*O0cnWz0ijwLMM=rLH=w7vPL$|36s
z4KIzb=}LyFv)`tzZSJ>K>n~HRxzVLElNnj>LgmDWtc&Y(9W{_FvN<e>M??8>O}9f>
z?Q@Rx!AGmCX*1j!_feBcp`KLb{i+k-<$f={CmEi6t9}-pd_7Z4wFf<)**i<VklokQ
zvF}J_y&7&C?xPH5EUKDns?xI<(*HEl=RtOg^T|+wg}Y>2jA)Gl>6hH`%sjg10}I<$
znB3XnMX0Hw0lSzWTa@IzM|L+1Hk)_@{RbDuBd?+t3i~=0_V!Ts36zy|KjU-xSkx5e
zo5i+eB%k-$(5DO@af?`lT5_|9H(Je15~kdG9pw}EV*30pcqOav;R`#-P`~B7DwpEv
z?~)v_sOM!feKy!EBuN^F8Ip}{XQ$@Ksa_C$x*5$LzH_Rd{fyD+mi1&(t{&4lUzGKR
zyGY~%O~My9t@pQCQR$U1LI*eKCDzDvP_x|-@`}94YMkmRQ~SKXczYlJV44;71E;1j
z%u~g>;;%Y3vK7gLA1`y0*>j%p?~K0e>o|^2f$`kVx(F>g2z&>O7nL^?KGmJav$r*O
zA^&dXK}I+^Q(#voY^)vRQ>@91ORyOQ-;wv^SEYRLuw?nxJ(SC#Cm?61Uy*F;;YiOZ
z#Cfiol3PA3q0X#t*zLKl<W}^!Ocs1`<LBHPKEfdp*4>0EnFivaOM)SX6;OkptdL?#
zld)`s`bWDf4>0kZ<;=iA>X%NIaYp9{LrSd*+ebyWo#?x|g^6RPw%*M}FBDw1%xMsk
zouo~H1u9Cb{7`hIo{!#FEiQA`9*$0UeJ_7B)9$|qHZUGIGW)S5=irY%)+?madsbi_
zzH3P%9FMA$A78nosflNz4AZ`FoO>fOIzk=C{nh5jr{{2XT6Jd}B>y%TAO1*skdJO|
z-H;;|Gpx;|c;2G5Hf15~`~*I*6k7}S;3shUn6dhUTuY!{zN>MFh40I5e`s+|urRYh
zsW@5n_cC$q*CZPFX*urZeRsM%gKB?Wmi{8CE-kzb7;3ZL01JbGZZC>NS3=Z=!3XCL
zLZtrZx`)<*RAp92%#m0@7_F3wZy(UL?=@O*#|n00H!nVyl6<BVrRf-Xw_(^O%Sj_2
zS0u%IGdp9&l_Q4vh`oEqwt?nuJRU{tT=2@agz59(;FS-+iB?Fs!pU*}<QADoMs4$S
zT6p;O#i><5ucA0R3Y?0<6S71x$*lF8UC^<N_DjaP;2!^qDGjDp;GeuW5Rdkb7+AP$
zeWdcbsyVJr=k_~(`C%Gu8d%6@i4GzB@*5u`?IUr!J1mPy1|FVImPxmS#%K{4uRO}n
zdnGQ7Vk+-hc61~Q<<d~qiT?gn^Eoi<rXTSM<5h-A)JBO^sZU1X$wrz5N-Golf!*zU
z9D@x48<Z>*iL9)BvO{r77u`VWhxW~jz!bSTq@Ch!+NWN%EnMiWHQzmaN4|C&hI>kF
zj9^Oq%;2jCr8S{-wULQqjm=fb<x=LJK@v4huOHYZmD;tC+Sm3p?K(a;$l<%0(+RFS
z3dzAX;fh%buR1mr63y1xQENu;;OTi<Ldx`!n-LUmrWZm9N+)sd_V;b{2=f%kgz(2J
zvxbKh^DR$B4@l-+=9FFf*DobEviZImccH#{CAIw`og#YIBKD?#sG@9oxpygkYCpbK
zYvRlY{kutyX)mI~{Yw#%VwN54yt6h84LnY*PCjj4GW8YdPO2WE&o6fY@YJT=ox+Y8
z)#jc1tk@o8hi&c3_nPwz&OPVuhHEUU-nunlIN$NMywWw(ID%ys9LNVs-)xgA)795m
zX$W{-`9q*QrT>CmdN5@aG&NZL&fbgi{e)aKPt&1zVDIeF>FYWK{<QDjqYL{tBlM4T
zrb~q&Q)%^j&P@XT*tjTZ^Am3VNN$i#3@7ms3s}DH{Sj=MhB5)SP>pS~;x?m^<6PsI
z2ZGbKa--lV24E$`fu-KpA1B2tG3nwHqNcap^itIGiV6EV;4SbT<AG`cTThE>Kuaoa
zl?gx2g!+R)@3Iy%&UhVLwG02I#vK7s<I&XK$#WHb9v*|}nh;cpY}pnno9)>;Uz_|U
zCx>Dm=`w?u6bcVJ^#0A;?XFN#j#T*2v(~7{Bp2;XLBZ`c`BSB|%Gt#-P;rK~YYV7}
z0$Vun=?K#&XAya-d-byyhwpr2m;xUyR_kQAeR2KFBGeb~0{aY$TRqq?AG&4}BJ65<
zUo)T>6E+Tq;pd|QHz{o&`u*h0n<(+oPggK0->ynZj=maLon<F)E)rkCNHDCx&|~hN
zx>564bxTUP+8;NHN0rh)?LfiO;~`RK_wxXf=>bmY@!|}(z{f0ta@{BKvBNL044zLf
z8(^x)ni8yaVv&;}5q5q!h4iDE0z8NX%g?%N^=i2ZiunGhj+{>g@#iNGoyjsGlRd{g
z_3@_hOs(BtZz5Af14c_+@m=W*OPAZsdU4J>1)bIH1fs=5p1kex+O8`R>M{5>WNe--
zU|C;Z2&#Pdtpy(LhMja5+2NbYf{sA0e)rQS(KBSqT^r7cmm!))OV%+G1(macBdUq4
zab`gWF5OG0?(UA2CrTi@=g*t&xZ)wa1u@*OvJ@1kIc`c)H_Q_Ax<n$M+OEd%`XW@*
z{i8*363^mtj2PD`v4}7Ta(6DCeQnZ9-S&PI!;q`7K?JloQn`%h(_AdH6a{R-BSL+7
ziV_|z@70sKi_CU)JMSctd@%mBYtgVk^W=bump9N6l_&gGqAL*NYp(j~T;=)E=YmPn
zG3eab$xnQIay(kKEGGh~8)KP{FGQX(8s}!QZBXFYW54KMevAF(Y$9tvg!xs7t(Z<$
z;}zFk1?_c>;kuk3?g7#QR-IDv0yc~8X;PSTFPSD+!wKv^8nHy-VB**BejTk?D`CQ5
ziT%J&qla4LRP9!{&7*bhn4OsLgHx{JSiil)w0JdL^t1OA1c#+|nKqG~j93frcq?O#
z@_2x=mPV}|Y?3o3SC-a)c`r{dj>Cvy{^i|}A51+pM(-F}vV2p82QNYkYToL*+VYY8
zvSo=L*ciP>8Jp3&@v(L3d)STae(4qrkj6d_0mU5@k($ZbebY#%5yMHQ(R-~Om~g6_
z_bj7t=SKux(R(ikq<4lgJk2C7^aAhZoX5YSCrTDGpqJdR?3kt_IlEAfh<A>%@Xb-%
zSFazm-P~=87$$LGaTfQJ7`d7u#A_3}iY;+d^Y~>#ZAVM?Pzw2>v7L~ZvWy`pC|EwB
zZ}%f1>YQF&a+C}TRgpCblZN>il^@V%*a~6|$oYqIP0rT6a(HkScxiX)?A>bOpQ94p
zR3F#3vsMBtblYG!Kg~a)pWl(PCmCn%9-~LHZkH`~F^m1&H!07T!;r^+41YkoHFxq_
zOnLbj3$e`nwQ5Z7d_Tnxmn;2+S<~4(B8Z?J6}C^iK5L7`*xdilyGXgr3Z@9mGb}M8
zBX?&ZfvP@YwAzO-5w&=qb60zMyd>FYpuj!L;!pcxoW|%_lW@{{CLD230Jn2!1q=De
z7$v7u9>FU8{KXjIExLmeb1@lQ^7tha$E2n`)7u6BB6pC#M0$O~oz;-ZC3}JTgb{nM
z@p!lq+msIra5g6c6wFNlXG;p8*_`7y#R9_sGYe6G-GcoO+r%RK4<)diM^j4R#1hRn
zC&hxmfB<s@;9!N;GA9K}{-vu{Gk?Sftj+#Vgv~#wP#B<YD+-j_{6WQnBK|a~ZB2oF
z^u|K8Ejy5FM+x-WegNX^$$&;X_TLl}4&>Vl0^Igle|qQa*?}4dN`S;65BO<M*4XQy
zh53iU?q~_9I#L2zj_kiFCIlFDF#!mi2mypE0~P`T=(uKJA)vsKE0Pxhf(n2HK$`pt
zS^}m5yno)_5EuvszQzR$0<Lb9E+BO8H3c+`@HMUw2qJWi2}W}v*SIi25aPNYZ~+hu
zD0o7yhXA1k{x%AOgW%U)fx$p<_%&H!5ahalFaf~aokA821)&XHLl*|YuX_&%gJ9Ra
zhYA4&?i4go7zmB^HxNV!koKfNp~DQmt_efiMqF0`gV0!i13^KM>p>6%L9fpg1P+4z
zH6q}nJ1+40F*zL=9g6>;0fHa^G7kz_*nbF<5D0#q3lRW8ug4h*1)(n(lm{j6^+2E<
z1z#U4811VN(BnZN1H0Y{MS#%${v8PPRD%B+9<P8mI%YzEt0x678u4!pw6E8}(Muc-
z0qQ*|c+hL+Zw<6Fi0fg3gCM|>CpQgx@P8|y*FPK#m_4DC{13AX0l}|N9T>fq{<tcE
zei2wZTe(;`5FlW{@Dq9n7y^Mp1YiOX2q(X`y@#VUhm4DptGT5INXEt4*&0oGK}dT`
zYiD<BkgU0fIY<eh_40)NH?{u{2}b<3@*7-Cj9(QUIsty9wX>~<9eO&@KRi8N_fSGG
z1X|wR!_C^<iNHHMM}NfmgFMC3F86)|jzPr9Iw2{x>lbXrsgjzFqG-@9`RC+JzBIQ}
z5K@wzTS?FcrDEb*>cD%f6aHfvtt8)*2#y1lWh9cO^eBsl6^oha3Ao_2YZp!UxyldT
ztrW26F24byF_PDF3X%#^Y3S%NQFKO1(i%KiI4YBJ1Yz0*L^#o=g9LHOSQJSqn-j`E
zd_gxj3y&D6XgQ(<hB6g3R;YhPW+ty~C2XlEksXUkgqb`vC=2OOUlw1-*}|8v7`#wy
z<G=_zYIAkO>Cg_fZLABJs1PV>vXSAnzrjTC>%~ghvZ&JsT{bGVLM;2O3)CIOuXLX{
z6u(BKY9<&tJS_yZT8&V$;*HdTgkOta#NmjRi)FliE%4By$GJ>OzR8W5)(H#m=B?C1
z%H}?-ntH+JW#is`y@^^L+BeEgz0a*ESp9S=nBF&9Io5NMSrs!0cZ*nqgw3c^0@urg
zw-fFPR}3WZ@?g__5&K>wg&U2^w_F)=7!!SH5qPCjH+7$uDzR#|Lm!7~-Y!(7o*1U(
zI_0Yue$^Mm8^Yd<J`^3go_}GfNSvD|<z^L#2ym_Lj=;HveJjT;Kvb?~iNCadSp~Bo
z+nm3yhuGN+v-7?<m08tVgmj)ek~_kc!IxtDv-076CRmM?@XfMYHv{lcA_32HKY#3e
zyKWdxhU;Pw(~tF4+y^3V2$#&cf)}35eyzLk@g1rQswt`c)a%b9f#jD&KU8k4gg-Tp
zxZT(HYOgtWJaftXqnPRJZmAkODYjKc;t{q_{g2D8x&*U|@bo2}tOJ?(^^?8J=1f74
z&Lu~OA3v45c(=}MOsC~$QQD_&C*>an#l2khtoE00vK6Jioc@eCdUNr!p+j+MX2^@R
z7^~P?;_o)C1=Q_3Cz;!(&!c@!Y9-%^8ZmS&H%~UZ0BH;BkOm65gFy-D)7%b`FR9=A
z-9GZPWR(Jq{l2Xk<DGk1zDr)K$!U_V%v#VFM$4z5BQ~2;MbmxhRg~ordCc24`6ox*
z1C6%tv;_rEpOCZ}Ik!}H;;1?Vjty!hiIaXzpe;Eq3}$<^dcSiunU=9CcUVvHp^Y*}
z&*x{l)v3`H<?Lyw(VEW{xh`JO{-5HeAMBZnT6E4?d>5w%2aQE3q{fQRpMy6n1%;Gr
ztG!tt(lGAXhR;&_`n97LbfT};-<$s|-Y?DNDApf^Mel94;N-K;e_NR9zc6D2C&3oo
zfoRQ)Jfn$w)t6-J5_zu*EB8Kq52Tzr9fErdv{ATBsw8VS+<D^BeGr%pS~dEJ%tciT
z5{Zivil-gNhz7@~AhnoF*iydq%|jP%#E!+38fjV7l(WpOde@+qYPr~L)A;e^Bg#wS
zw6!7~l;z<m`j!K^(+rA9T<y$lEFS{wl}BNoR+-AkX-G*ql8!~l(hD?1i+(s`KXUpF
zRd>AYf>e3Bz6f+AIbMfrEOoJky*S82Se>gRX<Qo;6uhYGQ1p;SjZvhEGI{7mu?2Gm
zlC_edS{upg{snapN7yGH{S}C`!U;W#H+YtNsJQo%`%q3MrYMR&VG$-y(nfGQ4tBO*
zk~!yZTIKPqXSyneQbiz%>#LlmcOHG_#303pPruVew>S9K9#~^x`q{DcntM%S5<{Ei
z1S}=BF3)+#_ozM-Rp4vPt9!#s)s{}uZHw4%cnEK42o>Uy)b<qN2Yt2Z)Wt`A=Imzd
zZ!{Z>z28TjFaEVa)f0blNN)o|zcfFjM*>6aHhxDj?DQ^Q2!U@bB?hVvNTtzkv&vL`
zeCVoaF9Kd$q}Le`^0LY<5^)*(iT*p;k91ck@tN%4Eni((+3svv=vm!0Hts6_Wp6U~
zNpZ>V9ZGc+=u4igX|B9H-)W|=ILY$Uq<!49gvePB6ls1cDp|#pQ3x~|3qsTiH(_s7
z3a4RDkteM%)(1DrU=+&G4A=`rt>8uNt!9LvPb=oIxFX+>dut~5pwY~R2zQ!9E8P&z
z{qgt0wwq6Z+Wn_n8(A!jWuv1V6O3)%#ypj3sCI{(my_at?s^BGyihfYj3tu1>Viq7
z&YG&$1jAQMyq>}8J2p`>Dwkzhof<A7a!UyjmyJ})(}Z-R*miF@wRU9f-@cv9pD377
zQ0Lm?eE1=mz)Ts=Sqw?k+>l2<ok}}FU3oM4n7KIQe(<A=scN~;7g`cX;1`ArY4a|D
zHMz6Zzq#k%EC@y*fLs(K3h__YM4G#Mpp(@<4H*|tXAcnMzvs8#9slOH|68(jwzYQm
z;N<@Y3e5j6{y*iOyuI5WYv>jcx-M2Xce6&@`|XiZ00;{q1Uw30!9oZE2>}o+gm7bD
zzzHTgDgW=uxp6Lt1d|vH;e|l8Ap#;W0TBoUI1Lu~n*|Ah{LOL;fw5XxqpJagHJBG>
zVFlrZK`hL9g<$5Eyw+erYlt-zZUwaw1cpPv|2IL#&_^_azYCauL#ATwVQ%%ih5#dk
zf#;zxEc8(4L+P;)aNs;t!9?(P8T7BHlB}T^Q~-fMK+qp36pZ!?B5|E#%&+O<f{xiA
zE1LhW+JFi}__gePt<ii4zml_!%O8W;VM3^OcNGl^yk!9Ui1>bxH=Z=<fj3^HBDUbr
zn16Ow_MJX;0ZRx$Xq={Wp(aO+21kkw2j$NI3WDPM1?pU@qnFthD5$MX^|w9GuM$d0
zk|!rb-xe}ih0k=QS9B8yab?7NwvC?>4~QIMO9mZ1p*Xy28f-y+nO}23))gG-yx5Dn
z^OQsxD^>oGFz=9^gPWh5zbo`O$|{A~WZ6*NDa>m2O+poyeuZa+Czrkm^^5^XU!`Gz
z`UlZHzoVOshtTw$KA4Hj?q~`0WONh?o$%EaIFV4IJ5f91%NS7kfqEYx4>QN4vLMT>
zr+H9EF;aJzyY4oxUg)e|uufIK$cq9L{cb(xoykCz`54~$D5v>2`t3f|FRz_F%t^jl
zFt*h*;<=KF3x)Iw1r-W~tqBF1WcP7q571`!3uh}Z@+~v-6)@g-86$1fLmKv&lI3OC
z?#n<dd2rZc3UJ`<;j;WF3OLe&fOh9)=!f*7_`{si$4LhyYu1PPL?prb)OLtpc>Gs4
ZwpkPEfXIluw;;mks*r$<O-@bzzW_RK_^SW_

delta 28967
zcma&N^K;-$(>=VKjcwbuZQHh;jW+zmwr$(CZDW&cY+K*!e%^oJ{iUnBW@>t>X1b^A
z^qK0DpLOvdahhPvOspI%@p^<nw_Gd>PYiiSt-;<j?IPNn`j2RR+2uT@UrWX%=<ZxF
zzZOd&W?+`=@+@Y0d;5>`QK3t-Yw0XD(mjGy9?1_CDM{lCBqNHZd^g4c25`X#Cj$4-
zRe?*NzU#y5yTtj5|H%)J?evQU5L_tC-Vf&_Pf*|YMS&aZ*YEG=TA=g$vGlt}AgAd$
z_OL(q`_19I{=F1<yWjb`Gx+Yv{CdrG|9-6nwD3P(4Ziq4XHUVtKX<I2YrlIwo?;W#
zKS+1N?yeWsPB~f>O7;HA93NVVSMQ|aQ%w55M718o@_uCJG4-dEnp=f4{CLBA{9$|n
zastz90?q!(vGCoP2;9Ynx=&qywS3&{%te1U3VwUFa@c!#IW)L;c0bNse2w;AeD%1*
zes>F0E<7SC?P>a5=KlKm;cUC>{Eh3@{LhNzk&B?_8;`N7HE?a}R^#+2gtjVfSjW35
z=r<d=?BC67xOXg=rap<_{l8ELpwb|(*>aPCBEJgl5jmlgK!FUf40m;XKGvK10bh%w
zVhDA8I>n?8G=6o?NgWT1;xUFPFA`T2BO?L|M^sK2RO$mLJZwx?yK1I-FqGn0mUorC
z!oHUf49H7u|E>oob3GbHZAR{izFTNw4b2roiKZpT$)PqYkN&h`HNjAD{WE!)X0Vpd
zb{AgfpapBNSfG>C4*DN*{Jt9|06Ieb=fI@bMV!%W`wrn~b#D@lmp)eqUk9r={uZ;p
zGT9t<RA;X+s$j|St`bex<8}J?h5pgZ1ZCh9vNqfuRj12QUL8@i?OrhgiUl*Yl&C)}
z)ahJbnu@}2F#_~4Ndl7a*SS6kf4Ds}TcsUlQpVX=4FL0=K=Qzxnw0Zig@xQU#dkdD
z=Q9{AsB?L_;1G@eiJf@23L_d}Lwpdt+6`n>p#5!oki!%xJPqYZq;R-ahaG4Hh}ptL
zzJDw?lrY}p5a$AeBJ|0BPR*CH!*HAYhE0%Dy@F$L)5p;mocsOQ2qSmGAZf}x?F<Pi
zk@S1)0GgtU!@0hbcofdl25C|ZMn*E^U?D~QUC99ANSFn6+DO$s;V>a{eWJoR#rymL
zn{8;G8k+s~0p@TN#5aB4VPhpr>l~UWk2(;F{`ggO3g1d&Bu2<(s4S^6^$_SSonhnP
zSnXf7dYmwA!ysZa`~U4!7k0>R4oY(>f~LO!7*@uZdD!TaaKm5>`SH{tSYNk_Ca$ND
zVi`;p(5)@;#Oq`ud2lk?SXUXRB&>2lgZs$!hl8UZj2n^)d|*_iZHZl%D!5i`Y7Uwp
zIalnCrPM22c)+u2p|}qJWB$<zJ_i*mzBcHs`@i8e5+zof9p+Wa5!ObqC=-~_4zFYY
z-Ml64<*#nfUXqPzaFNAYuuC@2q@BUY0f>!m0ENFxi0&>t^^1YgQuIY8j9HJK?(Ko{
zx<_njUCj8h7M0?W7j$mm#_=fhEOh>Hx#DuZKg<DWMA7hJdnqE3?k=vaySzpa24%8q
z-GGEY8lU{?PeKvPa+@^}$EM)I6?R=f%Fp&wJXmSfl0o(|o$8aX43#CYa&2s-q}5TY
zIG)anIklmM#=A&$e3^in0MaaLK&Y!Qj^w=$n!x=py3kmraD=`WL*;)*OuSLyeQ-qF
z(w^Q8I;{ReSvT)AYqljHtYYOJ91CJ0FXe9>%zJ(`Km&8p96ZF3M$B2u_+|*$z-bWe
zEXmoPxA}h#Z730X(@pZWHE`509yt`ug{Oli-q;^*(|Du)S;5Zn_Vu7ia=^oWp>!lK
zyo>LYu8Di_366!Hgu!<qjQk6c;AhkcU8pztx$JdiD@3UC#1k`WRKvk|A_y7UXkrEj
z^V5%w0K07$AK9(sPdW{&+Li*K+fM!0V*!ek%TNYv7>)l92hl?i*oDfI+6Gg9k(}~B
z|Dm(1t?!=1EuTEoMYoV%`#a6u+rTL;(j}zb7*3(bk~6Wm=1yIrYiK~sXWRL2pFi$A
zO>QQrw5u$d__l1$i3(n?aJ=g=vj&*_MgT32FHIm#t>bCz3gesl!FxQ=RKhsIsx<Ua
zfi27IE8@EQUx40W721%T>QrEY{u4Bs(^%rijKG#BJgHB&k>4XRqR}blKxHRxUj;dR
zQ^jm^RdqwBOr)M?2qWmz$V+h98la95O-GT5hP$t2K7eL$WjPdPP~4TKL45l!RShh(
zX`m6f+8zExQ^ys?25kZQF#L%Q^J%J@!2h0~_v{W<B-Junazd4AOvN8-u)R92tG~n=
z&0;=9{r?cPHnVGg{<I-H+z37ss&rkcW5Tc_KErQGy&jRq*{4Gjj5D;U2M6`Vn{IQ(
za>3dT-Eja&{$_l_%$!w(N!GR`iHMOXB?(qcPFam;{0&y6UIc4e|FXCbDF*ln<&By-
zt4_GP-0ehxU95G*^lwS(M73Y(FUgUkMjjDqCqX)1T8ESO;TOi_vSZGbeNkNWcq9ui
zcl@UO>u&=?QiBKb-jh(K?S*@pYb>tm0Tv$dAKk!McpCDB(nLi4tj8XZ)v)pXEOi_T
z=PZJ-XYRSC9Hc~&m@ovkI(-?-ND@YJS`<^X2qv+RdgkoevVE!0e6^0hMs=}F#y0-+
zoj|+d@*vlbRx6<LC4aX&{APTUwNVhv3MQ!|5Wz%Q@Trv(&J|Xx>Dw=RcLwtwXVGWL
z`U<=)7%dLn`lJrG+AM7}U8m<^x&~BLFUGBTh%harF;A%aO+U0PrI=eC4kv5CiL2Vm
z__9=U*_SMb9?5aoopDcj(Ea7)5Q6a7-%5+ZPp{&f&O(pkI71ynM}n&)Gi16Y`}K1N
zaTQ9PDQ!)knC@%{qq-rHS6prOZ7T@3*B@}dg^IXMYZgo}`YgjQx6GBBIjPj?ANy-H
zZrIRYuiua{#t44L;(b3Xo*~lwL(iGGA^L11L~p6TfQzSo&=#@mJNWxjC+M&o#;Esg
zY!e~dOl=M=cc7Xxn>>EEsv$qza(5~)EQ%gta$Rjel&UU#t1m^;j7s_^C19lD8w?zF
zO|Bv%y#|n#24z`Vw#=#O6Q^gAUDh>YWg1=*>%f75@_18u$}e&hljI~~#jq-=6Dx6j
zGOr?HAONcTW_;y9jwj?yNPFn+TxNKPN!4a}iL@KCw-Da2f^@ODE9Yv8y}8}YVNOh@
zm3Hd!z{c22Sogq_ur^F%K{zc=6fhoCrJ1cEYohY&O$+JLPTO!Z4VF>ia<D|iST$2>
z59M8>qJZmxEe);4&KWfgx$q%w%xGF$^Mt9EEO*r%(#D21Pih4M!M?+lB|ey6*GLLk
zfkCtDJsjJ7-BefRg{Z37gsQzIX#+&P+}`}|{o-6vjF9NGqa!C3%qDYu8F0vGdM%Su
zOSqvKqV5Yh20^fqiQ&m{!i5o&_0X7b1+mY$UE<m|YUGrhlrG&6ahzi=D_cC|IL}#}
zLsiL+MDygKsYyq(!ytc2)uj-NXlK+;MwwyY?$vU+!&<$VyyUDu${@Sf9txkP4#!Xr
zM;(ynZnP;6GY(-p?-OPj1Gt(KC72gAWSNsmCpSLHz-+(Y8G!f6D}l?e|J8!g#Er*=
zWB-CF8wfXm4pgxg4^Mhcnn7w($k~37e+DBqNN(_MlIWtBFmKpK;C4c{iFrg{oO_OB
zS&<Yn93zQ*`H}6*Lcu}hfxnG+mic`UeK0!~T_;M%wPqcd%{okhMwR-SfLy9|DhA1{
zKlX*1k82}!GnvDc{J0F7$h***I+`fdqY&1OKdXYFA<qP*fqvrL{^e|XhPxk0QFiD=
zdqvHvF}D>h6@<TjsxJ2~CKL<F$%r+}+{(_2uA-|HP7Yfx+7meIrnqXOhP#upK|*to
z_*JkCPp|6f+Wq7LR-sh*dZ#eK?D6*#AiydFmomm!?KGQdnBd}W{eNlHkExbRiXlj^
z_A!!`H#>ylnZYqTWdqihMNsD_$)Z|Xbg=4lsH)v<@o80PI_nZu>D2VQzryW)52_Up
z#MvD;r5Ky^SX$gU(mZ+RX7SZMlhvilrgA=3#_E=*=;VL_e6iu1BczYo#e8G@5o{ZQ
zO9^JS^C?P51&s4rmVpY-(cmw}O9+*pDQOtv%-t0tq&gD!@RT4)T4jYVfoR70O~ul%
zPpA#Y;U$!ZGjE4SGOaAfJ%`o8%`|uHR;Z*gY($E>$+A^MQQ<Zu>WpPwl^aOxqVO>}
zJ}GpW#xA?SfFD?qt<PL=*&z~tS#yvwf3y*}7e#6=l}<~>RZ{9r;~ILT^vKWKV&e33
zYl;ZfXb=k;FY|t~*K`dTYwhYPR)rqT1PnH==9zj^kZ9yLS)91uG)_o@r5knHFm}Pq
zAF*ImmEr~W=mXrv=}D}i+Ih0ff!}M=`4Du56ISMcc;a*`esd{mIOL#=b3T!d7BBee
zGNH6|df9{(72@)j9T8U!Gjgl-JiFa^rMcWsc{{I7WbY)I^0SqZY??C&86}>=T6-B4
z>kPO92CHN~HP^x4^H|E;x*XhSrz`87=`uk}7LC}t#*X3k^zm<DSAnJ&5IYYR)Oo6~
zRO%5xf9k@IgT8|CaRsSZ1j%Yo%^^$lW|jhW1Q-KkB_S(xnO~5_sxpr%<2k}$Y%?9;
z?I0wTecX=;V@k$@!A&w&WY3xb${E9^8rcgQu4NE>mb<sfHFz)?|JwTpEXtXd_GzMu
zaSfafvO;*D5%G)PH<83e@}Rxrmipu!S47@{e%+g5Te6pbs{EHp{e~I!q4~t*REG@%
z2%XdB4QzNgd|yiHbC{^n_GYSpccXxm#P7|qY8{Vb-CM{E@ei|>r4cNg;Lt4EnooLI
zuOp)*Y=X>t1i3{K9k|&{KY2$L`REK|W3rP%Wu^@!A{>{|#b{)>UG;lP4vVvrVRRON
zZF};(UaKZoL&Ub&?#fQ;vexuDf_PP=p&kWJq`)&lG?`n>P}x(-66Sgb!_FzW`oRTZ
zgARYy2r(-eAI&*#09C{EK`uXs=9DFaI;u358Iq`xOMUXe-tZ?cHJkEClV@~T)seN-
zETZLYkrS!o-nY7~SkklpsxvO5Cf_dL?-f(SjwbzpSY$-DCZMx-TW9xfE<2MAF+YJ3
z0592|Q>y02Lm%rbL(Ot0i-_NDp%~zvT=uF6AvaQ6Ks>!Vol$)pvm0*8|0j=L#MpY%
z;R3f~Yr!0@aw`f?`WQdKP`N{Sq*~o-qt9h^M6%KDTq(tu$fPN80e6}W=XC=}CQ+T^
zD2+@Q%945ZaeXV8jh0VMnQ+nCnUi#q$_p+Vo}0$?K*~EVg{sZ@8Lfb--_B5RA{|n=
zG=ar#dOraxA5ly#b9TSV>T!=<%=^J=yGD^~b}H?An4q7n--h_u#FI^xoKcBm^wVBU
za0e^yX>P$UkIbR=!lyhvL;Vc!(tfjZXXbLYv{s{cFDXL1&dHeBum49XxjucME?E5+
zZ1F7AAI_N%a__1yxSWE<(y%}y06!wHJqw1)5kt8aIoaRk{&t#)Y#TiSREXlCfheyi
z!>*C8k`;NG&fY)`Jq&Xzm*jk_BF{zs8nNlgKz1%7J56;K^%1V2#Wf2kEK*p_qvk>!
z+;UcLmz=#?8n4N7CXvn;U6oh7D-Bb2sxH>Qwl=dJ^|)sq_u)C1+kYmg7-iUS4PD|)
zTTV4mA9*6Y3k03<i#wu#&T4nk@>V<TtkW$$BD%UbGcU4y#-WmL?r(1ED5-(XfRjyL
ziR3Z&x^euA=bRiZzr_T2*f&9YEaN5C7<7QDTcj-GH5UJyfRh@&KqMpCncyA9om4CP
zP$esyn~AwXNXmQ2E>Ea_Qq{nCiuU+?Gk4vl&U><l+rM!Th#u^f$MBagzyZIsXoqwO
zX@;d|Y7^y1J&8hprDUS9DQGF(c=T=as9OBZ+4N;YzUq3_pnCztt3;Y$XYCg$B85C&
zEN82eLvEm&gLZ{5Etuw-dfrPjV4`S3eJb358LXMpA({wA?F1R0WI5*MEyTen*9D^9
z=1eE*tDUQ4bu1`lA6FMSY-pYq%$rU;MgL&v&ekzi3D)wVt1!fWQpHrJOD8vOrG#xy
z_rHf86wlsB(^UhEeyGGu`)Tchw>}kLu1>2i(?G-0jC@6EF>yby8lfe%3d~S*x)&Hx
ziXf<j)I=CP9-C+$vxPho01;T}QWPbvY$`L_oL{E|7RC%aZWZB!-kbVUJt^EcwjDuV
z)1TAbJX(7nrs*=z;>0DZgdQ(@%3}^b-u!v&OMcp=KbwIXs4`bsgDe{`sk!4vwgFEi
z5)>%;xBZ~jk98hWhi=h3ET1NK@lWg`x!$7dEXX3se^lXBaB9>JKI+L80l8;w$YXfc
zW0+bX+YP_>vesgjiHV|ym-!$w$Ee%!SUnB)(fHU5Uo}jwiB7S76J*2WwWp>Fgd*Xx
zlGILn_R|4{M)F$a?13CAuALO=EC-&gP1nY);>_p=%=7udYG|FED2(W_%GNMXFyl~F
zI55$&9!KipxncrmK_k^ih(|S8ZqbuQT(9H_%Mg|M02xBrX=Fy#EXuW?QOz-mtvP2y
z(s1z!ggbN{Xih=Vx?tQ#hsx=#K`539Sk|Q(Z!o|<lPtA`cWS6Xm|mM9WKd}pfpW0~
zn!ah+y|g?89p(g)_K&C;k_{p%u6e@J#X|5|scw8VIZ^^>2bl153l0|tj)}^}eYU5d
zK~AbY;&^51>*+69DS^`Bg~V4`D{GmaS?3}I73}#+^Eu=lna}H0s6uHuI<Cc@(&8Oy
zMkm0kCvBBo1^wS<f_hh6^cgx_?R}P*nHyUznueZj;*yG0<pL`Ap>6A4mXk7|n2>cC
zm1LZUkVYMevk#ukzN!en&ex~d<KF**-a>}<QjGfWhwZAAd4JeGdqtb<CxV^KG^q=v
z>+FM+E7WO!E`_C4S6T_o;w4%6!c0O3W(p7lO(C|=F>GaRu$?5V@`EH(J1=CuQ8iJ=
z8oM*G;6Ag!u2)4Gf!kp9Q-Mz~TRV*C%TSu|)U`TP)nxVIq_PS^S}DUbhTLYlCIn5}
z&2-znIql&nsil`gLD^x2H{%XZZdt6xkFd{_--~Zm#Yo@WrWxw~AWk>}ng{n6J|jRK
ztE|V?h&EZMLs12~;~#l?Td<L&It41Ti0Yn}ljqfge^j0{aL==y#B`f)BuMf40!?z*
zh#bF;9+8|dEc@P>VvS8$L2i23!E+rs`#Zj(+0-R;5gDg%?uL8VZo+~_*%3#ghUKFI
zEDY@o4z{H;fEd3)!#1*{cSJ#x!Vf4wwp6;$okoMzGjG%HbnA5LUWv9@R-w1kRa^G(
z$|?Q5&n{A&(II_@IpuBh^w(a)b(UOitJ$Iwt%fg-v(-Xi<gH3+z^rFdJIbl}Q_`ZA
zt)U`j(Qf3lWq-*yZ#>;Vszl3+qCrYi3D&~zt~)kKj#BTRWSo%<S%b8@a5Yf6V(Hqs
zNa-Z5;Ka5(Rw0b8d0a#W9#^{I)BDt$P2WitsXXLjHA1>L;$$F)t|7tqdOX33z_tEW
zHa<|yrjSLuMu^N|zCmJ+4`GRHcW9Sn)<RZ2CL&|4Wn<F{;n*=NI0#iEa7?oLFM}f&
zuJWv|0>1KWR7*{OCiUf*VgZnj_P<JoRisl^rMXdXJ^%T-MAo43c_+E1;^0^EOWVKf
z7n#^L=Bs|BM{EACY0rwQXkU|yjfV%f&K(swT7Gf;;WySAnZ+<L`xQ(jIo>kn3Wt^Q
zzew>KSnYo*{qxJA(7oOGL<EuueP!%*h2I{#_%|DxBE9h1&$fmDMKC~V3Zt_74Ixc@
z&HS#AxoX8rR)+eAO0&jye!*qkQpX81pxpkClufQOe_trR%R0I4?5ohtA*ZkmWE6%>
zld?VOBqD$hMWzPbV98$4XO=@8wqYS+JCNH7HIV07$%?q<82Qk$xK6*5e-CEru)<yK
zB-Qn9-EMlszM@{ty$HZwDBvKp8OIn!C?-LUkcRD{Qk7O}4&~?ZAcK(mG=MB7!g*4F
zGP8yfn@xkxkK^o{Nje&|9-(qkcBl4qIOiH~LYJkl**en*v>2Wc5h@}IkO1RS=~Q8$
z12>Z~xMATQFjc+a2`mbu!gQ>I3j9ojOkTZnuk%Ree6s0pCI_Hb$?$`ZE94pv)mQ?{
z5lVc2Wf%`KKFFgN*2Hw&z`SeydZE;)ZP8PUj%d$_;;q83YmPoL++y42%nqB_pnEUV
zjVdAS;Lkv-sZP})Z>zP0sUIf75`Q1#_&WDxF-*D1H(a^q;PcX)2(53x?`ZJ6=L%ZJ
zduiU_jr^wv*ABSBEMvR*ypL^N)8U?`2)14q9A=$7?a3-Zl2i@fQD0VVCin`=yxqDf
zhQZ9q<Iu~=%|rSs-u06p(=R_E9A<CWC8tHu6<XaCerPR%VaU1v6?0A}b>a?T+N};f
zdOGDgmXJ>7RVO~ZVaO(610}Xh!jYMF2wHw;QXa`#NdXj(pPy?me9Tk->VLGizV$vk
zd`9WlNW;Ig6ijKoj*O{|M?wooL~z7*N-Ka}hqFV`p&8glyUq<O)6-;Z6xf#LQ<>+m
zRQ76FNjhJ@w;Yr{iFI~h*1KQhZn-np33M<$VBDV_8U6VD@#}=aoa<rw4#AP<b$F<#
zoFV_%{SiR_Savy>!K~Z+?VUY&%Wwq5=-mt0i+*fy5PyN3Pm&(?2cFr|z8zgQGC6$I
z2&-_5K-ZIjy{s1{qZ-RVQ$yw(*!8uDKca8)!2PT^kYH1~hN+C}pB;8EctwMK`7>S3
z?p3VR{HON3bWPVqgEn_LPFszEH6>lQOiKB8nLVI=xF)9+K>oyduG*aV2k+2x)4vi4
zZQlDTrYy{Wh~k0pc(fsza~OWyd~4`ah{Nd{ny(#(kA&5X8zbW`a$Mh~JZGHT?ePFR
z*jSDT>g1^)b9N=G5IrM7hK&6>d&8|IB^Sj;KKzN3XM$$-(X=OFs~-#B{>7LU$~otU
zO$M-^lM#Tf%Z8ZLySOq@z>$#Ri1z4B6;ExgM&3SkhN(x(ZJo2UNi+vRj&4%;fSVKP
zSI_R09ba{Ao{`_<ZSz=suU)p+@eQZ<3<yDIBb5lK9ZmUgFe8+k?~p9h4%mcZ72}c=
z$&m^(y;#+kC?&A)e05LMEH363sGA-}VgvBU>bf`hHqET&cg}ovyL+KWlyV0+f)U)v
z+9kro6HL={QcJpZwVOE4Vr+_j81sJ8cZQ#sIz@$2%(SfmO71v^rg;Lb_<A;HRNb=)
zC7O}$YaZR03-Z>v^O#bF_&&H*zg67Y*6nLaurWLxAF{J605+2T$Eh(+ke4(PKftUG
zZ&5(jdit1uz9^-W^Q|1Iy!rTGB}}H&VY*?;EV2Bc-ftO2!>X4uB)Ba3{j##A2%S=~
zh+)N=y_mMFC}oI8tuY<i#gJX@Ly|1~?=DEnQYJSDqAW>K50hH5nQ@W?>OC@K^Pcu$
zgD`WCag{K~Lsz%I>*_|6Pj<rw89)zPeMn(Rr{U3+ei|^DDR6x^qMs(i??4ed>yZ|G
zW~6>67d$dZYs)(&yl;el<?iWqE<b|B&he5M>;um;WG1jyQKJ4jhLxSE3`J`+14)PK
zHctF|^}M=3MNh^0EAKU&I-#~X66Q%<x{qSw-&8YEVZyT>xD56gfk6GBF5qFVys;(p
zhz-LnMbp_>f9ON~ViPYRVI3KWFM*W?LJX7hd&*8K%D1vSNtY+oQ>DA4gS~|cHJY@t
zE6hTCzpP|~tukadp;byM?{!VB@$wzSfo<TVSrjw5-T@bmEyzxVn$4vCYeloz2KVTV
z+iMh?p&k#xV1KyYpw>)E8c?-S{Y3{UW~r8=amArT*O-M<(c6ixcC@0wQG6jUxz!@*
zQKfxg2OZL*x&#+N*Hf{<km8P*^e1EszHAMdBk^~(^&CzZGkhAs@4gG}+xvYzLmr2n
zj=*I)z3f~P%9z9v2cLyCtlU?X*i_rINyxi>tqd9rJ~$pc%L|>&Q$U!2IaK6^1vfzD
zOn8N}$CCfqV-%wuf#+GXrs_z{v#U&FZ7&S*Lv+4Ew@|fZYH97O@@)fkLOp5Kiqt*-
z(hAMT=K2w&(`VhDHIb>!#k!~pgu~K@q==HkL@J%^;M4AG3uSM;>{)2uZ&i8T?-M%L
zy3cUYlT;z{p-4BB7hnr%Rz)5uhMu*@qm8YZjGx+Ac%*i;sENvF^|2`~=Xe|$D~Yin
z$$TreJ?lkge><@c3;6G{DxhWwjOp^J9x&t)GvKyEqz;;02kJiA`qrtlg;H3liBMxI
z_v<MOwdSlFng@yM@@$IiZz4or|HMfk74%&QVGT+{KsM%f05b8QragFhkuw~SGrj{h
zxE=P|LdEDVUZrTQ*T#Bdqq}tY)oyQ&-&9@x>T<)18_XG^a>s|q7$18s=g*!oRCX3!
z`6dde(5h)ow0J1Ntd6y0KmUejx-}UZnn?l|SO#O5Esw-~WEI&TP0qo5nKmTYMG~NB
z0I4frW93Z~2C!0aQKCc&nFx*M!i1)qZn5UNHPl@7@+$0|i6bI<?H@49Rd)N}{l<iP
zqHJJXsVjT%+8i#<*;TIw=3Ez{kt+7j<xqwx3nvD|*(vW>mQT&`|AS7N@GFH4uDU2W
z$XFBiH2(aZf+dT>4uz`sC=5;Ae#Jib>%v^AVeRf<2I_~m;>R4)rUZLiGp3?0GcJgZ
zyoH!XU+{I|&yQPMeCfAJEq)3ZH0hO9(10D)(R-7e3u8n`MD3awgH~S(&(6^ah_^P`
zU!{HRF|K%D-Q$i_T?@_NfqS*uLOF>J#fH7qZ(a(Rwc;S%8jutJWzcy`{IebYhKK`J
zpS2Te4xDC}A)p#mfO}T(_k}^>)*!no5kw>}qldT$<E_mRy6Q*Ax$!GR=RvueT)f$b
zCXtZV$o5%q&t~I_j3otEmUS*&aEIMwxBuu`{F{(paSX|W>Z~&7^KEx*kAHMm?20sd
zhI!6TTw`SyJo@i|$7<V_ny&5Kf-)r3+4bNS8|be!@GXwrUCnjy#HpEk7uYrGgY?BS
zq9=KAU1OHGIiKY_An31+<!fqJeiveQWIm6F`xtEW7ces(uT#aKJk7KEpBO)^!fsZG
z7;%X3OfKx{pb9SW`!uumhry~#SNM>df0dhW*`X@7NgCSw@$JkWEsydoc%&g}ejx%J
zDPHzATj%nm-f-S*DC}JJP0E^I2|m{SgQc0_Q_nio!885uHA!S7$n^M=9!igX8_M;q
zJJb;a)ghsvx777Y6>-*9gaGrDX|Uj4;5#c~^3H^vc`b6Zrj=XYI3mAVU=>(BfTVF8
zFVmm5{7t%~ye+g?vUJlgMxz`NGSv>uN3av+vB9S-Fe>igKum^|AN8O>c&V9x$v;=;
z?_Gq3IERL?JVFMOG<koA)an+?Kgm8R$Ys}$E%3RQ$2xB!Ogv+3wS9S8s^^KVA~6E7
zMuzK@cPg;INE&Lf=E5#;;(aKLv+vZes!1BIfBng3OnSi8=YZ$V41Sk`=av9Wcm8jV
z0e{0R{p6mME}n{7u*Q@cPriNQ)Sa%zd`Ay8IeXaa5bEuqBv(|@GbR;J;;=xt-ZN8S
zuJs{|&ud1g!%^$gv~0Fk$EZA$TZETeM0@O&_?p>$`z%bSF8E*PgBuZd@y45C{8wO2
zk-%6)@5w*j<<p2_Ki{GOxK`ZF#=z%|$@_AYP!t)!MLyDN3FDC+6;KRw@)<d`NH>48
zMcQ{X0|xh`FES5vftRd^DGp*x(2u`Ju+9|Bq3{1l7G`LdPzmVPzKIrQcukB?|4Lf<
z!%oIkGLb|=55N|CNRd)ha6oLc)ngnyEi3x=P}j@e*-2p)EJ_jr$vITeveTX|tT(r8
zOkZ{zOUAEx)uZiZZL4I(uX$x{Mq(R41X?-EoLyS{6Q6m}8po!98kdY!R*3iZV%%0}
zc7F%KPzOfW(-6hyAGVdWoOiTqL|%-`Jt^YPFt<04d3h1zuMOK)4P*R}<k)bS%c&>E
zpphfzTng3_{);WZ<VlN?O~CB=QzT58Zw;3M#Nbx6?~%y)fRz{lu$3>=r!uMPVraYL
zp7tFai*WU<jAwhEenLddob~y)%<i++ey%%rv6u)CuH;#VF^`9@AaE1a|KRZsTYikC
z9D5EsiLE?~k>truLKC{wcpdNQNrD}!b!Re_(1_L3xm5u0FS@T{vdr+#PDfr!#dADO
z*S0y(%Rbc~uOi>0<`xjbUAdz?<E-|rlJVB~3usB{pvHQW?$8j7w}JbLM#k9ehE{)w
zmg27VeG}IAoMZoy#~6EZm0+O-t<g<^Zeg5F->Z?9;S~=Y7a8?uuBG_(fp>27I6wm?
z0b<GTT?`IvuypY>p|?6_9b3{33Pb(wSr%Te?1mj(f#7O^*V=`d1Ti{zT$7c!&UT>I
zNlcGA5TEw5m$YB<+SkvVe@&)tRYrR3wl?hl2`B3(bx7wQsZ{{)kPeF&2#X_*UFDd3
z`SRDifn8<P^67WjB?qXd*VXCA4eky-l)God4_0^pPT(Y_vS(=CWYT9W#YTer)hNj;
zKxqb{<|epZ_~Zb3kn$NU`gb`(`r%wgR3&~YRp>$iop|Ve%}2L*%*FZqjRqNkXI1YR
zv9d2H4JLZ^XQ^fr`g-LrK9X_}#h1baYFd%=4smbJ8E>4?bTOi9p<Bh3kOsHdh8Ek+
z|56Ju)NB!E<CY$luhCk}P^6)=8JNX$am;^Au|9jsR2P9t>YQvP`RK8-Bf`b%$%M0I
zFYOsqJj!KGLY9;nC=+jG*<7<+i~bg#X<pl}y;DCrlDpRo-KFfglk0z=4`MamF%fUJ
zk%Z0E`lrz`bR$9phau!_qTdeDdGUOrKZFXv@7bTY_26KKk6hGf;&lBB#_JvPw`PUG
zgW865X_DVtW!=-r`_%N8$T_z5s-AW#p45-tI?5f7(*;D$o`SxGb1M$-ApQ{v%ExfV
zz-7LmWj_5r-Lc>B3h|5*O>XIaNY#As*;nD|nDZMX+Fq93BIn&o=XmoQ23n}N^BV$y
z<oRXfO3$c$7j4fgmGP&e1TUH}|2ST~3ele!qu#{<ZqiK$y7f1s_D?P^O^2kb*x8hH
zN87KtZ6B?GSE|l;#IOG%A?L=yGx&QC!nK(o3CBFu$ju{Qy_n^3!f}10*NAr2cE+dC
zXY`16Pjq%YO9Jyp`F_7rCIM<c-vue~u27%YCjSBJyE*94d5?7hKDCaY-jwlkJ3*?_
z;R&$TZk4y7DBP$bM_;rH#_EUF10|FdHa#YXQg1zi{bduxY89?UD<b2HGBgdQ;H<aL
zSYWGqnJT?%9e5y`lpX1buAeM+j>=j0%XC_KUg7;7=f|5S2oQw1+)zRfhr<BCuzCMB
zrv9Z;u+6D(!qPm!e*b69uH;d(I_sv(gAPfingD*Az02WUKPvG=63R0ayNO929cG@5
zT*ZT_O3%vEbz6<kN0falcLG$`LruY8>{Ee*A3M{th7nsl%4n#KMt<8pemk7S*fyr`
zfmVX8p>ZZmQ=mSlJ&T*f*j^AAuLSg+#A$^C=?ea$8An^q@a%Asslz`}$%h~0<1Fu5
z$%jY2Ec%}v<FYX5thBY+3Vep$i?clM-oX!M>%67p?6a`6?APP%p!KbJlrW-h=bz|T
zpSX!rL~TFXT-0b>1sLW2;?5=LhN+l<P3p4d_tCQzH=#c+QJkCk2de_W3RVTT1$YV}
z!HDkLQfqGBo>N2|@~wtI8fcQY9{m0@F~v>4wQ6kGz)DF&vY@Amu~I^MK~XjP;HcpI
zWh))h@;k+Pf7LTIrqjFU0ZE(TnBd<qB0~*21NY$W)%uy=g$3h5{taC4H5T+vEA-bN
zc?-QiO&snCiq)lc`Fo7OQ#I~Li1YK~%=UgmaXo{;V7nJ54*x=Xr*liFKKH}I`Df<{
zoZim*h0mFIikBl-1A?#YQ-5)8>~i%~KmrAo28n9R>lOxVGM)uQEL5*Yo0f)KD@FBd
zy^{Bm_&kLRT<IJ0&s-er)iQXJ(v#I0stvn%OwKQM&a37?SgaF(iCM80YVTNrLGHdy
z_<GV>y##{G9rB79?Nut^eb&Ib<Q&oW0x5PO@%`qWlp?$*$$j>;iXqgTLz%xP>+vB#
zS!Zj}JBA-iZI2u%(X41lvb!%puZiD2UR%CLGGC|tb~pWFy__jBe>{GZ-G+}3^M{=m
zotqE+h`$4;#zX;d!egO&x`Axi*Fa-zJp1+HIVC6L_2HJ;?J=m|)AajM3nO#WlC6aA
ziw}K->A&jjVX^pmRjQrdMRpF4J2JCqkK&ZpB=g&C)7!nszR^WLeML{j#woYTC)6c;
zFs6v7qmS&7Z*DpoQHSHi<k4mUZTxv-_>^58Ze$(p>4*cE{Ij@to)pf1zQz~nMsz?y
zw;@ra9jLVJY%wAnz$*Bi4xO(4pshJDvAQ!klCrHmM=2cUT32M0JE<E$^VzLRGEslJ
zPN5IM2mjN78}uS-=H(T=(JKm9fHB>;7R#(n)H_N>6!t$%rDpDRMdRdvzv^3+oVC-a
zS}?RXw0Qt<q1@khX?@+I$hq3UKlo7XF}}d%HqCV6d`lZt+V7lWDL5;sEI4cV{!H!t
zG<(i<13p{7Ulwyy0k`i51>kGb;OpEVmHz8q;QH&{;JbnK<`{T=e-J3e_;?27);`aB
z83gVGdgmlJioq`Bn+Ae=qEccg<+QE$c4})|X#q%sv+-3oKu7#;$M5O?<DdSALVe#d
zboQS6eVC>a98}XDGc<>4xq#3We?}qOG>|&0Z7!bv!+hVQ;X~J1JjCxTPHvki=r^m;
zUr@o9p{nw{Xy^aCGT?gu!tW6TbAY6Aw?=DqoC>#o_U2<V>X7@JC$CM6g?uGrM4<&x
z#G3nVd<VW&&lEb*w6WjscK{tPj?1r4j_mqPfd)K_1gD;CNndxC$ZI%Pt$Qh0%0^8O
zFnve!lxsSjkuLw#Wd|_y)N+tWHD@D;5OpJxERrxe4#*uy<G4s<t<(cUb#&dh)Ix2Y
zgf)L35BQPR8zK?&<|gbz7AaO|-c=w^G@oLCwUM^=7&;S#Vd9b2{Juyrt{-`YNvl)U
z#;CaiDTU1}K3mP2R(BCGfN2bgpBlG*MN`6P&?-$VQUXVcX!!_C-;|3%6N2`0P-pU(
zZxh62jqZ0VSr??mNlG7#Gn{wiTvUgjzl`Xh@xII?P3^*jvKoJ~8P$w3&<_-mxFC{P
z&l#A(V~jzWf;I$nllDT7O8Huurf|ut=fI5AV`;t`q7rdl8U6)xOKfsMR5b+uv|lev
zAe_4^<G=eP6`)<qKCEmMRL8yrdzV?%&v+_86-EBRosPSK!DUK*h{gCH2@6h;WIsyV
z49oXlUKV0!=?gzf<D}viyfQEpl^%~!?MyiU*V1lQrf;sw{fkqk6=Tdv{3o7UozoBb
zbk+1?fbg4^M4da6lSE1p->hL#_k?dkLXZ`P)r25{UI!M!L=Vy4Dna+n?l3dokaV&T
zY(}@cQPzB<jqi=)S7!{I`RnKyi3qvhdRnk;0PGH9ir2~>wzZIyITqk->CWgmV|t%=
ztChlC1E<$hfvIzhP*C7KHk~Hd*Fg+f=;5&lUAspemM2yN|C_K%sZX=@PbA_gcAZJ5
z<|odYAp{vMAK14a6~3;R0zsp<0^9=^I%Z=;D<qa-GGp&;rfhPuNQ7vhBC$6q?ifwL
z?@3B%H6z`-oMXrW!VmyyJwT7agzVsT%Q0xTgt!M1+OQJ&r0;RUz_}bsa)$zzN<wnU
z#7sJu_Z0E8e4a)Tqm69@4di5(;}s8*xq+HoIhw-iU<!1Vg{Vp0ce<F|)9)FfA*-5^
zq#tGhm2O(|ioP+9)s1A`idE7i#YzFH@eOA*!l|1Yc3l!3b`*&An13XbX`IS5lN08y
z^$R{Llzk;u67!%Khuv#`7$~F>1`RS5m^+p_A#kXtKvFh4&7Im5ZjnD?39CSSEr}ZJ
zM8R~8IfUD;d}V*ur}(tq>ww^_;_LaTY2$&V2b0R7s!sXs0NO=F2`gj-2`!?C88Co|
z8j{Bd8m!_h+5`0CI$6gt3J34u#g-;A1_$>gWQD(nda2B38kRWxj73~Z_o{&yZ_!*^
zmW)Wu)3rfXoyC<aK|L)fYL=FEX{5S+02`$**8jxbD{fCP?tUu6g)9TxvZ%J$Y_W4n
zP;}okPg*6@z3h7a-Dd3_RT<(=fMUa;9OC1jWK@rmE&%)$py%UNxf3S(;=-Ah3}y1k
zb-~={j%R^<6E1xvaE)K;n?2qwy(f>65OX&;u8yO}m6%P9DcmlI(Bh&O@WS2ZKcrMp
zh$!U%5GX9h>`oVYL$@D}rd}VejYhBKrvcH6zc`6*UgrVZmnseU&6vQpy#u3Z>3xQc
z4FvGa33Q98NjK#VG${VZV~=5M%H&!k%mQU@TA=bqU5luvRe8xmIUgWmZlr%enCzga
zThmK8`B+()%MyE@e@0#Tn){&bAr30?TA8b$Siv2AIYHrsvh9zG@+<eN3|<bq6q^FI
zfUeufPhX#_;e}F-?lc={xlyHH(2%6iz$A)N0NDEkz;9?*4oNI%7eztVJpO!iInOXL
zzSuFg>5UxyO06GVhYB|gHX@&6@>uKt87?L}YGg!Px_Aj5@~LAUDWq#$Zh`p)yH8^%
z`+W;bi>dt|=Uyu<zg(ps8!CvPm63Yj%|?pZpIn%%2rcB4F>#3y&hG<~D{cO#$yuz0
zA&@WJ^yBw)jI-GboB=xM%xs<MTrP8<@2~)WN@Qr}(k*UyUtT21Ij2J5>meF%+%sNW
zt6tX=$+O{*x}v2*NQ&p4cM!#Ig(aeoOiG}q3+Yf*affh9yGrFRBy;o|_>h55Afrva
zyvJba0!p#;{~0kow=?LECg5#kAkV<Os9&_`F=XA0lCkEGbHo*{1rA1rH*lks|3Cxq
zky-~s{Rg-Kwg<xhw2wFNBeDNmywKqz0Md8pN2}<rKpdnYQQ&dkIs8#ErxS&xQC94<
z@OZq1o*%P9H#}MnXa<^cspsC;i}<dTX}d3&GpGPsHba)hBE|t;lJ7EbWsii)k0=DI
zx*KM4zsy<N9j-ruR9DQLAr$MQhqa7@8JguUQOQX+>g1GlQlM<~=XfamFA+-qpcmv@
z#r8HarSAcBf<Iv|-yiU;B3O@*f#bZuDd7#Gv43lQ$Ap?0S+Yc3xYXY8+!rffxHvDk
z5A?*n?{zJZJE9;L+1VFBt>RY?6-_RO*}8Xsl3CRs9$jWLyBzLGi`vLI+P9sepB&-`
zasi%*{Q<SFhK^T32NK>aWq+b~mj4#gb6Jc3cEm0c3v)<$8e%@ExRpHH%PrR>_O(wi
z8r@t2M|!%89&whLn>PEGHj5IPNslCv_P5^IKIbloQrps=w$F(UfUzi+V;I{rV!9S;
zq+}OZT55IW2eC1foAAO9L24o=?Dg}UPF=3Uk_(&EW`<$e!Xdy8yzwFtgfO|}gC1>h
z#OH0o<7^4O-!;-Wr>^@XnSI=Zw*B5>8!6c_%W~u<O^I@(Hik0nM~2pJd@}wg@=@59
z4IMJ!Z{*{%`OGB`$kYb18RZ)=2^%awYq48o&2}x+vb_Gw!?i5puE1FhT8}J<;OR&a
z`qAib?~h5iJ)U<&c`=0582qRQdQOE4DsofLt!xllcobjGj0SJa1JeTupR(jr^wY6K
zFrF#p6|O7B3C3Uz9;pAj?PAoO>CPT_va<=xuCU|fI}Ftgv=M1L{qr7J=8@tOaBvvn
zTJY7*uD~qOk<RE8YG>sO!2Ygmr_*;nuzi`%WMRR62%s@Eb+CgW@j7RdIQ4OPE)w0s
zv@@^(3}?dQWM^HXg5-C&^Ht6U-`1!`<edz1uK%lZ*V8g)eU9i##$6bL_ZWNLq2c#6
zIv5!4Qv=cf5`wE9-2p}B<IyteAVJteA;BK>sFJH?Vm?||5tn2|7YEaR=is3N&-QXK
z7jv0%YW25<`Up;*YO%y|&?q}-vQk%dc~N(3dW)_q)+$)NOoc7Sjaa?X<yU?QwFU<q
zRpVtW@p)^A(mM30J9#=`!{!psvKlQA1XCL8oitY9xA;Ae6;6aUYprdJm-{9~71pPJ
zRUvgBAxPI~)$W9<3_>&Hdeuet3dg0*ZsG`Do+x?0JL<}j=0NB}@EmJ#<vX;{##6o&
z*;G|}gR703O#^)-pO%R~^SB-vo_PZMy>v1z?X^l=x^W-U*H5n1rB#LrE!HELYvmZj
zG(SHeV<`Ty(3)|}XYN4ud>C3BO;w9Hu_O!HOc3jjIxF(}pU`Xr=(Wt{<sMQ9j*9~L
zl!Ut>c#ecO*WV5oBFJJtb+Rhdm?=}~)(fhpYQU_)k{_2%b9c~L&kxDxYGL1t%G6}$
zTlC6?D@p6=*<NCzB?2yU8*eq2B~ie}kk?Ltv45%?ZZufRzQ}U<8#g7$SZb<?;UE7I
z3`<aDN9j$Yj0t4r9);*bTb@JBJC$RMG95=Ncv%1Qb5WrY*Su6!A3f&Upcm}s_jKm+
z+HI6867hkod=Oq=g^*6Nc+0|!_dF676IL=R%6f=2=p}@H8o7tZe&S#k$PTl5q6r6(
z@QFHjhE?i%WOX_=IWUCKO3NF_&aTG|A5o=vC`#aOytW@{rtJxpHqd~So_wf!Yy1rN
zFX+>jGZ1^o4J-xC5(>!0cr-RrHh*0u^P0yxup>Z%zN0P=qBVkkaXDZFztTF(4+OP-
zm`4GUC~Y~az&ziGaMCOT<%IZ}^=<(pkR3{TeP-Hd+pN7q6b;9K!Q8g&IwyZjbg~+v
zwr*TsBcZoU(vAT~#Pd0L_u06&i9B#_it_5FOf%~;eI|C;5VuMCAIiKS;%uFjwGC{O
z`%?`Zb(36X41c3;Zo;1$LT5MWJ0XvYXqD(<IQ<r*l{l!ywuO*bZ`m6nI?8}G=A7_2
zaxj<{#WG6j-63!5q4*{Wk|B!fHuFLPo9ip=qEt-IX#=nwli9WmG=2y?$kFtk@&6Q|
zS*PNw|33dT)jSym&kA95|K1^}6NwWt*YuyFF+5n9_$L5ondA3k0DA*9ztbPOApoL=
z9G#Z=kSGZmG4n@Mh!PrsPA4$O1wJH!MQRBgo}$9soGpNcjq0hK7tNjax)Me9IH#s{
zC1<&s14MFfr;E=y21ZocX~K{RTD1IIKxAl<_%?4DXtyH@!zgkajyeqWW!=!d9h>46
zj=-k-C4VA!*j$?29y2>wVM>hh(xfVmn%Uy%h#=^zXp1&o3p)KOI?ynYYaLW<YPyu<
zd&^70VP4~zrO$7l=$m<lTr}L3GeMoDS~X9>i@90|ItISc_V%+bY2$jM5`lv!R%wJU
z#tfv!8SFgs@VG4iY_T-%+sVEm#(5QX+ez9FbZXY{(<FbVY0hg=CmPj!hay<ZBBF}o
z_0jDwA#c?V!o=}%IFP&dTUsM?@At;>?+l)62ZB(Toi|4#X=jK=tWcO-uQo)6wd{{!
zPNVj=n}ltv`-jXCC=QaBdZz)0x`*h0L76?VoO`G0JomvLrS!T{C^<XzEWI9YfA1^z
zgR%*n21HN^3SN#Q|B=YQXz=0xXGd=UL~PbWP_fy@Ls0J^KosYmu`ZU=z<URacOzsh
z4T3QSKa%6@!Tw-#RD)bd>{@^xIJ9*h4p|s^-@RfR+92P$sQoVTRXFm6X*z7Qrrw@N
zz94vk@+Qc%Rhb!7**_+|CAflaz=56^taD7=W~+*<aTGpfvnM%^KduIR-niG~V|@Vm
zVUijt;QnS5zyNPpzl^`77_o_NQ;RD^=jXCtettFLU7d=1`=@uctJQG7etc7fWZd!Y
zMpUw21_1gH-S=g^EY?f%tg@)Bgl}z55yVj3vu|FMN#6wpDHHRV$k~y$s%JZY-pZo$
z&`%XBT^~obs4GY18dvN17t!X~X9(PLJ-<#E4(XzS<5`m5#&x2cxor;zOe%f5E%zEi
z(n-7V>98|51@Dv;tc_bn2uCawqUfL>6YrM7-6CXbzgw4}iFBmq3@HB2GsBo-)&9tb
z*pcf3@jcb~XLi9k-QQZJS!w)=PG5FBd=X~bUrncf?L9!HDh?ZvP8u{o21+ny6fc8~
zg#w8WAYz+&gmQ}UrXryQu~b&66=}c_M^E77q>jLZ;mjZFu|zYfK*sONziLDi8B2x_
zXM-2`qa@hOyy8L#de1J{tth~@g%_k-oxsuO)^!mO{cE7rw+#$B^DB%(b|4$Ch;4!Q
z^y%&g{bx;gi9kQ@*aS%n<4j-In6+H~k@JTL@QVAB2RF6!-GwS*q+%FFNT#1raPJ?D
z%@K2(kWJe9ZR#tvQbePN!q;Nn_#HjT;wT;st5EBZTDik_=J!sap5v$&YjS})GA2kq
z6=;&_Y}|)(wYxFSYZmgV1)DZ+r5=~F^cT!C^DzPQL?n+Esy%N0E)LlMatdH@CsWb@
zzU6+vgrj3D!n_^~#gUHw0;aq~$@qGb5Ex8nB9%x%<!jX<7N`dARdJ8cz%ZC6+F>{M
zepA$#N#zb-RepLO9f}1Qk1qZPf-y}l5kE++V5erz^PO|N+9s{TM!hj1TT}jm40k6l
zKfa+IZAN?`$A6>-i67g(XQt7LYD}X5stSDm8pU!M+j-KH!i7iOo1#0Vg+AFcJ7+fg
z*46g+fWKp3oKH5?R*$937+8v&USwC=$_KTqr?9<t{K_&tN(j3ASJI0(kqtnkFG*su
zhGi6qi`Rp=Y4YaO@Wx!@Fmp6PV;TrgKfYUBVK}{Bd=eXU&fdd?aS6c{_&25lHM0)_
z;ZCD36l9HAZ5{O5x&>Z3$eCN2FT(}C_R=A^X~ogW$M^r7eJkDrF7H7I!mD!P$0`<m
zS>Z8zM}F>0Z7EPN%k7&Ih5Btcy@?tQg*!@li>b2q2*&?47$zH}CU26IR>W2hJPlFQ
zbM~Df8_0b3M7G;=sUqC~u~9Sy5<p#(^VM%jLB2Mn+UPfm|ARgE>Q`_6oMG>I{*wnk
zehbK&T*KGRG37drs6VOahGj$vUf##k$$~10=q2uCg2tse$hhxb+`{2D#Fs-UwhulJ
zrQq8pQYw=W+c4m4Tx8hE@G-G!qgda(A;I+xdVWEo|8+vxxhKBneTA|OKrZe=z4xQ=
z=ThjN@&z&chBTN<F`e|G+BEJ)5d0)=51L%rPLa)Fhw6m3Uu-WZj;}zK>pXXmvGTN;
zX<+Z7E9aV2?>;4WRzD`AR9Pw4<CA`(8{A@Cltq_fQPHzIBTQh&y~m~zKMp1o!FUPi
z5WEmQsxx-cVtO<88nZ(H;x~`}Ys1yEBy#bZ*x*A6xswo`gb<78^!<n0rX#vw7P;r1
zLwONR_vWfAtOc*A1iAbFIqkY?kZN`j9k(nG26{X6g$t0YTfHx<XZ!BbzHPR^?|A#E
zB;J#TG-%5M6H>YgpJUs)lF_lB!#B0tYBcV|%j`<xGSr(;)s5}}-CBE_y$=0u1rUq`
zKQCu0s5Yri%sUT*lh*%L$gaqaJOcb&la7~|HF%wS8}&FfcxjhLs8}_41_PALx;!B^
zqr18aE|+bC0c`s@brw*KgLsFk<`)OW`xhQrd^^cM>tnA*`o;fi#`3H|2GYRR+$8fV
z7l0ao-3Pg_XG8%<&7@n>MKI9Q+K!K``5)Qr<H0T!El@#W-311p>ZlPOE5n7MvL7I^
zE2>)g?%+6bJv}aKthebD0u%+Rx1;|53YP+c)n>p@padhGoqIsw6xC?Y2xwon;#VxD
zSN1o!OzX3Xur^WuUt?b#6~_|vO9*ZW4#5_J23vL)w*bN2-Q8USEbhLz6D(+OcL;8Q
z;O-ts2*H!Lx%a;FzL)&*-tIY5+rRFruBz^ysoCl7X)x6>tELHK?e^@@l!8yyarXzd
zIyU7%Rq|J)d>m{&<sD_!>E+D7jk>Kn>$y-Twl<$RkATK%buK0d_I=Q12wq%V+cL`^
z?VBbQv-_eej})7>yhsl%@+2zM(Q!q}=FL2`ulTOUGryNRDW%)3utIRsii+9I!_&I=
z7|+8sLM+v5FV%b7V#g?=Y38BR@+5GQp(BI`dObs4X~1%$BGu@G8<=CSAKnv+;=-@d
zPCzg5rM~Cpdvs3w&#U;?8@^Bc{G)}^h>WGBW!ifCSPy53YAojaY6;vX8bZeoPi#+Y
zzS|GJA`U(ICSvRly<NMwL(ON`8{XXQNAdeK5$y#^EE28L(YhnpE<z4kob$J&E|QXn
zfg*;P1x;c6WXr|-=^@JKhYtCb(x;4R?62FxvjA5|8ZFwR&18n5*#s}t5V!B@0~Com
z9W&(l2A-(QscL!^5z>(N3}UYU{*a2)vL?ZBCQ&A%o(vlG-3qDCk!<y_SivT<by!@}
zg%I`X`uto7u!=mxR6TCIkDcW1w=gL6B4$VeTMNhgkhe!k8E2;WQQ!dbFT)g40;3`r
z_(9?y#YGgTUmLJcQ($cn)Q3;M@JFrmP$P=7OA7sFVXgR~2rr2x&!YvS%!i;$x_@h`
z6z5i9r!|y^4K_q4S$d1;?d6ORMXhw?Pc{T!`=Dz5(g#{OeY6oQ`f%OCq<;s!R@xBG
zwRW!R*Vg+r%U@jycE~8VOM|+~A{sVNks*baO}sQ^#zw%r`{g<FkPUb>mSeB%SFvgJ
zaX^wxD=C(mln|s|JRYLxP-^Y0*|K^|XP~_##p!JuNFFPN8cN}MX|^vDm85~Xy#!x*
zKW-T62OcJ_BY7g4e2{TFmp}+*NK-SCHrlNgZL8F#_V<MU(UZOeb^_ZypLFrMvLkXY
zh_IAq`gs0g)tz|YmL2?w0K`u>@s%EZES;a_+dg>e8qc-k_Ktj{D&cfY`c?UE!t%KE
zJN6<RF-MpjpuhsFMc{1sL0kF7^-NYo#Y7R>A>i@boh^MBtGti0YGE%lW}g=&V~z1J
zfL}jZP0B91b<b&v%;?AKA1to}k481L4v4&yfXyOFM#c`o{p2kJ(zvKv-fZag3B_zR
zhELr6TA$+7n9}eS&G!2qCGzZ#9n7%jjgEV>G4x0&m0s=@Baagc#~od!zug`DF>Zx&
zE$axJsuUx+L`Y|qG!QO@4is+Gi)y~N_Ur97mw8W!Vz1j*W3EG6o|%3%=_GI7CuNjM
zo3T7DTVd>HqT3+mO^x28VX-iJ`gF$s$qzFj1}CF7j*3WBZ0<~>d40?aWm~j&7euMK
z>UwwIVtGv0a(kr0xoeS?_?G1hroa2_@z_L^_ckYVDlU&+5e$xXLWK)_caY);We78G
z4J76*8B~#9s%Wz!JsU?KMoglu<4WI|iICgIpkmH`MZml(t8dQbXoQ7{fsh?hA9}#f
z*VZRlRlq7~i~`;m8i?AXtRzsqC<j_#b2}=OR2m1hMQA%^8iQW#&Z}oX1%F3g_kCYs
zUQO;qj~X*<Y<Wy#0j-lBx_*}CARYqyy67|*2Ik7H-HO4swBw;_+p=q<y-d_el9lUz
z6)BEx3cMgpJnKOQp~$mje%H)Uo<}N@L#zSha`rl02-Sn@)y+lg=PNg$o{o<;YpW&$
z{yY-jiKP273w=x|job(ma8kO129@y>>fDF0nd|B6Bz7L9;OoylxwkZL!#Pi`p|OeV
zpC?!)R>Mur=Ep|^1o?p+y1Z=|QsJY96t3x(p=v<q@#xdW5~cy&r0aL;51Hwn3+MCa
zzh1mFe4nKoa}z%xmF(Ng+eg&ZCmCfP5Ny^t`AwzA{4(*KbZ9)mex1`cAj^DE{Cle%
z9;%F|PeRPb6tp+81~*j*EGS5=IzZ5~cl)My8ZE?;R^~MgQFhNUKNi%UUlmb41jmKg
zkJfj!ucW8`bW+MgVO6PvsisP)Y-9p${oqv__0cb09%8RltUUuIQN|!YA|C09jEqZ5
zvpU5?eh1qrT$4?7yT~ja<(v_02i#elTCwNRyKK1^U!erK=nP^aa@G4wFEcuP;kzj$
z7YD#XzR%AHK*2XAZsM)HD&)$g_<9mfI6sgl<3t-&BgiBJt3(55Fq_iHmzoJ6@idtO
zh~4%3L!u;@Tk(z0o7!bsyft~3G_iuZElKZFL`KJW&W44dlS3{@OpYa{NKEm7J=|mN
zpk&E}Z_uSBN|Di*Qr=G0@n|Y+BO@fH>br%aP@M+zdLnLesC)P-D(wK3F<4W<LrRcY
zJ40bNf4H$Fe^~4N$ki$J;+IiM8v7K%H{rGmI?|>sy&0HfY8Is*->{m^Zk+5FGZ)`0
z&M~KY%LzUR*=kbd5iN}u6b=a!LZe?l=eIOHD}%mS3ag-h_xbdsg2Q;2NLZ{%>wOn$
zTBeiH{P2s>B{>DmrG?jBAE!nt@rPfa(H{(5<BLC+PbhDvNyk;Eejv~6%u8w`f_(5B
z(J0TB#zsi@3)?tnFkl?31|Hdo=jUnY*_@PTNK?d?4pkSc@tv4uaUHJBo!RNAw^!z<
z`>{c}r}77_M&~$<ZB+*d8_0`GPSjhAN4~#!z?jO)C=f0CV8w;d-N#AIDr0FUWhZAZ
z_02@9edhb|EB%46UiL2b?iP@E;4o~9x2!cIFXUbG@cFAcX2%-3hqoTAO3dR9e)lb7
zj+i!@W(DhQ##4kRbmUF;7PGy!jsr{A;{#IA*FlyqpGaHk&@4!Mo+;euv=-LcY^&DK
zI%)xA<2>3&#XpfqhI(@F0?g9|P5lmf<k77dZSOHCdLZx4qd$2W3EBlD=L_a8tT&u$
zfxj}>f3=m)V7fNzQ_od;QAA$PaaH0jPtHh{LijG|j?XHEzt1M{^P3BKS&u8fJLGCH
zC{=Y{q02x*JDTh8b3=)+8}|?k0jdI0uEbTBC-GjiBsaVv00Tr8eX2kTRzK2#>kD^H
zod)=7yp`~U(0Q{XmHbP=GkxMn3V|TOOyzs=+L==e7VUkOmd`^gIyVtsr<i3feW6}<
z3i2_;+qH_6viU!QZWkz4Nmv)Gm3Gb&p+Vt72r)((FX4}N{c4`D+g8qtL}Td2^I0X&
zJ3kg{R3KOgEH0h@@J~$fxHngnX1@AmLUOpsEDRaybDmH9Z2Xx+Z8P^7X1S#V9jD<m
z2aRaJ7I))1O2@$%GICId6mh<^u4maPF(HTT8EXvXE^wmV56k~{VYGYU%1FFv655`N
zsb)rukv^p?5q<TR555fmF&-BK?P}k(TVI*5W=`mU<C7m)&qXOFvRdXh`mU#gYTXv%
zk{LczJV>>e!Rp+!FOel4S$)rCoW|cT;fY0`h$dLbmSRWXw4Bn-_~(w#Jb`UvQw%$t
z1>p75HM!SWxWHn}Ct*mpZ=2l!15jUk)QjTujpC5j7iR=<6G;)8tdZBA(U?mOqC(xe
zH`1aLY!>G{-lz0maXyNq6B;xd&5y7TbBRo+<UhShv}wX*rM5)gFr&n5x(+y{Fc!+{
z+~JQsFs<{{8=faD#oRTf^Ij4+-rnU%>9E3;8t6ME^)OGN3RlwxE6COpH9$+cs=#<!
zVj4K>m)|K<=aF`al|J0om7GLaBzj&ue7Yy1r$KjPtK5Q7%eghNtx0Yz5={n&H=+LX
z*ZZlBK5`Rux7A-a@GS2hWy!4r3({{+;RSM1R^+Rw-bP2R(r)MYO8ry$Q~_C1{N%$2
zM}Fb4^}16odKL&v`-FQAG*3Kt7&0-jZJfin1<cnKbj9Tx6U25N#!P%|pHAWt1+a<%
zrXZ}B^+fdB8~YKHz90-k?J`}avn3r5-qc6>vgn6BiA{h68%UfwwZs#?TuQx>3t`Xg
zJ0WSl2-ONTWV!RA9@6b_;z+TSD{F0G=<t4U2(_)dRdnG_$-3!-I^7%a^R0G;uUtFb
zQw|Q6^7CLdpRd7xJ8T5I`teU*U9^|UO(O|UC0Y#asX0EBgb@#4AbNKY54U6=%UkOy
zG*anp#ZM5bP_3;|$1h6bQwteT7Vs~XZt%Lj>hN3|4=ZmwS60_Qu#2A#$GvlMKNLHp
ztt&`?ii8Td)3`!OnuP{iQtsKFllw?tw#I*!t^T$eL0r8T`J=Cs*~NQPZd=gxY&5I%
zT(DboP|xdr2A_Bk{R>a8AC&JON@23V)BCt(^A!$NC-5sc!B=$nJfK(4C7<pfd1h}a
z>{MFZ1?SGi;IDo#XCh^231&Xcn<S)!1~G4+yY519E%wYtV-_gnC8O?Jqw+cL%U&rN
zskP42zDHGibt93KI{(Upx1K4n3Aps%Q&yUR&y;0ewk_q0>7Q5VU%c{3u~@T`xGh5*
zkq$~L8pBtsxU;arU_du`J)KT;h*64e;3OdPbge65pRQMS^+WT*EsDnDe&t}L438`w
zv=-A%w>xgz6u&*evB@%LO7?W7^;VdnR@SLC8lZTkPk1LLn@~nA^^sWJSY3PUm;o#v
zYC~K+C|!7*ap^1<;Fxl%DzBF2TtHv7tORS7lNVrdoUGi_>9wd})v<pYki*;|*po`H
zooBJzsJn1RnsY;1H=3aSB~cwd188go>L+t1aa<z0taJ{up!gufNhj?SwPNyhf4h46
zMWA<PUAfFhD#?{%bT2`UL=%H%VNLNw?o){}>2{_(XKxBQp`{KT)U<^<DucaEM244!
zWi|$^&~Ou>VhW`-hfEQhFIUGNPj!^|foNVQ9<H&yc3Y;;2$l8_#)OBAxb(1~&<Aaq
z(&#N<KP2y7031Wr<t=>hp6&;Ti;f*<8`S`oC|AlHGU`+Gt!N$tZNx`woB2wE!9ZPg
zH0Qav?UoFixPHgoaY^#p2r^p}@~CNJ;Ob!6_u{^0#zm({CxIR}QV(at`FB2a_Vjz@
zOH(=Z!k<eEgw_g$Sd*8XzX@c|L36h%Eye`|gfzbUfjM^h7_6YZ=*xr*Ry&sMt`-ss
zN;|5b;Wv4pBqwW5B7b}nj}u*In{^YB4U@(P2fUr3ADe9rLzwCe9jR8k`pY$$sR`KC
zWM7XGQZ)}|HQkTCsfXLykOUg$YSX7gvmNV7`kAC7Ty8h`^?6ojljj9ZLc;+pnT;X>
z-i|H-$`zIULuG!PO*ub4RTb`_X3$sr@2rj7hMenh^Ex6veccpY;&m3ges694i<H=B
zB~oV4HZqc#81=4Xb5uK;30gYATQEv+QoB`oC38|FHTq)p%NUpaEwTZ2DP?xYZEP&P
zp&_4LX3H0Z8P6l@tL%%Eb!hesw>w6^KC?$*cu4H-2fBq+72TfQ0r%M~O;;<z=ZuZK
zYp*hS1~>zpFO@SBBBKa>Y{59TvI^W3DJ+aHhTB!D@txLijW$@G^{ZaCDt`ZU)IT{$
zbEm`lj`^!WU4+Knvx<FP1t<8N_eGI-e!^|QlD*<2x5u;%R!Nda8V58T`!Z&W!t{dE
zB7U8hQsqiBp<EH?DSslb0;`V#>v-K%e5dIz&g(dHk*ne4WGjC?r4r}<aZW#CaN0S@
z6<hYECS=1LJzmg^+oOKy)S?WPSJ;DltgQdux}`65hM~Q0xeQZK482tWz4Z%Vua6?}
zQ(ACxwo|-Tx^s@YffqD!E=f;4=q*m#ErhWZ*-_e(+tgDbksE9gPo_ij;pN!koyzVf
zF%K6G?I?(}Wq5n5lPjj|*fq@uwlM{V1Zhmlq}0@0x;n#DBDFmoXQuJS*wEt4<p&k5
z?hXRqv(G9Kjoq@;a|I;S3!u^B8im)awEn2gmGaa%J>E92tf`?5$Qg0VsWIgQtK$wX
zRvCFQd<ZW?^Tog?(}=n|`GREW4byVT3%uVObH^Ru%MY&(E&D`uKw_zgvNM($dL1g)
z2*>aF@Cq<AQJKEupWGCi9e)PCw_#FmV;*$pebjz09Lz*kh)f<cAzMI>Cy$QY%`9o*
zbFiV3(C%YWMqdS`6O_w3RT&nbii8C+XLW(MUSxF;K~SG#7Wi7e0=HSAxtC+wp&bNe
zBP$@=Vv=L>5ib%8usaopA#*WjABci5_0Vl`_jb_rj!R*lQw_W;`|T+g#5@qcX!Ek<
zpY0ZU6C^twaeg`Y87$32UMj`N^^;{;mVyIWSP7sik|=0#CaMOZ=aZWz=5Nel76gk3
zXkpweub4O&SaW%8$b20yI(x5CHtt7!&)W)rWn(m=Y=tm2H|WY<hIus8%`_&M7N3Ci
zt`T2$eQGt=_=O$UC|5|}(sigSQVN^ZG`+XckEJ{rQZI$I@=dcSg3jmsHd^;gyJwHO
zMb<kKPKlwO8zjzx!pgi9W&M)J7lZXyML1NHSnaw3BofCLYf=<Kae-{N*WZmxy+XbX
z)JvQ&OIz3O-z1WaJT?jj1<lv$F*S7@E5x0jlSxn6?+RU!C=IDq2jZu#agJ?qR#VrX
z9A5GmQK6oCQq<g2*1c6|DiC+5$?<!PJec4}U$KOm7HQqCGikUyn;Bx`@Q7^pK<B?o
zSWD>sJ*)Y_UjCVj|8bL5)k)%GIN5ygYK<?kPgwEW;~KY>MetJEYJ2qv$?5LJ1t}``
z%N==e{?8chP6p+EyGP`S`A$^*rx}LNGjdR6#5R7--}#@9%t{YlFODZy>tJK>XMN4F
zR3wBFmXdB1q#z1E4>W;C*O7%!IuN?&>EulDePOry%eNil=f=hJG(XDjq`q7ZkDt3T
zREIlTl6ZdML)0p{@~9&-ZlN7V4c}U>hRGYQE=z4{r#$l&+%L%&^tbhHz0GHsz*c3?
zO>{7216L8av-q0Mv@M-Rn|-ZjUMn6h{Ph#H^cPiJ*)b=KLW&j%#Ki^ty(g)juI-8x
zf&bKp^t4d@_XO6EBnc&qR><_s%uLIg<&XwmV;!MgD_xDSe{n{liEg2z1w)H<zlxPq
zT=8YjJ+G^?RM37NaTHbk$4^JQj5M&hPha=e+@uY<1pJ{t_OnBV7|b6JMmExRD=WD!
zyA3*NN)Ie03#cLvmh+4kf1X1_NiRt=SmNT?Me)AvE5c3+e}G}PpYj->i6aXXGM7pO
z%*PvIHrtjIS1wY;{?{fn5xE2TfN{^QkC9ZQn>j~X-w{TiaQXl=`Xz%Y*HCZ|Fxq++
z#GsEqV;)3w$jCc$V@T-mB)s2xNKBSqCF`w!IPnz`P$8=KZJiwHc(jGqc8n}EP8y*{
zKgM`z@0aS?(9%G@GOcNh=py??6M%#jen6V!_l25inJc6L7(>-_Gk_na_=B$F=27DB
z!_B@hNZVXD;E8O1j!rO(mByygvuP<3+KKXw7pbJ8GmgtMz#4&kE9@MGsn`(qkR^SZ
z5{OZDPW&+Ax>Y+RuQv*%PWxOcpt6eyv(!>X5oF`sy`c^yv9t2>E~P3!s`3X>W>x`*
zNT3q5(%Cw=eF4faBozD?F;2lFC@-}_3mA$H_v%M3BgZeZ-1S*TKHB)S19quI*BwUR
ziWU-wpd=sR`HmKHU4|&@+O;JS-$Q2UZdg^08T|H_utrubwcDT!--c(e62^U(VbRpB
zBP_uYq+4s|l+?v|F6<1`4ONs{Pl(0Xv|;OfSs%i77oTlEZi9lp62XXH*&!=*qFEm@
z(Bq<MxTcX0RD9R-+6<>>`*m2E@^K6Ll$z&A#O$*je0`5?B*hoX?hbsB&CgK@oGBdO
z$k!Z$XfQ*qGHpcYCsVTwUS<*?O1hm_CQ}TeRQxA;e3wLY!>+Z;sH=|jIq^o{;vDg$
zB3zEBU<ve>oj+yu6)B%}%He|BE&MqF4k_^_uVccl42N9ewECJSdvtBFH7e5jv@Ihe
zKB%GFO%ztvo8IW#TDlx&vq$aKk~>J)t+^p9FQXJcE=r$4liNw~GKxhCXyO9DY~{aw
zh83lUM#|4^+k>y8AwwBE=c&2ZA0_g>meAgAa)nxejH+*sc5@`YT+xG^3<W!F*2e!=
zPxvdLx0pmOJVLiOVS1X(Aa;%0O8TsJ3;M|gv$kxQ`<pKst<7u>skf``74wZZyK^NE
z^L`2k4v@%QC<yiWle-nkH@;8Di&WZ?rkO2JbyHu|>OaK+))?EI)Sx5i*x?qxgV5N0
z@x}=X{&|*3oid=p(m5dCZSLZsCHG}~OycDL6AfP}VzMEhJ6cBLvC%mB{c~=)_evBP
z*>Cbu(*`A+q#lODIyVa}Hy%C>Q2GS7|9X2UO$&+{B7<6riPlVyD&f5sOuyEvu(5PE
z)~TAq&x~C9GBVSMls`l?Bw?o+Av|v9#PpcOJ0a!fv#Cv6GHjXZF37ZCAWX{-Tzb){
z|H%Mza8MU0vtnqc1H6*{9Q5&yNUmB}fA{vmhVNd2==Rj3jb%PMT<GM!fhAL+f^=v2
zs)3Q4c@gR=GEU4#v0VK6I{E2Kgtn(P{49vCZHl-j6jpkZnmz@M_L;`IcDtQa;%MPz
zA6T$hEYzX-S*wp|nZ=|8(_5jxj%OWt_#AL{gxBz<6qypW4EM&f=gA%J0QTb{Fyry{
z38T!IN{SDw>w2n)<w7W)SXn;$D)E$^O%Z|52P0CbjTwdwZJ~UcvHHtB2Ibh@yBACg
zE$f<N?;N7G-|2^H?bZ8gSLi>K(3a0d5SwYweY_IXUYKwks<(0G&Y9aCvhRAsi9d2d
zxi9H?9r81<Z|^JS^Ex(<{YCu%saT1R$U6z9L2pV?*%ojC7yXsc9@GNVMJbkn8JTe_
z8X2S{=%U~(m4u1euczjn)$<tk)`X;}%KRTi#D8k^Ph-{_N@rXhOSLFdOb-K}@?1Z8
zk5hQ{Q^ANjMPrjz?hSDOl83xrI0tZ<L?jTCHF%cqyYm6{B+XNq6D#aAiNsG%!eP@*
z3e0`l<AM|J;cQ4<olTPUp^{HOZ6u#L$TUBSmP1`~KS=ql_&R8?eu&PRu<=pfH}ioN
zD$pAXxtF5|LpfLbZpu{?Mb8KyJofqk7mg{7?NRKzGtt?Z;$hS{6bMmRi7Vf;@!B<5
zh@$L~8Hr|&1Buky21W8`pT<x0<jismghdtHrv|@8MQOw$*2<UF;q>_W-fufS8i#ZV
zl?EEVJgRO=o&Np7e$X1j<FSk<+lEtNOfkqg^VsvTZ1oDNxt3t9o#fGZOK%8kqdA#a
z({Hp1J1J)otR?qzSL|}gc`2HL`UHBg$}Wn3su8I`)t>dZiZ<z2g@t#&<}ZZ8_70Ty
z(n+x<$!_ZkXReECOPpf5{AF~^v6BJu(IOO+Qs)N?q}~%g-KBo3>kI={H_>IwQyrH~
zc8P0tz8?9SX0^w^u8O{lwTfm(i(DZrDx}4}M7LLLN+>q=w3{aM7c_bHo#JIt=C#eY
zd~6cIdf7d$ivxG?<(j&BnP5LD9W`#O8_;5S%4u2r71S-5eVWPXEw_qR4_3<>I3FsW
z`V}dFGIOq2#5?6OdewUYXVo};a6mS*<=Ift-Mju&t*i0wWuhD#kI-oui<*2~<$|tw
zDmI2)RiO$E*R#k_pqc#J+=d0;K{d3gK>z6~E%!HGuf5(ij^~Os9}=_(hL?yK^*o}Z
zyt_0AehWre6FtMiX!VJ#+NLE66H0*&1&-P9nH)wmHsb`l`Qq@4@ADn9bs&`1oGtNg
z(=UFJ&$}15CK=H1aM(MhYpMe`kA%wuFIh;1m4C2Y8p|Y)Gg6IWpVp7D@2Xyz(h}3l
zr=?0Ouo0gdcg<QETs9(LBO)6moVPq7oAjK{`HJxfzm`ASw9`u+!TYITaOns=|9SFx
zlGnERIgj~HD><9NgGtu=i>d>q*~wY})%T)TDfA*h;1YSq&-L65o;9n&K+A0vHp{aG
z!I<<t&TrOkT*vujKk!-+yP%~Bq@gbC!LO8PVY%JvMFT5|qJyHvWib2xF_HdzJDR-$
zPOD}8>gBby4EiDzb8@a_xZ|PAUNv-U*zBFs-fub}2(hQ8j@I5m;U>lh@f<5ZhIZmB
zw%;o6-`P(kDC4S%2&@+hl6`oy@^hNtO9g~6zKzN$L}l5oO{$)`;^}p~xlL9B|AEf+
zmPsOP*38%0j)(bMUc=WtX)lbNy#=F?U^9jF82@(Mv4Jw)_4k*z;fhe`!uu5MNP$%#
zq--bOn&M^JMZ+)*VAsq??c!$t1Dz}6Gk2%dZl{ul5GA(XL%o)tm0sth=ECgKaKz}!
zhrzAh8|Q+9{Zmmhy01T#hCsof-03;wHr&;Wkq9rshcw-kBk{>WIl_<QfI3$@ek#o%
z!O+WMbXNjzQL@h5%5S02Q$z)>D|@gjQT@@Pa#%uR*W9`WmHfLJs<5Y-m$)VU;}w%5
zrz6$3UVQ?ie5t95p?l^}-5$(OXo}k$%dUa|4l>px7oV6O(<+O6c&seEBu;9>J4NXQ
zMEM2`EO6@4+A&5$y0`pv6{S|oOt_JLAur*XvtXDzn7O*Sm>b*I?<mqD!p>C)VI(Ss
zFkuy3Sd0q8KXmv%ilq8)`n77-Klp{}0xVt)7q+U#0Ouos;j1(LLuLP?!T-^A_0KSN
zEnHZUhT%VyM3dnks`f8^!U+@6;)ad?hoWg2!s0auVP0Acuy}1;ScBFIEKiH@2?X|4
ziyyYA&G0(~d#;o9JNF4MY)hF7cCV8UGt?!luhdn20$1%h3}4^u9~!OC_?seffqs`m
z<O2Uo;M)`YPI3NAxM0fq{7<<5Ir98-{6{JxHxQ<*!iUJs@teT&l~ni<xxxQpkbem$
zY((Dxk(&#~WWb2X%?VRA$oQT5VjxEXf&jn}01%+UE~yGM1hW3~_2S@$aTpV@b3y=I
ze`j)X0=PK;Vu1iSVE%?gL|lL6@Blb?U_FKeP)_c@@;Jc&F7RI{2NwYJw;Tv30ABT<
zszM+DxSD^Wya4!9i9bMcF9;C83H%fG;s66cV3?y3q4r-aUYr~NE{?xAIJp2^f9nV4
z0YG^EDhqcYHw0E|MDQA}=^q+-fp`FLu0K&OAb|UCHMwBaCInD05CFI0PYwte0Qcmd
zD2M|9{#$u40B-P~MY#bSe>V=?a_&F)ky(LWAWqnZF(DB*0P;5r2Ta(A@CgWZVMGAs
zfB@jV>(83tF5>*#WKLcH*Wca;0ReD(|C9g*1K{@liGn}?FzA1xsK5KN7Z^S)3<+V+
zObL-WfB+B>res1O2Kl@3;5u>rtrmzE0RCGoP7r_#_Q?dF9l-I2d*Bsv@BrYg`lohW
zAOJTAmI!Y^$p59}KRN;daMk|gfN%ido$pVS0|bB@`X>sv2i_(BL^%N*e-9TJttlxK
zK9c?_%njiByE);b1>PC|EDLuD<ZrKlzyNs5{8<)mF5F%JH;M}Mf)9H5IV#YUfB@b}
z;kiQa&+n7Gqlpa$H#e-zlmZ0g27x)afV>bcCU!MzH#>7i88I=y8)G+PfU38vo4GxJ
z6<}v=YVP1_4lw(TTElKk-NFBZ?f;16;QejIZ{Y$0><aK^1F_4QJ6O6|!A}zq4p_b!
zJ(QP=8(#k3iwuTWc8>On!wS!HziZ9$9k%J7ZGFTjMC)Zl`&oyCqP6gM&!Vbmmq$~L
z$Bs}I<2S%~Wj9IDhvH9N#U~$~c*sl8>5?&AqEw_sOOjvVu@$Pp<T%Wwn8eEHLc2dF
za^0jSNngMcM<C|t+BwQ7^f&3!E>IGSO-q8t*&FapxbPUB$|yN{F-KO?G#-T1Ut8cX
zR9OjtOA-((buniX`=lZz;Q46?IA01YQY}Cnv8in5WBMck```lBT@>xhjMvYo@siF&
zsewi=)Y99+SOh3IYKZjAsccv%a%?Qp_C4A>Nnz>%0@mcaXiiNmn0K<6Lr^sI$;ldg
zy7suz9^S?Tx?bM?j)cwCSM*!cZ$#veq`nHY8$>1(TNV|eP^B0lETGdpN5b4-l$OEF
zRUx@BvC5A@5krzD^(aELwCz<2tj8CCPYCd<0>#l(PH$#^O-4D0;S3ST0lYyp{$vLW
zm~C|GSWHMwBG$#?VSEAHyn#|%6>&1h-<)Vr<%^MNP#VmJrG!g1G};?U^J}aJ)SFU?
zQua-%ZDu1f_XW5P?vsS2TPX)TIl&?d%b~68L6|1cND}b^Dv<!+8#O62K{?Dw%KCIb
z_M4Uc2rePWmSeR6OM`7h8fN4}h$J8!CnB6|)gLG&@`E*qLULhK0Z_`N5P6SOJ4}d{
ziFUpdQ=s#*169SMij_5CJ2C&b4GNi(19l<V%J>T{rkYQc=CTFN?lGR5{h+=K!&hFy
zi4)7{k_t_}s#pZiYGnFqKN!ZxSM0~{bh958l`qT+4_V5kPT$^KK0_PYJh(XxQ@cMh
zc_`@6W{>{5_xO&)5CR>$D)KfYtmk%=FmjWy#$(*0+-v{#MH;j<GC=h4BTb&LLf<PW
zA8&!DH*EIfV>y$B+Z%OWru~Ybl846Z4T1`b6><vOIE-ZaQS!49wGiHw%r-6gs?yK>
z$#xVi2Aq4@LM)dnq@SQ~^5*9Rzb!DE36(WpjhI|X3!10C@n(afHQ?sHeYEam(VTUe
zNxpiRIP~IUKG?w_(3LQ|PxoDqVCezbE?j017|Sxm<#11@VkfcmJ?zxSyXmuA>##*j
zi=7~E8dfsqDOwj>)w0BC>`io}Q?eeb&sKNnXm<CteF}e<Zm<V4gfP=L-*)ItP|mOJ
zsYj|iG3y_gBWpsdBn*$emyCL2T18CYyXg(~HyqqW?YpZQY|NJT{)%O|vP%?e+-Uyj
zt5*9tpMGwxK}+RnFQn{XfjsV^{1sz2lSJti_MW<UCD9KMCuh}sw0LL8YFl}nPSuAm
zM|rUqj;O1HD62@LkB`@SMg99@I-i>xC9iGU4Qulx74yuX`-t`9;H3?bQmVWnoO=bk
z(wW(cWAmh4T+WU8+51w)P8&Hs$gKV15PYG)=FcXd<=5xBB@1G#tNGGD@NY5c!}Qp~
zN{U$VbGSKTK^&XXEnD<IAdy3{UP#<iS<6q2t?rg+lSZEW#Pu&kBiy0F{Z>bg^$qm}
z+x*T0jVK`i`b=o*R_J+J)Xl4{VhQr24UOTF=(cK)qVxW9x}#^*%ffeg(xC<f6%?)^
zjup(NV+vg!US$p~^&TN##4hLxs4IrQ8x`Ci9m0Q7jo7tJpRe&6#7zEdYbm-kQDHBw
zppZ9VR_KaA(Se?h@Vp-m;NWaH-JnTA-H{dFkwx}}GI6e+IJSc-$}jaTE37KZej=$V
zi@zuSn3>i8NSM>1CS@>6888EjK6f+tweGIthNtR>r}|UwvvM;od(s4nLBHekk7{2_
z*Va<l8w#&I_0+oc&v{-CtsAyT<6HSv74J+JK0S3CAo2t7`9>dG4Id%!Qq+ofF02Uk
zp%Ir+K<VD$mcAXZj_1J-=b`8+40l*yeb+ywhmXyM-&6cd$W`7>EKE1h;IP-SIx;Nv
zsDRLU{|j1dSQ5GtXrw^&Oz4LJ-V3W(9xW?Kf*nFq;wOGj-zJvx(ef51iL_Oo#ZPoE
z3^lGAN>+M2sMx0LjmVC{h2f5ysPFopS(C*ASD-IhwiDKgj^E*0ybYnq=G24q>BZLs
z*M~)iC1EOoaJ5Y@U%!jLXSMSeh?wjD-k_|{${v+f%VB@ZirLjT$BtzkwdXFhw3N%%
zR5AXHE|)8oU-NAN*FFxk!@)s0Dh1~Ip_!4=d&^7YHe55#t@|fb;TA%m#zimac1Q}{
zID~H9X`IJVfAXCE=_gj?Ji>vk)Zk#{GM<LkvscI1Mf8g+FZwMW*~ap9Wt?fxjJH0a
z;WzR7-H%{0y^QUS>a4iSIG*{A+)B&M@pW`N{`A{$z^~D5D(;8N0LK^MVe(cvA-Qj?
z@I$iRws42@o3|{7@~gHqhHMKGG!-;qxobihLq*;3Fv6U|!c95Jt*O_-vB;B5hE=H*
zLj;L7U%Y#)zg%tyb!+c~;}gEDEL_=Ly|m6FcohBhAgSL`hKcO1DAI71F6x)IB72h6
zXOPtu+%`8?6h2vSU5-}e(XHU)KXVDo-SGGj<jWrL(3tt4pXT8Z)8HCN0~IOA;meco
zrI7Dxpfj{jVn-NRFxwrYU1kCgQ|;_3YJ3Z)xV;Sb#bL<%HC&2^!SDQCc#?ZR=KtIi
z{_ntngO>v)XG;a;{Wsu{Gj?@@U*G>th&j4DxB)=_GbH$(@n1;r{}*34Sem=KF|q$E
zii7<>`Txc|64oyN)CNys!*8aPj9tv(_5If9+7^Jw3x<)}y+q^%!G!EUh`f+`7rV<R
zfd5xKQy=Q^><JE#n-v6B<KW^0^728rVDB7(e?ps%pg$pi6NHw_%#6zfWX#LTV`2tm
zg_wakS$W|Paac{wd4XmiE+E95#}ww}#PR=EaKg!!g!gyc_@B$<&E1Uu3A^AC6imq(
zLe2Ycv?^!pV999iz{IZV=HhPZrsiU9uHxwE2H=Lj3&~m1fcJNt`kx5tH@X5~Aea*j
z0rP@EU>^99SLkm<pZy;J9RJj=^1lN&2!w-O)!N4#?qhCtX$K3(-=Q2##)Stu<|wC3
zj(V};Lwv<3-f1YVeE#lpA!F3LV|o4$lX3@>tF`3=h>2Exq9zQqTzJrc(9qD3(1>C<
z3C)QO6@D#0Ii$a;=;F}T?K;VRu*z62xU=Kl=&4FD*K)-I{7fF<gZPv%Sn(@!!Z+3{
zz66JW-tYPyAJ1Qx5C(h2eF%hBdT9vUBb;9_B-l!#mrOijVKwJdDPEvMpWfooKA-x9
zMsV6R9X@n}_SJ+z;wuUl*G!mz!M1Mx=Lmxsk)x!U+W)@hg3Olrmga&LhuXzto&W<}
z#Y&dix`EN8^T2X>&8y0C%Q<$1z}3S8#_|t2LD$MLpr6m?3n-!ZKwKD*6#izm+3A3z
z^uP?O0haMW@^NweePf}_S_I5mG*+z`I;|*ktvEuhNOi4PPOWH-%6=ca*JNBK_*{h)
zx;2C=H5B|c`0dkyYm331hXX>VlEgTh0Gusgn=_K6GnODv96nE^L3W>Ywg}baHu+>B
z6)`X%x+P?+CCIR%B@F(;t}K#)=PFV!gIQciBq)&yID+tANhww7N3VS7J8QW{^cT5~
szIpC-!w8%w6#s>wpVTh!_kebFGj?(Faxu5SfOiotP7FFaaYc#$1*hPq-2eap

diff --git a/backend/compact-connect/docs/design/users-arch-diagram.pdf b/backend/compact-connect/docs/design/users-arch-diagram.pdf
index 09b0e2a239571414275e5a006740b22c8b2a2595..912a3fae0133cc381d67d1fb38c5c9bb061596a4 100644
GIT binary patch
literal 47169
zcmafaQ;aA~(B++(JGO1xwr$(CZQHhO+qP}n)_=dvZZ_GMeW`RORY~<jpRPKmnpjRq
zgqog)6@qxcZ@_;bU?32J9*+*s*1!USi;Gst-OiX+PT$nnkyg;w*~STvo>tP_$WfE=
zpNoPv4-bT~jnRLuO#e4T%Gk!#$qbK?j**>_R>a)O$=HEb#7f`ESjgDW*2wr@jH8o-
zvA#8gTh>*#WGoeD0!~}4E_|lCNz&u76DUTvT<Tn$pH7rV{;*!2FpP+*K#5-l2+_7L
zug#0M$O0kZY`C6@(NUnbw`@jm?;9P)wX|y%%tJ3|DPP3m%j^9+?P%JQ>u2Zpkz3{W
zwod}@ENH4JK+YdFUT`fx-k%3o@1>v5-=E9<-|xxaaa`G**VpR--QSnppVNKZpZ(h3
z2if0!+t72|-}}4UpBLH9;NG9dUYTEGkGbFP+w(i!U+d57TT<Kkk<M^!w(pUj3n#Uh
z1-JH&Gi_fSttlMr@JJqF-=l-vKif%N+Rlkj$~baovfZ-$*Plg#1+ZV`f_0X?i7&a>
zNxi;qg9rP%Ex130EQh|<bH2P-+G{yH9mFAn^P_t(zvsEIza7l5zn{-#5{rvofBE6o
ze%=4({c<tiwfo}09*-=pCSA6v{l1oMd#s0Vqxq(o+>8xCs&{3@rpVFcfVX0O_m>`0
zKsNQs2Avwhk%1)vM}X$GLdHT@y^{Ew`Zw@Z@?G{%7REw<Debx0U9JGq#$qr{b_4rR
z+!4r9gVK`q)Zt`rWdfKUlXJSExWSVllL2~I>2<HBa*}lQPcMuhUz6V@_I*T?#r3R0
zA{9qd-aG?dVq$rw&*`R*K}=!@#kOz`u+Zsm;Mm!CRtm&IcWrZ8w_4ZnR;}Ctb0@W;
z+?~fAXEWHNCnCaZ{HmK)`N_6nwT_HQz1Mvg9%4RC0())nv}(UBNRocrGt}zn9M0_m
z@`}@5#o+aNq*s#lx<7GGtht{XC&(|flDsGFVmyki`HQ^Vt%QIRvO|hb0kXp_7y@0U
ziNsa5=m%ys*@MvYviwUK=5D1mU6vhAZRibg<z5!gffXIR=5470s70dFsL$yJTIvsK
zXJTJftWbWd@+~KDBLJgLLNh<G*8;j~$MUT4_XxyZeE@@Zquc?(v<u)gAa&mQD2UGi
z9+<Ng5F%eMM==C9OC3z(4yV4u6Lg20)`$b`9iqoc3IlEBw4bX4imx6)m(;Q&(B)s_
zzRgx||1ljLOf^lUzcX4Y=tl)mQ9=T0;1m#Cfq8ug30;;g!V+s>^y6cQ4naW~xR6@6
z)OLLx4)By#0QM9`)~&kE^>7&(mqE^0U47~&WDnJdJ<2BX`ov3kcYp%V3(DD^v+7iL
zh_`YrG+Dy!!ywaWqyLf}FzAB<%O;B~cO-5+b1sK8^|09^Wm46@4ro|~&WP?-QM--S
z3)fLAXi&xN%OSObM#uU-r^13b5;M#49$>7cyj=;Vnk$Sm0Q_=-*xZJp9DduVB2?NZ
zeP~4gqOzmKC#o7vqzQgL!>x&Ryc-%%yBDL_rMyE7_Z~s2w%QC}uJG2l2e}@_kuiR4
zV6Ac!9C57lCXBPB3Mw-0fV9sBjkVVOKti~2gU<PT02UmCt#r~m;Bgz(5^QvceZnD&
zzd7^i1kos)9~Hq5nM3FWV^PbC>_%KfJu9Ld3vDF_X9hxTvq~5Qwhwr!=L@C<FP~?1
znKvK{=;#5s>MsB@=TbX}=@j#FH`R%)k|5CIRoLfIYe=bOp5FMvqY$B<T=|A>o2fI<
zB4OIa9?-tFL34*#BvJLF^v2iV0|6QiAP{o}gzUp1WE&voBoYx{ow}^OPYQ2MjvKr@
z)KXWFEKv{agRoY=Tlvf>$Cmu6@+Q6qENC#Nl^5oTdYB9%+Jk=xIrH}v!V=S~oe+tP
z<<+F?(j0UY+;tZ4d=&*fRL|2e*!hbDESn=?g2<q(tMgy(wOxb(v$nFtpDTtyyx?7a
z^26wz6AF0dp24|blR)z4d??;hcmScV2rI81SGDv8rjmf}o40ehd4}DA$uL27bR0S>
zb#Q(SC!-)O?W*9O{%-9^W)zOR`o{`gk$H&8M@}tdWGZjqyK?cO=d$hr3q-E|5WM;)
zNtb6<<f{=|@)Eq{*}}F9>QoMDP;NPnZD~#=hQXW!Zv}&58{J3M0FMlqsL{r=?f|5A
zLt;Fv;7O9X5LK@<d*Sq{KZqIjw-$!Rb|;ud>wB7!4#yCho^GLsii|nA{FXt@vWP-c
zV#|67Kb&Pi|1jw<&tV%2LvDdV935y-a*s(%KmQUKU^z~w-ZZ=q;FWP@6wJT~)J-$L
zR&J294Ny`xv<6@D1`RT=Qx8H?Q7N~Sy-^DN{oI<<7rCH{Tc@kP78<aGnmLHMC&ZVK
znhs9+!DV;Pogbhhj55a3x<XGGqY#dU{zAsXj@nCbT7`m+e(^q4Rt_U*j_%UY=&E(F
zFYZf}{w&)6-@J9bL}>?!x{ZRtTIWn4&4xl;21uuU=52+0IU<B<lI)Y-K~^c_;~$GP
z+z2euOSy%Q+7bXxdMJ(m1C<J;OBM$3`oH=VkW?f9hAR7{T^x3|iY_ViCH`MRYoQT}
z9U1{OXA9lB8(}_oVOM2TJ*3Iw74qqC=#ivn4@mU%V68C?6RnqsYr_y|aziTlgeY}R
zSz?Eqj}(vNE2$(<88A0Nr2%|6oEbifuTnIM$LjJ#zhn*tFyS}yM#CMm!u!5x4GTZI
zi8HL1Cown+%TINsV4#GFq~cu&9qqsJ(_jc<9Q1Kc9>j4^`9oPb-nT!c4!7$lZ{*n2
zM9M9{p;yk*v-SJ|!r$zloa4cuxYK*=&1I_Q68Jse;!*sKJ-*47vsme%xA(xT<Atzh
zgAEi_wA1xmPi>yVi?xC%x;65*kM*X0C+R>(-smAwBb;IJGwQUB0G<2b?ZYbWlY(`k
z*)L;OlJ=}slU<lAX&I!0O`WV~X{b*V_2O4Y$%cn0*72HbrH~=QpPY_hMv-aQHj^BY
z=&<a_cmI&1Qdvsc3YL-TB8^tfn6$mBRb(qxnrsjAqsj-+pesfLaD4A49lrd-r^{iv
zB?Mx|44b|*uo~-9KR;aR^N&x-uGbyoRKAeXY8KskOh=0#;<~zbcJ7>Bmt5%&>wPON
zsa1Lh$(1Xv`+I(4m4x$fryV6!=_DSTEDMu92Hk^%P|Re%p_6!81aX&vxn8U|FbiaX
z;*X!|Fhpc8B?=Vcd!A%WP?o;gOGP=?l%5SvQ($X#2Y3p}LG?JFaVTubDU&rJcE9Y&
z+#-}ZxDfK2aTPul&X*X^F=3f+wg=cuX>;ga6Eh;zXon4H8pXWWF(eccZ~xT{g53<O
z_Vk8;ng<4qe$1q!p|zfA8n>Y*xvJ4IlfN;gp@aE;RgH7Wb0NofoBVF8C(urHVE$C1
z^%}ESlm#W3m%!(hig$Jkb2~(;YauEJQOr|ZzrMCGi-#5kO6mucUJrCw55g-YtWAb9
zb9`}6`vP&eyT{zHXI7s61_`3ZfNZ&eY)CN5By~Y$QfB&B&&Yx@ycl0ce$}aU|A&d)
zyL756u5-H>LcKtnuqmN|f9XewANDNp6EHyu7o{7zU!^FQYmD0lHOw5tc@nh}j74?^
zyOw?H4LuZe#-y6k*>PEriPD=6b3ZSYvD{znsCfk$w%)S?oB455fkxWa?<M9{s&rFC
zQkP02ALC@O1d8*j{9=MI^qu9H;*vy58&FuI5m7CdU?S`5pA^8C-_O^7#bD^~;a%(R
z3-7DC(T^9(x))C*)seC`=jFW>#`^fNJG_zzooqp(t<l+%D>29)KLBq41R$`Wv<n9}
z28#1N?|31Q&4l?RjA&CP5Lp?oTp~34b=kImC1$K?Vsyh3&bGzVUhPsgW4dL|@2{jY
zOGP&;pGc2b_VcE}#ND88T^w6eg6pz`%ae}?T~tx+C5brb0YCf4h!~||C|qr|+9k=G
z*iiqT*pV6(@`mWM4%(exEn<ARgk3dd?kw6{s#u7iUaRJ3^Kc#an_o&ECTZG;E4s;S
z^*z+cEPP{1m1$l1FhLxo3F*@`j5E&m^pHy6w|1*^v7&!cPg`#V<+oWTML-ae6q4o~
ze|H?eJ{UuUqA*S*668EH6Tx|hN?VmOv2{d6BUic@QIUfe(}xR+vg48W>5&B@n;o^{
zwpF|yL3RP8mHg0@U1B~%1z!Stb_bL>tH9@*@m#&Wo4<=RZm1HteV$B&$8svez^qUb
zjH#E<k2VDvMG@s>6k)YjSYjVQ--d>=K>$`GN?fBmz;>}rN9LLkSPE04xu#;_+$^X6
zjuR?kjdXJV21C+hc<fCb@DxA1_CXKu6+;}QJ18!L44_OUQaE)V<+fVu;(`m9NYDZh
z)P!)Q4~%})&$bBfYxGY$s;*fqWMV7cMl8#iewZp9J}yR2D@yTXCic-iU8=MPxho(M
zyL?_cdWg^<`r5^n3)-87#^vV4>Xg>$pi*rW9%!2N%7_ll>owJjka4d#vi4vx(VRIo
zV>OKdTXr)6YDBPxv~gmM8dV{(e5{%t2kcYI8cNnYU3*>&f48tGslZTxQDU7M0S|OE
zj%Is+WBY0S7_dcT$QAn_Pl%~IDlqQY^j2IQsQ#!Xny}1alFd!bK>N$+^wu~&q%PeL
z{ZsUB`Fw42FEvs?l5rnIm!BIQGo%=3*vy<(vX^7pdY}9R4+<hUb;!o0m@O(%s2KqO
zHPnZcx@IDO>|NJ@fj5)7p9)Nbs$=o*Sw>BE28uNW*7@9&KSkc+N}&PXIPyajI;vr@
z%5L9MjLU709qVPL6v9rFjGqI22_B8{Pq++!Rg{5Q%}YPG$_oa)%E2?mjhzuaTodx8
zcKV5&c6JMr*qsogVD{#VPRo1|&Ed8t3x=D|P2D^iu4q0kD9o8N&zY4!!9}@%o8yp_
zF}neRQRrQkV}?l1l*Sa??~CR^`w7R47F17_Hm`ng2t+EZY?fP<eT1w<K;LHB-?-ts
z$>~&^j#;Q@n=)5h`C9|rZRkST$M#Kh?}a^xKuRw#)wZ!@q}k4dl*gK)=#?QUSpjb1
z>+j{bI{!!~Qv9)lE=7LG_@ayHLAtwFt4Z~G;l}VMajCyMplJ&La2`4lf9v-wMKV-5
z6IL2yiXuA&MPoR>MhAbH#ZBxceqUW)e+%_Z?JoC@pU#<Pd2T}wo}}4zA4nYibeLjP
zSzFxS+*!dtS*?fOFJGH#-<O}XH~ThxGhZ!5>!*g@J=#5nAlBpjYOu;z3DgD~sGE=9
zI{x@pIN@qz;P4uc>uwyjN*{J%#caN$4AFn>)bMU%sa63rSENg7v08kKibzlkZX8L)
z4{TEL0K}|?BM#xTmto|8NeBYxRN{Ia=%M6GfrhMT2OTomb8wp9WYmZE*jj}E-w8nO
z6(iEiY9rDsCBMom(`1)yu}Tjbc%nvL7dLjiOj7`+lwU6IscdtXJ57U~Hg+uT$-yl(
zM>2A;j>vMC2AKt@Mb{dwMx8~aLlwDgD_E$xl{<PzH>(xLFFEyB4d)4m#L3{1-b_^h
zC!|f&rni$MgOFoa#i?Q}z;y>B)<~fXl~FC9E_|tN?!utbW6}uX$0w>+UUg>XU!pZQ
zUV3nge?0)9YSa>sk8O{7K*!!a;$Ka5_eBUY_6|kpuK^kawvX3hJjk3}U?hecX~xy)
z?aKj<`Avr(KxnsPYqxW2qeIL@J&{EU=FU<NQjAfq9XGviGfX|xKz=IwY{3jTC*g#g
z-6IRdvI)i7l6g2yd`}TD9w%WSHA!fD)B&8$t}o|Td6ddPS^=clvysmO89VGbiGiCb
zaMfi{iw0njJz^oy+2C@()=k;|Qv3H2PLidR3u$neB-@f6D!&Y=C*zZJ*I>D<ZVU?A
zE6OH2Dw5>)aM4aPoA@vtzPYVIUn-6l$;n<diW^v;NJSv)xDp0_7l7G5nCAY`m+|QL
zNln3rE!jvaQC_Y8D0U6~exQdytpv1TD-KbdXklu)(9Tjwy~M5&yhR&Odu)e=8(~>E
zOCvr(yyR%sGKAdw_O7Yl7N=@^VK?x_l2J%sb>bQfKTSom^`ee{U(i=ib%m1`MR>gL
z!n*q;I)OYTcbQ(4YuYU`v+X`Zdv>KK*N?f`e_Z0%CgTfSq%#B<v>rAuaRX`A^r!A|
zj~h!S={6Ka-7y3lQtH?-1q?CbAX;>dm+~%sVDlQjy`mK1Qp|mFk0fA4-Js<h<klpd
zZ5&76ij-!vf@_2XGz^NQU=nQ<(RWU=AiA?6XY6N8nmjt)3Y!H{{NSY2kkbGNK@IFk
zRr9RBOxPen2R3{#9+v8fLgq=P?f23IS`})B>T<MUr#fXsO)F_qO7&y^xX9%AJJoL6
zP|X9QW>?-e04&mUbS{oZ_@i??fU7@hh}(V2)8W&AVcd&g?Tg9Gog16sQk!*nQ=&Yv
zB~v#3x&W}H^WC7oIMYpS^MUwO+WIH<->s{Thcvk>&<o|dxb+G(+rn;-{ou@<s`<`b
zM}Kw=kz%^IWtuz}Rr33{yJ7#p)%6v9_`Fp_(O=qSr$vhX;4J)^0V~IPcI7er&h9tv
zXrB^JX*@=rOy{*_S48)2Y0T6CacNN%&J-;-?af<i)RinZ^;434^OV<D<))Oemij1C
zRS9}^=gg4vZ5Y$_CT<kFFG45wpfcUBI=-TOF5Pt~@$@fI(l+DJjBV^qWJ9H(b)zwe
zs}YrKAAtFLi7<r_Tjc@F+yVl!{{#LN#bp>u>`L$<OMNH7O%-(t<S@u3xjHzp-11Y8
zG~<vH!na#jUEsy)(cZYISTbT@1}fZcBD%XeQ}9{$y(S$zgkR((fM2`{&hv8c8vo`Q
zJOrQrAp>90o1R;2>oYRX!SV++`k|%UMX1)-S9;t!^6A4~JrnNu6ai3adcU)&rd^w=
zF&Y(hatk2^97#gW191%~jB357f-qO_KnVZO$PLm?Lk4|xme#e!hgum9T8%-6P^y3y
zESt;%TaLGj4KP@Ugy@~=2itj^5nU^C4gNhrZrt;qr*IcI+QNOf9l~WjG2vW33Wsu2
znq33%T%lq#dC<i$4mM8lKuIqF8hB39$IVFU?qDa<wczss<pT@Oc3QsB#TxD?G~%!R
zqIGSkN#U7U{iQb+NJs3P)YYdd9Pa~ahv^aU8^?he(WCcoo2Jgi&yG+}!>m{EGBl9#
z!BMm#j>Mf1={+14|CymSc%v<^8yEhOdRrF}z`dt%gg>)3$-U9ec8iq#F!!pU&XHQ~
zEV5@u4_z|HMwd~E)!#}oEh=*|EhD#1#_)?t7+m0vQ2$<^eE>c*oISCz7;~-|o7&4k
z?1lHlj$S$69T$by4*8GbbOD2{4n=jPs}7ekR0uye?V>94%Tqb{QHndE)sfJ`$Y>jN
zs}R0}1^9hAAk;G8kMe>#tOX;pu;fzRwo!jV1`|(?9+b8};9cKq#{Q6lI*$=)4>IuB
zf+xH?LMOlMFHN+XaaXK^^=&nAtH!kE3l9Ac1$iba(AFwK)xj3W5D#6Vjq-w3bCRmQ
zWsrDx-DIxH$h7>a6n!BEMqc%Hhc^2YrUHkY>M}#KEp+FN^)rzWi4X$=MI8$j{L2yB
zikimlOC^b0e<a(LjuEv8EBbFHi*<}_90!TD%=aWWld^9!CT(dst-Q!|d1-9x>_3n(
z-^4I7MHbR%oQVf>F$FjhMtbI17!yW#=JT&_WQZB4(T~?Jelv#&S;WZnJ6>Ej>YW|3
zCXQ7z9}_MfLhGlK`*od8-99)=hfk~uJi<~Bgo>B9sGgBqnFgUs#U9&bRo#uJW<sZC
zz}P)?5!YRtS*P<YTe+OAXQHD+4DhxOOtmxPCL-HhE;f{O16`^;KBt<^y&v<huWLnj
znT`MIwy{YfOh{{G+2zlL&$E&6jtskJ6fBu)GJ$&(k!hzDEb0HEZytnNMS7fk%=z^O
zgKVXXGFOSSQo|g4Q35bNzWb%OInUt|{Sf9trm?q2ZJ(;s8Zv%58qVIQC6Ci;zWyE1
zZT}(Nk3REm*DsVzeM8&heLjIs$t3w<8&~wWH-3{$nK`?9=p_L=X>78OXVFNCoZ>9d
zqHF1ev0s0&qzym@`A%><kgj_acz5@QCi)~kTL$SWCLWS`l;(JHWDX(w^v+AvK@9|U
zG_Vwg!*Ib;n_j-SubWe<xxDkwgoU)z3r^(=!pM>^?Y-$xd(qo%wvGk8Nex2}ZVJp|
zOy)q_B%o)DvXO_UWU<^(%sR?=v2N;b!L8cL>I=S;0b|my9$Sggs&B8~Z6X|h*n7Ns
z+-IY0<i%>-9lPF^{<7)qKM}!c9n5et3YVK80g<WF9&T9{3R`osyL|+vGS$Jk+*zfd
zzj3-<Y!!fZr!gRG`U5wsuwMYYcby;4l<&iKO7UQ(u%kunWtHl<x!GRAaZ-WMeBI&E
zVQ{km#&y_?Ftm)opv|oX3w7%MW*xsMk=ySwr9_W-isk(c;7P!(*dbtUAf?ttqF>fO
zpA364blYu^Hf9q_FCirja~5wwP}CFj3>*)m<sShO8>{Q(iK~KTd7gqel0dU2QkJj>
zS|g`Dg+^l?sEcapL&c&tMubIUz@oJifYnEc(d@}8sG2CO(>XREM5#F}*_bn??7r~5
z6p=ghw48^gYl2G{;zzN}UAYms-e{+=xa<^=G*6y1P6qK6K=1`K$Q(^^oZLRAJdUb{
zG3jp%Tpf+HN(ZgFE<}$VXU><RxFTG_Z@!fVvZjIvrWmEY)RY=gJn?tKR)_m>Q_Pj^
zyqu-6swSJU6jH>M%Ku~{$=SsDZtO2)npMxUtExKQ&UslaM}umGWJgz9ssV6g#>*7)
z)NGpoGn%(UU|%b9ISyv>+(Ws(K$fzTS!>E9`P2q>0(iuY0{%mma-ExYA@N)U!1P*5
z@?AMhjTV{_o!V#D2<n(FHrw{M9)5Wv-jJwf=3&uLfc;ilOTl%)2n0$ASW=*JF_4|p
z7NAfl7MG&#y4R&g#-ldVsE|*Ey=0+cX$7$Aq%;#IA)8^D06=L%MB5LKqFA7rB#ET*
z<dvLLjy+IhdvSlcSC`E_w28WK&m8M24`t>jLoF;Fa9*Y3>e)!meDG96zp`f_%^X4_
zAVh(}q%m7R-hO8E$2puX0lMdU4D_b_xl)w*3((-qJJd;6kCE>MdlV?GoX?ybOGxZZ
zJvnQwblQQIArd-qnd3Bk!HFz-u8_Rw?fJ#Kgno}tkI!qgB=<Vz^ho{)G_y^a{q<yT
zIfg4iZJ<c>5uYy@2CWCU64#qz#ftEQ5tu$Fvaq}&6mp=GlTAU{^fS%IGI?rt*zqd#
zP1gy1TPw!a^0am!r2FE-Mp=cv;~ZUJVL8qb?u1?J;tX(uV#k`gF?+ShYK1GaVpa}r
zgbxLdexSyQNi?n9hhu*!Ly4Y~qH{2>#<@-%U=-QHdOB{b_*-EPsnBF(dFVxnQO>9m
zDTADe?bP2Z{{)drP41gr@9wPwt<WuoqBlrUR;TEjxPx2b;nBDol3`KS-Bt8J<Z`X|
z^%PQ5*rx+N;3I$1vTcYc{;Fw8PBq0;rca&5dit==nUGL<?_e3>DOGQAcjIuB{94U*
zpfqy|yutV{9%v&}si}uBPN|nurMhHEWD(+Y^t8VGP5)cDR>O6nGZzvq)lq@O(uT<}
ze2N6c3bMi@9x=oQ3Hl_twSxBfDThYP(G|J!&M@G4{!_oUM5-_u>0si%KmB?fEl)d)
zI#4YlS0W!cC9W4DePjS3NkJ}$)5a!k$PDrD)0!0KRL74}O<qP?0in{Uoy0TBc1;5e
zc?TNMrH&XOS#DoO4hE<17bPY{WH%~$;>gHa;LGxYJitbXf=Ta4+GiNWWUKT6pLi=O
zTneWQ#b7KM=A}sNG_)KbBplqCJzCs;?$}u8h;~KIwir9&Wnwoo0>Or_k|*$lcl}yn
zQ!$d$UF+5!<v}zu)EDj(Z;SmpF++qPeexMb7Zu9-M_P|rlkEv?hGL`~r<<)_S#Wf2
zC?P~n4^{fuZDwwYr*|zYL#LEg;o~5b$Wsh74>*=qVX~;3aMc*gof{IhSPL^8R9H~5
zg|u~NzPxgsoQ{tv4_NiQRybGBDI`PqSsAa_^gC|}<yzK_-jWk@bRyne^cEN8UGz?+
zvZb8X+-UI(tWinl7~B0THz?$Z99{&)5bKNv=Sv;qH0E1kh;Scn7&sCZN+qF0RCBjA
zfnw)Yg35ISF2xTPU3Jp^8j8rPfb?O4o{$lvmZuNl3jb6iy_vI`@)notwv(;>PP7Rb
z^xoy?sNFT2Sl3+}+DW^}TBEjV=E3V*-*ncTG~>*Og>rKjzucdPS4MVqTFm7m({8uT
zF8hP8lGWuGvrVtpNgr;x^Dn;lbJcRcO@<l%m7#Z~K8JU&3~dT?7k_h?eDOxaHR;jf
ztvc#D;s^RZu|~wVyyL>>QSsb}(}k<9P7dU|!_BkZG>A59bF?Q&Low5Rp2|RThL5)Y
zp1*Q)24<eI3AwoJrlfCsiYg|xhp@_m`UdzD*gmD1HF=`zi(V>RirP@}^yBBW%Ao<z
z34a41O=`;wn)dJH1c|NPFZ8HWnWOAc=hf{?*2<njXc6hK3R-PT$ZIYsgQIHQv{s+!
zeW#m@NcpP5_bto_XRSk)o6K@r&6abFP&-><F^#`wl`T=q+a&l_g0=?8ccKrIA&xUj
zsbiwtB13XYLix*~&9P<31EZK269Ap6b(I}y49b->EV!1=^c9fpJI2gI`LwKocHOXT
zwnw|;pjZW9ey&JOS5wetUoIyg-d}xYpN&T;h)cuR9Mac?oK(zV3=QSLI_xGv<b0)O
zVVp~?yYyEYp!T{!`>bUxuF-po>J~6CJlI*M1gd3tc?1y{_!Zhh@6j~YFhT&*Yy7xR
z0wGKRYjBOoY41c!0EOY`T2bS}Q2hC6;ea-h*f~Sox#e9+3VUG3B~?JV7$8mxcI9YL
z&luDK?ZQ(_fJ%tr)U0p)OF$<v{>hH6JRA3ZB+7`6Tl-=Az#GioSO+XejU40#L;Lv<
zd4_ltDsxh`R;>ZCE*dzoF?>aGhJB}h_>=_3ordgcfTgtMIm;74Hlr`wt+bS7-K`Hl
zf=ja;4rTW2n2IzBa$~$KJ2!1rjb}lmyUb@xqH!&jFFjwD8^m)lv&}uRY&9bvwak4(
zKFwQvLKbH0E=|{78=J2fQotyOR(8Uz5-yM+)2=*k$us#nvh<EYqx1T}Tm^Pa&y(yJ
z?vFf>;OqUs8~6wzwNLYkp?F2jeX6c)Lnm*?2jrBl@dA|^)~4rxjqJ;%8mV78Czw_}
zRyzODyBJk%<I?*%fyFFgQPJt4{C(?Vj)Y^IZUVzFhtYTIe3KQnojgRuTLu_1+Z?R#
zW5ev+`#q3{M`Zj~131GWXTdRh2uWY~7;)xj*DeI~SI&D%M*^u?C}-z*1=L{TKXl|l
z|50T~miQ`kkh;p!5+6xHf}h7HlDH_u91)Q?H*#7}FXN<#MAjUM`c2jol-=h<*OpNs
zhkcp1?F6Yaf`p+O_Fp;{!<|a6IHu@i;duD0DsMHW=vvBH`bf^dF<LvtJ;z^(Q5Tyk
z3$7I>on*zE3}LR&&-zlOGJMh2qR_OCQijQM7qQDNOWiwwlFl0E`7g#9+{4OTeBE;p
zzYJ;~_eFT7?Ba0q_FrU9hE&~REYcid!G);#{e)nF+Xiob!+^yN5cg21smX1F9XfL&
zviREMDK@uTT^U54)e)Pfw+yAy^LyiTNq+6R=OBDWB}M^5I?JkhrgTsEXsb)_7G7Ly
zg%eji3<5g`@O$X<)1@KSYDeM2pKl(-%*Et?9BUb8LQE3ZI}RcZ(3T4IaZIQU;I)8X
z*8mn!N>DJ1<RFGwjreGjvC`x$gBIeTH$(-}H3am*V&Ead1ho~4-j%wwL`aFbBwTBz
z=n~2aV)O?>1Q2ARQ(6fFE+P4z<Z)i)Pr3wwlUvSaH{i4};jKl7&8L!V9GT~Eg~W=1
zdMooI7zXPJ@}KvDYSOx#R4W}e-ZnVWKJ+eBWfr&Spb~S{*#aPU*I=3cq=ha0bz#Dh
z5?<_j*E=dVVNY_E%Tv(xU5r}vC#%}V)$|5EXzc-#@Yv|(Mh38^aA&1+UB?R0Z%P#d
znfN)V8SG<NQTg^+Y=}JwF*NqRn#kZR1+SKga?{79+UP_p`of`befxM?)MpPi6|yF1
z4&6BE2}<?0i-piHir6TuL%pW=2|(lBagn(6sGEn8bTmGT(rQ^4b^vxc2v!K&_0F6}
zCid%b-|syBI8s$m8+b=bkv>pwWvNZuPKB`ceAaRR8<I%-b4In;D+Z(AK{ZJZXXyhp
zbp@9ZQu0C44SJ5hf${U2>6IL7kx*PJmYC*#^#0pBC1-CQ9_pv;EgujOW-lJ4d>NX%
z%5AVNLbX|IxXwp)OH&zr6u%<~yG!hTN+g{3_wUcjmaVHx_Vtz~)BO-`0%j^)Hck{G
z*Cnj{!m4x0*Y6T;!3AqjSK+wn32c1sreX$ENs9LhgXan?!FPK$?q94FTon_CUdC+B
zNpg(`ogH9{bqWFv3$-)%#8Jp{8drtwHH^`fx0Gu8>%z`hgK1QaT^5WN9T;bET-q!H
zl<aJ@kq;uaw5a?)7<_y|lt5{g6y0SzBi;|G@!nC?qHKPomzkJD^XC?1+jmYeD%k<i
zK2-GqY5}vw3DFBVh40)=Vd%r^Z5V(th0gr#kL`B-!0HLtqdFiI4G(1qUXFJ7`%>pY
zs&x+NyRnJ4XJToYu%|Db|BBPwp^-InS_`ygNAMSoOg*rb4b2TbdX2ZU;}+?nti~rd
zGJLbUOuRb1R}cryWCM-fukyzX9f-}5O7@)=d)56#Yc0^M5SkE1rmNnp+A=jOu^280
zTf$TYM6{Ak?9vu>)ccw>c3#6-EYB0om#Ox|n;xIAVe6o^;{1uz1C*2XI^)wci+Dm&
ziyd)HF6^d)^g~c?U^tyT@7QR{%woznogmDWGHw3M0lnj}?NqNdE_|~RFA^qwdu!fg
zXjZMKbrP3RwoJKG>_a6&Z>mY_YI&t%3e+P=Co1M_Ek{nbrvgoUT5t8m7|n<{Tew%2
z=lSE$Fwdm99N%mKX#XRmW+aOOQ^hiAg$$R31p9d}nCEoTZ59PNcc;+f^J1){^FM3)
zPaN+9ff5tr*Fz<^85ED4=%uw{&(PG!-NudM-zXySj;}DyQNScADI>sE5d&})g!fhF
zQDl}ul=6%G<5FS&(8NjC^kJyp&brRC#Io;*1n-f~?iWfIbG^O?fu>!qKV2%xez&7K
z=)&0W>H;taS}<!Ao=YiB@4WCv#FyU7&S}`4BAD%IiMex3n5&&}$v5fDoaZ$JfxCB;
zo|Dlk<bVMwwUvy<#?lpZoj!xmPI7-oT~NI*k{Z!(yFj@QVmv+Gj~_;;J>%^RMpGbJ
z*(vxFrEbz`Tziz`Esh>x#QJQlfR_suc)KMCw;;-C3wlC0a_4<-bkBEfPZz1|pi~u5
z`G6Ksd4c8be3>uV!TE1Rmu{ZK0$s%<pfXD|{`=?O3b}y66N2G=ygB@h?BHYhT_z^W
zRR|j(%fo9h#We$>ZanFIr5j#iDJB%C20~`Sv6*!zlAu>dSQE3Z9&2V!(2THF5+L{o
z6!_eYmgoY?s+T2OMkR(SyPMb@z*FWEe5U$vAKkDg1nx)aQcM`(zhlwJ@iO1Y32-l5
zZ;TYr!>LQ6v`7M^eA68u-Hx6Yh6rH_CPizYnZTSVY=BVVdBY%-;T1kMD>TJSnq$|*
znq$n>M@IOS;&Gc>^<cg&agN$aT7n$4JF2kLh5GAL%y(;ciB=XwNK@<Jc0!Z-;`>k&
zVe$r36MJX_q^&55X6d!6Wd{peZPt%cuk}~@NtuoBZdMEh*<pVjH90>yuM7PSci_Z?
zXD>(wHipFNlA*>V)Er~8&-fBOQRra2$q{B$spen)kw_EJi(jcM)2<$3qQjtLjrrZT
zjjCR6(Bw`loIef4dA^KT*`&xZ53{4^O*to+OSg9sAK5dNyK-EpGINt%`7amh+N>4e
zA|jj@iVvX?HGYlf?Gbz44`W+q?T+&f)omaD7N0g#3(<yRKHOM^u;+E=CFCpm9Gkpp
zShS1Ir_yMP8X@<C#l$K!LD`Fp*>d8&5W&O!LK+JCF8`Fwq5;u*hY%q{3i2Vc6agkE
zf%prF>WhuOf=j9A35a`4e${L935Q)7pGTBKS)Z+^2L}2}Yg3$9sX$f}j3N2XD@f($
z_i3XSl!8wHdll`0NlgM97LtS8hWV_ZU^Sy?2ZoNB6BV#ic6lLqC&_1uq+)StOBSH>
zopt)=K3fA3J00Em1Ah%ChL}7e15h<;B^&*!f_^iO9t0Kxk+2g(LYMbDN5j<7FR!UD
zr;)cEQe*m8?4pN|Z#>(o>1|`)KmIgQO8(e>BsNe*>TT|NmpK1Nj1bmG!sXe*JnUVx
zgSAcP`sLqgn9=qOx@OMp)Lzp;dlw<Jx`omAELT-ALd2(xnXB(<>rQuu96j4Ld~)19
z>lI$vVCm<wx)?0svAS5SD~HYe_-AMw5osLN!}vUih46A=;pOnV+vaqIysv6(1bf6n
zj;IKFg|1E4-*bsvyx<#P_V~mv$~@!!j((~|=k>f@U@ZZr+sI8r4@Xu9_R$1hsz-mH
zPps5Z*ufRn6!*n58)-yIzxu$bc&#-{y(DgR?>+y;^yag_C4D_YMcYf81x$e5w`n+5
zr62!rM<o=vhld(wJvgwHq?J&L7{%i_2%$V_kq*Bb2#PU4t#|Y=2@0rf)}7H!T{eh2
zvQJMMTiYS%*WY`ghZqwER(~?oIlvXpe#mzlB1U)hd%WWK4C3uQyJOli>1oc+kMIe%
zf=h!JldGSW1V2CaAG;F*oxjgZhOb8Q)Yh)<d#4~QPU`F5rK%BKvSc&edDOqy@o2n3
zJLV}?X?xXt&ooE?Z5uZ5l`Ab}zTRn$;Mvyl4w7k{<h{nRFMYn=VV3o&<h7EZy;BM_
zzEE6jA2?&El;2K1E8y-7+M3B`|D0+gx>yG;dki3$ftLjD_7(5}%A|()q}6P2M_UcV
z(>@(IaW~yzg7|yY;ZL+6W9WBL@VTh_wO%0zoF^{$_t?z8Ca|(XRcy5a`9ALJ+73Tb
zYTiFYR<req{Z6Q8)kGL;i`Xf8vi=+tSyn12tf3(BWkC45nVuL8vy_{hBvK*J8xq__
z@mySg!Fdx)TevM8nB&4y^_PfSIpqE<E*X2GAGS)Ix;8{d4XR$qx|-xbL<7hqM-Cvf
zw(KR8$>Zj3^&164;fALZDY3MuS(pV<*|GB51^2^{9Ak_|ev+P{B<;GYSwPHaV<{M<
zOO{=ZDgn4<ZLF{!e{>ngF;NK72eGm^n7aGA7{x-oxDZ(sYUd8+6tx8YJZL4_7u~+n
zqdlbv;&|MDs_pJvGVQ>VDebvJBVANADOPy!24Xo=5}&>VgG|#Vx#XZ3<PSSUnkAl0
zJnkX15;2i*k+Xw1K<q-5y%#*(6w;(FjjG{q6)@_VW-qe>)2QC)#GxOl_fP)OQfdFk
zNoYM>SEtx$7OlokvKeC2L*9CgeB7Q`V6}Z(7Zvmfy6o;HyG+S`yDggw{qgY!>+2`x
zAxu4ke)xScki2My>l2-{qadznNz^B;FK`P9g)a;u$YAP>B<<Gz`BF>Ewby?^+538d
zT$JYi7}7k-h(@e>jkokMAP7$rx?$QPgwUytCVR6FJA6Who<D>W)tJUK!a8`%4`tIq
zp>NBARRmk4WcKbJauAj_<3=pCb6}T<O9TP4dDv}9rg&QlxJd($K&bEdF$HIW*X<e(
zUegW7Oxh&%&M{dLHt+glz91<cP<G@4OqU8V6K3EJKH2)LZ!KlrI_Kv#lgjh90PHXG
zYa?}qhBQ#?HxC%gC;ooMen;FVN`xh`Q&c533X|loBA~$yn;WR49r2|+B<{_N=cTld
zfcXUI1%3x_Uf8p_31=V#H;JO+%Vwilw)r#dXm!X7k`Bedj!2D^b(fb4z&c^}wktk0
zP3smPK^GohUg@TZ8vR1>h5!d3Z$@aYq!&EP-%tsj^}GX-8_06Mp7Eg6pV|iuc^dg*
z&O6zYeQcQ1;Q7d9`I$S<10(Uz84J}VZ{Rd<6i68j8io0e*pGf+4)u=MZlBAypXd6N
zz3Y~Xb6>z_IcxzU5?z!4bXlfAIZb8%9<heh*?*=0-Yl-t4=4Yu!x~R*OOjy_s)lk3
z!oFOlElKk^2GQ+AwJQl#>sY~j7C7-UnWG_h{w?QAofjF-UQHhch-)1N;2Saof65pQ
za6#4xjSJAj84Xa9c1)RarP`BvTE63ThVJKjKYcgeAB?fYkGjK2q*qGy#WABMXA#lx
zo~3;Ar$-CtG=qP%Pz8hV%U7(rX@BGWZ%y{TqqlDEWf^d-NsX;Cq|f=J^G{9l-fEm@
zh@l(G&UoV<5w11V?{>&;E%xBAcDg^LyAP<kU6CfzoAx4gi~Lo3j=j~W(|kR4={$jU
zAUE2hv}8e$DhxIBqdO=m(@9;AgT;CJWN+6#;O8il#4-dM;IgjFf*5y)=!N{#t>Hd~
z!t_0f!t@q9FQL{sV<=@dn)Z%4Gz{e<X&r;D_f`5NK6-EJxWNUQ&!%jBLRASwmWcjn
zdz<(zy(8`M$N!??V5n5Jbb6UwgWKKvVfL*VoBByTCn<~E^s9V1XuxBlU{Qw1Nv7-s
zYoI~sJu}an`J(^;w4HyI<XRis17fj6tyb!{q#>R-J(gtCR=Sf=*(V-t(bZPCKi>SY
z*^vlC4UXiz_Ps5S<e-X=6v>Glcd<0j3F=e}*)@fQCdGl7Q@#s0wg{PDyMEF-vt9&!
zzp_3IZ_0t0j(YKbyM=!odqS^LzC&h+L(A!yQ9aZQTfCVzE!MIBX?xP^!!PR|iut?8
zCTevb?>c7A%U3jK3dccmXycHV4B_F^O06n~uWB+b?wqPHon97oj6D(A>}qgZu#R@d
z87MfSC=ve+*+I234>BF$PwYzcT36C!KCO*fM#Xa(f-1{`r69h*ScAwSIi2AHIqQS1
zBA;NFV@?h}^5JJGBemZs0qvzJ^xPLU5IdkB042hJwyI+Z4W-^i6}%v{H^@-xv#>6=
z4Fg|GIzQh_ug&}CztM_~e_p7&F;Ow5VW%Pg)9clMDV>SJG|o7IqqsZTP$2aTu>`L&
zp7qMq(0_$%zH<a{1=HS=28K46Qwd2-F2cg^wUJpz2i~I~M?-spAGejIaUEs(Zsue{
zTpma+pSA>DaE-CLM=nFA4)&crU28YFL0s;d`&UC&rFreMLRPKawnJ90*}7~DEv;&z
ztLq&twLZ^m+=zNwL<fpv7QIA>0g3BumBaNkb+J*}Y%@Kx1Y)<X(H=@8q25>3>{_0W
zLV-^~P_jIsuHY0y(>SQuKEe;{_MjkV{xdPu@#ZHO_Rmt(6?}|5Jyl=Y<+6UDs|x~a
z`sv>Mvs*DCZ2Q34DJMF!wGRckuC?7{B`eUjKkC+<qLptg94W5Y%+?5iCJitm6)t&N
zi>&zObbWTkXC>D}1$8y##|tWE0{);jHGD+_VKz!fw&>g5;YLY@(w)JLHz=ejYJ8G&
z(TGx(Zy5i3n6TP@HQ^bGrCDtXHPPZMJquoo**jvdBC-Ni_*LS$;A`TZs=qq4%~|;p
zJR3jlgo2epmxaOV21jU1U?ud|>kZep{<BmtxFz-bS@*ZBIuqviWmH!V<NPD`>a#tI
zRy6wdr=snxrgBs00WbD6a3J$x&!{oSo=(7@m4sY)3AH@e_Rc9wcs|LK#lTqrPMnNr
z+$LEFIme!3tR$18od$MxYx-#|!EANeA?XPYKDimi-6<s#u*OkXyx*s9Z6pEbj(-h3
zDp2gmo-;uR;+ArXCx5^L=yA`p&p{$0HP*P@@NgI=&ZY(64pCnve$^9<6KaqGBesVS
z@!$h>t+A<Vz@saOtJ$09KpVnZ;I#p|c>uF_$ppNMdO4`{Pqjzw02k76ED#hsx~Sfm
zUCl$e^n~uP6`U~%P~J7=g5?*5VVi{ev#^PkGG(NdY$R7N7E3noq-Nq+&gOH`@p>!&
z>qEc#OR+jn0$r#2PLYZkcE4L%al{W*w!*dE$fLSX+Obi}@V*-gEp0f<=VoPL7l*`n
z0s7y(=qdhPS}H5xWAXcJb+JYAv!Yx^+x3pz`EtA=och9=wDoGr{XB&J3PM8M3PUn4
zdFG<(N_i0_jKaGD&<P`SdTv7!%SfeAc{bX-3E_>>BU(^7qlNV#_;H5gMkp7Z=pEDd
zFobEU2FIlOSc8nkL6V|c%ORkH-voF>h=V992lHegH>c+shP22RPK!^K>}@|(nupj#
zNf;?UQA6Yg@da<!xoulxSM0xuRE1TBXRs7X7mVovkyOuArDj&T$5G4oinvK$WK|p)
z5RSrsR#qnyb=;s;`m374mH}XjES2=NTR)KS=9&ipZkLyP1G90E0o7(*<`4fmnLdJW
zOH^X(9R~$DD?O9*$(SP3_1uR-C8H*qhs06?`2c41Q6jV-Q!&KQ)40<VfHq1&4S}a`
zlX(Lp*>C5EPDlqPxoGyAAbAXV4A(|(m&4_PQiU3vVZ?SY6idT9m6@nmCo7~nSYE42
zNPzl|-E#2Ds0{zD2*-;SPTz^xePj7_uIFq9{`e}SGNqjoJ0Ye7mSGzf+=Z{l9G4MX
z9H1D?X^gqRJ*#}VOs}JxssiP%8u0;IO{J2?WR2wnu-8IHsmL`RD;$EHdB|_u>u4gd
zP<$#w3pV22d!~A-mCYx%z$Cv;wBH<K8FM3<*EHcG{|?*#yW*L11%9*ahT&-&=hAGq
z4ir$s&6Q7g8?n%d(n3l`x#l}Pjx8vM7BB#Z6p}~xHyED`>fdlLMCnP`Glb(%IkEG4
z5eU^#<b*(}Q>kNpTq+Fe97{vKz3J-L`GJdmT=<4bssm|XvWbSr`9Afj_EXBBr5v5w
z{1TkSYjUl6MSJUGgG6Li4GrY@Nbu|X%l6LKxRWJIcNf)k?X0nr#=+do7euGeX=>WG
zyMFp0BC4IP;VxVaffwa=s1EvmBK-N;G(<HKKq^oqZcxcqf8ns`RRk{6UC*089+l6Z
zOUGc`X@!{sP_UXgWj~1X^kuBQ=xp?ag@sp(A5$iHTWOGnm>>_Q)D~+hxf}S?pqz@p
zC}cDXZ15&oZlbq)fca1!mYm4R08S3>Qde*qu!}kL9WEETjx9#4LBl6@E)i0G<m^QD
z1KrXX0TjtyGgw)-$M)B!Al(yg=+o{}dyZS~<v-QN`$0WwcAb@Bb6zWzYeqjweG;?5
z2+!p2gs8uN&k}i4CUtg8WB+_9+CDe33jwSv`t~e|6eQYU4VEZl#mt8~v618&V3#z0
zYnJMQ>y&bdRKW^@zh6j<fmL&N$(mV1c^~o;mCcgzJIkE3#`;frlkW8Nd(c%*yJi9Y
z9?JNG3db@wTx{-~Mpf+uZvX3*=g>{OA02TSHC%A5rE`|ueN!Fjo!gY0yhxfg#5JIb
zl#8+t(3fn0Ti#Ci2~dmix;E`{RSv)GYW*^Am|_ief9JfvHz$X(ahmJ%eda<kJWfF?
zW*+lNo|=WwTv!%>qXQsIj3OOD$2bMgh&L^Af8Mpb6(cVfI7FQbYqht_XknevmU!~{
zr{Cihy?D^8NlV|P``HjYS-)5YZ5jVFkJ~Nj`>pP}z0-RP+gc|LbV*MVXc4@)AqDs(
z#8QXB8BLuP=_nYBzf_LNaLT_#0H2X@&VN89!Yq9SOhl$K66ABY2NxC%ooH}lFm)kA
z4@r97SSpU5PpA+Th6TnA(wo>T|E`kO!oPfcVmv8&{6_3vHhR86PxqISNVBV_qZLWZ
zq2pV`{nq@~N>@pzJtDx4l9|fmC`v6N6E?U_gU+{7pS8<GDD#44s2@FRKKpZ5S*tmr
zo&38I?O7+s4J=laf{blUuhIzlD%fiYghlSI{8Y(1dflF|z4~x>A64O~3x0Hz02gRw
zXDs>T`Ao!@TTOL7JXRhbA|MNog}L56SC1ba*gDXIx^cb5?+Q0^t>;Cd_tYymGop~a
z`Y=ur&5^UsyXq?DdF3i7|3<WM*l?)7Qt0Qpno^?*jA1-r(*?VIVSD`{tbjc%1LAuL
zoU*GB2F9{Vl^JT=bS?(}9rwC?@wdxzpvKxG@rwC9Nbg^JP6a{amqqkVw+-TnVGj_l
zdwjzE6~d2)YZcaD9h{M;0z5_od6%LsK<2H$F}F(nq4RJO!k_%<vS-Wlby@A^V@wHC
zyR>+(gYhz<($!1RyHk=A<Js!LLI1L{xbEy+G#<<J9#6u%a3q@XC6<V5{y-@0v$Tl*
z{~}E4%3^qVZ%&NnaDCz`q@ubgd-kDgSQy%|lZ{MmVOES5`mvJ;d-g8WC|T)ac0k0x
zwY-dJ(&BsZqm%ovJ4f#Umvp96PsnOkX=kPB<T=@OAa(z4c(22^?7)n~#UD!_M`?L%
z)rgBER%T&moqFw^MsZr@0_n(s-(L+%3CS%GW^CP5VA)v<E{@uU&Cpy%4hE*u!Ld0k
z^b87#7^vy^{P%O@ocR29%{Gf$Z1fDl$!`vgo3XhsBJ_+(&YE`~hgUnXu2NzbB3W#a
zh?6x_nd)*v;YW%^jSL<7>TZV_+blS%I-J>!6&V^z%lo<vkWqThY5Y4T*n^m+rOrS_
zSst5Bd~@?$^_35(ZHG4NP%6vMs6q`)veOmUTR2I}H$gLk^ET3DVuSviH`m~K(Obf)
z(v&%_rl6B_c0zE68oJ#1I(E;I&XaT{-o%YsqFQ)@F7SM3z9$A;{IAh`DJXLF0~ZLn
zlOiY^bgAy00b{MnqvY|2D0~XL^i~c4<G$w*lp4d_3%m<CJ1FFnx?-2Vij2x0iPK30
zmFm-(?h?*p@O5Vw-{o658J+A~JInJbX+T*S^(kHWty266r$t5`BvQ;EyY*5d4Cs?b
z#&IgQ=vSqkad;U|q$a7)en}($8dV(dNLRd+PXBHYTZMX?EvbJWVA;W53y49of4sRE
zi9BGoY${bj9=tu$N^Zuw@=A(}9v+xw%4Fq;kt8xy<Kypz?ONS5w!4RM_`wD3;I>_H
zYWhbnx1@|LNen7YxcI}tkZEvp$T9_>^JB%ee^0%nP##r!ofMVZn*Y&F7UG`GI`gd+
zYt<KpA9GW#Bz5X8%G`jND(77ENxlJ!*&9$foGb}HJBWWK0T3^=x6%h{U;jQ?loE0o
zU4X%!E92(lS8lv%Nnu-L%2kRp1Qh1$W+*e;SQGO#_Ugg?)4O@9Kibs!v7DV4K;QQD
zWCykS^o(0xvMz??xL1?Y(TW4W54nUUsJsR>ZaGVTQDswgCY4MygU&&O$bsPrB?H>S
zOZaNwm=WgzgNQ|^{9&L6A)72e*bD^q-^vmRLLfTW^7et`8%L!W7wsG56d1eml-*Fj
zJ}k5U!u$#F)awnhcA&;HeMA6NE$xM6VR!27Fmn#K3o~U)GO6KMJ9U~Gut^U6rXZ~t
z;T*jt>NNS0RcUvaz%a=Cr(U;D)KkmQ`ShbQ;};M&z50KNb-ew3_Xl>ey9l5cE@n=f
zaw>n*%D}b!+}wZgEHN`1Na0={Zq3Y}?9!p>3SG7Qi-<Mb$+n9owI?w91Z97FrB>2B
z_zwKb`i(LR)nPhm9Zac<Cx8JE(v2cSN!U;C^>vJ<(9lmIDlib3`%m#|vo#xNuq3lz
zJsZWiEbgo>vleo09Cw;(8XNdVA<Hs_qwzt$Y;MB{Q)zioOz?vQSqGJb*7_gD-Z4m%
zs9V(RvTfV8ZQE5{^_Fehwr#7+Mwe~dwp~5-opa{i8!;0x^JnFb{UakIG9vfNz1Q<B
zvTO_gV>Ih|)M{1vy$PzMUlUhue+a{mg1QS-ZEqYl!)9ErMNJRGl@)H$wHrdwDLELK
zgG%#`$b`R)PEbrjr>Mqt;GS$ypgqSfkBE2?_TCOcPG+UtYzgq$Igr#I*RV-;xWog_
zCIu(wA#`I7=FME}latjhawb^f5Pgxj4F292J?JL!KN&D>zWyC%GkG;y_-wH{FFq<Y
znb#PSeUJPpN$)|t?OJ$r(nE=>i(iEXG-zBsMtaDyVg3budoQIi<oY;%=eMwOGSk{b
z(z>N0hM{-L|9F6ZJe=m4H923nfPZ93^Ya)0V~(93>=68$k=j*_>PYP^BV?uya{vwS
z5!bGYL|-Gym$_=F?^j+hb`{O_4+hOkBu-FT)`A+Z(+UAA7B7Wr_|i5omx~+3N9Hve
zjQ6040{<X@9ffh#(u2*_(vC(X&-{dD7j_<6KS*k%Ci)!YU2)~3^|iriMDkrom&0|7
zbSN-cGsYrq7InpDlz<*p5z-9`ru_3;mP(!0ONUtbZ-}8!ZJi8brJ>Vw{B{IAiW*-d
zeV=^ML2ACANS<8FS|2uwi`oO3(i;#`UODG2NICSJ;uM4WiP&QAm424G1I2kSDf9B5
zn}=-}3F8f@W1hJ2E@k?>MKl2}LgjUHG;G21%zi3t1<kU;7uzXb!81JoHc-XeQat3H
z3P-cx%U{{AfYSPmO#Vq{>V`9ga9}v6BRcX2tg-^oQ@qb*Q4H=YIc?Y)TrL}{`QQf&
zq!F`xC{@M?uD{zHU~jC3tj#&*3j^F*2WgSgyJSJsU*3|_!_NFo2UWwNt`A=Pv`z8U
zk#2mTTd5JN`6yGBhP0aZG}hhmNdDGYJy*9C(Ob`|<&yWyK#*E6uK!B49(;p(C`-G{
zj;g1P`#@_UYkT3yL6bP!(b3eX&`^~>@I6OMpF+knCmtwP53}6LK({-pYYRebmc4~c
z5kV3Mk1{1{j4y^lGQ27VOtDrnK+tSv`dlRzoi>?4+J6KO*)oDj-3qXZ-eSMY6>C+|
zygz{81G??Q)@nrW3d_E{7-Y7y(&E^-Y+yVcUQBu?gQc;AvF5mRM$yt3j{aQzGuEoD
z7t*aAMNN6#Ys+x5&V^R7WmM3MoGEcX!+oN21`Sj^dcuZ5$Vs|JES(p=sb6HsUn3rK
zuVOl5!DN1d#?~C?WBez`rCW?L+V>*J4}pbP{Qk>ogP9{1h?ps02ziRdus$4nCVhXM
za7>1v$xj7#zojoUGuT7&PVB*wt~{hjrG8ek)N9-@1@6`18WYC#FW5EER#t-}aWKxi
zDMt^MzP16dK5lld%)W1xC6TMzwGzLo@kUYIh+~|vnZ^oX6bnpIp+Wa1sp(d$?0Ly&
z&#o1e7UV*;p<PIUA1`uH3LL+xPZ|R%Ri0{6PHb`2daD(Tv{WD=rXBehS$vA^a)MzD
zKi>jeKfDQYt?vpuPD)I;dzNXwk^p~D+Aw4oJ)e?fm49T@lR6oFJO`-{aYkkKn?RWy
zGE`JXUCz`L`BIG~6ALYYy3zNx9SO!fJHwvgi3I^i-c$~g6y%olMwNk16ncULAa7N3
zS0oeo1UT|AIEQ>zJ2n}IJ5^64M9`StQ4E8a+wo$tOSpm@PxD=B`SI{93TTPRo<kMe
zQVVw?Q4TIqQdAT}ZIt&&<;;o)n$j3*JZ_Z?-F+Uz2N$Y+Lt8j>P&+{)a!eFtJ`vqV
z%D>yDw8Zo!U?Q+Uox_bWx~^q`N6orK#Y(&6?|CUM42&H2s~|bVab~cZU=Kvm+G~ug
zY-wV(3bV+Kz7!D@&pxmWDyI1|77;Mozd6MjI3&tVNU(lhp%fyV(T)Una($ty@JA9u
zlJMy1^iuEe!{~7=gOSxt@FK}z#hzQi^g;Y{j*~+5R}r50v=9{=-Q)K+Xmi(Wz(3MV
zVl?)A7QW{E1C>Qva_p0>#?ar%;duv7e51~ns5i9=OI)C|osopK)7e1IX{&G!C!KOm
z+(G2@M1@wtUj7AO6sN<!dQn2vv1erLJl-ZNcyO03w`ogN_+YfO+HT9X>fIE1L-uC2
z+xJagCnjP*$5hUYAn*ww4s<Ox^2)I3g{#9SaO^Bul1f99<fFnU#Edh{)UG7=7zZu-
z<>{sSScjAk7xZ-*XYy7JxX&l93huOU#k$?Hn*|~4NJshToNU^R?j+?P5O;`HPtESB
zyo@mJrM>b#MWZLM+z_J3?I23Gax=2pYZxd-<e=N^?6#hP^(h@bH{iO@Xl?eCVKx&u
z@XC=Ut3(a(kO`==??4EPuAtaocs~X2S8Im&23r-32|^>0lF~nCL>A}%y1GVltIc=B
z>aDh$jXEen^s21&m6UTfkaU(q{7P!H@b1=3DpTQX+8e(Ms@8K2sPwxac$#VTw^V{%
zA;>kw$$u}HGO}a`P{N)DjKy3f*)@aNsV1EOVCV(<(Y;rcuv&HjF#OwN=)9=C427>Q
z+L59AZWKd*X5dB82j14dL3LuLCC-2Yfx)KLlcnnov|t0zbW_}OQVKMXCQ?o(cLP&Y
zN*V{Os-XYC=pobUHyE61umJ)f9Pe2M56BjBFHZM0_(T1HSHmMF@yS^W`-I>@BDL&!
z%A0b^oAH*_TXGsW*YSzgbv8hl=hfM+mB4;C3jnD$PO>idvF5PR&fx5^kMb5=iHcOH
zSRJ01CjJgI2e&q@leRq|?5(+4J~6Tyer`dsZD=~F4b0?YXZ!rN3_x*wl`NTBwYTT;
zs<>~?c$z0CfN!+PW-*KYs7XqS)jdLjWBaWxSvtYZW(`JQKy%6>3a2n|%i8q^V6V8C
zU;ff;7JGF7(h|piusuoXT}e<ez97w=MP7O#3TcL;j;&MX!p~@ja*y-aU6IZr`c6Gg
zATwSlNc7-5QB}8JN6&jOTyV4GS|Mg&Ia%fiY7nHX_FxsX3K4Fqry)Z;5NNn+9ubF*
zC^Hlvc4nT>jpRk5v<fu9yySYh?he4WNz0j^T+MFM6dRRmS&}dB);*w$L@v}+5;nMO
zMT~*A3G}u#;xJ7WEv5Ojd}<iFJnLgRG<oVGJ87n7f(T=OS3z8=qsa*E0+YW)2v(jl
zvm(wfP%k$W3AI7q_%H#kBBCq@to~`z3@(d?wt-6EG(qHnQngipcNsOsi^o1(e-&%<
z@)Uf1$SoTtK*Bvggv$eKXLl<}SaRKiACXYc921?wV_I#Uy;YL8TjGsC@{a=cZo7rt
z??h`;z1;R=5t@Rn#4Nak(=M>-x(fBzV(K;A#^Eo!`M>0#1}P8pXmYZBs=;+x8E}~-
zl_7RK4IrdKBkxh%4f*A#+&bw&G86P)GPy(uT+F9$=KXblXqFcX6rD*X%yY0wWlQ0O
zJOJiU=>d@<5u0%nnR4kFMpMJ|<7zA>f}j!h`s@HEHp*g__t?|6sVcE;K_(+A2%2tU
zUqIv>HDXz_ONXL;F*$J(3<uoqBqo-DMWIs%5wNN=*gtI|a0r^XQhD2jmc>rFkB*|M
zz{;vvhfuw38la<;l3$pLK>#sV>Jg-G3gQTk(vVz(CF9vxPztw=VVn-%Flk2Bz?ZG?
zh7!LFvgxTBGWj~g2o;Grlqn80YL3}zqtaH^JfVlNCB&tW;n6@obUkw>%~97g%RzMV
z!5eO;0ntjNFP1{TSi9Kovxly4ShSv*r#E!C-!8qK(!C-<8ph_gBRm$j8~!Dntgka=
zeZ3<+cTgVmiQ_lYE+nh>zxz^2o;?Qndk^6UesRM33k>{PrNE08olSuBj1ryY&v2xF
zpQG-quj*JBRx4?WLde}6C(#V(>xs7iw&AK^91Zqh5fu>z))sc>wNe05OH>1{iYL!3
zjkMfgryFb4jKI(0ii$eRjbfMibA(FWp#7Mx*7e-zkWeGi?%3^88>3O(<YVGXtK|J|
zv6HA18iFA8BA<9&K5YM5P1KMxHvxYaKGP(6#%v1$@8b%mZiufz#(gOd103r72^=$F
zU&{A)FM)EBGKtESF1!oN^(q~Jw1`tsquE7|-cOFc1gz6a1Hl;lOw{xbwxFAZ7ssn`
zd}L;08XXo2YAofv`{0fr-3Q(|mpB9*5oC=KA)H%iECr^;Z3@7`ie(eqF_JUDZj;}4
zyO~+$l<pgs&K8Q0o6iEqRhWymlZ3~EmNL4An`0}WR$SZwtmmN$1`I}?hQQl!lYklL
z3x+%!pTe(JfM^caF@LeR$(-u7TGJE0WeKY8SNYen*M{M{hd!{cs~7E|C-+zAu{Xn1
z`%DC*H04GA`yg4eMBj!ToyZeblAX5Ijd}w74dARZCF7jVaOFJqA%}#8R^2NBb0fnr
z0U^Ml0U=&DJeiO>A11KPMX&F%$ga_Sl~+v`c+@@*+9kouK4dDvIL+CGq9eQ|WTrKv
zvBu^FZUzcdycOX5K_uSlu-h-0@&*e*|9PvLF^w3IK+U3TvYk!6KvCCOSz!BaXx=@#
z0bN6+1j*8XGI$}v!D|Hww-fRHAllbCiNFx?#@XNK46XRIzpLSJ28`N?_<E%U!E;;t
zb39h=&>|bS!`!4QEo0;`Zc6J9)*Q}f@=UUeEMZqJBPccNKC8?q6_Hd}lcsDDR#>A{
zh=i@#8mCZw_Gy`H=$zy>5{0&T{n>4^&>ES8$z%C5>4il2Cok(JQ?uo&v0~trRrH0Z
z;~(OjUZ5^FtuYDL-UcbfYs@ckvEm!6o_i1Itu<J5h%Bi*WVeo4pMt8~aH?`wIgcFv
zARiPv7BeZxB^P2CNw;NKK5UQ{^;Kc(2<A_A;}(ir8&d-Fjj!eYU_&s?8?<omD#&de
zF#c`o&ntB#LjtT?KQ%yqr}7q}PuS^)i0ICA^(3GPU;F|Gv*v?+%K?&?RI)W_nCNz4
zg%h-gg~%{H(aui#8l`e1pf2xCaFsvg*laP~qZjuaCWWuHn{!)Z4M%;`&S(ga%(N#R
z!zVc%i_Dao1b;gD&z|hhaQm(MM#J!!&#`%%aQZDi?!jlMU8%#gjXl)LsEu9xEVBby
z{F<fyXDYcCt71lg;>qJ@u)l%0(^LAotkq#ES{gl?j3Zk5n4v6gJRUB)C;b+gK$T+>
zC2l?r5nSr5{)AOemB+<i(s(%s(V@<L@d?{)a!My4YIjzh%z8OJaQ!)565`vo*WL;|
zUB`<s@dLZsKC3;xAuc$X-DMIDz+qj7joRms1&6|N7`M6A_CF4ov~7>`iiF}YZ)Taa
zO&1Ef(PeLIotloiinM%CHEcCpY2r0(LDFIdfVEP3)Z2c3c{<`IfRQx#%N)^&qX$!c
zz;9fJ)4uwT2JW^jtut|uH0+{Cpa<`!!e`x3`coOo@rQbquxwK!+^V0cv`QDYtL2VK
zkfZ2p{Cdb$#c)3JRO4;+p*#u{x^T&Cflsf(8ZGS!P(i8DIrIdl<1w9}N@MID%zwi=
z#~|*v<+VJ!Xn{9HF0+*LI&?9RU$az|`?XHpUw{wiL@sR}Cs*emUzWYbL9!5=sNJ{f
zc)1-4P{?(2ojalp<w-lHQ|NTtW~6gpT;!C`>ns&FW4|c3aVlG9FRI)rQ?q|34cXho
zo8Ed!K?;-dNKdu{C|}Fa;p@ymSo8Tv)i_b|dNJfAov)}SpxRWhhLW-X4|Hu{`=*r`
zZeTksDWqdK)H{s?{G*#ObsJEJ1c5vHi^U^YJxbC{Q`k3W%&#^G3<L}<4X#%`)LOm~
zfM#0+ZBPK_qO<WH2M7Kqf5N^9x{vqF4VwC)YCr!2sGsNj?=~Zhvnu8nKbp9N_+i;m
zO%7H<<H0i=8kbs*LdjrEP~apxRz35IMNZ63zYC-*bIL5T!zUWMQG%QM0#qKji3sSk
z4BJKPm1p(IMk;32YJT<J=?Zu~0^$_4FavK}DjG>zB<rMh2sX2oUU`VtL5wJplTvy!
zw?kRZqf=+}$e#84<aFsY>0AK-0q!HGk=jpu?R)z3FUM>7r+D3jkB@5OIiB>&%*MOg
zM-cOJ^#*p!Jej)YN)^dHsHpRcad>;-!#a1V8QEhwK2bJo%n`z>$7RG{eDesR<F9cn
zvCqU>I@?C3_WAuVNuP*v&`hg3#5uHi=DflBxv}ZiKUe#J#S*5Cb!+T{&3)9O<eV&!
zat;9P#(RE>g=<U-RJc_<qDz#qBr>DB5~vP5%M~HN#wwW$s<Qs%s&hDfG$)66bu|NE
zLaq`(7~ZOW8A6P?7cnS<NG3nX!oR}r-@L3im308zGQ}F#=8uGN+jH~vDK^ZYON5gb
zbKO&AT+9~T6iSe|JUenN;RzV|{mhaa`LYqmu*tAV-aY-Y#Skj*fXh9k=Mounyg5r1
zDu1`&9I1n+`$&J?*=lV$4u8{8EdhJlZ7BG$dc+BF6O|pb(rN{lHCQM0iI^pt_sZ69
zD4}^t*Kf#!P)H4Z`m>6I&Ds#p4Xcrr&O#{I$C$$~ielxv|82=u?Fti2q{Rh7RyMT8
zRmyV=q8_6TP&)-oL&A_&+H5Q;?ii98m><*9mu@nw({`t-l#f~hiR3yRnH>=8ggG90
zUg+Zd(X{x$CLg8=eLpMnk+F3Tyoh(cAv=qWe;6=>i@IExYZQT8XOZ*ih~B_tnOVKi
z3#5n+LCPWv=Folzxo9LRJ_l0&5(R)`b(wMok7g+;lbWXMK8c&tpch7j)J2G~Wj&Y@
zZHkx^2!9|Tt@GFzlZ@?ska9hO&m(j$rPb-U3~&B}ZFMudeAh9w;7E*oaY2GT{;ElT
zc>-l*J@K-b_K^=(`Xhm{Oi{bCVD^E}yoixd@E$!z;I3#?2Daol+O&Nz8KZqpvwsUh
z(*;>PC<mk$uUpCjXB6Bs1zmqsVTjBU`k^`*zKKR{T?^M){Fr*$6#t&&QAy{++jP}q
z?*0y&IsnT$DJU=qyJ*IaPt`>d^5R2xBfu+Cu!7A4FNh66*!_h#!7p+fhHJQHF^G%2
z8Ncfr4!UA7_I-wPT}H#|D3tYa?gv|RvxN-89Y;>E-1i57cggqV1xX>o`G(amb%OOs
z!eMX-zIli`+yk;B;ppE_kc~U*k^GM6c7t^=3y{D*10smWpY<4hYn?*CgeX@KaV9AI
z_#nvVH<ay_i?%q)I2!PN`avmk%ADc`0*CG?s;=b$pRJMby=tfrHHGGOXgwZP<r6v~
zG~3kU7wYx=957)X1Bs?Uf4u0e_~J!gz|BJaqfr#P9N)QEFkvIP)BV^lf=1ZhKujVO
zhM<NgZ6vZHeF~P=Haiwh$_>x9G0VN_R&C3(mCb|h=qR0Hn+%1T`fO9N%2ELhAn(Q$
zUP3^+`NQCsgG)t~A6Q4aTO8`SvZ1TpRIin<Zx-$1cQ_F&`ZMLuU*2$8^AM}a+)nzT
zfv<X~gVV|~A_AY-?|{7I50?9p9R=lHRl%)w_8kpDyzGw+`)eYwf1p(E#c>z?*k=bK
zfj{AfazEzr4vCa85VZ6s&W}jEze*AaYzk!A6vxFq-VI0+_^q{UKi=&{+VI=cXjtnX
z-`5Fm(d9KWSa@<83H-&{$iU^de%~1>6=<01ZDy)x+4uyhiO5;&8Tie9X(BNAdpX0O
z7uIyZ;Cb3&USQL3Iire~)^xzo)w^-1ng#1agw~XV$#c|RB=qA5`b;MJ=gr&dGvDdK
z(7Te4!r$~sxFZDWsDyDDyCYm5@j>>{@kuQHOhXhq4xM^J7s1{1x!vIhvyS8<ChqaQ
zVsC>)u--7bM;j6t?&!o$bSKu@rc5|hWhdzz@orMDeycOx6J!W;M*8Sx$V6mzz349g
z@8`7QmiEVClW!|7{GtT<UPj*4Q-=GJQgvz(=u7Q*P=cl6CV)26Z*xH<fvW`2l&)(t
zgB*@0wjq&9IsY~-oMlT^yI-$d5PMk99BnNStUb2~)r%pgWXuU8W0_eN%9|x)4Dujy
zOB=l$llKP?O94S8?${72xe~3pLhYGzRVG-+uTXBh0`j(2Bj8P61gR{6SglRX;CCs8
zJyFv>o$_8LWO<<|1PE{VFy(O_wfp}C-K#25Qdv<n65QHG)!_-?_;W%I;?aS)G`eSF
z`Re0nTHg>dER2pb^*R?>AmYaA6^szJ)>X`6R-H-0T<u(^%D(76z<L1i`1m!UlecUr
zn{Aq=Ic8DhWD?$?V=nIvkc>nN4X&A<Kc#7+JKsEBnV|_rvkl%I3W1uSL;Pe1wdR{I
zF8dIxfXt;f^d5!=kDvKflK|<z-rT`%^+ZZZ)Y5~%lV)%qwc0$3{j*f$r!HYLs;LGd
zzou_I%i76I;;r}fn77CDbLG|APwS<01IYieo8BvNo>+0=N$h10P-d%O-QBADz}YQ*
ztlcvtBYTg&q$2yus^#?XIcrXa4Sj}bPJRTZCXliw25+zZdTkU*<(bflLoG-kemq7k
z;78dHGlq;Q4F9i$`~yP_7YKo5cMlv0!3W?)vI_v^wJ-4=@(-I%pGUg8MM@ceKNpLQ
z51YZgpVcyd0Etp@QP0BloS4<|4d0&E+ICva3EO(hsY?8|A8@iGn*n&>r=GN?Io;5(
zyfY0|hzHF5SJw9h6a9S)*V-6*toNTg)Zup7-}dMA!+eZe!%J-14{nh@wEbx~za4~A
zz)c(1cpQ9E|DibBHoW$^ts3AJHqD*~UC?XrLbl1(Fh9HJ{cKY>oT{9Ibii`_j2%}g
zA6=KA*Nm%AuREn1BF(2oXh$v2L%ZTw0gM^tmldyAs`}Kv;Kq!0>q6A&Wsi`0D|Mhg
z;>{L|N6#G|zkb)(*BiV9-a`%&W<XV1)AaX+*FaG_|8}i#bt)|FOnwnCFl&5SP!n>V
z${@(MPV)!s+<I(?kT;f;6!ybd4**?O7|ac!tJp>YSfkhSvd%LR*5>aXR1I1=0UO7>
z8H+7o)_10F^P!XPDPa2xyh8ubf>5Y`@nRoqNW%mY8GVl7M=^Hpe%bpW-#vn(l%Q`T
zPiMVE$bIIH@H0I}AnbQK@!DEl)T(m4Uhj6koOHrSIp1#047o96_hH6<Pd9SDuI?JS
zofrW!WA7+#>t&+;v>kY#C}DX6ZbLpEzy!Abe9meD8G&s&f-V00`tW-z8~Eq&y5aYc
z=l6E;JoA4_s6D<${CGb*d%qT*1OHD8^&!H)r=1ppf4&`ZHY8q<G#oK$SpHXPRkN;(
zqvm4E?vG(&vKf&2Qv2?X=-kOIA&|jt_h%AYJ*_-XvF?-Z^8ONCa)RDMKYv@WFH;V#
z7W}va>;pfNm<p_N{U<>j&a`Ek`$giDzL6Fn1v*E3Z{B1tsLOw&F1}fRzh|=ESDQB8
z+u<w@X>HthX{pQ`iy?1lYtrqN{_Snbvx}hY=;80Q`s9?=ERA(Kb9$cKo7n7x8}m_m
zB?0Gc*lCrE_dB#Gn1R;MG|r9`7q!NeVn8Q&nYQ~`#i#?8;E!X%+35=$bo~d2Q8xa1
zvr7+g_e+^lR=@x3UK|e$BZ8@)VC}`Iz1vW5R(`lIj0kSw@Y)I3ywHwA7BgJHv^_f@
z{Oe1o|Cb5G!(u$<FiKCg%|o!zl3fTD8lhv@@#YHY8z~7(Bu@T)nj6Xr`G?+&IQGO1
zS*^7>Dx7*QAH$e{aa=4R+%mgSj4rqWtff1&0##0g)bX$IY`pWXCb@>vh+zY*Lgq#&
z($lTJ(ZJp4vtTM2-jg?<2*^g99%f49Z(XkSSRgG~(2_6?k#|H)Hb^AwG8h68F^RXx
z+vuhdM7RR0IDQWw43SurkBbYv+w;bBa-AmT!5H)D=nBhqueCQTiz{qQ_r9%21JMyE
ztpxCaT!W5gF_;z)QPR3mW<)Z=>1KMmL1Kr2#$Q@4dk>5nK6Jpb?#VO<_?R>Yn91eE
zVIWo$UPLNqz_SEM*d=bvWnc`(2=T4+&NWvp!JynIBa+XsylVU6i?pRVNz?sB-jGjm
zD;<^3QcRt0`m7lhPRvvd4%8Ezylb3{w<{@xRp|eX*Vwmn&ihQuXiR85rM~fr%7Ana
z{hVWgjl;<vnikI7BSX~-jh^!cf-5L(TbA2pDbC7NK4Nls90Y=1`R_FzH}<SCFVn8r
z*e);jn-nPd=~5@rp>3w0EAQdl+L{3BkATZ$Ovo@q{v#U2V<pkpySJrBRl_9K%4rZ9
zJ~OR@(s5m1E#V&^q#f=g;nd_}H(k`ykJ-{q3}Y{Wzi0vj;!nzWsI!Ezw?Uj&iimis
z2W#;qQjO7qR86=&#YZVkhi+lkPXJ2ajMAMb%C&5wpr?<`t0juYSek?617T%PR%k1*
zM%iIWODzj%e}qL-MK-?m1-A}FF$FFTwU-1p);^`A2&9AzsCPSrcn!r<5n__O{zai$
zC!?r?cp8Q=t|6-k0yghk=$0^3E2(A)zQ;Vx`~v%oL+d3B0VR9|VZ~%XNr-TXE1{(2
zJOvmsT5pFlU{VqLbunE|`74Hkku=vuTd|Qq!hIJ#O4m#{>BLdD%}n9-Z?K@!IicqC
zk9rf~ima9_$FbkK7V9CHaF*X(?-g<zv=2W$?{BE;%Zm$x_fNsIBSHF@4!Xgnq1Zi<
zwBA&b_si+NHmzdz9o!!sm_IZRE&zL<ycV|SAKyB};Pe=7mf#FIV_eCDPwMo1r*lu|
zl7-#}EL!@<FQ=BG1E`2l?yC9A4izf9@}^>|IVJ_ruY5ic`a|-hl#QN)H=WXIVG+2P
zW2uk`ZSzuUT7kq{MV!cM4qEtWWR=?V*}|Y4Y*Po}wc$tmm<*?OvGiPF=YWqGOgS|8
zig<i$41!dA!&m}y3$kNMJj4MQ#cXK_AgBaxO&4WjDCH^eEAdhtn6rJ7abg-u+7RI%
ztWS#4GDK?kSM_MKS}stZ8J$5#S9r7zkFcaYZtnVO9+wn;MF}_SJUD9{@b38AG80K*
z-FPr{n<+BYq)5Ux-=;P)Tb#*<CwK9W9kn1gn5p?tG&*b@thBh+j4{lpZ~nTSEw}Hr
zo$Xq?A-As-JxY+C8TU~Z9*(GkI&X>=nF#IQwxppOGEA*c>?(n2Q2h$a+fDG+G{cWs
zV?NbM>1cdY1O2`&2_zJ&?(dBixUAj+OYr_g@O~6AOM@R7Gs)s8EY`ys9w{BcwwF+#
z8X@8!-FZhGO`pI}%3g%IZI>QUIl_b-5Jl44z`}Ei`)gVa#6P97kN;{BV2yG6@4q?&
zjK}UqZM=etB2RAM?9Ua@RS=%vw2p95H`8G7`2xI}P&S%sw4FyNu9TK-!!+YHHk{rL
z(wa|J7Vv&&T(@P}_QJ_5sx>rINfrRnW=uc~ZRdC2Qz0SQ!T*sh8?7Q)e51Fjz&!As
zo8NWZSg9j|dd!!U#wNJ4JfQdc<SS+9VfHyo;jBzv2@=uDVR2CHtU{E|d!ojT@N-=8
zUxj9a^*egc3wDUxn)?QSRe<cwPOs>Zx_NtOhD_?Ek?GV=qR**G6X_YWQHdN`sp+DC
zKZ&7x9}s7~_`D-OEP%leqhI|4Q^>Khkh6qX5)y&bNL@GgJD9~i%`+>6VGmbz{aA4m
zT{v+rUmkiB40{d?BpV(?Mm;}C^OJX1+YG;Eo&vxi&0ZKiy)?GOFrx^5d%1|*3r|}C
zCy!M09TG|)y<cuT_0F?Spt@=TR6hY7_=q(k?_5vwx!2VwgA<jLz*ehOIYYj$0?Y1F
zEi}0~M$(n?=#ta-RFZJ*Ibw*eqPnUU8(>xrH8#^ervg{n<Dy<!R`|<0mxivfmI+gS
zgN&{He${;8l-d+qullw^90Gm<frK{O6oGNH-J}RT;I~1?gEE;rI&SWHmT$?t-YEs#
zh+Ko-J(JHX`G`3&qxl?$MbwH*CYE;a(@q;XK}^LpZVFtNo2n%*%PYP0Et)T@9}r#&
zIw5tnltB8Khl#Pk3zL3M79-!{f0?4+y;ESH`SnAU&X5g~t86D8Q`Per*2|WeKVSU~
z@A=smeE@*rmxvHt_Ot^zYx*47)oJwf6}^8-aI_j`e7<wjVTR67JVi3AIC|mKCl0W2
z!((tN4`Y_j0PY~V4&xm!g(4U%!g6RCus3#89``&WHTNT0TbpOHC|rss&_<<-UqBkU
zw&eV2$0O_Cu5F*&;wI+(=h@U-m!_x0%A*wwznw2f@;n6i9gtn8?-XIf3}4wP01A3h
z%}k8~Y0Wylam`DhHYs`z^o@~v4z|M?9;}L>faNe;{{lI5yMm%5W(vY3F^%BxCEZw6
zVzu}FV%0<no?ZDOC&;}4l8nT{m>)wRhzxB4Y9$dQg&+=V7^qPe-USy;*x}^<e++@V
zJ2hplclM|3d7T9!9M7`TIH=7rCT%<xmXnEI-zKTqt<K$i+R75H?Zm17mJMw)EFJL&
z(t^K^oysMgV+-h87}f#pK2;;1o_W6wr-_y1c4@`}S||E=#@s;{9>;mgUH6A_aq2iy
zP+eJ0qni@ER(A;g$XGrappuiGd5&N~zDw~S^zrj5)%1OfcI$rCWGmIVP5`Va`t`e7
z4D~@%!1RnJI6yKoKEpjX2nKr*8Ell!qt6OgyA^p3S_mqGuu)`;NDxwsP)pQ-Gl>xo
zCA|K^(m@<d7x5v^d()a~LxKjJ>5Mes36BdbU!lFsM56+AE@}wdK%-^1?<nQ<M;NcG
zrfgvGj;TBnejNP5V*LgRL$x0&)Q=-8iOxAXjs<7Ie!$3mM1jZZAh)niCujiF`ZThz
z<`&#_DIGxJCAhJI3VW}$pkC*2H^;E83(u|5X(P}9%|%C`TOX`14NADJBFm4Xy#7Gx
zkK_LXr88=SRu>6KvoG7Q6eF1s?%68RPo-UQV%fm@p6u$QYo+Q(sAcHaypgof%dcic
z(oU(BL#Yp*M8p?m@BF`lA`fAHA4Q^hx*rKX0*#LkCYVq?UdST%o*J!Vlf-Q`l>A9U
zGDLe~QKHe!_L)k_<hW_TGJKgfnMb)XRGmS~H{*`bRp{>H$g^o(=$z}AZAtoR1CyVj
zw5j7is0e-zDX08PBB_gI%ZxFRarbmK29!Do>=KpK7FJMBpA>MLsRyp&JT~7?ABx|W
zLCyB$YBZNE6y4sm6L`OgYf<MPqkg?c+*a2cwuRLVFjns~F1Q&B>mC4qpqZqgraqsk
zY!~Imfsl?ETZ>#Nsaq`l;3773PzpfWPrpN4=*5`kwau%NzdTY~ty{;-*!x^lrUb@i
z!37<07oJIdQ<ygM3FA>D;Stt?N5yjWi`kV@Tgm4XS}vFmuqDoqf*K{`8ofyYt`C(*
zsVx<=NYP<71k=m`_{<~GCyk$VQ`gk`dSLhWiRO*H-Q43<Md^8_i2m%%5I()5xHOas
zn3L6};9x&{zsGc1un6!9mL+6cSsIg<)I<4;9WCdhqhaTmk>2^zeamVUpe>R{sK1NX
za8MZwq51lCs_cIYrocdxO$AC5vCjTKV3BBKH7$t0R&GsywEd-q3Tn1~_heX$qqjFn
zJLlJKvlU>f$D09*FG@*}P;=C9XEb~!L!Fve3$sgg+$h#s{GcMmng5N7WSSPw7*}F6
zEH<K&>8fYdbNim(B_o8WNvHs7A^*O6dd$Q8>7!0hL9gfj8{iy6U45aR2MpSw&biy&
z@$Oc)uqyR;UipZCI)+-KK(}M`1-Na18K=6aQUS=3yUPDAM!>lIlL%BVK&q74-;e75
zhD8GY7c7GOZR}d~h^9E`5{6IB0arLyYrq1{XV|^JGIXsPJ_C{)(h)3LR4Z$t0*Yr^
zAoc$f79kmrq@yHDO#xQQg}o6xeI(|A^Kq(z^%A#e6qwbxT44bI(zVcG-)j!~pU7ku
zhNlkX1#vY(Le7;u<tn?T{ue0{4Ebx!_wR+)seYcY%woIdI>kXtf=&Eg^62l7gTQ&4
zJy3Z{qcMs$jRT9zZlU$1eiMY*NLz1Vz&2Wm8=bX67d|b||6)V_7cOFN8LL^#D3Og#
znvGeXLE$_GAlz8qyHQ?W`Yb|Tmye5kivT3YQtk#I@`7$<2`tPx-Ky@>+?hAzF*v#(
zuNqdLAz`W+jyzRjSXwsVciDBV?+>hfbUj=L2_k{J#oV+lw3{CbzmZIfxvx1#XTLch
zKFa1nWFyJMK>Khrwv}e8yWlIktn#lXR6Fk=7d7Hy`nJ{%1S2@{6Q3A{$TWyq7iM7n
zhMwtkiP~o8c0w~6Ej#!w_!Cs+kLID}F-u)mg*j<4GgYO9c<7pYDs<HwZmZWxOt6E@
z)hJE8qt~`A=@3to$1}9YFQq}`Oc!*cjYRq%GNgzV6ZbZ+igk69E2GGNbWuso?hNM&
z>3Pxnnr|SN-l@OW^>+F_5@nmA*Rj91?Y-&(BPYrQ!NDR}#@D#b*lhHE6s%o>Uh+{d
ziEZ8uuG8WD`ad+O*~7)5HT_K!cv$Q`lyh=T9G?>x^kJ7mK(<Zq&41IR;diS|bqBhe
z#V_f2b*UFR<4%L$zqY%4Ev})R9s=?DH%!Y76`oUDbL6vPCwyY-^3xef=xl5lC8Egt
zpCT|pfT81h0y}c1(7X>h4I5*RY?bqO=8Am#S?^1_MwN2?CjOpVZ=F~pYDk(HH%42h
zDy?2cUFj6nZ753frzkVOOx?jbl{l5**k-ni>pIZtY*B&J&<?TK&MyU7SrA<^a{tNT
zJ91?mgkqrNz3W<es514*{UHt|TkZ9p7N{=#CHw}Gl(H|lK(9MHcsc5SEQze48>MfX
za1))uxno$Rxif(CcJW?$WFhXyi-XRKl^4v_0)2!p&(oEK**{^ve2*8xw<5jxItQ!R
zI~{Db`cz$>D!M$fjAcCnh`>I6F=2Lbw=FO}ehjk2cvqkDEe&<9tHHkhHMCEdggrGi
zv^8h%bC@j+$4(qgDN}q&EY>D@BkIo^_D@GCnGO$4Jh{xa!H5}`Ek0gE#8BZ5R#~RS
zAi88RUkZdQQCuKUiN!aGxZP#>o2)pFLqcf|4$XAt>5C@r#D#1$z7F1pM{)YAxyfd(
z`x$%<2Xb@Wn)3rQEhj%a+<Tl8CLSgoTN7t3B<v+v8hPTCMb>t+D|fo`Jv?9UqpK4H
zy@rYMp2_Ew|DGr3CJ6lEq&&$&j6de1q?GYZtrFK!&<&kU<ldWWrFuI&lSYKN8_0ni
z<$&8=J8J0G>*BM-&`w~M55?m2nYMavY0l;X--#}Ni)JL~%e|Py^$s}yS)lnz`6n<F
z3(;93sdHqo*7ahwg(Xg%l1i0kq$Hbxw0cCEQnWZ{f+Nx6!c<T~yZq*U0C`{G_^-l-
z-#|^fW5Jdbj=jKh&n?OZ2V~V?)#O$hHm#Q>_gwn#yD}I}%ada}BSEU)h>*R&;xJA7
zX#Ae=|6$*2f{4*XjeFtBSyVa{*8cH&!+VN`V1H6usq7#?5~y)zQvNq1U*ku7^UNNM
ziB$4PR*eI&4GjG+NM6b}evB|_B#q7b*u5t-hWSSbRn_0&^}CqZNmz|7IVlN>dRIp9
z!jG1iXvWfo<rTNMc@LeFA`kl&_eXCe=TW&Uvl|%lAokIeceFTt&!n){?UCF3HDgWy
zQPO`x7z@LrxaTx`5ReMMN(Jr#WhBQv|GCg-pD?VJeeurR@XY+^E7fF-)ik3G3(ue~
zi~nXMDFbZ#U8w3Prks$L#y}sTxwqI&(Q4RT{0<6tJNm29yENL8jqXPHcpqq##jS%<
zOZhNluQkp`eZ}>uJibHUVCyQ?(g*xWb+AGSn=xH5`*lN!IMG&3Fh8N!^kjhNoyj$7
zy5g^!n<Ou`c?P8G!pwXnz=<c*fm=@JvA&q~)@IIVTn>Dh$|%0GZIlOyMrc``l+^rT
zxxa5aeo>SeuL&7p!wNy9OAEMmScPheqK-{VqNwjM4$w2!3KClvKV61ZfcZKFr#`T5
z)k9--IlxT*o#ueV5nmjDk4OaLgt@w;(oStz_P$ItON1M^JYk&7O|`wunzXy2lsVYF
zbg*Y9cRS-zee2|w`!Dc*kQslQYQ!f=b@+D2?$t-Zc+AZNoc{1d(j4n42>P@3DQGcm
zk!XueDXz$He<&!Y6WojO`1i24QuNrlzJq;_GI9d;gB2UnjPCalToLttd89k88WO_K
z$U&0rCrZY5ES@q~68jR+Jd{UrRuZ?&#8igMk@$)(g?6fn;oh%~j2h)E!G$_HAsm%9
zqV`LATJgJe7Pqc)@Q5^L^u$`S{CvCUtOOpFx7^}@wLE8LakWp)7KK-ujp!u;P`cTn
zvz^g79sUpS-2`i0x5%0|Q(VzCjQ2)KC8OS_g<os5N3HH43wQ@+t8TnCkX}t5G9;mE
zHbPR?`ajyL?W7~)G!7w{|Ki@I`{W~#f=BKvl@&8e!PXK&3XLkxNP}GEasqipFOuf%
zHYz8``JV5vjYwx!h17V59s9Qnrs@V1=YCF@geRB&hkJ+ry(ADFGC-GWB>gs=G@d$Y
z5{@9tjk{^;fqAK#Fe2hLHk~4eww*^)l@$A2((!(&t7R{mOOpjn<)QzyCo#b60%|}5
zvWMeSZ?L<F*8Iy88q>?!fo?dF_dn3P718q#^lkzK%=hCOiI}03t=4nmBDN}x9mT#G
z?ti2I-^BY$?)kR}57zov7B$KYpYe;*62_mqt(eG*=c^k<2cOsL(3{%n+1o9+ovr@~
z-B~xbl<*=B?kZc){2e&HF@LUB>}5uZ<0>Jg4R$K2`&&x6FWq<85x7fg8@a-Gc8T5o
zvbpBl@Vx;bIs))c@j-Yl1<MTk>p<XmX8(8KSq<n}$k128OaL=;dB)#5+_1FdcV4`~
z);S5Y&dG{iRN1fv_4J7p{1bJ~WYgr+L#VP%@J?p7Wqppw{BHsFHBuy?_&$Sg#?2zZ
z>8}d+=P_t5Om24_8Bs?m#n`ss>eoGOK1`lZSdjlFs(uE>%ea&v)t|7>f30qG7PkG2
z?mH@npx&=Gv2!lHTFn!HITKs`jfTIx$kCxtQk6@)Ks>_C%Li#DM+MU_(nsz4^n`dm
z9Ty8KE4)R!I6xC1-@_j(-f%O!C`bQx-=QI;*+n)SiXSIkw6-@(RI15YUhFc*VcwZF
z#CFgB)RD7FXT{zA6Bz3P#~)zK=$ow}(6{0iZ1ZX5alKe+t4~X<w-PWpl+TQ;{j$Nj
zEUi7=OatDO$YB82lJsSeJFo)Yah(tBu>OW~_i@lx)98<rsg3ZJeR&P084kii=!t^h
z5c+y^Uk+gnN#&+Z99{CIPg(M{1QUuz_EoX9qg%>Uch4&_yFwA0u?(@X=>L|+tVv~+
z$PTNP(2Bz^l;GKiB8~gqLqlX-lC|sYv63FP(egm;<bH`f=y5*@5(HT9r&ytxT7p(a
zgd-0BmeRd;Vnl3ZmMN}KIU2eZoJL8Sy`K;dCG&Y(*SvRMo{Te8NhO7y(kqRKM@_|L
zLI}E7r<f9<Z_knBtvqyX77^w>7)JxT!|y4J*7c{xr7bZYq)5CYWsgw)47P&nm_CGB
z4Qx(9wSu1%?!AK$U||V^^frVoMLvb1WG-+nYnG#JoS0tko6anuf*LM~%=-YQSGz((
zbm1aVH6v7ADrJ|e%wGNuw77bK8--4v-0~k=gzZ7aV7MP-6h9t@)tHTe&?V{_<+j&w
zjwLzM<fAIIv|k$r@i8+Gv+Oc&4a4g=0pw^0gsUzPIW{n%JCD>eQXf4WB@QmzAn-WH
z5onw^8VMDqWs$<i-;PS*tYSNth#9PeEy>vw^t)`)1OTo~-h7|;`ztg3j~5|#s=Fl=
zd|pI$0e(i?7cTCr?)GBqYVPhHFWX=1i~m@rmEIYY|IHZCmZjz;Xw!#paL<We_Wg^r
z%e+FrJ%V99<j}@d`4CB=(_l|DzcfDy%!vb@3XQ-Hp;Q(V+|--{EPC7*^#jsTvMt&I
zB?PC7HiC7;8*?%;=)eKP&wu@IWOvP4JD0DvcYEtEZ3OJl%S)ufULpY(Suc?unck~<
zzCvyu6S|P46W<xP^b#^tZs>~ceGxQQC}g$P5t<94*(*6OTZYECC7(bvmk@X$H|G0&
z+0PDU23%leze*r74dAdG17_E>e<kanx^<b^c=zohAhn1&RFtIAH<L=?pkY~9&j@0-
z8dpd)czbmUVH-tU58S<Z>ojRY*K|Slt`h5JiI0we^{zSeMRPE154tZrb{cm@+?ARH
z-I2rV|7Ql}K#n1tqdvncGNVeW`Al<w7m~0Z^{y_^Lj-JrN}1@zB0Wy%bFKATmaqqv
z6v+t?<{bBv6ez5#CR>aguVWo&vIY{;z^|YRxEZ${FHd*n348-(g{4;ir|Iqg^sxP(
z_P1>R&-S<MtX%&e-EXh-bnI|ik$qqOtfqk!`!{dHyqJOlA@jf~vkEHmoXY5<N?9zP
z8%jDx=3n^<bkUJr!3)e+acXyp2Y^Fq@U+^Qj$$R^Kp_3IL!1y0e@N0;p|G&;=H}|`
zz@iU4nVH$v>*|KxZ%k{PYE0|>4TjNpboCmB!4RmChC$(gIkpoaaG?3=hge2y-1qc(
zcsaruF7vIhlJ`>!wQ`VT#^488`)?IzPe7W5@7>Ca6`{)Wv63${_$dm6i&K%;9DVrX
z(!?X3d$luP5)<6CX3m+X&H5iJ^X67zU%jc`y_u%p*ER90KB2Y!{rkFMvMTnGCCld{
z)oWdDb>PIFsbmH@!#E=pxJ5>AyPRwJwwx6si;)QFX4x_!%)=yiIvZRi=SuVqPE&YQ
zog?HE5VrFcb`9(oRHCIAqwRJjm&WB>_KB1xH)n5fwn$EA44Wb@=CSwRRH`~3Jv;J;
z-77<uHy^f5*|aDFMA((atj4`)cxV$`SjSXX&}|I^Vq^Yd5c72pulQzbnv!{8wnEu{
z$FMFtAgica*AV8fZLEnL2lgvmngVFcFBrOocLkNSZwUNp8hs<8T~<a_Y+yQBMvl`O
zGrfa{>Qpz40{*>x^TS-Wvo9zk;%O$K7orlpv9{yRvt5&G#4}7OGrfnYb{6lC)%rx&
zPm_k<+qL3JyOs^_{S?SS23+f#@#Jz*ikyPLxVsqTzbHxP<zJ}KRkzBkgk-A`vFD(F
z@W=j>Ul}4=vp^jn`x8FXHp#k8qhfs&b(+R`kk#8FNt7~7Nnxaf>hVKLqwRCmQtzQ`
z1PoD2?`L0@ZzkNw-(+SN3>;ZYj|W$#!o$<qOnc^Px$7iTUcq?glH~-!c<HMnr!^2o
z@)n{r#qH>$Aw@zacrJ8=t3_Nh)O!r^PKHaDX(V%)hdA1AMkkz`9^h3AS<0z%MQJA$
zV)sLizAU&lfl)_>OnZLti^XK_?btrKwy(XLwdBPZ!x_KS(L*X?*(~A@0f~wxK{-V9
zATxs>JuN(4MHe1k>0znP0;igOe59dT=}S!#?(Pft^aH#M*s&BT`7X2mcH{l~zE6#u
z=I-}+k44FX=Viw2I07IH)aPofXg%3(%5VNPb;FtVrw(GU5&+$|?ygkDNFixWCIl#b
zLnu66?)+P<1M78s`u<|sFMsDhl-)zwJd1^zIFulm8}1?7x}n>7wkug@#IFu)pS%cx
zeu2A=%$bt{_fU$7x!_XCjMTT#d6j`eSRrpMx>+Go%~rR0EnG$T`%Vt(Elx^&x}nw7
z*!fMLo(uS<0K?F-D*%3Tj2wFUv;1K>Fr6_;1G*Y!C+e+Hmh_N{#6lC#0Ph|)epvd*
zjJtcSSiE;4aWZclml$MS=EW?bzL<)X5tGue>UTl4n#tW(dVI1u`RnE))%lMZ{Zs>y
zg;08j1Xg3@&k5)iDXrx?!QCG`2DjZwQbyB8z|ev7p0a*mhUDFCMOp+J32R*T*P$Rj
z3Gd}ATa`$?!QkyFTBHnCq*4LD!dqshNrDg7J>o^CFg4v`ZYlP;l3Ja{#GWN?R}XKJ
ziJY>G)=&~MjiJ}k9-4M_p9u#lB>l>6M<=}s)H2&iOrmKn8GONSk^=iG=!{$Qp`C!_
zHS>Xy5M;If_BKx=2LkwL-k1*dv;yjFOjeD6QlQyv(n>9XTm=kQjT7ioO$UGTfiD(K
z4b98f>f`AJR#|A;D9f9)2`v3B9&D6$Y9ex`RapB$&jdpSrxjiM5n>pjX@C}DC?O~0
zKwHKv^t1VNl&EY1;R$~V;0ZrdG=p2}v2m}MlOlu~Ma%FEPkrTSQn${G^W}b}f8H7S
z0j1+i6}qz@4&`5SY0@lYdnc*X-~xp8^O@Cx)Q=Wb7j?Quut$z!A{TG&(IKI22I^jr
z$-az^Cn9sXC$IW=;mNZ@cUJD55_vjB%wZ&YeyagO7CoMOZk5kQw&LSPIZZnyH|uq=
z>)x`dE2Dab3dADJl<A}?Nu<aCL@d;*ahmAKdnK<~^<!ZzPhh&`T}m>=*bo9wM$8D9
z`%{pwGOv2f9yoiv>ge?%Rlf3!b#kDE=48p3)0ag{R{ar~TS~@)Vo-Hvd3KhkAfSNI
zKIAsk(UU<@2;mYx#2XrFyaf)GYDC>1S<~_t2gu(kXncw;|EgTkzf%^w=saWu8_IQ|
zw1#D7@mKI&18Jq$U?1cT`T3xfl%n->Fkt6W!GV#YKv6A}uU2eZ@p9MLVBtBr1-lHK
z8#g_zecd7j;C($}+Jtq-UZs^R1l!;kjc3O71uHy;JI2Gxw(s&Z{7oaP)r6dIa)s?f
zYz(-I2%MBaOFMj@c9s>KH{#TJZx~h>ae>`F+Ri`~;e&-;=NpBaxLJsoYQ{07@<%-l
zJ?QbIUaTirNm*U+w1j)y(ZxbZC)_Rx|Lkl=Rj`Rt)EY!lHN8#<T;`-3G`332hoIxy
zau{RdIV<NsU^W7S3uiaebJNmY{eoHyx>Ls{(AB(n=(f(n(`Tiu_2Rx-an;X7DvH*C
zX_>3by<C<9iuGBJU9jcU<mh|pLm!Tgs&+kJ9mJ<?7Npf$+Xi$%kZcVKNz4(q?8l=q
zNDy_?^;Z3sITfYnxYs0rX`GZ!g5NuA6DavK7VIw=qXj+hYgSpZy@bTBetl;NOAH&!
zn=x@tKeQHB<1Z-$UR#wOCvo`YLd@8C=wi!`Fvug>I1{$>8STAO<18;`D~07Y>OOB0
z!a2g3ntwt`%yhpd$;N*kDUp{##rK}XgRccL6<xJ8@koo4v#i6HcNSem9ABIB4Bx~i
z3T;RC_!pIV1~Q<HgfHyFu~r&&a%`ag_4vgXFymKK)zg`;)Ey>HQW!Aj9zGNveqqBD
zO~M<wBP;I7B7KaZ(BXC`H?A#~%!yQBROGqXH55C%sak}~NZY{31sWO_y^N^N%SxzQ
zYPf~)M#7R`Hn+}Y?}o|~me*JEtJs>0CZ}TsTq7>Cbrr4_U9QmK-k0r*c~f>eXzJY6
z5gWA6u7iE*AI3HB?FIrQ2HI)OCI@{FSSj_EV16QDB3u|dE;<vw12gfm#5NEHM9(ww
zSl)?i%CbJr@85+BG$u8HCd|NuR)Fui<=bHJ30Kb@O7;FEPb!s^&4k~+UatOgHw^YI
zIB-6@)V#k$6@dEmad`J6t!aMYSZ_FGZp$!uR&H3E&S$)yEZCSP`Gs-Op@h}r+siL}
zCUL=yyF$VuWK14NJ>lJh(0O2u0YfK#)*nNpEf-r#)}V!K?m;y_LpF}o3&sZABC>f@
z^KL49EOW`Vr`&OR$*aJn2-s>YJh^kPx50>MQP<LV|J9PYQ!t|=-5`JvJrOCDz}&?&
zf1SFzD)?5Z`i;@*oLWk&cNnrT@8TfCZ@F#wRG@3uoXLetF>%#d{eH>0(|?wH30Eeg
zIs$bDCZUD9^_5SYk^e@c3W0Q|kv4Q#bWG=3KA75|*&Uwlp)uG1Y`t~KLK+J<By6`&
zN}aD*rT}wuqZ5%tPE?~-PQo>-{iSQc*PjAg`k^}U-qTEbggtC^86jySp2{=uq7wgE
zw!n=u*1N~6iiXh0;&jPd{3w1xRIFkM@yP*v^AdTMd?-eIGZ&C3F!X4LzVHE6IHHlm
zP0I7UAWps@8OGLQJ;Q3zXeI0-Yl{Ds$V-oJ+Iu*fA$}1v$*NfPMeDFlv=E<oAq(<<
z)p8~9P<G$Hl!{U$Z=vN$$x=Ks&uj?UB_#X)))<44nbDZZQg5r2m(oHd%9={iW|yTm
zYlV{SRZ3Enr9vug|2vPC8T|UqkIz5F%$ak}J?Gx<J<mDk-pH@9OA*=nSJ;a`-<d-1
z=OD}8N%~kwU-(9BejT{r@>S2}nU<e6Mtaxwk%{VshIt#V9m{k&e_|)6Gm49<s>8We
zhj;I-oTD4%Xc8G^ds*bR-9;<z^x0E;?atmvdzT}-nJ}ll%&8*IZa){l>4*MFJCv$%
z$=fn4`LRC3e?Q*)2s(F1)}341mQQK;()_I#NsAl!{MaHn;*t5Z#ye{i21@sAvFpp+
zCPWPPU&EXpapWeY=uOUCO<KM7=eEF0Rb9*M^qid>i`)0TlDe?X(}40gF))y<!vJab
zm2}tK8fKVSa#qGQ&HHiDduI-)Td(MKUv-Eb*sD|9*e(&-SHL8<hA~XHbZipt4K6JY
zO<45isd0ePj5<o=oKGiLvU2Y^y?F7lDOSDi?TpJ6&k<RAKw#+Y^{<cmcZT1XWlN20
z)~{bZBVwvZ$WEE=4@EEH$sIYV3-7*rKd+#*W$kmyWrXFbHD6(S;VlKK>uc+tjw(MZ
zWtGS;ZMjH_l-#+4xmvYzW=UY-yZ#hp3)4FK@Oxs^h4KRPEml#pJ<g=lQ!NgeQVHF=
zFZU`(OHDF#$zjOYPP#WoZjw8GQs3#WhwLd0hbC88)L>e-w4B-Jp08ZL#GNp!XXg?J
zsV7g5+P!V@*!=YQ%cBkXF14w)FF!`r)%723C_k<o<xuV7XqjO3gw=U$Ree&gkK_HD
z*Q{<@ZNJ{of7Gs`PHTr|hW?H1c}ev!tusveb!6Mce-1gvExf##qwp~`d5bfBOIKc!
z)U^k2$>MK++u0KzPnldZeUdPZS|mnZ0-jpC_Ne`BvY^EBTIuet<8~DrihO+sOr2y`
zyp4-2wai-mC2ObQx$xB0jM&b1CC-0sH=emq`=r!`@K1vpIYW7m&0b`Lxb^C^B?UGN
zPS1OD#Wky=o2ad%VB#fO_4nxykmT~&=O~>GB=@}PIJGmfQ*4|=SNT2o(rIg16>nt(
zFLu0iM|jbVx?`_&=jFE@IOIC?;6>8IcOL3%itgJZg^P}<q^=9Wlt_tMz42S=dXS})
zkXImFiSyDv6DEITN(7-e`TqOKFV<FI-&IYYLVGdPt}jLlDf%E@KA^Cq?PQN$P;#@p
zc+J-1i)Wr$4O>Jsc3~?hoiSpX>0g)N?!ffXRVeOP6>3HGV{%v&svm>^q7}S>%%U>b
z5Egx7Lw56ntzms8gAIs&&Uh{r;?}TMuCO`PokrGU1~_BDdy+b$ih&4tj4H+zwh8p5
z0!5xwSeL<I0y$T0ZLSeaH*ZlQVCMeR)P(iOepDl%8eU8F*-B;8C}h~0<HqI+b2VUx
z^`IPv3<}eo#_)vgX$)P4AMMBcUwTQu)2pJ#^l_hna<$(ow{Y{JZQ)QSpkMvB`nkqW
zd<-minZD0Fx<G~jY-4LSnN5ZD%;EJ+7M<(^>+3=om_mjyza|#Tg@OQbSXERK{NR!0
zVrsmyJRtp@y<?8c1?qUm<!RCU&*So-`**UV=9mY)zmpr&R~~TwPIlCoJfQnu<dAXV
z2oVrRBke>4#Ly_Y3E&5r0Dcew@iWR^0kJa{1`q-9GiuCnVh0%~c5vgw4sM*-!Hp9;
zxCvkfHv#P6#)%!=1h9h>5IbYx4ksXf#*`f=hVTMnXsj{u0^(>)*>PeCFCdmi?oGUa
zI2t84P7L7%#L%emCV(HjfcP0TrhwQPYaIy_zz;z{{EW1hARu;Bu{a!#n}4A%e&taF
z0WmbDzXIZDOj!Z3G^Xr0@kE#ao(KZsX-s<s#MH>OB~AcOL;>+Mmc2v)F*VBG31Eph
z0W1+GfF+`USQ>MlCV(fRfOr};#{yz$EPF{4z!OP8JdL!MG)^p$1jN#)@dU)tC^-Q!
z^q=A=X#zMR35cUnHjfiSqzPb1Z2}ll8z+X;#)%;{0WmbzUQrVeM`OzJU`ZeA3|Jsl
z9D*ebe|Lq~Ls-~|!=SKfOa`|;h7edE<E%=;gNBGI28RWCvnoc7h>%=i116nJV}L#w
zmZ#CB#)CC|rVo>4?MtRmVFT(`8ii_QtoKtnq{g+x3bytlb6Z^B#{%6M&@ppnvp7_U
z`^^<};g~FUKkg{NRPH|v?`S;e{D1L=2gU!z8?Gf2^@a!g{~z9{^X!lR;tki533|h`
zF&r%1yr~qnrlz(wyn)4}SX0@~@CE}T*oGRwhE3?8XR0^+Lx1>(iR%wsfQG5H7iJ?y
z1^o)ZKx*72;hOe~h(M@k{6s8-LeUBg$?c^AJw{lF3r;K82!V!I%LoSzYcs+_sK<c$
zXMYe#7+e1u1U#UyT$il)sNhja7*@*5OTa_ubDy7=K!AwcUC&R&LugxppQr|*wKzW!
zPlC{>!A~XOAuKl@@KZtRjAjq~R6GGf<M{|G9wH4-1FsM25L%XxU<EDj(e7e#5c((`
z!K)6TL6x5hY6&!59YG~RXi~^e1$8#s2IHrKYz!@+_^F`(fF11w$PBQ<OU>&Vq6VSu
zU49K9qeYAC5mX566pSDeAhd4er-JqwSmKc@K~x9l1EZ+GDqzJ(UeG84b2*X<N@?_|
zIASy`1eS9oFAhSRKm4pD2sgZ+c_#tPH`>P-!HPiG(F+WkduT1j&kH678Eq|A9YV&?
z0HMt+egy!xXxhh51&fP5RQag{bqLJlNOwV37VL_VRIqn|6(gwtN@!DpUoS8VZPD^m
z!SfJJg88YyFSMlPr-Ez{u#X%KoI9Xp13xe5SfNc;ek#}yXbQ_uC6XZg=zs%)1$v~x
z&kM{#3rKz{*lOIYW&{yzs?k#h$||&*#?K3|g!aApsbJ1W&o1aOk;a$>1VRf%eg$Cf
zpeYPLl>niAQhp*Z742N`Q$b`x`_24RFav02K7tC)=SG_gHUtQqBj*Od8SRzvYXGZ&
zW|sU^5X#Y>CqEU$6|_PfK?UJ$j5#MlXtxVIqJH%})OqqyeHN9>&BF}9X_caZ27*EG
zSOmc#81NTSf^BGQAF850lMXU0HUv&98Q>WUsX(@VRF)s4%c6ME*nq-eQB{52J(Rdl
zUUv?K%2G7rP-yOuHPeIb4~{({69z?9iF=I4eMS#|Nbw@G*h(;J0F$M-j^oFsF(4xr
z*^90On^FV)xjC7l60FN%dx6iDU~{JX*jE1X4B;)KL7GWIU^6PilkEi}Ar2&+G#@sV
z1snMQXAP*}+;jLi6b7k-HJc7TX8D2hSptp-G=9Ha91vUT)WVb{&E5HaBR0YwQhz<W
zXfFhAMH{A@kW17b=|2R&wIL;M-SMS&a%Tp;FM7hvS>Cv^vepXTU+n080vEe<XTR?3
zy(uAkmY!2|@c!4@w=PfTrljm=(PSq>`h&yQWNMCQ=thK8X7o89xeEE<9jgLluEo=2
zO{+5kH2Q8ods#_2nKju{Y$!{@Nj$4oX;bhYb!o>*A8uZq^I;{1;ViB!omuKxRV%S3
z<CsM&J@znV!^PsLx1I%WCV6(Wi_N$pG^fn@b-|T$M6d0h`j2L8%km0%*?qwIY@3a5
z7j?Z5HeYe(Rjc@amaK%CCmlA2&k`aY++K^&|7@4fa+*5bQ?^}9Ex%%V>|gCus{j1p
z<vSbEI&4D7l2F0EMkJjQBtCgrUAj5lEXq4M!tmDAXb~%?7jxpGwjw4D#9Ii-f%FXP
z>@aH;bbglF>S)_3)z$IWCws!jHWmNtoFLQz-3c|Z*KLs8aPQy|((a6kTD^5uiPwae
zH&w{4NE_nl+^SSCce=COVM@~^oXV9%z;q}hDzGe|d72~Mck71i(o-}zY}y~qQ^L}w
zbi}udwU#B$esSMxax%_6ym+#=?6NyO3n3-b9!(iUb`yEw@vEgmvK_*+RibBze8x!3
z)d>$hT<j7fUi|Nr+Xq|4p(}2aRHkJi^hpwq(@LC|+&e74OUSNrZtx#sR}+e_%vi~s
z=eX>_%#?<T0k^aCx<xBI(@t2lc3-hm+2vMXHg5&^O+n$i>BaF#V>)f>x$tSzs0-r4
z4%}jCNJo=*%s#MOqI$BVml{jMDiAMcyNl))Bu(s`6-jA|zrJUkVyn-AKXlf&lbhoE
zKSU(#>bKL_>nEOnGdaICG3qe$if?%4doeEW{9PEIdo%6J0v2}~>)%{zaICg{vJ!rl
zjNOn!A7Xih*k`wD?u<dZ0ioUgiSq%co%G-{VcA&@AH-GW#_Eg9*3V1SbZCVZA0Y45
zJ$&cNO{njm?e~54g!d<xIFMy^D}yNwd&=@~v!DZ(xB%g|Eadu4J=19^d&A<2|1AaH
zCS;%V+I7imm!G&~x#mA1@tfEO4xX@YQ!d@**jiU{%0SY)DO5qi_=3AoiKeV@urE7L
z<C>(ux6Dh0Lk$bIVA|I2HdmAvTe&W@U+OeD?#(si!JabWkmkz8)@3_C_I-Zm)_<b$
zTTUV=to~LNspEuR^S%B3OLmr7CBE(Y_}uf=M%U9j*L?eYrMG&`j)Jc0%fznzT~+>J
zjE}GCr5EhB@?4j%ABg?dw>;X!z2`vNE5_FRI0J*i=DRyS9sIiEN!m-dtmuQn?=$!0
zn@OimeIII8KjZ7W9S>Aq_VlEDx^ag7;-YiV`s<%cTR!?=YxVZfPs_BOMN}FUkA?^(
zsMADxv!^!J@0pX4AHP~LASCvp_-B3pq9BKj{_Og+qDeY6G)_V8!`hp+U7Ke1sD7RO
zYQsJIgj>&p-cff<d7310<FQXezr~yw#%B5E6sNEaUj9%0*M?<nx?C3i1l(W0-X&Jx
z*z$O5fcERR2A3Nfi)u&#QyjBxtTL4|UA+8v2W~ivcpco$49)KnjR<vqlyGLng;_({
z`#)8EK3=%7X2-_4U-ow<=Jy_tn<Qpev)uEZvs-=M+R9uUJ?fa5zDPpa$<lU-nnKsA
z2GT%FY2W~nBA?T&%bKiYyrINg_aG9xh}xx~jFU^f`i5k`Cbpo^v6`73nSSv0wU){Z
zqEbQEquI)*B`U4Ww;7a3tutnB&2>^~6*&_Q-<VlUvEG0=zg4SExBmKS_rI>q+>n3u
z!+{*-DIrzt`B!A?OG2^?E*!e+9iJ9<S2^j>X1#uD_Mg?SUmua8r{$&|Do-t;*v^lz
z9b~&u((M~B=J$Rrb!5AAF}C*W`#(&3dNaskMaU!4w@jl=vMbMByp^F$cFHa=@5&3e
z@U%Fu?2{*6nQO2nwJXk}QL1R$DRYquCk0}DQ_%ZC+K}cJ?{25Ze>p8YcZ6P3?eHX>
zQK)TxN-O%*t0`p~L&?w58#R(C(-M#eoK;JkyM<mII3#W1otk-wjaNE#s>Lfv$M{%F
zY~L}?Dm;r}doHO`{GPeFK~PxQ+Z*{U;pPoC9h{VQPKxU1Q{5E<7mh?4<?mCe@lH*;
zAdTeZd3htZ2VUN<vop4iS(>ym@ulP)#>FY;7kPCFov)f~V=sKKd}V?BHqMMp`QYX}
zaqsI2wS=VuZCyP+xp^OsYgcQlWa%YeoP8uKc&&Z*F^>A}=u@Y=<2?O$-iSXj=j32V
ze~f)ib#I8x3*j%)lp;-eLXJyK(OqK8Orf}5X^AgK2UmZ1eK|tob6=IC*}{-RXV2Z(
zK@=~2()qP!|GUp$J$4i*-BKN#bL!)&tg^6wD|0Nizgy)WQB=04N7CEUV2JrOJ2Sri
zQ-J+H2Tf^vaWA6>398g(s{35#51nJy;-0V5-nTOD+Jd+bA4_T!c4)ut4~@J0@MGSk
zOVL3)FmkCC#A%5arUxubydc{zVQH9%5x4C=H9hfyc02aSX_;rn22#0ibnpb_hy&|&
zgSCVu2Im<xS&Ne`bc0X-eLy>hQ?n-hYbT>-s46NT_o}@}y|G?GH%+fkG@*B`V*9{9
zwmJ+bH5BWdXBRg$O6cG-+N&Pv42{qk>Y={gL-BJBs{5Y4`TC$pEAtfPX#0(*PkJV+
zQtebY>y=#gS&A7DI^te`{8BhIGN$=TrP%!D)MrdpLuq?TQj*`{ldED6TJ2ZicxPKa
ziu5ZjWXv^vXzNYY9C|sZA--iJ6iVppv5eDvyH>7DvM%_BR(;et|JyF9$c}E++1-)T
zWf=b1X4Cy|o2W@Mf=&iqN?Nbc5c|saLRNs5W4Yd~ZLd}tv+t_)5j@n5m>j8nrc$N(
zl3EzQp7jSF?peIEFFrG$p=vm1Ny?m|y0@@jPhm`8d|I==pVEoo)K4=idrag5*`H-M
z4wM&N%`F${RVrU-ot~3acunGRg^iM<ceT_Xe;#m<hf|K8eXUO3*(^Pq5LH+$0l&3T
z6OF=UVOlKb$=GfCJg94&!1_Gv!Lhb-jZ?|b7EkBslnd#RT+6Mt{A;~RJ&{soeX_7I
z=o01c&~2|4>}RhkKVXh?t(;38I5Q(?gUOf9t#>O`H`;e>yrmRq9X-kP%cmaWSIk-T
zP|KK4*Ht?^XF_kQoethnq#n+SKJ!I8MMJB)SLyV^2V0Bn4C4!S<bZew_tr|kdKhzk
z;6>h((D1X(*8LiCQA&SS*w}V8%@Th4wc_vhb>e3Rb5eXJo3WZwlnE=Nj%A4)Q>mXN
zX&VzGcJ^rHiO@2ql=z%;8C%xgc^Y!3J+DotWSjR=<BWyrPUhN8(P>wgea`94i_6=|
z+|gZV^{LbKMqBi)Ao%Y7`owK(^1~W+p5IxPuJ@Ll**p-N9U`fjp1$OG>#CEm&$bW2
zY}Hd)_g@bEStxV@KJq-q{^L69LVfUC<=bPFJ_Z>TzCR2vYM;9!eQU>DCsm#2x7Vj%
zZ4WZk9;#6&`xveex3hg&=yvFEc10jF`uaeuT89g<BU1g#?R2eA4c(k;r@uAVbeC=)
z4AgR7@#J37r<dfwZ+?<+TgsuA)vNX`51OmgvOk%9?r?3I<~sX-6<gpWwo+JDFX4Ve
z)RJ}YH!8ZWOJHBzTf0a^CS9`q_V&aYTc2Z{rlq8JxX>c=C-fnP<j$CgcFAwwUQ1}x
z7Y$l!m?g0b4V@JXBCFS*U#JoJ*Y-U+|Msu&%20<bzSQO=SIvmJQIK3L;w0~C_AIha
z`JL%}IBSpES#guSdo7+^UupLEW%o`=)8vxT7aoyOr%x6fwhxU#_4}SrBj1}uW@M0D
z|9GR%<bbP?2yf=jE$Dw-EEBlu0QCc^2@8K$KU@M0XY$DRg6R9j%VA5cK%dx;?L6F6
zFru;bcv`)~0^f}o$@b&^<_{N!OCw0nhs@Xv>DpUEE{X^StL~x%fy<koEHYh**E?<_
z=7)FOYnbL#HrbubCjY2Uuvk3d=QT$MbF*I+h~}CAP<(BsvLQFBCyk*cCkN5owdCvx
z<`{EdeX192Z4irU9kkwt61173?k=}RTU0YZBY^Hp2SY#sbRUMFMu3(a8Qc-2YJk^V
zGAsw7EbPr%a%iQ77GrYSq7bCXa`(`%GBEls3EpYRd9m5P8Zhkd@2~2QQ)RL|VXV5k
zI*dVJ1W^GTDt>_sHaS3r;kOLc@m&j;K?;lJ%PlV<u2!-elf&lPKWvmc<)>y}4$BAC
z>rR2GK2$pQN-T_3#d7T&c7X2tlbPYCiaMi8Vbb9MvM*r7@G_d4|DKgjhre41>~yDS
zcyKRhvbD*+zCPfhEZ15X)UulJuaCgAaQ|?b*<5I9qm!iT!ybO&L*rVh0f6ACB^RLL
zPW2#jeAsf@f|SjgFn4BrXxhUsP@UY7hsWU=n8Gd8nXKUv^~j#TADXwC9x((e%N^o}
zMxH_3f328+KK??_h+%$u!mIPgPyn48XyH%gR`lB3u7e5|Q9*Dv2u1^kXkZXq8+}c9
z1RJk3Xa>+c0{^Qt4;!EK_ucp3<#`!-G?<%f7%(XuE>KMjv^gA_yM{W3M0CTFC@Odi
zfvAGV6WvtQv3R@+LZWye7z_bRCSy^T_+|N(nlSv>WCn#g9;H08sM6sD;n{@f_D1mr
z_BV(U@Xs&--u#R*;A~7w&Yv4bz$^a$VvV5f(eGjGM+5^geYnfay_W9x{d&7OnYG!3
z;lTt49Nd>wcl4wU9DV$FH~^{PR-PHyHHuUQXbyq1I11Z_MWtFXnQTaXxG!l3e$N<{
zwSh(Tpn}`;;4(eXXh8Gx^&tm>1wdo)57p>ZTYV5yeVCp+p_lj6-^9RKlZeA%a5y54
zNW`h*)Nmy2(G*u0HDTCYs~;hnKmZY%76gtfNm!Wc+)vN#ok61<LR|l2gUP{)>hUY0
z2gIt>5qzaA7ficX+S1Y@uQt{HeQR&;ACE%CkBUDwU2O8E_3mMz1u`Cr-~TL77F{PQ
z8X^+0t;wyXxBByw?ri@KBg?+?=g&uKl0p-gpS`f#bcxXYI-Q|Nosj%+=MRf2Ttc%y
zNL9#$7X*a7-rcQ=IdQtUy!g2c$mJrR8AIo$HzdxB6S9A`Y3}+~;qVTbnwA;Qa^t21
zYU@7MbZ=XvEcEeKg2UHk+r?byyYcO<f5pd(8r_VMx=~hBoH@_OP}-oJ`_;EpLsg?U
zrqr+;e9a%+-Klqf-$o(Bb@QwK5mt0fX6wBSt`)f$edSc+>P<>+S5B46NIfZu)2Uql
z;byNqZl%IyZ=;Ae3%)I})1%txf-TRf(=o5pqu1%W*6II+*U`u8QSiFfczwSN9n%cG
z%^AAR8T#AUI>u~0PqwZ-Ti<^`$6`Q_IiS07K!0cQrb*M>#HUeagt#pTp-i>H&P~F|
zP%wWy!z`A>NF2jRTVtdiU>4yplGib^ewg|Fm?bl>h|?T`OC9!{bqIOxush0OU%kWL
zOo#pNnsyy*3a)C}lhzc{)3p0^)4rCby#-DCzo_lns}_7qZ4Y~4DRyDGNNkBxY?*Xy
zsd{X=uuF-&J0$5?QATZV6=faSzum=fa{AH`HBrmpsp&}z<P}TB9+jv(DqHlZR4ekS
z_Ttv1XIhoc$Y-ZtlfGZHsQY7#POfW?=FBHT@RI3&rv05*MD@K0kKThIKCsvUU_XfB
PiFia!R9@cD!s!11t(P;}

delta 42103
zcmV)cK&ZdL@B+Gk1CUt+F*G?ikzFBw$!;`Dk{-IRr^t<#%nBbO+yiLzLRCUT0%~zp
z3oW%s;Pz>O6i~N;md@MXF#A4p_eduHlXNnf9K280PqU24N1M&u9jAl*_uv$m<Fx%f
zJ^kqzXZ_v&Za+ERYJaz%<j>Q=rA2^80M1VW7vQ%){X-wM|NVdedia0;^#AaG$FukS
zW4rL@zy8~Q9RBH_{`|MU{MWx8rhoqD!+-wkU$zT>{+GW`|8siK|NifE_}72me*4GS
zTeR_RVi(T8vA;SU@=+QuSF_&r`@zNJ(UF+-DfuH8e+THM+1ph&Nnhmwg?`uj6x6;?
zIwbnQ?>Yp#_B(0+#X<SUhc_&L9{#rd@ZYo<|7U~#*Wu{G_Vm%^7!F4tgFF29e>wbp
zYaagl^{7hI=jDh6L16#q1VI0JY~V}(oDSv2^VgK?xLE%?X}6wtVmHR0rJ1{B;bmDo
zpO1E-Ts;#mAN|44$5l3HfgcGk#~@G;C<zn~K5Z9H4XpRh0xtq3fmVTk)`OQvPYwK7
z;COKB)&eh&8nnp01%51WmZ$Q;3yLqSM<@3tz)5M!4qgP#0?h@AfKCmp_xf_jgg3ZF
z+PI=U1%4D*zYzt}_j-Y%v~k6~USNHLV=rg)S0=K;vIo(l?T)YwOqjL@oZH^2(5Zp9
zd#CNT4fcoC8lKTZd20cG9}h|1DHE44IpLuFUv$O__=wAKYmCg458FRFzCpiSz{l-#
z+hs4kbkZLu^Xla_4*f0gqx8b=2=c3!xr*|eN8h82otIwDGD`Z^Sw7{r#+(Q{tdTvu
zwPC_YF0v#RfgBdnseyG&BbKYSVS}8salv9fHSnXr4)E5ug-<zuEU<|2C#>T?W0AYb
zmf(s{tvX<<v`Yp|=ia~>V75C6Ec!^4^|tDL=U_5m!Ap`hsDO_;<GOD3b4kCk0ytGr
zrf-pzn5EfHphcjJHG68{M-GClj%{E9)~`;fLZ=4SVb*&mOpd-mH;+r$?gf5C&s;9^
zvf2!Ir_16uOoW$zsd{Q)ouCAG`?fC-$;+vMwM9YT#BG(ZT$F%ukr37e6$M_fpg`hg
zdDmi_l&~$tSw^0aBP6T&RN#7VfdlrHi`Zcqi&G(OyZx%0h0xSoC#>V(1x_+Yk#C*w
ztul)W>p~3zXDn1NUDdhwoW%k^@(v~ILRpkrY|w&nJT>rtBQ^tOK-P(pm^xQ7i(a?7
zP^PB_enfK>)-EV{-Jr$DYlZdR2$JZ9Br19J0pxiCYe=Bzj~C%kAjgHq*(bd4y3%gl
z$O4^YDb9c&&tbdUVW${fTXcjf{78DXfSv{N5<)_HJlCa=9{t1paS5I{84Dhn%l8WW
z$i=>3idMFNEn|;rpH{p<`>}`T!oBPbE8dXs+-lzlq#Bu!v`o1W_j&MO`_iW{<Bpf$
zNg$3;n8871{wu8aE@)erZM?%$=P4xPypQKF`xMHk7?klG;Y(0^{jtC+A#HiGRds4$
zgMvT{*5Y<OLWmG5a0&K@z#S0<O12Lw{3tM|CvYEsDC7Wb_d2{m=V%WvyxU<XDdfvH
z3as}!w!)Q`Icx8UQp~DU#V>f<^c=Qby5P+b#Krb@fgd4NV)xI54$Rh1p&&6p$PqqJ
z;m1StCJ04mOEI$bvb!t%D55Rpqp+IT7FM)US8RbF1$ONBYW)rrPUXE7eiS%kNDNvE
z6mf5VHd<+L<Qo#c;7o9?u(rXMJ3@hCb8o`C9(Qn@aQ7mRel5#51mler*72Jlbm~Yd
zk%*zv?g~E&yz-6+I=?+N+qX^){3vh+p^6K*N-mJJy~2-#<$<W{KsJ4xu>>66OIY9Q
z!CzwpXPX7`#_!Odpkuv*bsfmU!RUC|!?FN>lr*0j*ydg(><sZT7icPTKVj!myo*>T
zD#__=QBbV#Bfg;`kFGzZ3A!f91uFcAnNzBxv!zrklB1M<QaX#?q_bG$uo&<>=P;Xe
zrelRWBIu&SNZP%mtpW407!{3$=RAXFP{c?&HwlzVp9-w^X3)f#O8*HhxOcU&GC1*n
z4YF<Ut*lhJ!qy(%;rP^o=NGIs!rG?^B4(s&FiHO%)PYk2KZ4FU?v2E!s2I$c1H!t#
z7Pi4b)CdBp9-Fb}2tNY$!YZSKu(5!8Z4mb-VV&CmWoLsjR;9K}#SfjY8A{UQ9;P_5
z$e4I&Y&!mwAuGJyn;{oQfoAM9gS0(31%4zfFOO95^<H0SK!G`jDh=vvDP7bVA`PuD
z*P7DaSolJmt5RNJUBgKzJ!cLyzo^Nlmu-drlQ9P)lRyUrfB3xij9r9Bc*h72ZJx>$
zPlpQYhMh6@L8%kz<|GhVCgDfW3+z={LQ0Wj--W1SIO8QAzljJe`%xu>Qw3G2RyH!p
zVhKW2GAt$mV^-luygHEgDLG3R(?EJ6<U_?N-7P_Pbm`tNZA3qKM0TqzzUL~FU86Gb
z6E;uK?I~hne-LUNWtVT)Cy<L3FrWxlp(7Tsb(~1!+w&^(3G16D44Mw^gr|Z)9vn@-
zsXUY0RB2We$v=vms6(PWilkWiTon3;AuH|w_0suf-Q2B*`PJ)TzakurOrA^Ph0x9Y
zk7`DcK+=hUq|*z5qz@(L^x}K>Kb3ngw!lyG(Lz#%fBiosuX}ol4H7Ks&)MHeE<E^X
z2G6NQy-HIG@$HXd3|jR4t6Y2H$UJzDFStn_eLx%Xs<6H^#q!W;_ln0~hb%tdqu!@u
z&j2k82gv&}3<-^Q5F?$lUM2%}!xK`At@4(KV2?WOk=d5wZdmiO8`d~CPljoCZ_qI>
z=qtx&e`Y6NIW{h9i(KZMW(<q=ci|8Si&z|POFD}Q4>=X^9p*ZzRZLB64+|{nm@imm
zC%LS*M%)i36z~mwRzCqTUPo=llEM88BU1JKc;%{X4HaC_I$}--TPfB<rio1Z0D7k1
zeDDj*p+r>IoG{sry0$|T*;##^pU_~uP^bP6f8uYSPgtJ1ChU(s^87;=NtNn~ccE4o
zPM5IYJju|6X~4+qB68dg9;3^Jso0EH<OcSbRA7rBI^_>|Rjjc1yJEpGkq^4%xR4VJ
z&0aN?hXusVW9{H=t1`jTM7(u2P|4wg={Zf?xQ^f_bLeS;tb|1s_+{)NY##hbI^`o)
zfB!o5EI2=}Jqu1-Gr@4I`*wn<5{*>4z(Dac%<e1!=X}$vNm~fHr{NIhxIH)026Bek
zGqN|QimaR_kZdJPZqA(5wa&DDRHq*|>ic$Yz`J!Ylz6fYy9S9-ZN&<o&_26WU#D%I
zU4_fL(F+|C$MujvVO>SG^_VLbbA1Ldf8Pc~Uy1vb1~<)m^&*@5=1R9D=IKE<?{R{L
zX-p=x3xA#~_GnmWvD6~EOUcaS_cfNTia>&;8_Is(Hmq+3m)~@0_feOMBoQlwTXZ%e
zHuzlM6u|LZKwltY%Cmx(0eJO@r_K?dcbfxind_7-R0?XHS~y&Bx9>3w4VubWe^luC
zsDx%z_+B-^Kjbnff@UMMloKv*y13hP@|n=^<+h)?=bA0^Wa7kbmn<*r5<%v=bk@+W
zB8VB@)sD?gC)d;t9+nv&amke>X?yn%SHS+i|MIuL9RAbcumAQR`z$hlIg4z$oJAJW
zs;-^&crlIa?DCQYl@Uyn=;Yfne{|}*5(5ChfW82U0Sknf>T-B8>e9jcA{QBKOSY!e
zXuO~?cyi+VB*BQ=e!_kF4}ZLvY?P$;=vJc#f2HnR$XxUM|6i)JQSH3}GV)dGtlu_M
zf*<~ag~XwiysK8STkjVH!^rjZx=GT3cu<PI5z<Q7A;fDd*2)A=L>vr`e?*SOP@#QP
z?}Y&m_&O1psu`|zrSk~`{~Sqh2<*7EUt0|9!3VSi-8jQEzRNIsZjBc(evX*6WW9h*
zEf#@XF*~7ecBu0xHxpY8_`9-AU8e%+`XYZ-SNhSIDuRR*oGG@TgL)xhg(1i&P8B&7
zDHft@XhhO=t#H|^y0j^(e=hRm%tgXgj*mv)&Z26Lyzi1+Z2||bC90b(5=^91G{Y7}
z%nUaPDx(S{iPNdukai=qk6*?*HViM&uIb~DDj^QkNl~wQE+hOzMAzYhkI28df}%pY
zvduWsN{2WJ902UCRV60KF>3)in^&y6xpUo3Y$60pn%T6ibED8Ne>;KRbQcq@O_jmk
zGL+kikM6Jx;-H9bao+-V8OSSX2Oly@0!phZ5-h;$y0LE0x$O{)2&D%Yl&g0A62ch$
zyN!P88~sZ!zS15SCT~HsA8nAs5U(IYJ~VW1ElQU+JILv<6egX^odCI<D9|hnL!#jf
zWOZ>n40Lr~>)Yzrf6QFx!&I-VSPn4Ttc|@~?%P@Hi3-1&E4qejmq4er%(S|Q;dIuD
zR8}n1YATy_#bO(+h<d~Z(|Mq`#8_}b!{mb62K5#lod^*NlFf|G67gwh^kC%*F6Ew6
zkqguo4cT*neGJd?E($)7o5_&CgTV1JqsVETQs(X`oNIsFe?m?US@??akD+h;&y9Yq
z{Vh`nQj!5HaK_@n)MP9jAUZ=!Rr1YYW&=kl`&djQv>0lyBfVXa9HNN?v@qy1Wp7Oe
zo#1(e#rkNn0IeJpua>(0qiec$Zd$ada9oFG4paf1wjLD&xm+R7m~k=I)#@9V+R^Ua
zS8}ty$>hRYf6xi6T#P9emlFS(PC@L9VrZ`R!97-ZjTkHOdKGs#vKR>3iuJBUbExi4
z+X`IpL=!`u+xA|^Xyz{C-CGz9JU@3}G)Bi!=*NKqdYunCTcC(~su12BF;m%&m;~Vv
zo^wvq$fH?{8RFl5OFY-y$BCQ4m%ZyJ?9fo*^5KaSe~&#*@kvb(cpH@fk{Euu`O;1K
z%uw%!diNIfF7~avVf1M}cRQocJgCB;3Liohu5u;C%dVt+*_E`dH8In3p`I`8{napo
zfs1q}A;{vqQ$Y)nr0UJXF!1+e+gY)!*+lvzCIasROz8j!JugLq$oQHq%~v~;){Bm$
zuhgAhe@D_L_vdW_^YLY|@LZKUx_S7KbfXVH((_454a0qcU)}txO7-<086Y(?XiF3M
zlefux1RO!uXYf$DsOp9MO05^q)ek;$3=4<X@t~;?u^mm&$4)f3M#}PiLo%#L?_)(;
zrmpcHQtpRHxv6h<hK=tt+W6MK$wXu;m4X@tf2j<S()oh8FDp<CG6WGwd$z#DZ$#5`
zCWy|Ezwnjhnt@y}fr0B=*+q>XE(MWaV^&lFV{W=&W<@MP#u`poMP#<BE^rN-11oU{
z>e3^_Um=1tD?%hf&a+ZptUaZhK9%Oj+WvO9h}m!%3W1XpS*6L{3|&Qaom<z}uY@-k
ze>Eld#NEfJ2}j}6A?&Pxz>1$MJ;#c@(BdS6c~7qy;7-En8U<Qn@40xO@9Hckz-Cf+
zW%0P(;&J=MV<@ODl4UF^dAYRLssOHFmkIxm_FAfUSrDkw+IA4GTFzkz5uaFyh(n0@
zK0-vNyw1cSQz5DFK=;#)1_fPzPOgq%f7K3kHlV0uqT!c9!<CYOoFNLliR#DRwXk^V
zi41L@fsr-n@WU9p{VxXsCsxiYGl)!NOeWt>>Z-(ulPM$1Wx8^-U26gj#WOio@=WQ1
zTJ4gXYYg^p#_@F64eMhGo>%AFlgU(Vvcw!KyzWK@OreNj@@F6OZhl$8{wNY(e;%A`
zQ<_#?MbC3D_x$eO=+zCc!|*y7-$JWC!WZc_g<;57$ImHWZ404ea+n^fyV6oeEgtia
zQ%CJiV!^e~5&P|MmYKTF#|z|kd5-bM%Xz7PI2vny2Vrxhq8=}^_CHER{iErLUDGr4
z;vT(tYkbFGzs1ah8M%ieQHL;7fA9qrVQ@JH*XoE&@d9eM0?WR6kjQmLwPQ!i-!R-_
znq2QQ+(V)q66ISYO5dsC4ZrLA_+1gt(kC^(f31-}Xl!RF<j&smWP$>jsR?xrVwO2z
zj091&<7kE<Y=Ke>0`4NE7<h*Al>D3;Y1d#%Z5L$&iW|W2VyxvHYcF<Pe^TopqeV<E
zteDA#vBKwaAt-EXYnrG$fj}-T8Rayl0@JEB*9C9hv-+m%1;eFpj;$yO$ZIKc!CgeO
zBu7cO75-io`ag^<gEf9UYg|878K{f0=^w_UE|=p`-3upVyJ?jIq7$l}J$I(ISHDsO
z=f3mqCr6~Ft&tfscvZYWe;SodMnvkcERV`2LjwA7640n@LTce#Y*aS+38Vk<l}#jb
z`aTKgqq50mp=eY#8I?^&z~ZQE@);|e3@X!2Wv;TE<rgex{<7svW%R{P#d#h`*<KZG
z9z}G0MiE`VmLj?Ush;rnqQb6v3YXfL^hvLz2=DWD=$rmz0k--|f96)=Ni$0HSkA&l
z%h^}zPrv0%d4c92U1>U7kBh&PI2S4{cq(F$?nlc}0tbS131*2C>j^=Ptx-F;e*!%t
z&DdeHI}`n<7I>l35XSQX$yA<2!C~cUTYoAgiJYe)&^KhODBq1<?(AHOsj(Q^5j?Kp
z==-WfbPcv2yQz>ke}t4zD5Uf{xCbwOr!4e$lK4l|Xo24~YBcxF&p5Qi2H?7I(J6EU
zl7D|q$!(kT_2aTO@xxCgyr-JOciB@*yIB?+FK(8lU05bi=)%&QKpwEjX5*_m@-s}F
z$ed?fPN6NU8PiC~)vl(Gh3bLfE~ZN~m&NsfgZhl(*=Ltle}G^da|C^+kCP5bMp|1H
z7cO3;?J<E~pJ)g1x-}fadxZZFspu0(MQ-ky%ePp<Cs8Rz)WI~O4lYj8pc0>uO2p2|
z{Pto?Z;8?gc44}3b#b+w+*f16Il>-Bj1vA}((EpV<tpdrFlv08jkylb%S(Dzk3R7h
zxn`pT_c^=de@CX}iAm%>0Tsg_b@&*ARA>6yunFA5CeWGdHiC?s&)u**Sl{f7<i6=M
zC-+?y>)@srf*s<ojzAW<@?xIQ+2v)O%9+6lX9oMJoEfa3of(YZ>B=IeDK&T!<`}#W
zFvA0YFg(C<Av>n=IJ&)FAMP+;J_Gp+_2+G8Ag|j>f4??UNK9SJ{f<jg6$PZ{V!Q!$
z$sH#9Y(AWwL<CNHhB@#AV7nNH+sP>3wJ?xRU3$O}+3q2-^#()?L(nHQ1a+qNkD^b~
zqE{Dv$|IKOuCYX&Q51u6eL~9R{FuvcGncVvF5h4V4tI+t7<qN?8ZtdN<H)NU<n*0F
zroX*+fA=0IhQ~X(cP(G%$xb3jaLa-;5D6uc+5S#DvQCOqsr+hlUb2CHGqSldK91%S
zPnYnNZO$e}q~N7ErD-*@Mt#L~{9+WR`NV#s&f+v<c0OcwMpWMWM&*51tNaqWxaGO`
zcWFX^DF)IEebM_1sl145=iXn9wAQXwhp2gff30syG_D+d*A!TM<^?W!IydnG>lnnH
ziSq-!z~@<9U2{FMxNHEfwLf-57Y?@gA#72PW*-{xx6pt)Q_Y4o>8ABloPQyvXt^9y
z6t@oggM`SWOEE=fm%)9W^fH*)?;ClJ$D~9)Z`~6Jf93k`gttZS%MIJQbTc0V{JY+~
zf5CFo#2+VlN-sW-5K7V+on8K~i4*!PZOqa}3j~sRM<5W!_SaEB8^87<SYgnw3AtXl
z@>7NlB>5clY6IRh@*4CfVdz1WQS4N8RkTsb9|bf}R9W=c!2-c&jU50UY}G+rxd#Sz
z-N&$;TPy}hDyxpfLKO(Js)^f|H6`lFf6dZ-0rSvwh?N?p%LUZbpms1oN{`Fp)8V+}
z#UGBzZ!6}#!<OvO=2<6Tsn#e&QZaaZYDWyR4FV;>^5M2nv(rPSuR;mo1Gzto#DK(>
z0Qnk?!yt4Odq8)=KWp1g2MR26og9z6NURCCH6&{j(u)e5Jnx$ckCf+0RDBx-f4>d>
zO6dS>0PloE8P<wy?MM|{8UtE8lBd_sUT5IWn7vOid&%|Mu7CNFEA7})Uu(H15jV36
zi8zl8#zDi>*&?QpO9Jw%$BnA%VLEMX;OY@7AW1L7MB8tP@dYF^Qpv}%g{X`bG3N@~
zhs$DtsKs;^<tbFtp$L#V^UKYbe_l_VdtIp7P?iR^m?mA~x+er$Y(Fv^9nnvE<5IvG
zH&`(-Wr$291LMP+9hofk8C3*~^{KMYir@?OVCH9Z3owRJbqf4$EW3$)+~$v_Nx5b=
z2Xv^>U{3YGX6+8`1SlMAv%<LqJ&TwlUSv=<Ha?aY^fhQ=#J1k5GR<pze}Vkffm7iF
zCX6}@qE68m<~S*_U>rBbacaA$Qm%7BAd{?0e|%Y?W=Pc`N06Srvia6W@f4GYw0o+v
z>KZC>59lNnBd(MQN-Z%4-p1!hg8gD=L$HItsa(-?1OYCk3z+ketWx_N6wqfVKWHc$
z!$<enl$zJhpf9P)o@<Rdf432$_DDuYk*<#3tEt4C`i#1RN(?H|O(jy_qI)mdCCB^9
zE*6?!a;+f^s2pgTocgw~7+8IUC0caRdK%L8ZX^agBuoXQS=8@`q-OsVeHKCmG|sXI
zu>%*}f|Df@C`yz2QqIY!%bkU5+}vy?Uv*0FYgbP+MWJX6_m0;!f5n=k-a%t1MPsxt
zRx}1Zr<JPaC%i@`>U4F&tw4cqD&9$ifJ3dZ`65}_##EVrz$7p_%*w;`Mja%ak%H%T
z%w+Ey0a1N0Qvgk}um*xULH&she>(Aq-(69U*Rb-=v9d%HO6Gy_h>gMnO19K?8^Km1
zv-t!=;}e|CC#WQ|f7nam+rrS$6tk2C{m50U@1c;b>yAcGTF66VVTU0{SF+h+rlxt?
zFf8a?KF_S8vbMq75`9x3_ne~8vt*ZE@BEOc?juq4o<)h3ZVIi@{-bG&Rkot5MzveL
zT)F|!Ts53ImBL!5_0%9WgNz<3j3SN;f<Y(ab+|1fI01;#f2h<*8B=xHpR5WqB%aV%
zJefC#jsIIc8VU|g^S&zA$(V4Zv&<R~6iVpIYDkIl&sKOm?ce?Cne08?k#u2Zhb$|v
z26aEMum?QOmYk;xFPM{Pu9$f+jg|%weu|1PUpITUIM$UWg81l#H1m5e#Nwpg9;V!k
zC>!)hCBejXe?`Jgt2At2<l5TP?A!YwOY?-Sk{<?h%}%}!79*hR8^Z-jV$Ih4Si%nB
zhU0J%v*GfwStB(3Akt(vL$9XDn*iOHo$wyQYfv(APvI4Ok)kUI4p%Ei*n!NG7@VPY
zD=<c#Hm`j39_=p~^d7Sjm1W-342qrn#51qTNwV08e++F(7cjds6;fcpYbT&Hb)9++
z3<&kauIpNFcc$ho<vC)%9nJ>Fg5-9Rb-IA@#y1a5r+dswb2926w*qPn+Ngm>$}p=V
zB-Ho~l2pcx=<n1u!LO}y0U5T1O;H9S^NEd{5&>~0K`eMKHJBxxSGG)Pgl841zyetj
zkt^sbf9`p$g3>v>L(n>YGC^zUoJp&1Ng_g91FUwC^i}$CMRLFlgXdJah`u}Kwb^v;
zL@C8k=~q|sO+=}s-o;=qS{d7ZzIvPFJ`Oqb_~X0k@tbztlb<|@)$x-NE9ZMA^1TF3
zjoZ7Uz?qxq{U=J_Msit$1J))hXU1udJ1LIZe_%yx>~$s3jAkrr-3~Nv9S{7bZV276
zf;K_ep$JScdV@S1r^8t_OoV=M3)EniHnP92;zA9vic9^H((AI<NJ2rxQymafj!c3I
z6(eocS1(J`QtmG08*BagZg;&_K<#A>!})idhV!p8M4)rg4TJW*LIgVVz6O;TRHB<o
zf26)e_fBHgy!Ff7Rm?J*&J!kAjlLuZaDyKUSvgstfN7gtv#J#!|EHA{NFI<)*hcHR
zR-CCm<eh=6mDJV(F^*N9Ml>V}*nntKG&kuGTimF2>F3AEE<>$-Pqns}n-9JA_{sFz
zrFTP7gMwyc<wI3Xp{Jqv9xX{3$VMJ6e|sRVF{PzCMquHww&Fxfote_~1x#`?Q<|xd
zWX>!;+4kkb9RGtNy(>lP^xD6Z<gjd`=kMyD9b)$oyQf~UyVqqom;i^Qv((Y>`Ce&@
zcw4O^hGbpu)SGRv{xB|~apgT;?aK44y#B5(%Rd~_>yq>13(5IwP0s(vpO%dhe<hjd
zsFBf&1N``>e_Ti>f8MAjwfx!JmaRMKO|Pr%(YE>Sm;HL6=F0=+r(abu*p^KSvN$hS
zF({WWR|uF(g@C{c0imf7An?YvbGc!Yv~uKQfKeep;Da6xqCZahRJ>Fnz`IvhG5Gj4
z`ZrcFSY{6THF0=e4~~n+)j`gSe?Df)c?G<woQL{oH3Jre1yQEC*jJ{)GF0jY4Jyn9
z85~SMP{zRYYt$Rje^H@LX&;0)Z-QYi7>hi{22QjyQRXL~FV!H)$o&P3M^q5AvIT8-
zU+=T+JGg3;v#JuuYvrKMqryhXohwW3yhdnRy5?fk8EZcGhB{-fvBCAtf7F+)IQc4v
zP^a6NMgfrVaWYMZL9K7(-^rjB7Oj|lKS7J>udL}w_L68Y1xD@J>cgC&F7D82Y9HNU
zbAu=$n_A$7W9wK&=Nt`jhx+zAhJBFB?dul`evRPM87%?jUI*u?$Q3FGpf=f&_EHM-
zGFrN|IS>UjVF!KC3rI4Ce^gg|MCLXNb-*l_Sg9DzwzTI{%tY<kT!&{S&!>@;QVNV9
zWXd}5b3=g6YDE@@vtF|V^A<5%6;L(Nn$`88R5gQY0#Z)yd^CHeN!7$0IUF&(K)a@o
zL)?aZRwqTQxI8To>llcN6*P1y*{$Ho4%TDbBHS*G35){(Q3<ELf9N|=?y7$4^#Wh#
z8f+QYQ(;_HPkD)P{lZE{xp60OIEFD<Ei4`R)@QqCSA}O|O}vR`(;LzTWM1Og9}}#?
zq6aqKwilPBuKfiD+{OACN<YJ{pJCt6)`acIJd$hn-kEGN*C|#fi+%4sWfMr36QV@0
zMvy2<PRRS{31k#8e~Vrq8PtrWB!RXpbf04_p&mvm&5yPH?Qr@1vM^MKiv{3ZTbAPL
zWpQ=dpePl0lxbd@y3nPSyw_lXx!rHD)CQ5jn0byBLOprp6=@p}*V<vc5zZ-SS@mtN
z&qoipn1-{tzRgFjoom0|SJ?mJr{vte6wWY-cAG?d3+l8Hf90i|gz{-rMnYVN{>&Os
z+6~;H!nd=D@wrZmhkBzE02yd50Tvtx24k?eCdZRw1hbBf5yUoq^vFOqirgzfXeWq7
zMHm3zPTs4!6B)cF;E=oTquE*WsOW1`wZl++u)L$(T!TyXtT@s>Q2#euY%FX*9lKdy
zsFD?9+jg!ze@6N>f`b_kciTX*3rCUTWfb`3!MQf2Y1K!S4jNm$dyD7Znpwl^@$O!a
zjVX6b#c+BwpZgf6$3|7|C~<BZ>%M+`My4qPtf615A<YSBSPxQePlsIX0~Q{qJDxM4
zCe@l7cCva*9#dr1nV5&B7=AyRsCqQf(vn(Zh0ES$e_otx3=ODbY2D&BF-L!qF!&7j
zzLkI{VQ9lXQ3{hB5piklh<#LqBkT)|(MH6Z3R&4UHmW<qQi!Z$=y+;EthqSaMW)W2
z@Vo9_^3-ERLTe-oU11O5zKZ*r$JQEK>($eQ-38Q+%wnPg!?@`<015}JN{-dLKog-k
zOdyNQe>H)qyrU6PLeq@%fhZCT)dNbDFlNFw;3{0+KDUYrQ{!~(%N&AWw3lKNI~sQ#
z2BsgHUHyL3vJb1FG<Md9?yTMdNoe&<ry~1c0d>Wd;P+6u!`G)DahOUAFOU(DHRt%m
zS<K#i0hNU@SJWPbrGJm{6U6xOwo__IW1}6me<o`lD?P9SRy4;YmG__QnbK^kUlya-
zyzmO1dtEqndLc?UT#gcUb6U4HubACuBJ=L*rTANDRq$+L?cgusZyD3iXmw)EZ-5zq
z%R^A7`X;>x5xCkK{_hV$f<LNB76B|xVsN+T|Nk-w*v&a^YE(SFEPb2{IC60NruwcQ
ze}0<#2p1UP0>2Iyz+$;oqSvrgz4}PZcZrWai^4217mzf55#(uicAfnFwo`pdu`s6U
zAtaIUiF1RTo&2p!U-y~P|MQc-RsDvLcQpCTPX3mkc^;$o)8NK({Va-segj~3;<xnY
zb|-#=!nO{J`<?i`^v$t(3ewIOZo7zRe<{+Wr;#47Ty?$q^n*1H*7z3I*jx7hgGlq0
z*0*g9doM>%&L1zFViujHyR(E4vg#Scr2!5^xHEuZ1M>Wz<76?=r(ecEGkgz$T%M$F
zX%NSxdPCvmwp{3{Q?SvpL@B65T6|cl4aX)i0X?(`%>hK2ZOvnibQN3dH9o-Ce`ok)
z+K)Y!kNd=L!?%MnHPzun*p40I73^GwP@-%Dot#Va;naTDSHI04iH)5O&X!P#iH|AK
zm<37#sUpTGVd3M!_QpiYX|Sh5G+SSDVDqKu0^M&U(3j7vUl|^LY$Gvsz{$p4h0obI
zLJb;^ziSVQJsFwbx&L#4_wIi+e}Q4To%Qt<T)a2NWbn+vGvC59yHBZ#bvD0dYRGMb
z*xanjCx)h!=%>OtrdmJDaW(Ix4Lkb1po!xLJ>{i187vsY$?&}w%Pd!g?5xakONY%9
zf@aERSm0_c?`X+zLq(r#Vy}vuQX_p0CSqMwYyMm?i{@%Nxu$mTumej`e;9pP(~et;
zkZ%z8Huce^`-pp#(4Kysr3QiI9JMSpq8GE&Oj4S5l9Ex;bP4r|Wtti(s64vE()3&o
z@^k>~FnXPQp+O}%?{;ESJA_XMtAfr$&MEOuilArZkaHN#RK%v84^EIGN7o6uJYDA!
zC`BDaFu++CDqKE1k&=SVe*n=}T$Fu%I}z8*pmF_dmWsKrMJD-X#(<N1hngvjiKV46
zgG^BvLMSE+r6uIYD4F7ctQdFDbr>_1udiIog=&M`LsX#2O~4s474Bc)Ya=<<SHdM1
zD!7n{GGj;CN~m5omWSh6wlKtbeZ~|fSo)~D(O(Q799?ncP*^m$f8iom(d68h#ykQ7
zo6o%=An=bkW@mc;P+W%M@)pI#ZSC$@c8um=mCZ!nSwmSsi<idVaH{1hv9pSifI$vK
zxtsXt4$Gm+D!Rjc3)p44<X%TQ_>d72#%<`>qCcpkX+bQx?U2<E*$v87o8I~0$KZe1
z;9nJ};-?n^RpKuKe^usf;O7?uRm#;7sPcY+Dzk=BT^FdbX$-T!PoN4VI53x|QaE>l
z<d^DpCI9e@btFSjtc|xLOkoR{8v2{sbmTuJOf(h@vLiJk$j-@hCKVkP@?eOoc-v}r
z4m1&Ooef0DTSR<n+ct`>u-a3<#X-hap@m<jhX_@=Llc|mfA?8W*XWsVI(vL5B0z4e
zh;-_&kc7bV;LoV5FFs#=^g<zY0;^f~pm%P+`fyGE&~SiT?D%Yk8F<<tGc7jQNmTVy
zvv)1~ncJ_uWE*)tzOa$iBuF-QEW)2{<Wx5$_mIvj&;6ufmsm1$4Lmkvk`xqo7!-wy
zmcxX@1(Xq^f5e!T!7+qSZY`$JGG8yOimTHoj`MsU%ib5yhW{gC*_j?YO!HsaG~ekV
z9kqHO&xZEC&t9wN50*k_Ny#r;ZSxO?BQuZY)jr(DNHr>KzP$LZQ@_It>i2wE{f6S1
zIYH0!hT5wab={~Y7_IA}PstxDx&khy=PJTOZnsC4e@4q)ik55jYnMjL-FIV=ZXCnx
z*TXUTFdsI}bdGhHF7^*5$Ln<6#WU+Pez>&6;!v=2dZrWV(yu~caWHW$sW6+%odBuu
zQLJ1b(U?jKF^biu41-Xlx>BpUHn8YAQ@yf6{6^3fql_XIwy=}myv6vF9yh(bPR!~(
z77N>Je`FfGG1DM+dRERu_S)z<CgOrJ!@j}*OH571(&6coN+YV!XZnE+9A(a95t$k9
zr@f98?x9A~&F}0yJbk9@t;rx(K!O&gZ>&BaOEOsM`j3sQ@+>gWrowR@S}>pb02>ZW
z{t+S8T4-RbtJOC!?H;>#U$vQ*-YVF!E}?H4e`nPtyu2miW+Nj0E{x_ZEW{#fl#<bP
zwzNVxkK!PTpj)a}p=?cRT8kM-_s))~1^ysr1V>>OEgq;vC*zb@B6dbdrg95o6%9ty
z@rAGvGeR^U8?noWpBuY8=I3MPr!&U)J}HZ-uU7pV_(9r8o4X4?zyi%oRDm6UCT<L*
ze_6PBhTk5wTY+WYJV@lKFp3W!?v3!@X}E{COrHNBZ&@eT9$|aU=WZ9a*L&RQ2;0+Z
zBW$lTY_Inm*bzGR9&vjM>lTjDzsKmOzR`b+thF)0G;Hd_rao-y)3B)zoBFV+4=QsL
zDsx?kz)J_tr^_J%Dx?<|`m?By-PLW#f3svrE+X<v)P54q|0uEJS(bGG1)2}rXnT=>
z<o>Nk(O`Xc4{HI<xG86c<3`uQ;TS^lt;hf6=4@D!ISEqOQ{hRQv*x1{df)_>pElMh
zpVIqR{9d2k!*6H~J|+J=L1SEJG(lyAcwDVH*35GM9!5#gl;hzTr<4!JInL87e?}xr
z4>=+kJ=aNbzSt0E8HQwC&&`k!);44vhGos0G?(TjU)KgF5f&TGmtn};GT6E=11o1;
z`J^A!J2uhC8?1Nl;WrEdUZ1w{Mgz9}9Bm9#beqtWP@0l-ZdzDBA6#0tWgtC2dMWXG
z)#vr~I=oL(Vmjlj8Z9s94wX&Me;Rn5tv#HN7JkDV=oD)gpK8C8?9xE@m~2og74_yl
z{FX6D+v_h7ik3L&JtPkG{yqGLRbV^NTN7;gD?+pOD(c;~<YgLGsqf4EQXk&KZ)i`Q
z{-<3Nc5Q>zdcqcH7fcJkfka^mINcihVY+JfYh)9Sd|59}_d^T6VGu|Mf15?wwn8I}
zR|QBe3-A^$AuD~-b)c`y`d-rJhCr43cHkd;_}8p>d4Uz@U$Ei;BmE1kxLg&>x{Tna
z_HOjWN!M0gNnzVi0BI@&;+>h372Bkmg-^0b#Da;yGx{iyN4}CKH9TqYw5J10uxS#T
z+^7FEb=jWB_^s0UooplHfAE$1)18^8LSuka<*IPSjV!oX)Tob7?qIS)f{(;Z5-J;8
zEH$)27Py-rxWZrulX8vY#r+d>3p?Aq#pb5q+|?l^mbrwweoPgB$Ej_7Q?Acj21%nr
z6hnApBX^efM_C?6xH0d<HQM!A?8)4A&|jZx(rK_627^y%Fz79Ze?0W!_p!e98f-?O
z(8mM{bynIL=T6!HTvxed>Z)Aw?X8w>+oZ1_m$k_#dMd@>t803f-MF-yWwG(%W?9;W
zWdemREWHWj0gG%lzN#ZX!`+AsKUQ%sv}HBN7Ad*<xb(45qanD98J?8O;<7`hI0g3E
zr4=BU*%U#a8E?eke<0>w(VAe37d4a_W2{fKgLvH<4xwYNhE((!r6M=?%;g)r(vJD5
zAFn!%2*5880XV3{XQUFnLH^%fY?*s41n|)^oJtp0+sUw#SW!H~!-!Er5lx!i#gpDH
ze|~Jt&$uyr3vhn>jp?Qyec~;0%|;2<`^YsvF_A<}B6k|@e-Q<**G3flIK*-KiiYTM
zh$F4$4KfaK{Ln)juZtMWm%|jo^g>NvFR@%v6Iw6CDV$x766B--f}8xeu~G#eThJX7
zKuIE2*Z(4cCgO{?xDfj*af5REq|ejLnstpAV4n2SEJ0LqzXF&`1s6oIJcs4m`mi>p
zwp-SKe9o6XfB4b`fzJPKMC=$8!mohQ0*^pR`RFC^IlxCG97^7#q)5jOD+8^Bw0ar7
z1gW|d`KySN`hGz8sKO;S=o$DN;3LvTeYdwE#E2l4Ev)`<+*qjF{!L44<3GkS8O!8C
zv`}zDgPsT6D52s1&SGwUL5oy`nHib7inlduv=_nWe}D*xvNmRo3as!YNVuB7N$;)j
zC1?|$ttpQcd=6Z(alUAu_OtBUSw5yIxi`<Vw*Lw3<DgXd62x&~2P%9CIvuFOXt1b(
z&jE}Hhq{2zfh*_v3-)P0&*6RN*$EYLt45SoSj;#QIjD9Lt-`bljh}FRRu||Z8i5A6
z3g{7vf39o;!Qx($85U4oAy$Y>bwZ`ws&|~h3%}x}yx=OAN_(!D+^^J;{fx%<q|f@P
zfQZ8ia~R;sb_nRt7>2NvVF*Y+kzw!%=+$8eEWIFCtys76TAHJj_bxF0?cs&rk%0&c
zrhqNFc1FKUSN3x{zj{v3jK$leZu~u8ALp8|e~w43G)DOUkXmWOwetyFJHzMtzCPDc
z3tr7!->MdT?#p%luC?ITka~t=coyEtv*08jZ4Ce2hTpFp!~b20feUGQ2U&2WTNL<R
z(=E19?3tc%Y{zufu^s2pB3*+$2=h%#qJ$R?Ee*?M2PZV<u)c6=>4nR`yx|J_$23aS
zCki+M)t^t&NIkko>QVIXW8oT7&G9Bu&C)qPBV6e-hbx^KUEXOAlRz;Pf8(dvNmf$@
zPNT4+Tx8OF%-l<<zNI`z?6(8U6_?lN=B}_bFW4cxZGkrUXm5F8DP9@tKOgf9N5%&W
z;uI4WxFOdDgP6U|^x7asfPk*bKNVDVwp8%MaRjrD<!-J(zgv&`3DdfBd6A<$|CWJe
z-J_2m*pWjqawtX)#TVvVe<O!tC?%gtDOvjF*h&|HyxN+xT|~5;R8V8tud2g6Qgbis
zkEzRPKlI1XsXwNkT0leo8}i><<Ui+omR;U6bZ$9Jg{isF!y2>g$!x2IJEUcgnz9S_
z*?Lo<-=$_)u>1L5Xm!=>E@-ZDLMVjfnRS_qiOp2ER^#``XI$RSf0YB5pBwCguVQBo
z76kXh99)T}g~ySEqGNN@Nru~+VH)xf<!@cTZL8j<$Etw<Nf5(8@a_hJdkpMg5Q9Ms
z1Hm*51j9fu3<PDt4+Ftqje|A5l{Kz?>uxAdUrc#=R$#lM@c2lY`hH1M+y3gXoqXFg
zi8=J-?2I`4>8d#V1=m<`w*8ZxGai3!k!j%`akczERiFhQ&nthQEr9mHwQC{lu*ANg
zXKuHKIN=4&xw+T#tGwu!-D|IM|GOUd|F@5E*(PD6qSw*zt|R?+Mubh$!I-NZDAh=F
zNE#kQYo+L>?IfbG?kT0xmJ_GI1DPujNrqHLMf!%^y7@VhP&sPeZJc$tIkA7m0$PG@
zoM8^<s?NLT)_4Kq=hnDu$$9~sS}dlkmul#loDq#h?t15Ftk>w*()c_S>>DW9cNy8C
zVGj*^XxP)xu!n{{H0-kAhlV{^<6w<<ijf$s@ts)Xrt|bfE8K-MZtJqk1~wSumtl+>
z>FSu`^AZXmwJf0kO3M-oEy91>t}LN&9?a0w&hKQ8PN^%J<J;S#^V(tL`?mJzHO;Rd
zjbV>&K6g8Nw4Zt=XV{~^pgr3Ak1wwIGwjj#7}=q852bt9qo=Q{bPs#<P`f{s+CA*i
zgEbD;s50lUM-O}SutyKZIQ;;7^x&3*TfVJ2Sn64JBf<S^C%CU&zOR3g;C`%P-uFmw
z-x@iRFPhQlas7=1cWKc(C%A*!4Ts0^{T&|n7}+7G4mou=JoFRCFKN{o4v%5i`BZkD
z;qVx&aj-^}IXg=$+{fZRg|A_bbv^C;PT|2}9pS;3?err&xEYOgga?1t@ZgQJjqu>3
ziAUc$Jb075$B7;{v6g?`V`PU)FjRtJEz?gNhqY{2%Z9aVSjz@$9IWy94y<ul%RY^@
zZ0zN+m){n=7<!i72wwc!!HaX3Wqt%N9;a^>yy)_%9Nmn@+Etu*1TRkSAH0~;IG*P=
z=Gc3T>>cFkKKtFrH?-5x_z?}=|My@1_LswdI{fwD{^L)7-u{0%{L?@E`EP&uuYcX>
z!$1G?;XnWNFWU?L{4al>{^#_d|NY;MvHa`5Z$JLynZ)VVL)<#8B||RMhi|T;hu9!W
z5n;OVpja(refS@T|NSSse>zlXd)c4={#$L`bolq*^yB~N_{hGWS^60df7>qqH|@j!
z*`WV*z<2-qzZ`%5{=ydBcXgw}NgVvEP#%Fd@yc!A%ggpt3vcw;3mlHQz|(ON{YviH
z1Q92+d=?MeER=i}4R8^+S`wAa$#r>nVKhJzGg`Fk%8EA5;J`k%w=VLTBsOZjPLE`g
zWu!2|0Jg_-ft|sdjIxR>l?bUP2r&EP{dQXmCyX{=w>^L9<zq?i*!Y+Oq`?XS@FQUv
zoJZb6*kKq}p?vy|M2Hku;7#9*GV2OU`}8R-X`}B#ahpTV+fXa~cv!Vr0&nbY##4Y+
zy;otKOOa&27}EC0le}fSRX(*b&sDVLC^H!VZC{aI<5wBO4GID|fxOIKl3(-o&n9;!
zdFw2e#qEE(%(${=FCSdQufNDgX3TDqH>p^wBNz{x=#XRrJ(TnX&nNj|o848ux(ejw
zCDCSodv%moZ#`e+BN}J0VkYGMLUmWHJU2-*wx#J5bkfg-w`|={=v0u!9-+*xnAxo>
z;h<vNsv{#Gs$(c>m<k?SSEG!mG)Cbp&EBAZ5mkTabWlB1;gqo|v$Ri_f0iC|olO{#
zBvZb~V5imA`ywCFMYBlkQIxTd!s?|v+ShHuJwj%-c6<5eY%`MO(gtVj-c<%OYrmtm
zZ`Iiicwv@*oLq7s0y-M2ESp)n?+zM0u(G=jW`HE4tYhd88kD2YBnE!SR!?$Z!1h(n
zSRH>qRchr!Vb#%8m^%WnzFwa6LTj)K7F~<j9iTwEM-|q6t4{&Kx>h*gy}J8%uq<_h
zrKL(gR1Z|DLPJiL?*&kYycn#bs!suOI;(*3jo)Obys)|ir9A<D1U!RQ%%ql!#E2N-
zlIJ3Nu*k$997AR|N?!p*TzBZ9Qqyn<It71fPY~#Y{fb|+-Kh|t2fWDYk|i2-XG)tQ
z)}fxNsIAh~rPNycHP5;Zev{vIf}HG%39BYzX=EjOD}LkK?AL5}Y76xFlWb=%#7O2P
z=?a{5p7D+dZX}$Bj-yqEJtZC0-_Td>*ArnOm`OGa`mN)_{Uuw|#?9kSKpa<vWz~N#
zGUPGIB9;%ujO)^hs7;YY07&=&uP0gm`V?BCp0CnA8MkfO1{u#;l(z*>N<U&agY}+A
zdxE?gPlNXcX;%vu9uRcz;R%I#SCrnhusuOp!Tv{~OvIHTC=5Yi2ns_`7=pqO6o#NM
z1ch^R#QF+z#Ca*Fyh#n%h%eau&Mbem!p~g%_~Ne~VRb89s&E?6i@O$IUkR$A)mmfQ
zbGZ}X3X;J<>ILR8-bE)d;@AoXFR_L|*nQ<|fKQe>f-AHmtCZy6AIHn&KHt9ETeKkk
zK20yLGbQ!~W}KT6JtB~Rm42t^nBCcB_Y8fFeS`U1=+=Cn^-7OHg6q^<6u*Bi38ZXz
zEEYr&c&;Oc1t`XtxZJ?Z?U<`8G`qU)VueqZX`mQlHxUEj)gt_m5UT*!+{401jCOsm
z=1xZw@z&WukEjZD1?RSH=(zXro1mxa4f7M6s*IBG^#5sw34VNlJJZL;O?6%9?pKOW
z3TmGpE?9Ojy3{iqBjW}ED))cRxH$`%?VQZvP`}Qhz8~$}H`*hUu=(73W)fcKJ<XTB
zr*XRMJ=GAkoH?P-Hr(zi0u!I~Dwxdg61C;IQKCL2f8^rt0R8Nb<+5K8un;`K-}P3%
zm_rnhJ@xx@Z6rGB#xZPK#o-uzm=DL<&#?~E#s00+uLQ4i8Z!+g<Qsn|AtQ0>@IHxC
zG4zf9kf1)J1l2j2-@b-Kn!D7dH&_oA^^o0z(HI>EH#aR>DFTCx{nADpC#*K2s*PDF
zc_>?xQRR!70%RH%Gv9=%1*%1;X^1F@q!FH5#ZMKLC_`Q9zCqY9qTnpf(c&?crg_H2
z^YsZ5N&B(u7*XsBtb2b(2(h9ujFyy{Dq=Z{ppm3y#`V`~E76Z$PC~G($GWLvOMTBt
z6xsK5Y{T%Co-(7-RroxkGS|gmnvbi<$+C2IISu)EIj2Es2qX??eSJkjWgPSKspn_u
zo1gob(USXUYx1Jb`+M*MEKn64pSW6Ambbz{I&f?^#S5t23M_y7=0PG?Wh;KT@qQAA
z_}$pAic!B{hD&&kiG^vd*I+8J8e==m!6*W3$AE7aK>l4V$Ub!~&9yNAK9ynzHKlTw
z+6SG2WL9l@kZ6?5E(JW9Oawg$21hU!_<3g2c9h1?ToVh^&5ougDyK5*0hLuXB<N$I
zX7Q5#)9_gHAvb@KN?kMLmG;@CRqJSoj8H*WTfllFO{D=V-%>nPBVe*Bo@fX0IvJqT
zSTK~;&#0{SRzVr&{vLDxu(RFwkhZDkkhVd&J|pFFe$3^!nakKSmv0Iy@^{iqh6ieR
zpgtjI93H4|L{5hX>U}*>gUWPMnX3Y7mg$9n8h<&UMm2x25^(ZN$=Y4joDt1Vc#^rA
zkst6VsRvn>bpQpL5uyKx9Fv$dxuib3hoz^-xT$}K<3`uQ;TS^lZG6nj&B+sz-a^U8
znY1~pqzTMka|QJGHRz}G{uRI1XZP?MnuAYGnmn^I#Yvl>GD6gJg<Uht{d-uOu%sLh
z$2g^YIL?1@o?bB`*=uHtzAdBYIw@AiA!v@2*KgGa_OP}g>o6>9-lVxSFZsGQY&%19
z(KL%sQo2?h*pls}8H7PByxw5Fdk?>15b*k>DJ0T>u;>ERF;LNMLQ_I%O47M$Vf}n?
zY1x*6^!(@-pRW77zFvn{6ACgi(KPeR9V(mN=EHwwO&h8Y?BO@eflje@@u~JZ$u13a
zCd&q;IkVophu<;=nql{xP_)EB?;&xh_wV61tODDC-kM;`UlBTiR`EM9dux>(GVYi9
z@E(3cd+PK*?V7M_o8Bb6CY>#q7JdVX!V*Asm42AMoc$Vc0V!<d<~{s|K_DG$7G>KC
ztv!FZDnN2sfVXf7S?QCm1ASfA_mVa@1ghM(1OMQ|zh=em1y&qhs0`%2H0%XdyuT{H
z-lj5;d$-C!G4@sl+I4j#{EvkHk?=nf{zt<9NcbNK|0CglR0bM?!VnaOpfCi5At($%
zVF(J>RtAc5e`O%Iieo3OS0?3-!a&FG5D|Yd3IpAIy^g{_a%B_-8ij%WU^qr$pzjn^
zGztTa!a$=i&@Y{*;RWaE@`Cep-lX$2yyQIHUA<TsNY_5d68xR`E7yM~?5sEtu;w?{
zlm~L9JWzR4Qy%CA+vPo*^jsy{v?%=lueG8%$8AvO<IA$(*#qe~tEFZ7_yd^G?U8@P
z`Zc7Tk;FQZSchmjl32gJXgX4LMiT3wTqB8f%;kNPSS8-T-$ykWKAZP6Ru9(rPONcc
zv3?_ZI<i<_X?>huus*(UsB@eUkFg#vnjg<D2bef8rjBEFo@PPg(r>t9&h_r#G}r;R
z?T|UQ&*Zf}L(e5{+aY;vpK&bPsK|dBns@II%l!CF*2JviK5K2(Sg=R_U131h`v~)?
z9GZu6Xr5UT@<f*k^BIjSv}e3)o|)@s=JqSI*B~0+gy=&cdYO+9{_RjEhAUY@n+j0o
zqzrBuOugR1Wn9bTmC5o9vnp_zw>kl3!1aa}u46yfLDZq(7%I$Ro7)kbo2h@&n{1{O
zS<SJ~%+p+l95J1)-anVy=jLt>w|8~473KiX%~(rn)uu!T$uE@p_?lDJ*u=*+8QWxR
zljm`4xihWqoC^t}d68mYUJuCntnel1L|80cvD^*pC3usHk5hS~!j~Z2i<TI4{`YiY
zNc7OZ9jjLY@_l+ZPu;<bL9KtKv&zfY`RTTu<NRkR^$sP?tH{U@EL1i3tSap-JPS$~
z;-~20^zfdZURTYXWX(iu)r==75uw86!xLpws3D9|Qxi1awlC#wVS%kL@rG=@b8u!)
z*#0@OZQC{{nb@{%+j(Lq6HaXViEUdG+s4GsFW<NJ-L2Z)zs_BKs=DgbIo<c^yRXmH
z6^_;$ZwgRqU8jo+bg$|d9cq4mBiQMbn3(-SVI|_NQl>4;`D7#b@;HN!<6?`50PZZX
zK>V~Pnk)RUjz9WXh>Ml8@LXcynFShtAz@Y4`zkDMWp={Vlno5r?V`n6YWwbs6xNSe
z@Im^Lv!!Z8TyznIaq@csym!D-BSu4Dz4onD4VuV<uE&wA1Px`(9WqVB4T4SAb>gSP
z1jsUK$||OjIHZ!a(4b`EiBcF1Af8WjN>t@RA{X98Gdye;VvWNOzs4F{;H)SjKM2v$
z^7+@_i|?1?nnl011kYrNu@xGy+9VGO_2Zuc(4e1FtLr9f%4WmF?;P=89R*_VQm{P=
zVqM0-O|(00vL2y(2mgf!j}pfgPkqus#*5(kp)`#R`mOD@&x{^oGk4!JV5kfX{3GO1
zfL@SM&o}74cUo@uF9cas`;sB+LiL`Cm4DTxL-@pXWI;Zg=A$atwtZO5-QTu&KI&O+
z`h63`3CDa3@32-6C;DR!H+nZ@+YwFXDyQZR_ttp`QeCp%UYj~gGji^*QiC`W3cL&F
z16%&*Vj=w4w=mKrYA!k_!19U8Pi3jL>M}dglvQ$Gb8YgZZP3s=`2L~VIMwl*$Wyi@
z|8DY~AfX`fn!2tKG=$ksP)fNz=|lAHELIrcU;ifzIMVPqh<}g{)G6yeS(ke%*?b8&
zJOzKzIw@3X_Gy2$86iBJj)?fjDSoZIh^B|Q#@(um_^pQo>9hIx0qSBzJPG^nGDD7M
z+pcukUKNHcq@fs(T<j01Tw*{M(gV|qk+>(~7TEo(6eX)F9vBbP(LxMF5wY_O-ps%o
zY*;4==_j*E>a?~7Fl(DQs+0c6P88KfrQc)F`7-*QehZ*Wa?f(O`-F}8LS7u37U+(g
zYWjXqjxKZQG5JsV0bKlYC%cOqoNprNpV1Q_mU(6u%%EN`82M(+&W=+FPOuoiZo}wI
z@v|d2M0(Sm$LT_|V7HZLwf^?E3Tqm~zf=~8IYXZ)ci2_|ll`>t6C{X@!W5(uP7)jw
zT!nC&%YXqFb6!EVJ($?q3y~`W@H5yf<Wv(SAYZ{CJi!xZ0P`DJQ=L({z-fO79Flh9
z>wjZnDaiiDTGkze^#<$1ws1XGlaz6ML#=a(%vz9AhokafN0K03^bt1k$cKxo$;Ly8
zEexa__S8$IupKz!YRt#rr`eV{WoPMbFz&bnEjX`S_p7UE1XV0b9vlX!DTK)X*f5~{
ze}uASsNF?x0=yQ_wx5?v)HbXh4A7>|1vx=o_rWK!CCs#FQWegka`BPNKO4t!f4S%O
zyRc^f<;AWyGrR)kJNns!ijOozNCy?ntOKtCLtnw<OyD^D(oR)P7jlsyaQ{f_$R4pt
zi@?nCJy%DX^Ipnn!&l?;*!j$d+|fkuv(19jrVZi;0G{N81Y)t}?5Ni6f$~ewx=Jve
zri#S|hz$)adWe_L6?OS${tDr;aODM_%OZ-+vV)M>mdY4pCKI*52VwCa^(=n-H!e6G
zm*t8Ht2$7`re=;`C0Y|XLIxO6+YK)27WF&u70?wu2$bMS+-;Z`YF3QYMUOx4<7Lm`
zQrJ_E0W-icuIrq1kyMT4s!+QnUm;9-$b-2Fj^EDnOVM;lqd9!Gf1LEV73Vw=R|u45
zoMhk+whG-{XhGy21z3Ll!=O>g*Da@gegwk@_1Q&i(23j=`~CK$ui<AhMr7l>#_8(*
zMA0MLkcAe)S|C#&PiJp1Zm|9})~st1+^U*D1323Y-#3@4^P-h4@8fr)5#SoJIWBW3
zBts6NtzFjiJjrqmzZvvC`H6lJK^aZHUoBq5WJqJUiiS|-PLu}7LuZ_aIoR<b&JKo;
zD1QB6qoa>I@*{yeco0<%&bTfDcPedfjkqCI!1AjEd(aLnj2G@-{A=>j;y5){kxGIU
zJwPQVvHBTIP(Ci94}@(4Y&<hjnKT6NH4JY%hS4mow;_0eZRVh*0yC&GQQ}20Ayy)A
zBvB&2q0%P)VzR%CT9PS!u)uesNPqkq#~?Eyl$n9{Q62krBoe#I_9p+V!&fWeR*GZw
zRI<IoucP^B$sKFur}Hqy1^9$?x?7QEAwYr2H5e!o38&FxGbwIHM!HpkWBK<tQ(iGk
zf4+<Y`aEqOsa=;^B-{jEqCkSE+Vp$w0%c@~Ev2o6OM{eKrS>GeO!#6%&r@O(x5FK3
zjeE|c(%sMoPEyEhbz>K7a}#wmKkVC}I4IE(jU!{8r2Gzh;F5FE#%$e1h8nc!5r9;U
z9c?Z_r}PM;-TDZu(qt?rhu@Dy(+z$D!408_JT7Iu1TwuXBEnp4l>boW)P@hX>>)CR
zsE>k`|5S@;2AOji0teMbOddTc60(TG%ugzy%Pzmz{3-A}C||wB6*&gjyuhbsTdZQE
zT?~0yf)59i?RFC=i#X_psSNT$2naDR<YHxsl&+T_1MLDF!lw73u+b|K=Sf+FK&!qd
z<>$boP;Wp(^z#d)kl;v;OY$ex=BbIkqVz$N7P6Jl5RlRoDnqWYG?(;Iqmm?B<fOAT
zguhM|mtlO)A|ANys^X=1efUDK^DzPesM%x~oOy6Rn>0s`%Qj`%89OWx09{8nE%AHj
zKJh0jG+TOt8pp`M1KOZgUKhw&J!7uH>}z-ZBe;`E22s~oM<nLP9r(@BS{s&#MJN9_
z21J8ZHwmx~hIg}v3JDN6Et$KusfwqfXzVN5DIG$O>rQLyTh>rS<6aVHP2JU%Bl3qt
znkYNhEkm}3NOZMH+aS{n0CJ!g5~m>-DS*ZPU3iEcV}@8F-GFPryd-PMl;`I74^@^l
z7>&kpB);|%WdZ(Q&{A<YNC$AY9b!V`>Tb*#VQO;_h5O}l2lSULkO$SY4XLwV=&lQF
zN$SsglW8!4T*KleRM<M@7d~7&{Te&{`S{It4&0J7e*#6w36M!$0L-UQ?279smiHcx
zLnX}?tNgv=<;)2}BT=LL>np~k<zTEG!v%FV`)Wn@n`IU)l#qI5md0vI1?$M#e_;ib
z)aVgCZCO;NA~>|y_46y&atvMCGobjI=zH2rp)V0-fibe3B~yk*++a%BvtUVh>r~s;
za9iqf+F=Z>@6b9o06hsa7%|(;%F`l7Xd`e|2{Ng8F%JLUS~YzG;ZU&|JBpVb*%Bw`
zjP+)svZ20WSc=oR2x0Zp@q-QsZMCY=u?_xTV3j8o@v?(eWguovL8wFVR&a`AtFB;c
zpp%R`YGUH0%Fki%r0>*lM>L9(c36KXCfh8*r+T+$vv@<!0X{IxeoIOD=l&>qEi=h=
zvDxtA1$!)Vq;ZrHh0~deMSF~PVu?^ET}Jk3w^NRdFetp@_%cKEYS_@bax_$0v1O?B
z2$f*u2Wo)1Rq)j%jCdR$w!XYUp+|H#<)S*3Fn-KRQs0SYNMWZZE%J%K#73mGKX_G&
zOyhzw=uS&Z0bm(&n%Fu+!{%<T6d7<N`13kO?n7-tMx$gu3-1`KDV>5*nL`$YYlgTa
zNi>)DJDWoSIK{tZyA}MhJEE)DEBsT<f#amVD7oC%VWX{pjns!~!@vIySXH4X)idvj
zk8t<xAG?7Rr;r4o7qL`DNbhn7QKF`M?Pr}Ls47Rh1123^o9#Ml>}66}pnV5PR@f_O
zv{3NHe<ZmZ`Uf1g{?MZ&mq6pF&cLCxpia36y6oySBqsk{r&a29gjv5Iha7OR$zU{k
z{b{^}E#Mi($k<$FF}h;wMW?jPomtp`00J2?`KUaXQda}iP{@4j%j!X6If?_@P2i{7
zysQ6}2LPOj*Q&UPoX;Bu7=(a4rf-G$S*&>28*QI9a5B2id0{nG{nZ8r$OjmrX-OhP
zK$`stl+NeH#QMVvcfZVHE<Trnia~n3V-tOFfP5absF=$+71(!4ZG#BPh7~A{$`$>0
z=ztuFiwfDMf{s^7z%!avmLo&Lkf)UqUG`F~AFx`~7?Rl*bwE6*3U!b$k})8Z=0`B(
zF6v;Jrh_e{z{sNUQ%<K*N%f|KgF`*iN^jCIP^62cN`<eg9N9?%0@Z<+%`sr8pXeOt
z4xwFdy*NQnrGeuhWB`(4?7=2@1uBAaaqdo5f(P1H<PwiA{7PDzN7a~G9dSl1nqKHq
z9*{trKvuur-O|9qsvDcs`~kyhVXtGC=^Y0_?^vIB90f5Egej|G5cy<~-j34uBZ3iL
zUf(Kgc4*wD5_LqDBJdE2hRsNaG$$?$A>sxpeW~mKo3x4yO6>;=r6{JtZdTuT)i4se
zarU}U@ug_>WyF%<y43mHqa;nD9nvhUIzTVRHNSc-H^46&i}#H!*3kM7TcK<){oluk
zFlY3LbmI+nENEH?VIiT8B<HFoghKWVFryV6#lz;qpJeDle{HRwKNdl24}C`}?1#j0
z`4`<P!^He8&_=P~`gOTY)Ib%AW~{%g)%O=6TM5C=pi2n)8Xb^I5E{;5>Kj6gpaDKK
zoVPG47@dhIqzPvPbF$fM^|%|ful9}5T?9u-HbCUVi;0vfr|`p=RMgl>L%mZ3#i#@|
zTC;@C;WBUx$lFGnBKI}>pafCrY@9XO(U^t#$UMSo6ChshIVEYyiqSH`T-?a1iv*u^
zQ!rxml_PLtqHk}$gulnX-(P&=9WWdt68><B&}}URAN%y6hIBoCQ}d2|Ep5Tx8!<&x
z_i~L}8&6+8Eo`;vY$<F7L6_fnhU8mhR4sf635$-&$H#;<>*~%S%0aJqxoMKwId2T@
zv`GPiIzi6{JfB1;{1GN)m<Ar_zzK8Dv!b^cpL3!|ozrx=4-xpiVIsE}4yfVRXdijt
z8*Cxz{y_d$&E{}u!L}|ybbTCQyWRXdQ^M3Ig_EQHqo$Cx2uKo2aIJc1D%$3kK;1Hp
z3q3&NNLBhPS6F~lMcfn?$b^$VZvlg?bwd;nv26i^<Nj(?3OH_kt1B3e^491WHzXqJ
z6%coQ{~a0E0!}EeT}66830SwLVxLtqIgdgu&{PtRKQi6*#8?A=`8#~dKu2~Qe-p%?
zl^8(QLeGC~Bvec0Lc2IWv(tZZ9F_LH;0^!F5TG86o~JHgfcNq~$%#QnX_`4WeT+~N
zR+ItWiB!hn#EOThSSR<7B^9ZGt8R^8t*_hc=E<-l__EtY@(C%@0B`}<;4kxDz&QTq
zO+KszzrY>68)v~{3&uH;yHo6oMD|r3Gv|=j7t8U&H?s%5ha<!<NFHG^Xo!?zIB2;2
zliqgF@b^iskJ#6}mp&j2cKi6%HyX0GeOs@1JHL;PmHl}?o82=jO@RGbp|r0DYWq2a
z9c!d`(`_-<aH2!a5P)4bL-zQB<Ax2{YxLtC2eMb-)G)c1fWpy13DjeSR3JgO({6X)
z*`UocdH##D_<m$n&_IUeEGbJOR&rA_w^jUryXRSluG0_ouN<80hIEYA@2mnHvp*ZO
z414DJZw~Qjev(gr&}2l#FcqGKdF&S!Po|F2kwl{^!7RngLIJ3tnrioUM@{l7LxWSn
zZ>q4d=(x1DXE}Px&g?1)>(m(A=Cn@hSLeo29YtkEGq{gcM8-2`^zJO6YvRAwJ76aT
z`SYsp4hB(XIYHO9@Mo8_+V04rqTDeBu*HFVIDNdo5AcQ)YmMkn7y80EIU37}3gp~y
zlf*rHp^;j}JORHfAmA|H3f-9JplFv`W%G5#lu0=$+~v4R1i(mtx1_@&3*#*aK<OpJ
z&_NB_RReJdBj>4cu;&Osx6Szq?4B}%D_UwpP*gwkuL*<}0l+<MRlgZEu7gIB(hqc=
zYNl562rCiUj=;2~5myNi8_9Tks94Y?gQ5Vp(o9QLVnCN4#QgNyUSZlH6{GoT>Fj%q
zY~T}IXa}c?p^sB%Z9Nw&gm}rXeBuGA3R?$L*zdauG|ULcPowCqv7YyftPuKGvj7Dr
zd+>Xt<zYuV_~l{flUhC_@Ov~okPosv0QmjyfKMj8S;7AuVG1;a2{dG^hnNX8ekI8O
zlyp{7l~$E*V^isCqZ~5!!^eD@Y#anK&O^4564#ulm%y5o=|Y<DE!O)#L<KFaUUEM}
z6T&yWR<aGWm913vc|AX7IQcv5-ubEk1GoJ2Gb3C&Ih&M{Pb(gR{r4B8o$hH%Venk0
ztwf{)UQFliqmCkBK0OO|110N7I5i)DgA^8i0`(e_0R)_@XLFos2b<afT#o_OI=Z#2
z66OmRk!HO5&1gPy2mH$KFc5+axPwW-v=rOj<IfW}8ib<NTYZZ`2G^hL8*b+=is}2y
zRLF7N{xU5SMe8P#3{KdwZQzIx)-Xzhi(sK^9>*aC%CqvmT!&(AgLdYCEC~>4pz-4_
zr;_nx>7l~Y-q%tdB6#VX-Hw3SgDqap53HC{TkF6ZgaN;yIGKljhQ-o9>{V8DG*%<q
zS*aP(7`4<|j_)5YbEzpu1?3Mrj9o>lfviZ>H4`*?;sYA9$EnfA!XkC%X8etH=9>dE
z3#=(DmW}kx7XGU(uYtxLB^AIvx8GF;ZuV+bVe?eB^?FQ&f3AApX%c#viwC#IwuU%9
z<)M*scc@ewQ<En!2g&ef_DE2uaKqC)kH!bDhG|^08m>qpPN3129YPO}hV438%`1!w
zCKewL;=2R!$?s-OHhA`AFf7La%>=Y2x`MtrQvtO>P!Ld9X~@m0p%y^dMK5fN5(IEI
zXnd*pGq`UD!xhKAQkZ$>fe#|(Ma@akKj0>g7sxdUN`N8WqYyfmfbwExWn&?Jus8bc
zNH?Q)tU}{dn5Su;8KW6_-pDBKvC9k2lP+x;$^8kNUN_3uc^V^cVkQFq*p~6I?q2R@
zWlbI}ryYYZjvME1hfMtTW3GtQHK#n2+RAQ1f^$$i6c^QIvn*6|KUNgQMJXbQRGAXc
zY<TDAry6}m&|Z_<{89M`MNuWSimPcAhq3f=7QqjSvgyY;s5@t6N3amhcwa`CuSMnt
z`~cxY%7MNJ{DW=0Rhy+W$aK0zni<<b$KW6FH#I^!uMH9oMURBxZcGe^SFn!0Ne?eo
z>$~9M(_j_jvPvUP!w1t*qkn7q7OV~^8RAf<B(4z>R>d5PCpWw)fc}F7cS$UuwlZ}_
zUDTb{>l$G$o`pxEKF<|=I9*{x9MPhF5lV`^8#yS0Od&tWCa^3J(6v;R!8HP5Ycn0&
z8i0az(|!H%E;d}dL4ubZd)3`xTEr347)F%1G%Il>;cW!P^oAon^!9I`?j;nkUbKAJ
z{ce1MK9aApp;oH6JTyxaCjYPIy9eH(YD7kFtfx(#w2Z`o4ttxX<4U2;^n*V;%>M{O
z;*Jal`AK~kw1}y&qoY(&xc17qNqj9$m{njFZ4Xgeni*k+txLeop?E73;QJQHB$?3P
zafPIuLdd{e(;=Wy85ScWoznrl%GR=vINbvQNoy7Hlrz=nql>KFtU!<@pRr=LZ@-VD
z<M~&o$AgyWnM)I%frKv<m<YcSi8$)aYgDrZFVk6W!F!u5B3^mJFIg&}gPqP5T^{22
zhaL4(d=MZAoxfhp&BSldcFqa(t>sT%_bJSU;L*jE)AN3WIrbd<H30Cu4^2!2a&Ud7
z{JQ&(CHu2p$=@e=TcG;`I;GpU8;M7_n9a_v)mU&4V?EuUvr5sUUf7M&1Hs}#!c^_)
z@DD=f=TqIOM@}JEOr*g;+KQLzCX_bXNTAySFcraPl^bY}Jt;74$cb2m2epI{y_#B|
z=0>Rb#1fA9JNWc_@&cH)J_)8>m9lMg-z{8uOIjSCY7F??plk(C@7IPs?buT>+!NSw
zbV3m&jAInyVI%?SpNJ=AE?`J-wt{PSf5uDRAqJ0dYbsv&yrf;HxVly9=I9(|ZO|U?
zs`ov%L?wKUqW3FZ?5DIPb3+{Gtb4CagmqnnuT1c|$c^OdGy`y{bd~4)@!KDUMOt2q
za9@+kj%)!zc5cUo*vhT~=!_$p)ar3{$g)jMtMKsw&258;<n2JwUFqP2L}`5;w{}bY
z0WV6iK;6X!_zqk-MPgp0^l%XhC_mwrUeLYJ4Lwr#EeIvPYfx%Y*Op-E^+@e?8sEZ8
zT|Y~oBI&7SD8Ou;n%@nv^15aP1W0pb=WJ<Q@@|Mq{iN>_G29E<9CQ9<ciK$WyzVdJ
zpqs_{vT~m?mOOihsOs$A%w?CPKz_Xl>w_Ckj&}i?2F+Dr6O!mybKi>N+7ljw_c)~R
zq0S;Wi>eGV)GAk?Drcn=zVq7TJXT}pgB8QRZuX3C4Pcr&>+TfxctdR!&-~WGgpw%K
zrTfo<6Z$kyOg~QwGLpmM@{M{|F2k2JO<%aH1I_M;>f-5s{(!Ln{gL3H@fKBM40(P6
z`TaCxZ!SUohSrvM5p*niK36I9Lprh`xrimY82;Wm^7d8_^&Ye*HV6_IwC4%jIvxlT
z*-jweA%G5&-*q@SE+YJQnd*`TlXD2a?@@gCv~VVoW>!VR+QF<&*w(Gc{h#UEoPjI;
zi|K3Kl>2bJ93MI_#ECl~e@|DIk3ss}ZyI?H*ce0{`%%Yh1H=1pwvFlU-6sb5MXf&P
z*?u8704&1=T>}rk(*TM`(&T>kc*Ou37r)a6Ex=$7ZCQuG&2!KGI`X_~jF;ajcNJ|}
ztI-|ZJ5$x@=1KaiO>JwkdLF?Z!}T*^%&2g7z0!S@(nQQ-TQ5;n)P>MkNLhvJz^@1<
zcvO@^VQ41rRrwzqaj@3{;!%*7^zT_Wgv|VzGS1lc4gGYe9gLV*hz_=KGUQ-W%Cf|2
zXaE$MCYtI=vPZf5gsdD_>XTqV!|K~<1#x@HAd+HpW?-PhbK}4GF<UDarCo^T-5-yd
zz!T$W8jc}m+~JEEIXAg*)6-`wTHu8IXfuxjWs@Dq#1_55TD(|KB8dP4+Pwh_cRpzE
z7;}%ZHZnZU{_jW4kX4B5@VBIhQm!=WCcusR?gq2WzY-9JWw!cDy$M6p-~<G5cc<|9
zgiV)Jdh3=}MdKjK2Dh3~{Hf`sGWe1!kpu^|_bj?^U3rC==RO=#Bxm|J#*euGG<*o4
zo-QDjcE%#2b0%FR#l?>$QxTh-B2et3D0?W@Oh{4FDF#QicF9_f$g2K|i0z}Z1mJJ6
z)AvaZwA5Jb!X8qz{gtqUd<?_T!{kb3*>c_CAv%w!t(;7t6+!)_QtF_Mm8q4MKf7a9
zjqq6RI*4!Oxv(ltY@kL0ejByuUUoT;9a_%fD_}R-Af)xDuNJ|Wh&XCM;C6B)lGY-H
z6xocYYRY-`Ou&q1CswrYecV|w7+|<Qj7KT?6$7esJyKP}06Ywh*-A~L?V6vuan<~b
z0j2cw)OZMTtgasy{3NQVR#FKDoW+i$y86^usnSwa;cwM9#77uFqMH+uz9TiM0v^}s
zcwVx96i6S9sWSZ&$66SePq&x<Odew44{FSjAWM@*edshGs*VM3DpT}q2B>gPHeC;{
zsUG5}Vfapid6K5M)q(jT@rEzJ*%wml$i4z#7Cf6>n58-XA2APF!E_^#EETuAC0uGl
zVkNrG8;Xc*(!JBZCM3g3j>@AcP>-Wqe9$MKP7mk}1F@aYBMI;g7oFcG2Y(*HxOm0w
z(Op$tPPmv(xHra#oFa4$0CK}h_)i_^BbW4P>`~7Cu?1O$RWHYMHvS4AZi-h9B5mR5
z?`TCkN=v$2OVl<3<Yl$0OYdOOMfZ`Of+fx`)P6k5SBPYXSDP{haj>jKTZKWBZ>`Dx
zo&r9lJ+|oaI1r|B4ot)g8r%OwU`Jj5(BRjsAUO>^s#)Tzm-%Sr19;&e5x<j(>gr`>
zCztK(_DIRLmY5?pT2B~DU4!EGcQTP^>$duzS^Hz+0U>ymIjzfuVSvb<<-Dqdo8ElD
z*xk2bsH)-HoH$wcs#2S4K2uQ2+r{FeDPh}p`TeN7-`1mAVnfTrHf>3;zp<NPx@|z6
zS@!&iwK{yqIUI0m`rS@CLnFSN--xvE+QL#D?iKm-AI3oACx`4gYS^X`0yc-Ln0H3p
zKYbjj7HQWuHR0iER8V`2NdL+ox4$QA@lu%e(=E&X-qoyobAyMA+=O$3^P#bfBycqU
zU&%%5Zi&pMy(q)U7~#JxFdWHYa4?u5kl>@a1rX@HT`Fygxw96y^WrG1m@KWNb<r?$
zNE_>kP4`tzdC`_1QBpf%t{7Jp=I>N97|?m}Z+@pM1}B>DDh?r1aW45Cju`y{O#4EP
z_R5`QWwjKCoZ`d#0dNPEv$#A?5M;Zx*vb-Iun>NazfV_Uag1;f@%8zN3MAVx0_Wc#
z2JGZB**bvp#{@uKCD&r#%;Ko<k`f9O#Aq0>458fKq>B*pRx0`%9+pfi$A~!KcuyeB
z>G0YZAa>jV`FdQ&ritu5uNYju|KA60-ygM){W!S4KMNIuhbg7D)7>Oh`?E>}9$K!=
zrvKW8I@ImYs{FW<yYeqSkj-ivetn}Y$_Px0a`Vn_*3O7ri;gNzmA+zJY8Dg=yCttb
zzJtE`?_kotVmhj(5O%GIGR(JjBTa`QWrG&;OC4pED4mC+BCpFj+?G|{^=XqrN{s!O
z1e3f8L})9V07jIO){9o$b1^jvh48d1)14V>QpG!@#%2ZHPrS(rz4~z+!2hGx(6-7v
zTZu0Ko19H3#a7I7yEh|GxU_RZM918^y{+>LBx`C*flpwLgTg<ceiI(vcc3&jT=r-+
zJsOq?hyVo~2@=E7kuA3>BEZI0A>&%)AV@r{C@t@0<Re)>(n|Z=EY?xLHId3`I#+8N
zp)djdp#d*1`CAa@NJAP95JZywI!74I+_Cd<gMj+aH3hX8bBi&H>n>7G^FCMsUf`dQ
zt4HLBox^us0im7m<m%(}YAM-lc5_C;qc*D#JMMG3f%{}7&*Z7pgx5<jAWlyw-INU4
zgD^!13sSF@PcI^=$G|S94r~~)^$@Y_>m#-2<M1XI5%AIS^}LV^XaOL8-75e-*A2eU
z0YKvUx)UV&yfgT!@7kI9x_vqY$RoXOe`SB{8hrV^{UbWI9gk#jHsh&0K6ScOqcd>-
z3p5g2YPDMM+WZuH9;c6^vd9;?V?o=^_I)M4(8<#Dmf)x4r|N}qKtnc|eam1P@N?1K
z=){jR%G@288*0M=lo>qy!fQ=lqPtxoP3==z4;aC0gU>-c)CYYNbk5$U1b*F>2yk9D
z``e4)^2p#3a?8N3(bM#QtFkF|{{pyMlBQ+{JyJ)W><m(^Y#uH)eYw4l=iThKF~__W
zZz&g<TDB9baA8JP1+tNMyXfl$C<(gk*t@Eb+bj~^T9zyUk;<2bYnXH56zp+uj-#w~
z2$L3E%6|}Y%)<IBuD6>_cx}Oz4Bc{2wj_(Ux%-qhM=}M%7Q6Z;9v9pd)P;%tv~v5J
ze)~Lg#l?Ko;sD`9IQbA)Ia2IW_dD%MEp44BWwIQm5rq^`B1xhXv{=R$;>mUv4`m1c
zIm#43x5PyNXy@{<L_1l>#S$WvQ=-KfzLkEQ`UCvIB_yakh9s8Iy>3+`m1QQyYD-tL
zb^{UK&$T#w6VMjDHCCA>mWFS2bcM=u(He2hCciKn$WM3W;swCP0|i2cPlrbo=ajlh
z`AxP=BEn|7Byu~uqhXlY-p<eUZq6F!$#oi82V*S((lO=MYd)L1rgv)`%xL>hC^0A8
zBy`TAD`>JU&D6nDWTb%@5rHS5d%EXK!t|&(IS`{2aJf|3XErE~gD&zoPraHrBYC2F
z-rQ47omi|X_CG#Q@|C=)&;)LTAAd*@$Stqg%Sh(2ImJxm1eUh9qHsi89TzpwQV|I|
z?KE8hD*T2=znxa)jy8DG(O0=s%<u{A@UfrIrQ_A2*Q$H#9SA3T;=87GVQ4&>vM7ww
z4TT%oXLTmeaJBO`dg(39`wosJBM^j@k5Sk?|8Mn!O8;=#7#<h-5+bw!9O-!`L-qt}
z-yd@YGkdt$*M0SL+sd8cHhYY2kZXWCDy9ytW4D^RGE3u({o=9^n==OE^^v$zC`sa9
z62)yb(f$UyVPY}AFd@wt4+%%0vh8G9L$`o#uH=46+W@bfP=EsY5&zgKs4iZ}dD-CL
z>k23mBe80%7PM-@%?Tk|0XLSd87mPO^H{X5Od+97<99J?L}3|uxH3vMBnJS33x9~l
znrye{b2NX;&YYT)AJh(x)0z7tb0;LdS6PIc9E_F0H5p9^9WJoWqX_Cb%*;j!K9TPi
z48{fOUslkM8{wBI7;DYI#@rLVq6RwUlnkNPxO)1Z!5@$lIaR?p!k17sEX35Bggf{W
zN?NWnMk6L`W01h~a?$`-sv^L;$UY2wqy-8ZdgI6oX6q2?a{BB+8v&cwV+fKgG<q>&
z&?UdxfvY8x6Vqujnz_qV8WkMqW$;qyZ{`uU!=M)!Q%N^~f!FRBaB$SmkkUabz$qGI
zES%bnW9G0!qQR!_m(ws;qdh}o&E#@Q--F-U(hf*&Jk+-%BED>1I1GT^<lHy6I?1PH
z+M|WH+9o$2)P=}!+T7_!xTr|Bnw9&Zsx;o2_I%e#8dZ@0Yz_&Qa?+S|^R*{;3Qgs#
zqDY~avQYtMMj7nHZ(UF7EYT-CPAH2=8Vy;?xxO4cW2ff&*pppcwqxaJ=AWUKVQ=4h
z2n@vXctTSwqCbSjaYO)1D~cm(0^|WW#WpDk5SRpBO*dszIOVC~wOHAfKgH3%sUxfM
z;?ZH9Mo7u?_s}Q<!GNU8>Q<28xlI9g4;bnjYbe4&4SRowKL@35B^eg;6FBp{(0^!5
zx5VL~gsM@h_Hj5R^z);iZVpsaDBWqUEbkln$B|>7wK12t^Pm9sBOL;1%FiJtcPFd7
zo;Glq4Bt0!Js7l@3{|4Vh&6B!y(z=PkT+8l%rPV5qrO%ojXhA|YW(6>9L$63mf2pe
zV>TFPShk)w{<x@Vjr`SM``4NT7KQ`ty|#hO>L{^*9$JPO(hxJRx(XeQQ6ytCoy3w-
zhQ8l|L#+Z0BxVFuo(t4~1F$s0s0!NtxkKa$&~riHuOA})Uf0;$b<jcj%#?rnAE;x6
zap&tltmAV!ZYO&E8C(>VejRUbE}y|g=<l|}Zx>Z-jT-Ow@kdLlW-FbhlepX_38@YO
zV<COpnTOv7%Q*%LEdZnTef#zgPI@Jev83drTTy)$fYc-8WlF9E>E6_C$|=5=QwZ<2
z83TsN29q|fuJs!(r|Gb_qG=9?z~0cX-q*8_tbwP|>k-yo*-;~*BF2R>{^AvF$UIdS
zti;~+0WPvme%NlU?pHSRRUO~j_Kz<_qf|7uMXuAIJw50~w@4ILPd4*S4G+GfE*oje
z{N1*PfS)eh4yJQN&0-CVL=M7)?K@5<K_BhJ-gmEV77(0PM#h6xu(pj@y8&yu4h=UH
z_^8tB__RI3lJy*ANuVBq;;wx^N(XuqF;2)i1r-2G=@OOqQY+EscuL~OX9s7gSkz#i
z?$%g6i1ZqGS)|RcYzTtMgGxu~4<3zz)PfVB0OMs0@Kd(9>{H{~oAA47Mmu_U@ugPt
zN`dqU1(ub+b&xDBR5LA0#kFtnHB7Ot%Y5}(vP%ByG>|#@l;nb?;tCvTuS;U(IZ>cM
zvvQksF@TWc8e{obiUn<^xCYC@iE-!*2d|>0Keo{>yHCJ>hP6%5_n-^eT+0wM)}1N<
zzlB=WcDj$E-Bzh)9)e>e3+EV0&_GPTgl5mp(#U+Vm9JQvTT@ZD<1*Wwu0rMgbRiF;
z;M$w9cL-Ni?SQg)$`8YW<CKJt1CwrEE+g+Uxj`KZu+zImGvLz;Ym9Wuk3!uPh6NpM
zzi&oVd*WsvjJEo1rRs_fj;&jP{s0JQ!*?)tIVJB`_XKEpd`NHrRkI(S#rTM#<|r;=
z7>yiUNh*>@Xtnn>gUeq`Iog@C`#3khHGT?(a4^K`7|pP^cGT`S0wdOcrL{KJZYZMh
zkI!Jt3zb1YYxvD5|JT_0eM{VoT3T2I_^Zjg1+T_NzCY`2PYg=%a}x0WJSnxpGa|x*
zAGN!l74p-KVQF~sQ}xmQL*P*ztx>IYPuUzp*U4%)-HTlj+-NBrKOjGwVM|!TLOv^?
z&Ay#fwCc#Y2(^43i?W!}D-p~YH(Lanh;S?!-R`1622ayCvPco3&Jnax$VHO5d9^O5
zL0NK|{y*jU_`r;}H2@1K-2Sc&kJr^?=ActZX<ag`BdKJVzOB^2e9TK`dA*Rr%`}zH
z_{D+Y=vFo94!fKDfJ;yKXMqd6Tb<t=qRgev&!gqH7oH<})J5>_M10Q<{LY3L31qq2
z#$anI{fn`HuJR&arjSKZ?8d;Szqg)pAyhsyiPRI{^siZkHGmiN<8Gui!ZX@~^FxcX
zxX>CycwII$;9)Du4@DKz72%HqBrDqs%EK_xU=MPw-P{Jwf><4&3Ln`z(xOmoWN}?W
zX^m2pG98E<3iNH^Ps6}J!A{3>gwR$3m~0H-LB03Y-xi7Sx4%=m_C7-sNQqNlrE}I*
z`a<91UeV*u=K&>qCuEYK{Kkm&f^lpj`$UeCARbl6eL{bfho=+U3j1P)-$SWBVuZtL
zq;TQyM6i$6xcEf&ad2nwIC5rDyd*@32UBB<<2}y)axPiIiCMH*{%iynWuw#v#@cwG
zeH)PRWTjBuFc_wuruYz??udv>{<1^?#(kdD*V$*1!~&?nU_64I?Yd1z`fN>Z_@KVp
zN9zwmHB%0UG6ap!_d@i_M(1@yGYrLi31N7~U;ck#xNO1qHwTK>gC?TYCpIa;-0*~*
z4ht4?CJ(pFN%Eles695RPIOfLWD4V|&|?TOt9}+N&9gb%1^OpjfaoegqrXNXnRHXH
zN@76ws!d>FYyjU22NC8G7kQnkct_3SiB`~la_XdVsrj31VrbQJ`W<PXbwEDvl(NUL
zp~Ve7h;B4LqU93qPuK<pee2*R$Gr;m6*~p*7tKVzPElQ&qEoDI{B2jvWXKW8DBMVM
z$f)F6GNg3`;*oBgi<XA|a-p<S;wKT5WZc+F*ji!Le8m*1rwIdF4rt?97woxilyOnh
ztUArx9l67*eTsrz&?W6;Qk?}hfPTiJTrT;by5WRs-7VcImh9oSPpoJ}On}wIeWBv;
zPjmS!N=$ex5>@&yq;!+MJ1PGabB~nT8c;7Usm9f9eS*V9rAY-i%m7YS2)~|Dd^+_U
z<TSA<cv#-k<9?k)Y(o5;ztS?}nHrN9v_pB0q$P1NzGZRwqfiy-wtBJN0N>(9Y9oA&
zKu~eje6-Fc*wPrabR}vl6jj)KqyI1KmM5w<4|20ca9N3IsO)5E(~{~i%}J)kSdB_h
z*5Q$@1Wz~0210gLREUz2sh%yn>MsrM%C4@(+2FdJue&gQ#Vg4nC9X9xOT<1UnJcBr
zWD2OH;<+NJ<uq}7|GQ5^1X~$b(!YTc@bGY3gryy<2RzXpy!rt#|FZ&krQ-*SywubW
za=p0O6P!IP5Bld1?T4b3YB}uTJpDFY9-<eEri5B9=z*&`$Ua`rnBt2FbUT<u`uLC6
z;v0BvmLzRPQnddEcH33>4|W6mFYQL0aRJL(I1BTJ(PQ4BLLz|VnXpJ9!+tiM%qdni
zKyIU~Q(P%i-t=gb<3{jK*>eugvx<SHE;l$oDt)j1KHRceyL$B(^W=^y8DoN);*Tpt
z0YA=G;Or@VR#<o2H|mz(xax3H`FI`)M4lwagZx->+WkzdwgT)QIZ+YERrc4PDS69P
zbTZuLr#b0qqcqXfL;rvg+<72BH^>#1`P-(sMz!C}uui;Blh6e_5;JeN3!kGjoTw15
zv2S&=MSN+!+Yi=QfS0S7<{@^f2e*#K1T}&9|3=(MsIxN3Zs{gbjv-;F#BGmY^Z+i{
zqr<%KdeR*k09E1j(|;_2EHU#a5d6qN;dwrH7QEhwgfhMqgxQzJmH0U{&Db{H;NmGO
zPF-iA85vbj*Lbzf&yJ4**Ntz)iXnYn!yX%_y6i6b?<mKlowmH<)9>8S-X$|&(-FFb
z!bC{$HRUC0+2L)xwhHd#bek=MCjfe=u<hz|=G}p;-=l4syNR|anU>~Zsr`5Mn*}Yg
z)4D_0x2L0m_im0DKvE_;B<(|2j9{M2axV_Jpp9v?pXzT+1v<+$qa!V%(^ZM19#|Dz
z%J>K4$MR0C3iE2vdh0tK>fn)#5AY+@2#`?k$FvB|uJT9J#H?<rixYl@KLPzY88clL
zD+_M&&#8!8S_Y2&Z|`(e?+ukb?f#2xnor27;;jb~VKVMv^uKlEeGY;|w>h-P{FZ@u
zrPqwvcWlm_J@V7${-r;;U6U2^3T^!^(kGONkNsc|Y~Q<0o?~;3sZjRotc)buMvI=(
z2!MaibjDo<{lT_61-LxEUE;j@5O?k1RO=*sCf4Okvwyz`NN6g`YR3O*=1eOTL)(27
zjrjo*Dq$dGW+4NifG@#(u6cC?d*AU;mdhN=pNhpZe&>LrnO*&sg|Ih1kF!comT89W
z{$}iJgYJ$eJyxnL{imC!+o;C%%ymEx?kR#U&a9Ge$S_owf1gtCXDh&+A%sBun4_U|
z!ydt@9}ZT5|N7y*LM!(_n0}r?SL4HVoHuW7`^FUg*c&nMt%h+%&Q?=j5O=_C!S^cc
zP)~T~0A6M0nE9boyeEeu$n|7-#ACVknguA*L-_hITU(lMfb`*gvi$7?@Zk*{?!(<4
z$6c;P*YBdKA)rii0c;atg8Bhs!ySI#G}HM3W@JeTz5(&(dZ7DCh<`w}?G?)}Umcy*
z&guV9cRCvZ4-uW!c{ZK_^+zvTGXQo?w^dZ?{$i??hk)6Jy0B^U`r|)YQC8&rC2lz>
zs8(shx9eY+>MoF|<TBe+&W|}k&I`t)bn@*ntBcKfM#^b`-Gm6t>gS=Cgk?d0GoPbI
zAezEOLbgNH)ledlf8Ebz!B50vE&HOK&=>ca<8{Q<WcSWjeq{o4pWyB|Dwo^MyIQ2!
zuFroOlk-}?k9a2mo@XZyzk4R=yW+*_{mxeDX>c0!q#$5*Sla99KD0fG4fMLk_UQ>$
zQ+~A31$Mdvx~m!1fbki27^!sbhibojjJy5vHRlUsP)RTJMT-**rk>osyYsDOn)L9b
zv5|z;p{K5LrLnX0;IYOb(8|vgjm?m+*Tjpb;1@N~3VD_-vv%Um%49kC&~nJVe}M^n
z)H>_}wVX?W!B9BxhbZ{hqHMa)QzceKX`^A+a-#xx$zt-mDTdQ_IJ&q#C0-N+{~vRd
zYVXkB`k=XBzM?kyk{BqvZ6HnN(oZyB24PG>rC&W=bmNH_q4{48uo{XIztB@zY)*1t
zPV|3W`xC=N6+bqpsB67mrF*gMTG5b0kI6}L%OHH&y>g$v$o`Xww6Eu7Cp!*#4{^>b
zvH+}43LinsJ?y-4vlZ4G?EyNPX^#0zU`obD_<zf-(;wI6hl+o`C+m8&V<xO!@HF6-
zCd+{0j`9fc{1To|)Dhld?Gjb;Z|y}Kp9#`05U9wf%O&HX;`HUFB3Muz?@qq0uH?G|
zW|e;#YzP{SOEM|-W8w6EUx-rj1|k{206bJ_RQ+dxS!j5NzWpq6hZ|RP79zan3Rd;v
zydWlHD>98zQq!{1SmxH<If)m=SLtDF$rSUbR+j6QQY}%G09`S!MY(9To#PU<aY@io
zn$2+?W!gH)&;mic5TBAjS&H_=$9E7fUhySy?Ui0AJ2X7q@exT|$ID(w3rQ0NfGzMR
z-E}gi;!cArM=5qem%5_WnvV`7Y>6w~wN#8FL-a52Mzw-coN?6>y0(4)_|t3!D%eFe
zy@hWAkcREo$ldc{8^{%{*`cusIx>ko^Sr-v=yKd5snu<ug#fMWrx8q-VYhRkQI>1f
zmtyK5(YPfJ-A%SBsmX6$L+X_kKmiFsQi&OT;sU1Q&&DBX?UxhnfAtni6kyzMggY00
zuj1LvOxN^x)H$(xtMnUrbXC4;BUabE2z<yhnwPHAKdosEznm^wGENdJ86k(=eDJM>
z5c31KIKq*6lF--mP+lUcA~VxB%hO^*wK|v`qS;u?hX&dbv6N(wng%1_0I7gZkaCm+
z+<#$zBQTW7w(^#UIY{ND?8Nlqale%-Y|3P$9L6tvMdI|l|1^s1xyd<5@9UONOvcfn
znC;`3?UP@S9dD~WH}B-TIe1Td8_Q=*)*5+n1ld4B+?Vuz!joIVS@pyENzgT3W7LcO
zL2D1Ary8fH`j!>wrP-g{0><j7>+2?$bd79%O`{E02-@A(CMnq*a*I{|xNR%dB~kHs
zF|LOd`e$Ys{YBdV#!uRkrpwMx-Q#L_D)etM=3+2x9s12_Gs9Af%UVm?>9fKPi?K<p
zj-if&-3<{_SaW5nR3X8<ir%$cESfAavx@37ijW&Z_QDs2{9yZG4)`(oBMpRkz@8b5
zo>|in=`j886knPl6<gmGk~DbetW!`l<w~)<<B)@NV6X1uWY|-MwlFt3@Kmwa!7=ao
zr`FCdh2Fq8Lwd(N9}W<1WJltiU%i0=U?5OyAW-efu|aEA!YJRXa<m>{xqnfW+SckS
zo9H^nGR@OvWLCG1!~oU{2GRk4lj728sI*fB<^`l(`U}^UQ{aM8>9%~4ZLfTIwm&W(
z!9U!HWo}aa{j&BveUL+ZB`np289F2TSf!UPrr&K|2=Pu@lhuo=QlYrIomY`*I;ALx
z%q?if_DkIY6noo&Z3KN<hV~fDElR?@8v$)yUG*T7cAE5oZ2%A#up`JxJAvzfwvQDB
zjH56Iob6i^9E&XTwcXbJw%>f-7~Q}3<Jj9}2t44S3m97GD)-o(HtM!MTFGkNf4Dik
z1-DB$KK}624!7^_E|kW8#30E2Y*6Qzs8*diJFBx+$FFy=1MO(z4|YiZjL|s47<5qo
zWEc-u@oRtg@d99`6j-!BvPSH-m?b>K_H3@8EvFfi3kV8Xdf!?raDKY$D0~uQb&z5;
z=uXi)m;W9%-m$)bdjN^9w7v74Tm0qW2WLH^j-p`o326UhVBb!<rv8dMb!aXIH?10>
zn)|suh<6tIPNV5#n%W#?GkrU&s;64?wy5@qXnD0@O#o=x`g~}E1L62#?FnwJXzxmW
zsdA~ZCUGjv57}(zTbn_DQ<gniSd#RQ?Wgs)R(Lgv&b|mC$7ZL`;(RBHzT;GNgW8Gx
z=i&Hi7l-Xj((xZVX*AEZagT0P6J~rOlRH?(UDmKC5PRkOD7wg9$bSTy_Mu)P1;2%P
z)^zipYiIy1M<om$%<L^En8ViG|DdH$9Io=l!kkzB4m~l3XLBXy2(rFf4z~4XuI25<
zSIGUmG<|E*^30Xx>a_7n_u#ORY7~=ZX8*GH-7URwgcc?9KLGZc@3o}eyJk99(R;$l
zSQE)qELOik57X;EbsA2}x6$pNNIW1)2wt(9WHSR$Djh>LLt{UwdiIWiY+owOtVEqN
zu?G;=1*nFJ7QtiOuQ^#za>_6lo+_zIe~3*x%TINz-se*}9x2@D?ZNFHB}1PPIt1Gq
znm>F^02zj6$Ofzht?u#RG2zRz3mR_?AIBZfO=}ol9cDd$kg8;tqy4L27ISMH5DbXD
zh`j;3%|7@2C^18krDXE_IA#=aRnUHQatY$J>+Cv(5X4^zTq~#U=i}-coRaL9Wm69(
zqQ|{#knq_jzXp3sXtu4|$7JMEg}9sHCPtb5+*zU>05#@HLRQU@&8?B(Jxf%eOAh2q
ziX4ojyK8Ay&x(S{Cfgnk$R>rTh&01BfQW!6Zo!mAj8Dbl#k#R$SUIDZ+^og}d8?QC
z(`215wWscK#f`(YJ&>d@noiZ8M;Wa}E!IK#EGl<W>xfa<o<Xc_D^?Gq0spBm0*Fdf
zB&d6TH521DXIObZyTG?Wn^EMv#MtWX*R?(JUYK&DfH^|ttoVMXITa$TriwMxn^NjU
zhZBW{*sF;B#RtgqE>gW679)%1#e0nCn=#B?j_c!|uXm(4vo*pbHV<-ec4i))1U(|a
zrJjz%dMm2`OzrFhh<l(Wid%6|!LLl$XiNs+ifJ8_pOan7Lk${K^LL$N{mXwa8eK1p
z$cjg6LT(yF+m<GJd(xLp1d%4uOX%MhN)kY>CQe_UP;Be)?Brn2-1qXQkNfTC#Z=pf
zygogrVAu10Kc5c0L#d!3;HryXkk1(4PYj^?G?#tnF;==5**aXD8)KR@>3lAoP>|S5
zpE#XUVDf)t{IYFC7mPyPe3fY7c(|*7C|JjRJ&gXj%B_se9%6;2pZJ;pv4yiJ24Og7
z6?=u7x|s`!(XR8CdvTVc8}_yG$ztn^-zd0HBNehxbe<Y3^IxgL*7f=7I3E$fVK~`p
zKISc-E6VevlyWuSn=5;`$QqAqSHKO|L{Kg!R%$&DwheNN-E!Djum$>okNu>5Aw%P1
zCSH{e)bl|-R=2M(p)`MnVRVMXxy+@bP8?PUVmj0|l61Z0!QB0@t8HsipmsR(<#r9v
zYyV;I$h0#r7}R2mI<_!p@C_0m8!{R0`a{lV(JqFsIYrqjUt5VXMkTt_;YZ_nw|gk7
z-__LN7JuebT#6z@@n`5Cs}G3;xi2!P<CIz!S3?eFRa{aAS!S-2YAV0|yMpAF8pTw{
z_$KF>jQdaKII*l~v7Yc`cXG$rj>{eXrijMhMGcHjSSPd_jP8@g1b|FHb!toH*kniA
zH{t{qnb4ADYcH83p3a0%432n%r}_gO)vELh8Lq;9ewkRU3K@3})+&*Le)vbEnAR-F
zE85<<NSs}=ZsVwyI=o@sC?kqySNK(s3rk|S-me<s=)!oH!u+vMI!i|V;lJ;vo4%|a
z`ZMO%ji1I1T2q2s_U5L53)%fyrZ9Og+;p-jK5`1#zAh=G1()lUqdg005^bW*@?VB?
zi#esBfgoPvgXEB;RFqTpG^kBN8}YnEKH<AtU@LAsHYnp2_a_IQ)^YET7qaqkKYs#n
zyx<O_wp8EGtFe1M_ZJV~zE6yr7VVS*6`cP^dE5UNX`nq}%lf?uP-46nU)25*V|gUt
zVY|ey{EIz~^7s6nfeYTS%f<wDH1L$uMNp2d#UNFl-YJpP)VRP5Z8zwoSQ5RHLytW`
z^O}4Y{_C}3UAHKr3}Yxcxd@b7=7Jy3D5f3jfwnz$G;k`~o++K^whV&^ehRIMI-0OH
z@@QJJ<$6NqLsVP=Fg`F@lS?!FY~Y#LFBPo_uV|bJ-GWqpgfWNzOz+|2MU#&noE#4^
zWIIioCl-qtfr$v1GXVq^3ZEp$E2qTUFK50qJxy4@ACBLBK6GNW<VFK-`%ReO`_rUF
zwB{68?)HXqJs>Uykz8mI7Biw&r7(ybI;KM7?yAhN25Pwgn@1~1l}BDJZ4m&19?pBc
zVF{XI%=#4K+m#tx*yrMP8GZ2GBC`i=7ZymVHJaIge{lBQ^Q4klMbP|v1-H>+H^7Wa
zWJ-OpC)5e#FrSyydi5OO<*(5kOJphgmZk4!ccW^YePFZqSFBHkjaN>D9mQ#Qvx#6K
z<O@{%IY$f-?q-Yl!KLF*ka`-m%)%Qg%_u^lttVL+bnJwhMx_w08H4dXC~z~Z%Oz5-
z^chDg%b(8PMVE}F7%040YU0?;8B;q&Rb(|~0zvzvj?h2qtEyp6aJ_86<0<pS$}}XY
zJG;YVTU(+YB*%5F28Kd~)jW7RJnbBFgRrg8@AUvE;T4{Gbv#e5L;+JqW$xIrwMWb5
z8cgW34f3F?VOSrA90%=34Y=8bR>m~ID)7&CUB=D?3oSV*wM{ltL#P45N?q6-@nzgL
zjD_mip!el15@^nTX8kxG3VvKK%1R(|n+%W6e}h6|i7~8Ax+FeH_@83jBGibQo|Nhh
zE#N@@GXqC`eDFC$pJu<m#xZroM27|qm!xGdB;V6JoIqMck0!}^j?^OE?f+Ev)lpHk
z?Yjcf-3>!1AUVa%ARt}RjdV9C3>_ogxk*7nK?&)W5MD|NB?Tn~6r=<ZCFP9zp5OVF
ze1H7TV$HgFu6@^a?fvY<J!=nhk-nvtYyCLQxV+wHKNW8+4Yzh$`mr{-E9PNU^{1`F
z-~f#;LPWS9%v8Gr9Ws7qEm+sypNf0W;e^m=bC%iEt(>^GUd&=-p`L|kI25o4?Tmp1
zF{$6Zoao$&Uf%V1d$XkA?YYVAX|~s0r>(7%S}GO1)cu7>wX>@?&s3x;3WeGQB=`dZ
z+VVr&xA-Q`8%JoDM)Qptz-{J;#8w!U9JKZo6n)#tgg<uiekI++M4K00X=w3rRxYj8
zCtkshp;sfDs&=0;#Jvp#Q**9smOiA;55v5B*K>zbJZ)0Q=|SH=xD>{z`!+?N`*06=
zZDcj;K@_{jdp}&da=92lNIct~rMqtPn2YcbMmg2+CyHXkHV)Tib$MrB#$7#8l?g|d
zs8UVK$?nH^+T!-X#IA4SB;T^LX*Rauav+Okh8%1>Q&m6Y<#v#xg}PHuW|e`S@Y!Iv
zZFX;YHapo^I}qeBD<?<To%7mUf0~;+lbyYdL(3(>Yw?dr4Ev7<PX@NtaJ#Ev_t^5b
z_;A{3l<EbES-0zzq#`$TYF)4NR64toc5=&z7D!N>90IWxU=7hjRKb_iSbZYG`l!w-
zeG^)Yvi+wT;_0cwABe?wHqz~jWB6#y{$c9fz(r4DoDgTD%#s9YG~*6s=fudwDMcZv
zyy5qy`!57aZ`2y;qCysO{S0|nIR(c^({tz3vMAlto}Ty`cMrdUBd$Y;mAc;Gs}iRu
z74#XdX_BUYl|nNrvLy<eOIC<#Wyq<R?;{&GT?)7IX)L-%B^+5K6h4WGAYX=K=8a`%
zrNk0M^eJ~J#q^R-IXsLR#%|~4yHWeyVttGlysEwt$;`)}GGtjQks<y*Zvc{f_^qf*
zBK<tOJD;eif^U7PdeCV2AbauS(Q0^piBj7g%FLgOTPnop30&AUw${};lzIk}$b4N{
zKvBjcp9woTGcq&pgf5Yr=644H4D~Xfm)Moh$JOCRTz-$@-wU5o9^;#`#mdT$bQ^75
zlod=rK2fc;6g9vb$a|sL>9}&xHXeL(#&nqUdSRbGWIqcIhitkP@@BR-T5+zSTQ*lk
zX9G7QwZcLBrD13Fq$@!Lry#_Re$_&&zUMU_z3KPtN>iro@~;A25%;D{F|SmErcc<K
zIkvbu^v%@S;-@5%<f_6n3>)?x#HCCv7CJi3A7&9w%2+V0TCHC7WVNXHG1j3Ff<CBh
z_o=miMP<<BTj{auIgoX2z_Q5@^2w-5p{uOPhBLH1g3wyZbM=CbvR)<hJxRd*swk<B
zJl*-Gw^iTTyor8Ph8PoDe#Z1~_qu3}k1h<<=utW}2<`Wt?wK8Oy!Y1OG_Gk^FyF>U
zZrVIqHav6KZd+p-uUm3IOQ<(wh%{8%*iQ;<3{1#P@;eM7CHJlk8;Xi<Z_J{5efXr5
zK$;^?c$R9ZD?B-`r}RpRoAXH3^BDr86hluitJzKw)!awT&e2U@-)&6XMM&$M;*SrG
zG7$>FlAWR~^LSCPP_KCs`=C~85)ON$jta5Na8@}pG@U#pt#-}7Bka&i(yoiYKTTp3
z;xYX>rqH*juPa*ilskahOaE<pd==V*!X|LF#@M}Dv5vAy>d|0T6%tvYSRRl)%cTI1
zDol1!X*N%69^N2Nd4y?>3n*DLdq@+>i^&Ijmgvj7R3*BoxDql?N2_|NN6JsF^%ie>
zOfhwZn4+q_A-y&AOwE6Gn2*j(9^2X0kns}F{_r9)5gc!KDSH-Wcj_Ipk;ro@0w+|5
zojI7X_qVx>O_Mz=6}au_?9hZZ8BP5q!D;GZRA((xlR%mV!&1LGA2Vrx0u)A1M!Dot
zeYVf0DQ7j{C1NQo=;IEyXIIdetKW^$5UwbD7~plYu|O`kEW`{wKP#HVM;XxkVrZ7D
zIZItXkVnu$`)MD+P7ujnyAVU$J+pXawSuU+HDr2l4v-a*Pe%qQ+*&NT@*{!pdvBu-
zyf&M{^tc{{ncVZOi@%{S%r>MiFig>K)U~eu_)y7#rEJprwNT4TSjn2iq|B=yna&;0
zJ;yf;a!DTDdYK4Qua~kf`7l>z;!@Euke@d7WZ;WauQAJhuNh5SN^r3q-}*~!(Is{>
z)i>Ui(usyEfelMEjL?az`95Gf`=yv-8cltwrs7nKyO>V$nUQ9Ghp{7lFy4wQ9kik)
zr~DtbcxIqf9?UcPb<l{Vo$~sP&T)D55^P8Jnwf2M)3fE(d5`tLtK~Uhq{ePK6UB=h
z9W0m0NQ(YM?nxva^y^u<+alj2f9H5E!Dn=iceXo({8~V+bLv_zzeDPV4;ZibUly3(
zGz>=gJAcuL{{96t9h)HFcXG5th5a<aSUsR;SC;+dFwX6ep@G?^ojLx6?@7AzQicA}
zt8+E&X5GxM<D0?`2G@NJo`fBj9bBlfli(f0Df*sH7jslC+88Rk7!fjF)SV){PNdcl
zUbQK@yvI)1Tq?N+yvfPI7Z?k|(H7Kr{+8{!QN#GhuQkjegygr^igT9*HT|8mFAgd{
z#7Xbv<NEi>{iytLiky>&D!bekB+ZdDnx3C&*m~z8B<{xo6HURrJ^BQ*5Jk5XA$Fd!
z9LA?m1f}$o+QINPm1ce%_<6S5?SB%SYizaz?0hb0O53*dODQY)8i6@F!$`g}-c?v#
z34Fk2#u=SL9q!xxw4ghJv6$o3!pt(TgzC=lyfhPElJMpcj;EfWU3KG!wQDzSc2X`q
zZm6>>TamS+F!;hHCCAJ3v)t$alT>8yc)c1oaydFEFss`_^`l+Qyzgyd(uDoj{G%rp
zo$!&{Y9;!2_z&2x2^DE#UJ8c_ZrPWkrcx>_6g~@75!$a@(PJ1RT&pkgm8;(0vuF4;
zkLzglbai(>!>;^Umg1g3vrtiTodMfRV~6$}wR<wRh)^<xHpAh4J7gY;c(G1au%i#j
z%URc*a^IhKSPp~>S04_=e|~gN^wngO#hlqzsljLeRR}5jm&22BUCa}j;Q}Z#^84I1
z=L%)^`s+{y^(Wk)yz1*LcJTLQ41PRxBs+1a*`eXNJsR!%DsfXMX6hv*qWJh>v3m=l
zj7)F+x1TA;Egx$cD80HP_z^SBd6L>%+#HcOqj(`vEo)&r$uvYx#*(wA_T0jNu@hA|
zDZ66nqA``ngp3rivkYcw<K;J>4>#CmJuAa<qWdE`JxZP(Pd7FtSuS6Hl^7u(pLe#B
zgcqS2I&P#23F-8CCF(jLo5O+kf*^Gec~7D-*J?RkjpM#|G3(VyExGXV7X5nuyRCHu
z+-=#cu6JnMz!6ECMnWPR_UZgIkhNO__`al4DRkIBX}ecQC$lLqFWSC|bX6f51n<bJ
z?+M#{GB@Awh}~7=qfJ<=s1piJ5J6M!C?@l_peY=yHzI@WB!Y(Sr`hn{GooSsv`_As
zQkHi}Bl7See%g+R?qNwFRa>Bf<+DL<1HZ!gYQ%8mWZv}GtzZe$POkL|RS|a1VmaoB
z`KZ=P9be<Qt=;!%t`V!d3b;5SJEqp*CKVVia#U?Ws^DV;v6AA-1zxvc%AJO`C=pzM
zGnO7Wis1uZ#8CsV*xwch3iQMvfM<VJz{bCpH;(VOw;9&{^3M5pJr-w)#p!@s@m9Yq
zE(8jU#~~WF<CSp$tt5ItA(8KwZ3s@J`~&1C@d1@tObs(hbU1)z3Uz%7Ar4TJOb;-n
z=3z5a0fVV_zZ`&@Y5c&KRC*vd&Gt8bfL&vc<HE&(d$AILW4hgMcq!fLx77pefLj24
z!%Kh>=Z}BJERd2(56oxs{kC*jf2?|zC19CN4fJ8xSX-ZsZ48q`j{^bjW#0shbCiL(
z90MFU0L~S_fdQtu@;Ktac#b6w;x{7x8$td;0JjHZfMhNQ4ibyW0jNA<K{!YZq${fD
zBxWfl{QJir3_>C<fe;W91$5+T2_waRA5+%*e*xl15CVA#g~LGNfKCxDJsc$dr^tWC
z0LA(AN=Oj+avTf+g8!-ipZ;(tNE~{p1`G~@!-4U9x*OPPzj*v-2nqy7T>@cZ!2M!6
zb1)PH`7h~EAo%4FI2a@jzLW?q4iXo?ghG)Z7!tVukj@QpxgjVF1iOqPuzFuk4?%*k
zx&EdkE(SvU7yW^~0y-tE$cW22Ltr3m*-Lp)AjD;&U<3#P6c^IsiGg5%Y%whc3c||%
zcPs=9f?n<y3c^bIw<`jKP5C#7)e=kjZxn&Oz#xC2>|*{9I0$-~6cho1App)odcZcH
zh6Mrw{~amj4~BstFu<yi4$ysw{l?uwCJgkla8M`+cDZW^1O&aD5X%{Mxot2Ugl+L}
zG7xbP^zUl};4H#7L0+x~76U>4OK0LB*xwn%{NYFtcCY<iO&kG206h<B8BrkU<&z4B
z0Ai2maY109tB67PzeGboSndDLi4_0_0dR_Gf%GC;5iD`+CivS2t2$PyzfqVt0LrIl
z0AZE+`w#^C&Oe<w_IzTu?cc|+TOP~f5-JA5Uh;pVSeCHMM6vrB3I+CyvG;<@U19GX
zi2tHJuw2Lh5(i<=*WWd;dmHf^m6is29xwvIk7#a+A;lnI6a)r`2#D%CqusENF3QV;
z6s*zKAiV%@w7ok>806+`YwzK053>7(`gq%Wd4sIIY@L9<M|YwB5ic!GV(($+Y2!iy
zLH!cr*Kd-NqMF!i0Vb+$@8O7c!m<G)0LRCC7$h8l_4h`5*;~7l_~(zBYIw3CXgary
z_HwQ?PYZ>zM&k@>;__))8B=^uT@y=_c<rXdVhtOrPFuL>stJsDJ5;ZHih8O6LQId^
z)V(xH5n{+pbkVQB!IYUlL1*w)Ev7_Qdu`8DUuo4;cfhnXPsxOFZ))g6lZOh5vTXpv
z?+Gt342azrC|_og?2M1zBBZAseym7}uVKSX<WikMgs<W{?72sZ`boaSO0*0oDOg%=
zxEAYrHrrh|)=YX-y`O+EBNRT3MMP%FceDPZ1xp1rvhj4$-qFlDG*%=>C{aYc%<SZL
zH)i|3#q^wui$qdfH4WVNP>ySb{978v9=e}p)>}xH!lGY9{MAh$k+<-O{0_xD#XyA3
z48@&f^P5Zy1I2pHJx&b*Ot&Am9c+{q#}2*aw{4Ym)ma7)Smk;^_TC~nR9Ll_$7^%o
zZ}98`7LD-(opI@05}(D*8^mNimbd2@k0WG#k+a72F~6St+0^UD-S3MByq>~97;E^O
zlG{TNnMOihGS@*elhuGDRg>X}9dZ(Ca$JeGb-q^p5;C{tlMW@(9KwVJ)+t$duFACH
zHgag0;WS5PJnQyj5+_uhZ}+qh4}mNDV|81*hsl!b7ATvMsQYp&2p!qBU8@}-KfJ?y
zjYQJr*&a1^=9gs6u~|}iWMpmkF}dSR(u_=xYWoz?@zx(`uHeFoyVbxSyLwWcHV)V&
z$Dcdu!FW4ucZj8FT5pM6A+jfvpqpLVTLnH2$woyx64J7<j6@Kiaofpz4slb!S1NIx
zl|+i~@ALRuign+FZ@*+>wYjj>;v&<it<75w>j7(y8{SRZPtKCEr2-fwF(<e8dZ_M;
zhEqm&lU*^6jCHmN;R0uUh^TWuA~(x>dVe`0?dg@>aJgmQ^!TfMJl_OxSNNUwu8e8i
zSKO9}ev|gg<33l0%@B`m#2zY89X_ww-|a!jd6f!#8k5~9#)##@=z_(rXN9|$?{7aS
zs(jt>AtFvkX2XyB`>iuxO!U=NytjARua`t`@j6_ek`)D3d#=vwA+%*IHVH_)vv3LW
zijeq&nd4r(PjDL9aFoI+pY-uK<PxxYJitEm?!PIaHpSiqF-dn^1U->Uybdm4t!(4a
zE5$E~;~GPL0x3D;ofY>*4x#6cE%EY;`Xt0^K&)@W0%YQR6bh)`U?iS@K6u8npCR_J
zfhHrzCwC%lL8}3PJnQazumv8aq2zhYOcoQkebq{Mij>{G*N{YgC3y$`ijGatO^5I5
z)#|}}KGlN~xPX-vdl-03CtwYS{233<gFX-ZZ>z3@!{iwI7rYiwnIf}r@~L}Lco8}4
zv0GH$6uG;C(AJO4;h0f=e2=K?D}zpUo_%B1N_vCmISJKNECeKs%ej5mdbgG1vP)hQ
z=SGq>3?wkF*BH);TAZ)Sby`$?sp*o$ym^##a`)%?o3f~XYSzEp5}53Kj=XR<{v0}4
zfH@1EE3kA!{K%fGG1@sC&USPnO22;lIo>P8@Cy$52JR<>G>k2nguHvyyI=c#_fNlU
zK5h4XyeQP1U_B`BJ{XdfXuwX%?cgHu^Vnm~qOt`s_kGf#&b-=lO0TKabfG}h5Kqv*
zUDsLZ#-ry06ysNA{U*rfcMj+Dzvm%rOukcj1MF{NN$J@y#ulr-AhN5TJ0UPQx3s2D
zyn@;tBWjv^=-<g7VKm-rcN<yvwtut_@}6nFN$KCT;F0xW!E^3BS7q9;PpFb|9O10k
zW0Ay&`Ela2-lf*DQhsNLOwZ`-dqGbrL*DSMXkX`wrrTTGL9wp|+R-|9R@Z_Sq)K{i
z7lbpM)(;z5M^4*!zAA+@n4I0Kn!;oR`dkp#&`Et*$XeLa6UHci?GhU{tSc$Ak+lRz
z%EdWaRx#!Y9v<c$Bzs0HX$#AH-OseYsery`kOa;s*B#6qAd7SfK0EAhajdDX&PD_&
z&4>)MfgMcvlsG5mO2(O!VKZ%na{AWjLB}sMTlB5V<Mh!KIR0)#Bm|#RY56qXM5=tZ
zyFkQL?x*cOAj2?u9h_g>HMiw_zomBg-YxLm^QL!pQ#zw7XI%?sqF;7vh2Q6S>veMH
z)pO@Pr+;Vn<S~n1XRFy#v)`LH5-aZ;6DrM}dpJ4-f4VlzH-BZgkes_Xm!0l++4H%!
zR3H`9jJPo^*dZX;;qGf^wI!Z#U9YSh6v5r+D0j0e^apwZL+bdE*-uOKuw#le#_VEO
z$ER87$J^NF@_SuDr>(&pR?xL-zZX@>!+Y=EhE><RH7ev}9MyOJls+;x021ezSjk9Y
z{x~q&Qn!t>&9#?2n{&_c(?n0V65nvsO|xn~H*~JDM!vgk+J}aI30Cvy`|g_cI);vZ
zDn5GR4tvH@OPGQB7wDKN|Goh-oSS~~l8xXv)0EbO$RuXTx3633s2<+pZFOc1iN61^
z-IjfJBg#9Ne*FlyKx}S+yLZqcQ=DOT#C$DUoMipz#_N4%$?9BB+YfA(!zgL_?$L#C
z3OBNUP{r}yawv6hgS!wUpS7$3Y)91kpf|5@v0|puJ_ysm?!hPLQ^G<5L_W{qUR%hm
ze8(Y8MoHiZ3Tp4yX6K5e;fj1t#6_1nz0DA_kTgv#Hxj!)+EJi668MaQ#75MVk*<%8
z?&v|$U9riakQxe78)8x$b7Lwf_3;Dkz0vi&{=<_|qs`To7K8Sg<IRO2p@cgXHwzO2
z@OE7(tbbyp+s_Z$0(;i)YGoUV7Ur9C*S>2us+pN-Sz7QcSdZA^b8HEj|891^5G8!J
zhTLeA8{VPqzc~M@NSqRS{Ph{B3rBEP&B7L6&^_vki-XXHj`lki9tm0W7jyV(6Y-5>
zoq>?plIYC={i^s!7ypbM?mrQof#xaoPoRHdVk7l2A&+v0AenaUX}sZT^-1b9sB0z_
zfP!H=Og0->kZO`tEl?^jEYK{lD3C4CDVQk8`rg=x@KU=OH3nhoTCuBQteEYmE5`m$
zurE<J{#mprv%#AnHQ25VDvqbBXME7^$3$e{mW*9()G$imQ-7dS=+mR3){<3_#HZfJ
zE-?SIs@wFxJ1KqM`m>=Eb=utN>~}ng1Eg0=aqyW_+-MSeSp9xT_to3J<J7IF3A2~%
zZmiC{)ZQa+JBBp^3j$))DghDwbdk7Ef*+#}5`Qo!4Da}##3<<^lmq3SzZ~L5q-*3p
zaM=`99x2?kD7&t38WzelS2d}E+5MC=UH#H<$6t}&uVX-&knlsV-u7;bl()-|?y0AC
ziQ7me8X>@eUefT$m71I9v?MLD?=j!RM8Bq4Dk5Do;7mX41f~u>-6&z?)(ep2?cDk{
zYFWl{M<7o@&s$pI+QFl|cQJgOR7rO7$;KxCls_4O#}IM6DrA$b6&{pI!raP?c6T4s
z3<-Zk%;#Dq1>&B=6L>vyV$722w$q7!14YX6Dn)%fQkYNfxkKFRZ-d$Kz5(6UjklM5
z`q}w*7e7f_{&bgoqg)+0-V{~C>m$cg4hS5aO2$@OU72yLj#|$b3(NNKe`gm!%sQwk
z$?4g}Ngb!TK-3_mDfXJ~@h1$eI`yNvkrCdWR<GHTb<Z-+I|ATlR_kVB!JxI1V?zfn
zmf=x#(|49XA8?jS)#`e6t|=GowPtp`n9OuAHHmZ*x(RhI6`d__B{&#UL*3fv5ojS6
zBn|(*JFb4m#5dUXIM-S5G!H^=I=?ss3aS@NN9WbnzsQE)WL+Q~H;%?QOblt)LQj2%
z#?-6}(;{C*W)>@tZ3m-86?mAlcnrTItTZVhm3jhGPj%H5Gjc`GI?wrAWMdX$rv<I}
z_hRe6^*yJrT{CXX#q567-dq#3g{2#!Y}{WxbJDx#xc&8~M|)RjXuHWpQ-=$}v*!DA
z9d_5OZIWqwqcS@q{$y>;+f^I;>G=9WCe=jsR=YxNaKq$oCspZCCH_Ra=F;}Ecb&6m
zGbh6R)b{kt&W|0(QqGR8pVhWAcADJ5#x?Ib8Cn*WLie%>tLpn=4g=d=1GL!RjGcV_
z$s!CTfhekl%1#icOQqgCJzfmzLKS%4Sr;5Ret)+sAW!u1C)V6!OoeTiV~*#}#~>F}
zPyRszYCl&m74<M1YKsz0*E;+fXCxgtq%3o+&0BbVEk{UM73J~jgZ!eFqu20u`nd?+
z#mqu?mx+k9JHyP1P`lr)Ma!l0c{C=NhyLRiJAKU&6>g=UL~^e<Y53dXYt}ZOr=PB=
z?OIoMR*txQ$*M^g#MG$m7T;)lS-y6sWK$GZ?bL8>xD%2l>Q`H0(N@EIIJCe~ZnWE@
z(&^=>u$g&EuPeG%8T!@S$<%8^?Q4^oZsF#I<bLV*WFV7m<_1dEAjmOQO><oz^DI*<
zzT~0T6YjvO4IltmHdD>7Jn0sVQJY9%)At|OYhKc=anmog0Kc11?W{je3zXd?&o;T1
zkh7T^pq%A+ffsGVCHQNM`gbz=pMgpocu~zsiTX26s#|-bK@b!I*r{g3{Ko#Bwf;XR
zH~~?4Pah972rT+<#y_L9lC#(E{C`&3)?W5l9|-EtK&fEwjW+!=b}Bie<;;Q58d6*o
z5=f}w!Nqn|TLZyGp@6j-E?l@+17YnLj==wVplmp;Bf%jTLkf#Q^uZ_z2uuPF&@_Pm
zLbMy8e<7(2a9#(bJq&5<02LO4L7>7gaTrY41`37<!(nikowc2vHTID#;By1`f9ELO
z=)w#Y`!%KiE3Ae++WPnS3&E1>X@udT#DO1;95`Trp-IUSD)#H0gnwOC6-*_eFepkK
zE)Iu+u`j5&xb$VjTvXT76Ak)PMfd;C$Kqh5sGf76Jr;+Es(LthVs%FW?M(>GTO;ob
zdnSVAQl3s#KtxeSCY8IBNLJ#JN*W8*XN^EU{V*Y%bdCDFg-Gs+43`a!jKG1gUjJpS
zz593+VIMnZBRU<ra)0EWhA!rwi_@rL7CQuhpVh2!C8#^1wHGgBczJ5U3`jA2M!a|M
zTDmuQI+TxJE4CETT@X?<D_&p09Py>D`oC7O`#@oVPvO%mmmk?0vt^6>$Uk-_j3=a)
zAbSszI>)TE&Ji&lptPRU@1c^#XQE!86V=C?fGSvG(z7l+_BGVTm$!1nM}SPM31>~L
zNiGOh()%-$1=%qyDj87|#HF-qd}hjN<BA7X=(H`B=gB2=>S|dTLgi?T+UJaka%h-M
zQvA#Z#iG6pnjqA)6ionQwfPz~$Le`6gg?QHKZT?$R;?_NQXAhuhkRNG53WPnq(kVV
zL&^C_nx%+~r5G$NM+;Mg!jwrH6$FD5-#SG!JH=>?aj=h37e1nucuXoSZ-nk$-$>@z
zh_g7t?Hnfz8K*o4U%|tGi6X#PEp7Otx$t`T>6NT_m8@X{Rzd^Tl3fE=gCjh_)JxVh
z*KJ9jtOTj|qDQ*bNB(iMv!VF3LO9Z!l9PgO9II%Yc+EK8-Z+`wIIggkq_U2{wT@z|
z4u`dlIIj-hw2pi(EsA|M&U`jWYBr&;j`H;0m3Of#Ag{YbG54-w+Fr_&9rMd@t*8_c
zsg`Ib(y;Y|*#?Qv!hs|Dr*~N#?=r0Kv4#!?m~|_fVZXGbhm*hGz^vD2zFTAdANTnl
z^ZDM8vpB*dQp_q>!LmR>DdvIJDWCRprffW;)84!-Lx*MGlj#En74o_K%l98|G$7JS
ROoD`oiIZHrrl_U#e*md%7iRzf

diff --git a/backend/compact-connect/lambdas/nodejs/email-notification-service/README.md b/backend/compact-connect/lambdas/nodejs/email-notification-service/README.md
index 2cf4eb646..79f63f3ca 100644
--- a/backend/compact-connect/lambdas/nodejs/email-notification-service/README.md
+++ b/backend/compact-connect/lambdas/nodejs/email-notification-service/README.md
@@ -1,7 +1,7 @@
 # Email Notification Service Lambda
 
-This package contains code required to generate system emails for users in compact connect, as well as 
-compacts/jurisdictions staff. It leverages [EmailBuilderJS](https://github.com/usewaypoint/email-builder-js) to dynamically render email HTML content that should 
+This package contains code required to generate system emails for users in compact connect, as well as
+compacts/jurisdictions staff. It leverages [EmailBuilderJS](https://github.com/usewaypoint/email-builder-js) to dynamically render email HTML content that should
 be rendered consistently across email clients.
 
 The lambda is intended to be invoked directly, rather than through an API endpoint. It uses the following payload structure:
@@ -25,9 +25,9 @@ The lambda is intended to be invoked directly, rather than through an API endpoi
 }
 ```
 
-This schema provides flexibility for adding new notification template types. Each template type corresponds to a 
+This schema provides flexibility for adding new notification template types. Each template type corresponds to a
 particular method in the `EmailServiceTemplater` class. The `recipientType` field is used to determine which email addresses to
 send the email to, and correspond to email lists defined in the compact/jurisdiction configurations used by the system.
-The `specificEmails` field is used to send the email to a specific list of email addresses, and is only used when 
+The `specificEmails` field is used to send the email to a specific list of email addresses, and is only used when
 `recipientType` is set to `SPECIFIC`. The `templateVariables` field is used to hydrate the email template with dynamic content.
 if needed.
diff --git a/backend/compact-connect/lambdas/nodejs/email-notification-service/email-notification-service-lambda.ts b/backend/compact-connect/lambdas/nodejs/email-notification-service/email-notification-service-lambda.ts
index 58ff8a46d..78f3086e9 100644
--- a/backend/compact-connect/lambdas/nodejs/email-notification-service/email-notification-service-lambda.ts
+++ b/backend/compact-connect/lambdas/nodejs/email-notification-service/email-notification-service-lambda.ts
@@ -35,7 +35,7 @@ export class Lambda implements LambdaInterface {
 
     /**
      * Lambda handler for email notification service
-     * 
+     *
      * This handler sends an email notification based on the requested email template.
      * See README in this directory for information on using this service.
      *
diff --git a/backend/compact-connect/lambdas/nodejs/lib/email-service.ts b/backend/compact-connect/lambdas/nodejs/lib/email-service.ts
index a3d9b4374..c8f7890fc 100644
--- a/backend/compact-connect/lambdas/nodejs/lib/email-service.ts
+++ b/backend/compact-connect/lambdas/nodejs/lib/email-service.ts
@@ -185,18 +185,18 @@ export class EmailService {
         return validationErrors;
     }
 
-    private async getRecipients(compact: string, 
-        recipientType: RecipientType, 
+    private async getRecipients(compact: string,
+        recipientType: RecipientType,
         specificEmails?: string[]
     ): Promise<string[]> {
         if (recipientType === 'SPECIFIC') {
             if (specificEmails) return specificEmails;
-            
+
             throw new Error(`SPECIFIC recipientType requested but no specific email addresses provided`);
         }
 
         const compactConfig = await this.compactConfigurationClient.getCompactConfiguration(compact);
-        
+
         switch (recipientType) {
         case 'COMPACT_OPERATIONS_TEAM':
             return compactConfig.compactOperationsTeamEmails;
@@ -205,12 +205,12 @@ export class EmailService {
         }
     }
 
-    public async sendTransactionBatchSettlementFailureEmail(compact: string, 
-        recipientType: RecipientType, 
+    public async sendTransactionBatchSettlementFailureEmail(compact: string,
+        recipientType: RecipientType,
         specificEmails?: string[]
     ): Promise<void> {
         const recipients = await this.getRecipients(compact, recipientType, specificEmails);
-        
+
         if (recipients.length === 0) {
             throw new Error(`No recipients found for compact ${compact} with recipient type ${recipientType}`);
         }
@@ -226,7 +226,7 @@ export class EmailService {
         this.insertFooter(report);
 
         const htmlContent = renderToStaticMarkup(report, { rootBlockId: 'root' });
-        
+
         await this.sendEmail({ htmlContent, subject, recipients, errorMessage: 'Unable to send transaction batch settlement failure email' });
     }
 
@@ -533,9 +533,9 @@ export class EmailService {
         report['root']['data']['childrenIds'].push(blockDivId);
     }
 
-    private insertHeaderWithJurisdiction(report: TReaderDocument, 
-        compact: string, 
-        jurisdiction: string, 
+    private insertHeaderWithJurisdiction(report: TReaderDocument,
+        compact: string,
+        jurisdiction: string,
         heading: string) {
 
         const blockLogoId = 'block-logo';
@@ -725,7 +725,7 @@ export class EmailService {
 
     /**
      * Adds a standard header block with Compact Connect logo to the report.
-     * 
+     *
      * @param report The report object to insert the block into.
      * @param heading The text to insert into the block.
      */
@@ -782,7 +782,7 @@ export class EmailService {
 
     /**
      * Inserts a body text block into the report.
-     * 
+     *
      * @param report The report object to insert the block into.
      * @param bodyText The text to insert into the block.
      */
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/config.py b/backend/compact-connect/lambdas/python/common/cc_common/config.py
index ad8af041d..45abbed82 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/config.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/config.py
@@ -5,6 +5,7 @@
 from functools import cached_property
 
 import boto3
+from aws_lambda_powertools import Metrics
 from aws_lambda_powertools.logging import Logger
 from botocore.config import Config as BotoConfig
 
@@ -12,6 +13,8 @@
 logger = Logger()
 logger.setLevel(logging.DEBUG if os.environ.get('DEBUG', 'false').lower() == 'true' else logging.INFO)
 
+metrics = Metrics(namespace='compact-connect', service='common')
+
 
 class _Config:
     presigned_post_ttl_seconds = 3600
@@ -35,7 +38,7 @@ def dynamodb_client(self):
 
     @cached_property
     def data_client(self):
-        from cc_common.data_model.client import DataClient
+        from cc_common.data_model.data_client import DataClient
 
         return DataClient(self)
 
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/client.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/data_client.py
similarity index 57%
rename from backend/compact-connect/lambdas/python/common/cc_common/data_model/client.py
rename to backend/compact-connect/lambdas/python/common/cc_common/data_model/data_client.py
index 2a1ed1953..20792eb32 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/client.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/data_client.py
@@ -2,19 +2,21 @@
 from urllib.parse import quote
 from uuid import uuid4
 
+from aws_lambda_powertools.metrics import MetricUnit
 from boto3.dynamodb.conditions import Attr, Key
-from boto3.dynamodb.types import TypeDeserializer
+from boto3.dynamodb.types import TypeDeserializer, TypeSerializer
 from botocore.exceptions import ClientError
 
-from cc_common.config import _Config, config, logger
+from cc_common.config import _Config, config, logger, metrics
 from cc_common.data_model.query_paginator import paginated_query
 from cc_common.data_model.schema import PrivilegeRecordSchema
 from cc_common.data_model.schema.base_record import SSNIndexRecordSchema
 from cc_common.data_model.schema.military_affiliation import (
-    MilitaryAffiliationRecordSchema,
     MilitaryAffiliationStatus,
     MilitaryAffiliationType,
 )
+from cc_common.data_model.schema.military_affiliation.record import MilitaryAffiliationRecordSchema
+from cc_common.data_model.schema.privilege.record import PrivilegeUpdateRecordSchema
 from cc_common.exceptions import CCAwsServiceException, CCNotFoundException
 
 
@@ -171,7 +173,7 @@ def get_privilege_purchase_options(self, *, compact: str, dynamo_pagination: dic
 
     def _generate_privilege_record(
         self,
-        compact_name: str,
+        compact: str,
         provider_id: str,
         jurisdiction_postal_abbreviation: str,
         license_expiration_date: date,
@@ -180,9 +182,9 @@ def _generate_privilege_record(
         original_issuance_date: datetime | None = None,
     ):
         current_datetime = config.current_standard_datetime
-        privilege_object = {
+        return {
             'providerId': provider_id,
-            'compact': compact_name,
+            'compact': compact,
             'jurisdiction': jurisdiction_postal_abbreviation.lower(),
             'dateOfIssuance': original_issuance_date if original_issuance_date else current_datetime,
             'dateOfRenewal': current_datetime,
@@ -190,16 +192,15 @@ def _generate_privilege_record(
             'compactTransactionId': compact_transaction_id,
             'attestations': attestations,
         }
-        schema = PrivilegeRecordSchema()
-        return schema.dump(privilege_object)
 
     def create_provider_privileges(
         self,
-        compact_name: str,
+        compact: str,
         provider_id: str,
         jurisdiction_postal_abbreviations: list[str],
         license_expiration_date: date,
         compact_transaction_id: str,
+        provider_record: dict,
         existing_privileges: list[dict],
         attestations: list[dict],
     ):
@@ -210,11 +211,12 @@ def create_provider_privileges(
         the entire transaction will be rolled back. As this is usually performed after a provider has purchased
         one or more privileges, it is important that all records are created successfully.
 
-        :param compact_name: The compact name
+        :param compact: The compact name
         :param provider_id: The provider id
         :param jurisdiction_postal_abbreviations: The list of jurisdiction postal codes
         :param license_expiration_date: The license expiration date
         :param compact_transaction_id: The compact transaction id
+        :param provider_record: The original provider record
         :param existing_privileges: The list of existing privileges for this user. Used to track the original issuance
         date of the privilege.
         :param attestations: List of attestations that were accepted when purchasing the privileges
@@ -222,61 +224,226 @@ def create_provider_privileges(
         logger.info(
             'Creating provider privileges',
             provider_id=provider_id,
+            compact=compact,
             privlige_jurisdictions=jurisdiction_postal_abbreviations,
             compact_transaction_id=compact_transaction_id,
         )
 
         try:
-            # the batch writer handles retries and sending the requests in batches
-            with self.config.provider_table.batch_writer() as batch:
-                for postal_abbreviation in jurisdiction_postal_abbreviations:
-                    # get the original privilege issuance date from an existing privilege record if it exists
-                    original_privilege_issuance_date = next(
-                        (
-                            record['dateOfIssuance']
-                            for record in existing_privileges
-                            if record['jurisdiction'].lower() == postal_abbreviation.lower()
-                        ),
-                        None,
+            # We'll collect all the record changes into a transaction to protect data consistency
+            transactions = []
+            processed_transactions = []
+            privilege_update_records = []
+
+            for postal_abbreviation in jurisdiction_postal_abbreviations:
+                # get the original privilege issuance date from an existing privilege record if it exists
+                original_privilege = next(
+                    (
+                        record
+                        for record in existing_privileges
+                        if record['jurisdiction'].lower() == postal_abbreviation.lower()
+                    ),
+                    None,
+                )
+                original_issuance_date = original_privilege['dateOfIssuance'] if original_privilege else None
+
+                privilege_record = self._generate_privilege_record(
+                    compact=compact,
+                    provider_id=provider_id,
+                    jurisdiction_postal_abbreviation=postal_abbreviation,
+                    license_expiration_date=license_expiration_date,
+                    compact_transaction_id=compact_transaction_id,
+                    original_issuance_date=original_issuance_date,
+                    attestations=attestations,
+                )
+
+                # Create privilege update record if this is updating an existing privilege
+                if original_privilege:
+                    update_record = {
+                        'type': 'privilegeUpdate',
+                        'updateType': 'renewal',
+                        'providerId': provider_id,
+                        'compact': compact,
+                        'jurisdiction': postal_abbreviation.lower(),
+                        'previous': original_privilege,
+                        'updatedValues': {
+                            'dateOfRenewal': privilege_record['dateOfRenewal'],
+                            'dateOfExpiration': privilege_record['dateOfExpiration'],
+                            'compactTransactionId': compact_transaction_id,
+                        },
+                    }
+                    privilege_update_records.append(update_record)
+                    transactions.append(
+                        {
+                            'Put': {
+                                'TableName': self.config.provider_table_name,
+                                'Item': TypeSerializer().serialize(PrivilegeUpdateRecordSchema().dump(update_record))[
+                                    'M'
+                                ],
+                            }
+                        }
                     )
 
-                    privilege_record = self._generate_privilege_record(
-                        compact_name=compact_name,
+                transactions.append(
+                    {
+                        'Put': {
+                            'TableName': self.config.provider_table_name,
+                            'Item': TypeSerializer().serialize(PrivilegeRecordSchema().dump(privilege_record))['M'],
+                        }
+                    }
+                )
+
+            # We save this update till last so that it is least likely to be changed in the event of a failure in one of
+            # the other transactions.
+            transactions.append(
+                {
+                    'Update': {
+                        'TableName': self.config.provider_table_name,
+                        'Key': {
+                            'pk': {'S': f'{compact}#PROVIDER#{provider_id}'},
+                            'sk': {'S': f'{compact}#PROVIDER'},
+                        },
+                        'UpdateExpression': 'ADD #privilegeJurisdictions :newJurisdictions',
+                        'ExpressionAttributeNames': {'#privilegeJurisdictions': 'privilegeJurisdictions'},
+                        'ExpressionAttributeValues': {':newJurisdictions': {'SS': jurisdiction_postal_abbreviations}},
+                    }
+                }
+            )
+
+            # Unfortunately, we can't guarantee that the number of transactions is below the 100 action limit
+            # for extremely large purchases. To handle those large purchases, we will have to break our transactions
+            # up and handle a multi-transaction roll-back on failure.
+            # We'll collect data for sizes, just so we can keep an eye on them and understand user behavior
+            metrics.add_metric(
+                name='privilege-purchase-transaction-size', unit=MetricUnit.Count, value=len(transactions)
+            )
+            metrics.add_metric(
+                name='privileges-purchased', unit=MetricUnit.Count, value=len(jurisdiction_postal_abbreviations)
+            )
+            # 100 is the maximum transaction size
+            batch_size = 100
+            # Iterate over the transactions until they are empty
+            while transaction_batch := transactions[:batch_size]:
+                self.config.dynamodb_client.transact_write_items(TransactItems=transaction_batch)
+                processed_transactions.extend(transaction_batch)
+                transactions = transactions[batch_size:]
+                if transactions:
+                    logger.info(
+                        'Breaking privilege updates into multiple transactions',
+                        compact=compact,
                         provider_id=provider_id,
-                        jurisdiction_postal_abbreviation=postal_abbreviation,
-                        license_expiration_date=license_expiration_date,
+                        privlige_jurisdictions=jurisdiction_postal_abbreviations,
                         compact_transaction_id=compact_transaction_id,
-                        attestations=attestations,
-                        original_issuance_date=original_privilege_issuance_date,
                     )
-                    batch.put_item(Item=privilege_record)
-
-            # finally we need to update the provider record to include the new privilege jurisdictions
-            # batch writer can't perform updates, so we'll use a transact_write_items call
-            self.config.provider_table.update_item(
-                Key={'pk': f'{compact_name}#PROVIDER#{provider_id}', 'sk': f'{compact_name}#PROVIDER'},
-                UpdateExpression='ADD #privilegeJurisdictions :newJurisdictions',
-                ExpressionAttributeNames={'#privilegeJurisdictions': 'privilegeJurisdictions'},
-                ExpressionAttributeValues={':newJurisdictions': set(jurisdiction_postal_abbreviations)},
-            )
+
         except ClientError as e:
             message = 'Unable to create all provider privileges. Rolling back transaction.'
             logger.info(message, error=str(e))
-            # we must rollback and delete the privilege records that were created
-            with self.config.provider_table.batch_writer() as delete_batch:
-                for postal_abbreviation in jurisdiction_postal_abbreviations:
-                    privilege_record = self._generate_privilege_record(
-                        compact_name=compact_name,
-                        provider_id=provider_id,
-                        jurisdiction_postal_abbreviation=postal_abbreviation,
-                        license_expiration_date=license_expiration_date,
-                        compact_transaction_id=compact_transaction_id,
-                        attestations=attestations,
-                    )
-                    # this transaction is idempotent, so we can safely delete the records even if they weren't created
-                    delete_batch.delete_item(Key={'pk': privilege_record['pk'], 'sk': privilege_record['sk']})
+            self._rollback_privilege_transactions(
+                processed_transactions=processed_transactions,
+                provider_record=provider_record,
+                existing_privileges=existing_privileges,
+            )
             raise CCAwsServiceException(message) from e
 
+    def _rollback_privilege_transactions(
+        self,
+        processed_transactions: list[dict],
+        provider_record: dict,
+        existing_privileges: list[dict],
+    ):
+        """Roll back successful privilege transactions after a failure."""
+        rollback_transactions = []
+
+        compact = provider_record['compact']
+        provider_id = provider_record['providerId']
+
+        # Create a lookup of existing privileges by jurisdiction
+        existing_privileges_by_jurisdiction = {
+            privilege['jurisdiction']: privilege for privilege in existing_privileges
+        }
+
+        # Delete all privilege update records and handle privilege records appropriately
+        privilege_record_schema = PrivilegeRecordSchema()
+        for transaction in processed_transactions:
+            if transaction.get('Put'):
+                item = TypeDeserializer().deserialize({'M': transaction['Put']['Item']})
+                if item.get('type') == 'privilegeUpdate':
+                    # Always delete update records as they are always new
+                    rollback_transactions.append(
+                        {
+                            'Delete': {
+                                'TableName': self.config.provider_table_name,
+                                'Key': {
+                                    'pk': {'S': item['pk']},
+                                    'sk': {'S': item['sk']},
+                                },
+                            }
+                        }
+                    )
+                elif item.get('type') == 'privilege':
+                    # For privilege records, check if it was an update or new creation
+                    original_privilege = existing_privileges_by_jurisdiction.get(item['jurisdiction'])
+                    if original_privilege:
+                        logger.info(
+                            'Restoring original privilege record',
+                            provider_id=provider_id,
+                            compact=compact,
+                            jurisdiction=item['jurisdiction'],
+                        )
+                        # If it was an update, restore the original record
+                        rollback_transactions.append(
+                            {
+                                'Put': {
+                                    'TableName': self.config.provider_table_name,
+                                    'Item': TypeSerializer().serialize(
+                                        privilege_record_schema.dump(original_privilege)
+                                    )['M'],
+                                }
+                            }
+                        )
+                    else:
+                        # If it was a new creation, delete it
+                        logger.info(
+                            'Deleting new privilege record',
+                            provider_id=provider_id,
+                            compact=compact,
+                            jurisdiction=item['jurisdiction'],
+                        )
+                        rollback_transactions.append(
+                            {
+                                'Delete': {
+                                    'TableName': self.config.provider_table_name,
+                                    'Key': {
+                                        'pk': {'S': item['pk']},
+                                        'sk': {'S': item['sk']},
+                                    },
+                                }
+                            }
+                        )
+
+        # Restore the original provider record
+        rollback_transactions.append(
+            {
+                'Put': {
+                    'TableName': self.config.provider_table_name,
+                    'Item': TypeSerializer().serialize(provider_record)['M'],
+                }
+            }
+        )
+
+        # Execute rollback in batches of 100
+        batch_size = 100
+        while rollback_batch := rollback_transactions[:batch_size]:
+            try:
+                logger.info('Submitting rollback transaction', provider_id=provider_id, compact=compact)
+                self.config.dynamodb_client.transact_write_items(TransactItems=rollback_batch)
+                rollback_transactions = rollback_transactions[batch_size:]
+            except ClientError as e:
+                logger.error('Failed to roll back privilege transactions', error=str(e))
+                raise CCAwsServiceException('Failed to roll back privilege transactions') from e
+        logger.info('Privilege rollback complete', provider_id=provider_id, compact=compact)
+
     def _get_military_affiliation_records_by_status(
         self, compact: str, provider_id: str, status: MilitaryAffiliationStatus
     ):
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/__init__.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/__init__.py
index 1ef0e00b7..7612ecff1 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/__init__.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/__init__.py
@@ -1,8 +1,8 @@
 # ruff: noqa: F401
 # We import all the record types with the package to ensure they are all registered
-from .compact import CompactRecordSchema
-from .jurisdiction import JurisdictionRecordSchema
-from .license import LicenseRecordSchema
-from .privilege import PrivilegeRecordSchema
-from .provider import ProviderRecordSchema
+from .compact.record import CompactRecordSchema
+from .jurisdiction.record import JurisdictionRecordSchema
+from .license.record import LicenseRecordSchema
+from .privilege.record import PrivilegeRecordSchema
+from .provider.record import ProviderRecordSchema
 from .user import UserRecordSchema
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/base_record.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/base_record.py
index 554e80936..fd8055e68 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/base_record.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/base_record.py
@@ -5,11 +5,11 @@
 from datetime import date, datetime
 
 from marshmallow import EXCLUDE, RAISE, Schema, post_load, pre_dump, pre_load
-from marshmallow.fields import UUID, DateTime, List, String
-from marshmallow.validate import OneOf, Regexp
+from marshmallow.fields import UUID, DateTime, String
+from marshmallow.validate import OneOf
 
 from cc_common.config import config
-from cc_common.data_model.schema.common import ensure_value_is_datetime
+from cc_common.data_model.schema.fields import SocialSecurityNumber
 from cc_common.exceptions import CCInternalException
 
 
@@ -27,25 +27,13 @@ class Meta:
         unknown = EXCLUDE
 
 
-class SocialSecurityNumber(String):
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, validate=Regexp('^[0-9]{3}-[0-9]{2}-[0-9]{4}$'), **kwargs)
-
-
-class Set(List):
-    """A Field that de/serializes to a Set (not compatible with JSON)"""
-
-    default_error_messages = {'invalid': 'Not a valid set.'}
-
-    def _serialize(self, *args, **kwargs):
-        return set(super()._serialize(*args, **kwargs))
-
-    def _deserialize(self, *args, **kwargs):
-        return set(super()._deserialize(*args, **kwargs))
-
-
 class BaseRecordSchema(StrictSchema, ABC):
-    """Abstract base class, common to all records in the license data table"""
+    """
+    Abstract base class, common to all records in the provider data table
+
+    Serialization direction:
+    DB -> load() -> Python
+    """
 
     _record_type = None
     _registered_schema = {}
@@ -58,13 +46,6 @@ class BaseRecordSchema(StrictSchema, ABC):
     # Provided fields
     type = String(required=True, allow_none=False)
 
-    @pre_load
-    def ensure_date_of_update_is_datetime(self, in_data, **kwargs):
-        # for backwards compatibility with the old data model, which was using a Date value
-        in_data['dateOfUpdate'] = ensure_value_is_datetime(in_data['dateOfUpdate'])
-
-        return in_data
-
     @post_load
     def drop_base_gen_fields(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
         """Drop the db-specific pk and sk fields before returning loaded data"""
@@ -104,8 +85,13 @@ def get_schema_by_type(cls, record_type: str) -> Schema:
 
 
 class CalculatedStatusRecordSchema(BaseRecordSchema):
-    """Schema for records whose active/inactive status is determined at load time. This
-    includes licenses, privileges and provider records."""
+    """
+    Schema for records whose active/inactive status is determined at load time. This
+    includes licenses, privileges and provider records.
+
+    Serialization direction:
+    DB -> load() -> Python
+    """
 
     # This field is the actual status referenced by the system, which is determined by the expiration date
     # in addition to the jurisdictionStatus. This should never be written to the DB. It is calculated
@@ -136,16 +122,14 @@ def _calculate_status(self, in_data, **kwargs):
         return in_data
 
 
-class ITUTE164PhoneNumber(String):
-    """Phone number format consistent with ITU-T E.164:
-    https://www.itu.int/rec/T-REC-E.164-201011-I/en
+class SSNIndexRecordSchema(StrictSchema):
     """
+    Schema for records that translate between SSN and provider_id
 
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, validate=Regexp(r'^\+[0-9]{8,15}$'), **kwargs)
-
+    Serialization direction:
+    DB -> load() -> Python
+    """
 
-class SSNIndexRecordSchema(StrictSchema):
     pk = String(required=True, allow_none=False)
     sk = String(required=True, allow_none=False)
     ssn = SocialSecurityNumber(required=True, allow_none=False)
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/common.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/common.py
index fd90d2426..49c82e536 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/common.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/common.py
@@ -1,13 +1,14 @@
 # ruff: noqa: N815 invalid-name
-
+import json
 from datetime import UTC, datetime
-from enum import Enum
+from enum import StrEnum
+from hashlib import md5
 
 from marshmallow import Schema
 from marshmallow.fields import Dict, String, Url
 
 
-class CCEnum(Enum):
+class CCEnum(StrEnum):
     """
     Base class for Compact Connect enums
 
@@ -29,18 +30,6 @@ class S3PresignedPostSchema(Schema):
     fields = Dict(keys=String(), values=String(), required=True, allow_none=False)
 
 
-class AttestationVersionSchema(Schema):
-    """
-    This schema is intended to be used by any object in the system which needs to track which attestations have been
-    accepted by a user (i.e. when purchasing privileges).
-
-    This schema is intended to be used as a nested field in other schemas.
-    """
-
-    attestationId = String(required=True, allow_none=False)
-    version = String(required=True, allow_none=False)
-
-
 def ensure_value_is_datetime(value: str):
     """
     Checks a string value is always returned as a datetime string, even if it is a date string.
@@ -71,3 +60,46 @@ def ensure_value_is_datetime(value: str):
 
     # Not a date string, return the original
     return value
+
+
+class UpdateCategory(CCEnum):
+    RENEWAL = 'renewal'
+    DEACTIVATION = 'deactivation'
+    OTHER = 'other'
+
+
+class Status(CCEnum):
+    ACTIVE = 'active'
+    INACTIVE = 'inactive'
+
+
+class ChangeHashMixin:
+    """
+    Provides change hash methods for *UpdateRecordSchema
+    """
+
+    @classmethod
+    def hash_changes(cls, in_data) -> str:
+        """
+        Generate a hash of the previous record, updated values, and removed values (if present),
+        to produce a deterministic sort key segment that will be unique among updates to this
+        particular license.
+        """
+        # We don't need a cryptographically secure hash, just one that is reasonably cheap and reasonably unique
+        # Within the scope of a single provider for a single second.
+        change_hash = md5()  # noqa: S324
+
+        # Build a dictionary of all values that contribute to the hash
+        hash_data = {
+            'previous': in_data['previous'],
+            'updatedValues': in_data['updatedValues'],
+        }
+        # Only include removedValues if it exists
+        if 'removedValues' in in_data:
+            hash_data['removedValues'] = sorted(in_data['removedValues'])
+
+        change_hash.update(
+            json.dumps(hash_data, sort_keys=True).encode('utf-8')
+        )
+
+        return change_hash.hexdigest()
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact.py
deleted file mode 100644
index 716cde943..000000000
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact.py
+++ /dev/null
@@ -1,102 +0,0 @@
-# ruff: noqa: N801, N815, ARG002 invalid-name unused-kwargs
-from collections import UserDict
-
-from marshmallow import Schema, pre_dump
-from marshmallow.fields import Decimal, List, Nested, String
-from marshmallow.validate import Length, OneOf
-
-from cc_common.config import config
-from cc_common.data_model.schema.base_record import BaseRecordSchema, ForgivingSchema
-from cc_common.data_model.schema.common import CCEnum
-
-COMPACT_TYPE = 'compact'
-
-
-class CompactFeeType(CCEnum):
-    FLAT_RATE = 'FLAT_RATE'
-
-
-class CompactCommissionFeeSchema(Schema):
-    feeType = String(required=True, allow_none=False, validate=OneOf([e.value for e in CompactFeeType]))
-    feeAmount = Decimal(required=True, allow_none=False)
-
-
-@BaseRecordSchema.register_schema(COMPACT_TYPE)
-class CompactRecordSchema(BaseRecordSchema):
-    """Schema for the root compact configuration records"""
-
-    _record_type = COMPACT_TYPE
-
-    # Provided fields
-    compactName = String(required=True, allow_none=False, validate=OneOf(config.compacts))
-    compactCommissionFee = Nested(CompactCommissionFeeSchema(), required=True, allow_none=False)
-    compactOperationsTeamEmails = List(String(required=True, allow_none=False), required=True, allow_none=False)
-    compactAdverseActionsNotificationEmails = List(
-        String(required=True, allow_none=False),
-        required=True,
-        allow_none=False,
-    )
-    compactSummaryReportNotificationEmails = List(
-        String(required=True, allow_none=False),
-        required=True,
-        allow_none=False,
-    )
-
-    # Generated fields
-    pk = String(required=True, allow_none=False)
-    sk = String(required=True, allow_none=False, validate=Length(2, 100))
-
-    @pre_dump
-    def generate_pk_sk(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
-        # the pk and sk are the same for the root compact record
-        in_data['pk'] = f'{in_data['compactName']}#CONFIGURATION'
-        in_data['sk'] = f'{in_data['compactName']}#CONFIGURATION'
-        return in_data
-
-
-class CompactOptionsApiResponseSchema(ForgivingSchema):
-    """Used to enforce which fields are returned in compact objects for the GET /purchase/privileges/options endpoint"""
-
-    compactName = String(required=True, allow_none=False, validate=OneOf(config.compacts))
-    compactCommissionFee = Nested(CompactCommissionFeeSchema(), required=True, allow_none=False)
-    type = String(required=True, allow_none=False, validate=OneOf([COMPACT_TYPE]))
-
-
-class CompactCommissionFee(UserDict):
-    """
-    Compact commission fee data model. Used to access variables without needing to know the underlying key structure.
-    """
-
-    @property
-    def fee_type(self) -> CompactFeeType:
-        return CompactFeeType.from_str(self['feeType'])
-
-    @property
-    def fee_amount(self) -> float:
-        return float(self['feeAmount'])
-
-
-class Compact(UserDict):
-    """
-    Compact configuration data model. Used to access variables without needing to know the underlying key structure.
-    """
-
-    @property
-    def compact_name(self) -> str:
-        return self['compactName']
-
-    @property
-    def compact_commission_fee(self) -> CompactCommissionFee:
-        return CompactCommissionFee(self['compactCommissionFee'])
-
-    @property
-    def compact_operations_team_emails(self) -> list[str] | None:
-        return self.get('compactOperationsTeamEmails')
-
-    @property
-    def compact_adverse_actions_notification_emails(self) -> list[str] | None:
-        return self.get('compactAdverseActionsNotificationEmails')
-
-    @property
-    def compact_summary_report_notification_emails(self) -> list[str] | None:
-        return self.get('compactSummaryReportNotificationEmails')
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact/__init__.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact/__init__.py
new file mode 100644
index 000000000..cb748bb1b
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact/__init__.py
@@ -0,0 +1,59 @@
+# ruff: noqa: N801, N815, ARG002 invalid-name unused-kwargs
+from collections import UserDict
+
+from marshmallow import Schema
+from marshmallow.fields import Decimal, String
+from marshmallow.validate import OneOf
+
+from cc_common.data_model.schema.common import CCEnum
+
+COMPACT_TYPE = 'compact'
+
+
+class CompactFeeType(CCEnum):
+    FLAT_RATE = 'FLAT_RATE'
+
+
+class CompactCommissionFeeSchema(Schema):
+    feeType = String(required=True, allow_none=False, validate=OneOf([e.value for e in CompactFeeType]))
+    feeAmount = Decimal(required=True, allow_none=False)
+
+
+class CompactCommissionFee(UserDict):
+    """
+    Compact commission fee data model. Used to access variables without needing to know the underlying key structure.
+    """
+
+    @property
+    def fee_type(self) -> CompactFeeType:
+        return CompactFeeType.from_str(self['feeType'])
+
+    @property
+    def fee_amount(self) -> float:
+        return float(self['feeAmount'])
+
+
+class Compact(UserDict):
+    """
+    Compact configuration data model. Used to access variables without needing to know the underlying key structure.
+    """
+
+    @property
+    def compact_name(self) -> str:
+        return self['compactName']
+
+    @property
+    def compact_commission_fee(self) -> CompactCommissionFee:
+        return CompactCommissionFee(self['compactCommissionFee'])
+
+    @property
+    def compact_operations_team_emails(self) -> list[str] | None:
+        return self.get('compactOperationsTeamEmails')
+
+    @property
+    def compact_adverse_actions_notification_emails(self) -> list[str] | None:
+        return self.get('compactAdverseActionsNotificationEmails')
+
+    @property
+    def compact_summary_report_notification_emails(self) -> list[str] | None:
+        return self.get('compactSummaryReportNotificationEmails')
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact/api.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact/api.py
new file mode 100644
index 000000000..8ab3a084e
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact/api.py
@@ -0,0 +1,15 @@
+# ruff: noqa: N801, N815, ARG002 invalid-name unused-kwargs
+from marshmallow.fields import Nested, String
+from marshmallow.validate import OneOf
+
+from cc_common.config import config
+from cc_common.data_model.schema.base_record import ForgivingSchema
+from cc_common.data_model.schema.compact import COMPACT_TYPE, CompactCommissionFeeSchema
+
+
+class CompactOptionsResponseSchema(ForgivingSchema):
+    """Used to enforce which fields are returned in compact objects for the GET /purchase/privileges/options endpoint"""
+
+    compactName = String(required=True, allow_none=False, validate=OneOf(config.compacts))
+    compactCommissionFee = Nested(CompactCommissionFeeSchema(), required=True, allow_none=False)
+    type = String(required=True, allow_none=False, validate=OneOf([COMPACT_TYPE]))
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact/record.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact/record.py
new file mode 100644
index 000000000..f264ebbcb
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/compact/record.py
@@ -0,0 +1,41 @@
+# ruff: noqa: N801, N815, ARG002 invalid-name unused-kwargs
+from marshmallow import pre_dump
+from marshmallow.fields import List, Nested, String
+from marshmallow.validate import Length, OneOf
+
+from cc_common.config import config
+from cc_common.data_model.schema.base_record import BaseRecordSchema
+from cc_common.data_model.schema.compact import COMPACT_TYPE, CompactCommissionFeeSchema
+
+
+@BaseRecordSchema.register_schema(COMPACT_TYPE)
+class CompactRecordSchema(BaseRecordSchema):
+    """Schema for the root compact configuration records"""
+
+    _record_type = COMPACT_TYPE
+
+    # Provided fields
+    compactName = String(required=True, allow_none=False, validate=OneOf(config.compacts))
+    compactCommissionFee = Nested(CompactCommissionFeeSchema(), required=True, allow_none=False)
+    compactOperationsTeamEmails = List(String(required=True, allow_none=False), required=True, allow_none=False)
+    compactAdverseActionsNotificationEmails = List(
+        String(required=True, allow_none=False),
+        required=True,
+        allow_none=False,
+    )
+    compactSummaryReportNotificationEmails = List(
+        String(required=True, allow_none=False),
+        required=True,
+        allow_none=False,
+    )
+
+    # Generated fields
+    pk = String(required=True, allow_none=False)
+    sk = String(required=True, allow_none=False, validate=Length(2, 100))
+
+    @pre_dump
+    def generate_pk_sk(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
+        # the pk and sk are the same for the root compact record
+        in_data['pk'] = f'{in_data['compactName']}#CONFIGURATION'
+        in_data['sk'] = f'{in_data['compactName']}#CONFIGURATION'
+        return in_data
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/fields.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/fields.py
new file mode 100644
index 000000000..9c1a23aa1
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/fields.py
@@ -0,0 +1,56 @@
+from marshmallow.fields import List, String
+from marshmallow.validate import OneOf, Regexp
+
+from cc_common.config import config
+from cc_common.data_model.schema.common import Status, UpdateCategory
+
+
+class SocialSecurityNumber(String):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, validate=Regexp('^[0-9]{3}-[0-9]{2}-[0-9]{4}$'), **kwargs)
+
+
+class Set(List):
+    """A Field that de/serializes to a Set (not compatible with JSON)"""
+
+    default_error_messages = {'invalid': 'Not a valid set.'}
+
+    def _serialize(self, *args, **kwargs):
+        return set(super()._serialize(*args, **kwargs))
+
+    def _deserialize(self, *args, **kwargs):
+        return set(super()._deserialize(*args, **kwargs))
+
+
+class NationalProviderIdentifier(String):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, validate=Regexp('^[0-9]{10}$'), **kwargs)
+
+
+class Compact(String):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, validate=OneOf(config.compacts), **kwargs)
+
+
+class Jurisdiction(String):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, validate=OneOf(config.jurisdictions), **kwargs)
+
+
+class ActiveInactive(String):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, validate=OneOf([entry.value for entry in Status]), **kwargs)
+
+
+class UpdateType(String):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, validate=OneOf([entry.value for entry in UpdateCategory]), **kwargs)
+
+
+class ITUTE164PhoneNumber(String):
+    """Phone number format consistent with ITU-T E.164:
+    https://www.itu.int/rec/T-REC-E.164-201011-I/en
+    """
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, validate=Regexp(r'^\+[0-9]{8,15}$'), **kwargs)
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction.py
deleted file mode 100644
index 56c5ffda4..000000000
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction.py
+++ /dev/null
@@ -1,156 +0,0 @@
-# ruff: noqa: N801, N815, ARG002 invalid-name unused-kwargs
-from collections import UserDict
-
-from marshmallow import Schema, pre_dump
-from marshmallow.fields import Boolean, Decimal, Email, List, Nested, String
-from marshmallow.validate import Length, OneOf
-
-from cc_common.config import config
-from cc_common.data_model.schema.base_record import BaseRecordSchema, ForgivingSchema
-from cc_common.data_model.schema.common import CCEnum
-
-JURISDICTION_TYPE = 'jurisdiction'
-
-
-class JurisdictionMilitaryDiscountType(CCEnum):
-    FLAT_RATE = 'FLAT_RATE'
-
-
-class JurisdictionMilitaryDiscountSchema(Schema):
-    active = Boolean(required=True, allow_none=False)
-    discountType = String(
-        required=True, allow_none=False, validate=OneOf([e.value for e in JurisdictionMilitaryDiscountType])
-    )
-    discountAmount = Decimal(required=True, allow_none=False)
-
-
-class JurisdictionJurisprudenceRequirementsSchema(Schema):
-    required = Boolean(required=True, allow_none=False)
-
-
-@BaseRecordSchema.register_schema(JURISDICTION_TYPE)
-class JurisdictionRecordSchema(BaseRecordSchema):
-    """Schema for the root jurisdiction configuration records"""
-
-    _record_type = JURISDICTION_TYPE
-
-    # Provided fields
-    jurisdictionName = String(required=True, allow_none=False)
-    postalAbbreviation = String(required=True, allow_none=False, validate=OneOf(config.jurisdictions))
-    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
-    jurisdictionFee = Decimal(required=True, allow_none=False)
-    militaryDiscount = Nested(JurisdictionMilitaryDiscountSchema(), required=False, allow_none=False)
-    jurisdictionOperationsTeamEmails = List(
-        Email(required=True, allow_none=False), required=True, allow_none=False, validate=Length(min=1)
-    )
-    jurisdictionAdverseActionsNotificationEmails = List(
-        String(required=True, allow_none=False),
-        required=True,
-        allow_none=False,
-    )
-    jurisdictionSummaryReportNotificationEmails = List(
-        String(required=True, allow_none=False),
-        required=True,
-        allow_none=False,
-    )
-    jurisprudenceRequirements = Nested(JurisdictionJurisprudenceRequirementsSchema(), required=True, allow_none=False)
-
-    # Generated fields
-    pk = String(required=True, allow_none=False)
-    sk = String(required=True, allow_none=False, validate=Length(2, 100))
-
-    @pre_dump
-    def generate_pk_sk(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
-        in_data['pk'] = f'{in_data['compact']}#CONFIGURATION'
-        in_data['sk'] = f'{in_data['compact']}#JURISDICTION#{in_data['postalAbbreviation'].lower()}'
-        return in_data
-
-
-class JurisdictionOptionsApiResponseSchema(ForgivingSchema):
-    """
-    Used to enforce which fields are returned in jurisdiction objects for the
-    GET /purchase/privileges/options endpoint
-    """
-
-    jurisdictionName = String(required=True, allow_none=False)
-    postalAbbreviation = String(required=True, allow_none=False, validate=OneOf(config.jurisdictions))
-    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
-    jurisdictionFee = Decimal(required=True, allow_none=False)
-    militaryDiscount = Nested(JurisdictionMilitaryDiscountSchema(), required=False, allow_none=False)
-    jurisprudenceRequirements = Nested(JurisdictionJurisprudenceRequirementsSchema(), required=True, allow_none=False)
-    type = String(required=True, allow_none=False, validate=OneOf([JURISDICTION_TYPE]))
-
-
-class JurisdictionMilitaryDiscount(UserDict):
-    """
-    Jurisdiction military discount data model. Used to access variables without needing to know
-    the underlying key structure.
-    """
-
-    @property
-    def active(self) -> bool:
-        return self['active']
-
-    @property
-    def discount_type(self) -> 'JurisdictionMilitaryDiscountType':
-        return JurisdictionMilitaryDiscountType.from_str(self['discountType'])
-
-    @property
-    def discount_amount(self) -> float:
-        return float(self['discountAmount'])
-
-
-class JurisdictionJurisprudenceRequirements(UserDict):
-    """
-    Jurisdiction jurisprudence requirements data model. Used to access variables without needing to know
-    the underlying key structure.
-    """
-
-    @property
-    def required(self) -> bool:
-        return self['required']
-
-
-class Jurisdiction(UserDict):
-    """
-    Jurisdiction configuration data model. Used to access variables without needing to know
-    the underlying key structure.
-    """
-
-    @property
-    def jurisdiction_name(self) -> str:
-        return self['jurisdictionName']
-
-    @property
-    def postal_abbreviation(self) -> str:
-        return self['postalAbbreviation']
-
-    @property
-    def compact(self) -> str:
-        return self['compact']
-
-    @property
-    def jurisdiction_fee(self) -> float:
-        return float(self['jurisdictionFee'])
-
-    @property
-    def military_discount(self) -> JurisdictionMilitaryDiscount | None:
-        if 'militaryDiscount' in self.data:
-            return JurisdictionMilitaryDiscount(self.data['militaryDiscount'])
-        return None
-
-    @property
-    def jurisprudence_requirements(self) -> JurisdictionJurisprudenceRequirements:
-        return JurisdictionJurisprudenceRequirements(self.data['jurisprudenceRequirements'])
-
-    @property
-    def jurisdiction_operations_team_emails(self) -> list[str] | None:
-        return self.get('jurisdictionOperationsTeamEmails')
-
-    @property
-    def jurisdiction_adverse_actions_notification_emails(self) -> list[str] | None:
-        return self.get('jurisdictionAdverseActionsNotificationEmails')
-
-    @property
-    def jurisdiction_summary_report_notification_emails(self) -> list[str] | None:
-        return self.get('jurisdictionSummaryReportNotificationEmails')
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction/__init__.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction/__init__.py
new file mode 100644
index 000000000..a2b106f1b
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction/__init__.py
@@ -0,0 +1,85 @@
+# ruff: noqa: N801, N815, ARG002 invalid-name unused-kwargs
+from collections import UserDict
+
+from cc_common.data_model.schema.common import CCEnum
+
+JURISDICTION_TYPE = 'jurisdiction'
+
+
+class JurisdictionMilitaryDiscountType(CCEnum):
+    FLAT_RATE = 'FLAT_RATE'
+
+
+class JurisdictionMilitaryDiscount(UserDict):
+    """
+    Jurisdiction military discount data model. Used to access variables without needing to know
+    the underlying key structure.
+    """
+
+    @property
+    def active(self) -> bool:
+        return self['active']
+
+    @property
+    def discount_type(self) -> 'JurisdictionMilitaryDiscountType':
+        return JurisdictionMilitaryDiscountType.from_str(self['discountType'])
+
+    @property
+    def discount_amount(self) -> float:
+        return float(self['discountAmount'])
+
+
+class JurisdictionJurisprudenceRequirements(UserDict):
+    """
+    Jurisdiction jurisprudence requirements data model. Used to access variables without needing to know
+    the underlying key structure.
+    """
+
+    @property
+    def required(self) -> bool:
+        return self['required']
+
+
+class Jurisdiction(UserDict):
+    """
+    Jurisdiction configuration data model. Used to access variables without needing to know
+    the underlying key structure.
+    """
+
+    @property
+    def jurisdiction_name(self) -> str:
+        return self['jurisdictionName']
+
+    @property
+    def postal_abbreviation(self) -> str:
+        return self['postalAbbreviation']
+
+    @property
+    def compact(self) -> str:
+        return self['compact']
+
+    @property
+    def jurisdiction_fee(self) -> float:
+        return float(self['jurisdictionFee'])
+
+    @property
+    def military_discount(self) -> JurisdictionMilitaryDiscount | None:
+        if 'militaryDiscount' in self.data:
+            return JurisdictionMilitaryDiscount(self.data['militaryDiscount'])
+        return None
+
+    @property
+    def jurisprudence_requirements(self) -> JurisdictionJurisprudenceRequirements:
+        return JurisdictionJurisprudenceRequirements(self.data['jurisprudenceRequirements'])
+
+    @property
+    def jurisdiction_operations_team_emails(self) -> list[str] | None:
+        return self.get('jurisdictionOperationsTeamEmails')
+
+    @property
+    def jurisdiction_adverse_actions_notification_emails(self) -> list[str] | None:
+        return self.get('jurisdictionAdverseActionsNotificationEmails')
+
+    @property
+    def jurisdiction_summary_report_notification_emails(self) -> list[str] | None:
+        return self.get('jurisdictionSummaryReportNotificationEmails')
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction/api.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction/api.py
new file mode 100644
index 000000000..eb583e6c4
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction/api.py
@@ -0,0 +1,37 @@
+# ruff: noqa: N801, N815, ARG002 invalid-name unused-kwargs
+from marshmallow import Schema
+from marshmallow.fields import Boolean, Decimal, Nested, String
+from marshmallow.validate import OneOf
+
+from cc_common.config import config
+from cc_common.data_model.schema.base_record import ForgivingSchema
+from cc_common.data_model.schema.jurisdiction import JURISDICTION_TYPE, JurisdictionMilitaryDiscountType
+
+
+class JurisdictionMilitaryDiscountResponseSchema(Schema):
+    active = Boolean(required=True, allow_none=False)
+    discountType = String(
+        required=True, allow_none=False, validate=OneOf([e.value for e in JurisdictionMilitaryDiscountType])
+    )
+    discountAmount = Decimal(required=True, allow_none=False)
+
+
+class JurisdictionJurisprudenceRequirementsResponseSchema(Schema):
+    required = Boolean(required=True, allow_none=False)
+
+
+class JurisdictionOptionsResponseSchema(ForgivingSchema):
+    """
+    Used to enforce which fields are returned in jurisdiction objects for the
+    GET /purchase/privileges/options endpoint
+    """
+
+    type = String(required=True, allow_none=False, validate=OneOf([JURISDICTION_TYPE]))
+    jurisdictionName = String(required=True, allow_none=False)
+    postalAbbreviation = String(required=True, allow_none=False, validate=OneOf(config.jurisdictions))
+    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
+    jurisdictionFee = Decimal(required=True, allow_none=False)
+    militaryDiscount = Nested(JurisdictionMilitaryDiscountResponseSchema(), required=False, allow_none=False)
+    jurisprudenceRequirements = Nested(
+        JurisdictionJurisprudenceRequirementsResponseSchema(), required=True, allow_none=False
+    )
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction/record.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction/record.py
new file mode 100644
index 000000000..b5a8e360b
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/jurisdiction/record.py
@@ -0,0 +1,60 @@
+# ruff: noqa: N801, N815, ARG002 invalid-name unused-kwargs
+from marshmallow import Schema, pre_dump
+from marshmallow.fields import Boolean, Decimal, Email, List, Nested, String
+from marshmallow.validate import Length, OneOf
+
+from cc_common.config import config
+from cc_common.data_model.schema.base_record import BaseRecordSchema
+from cc_common.data_model.schema.jurisdiction import JURISDICTION_TYPE, JurisdictionMilitaryDiscountType
+
+
+class JurisdictionMilitaryDiscountRecordSchema(Schema):
+    active = Boolean(required=True, allow_none=False)
+    discountType = String(
+        required=True, allow_none=False, validate=OneOf([e.value for e in JurisdictionMilitaryDiscountType])
+    )
+    discountAmount = Decimal(required=True, allow_none=False)
+
+
+class JurisdictionJurisprudenceRequirementsRecordSchema(Schema):
+    required = Boolean(required=True, allow_none=False)
+
+
+@BaseRecordSchema.register_schema(JURISDICTION_TYPE)
+class JurisdictionRecordSchema(BaseRecordSchema):
+    """Schema for the root jurisdiction configuration records"""
+
+    _record_type = JURISDICTION_TYPE
+
+    # Provided fields
+    jurisdictionName = String(required=True, allow_none=False)
+    postalAbbreviation = String(required=True, allow_none=False, validate=OneOf(config.jurisdictions))
+    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
+    jurisdictionFee = Decimal(required=True, allow_none=False)
+    militaryDiscount = Nested(JurisdictionMilitaryDiscountRecordSchema(), required=False, allow_none=False)
+    jurisdictionOperationsTeamEmails = List(
+        Email(required=True, allow_none=False), required=True, allow_none=False, validate=Length(min=1)
+    )
+    jurisdictionAdverseActionsNotificationEmails = List(
+        String(required=True, allow_none=False),
+        required=True,
+        allow_none=False,
+    )
+    jurisdictionSummaryReportNotificationEmails = List(
+        String(required=True, allow_none=False),
+        required=True,
+        allow_none=False,
+    )
+    jurisprudenceRequirements = Nested(
+        JurisdictionJurisprudenceRequirementsRecordSchema(), required=True, allow_none=False
+    )
+
+    # Generated fields
+    pk = String(required=True, allow_none=False)
+    sk = String(required=True, allow_none=False, validate=Length(2, 100))
+
+    @pre_dump
+    def generate_pk_sk(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
+        in_data['pk'] = f'{in_data['compact']}#CONFIGURATION'
+        in_data['sk'] = f'{in_data['compact']}#JURISDICTION#{in_data['postalAbbreviation'].lower()}'
+        return in_data
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license.py
deleted file mode 100644
index 56a0dd410..000000000
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license.py
+++ /dev/null
@@ -1,153 +0,0 @@
-# ruff: noqa: N801, N815, ARG002  invalid-name unused-argument
-
-from marshmallow import ValidationError, pre_dump, pre_load, validates_schema
-from marshmallow.fields import UUID, Boolean, Date, DateTime, Email, String
-from marshmallow.validate import Length, OneOf, Regexp
-
-from cc_common.config import config
-from cc_common.data_model.schema.base_record import (
-    BaseRecordSchema,
-    CalculatedStatusRecordSchema,
-    ForgivingSchema,
-    ITUTE164PhoneNumber,
-    SocialSecurityNumber,
-)
-
-
-class LicenseReadGeneralSchema(ForgivingSchema):
-    """
-    License fields available for staff users with the 'readGeneral' permission.
-
-    This schema is explicitly separated from the common schema to ensure we know what
-    fields are being returned for users with this permission.
-    """
-
-    providerId = UUID(required=True, allow_none=False)
-    type = String(required=True, allow_none=False)
-    dateOfUpdate = DateTime(required=True, allow_none=False)
-    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
-    jurisdiction = String(required=True, allow_none=False, validate=OneOf(config.jurisdictions))
-    licenseType = String(required=True, allow_none=False)
-    jurisdictionStatus = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
-    npi = String(required=False, allow_none=False, validate=Regexp('^[0-9]{10}$'))
-    givenName = String(required=True, allow_none=False, validate=Length(1, 100))
-    middleName = String(required=False, allow_none=False, validate=Length(1, 100))
-    familyName = String(required=True, allow_none=False, validate=Length(1, 100))
-    suffix = String(required=False, allow_none=False, validate=Length(1, 100))
-    # These date values are determined by the license records uploaded by a state
-    # they do not include a timestamp, so we use the Date field type
-    dateOfIssuance = Date(required=True, allow_none=False)
-    dateOfRenewal = Date(required=True, allow_none=False)
-    dateOfExpiration = Date(required=True, allow_none=False)
-    homeAddressStreet1 = String(required=True, allow_none=False, validate=Length(2, 100))
-    homeAddressStreet2 = String(required=False, allow_none=False, validate=Length(1, 100))
-    homeAddressCity = String(required=True, allow_none=False, validate=Length(2, 100))
-    homeAddressState = String(required=True, allow_none=False, validate=Length(2, 100))
-    homeAddressPostalCode = String(required=True, allow_none=False, validate=Length(5, 7))
-    emailAddress = Email(required=False, allow_none=False, validate=Length(1, 100))
-    phoneNumber = ITUTE164PhoneNumber(required=False, allow_none=False)
-    status = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
-
-    militaryWaiver = Boolean(required=False, allow_none=False)
-
-
-class LicenseCommonSchema(ForgivingSchema):
-    """
-    This schema is used for both the LicensePostSchema and LicenseIngestSchema. It contains the fields that are common
-    to both the external and internal representations of a license record.
-    """
-
-    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
-    jurisdiction = String(required=True, allow_none=False, validate=OneOf(config.jurisdictions))
-    licenseType = String(required=True, allow_none=False)
-    givenName = String(required=True, allow_none=False, validate=Length(1, 100))
-    middleName = String(required=False, allow_none=False, validate=Length(1, 100))
-    familyName = String(required=True, allow_none=False, validate=Length(1, 100))
-    suffix = String(required=False, allow_none=False, validate=Length(1, 100))
-    # These date values are determined by the license records uploaded by a state
-    # they do not include a timestamp, so we use the Date field type
-    dateOfIssuance = Date(required=True, allow_none=False)
-    dateOfRenewal = Date(required=True, allow_none=False)
-    dateOfExpiration = Date(required=True, allow_none=False)
-    dateOfBirth = Date(required=True, allow_none=False)
-    homeAddressStreet1 = String(required=True, allow_none=False, validate=Length(2, 100))
-    homeAddressStreet2 = String(required=False, allow_none=False, validate=Length(1, 100))
-    homeAddressCity = String(required=True, allow_none=False, validate=Length(2, 100))
-    homeAddressState = String(required=True, allow_none=False, validate=Length(2, 100))
-    homeAddressPostalCode = String(required=True, allow_none=False, validate=Length(5, 7))
-    militaryWaiver = Boolean(required=False, allow_none=False)
-    emailAddress = Email(required=False, allow_none=False, validate=Length(1, 100))
-    phoneNumber = ITUTE164PhoneNumber(required=False, allow_none=False)
-
-    @validates_schema
-    def validate_license_type(self, data, **kwargs):  # noqa: ARG001 unused-argument
-        license_types = config.license_types_for_compact(data['compact'])
-        if data['licenseType'] not in license_types:
-            raise ValidationError({'licenseType': [f'Must be one of: {', '.join(license_types)}.']})
-
-
-class LicensePostSchema(LicenseCommonSchema):
-    """Schema for license data as posted by a board"""
-
-    ssn = SocialSecurityNumber(required=True, allow_none=False)
-    npi = String(required=False, allow_none=False, validate=Regexp('^[0-9]{10}$'))
-    # This status field is required when posting a license record. It will be transformed into the
-    # jurisdictionStatus field when the record is ingested.
-    status = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
-
-
-class SanitizedLicenseIngestDataEventSchema(ForgivingSchema):
-    """Schema which removes all pii from the license ingest event for storing in the database"""
-
-    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
-    jurisdiction = String(required=True, allow_none=False, validate=OneOf(config.jurisdictions))
-    licenseType = String(required=True, allow_none=False)
-    status = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
-    dateOfIssuance = Date(required=True, allow_none=False)
-    dateOfRenewal = Date(required=True, allow_none=False)
-    dateOfExpiration = Date(required=True, allow_none=False)
-    eventTime = DateTime(required=True, allow_none=False)
-
-
-class LicenseIngestSchema(LicenseCommonSchema):
-    """Schema for converting the external license data to the internal format"""
-
-    ssn = SocialSecurityNumber(required=True, allow_none=False)
-    npi = String(required=False, allow_none=False, validate=Regexp('^[0-9]{10}$'))
-    # When a license record is first uploaded into the system, we store the value of
-    # 'status' under this field for backwards compatibility with the external contract.
-    # this is used to calculate the actual 'status' used by the system in addition
-    # to the expiration date of the license.
-    jurisdictionStatus = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
-
-    @pre_load
-    def pre_load_initialization(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
-        return self._set_jurisdiction_status(in_data)
-
-    def _set_jurisdiction_status(self, in_data, **kwargs):
-        """
-        When a license record is first uploaded into the system, the 'jurisdictionStatus' value is captured
-        from the 'status' field for backwards compatibility with the existing contract.
-        This maps the income 'status' value to the internal 'jurisdictionStatus' field.
-        """
-        in_data['jurisdictionStatus'] = in_data.pop('status')
-        return in_data
-
-
-@BaseRecordSchema.register_schema('license')
-class LicenseRecordSchema(CalculatedStatusRecordSchema, LicenseCommonSchema):
-    """Schema for license records in the license data table"""
-
-    _record_type = 'license'
-
-    ssn = SocialSecurityNumber(required=True, allow_none=False)
-    npi = String(required=False, allow_none=False, validate=Regexp('^[0-9]{10}$'))
-    # Provided fields
-    providerId = UUID(required=True, allow_none=False)
-    jurisdictionStatus = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
-
-    @pre_dump
-    def generate_pk_sk(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
-        in_data['pk'] = f'{in_data['compact']}#PROVIDER#{in_data['providerId']}'
-        in_data['sk'] = f'{in_data['compact']}#PROVIDER#license/{in_data['jurisdiction']}#{in_data['dateOfRenewal']}'
-        return in_data
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/__init__.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/__init__.py
new file mode 100644
index 000000000..f2f07dfea
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/__init__.py
@@ -0,0 +1,53 @@
+# ruff: noqa: N801, N815, ARG002  invalid-name unused-argument
+
+from marshmallow import ValidationError, validates_schema
+from marshmallow.fields import Boolean, Date, Email, String
+from marshmallow.validate import Length
+
+from cc_common.config import config
+from cc_common.data_model.schema.base_record import (
+    ForgivingSchema,
+)
+from cc_common.data_model.schema.fields import (
+    Compact,
+    ITUTE164PhoneNumber,
+    Jurisdiction,
+)
+
+
+class LicenseCommonSchema(ForgivingSchema):
+    """
+    This schema is used for both the LicensePostSchema and LicenseIngestSchema. It contains the fields that are common
+    to both the external and internal representations of a license record.
+
+    Serialization direction:
+    DB -> load() -> Python
+    """
+
+    compact = Compact(required=True, allow_none=False)
+    jurisdiction = Jurisdiction(required=True, allow_none=False)
+    licenseType = String(required=True, allow_none=False)
+    givenName = String(required=True, allow_none=False, validate=Length(1, 100))
+    middleName = String(required=False, allow_none=False, validate=Length(1, 100))
+    familyName = String(required=True, allow_none=False, validate=Length(1, 100))
+    suffix = String(required=False, allow_none=False, validate=Length(1, 100))
+    # These date values are determined by the license records uploaded by a state
+    # they do not include a timestamp, so we use the Date field type
+    dateOfIssuance = Date(required=True, allow_none=False)
+    dateOfRenewal = Date(required=True, allow_none=False)
+    dateOfExpiration = Date(required=True, allow_none=False)
+    dateOfBirth = Date(required=True, allow_none=False)
+    homeAddressStreet1 = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressStreet2 = String(required=False, allow_none=False, validate=Length(1, 100))
+    homeAddressCity = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressState = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressPostalCode = String(required=True, allow_none=False, validate=Length(5, 7))
+    militaryWaiver = Boolean(required=False, allow_none=False)
+    emailAddress = Email(required=False, allow_none=False, validate=Length(1, 100))
+    phoneNumber = ITUTE164PhoneNumber(required=False, allow_none=False)
+
+    @validates_schema
+    def validate_license_type(self, data, **kwargs):  # noqa: ARG001 unused-argument
+        license_types = config.license_types_for_compact(data['compact'])
+        if data['licenseType'] not in license_types:
+            raise ValidationError({'licenseType': [f'Must be one of: {', '.join(license_types)}.']})
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/api.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/api.py
new file mode 100644
index 000000000..f7a7cccfb
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/api.py
@@ -0,0 +1,147 @@
+# ruff: noqa: N801, N815, ARG002  invalid-name unused-argument
+"""
+Schema for API objects.
+"""
+
+from marshmallow import ValidationError, validates_schema
+from marshmallow.fields import Boolean, Date, Email, List, Nested, Raw, String
+from marshmallow.validate import Length
+
+from cc_common.config import config
+from cc_common.data_model.schema.base_record import ForgivingSchema
+from cc_common.data_model.schema.fields import (
+    ActiveInactive,
+    Compact,
+    ITUTE164PhoneNumber,
+    Jurisdiction,
+    NationalProviderIdentifier,
+    SocialSecurityNumber,
+    UpdateType,
+)
+
+
+class LicensePostRequestSchema(ForgivingSchema):
+    """
+    Schema for license data as posted by a board staff-user
+
+    Serialization direction:
+    API -> load() -> Python
+    """
+
+    ssn = SocialSecurityNumber(required=True, allow_none=False)
+    npi = NationalProviderIdentifier(required=False, allow_none=False)
+    # This status field is required when posting a license record. It will be transformed into the
+    # jurisdictionStatus field when the record is ingested.
+    status = ActiveInactive(required=True, allow_none=False)
+    compact = Compact(required=True, allow_none=False)
+    jurisdiction = Jurisdiction(required=True, allow_none=False)
+    licenseType = String(required=True, allow_none=False)
+    givenName = String(required=True, allow_none=False, validate=Length(1, 100))
+    middleName = String(required=False, allow_none=False, validate=Length(1, 100))
+    familyName = String(required=True, allow_none=False, validate=Length(1, 100))
+    suffix = String(required=False, allow_none=False, validate=Length(1, 100))
+    # These date values are determined by the license records uploaded by a state
+    # they do not include a timestamp, so we use the Date field type
+    dateOfIssuance = Date(required=True, allow_none=False)
+    dateOfRenewal = Date(required=True, allow_none=False)
+    dateOfExpiration = Date(required=True, allow_none=False)
+    dateOfBirth = Date(required=True, allow_none=False)
+    homeAddressStreet1 = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressStreet2 = String(required=False, allow_none=False, validate=Length(1, 100))
+    homeAddressCity = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressState = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressPostalCode = String(required=True, allow_none=False, validate=Length(5, 7))
+    militaryWaiver = Boolean(required=False, allow_none=False)
+    emailAddress = Email(required=False, allow_none=False, validate=Length(1, 100))
+    phoneNumber = ITUTE164PhoneNumber(required=False, allow_none=False)
+
+    @validates_schema
+    def validate_license_type(self, data, **kwargs):  # noqa: ARG001 unused-argument
+        license_types = config.license_types_for_compact(data['compact'])
+        if data['licenseType'] not in license_types:
+            raise ValidationError({'licenseType': [f'Must be one of: {', '.join(license_types)}.']})
+
+
+class LicenseUpdatePreviousGeneralResponseSchema(ForgivingSchema):
+    """
+    A snapshot of a previous state of a license object
+
+    Serialization direction:
+    Python -> load() -> API
+    """
+
+    npi = NationalProviderIdentifier(required=False, allow_none=False)
+    licenseType = String(required=True, allow_none=False)
+    givenName = String(required=True, allow_none=False, validate=Length(1, 100))
+    middleName = String(required=False, allow_none=False, validate=Length(1, 100))
+    familyName = String(required=True, allow_none=False, validate=Length(1, 100))
+    suffix = String(required=False, allow_none=False, validate=Length(1, 100))
+    dateOfUpdate = Raw(required=True, allow_none=False)
+    dateOfIssuance = Raw(required=True, allow_none=False)
+    dateOfRenewal = Raw(required=True, allow_none=False)
+    dateOfExpiration = Raw(required=True, allow_none=False)
+    homeAddressStreet1 = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressStreet2 = String(required=False, allow_none=False, validate=Length(1, 100))
+    homeAddressCity = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressState = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressPostalCode = String(required=True, allow_none=False, validate=Length(5, 7))
+    militaryWaiver = Boolean(required=False, allow_none=False)
+    emailAddress = Email(required=False, allow_none=False, validate=Length(1, 100))
+    phoneNumber = ITUTE164PhoneNumber(required=False, allow_none=False)
+    jurisdictionStatus = ActiveInactive(required=True, allow_none=False)
+
+
+class LicenseUpdateGeneralResponseSchema(ForgivingSchema):
+    """
+    Schema for license update history entries in the license object
+
+    Serialization direction:
+    Python -> load() -> API
+    """
+
+    type = String(required=True, allow_none=False)
+    updateType = UpdateType(required=True, allow_none=False)
+    providerId = Raw(required=True, allow_none=False)
+    compact = Compact(required=True, allow_none=False)
+    jurisdiction = Jurisdiction(required=True, allow_none=False)
+    dateOfUpdate = Raw(required=True, allow_none=False)
+    previous = Nested(LicenseUpdatePreviousGeneralResponseSchema(), required=True, allow_none=False)
+    # We'll allow any fields that can show up in the previous field to be here as well, but none are required
+    updatedValues = Nested(LicenseUpdatePreviousGeneralResponseSchema(partial=True), required=True, allow_none=False)
+    # List of field names that were present in the previous record but removed in the update
+    removedValues = List(String(), required=False, allow_none=False)
+
+
+class LicenseGeneralResponseSchema(ForgivingSchema):
+    """
+    License object fields, as seen by staff users with only the 'readGeneral' permission.
+
+    Serialization direction:
+    Python -> load() -> API
+    """
+
+    providerId = Raw(required=True, allow_none=False)
+    type = String(required=True, allow_none=False)
+    dateOfUpdate = Raw(required=True, allow_none=False)
+    compact = Compact(required=True, allow_none=False)
+    jurisdiction = Jurisdiction(required=True, allow_none=False)
+    licenseType = String(required=True, allow_none=False)
+    jurisdictionStatus = ActiveInactive(required=True, allow_none=False)
+    npi = NationalProviderIdentifier(required=False, allow_none=False)
+    givenName = String(required=True, allow_none=False, validate=Length(1, 100))
+    middleName = String(required=False, allow_none=False, validate=Length(1, 100))
+    familyName = String(required=True, allow_none=False, validate=Length(1, 100))
+    suffix = String(required=False, allow_none=False, validate=Length(1, 100))
+    dateOfIssuance = Raw(required=True, allow_none=False)
+    dateOfRenewal = Raw(required=True, allow_none=False)
+    dateOfExpiration = Raw(required=True, allow_none=False)
+    homeAddressStreet1 = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressStreet2 = String(required=False, allow_none=False, validate=Length(1, 100))
+    homeAddressCity = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressState = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressPostalCode = String(required=True, allow_none=False, validate=Length(5, 7))
+    emailAddress = Email(required=False, allow_none=False, validate=Length(1, 100))
+    phoneNumber = ITUTE164PhoneNumber(required=False, allow_none=False)
+    status = ActiveInactive(required=True, allow_none=False)
+    militaryWaiver = Boolean(required=False, allow_none=False)
+    history = List(Nested(LicenseUpdateGeneralResponseSchema, required=False, allow_none=False))
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/ingest.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/ingest.py
new file mode 100644
index 000000000..e7553173e
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/ingest.py
@@ -0,0 +1,61 @@
+# ruff: noqa: N801, N815, ARG002  invalid-name unused-argument
+from marshmallow import pre_load
+from marshmallow.fields import Date, DateTime, String
+
+from cc_common.data_model.schema.base_record import ForgivingSchema
+from cc_common.data_model.schema.fields import (
+    ActiveInactive,
+    Compact,
+    Jurisdiction,
+    NationalProviderIdentifier,
+    SocialSecurityNumber,
+)
+from cc_common.data_model.schema.license import LicenseCommonSchema
+
+
+class LicenseIngestSchema(LicenseCommonSchema):
+    """
+    Schema for converting the external license data to the internal format
+
+    Serialization direction:
+    SQS -> load() -> Python
+    """
+
+    ssn = SocialSecurityNumber(required=True, allow_none=False)
+    npi = NationalProviderIdentifier(required=False, allow_none=False)
+    # When a license record is first uploaded into the system, we store the value of
+    # 'status' under this field for backwards compatibility with the external contract.
+    # this is used to calculate the actual 'status' used by the system in addition
+    # to the expiration date of the license.
+    jurisdictionStatus = ActiveInactive(required=True, allow_none=False)
+
+    @pre_load
+    def pre_load_initialization(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
+        return self._set_jurisdiction_status(in_data)
+
+    def _set_jurisdiction_status(self, in_data, **kwargs):
+        """
+        When a license record is first uploaded into the system, the 'jurisdictionStatus' value is captured
+        from the 'status' field for backwards compatibility with the existing contract.
+        This maps the income 'status' value to the internal 'jurisdictionStatus' field.
+        """
+        in_data['jurisdictionStatus'] = in_data.pop('status')
+        return in_data
+
+
+class SanitizedLicenseIngestDataEventSchema(ForgivingSchema):
+    """
+    Schema which removes all pii from the license ingest event for storing in the database
+
+    Serialization direction:
+    SQS -> load() -> Python
+    """
+
+    compact = Compact(required=True, allow_none=False)
+    jurisdiction = Jurisdiction(required=True, allow_none=False)
+    licenseType = String(required=True, allow_none=False)
+    status = ActiveInactive(required=True, allow_none=False)
+    dateOfIssuance = Date(required=True, allow_none=False)
+    dateOfRenewal = Date(required=True, allow_none=False)
+    dateOfExpiration = Date(required=True, allow_none=False)
+    eventTime = DateTime(required=True, allow_none=False)
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/record.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/record.py
new file mode 100644
index 000000000..beaefe0cb
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/license/record.py
@@ -0,0 +1,129 @@
+# ruff: noqa: N801, N815, ARG002  invalid-name unused-argument
+from marshmallow import ValidationError, post_dump, pre_dump, validates_schema
+from marshmallow.fields import UUID, Boolean, Date, DateTime, Email, List, Nested, String
+from marshmallow.validate import Length
+
+from cc_common.config import config
+from cc_common.data_model.schema.base_record import (
+    BaseRecordSchema,
+    CalculatedStatusRecordSchema,
+    StrictSchema,
+)
+from cc_common.data_model.schema.common import ChangeHashMixin
+from cc_common.data_model.schema.fields import (
+    ActiveInactive,
+    Compact,
+    ITUTE164PhoneNumber,
+    Jurisdiction,
+    NationalProviderIdentifier,
+    SocialSecurityNumber,
+    UpdateType,
+)
+from cc_common.data_model.schema.license import LicenseCommonSchema
+
+
+@BaseRecordSchema.register_schema('license')
+class LicenseRecordSchema(CalculatedStatusRecordSchema, LicenseCommonSchema):
+    """
+    Schema for license records in the provider data table
+
+    Serialization direction:
+    DB -> load() -> Python
+    """
+
+    _record_type = 'license'
+
+    ssn = SocialSecurityNumber(required=True, allow_none=False)
+    npi = NationalProviderIdentifier(required=False, allow_none=False)
+    # Provided fields
+    providerId = UUID(required=True, allow_none=False)
+    jurisdictionStatus = ActiveInactive(required=True, allow_none=False)
+
+    @pre_dump
+    def generate_pk_sk(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
+        in_data['pk'] = f'{in_data['compact']}#PROVIDER#{in_data['providerId']}'
+        in_data['sk'] = f'{in_data['compact']}#PROVIDER#license/{in_data['jurisdiction']}#'
+        return in_data
+
+
+class LicenseUpdateRecordPreviousSchema(StrictSchema):
+    """
+    A snapshot of a previous state of a license record
+
+    Serialization direction:
+    DB -> load() -> Python
+    """
+
+    ssn = SocialSecurityNumber(required=True, allow_none=False)
+    npi = NationalProviderIdentifier(required=False, allow_none=False)
+    licenseType = String(required=True, allow_none=False)
+    givenName = String(required=True, allow_none=False, validate=Length(1, 100))
+    middleName = String(required=False, allow_none=False, validate=Length(1, 100))
+    familyName = String(required=True, allow_none=False, validate=Length(1, 100))
+    suffix = String(required=False, allow_none=False, validate=Length(1, 100))
+    dateOfUpdate = DateTime(required=True, allow_none=False)
+    # These date values are determined by the license records uploaded by a state
+    # they do not include a timestamp, so we use the Date field type
+    dateOfIssuance = Date(required=True, allow_none=False)
+    dateOfRenewal = Date(required=True, allow_none=False)
+    dateOfExpiration = Date(required=True, allow_none=False)
+    dateOfBirth = Date(required=True, allow_none=False)
+    homeAddressStreet1 = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressStreet2 = String(required=False, allow_none=False, validate=Length(1, 100))
+    homeAddressCity = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressState = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressPostalCode = String(required=True, allow_none=False, validate=Length(5, 7))
+    militaryWaiver = Boolean(required=False, allow_none=False)
+    emailAddress = Email(required=False, allow_none=False, validate=Length(1, 100))
+    phoneNumber = ITUTE164PhoneNumber(required=False, allow_none=False)
+    jurisdictionStatus = ActiveInactive(required=True, allow_none=False)
+
+
+@BaseRecordSchema.register_schema('licenseUpdate')
+class LicenseUpdateRecordSchema(BaseRecordSchema, ChangeHashMixin):
+    """
+    Schema for license update history records in the provider data table
+
+    Serialization direction:
+    DB -> load() -> Python
+    """
+
+    _record_type = 'licenseUpdate'
+
+    updateType = UpdateType(required=True, allow_none=False)
+    providerId = UUID(required=True, allow_none=False)
+    compact = Compact(required=True, allow_none=False)
+    jurisdiction = Jurisdiction(required=True, allow_none=False)
+    previous = Nested(LicenseUpdateRecordPreviousSchema, required=True, allow_none=False)
+    # We'll allow any fields that can show up in the previous field to be here as well, but none are required
+    updatedValues = Nested(LicenseUpdateRecordPreviousSchema(partial=True), required=True, allow_none=False)
+    # List of field names that were present in the previous record but removed in the update
+    removedValues = List(String(), required=False, allow_none=False)
+
+    @post_dump  # Must be _post_ dump so we have values that are more easily hashed
+    def generate_pk_sk(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
+        """
+        NOTE: Because the 'sk' field in this record type contains a hash that is generated based on the values of the
+        record itself and because, in some cases, the values could be guessed and verified by the hash with relative
+        ease, regardless of the strength of the hash, we need to treat the 'sk' field as if it were just as sensitive as
+        the most sensitive field in the record. More to the point, we need to be sure that this internal field is never
+        served out via API.
+        """
+        in_data['pk'] = f'{in_data['compact']}#PROVIDER#{in_data['providerId']}'
+        # This needs to include a POSIX timestamp (seconds) and a hash of the changes
+        # to the record. We'll use the current time and the hash of the updatedValues
+        # field for this.
+        change_hash = self.hash_changes(in_data)
+        in_data['sk'] = (
+            f'{in_data['compact']}#PROVIDER#license/{in_data['jurisdiction']}#UPDATE#{int(config.current_standard_datetime.timestamp())}/{change_hash}'
+        )
+        return in_data
+
+    @validates_schema
+    def validate_license_type(self, data, **kwargs):  # noqa: ARG001 unused-argument
+        license_types = config.license_types_for_compact(data['compact'])
+        if data['previous']['licenseType'] not in license_types:
+            raise ValidationError({'previous.licenseType': [f'Must be one of: {', '.join(license_types)}.']})
+        # We have to check for existence here to allow for the updatedValues partial case
+        if data['updatedValues'].get('licenseType') and data['updatedValues']['licenseType'] not in license_types:
+            raise ValidationError({'updatedValues.licenseType': [f'Must be one of: {', '.join(license_types)}.']})
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation.py
deleted file mode 100644
index 10b41b767..000000000
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation.py
+++ /dev/null
@@ -1,87 +0,0 @@
-# ruff: noqa: N801, N815, ARG002  invalid-name unused-argument
-
-from marshmallow import pre_dump
-from marshmallow.fields import UUID, DateTime, List, Nested, String
-from marshmallow.validate import Length, OneOf
-
-from cc_common.config import config
-from cc_common.data_model.schema.base_record import BaseRecordSchema, ForgivingSchema
-from cc_common.data_model.schema.common import CCEnum, S3PresignedPostSchema
-
-
-class MilitaryAffiliationStatus(CCEnum):
-    INITIALIZING = 'initializing'
-    ACTIVE = 'active'
-    INACTIVE = 'inactive'
-
-
-class MilitaryAffiliationType(CCEnum):
-    MILITARY_MEMBER = 'militaryMember'
-    MILITARY_MEMBER_SPOUSE = 'militaryMemberSpouse'
-
-
-SUPPORTED_MILITARY_AFFILIATION_FILE_EXTENSIONS = ('pdf', 'jpg', 'jpeg', 'png', 'docx')
-MILITARY_AFFILIATIONS_DOCUMENT_TYPE_KEY_NAME = 'military-affiliations'
-
-MILITARY_AFFILIATION_RECORD_TYPE = 'militaryAffiliation'
-
-
-@BaseRecordSchema.register_schema(MILITARY_AFFILIATION_RECORD_TYPE)
-class MilitaryAffiliationRecordSchema(BaseRecordSchema):
-    """Schema for military affiliation records in the license data table"""
-
-    _record_type = MILITARY_AFFILIATION_RECORD_TYPE
-
-    # Provided fields
-    providerId = UUID(required=True, allow_none=False)
-    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
-    documentKeys = List(String(required=True, allow_none=False), required=True, allow_none=False)
-    fileNames = List(String(required=True, allow_none=False), required=True, allow_none=False)
-    affiliationType = String(
-        required=True, allow_none=False, validate=OneOf([e.value for e in MilitaryAffiliationType])
-    )
-    dateOfUpload = DateTime(required=True, allow_none=False)
-    status = String(required=True, allow_none=False, validate=OneOf([e.value for e in MilitaryAffiliationStatus]))
-
-    # Generated fields
-    pk = String(required=True, allow_none=False)
-    sk = String(required=True, allow_none=False, validate=Length(2, 100))
-
-    @pre_dump
-    def generate_pk_sk(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
-        in_data['pk'] = f'{in_data['compact']}#PROVIDER#{in_data['providerId']}'
-        upload_date = in_data['dateOfUpload'].date().isoformat()
-        in_data['sk'] = f'{in_data['compact']}#PROVIDER#military-affiliation#{upload_date}'
-        return in_data
-
-
-class PostMilitaryAffiliationResponseSchema(ForgivingSchema):
-    """Schema for POST requests to create a new military affiliation record"""
-
-    fileNames = List(String(required=True, allow_none=False), required=True, allow_none=False)
-    dateOfUpload = DateTime(required=True, allow_none=False)
-    dateOfUpdate = DateTime(required=True, allow_none=False)
-    status = String(required=True, allow_none=False, validate=OneOf([e.value for e in MilitaryAffiliationStatus]))
-    affiliationType = String(
-        required=True, allow_none=False, validate=OneOf([e.value for e in MilitaryAffiliationType])
-    )
-    documentUploadFields = List(
-        Nested(S3PresignedPostSchema(), required=True, allow_none=False), required=True, allow_none=False
-    )
-
-
-class MilitaryAffiliationGeneralResponseSchema(ForgivingSchema):
-    """
-    Schema defining fields available to all staff users with the 'readGeneral' permission.
-    """
-
-    type = String(required=True, allow_none=False)
-    dateOfUpdate = DateTime(required=True, allow_none=False)
-    providerId = UUID(required=True, allow_none=False)
-    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
-    fileNames = List(String(required=True, allow_none=False), required=True, allow_none=False)
-    affiliationType = String(
-        required=True, allow_none=False, validate=OneOf([e.value for e in MilitaryAffiliationType])
-    )
-    dateOfUpload = DateTime(required=True, allow_none=False)
-    status = String(required=True, allow_none=False, validate=OneOf([e.value for e in MilitaryAffiliationStatus]))
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation/__init__.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation/__init__.py
new file mode 100644
index 000000000..06f90a041
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation/__init__.py
@@ -0,0 +1,20 @@
+# ruff: noqa: N801, N815, ARG002  invalid-name unused-argument
+
+from cc_common.data_model.schema.common import CCEnum
+
+
+class MilitaryAffiliationStatus(CCEnum):
+    INITIALIZING = 'initializing'
+    ACTIVE = 'active'
+    INACTIVE = 'inactive'
+
+
+class MilitaryAffiliationType(CCEnum):
+    MILITARY_MEMBER = 'militaryMember'
+    MILITARY_MEMBER_SPOUSE = 'militaryMemberSpouse'
+
+
+SUPPORTED_MILITARY_AFFILIATION_FILE_EXTENSIONS = ('pdf', 'jpg', 'jpeg', 'png', 'docx')
+MILITARY_AFFILIATIONS_DOCUMENT_TYPE_KEY_NAME = 'military-affiliations'
+
+MILITARY_AFFILIATION_RECORD_TYPE = 'militaryAffiliation'
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation/api.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation/api.py
new file mode 100644
index 000000000..1d1bf43e7
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation/api.py
@@ -0,0 +1,43 @@
+# ruff: noqa: N801, N815, ARG002  invalid-name unused-argument
+from marshmallow.fields import List, Nested, Raw, String
+from marshmallow.validate import OneOf
+
+from cc_common.config import config
+from cc_common.data_model.schema.base_record import ForgivingSchema
+from cc_common.data_model.schema.common import S3PresignedPostSchema
+from cc_common.data_model.schema.military_affiliation import MilitaryAffiliationStatus, MilitaryAffiliationType
+
+
+class MilitaryAffiliationGeneralResponseSchema(ForgivingSchema):
+    """
+    Schema defining fields available to all staff users with only the 'readGeneral' permission.
+
+    Serialization direction:
+    Python -> load() -> API
+    """
+
+    type = String(required=True, allow_none=False)
+    dateOfUpdate = Raw(required=True, allow_none=False)
+    providerId = Raw(required=True, allow_none=False)
+    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
+    fileNames = List(String(required=True, allow_none=False), required=True, allow_none=False)
+    affiliationType = String(
+        required=True, allow_none=False, validate=OneOf([e.value for e in MilitaryAffiliationType])
+    )
+    dateOfUpload = Raw(required=True, allow_none=False)
+    status = String(required=True, allow_none=False, validate=OneOf([e.value for e in MilitaryAffiliationStatus]))
+
+
+class PostMilitaryAffiliationResponseSchema(ForgivingSchema):
+    """Schema for POST requests to create a new military affiliation record"""
+
+    fileNames = List(String(required=True, allow_none=False), required=True, allow_none=False)
+    dateOfUpload = Raw(required=True, allow_none=False)
+    dateOfUpdate = Raw(required=True, allow_none=False)
+    status = String(required=True, allow_none=False, validate=OneOf([e.value for e in MilitaryAffiliationStatus]))
+    affiliationType = String(
+        required=True, allow_none=False, validate=OneOf([e.value for e in MilitaryAffiliationType])
+    )
+    documentUploadFields = List(
+        Nested(S3PresignedPostSchema(), required=True, allow_none=False), required=True, allow_none=False
+    )
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation/record.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation/record.py
new file mode 100644
index 000000000..6276b287d
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/military_affiliation/record.py
@@ -0,0 +1,41 @@
+# ruff: noqa: N801, N815, ARG002  invalid-name unused-argument
+from marshmallow import pre_dump
+from marshmallow.fields import UUID, DateTime, List, String
+from marshmallow.validate import Length, OneOf
+
+from cc_common.config import config
+from cc_common.data_model.schema.base_record import BaseRecordSchema
+from cc_common.data_model.schema.military_affiliation import (
+    MILITARY_AFFILIATION_RECORD_TYPE,
+    MilitaryAffiliationStatus,
+    MilitaryAffiliationType,
+)
+
+
+@BaseRecordSchema.register_schema(MILITARY_AFFILIATION_RECORD_TYPE)
+class MilitaryAffiliationRecordSchema(BaseRecordSchema):
+    """Schema for military affiliation records in the license data table"""
+
+    _record_type = MILITARY_AFFILIATION_RECORD_TYPE
+
+    # Provided fields
+    providerId = UUID(required=True, allow_none=False)
+    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
+    documentKeys = List(String(required=True, allow_none=False), required=True, allow_none=False)
+    fileNames = List(String(required=True, allow_none=False), required=True, allow_none=False)
+    affiliationType = String(
+        required=True, allow_none=False, validate=OneOf([e.value for e in MilitaryAffiliationType])
+    )
+    dateOfUpload = DateTime(required=True, allow_none=False)
+    status = String(required=True, allow_none=False, validate=OneOf([e.value for e in MilitaryAffiliationStatus]))
+
+    # Generated fields
+    pk = String(required=True, allow_none=False)
+    sk = String(required=True, allow_none=False, validate=Length(2, 100))
+
+    @pre_dump
+    def generate_pk_sk(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
+        in_data['pk'] = f'{in_data['compact']}#PROVIDER#{in_data['providerId']}'
+        upload_date = in_data['dateOfUpload'].date().isoformat()
+        in_data['sk'] = f'{in_data['compact']}#PROVIDER#military-affiliation#{upload_date}'
+        return in_data
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege.py
deleted file mode 100644
index fe53c7a23..000000000
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege.py
+++ /dev/null
@@ -1,71 +0,0 @@
-# ruff: noqa: N801, N815, ARG002  invalid-name unused-argument
-
-from marshmallow import pre_dump, pre_load
-from marshmallow.fields import UUID, Date, DateTime, List, Nested, String
-from marshmallow.validate import Length, OneOf
-
-from cc_common.config import config
-from cc_common.data_model.schema.base_record import BaseRecordSchema, CalculatedStatusRecordSchema, ForgivingSchema
-from cc_common.data_model.schema.common import AttestationVersionSchema, ensure_value_is_datetime
-
-
-@BaseRecordSchema.register_schema('privilege')
-class PrivilegeRecordSchema(CalculatedStatusRecordSchema):
-    """Schema for privilege records in the license data table"""
-
-    _record_type = 'privilege'
-
-    # Provided fields
-    providerId = UUID(required=True, allow_none=False)
-    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
-    jurisdiction = String(required=True, allow_none=False, validate=OneOf(config.jurisdictions))
-    dateOfIssuance = DateTime(required=True, allow_none=False)
-    dateOfRenewal = DateTime(required=True, allow_none=False)
-    # this is determined by the license expiration date, which is a date field, so this is also a date field
-    dateOfExpiration = Date(required=True, allow_none=False)
-    # the id of the transaction that was made when the user purchased the privilege
-    compactTransactionId = String(required=False, allow_none=False)
-    # list of attestations that were accepted when purchasing this privilege
-    attestations = List(Nested(AttestationVersionSchema()), required=False, allow_none=False)
-
-    # Generated fields
-    pk = String(required=True, allow_none=False)
-    sk = String(required=True, allow_none=False, validate=Length(2, 100))
-
-    @pre_dump
-    def generate_pk_sk(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
-        in_data['pk'] = f'{in_data['compact']}#PROVIDER#{in_data['providerId']}'
-        in_data['sk'] = (
-            f'{in_data['compact']}#PROVIDER#privilege/{in_data['jurisdiction']}#{in_data['dateOfRenewal'].date().isoformat()}'  # noqa: E501
-        )
-        return in_data
-
-    @pre_load
-    def pre_load_initialization(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
-        return self._enforce_datetimes(in_data)
-
-    def _enforce_datetimes(self, in_data, **kwargs):
-        # for backwards compatibility with the old data model
-        # we convert any records that are using a Date value
-        # for dateOfRenewal and dateOfIssuance to DateTime values
-        in_data['dateOfRenewal'] = ensure_value_is_datetime(in_data.get('dateOfRenewal', in_data['dateOfIssuance']))
-        in_data['dateOfIssuance'] = ensure_value_is_datetime(in_data['dateOfIssuance'])
-
-        return in_data
-
-
-class PrivilegeGeneralResponseSchema(ForgivingSchema):
-    type = String(required=True, allow_none=False)
-    dateOfUpdate = DateTime(required=True, allow_none=False)
-    providerId = UUID(required=True, allow_none=False)
-    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
-    jurisdiction = String(required=True, allow_none=False, validate=OneOf(config.jurisdictions))
-    dateOfIssuance = DateTime(required=True, allow_none=False)
-    dateOfRenewal = DateTime(required=True, allow_none=False)
-    # this is determined by the license expiration date, which is a date field, so this is also a date field
-    dateOfExpiration = Date(required=True, allow_none=False)
-    # the id of the transaction that was made when the user purchased the privilege
-    compactTransactionId = String(required=False, allow_none=False)
-    status = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
-    # list of attestations that were accepted when purchasing this privilege
-    attestations = List(Nested(AttestationVersionSchema()), required=False, allow_none=False)
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege/__init__.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege/api.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege/api.py
new file mode 100644
index 000000000..635b8f273
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege/api.py
@@ -0,0 +1,79 @@
+# ruff: noqa: N801, N815, ARG002  invalid-name unused-argument
+from marshmallow import Schema
+from marshmallow.fields import List, Nested, Raw, String
+
+from cc_common.data_model.schema.base_record import ForgivingSchema
+from cc_common.data_model.schema.fields import ActiveInactive, Compact, Jurisdiction, UpdateType
+
+
+class PrivilegeUpdatePreviousGeneralResponseSchema(ForgivingSchema):
+    """
+    A snapshot of a previous state of a privilege object
+
+    Serialization direction:
+    Python -> load() -> API
+    """
+
+    dateOfUpdate = Raw(required=True, allow_none=False)
+    dateOfIssuance = Raw(required=True, allow_none=False)
+    dateOfRenewal = Raw(required=True, allow_none=False)
+    dateOfExpiration = Raw(required=True, allow_none=False)
+    compactTransactionId = String(required=False, allow_none=False)
+
+
+class PrivilegeUpdateGeneralResponseSchema(ForgivingSchema):
+    """
+    Schema for privilege update history entries in the privilege object
+
+    Serialization direction:
+    Python -> load() -> API
+    """
+
+    type = String(required=True, allow_none=False)
+    updateType = UpdateType(required=True, allow_none=False)
+    providerId = Raw(required=True, allow_none=False)
+    compact = Compact(required=True, allow_none=False)
+    jurisdiction = Jurisdiction(required=True, allow_none=False)
+    dateOfUpdate = Raw(required=True, allow_none=False)
+    previous = Nested(PrivilegeUpdatePreviousGeneralResponseSchema(), required=True, allow_none=False)
+    # We'll allow any fields that can show up in the previous field to be here as well, but none are required
+    updatedValues = Nested(PrivilegeUpdatePreviousGeneralResponseSchema(partial=True), required=True, allow_none=False)
+
+
+class AttestationVersionResponseSchema(Schema):
+    """
+    This schema is intended to be used by any api response in the system which needs to track which attestations have
+    been accepted by a user (i.e. when purchasing privileges).
+
+    This schema is intended to be used as a nested field in other schemas.
+
+    Serialization direction:
+    Python -> load() -> API
+    """
+
+    attestationId = String(required=True, allow_none=False)
+    version = String(required=True, allow_none=False)
+
+
+class PrivilegeGeneralResponseSchema(ForgivingSchema):
+    """
+    A snapshot of a previous state of a privilege object
+
+    Serialization direction:
+    Python -> load() -> API
+    """
+
+    type = String(required=True, allow_none=False)
+    dateOfUpdate = Raw(required=True, allow_none=False)
+    providerId = Raw(required=True, allow_none=False)
+    compact = Compact(required=True, allow_none=False)
+    jurisdiction = Jurisdiction(required=True, allow_none=False)
+    dateOfIssuance = Raw(required=True, allow_none=False)
+    dateOfRenewal = Raw(required=True, allow_none=False)
+    dateOfExpiration = Raw(required=True, allow_none=False)
+    # the id of the transaction that was made when the user purchased the privilege
+    compactTransactionId = String(required=False, allow_none=False)
+    status = ActiveInactive(required=True, allow_none=False)
+    history = List(Nested(PrivilegeUpdateGeneralResponseSchema, required=False, allow_none=False))
+    # list of attestations that were accepted when purchasing this privilege
+    attestations = List(Nested(AttestationVersionResponseSchema()), required=False, allow_none=False)
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege/record.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege/record.py
new file mode 100644
index 000000000..0165b7a29
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/privilege/record.py
@@ -0,0 +1,115 @@
+# ruff: noqa: N801, N815, ARG002  invalid-name unused-argument
+from marshmallow import Schema, post_dump, pre_dump, pre_load
+from marshmallow.fields import UUID, Date, DateTime, List, Nested, String
+
+from cc_common.config import config
+from cc_common.data_model.schema.base_record import BaseRecordSchema, CalculatedStatusRecordSchema, ForgivingSchema
+from cc_common.data_model.schema.common import ChangeHashMixin, ensure_value_is_datetime
+from cc_common.data_model.schema.fields import Compact, Jurisdiction, UpdateType
+
+
+class AttestationVersionRecordSchema(Schema):
+    """
+    This schema is intended to be used by any record in the system which needs to track which attestations have been
+    accepted by a user (i.e. when purchasing privileges).
+
+    This schema is intended to be used as a nested field in other schemas.
+
+    Serialization direction:
+    DB -> load() -> Python
+    """
+
+    attestationId = String(required=True, allow_none=False)
+    version = String(required=True, allow_none=False)
+
+
+@BaseRecordSchema.register_schema('privilege')
+class PrivilegeRecordSchema(CalculatedStatusRecordSchema):
+    """
+    Schema for privilege records in the license data table
+
+    Serialization direction:
+    DB -> load() -> Python
+    """
+
+    _record_type = 'privilege'
+
+    # Provided fields
+    providerId = UUID(required=True, allow_none=False)
+    compact = Compact(required=True, allow_none=False)
+    jurisdiction = Jurisdiction(required=True, allow_none=False)
+    dateOfIssuance = DateTime(required=True, allow_none=False)
+    dateOfRenewal = DateTime(required=True, allow_none=False)
+    # this is determined by the license expiration date, which is a date field, so this is also a date field
+    dateOfExpiration = Date(required=True, allow_none=False)
+    # the id of the transaction that was made when the user purchased the privilege
+    compactTransactionId = String(required=False, allow_none=False)
+    # list of attestations that were accepted when purchasing this privilege
+    attestations = List(Nested(AttestationVersionRecordSchema()), required=False, allow_none=False)
+
+    @pre_dump
+    def generate_pk_sk(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
+        in_data['pk'] = f'{in_data['compact']}#PROVIDER#{in_data['providerId']}'
+        in_data['sk'] = f'{in_data['compact']}#PROVIDER#privilege/{in_data['jurisdiction']}#'
+        return in_data
+
+    @pre_load
+    def pre_load_initialization(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
+        return self._enforce_datetimes(in_data)
+
+    def _enforce_datetimes(self, in_data, **kwargs):
+        # for backwards compatibility with the old data model
+        # we convert any records that are using a Date value
+        # for dateOfRenewal and dateOfIssuance to DateTime values
+        in_data['dateOfRenewal'] = ensure_value_is_datetime(in_data.get('dateOfRenewal', in_data['dateOfIssuance']))
+        in_data['dateOfIssuance'] = ensure_value_is_datetime(in_data['dateOfIssuance'])
+
+        return in_data
+
+
+class PrivilegeUpdatePreviousRecordSchema(ForgivingSchema):
+    """
+    A snapshot of a previous state of a privilege record
+
+    Serialization direction:
+    DB -> load() -> Python
+    """
+
+    dateOfIssuance = DateTime(required=True, allow_none=False)
+    dateOfRenewal = DateTime(required=True, allow_none=False)
+    dateOfExpiration = Date(required=True, allow_none=False)
+    dateOfUpdate = DateTime(required=True, allow_none=False)
+    compactTransactionId = String(required=False, allow_none=False)
+    attestations = List(Nested(AttestationVersionRecordSchema()), required=False, allow_none=False)
+
+
+@BaseRecordSchema.register_schema('privilegeUpdate')
+class PrivilegeUpdateRecordSchema(BaseRecordSchema, ChangeHashMixin):
+    """
+    Schema for privilege update history records in the provider data table
+
+    Serialization direction:
+    DB -> load() -> Python
+    """
+
+    _record_type = 'privilegeUpdate'
+
+    updateType = UpdateType(required=True, allow_none=False)
+    providerId = UUID(required=True, allow_none=False)
+    compact = Compact(required=True, allow_none=False)
+    jurisdiction = Jurisdiction(required=True, allow_none=False)
+    previous = Nested(PrivilegeUpdatePreviousRecordSchema, required=True, allow_none=False)
+    # We'll allow any fields that can show up in the previous field to be here as well, but none are required
+    updatedValues = Nested(PrivilegeUpdatePreviousRecordSchema(partial=True), required=True, allow_none=False)
+
+    @post_dump  # Must be _post_ dump so we have values that are more easily hashed
+    def generate_pk_sk(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
+        in_data['pk'] = f'{in_data['compact']}#PROVIDER#{in_data['providerId']}'
+        # This needs to include a POSIX timestamp (seconds) and a hash of the changes
+        # to the record. We'll use the current time and the hash of the updatedValues
+        # field for this.
+        change_hash = self.hash_changes(in_data)
+        in_data['sk'] = (
+            f'{in_data['compact']}#PROVIDER#privilege/{in_data['jurisdiction']}#UPDATE#{int(config.current_standard_datetime.timestamp())}/{change_hash}'
+        )
+        return in_data
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider/__init__.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider/api.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider/api.py
new file mode 100644
index 000000000..8cee2ccb5
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider/api.py
@@ -0,0 +1,68 @@
+# ruff: noqa: N801, N815, ARG002  invalid-name unused-argument
+from marshmallow.fields import Boolean, Email, List, Nested, Raw, String
+from marshmallow.validate import Length, Regexp
+
+from cc_common.data_model.schema.base_record import ForgivingSchema
+from cc_common.data_model.schema.fields import (
+    ActiveInactive,
+    Compact,
+    ITUTE164PhoneNumber,
+    Jurisdiction,
+    NationalProviderIdentifier,
+    Set,
+)
+from cc_common.data_model.schema.license.api import LicenseGeneralResponseSchema
+from cc_common.data_model.schema.military_affiliation.api import MilitaryAffiliationGeneralResponseSchema
+from cc_common.data_model.schema.privilege.api import PrivilegeGeneralResponseSchema
+
+
+class ProviderGeneralResponseSchema(ForgivingSchema):
+    """
+    Provider object fields that are sanitized for users with the 'readGeneral' permission.
+
+    This schema is intended to be used to filter from the database in order to remove all fields not defined here.
+    It should NEVER be used to load data into the database. Use the ProviderRecordSchema for that.
+
+    This schema should be used by any endpoint that returns provider information to staff users (ie the query provider
+    and GET provider endpoints).
+
+    Serialization direction:
+    Python -> load() -> API
+    """
+
+    providerId = Raw(required=True, allow_none=False)
+    type = String(required=True, allow_none=False)
+
+    dateOfUpdate = Raw(required=True, allow_none=False)
+    compact = Compact(required=True, allow_none=False)
+    licenseJurisdiction = Jurisdiction(required=True, allow_none=False)
+    npi = NationalProviderIdentifier(required=False, allow_none=False)
+    licenseType = String(required=True, allow_none=False)
+    jurisdictionStatus = ActiveInactive(required=True, allow_none=False)
+    givenName = String(required=True, allow_none=False, validate=Length(1, 100))
+    middleName = String(required=False, allow_none=False, validate=Length(1, 100))
+    familyName = String(required=True, allow_none=False, validate=Length(1, 100))
+    suffix = String(required=False, allow_none=False, validate=Length(1, 100))
+    # This date is determined by the license records uploaded by a state
+    # they do not include a timestamp, so we use the Date field type
+    dateOfExpiration = Raw(required=True, allow_none=False)
+    homeAddressStreet1 = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressStreet2 = String(required=False, allow_none=False, validate=Length(1, 100))
+    homeAddressCity = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressState = String(required=True, allow_none=False, validate=Length(2, 100))
+    homeAddressPostalCode = String(required=True, allow_none=False, validate=Length(5, 7))
+    emailAddress = Email(required=False, allow_none=False, validate=Length(1, 100))
+    phoneNumber = ITUTE164PhoneNumber(required=False, allow_none=False)
+    status = ActiveInactive(required=True, allow_none=False)
+    militaryWaiver = Boolean(required=False, allow_none=False)
+
+    privilegeJurisdictions = Set(String, required=False, allow_none=False, load_default=set())
+    providerFamGivMid = String(required=False, allow_none=False, validate=Length(2, 400))
+    providerDateOfUpdate = Raw(required=False, allow_none=False)
+    birthMonthDay = String(required=False, allow_none=False, validate=Regexp('^[0-1]{1}[0-9]{1}-[0-3]{1}[0-9]{1}'))
+
+    # these records are present when getting provider information from the GET endpoint
+    # so we check for them here and sanitize them if they are present
+    licenses = List(Nested(LicenseGeneralResponseSchema(), required=False, allow_none=False))
+    privileges = List(Nested(PrivilegeGeneralResponseSchema(), required=False, allow_none=False))
+    militaryAffiliations = List(Nested(MilitaryAffiliationGeneralResponseSchema(), required=False, allow_none=False))
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider/record.py
similarity index 52%
rename from backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider.py
rename to backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider/record.py
index e5a6ee567..d6b9df137 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/provider/record.py
@@ -2,22 +2,21 @@
 from urllib.parse import quote
 
 from marshmallow import ValidationError, post_load, pre_dump, pre_load, validates_schema
-from marshmallow.fields import UUID, Boolean, Date, DateTime, Email, List, Nested, String
-from marshmallow.validate import Length, OneOf, Regexp
+from marshmallow.fields import UUID, Boolean, Date, DateTime, Email, String
+from marshmallow.validate import Length, Regexp
 
 from cc_common.config import config
-from cc_common.data_model.schema.base_record import (
-    BaseRecordSchema,
-    CalculatedStatusRecordSchema,
-    ForgivingSchema,
+from cc_common.data_model.schema.base_record import BaseRecordSchema, CalculatedStatusRecordSchema, ForgivingSchema
+from cc_common.data_model.schema.common import ensure_value_is_datetime
+from cc_common.data_model.schema.fields import (
+    ActiveInactive,
+    Compact,
     ITUTE164PhoneNumber,
+    Jurisdiction,
+    NationalProviderIdentifier,
     Set,
     SocialSecurityNumber,
 )
-from cc_common.data_model.schema.common import ensure_value_is_datetime
-from cc_common.data_model.schema.license import LicenseReadGeneralSchema
-from cc_common.data_model.schema.military_affiliation import MilitaryAffiliationGeneralResponseSchema
-from cc_common.data_model.schema.privilege import PrivilegeGeneralResponseSchema
 
 
 class ProviderPrivateSchema(ForgivingSchema):
@@ -27,12 +26,12 @@ class ProviderPrivateSchema(ForgivingSchema):
     # Provided fields
     providerId = UUID(required=True, allow_none=False)
 
-    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
-    licenseJurisdiction = String(required=True, allow_none=False, validate=OneOf(config.jurisdictions))
+    compact = Compact(required=True, allow_none=False)
+    licenseJurisdiction = Jurisdiction(required=True, allow_none=False)
     ssn = SocialSecurityNumber(required=True, allow_none=False)
-    npi = String(required=False, allow_none=False, validate=Regexp('^[0-9]{10}$'))
+    npi = NationalProviderIdentifier(required=False, allow_none=False)
     licenseType = String(required=True, allow_none=False)
-    jurisdictionStatus = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
+    jurisdictionStatus = ActiveInactive(required=True, allow_none=False)
     givenName = String(required=True, allow_none=False, validate=Length(1, 100))
     middleName = String(required=False, allow_none=False, validate=Length(1, 100))
     familyName = String(required=True, allow_none=False, validate=Length(1, 100))
@@ -109,52 +108,3 @@ def populate_fam_giv_mid(self, in_data, **kwargs):  # noqa: ARG001 unused-argume
     def drop_fam_giv_mid(self, in_data, **kwargs):  # noqa: ARG001 unused-argument
         del in_data['providerFamGivMid']
         return in_data
-
-
-class SanitizedProviderReadGeneralSchema(ForgivingSchema):
-    """
-    Provider record fields that are sanitized for users with the 'readGeneral' permission.
-
-    This schema is intended to be used to dump records from the database in order to remove all fields not defined here.
-    It should NEVER be used to load data into the database. Use the ProviderRecordSchema for that.
-
-    This schema should be used by any endpoint that returns provider information to staff users (ie the query provider
-    and GET provider endpoints).
-    """
-
-    providerId = UUID(required=True, allow_none=False)
-    type = String(required=True, allow_none=False)
-
-    dateOfUpdate = DateTime(required=True, allow_none=False)
-    compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
-    licenseJurisdiction = String(required=True, allow_none=False, validate=OneOf(config.jurisdictions))
-    npi = String(required=False, allow_none=False, validate=Regexp('^[0-9]{10}$'))
-    licenseType = String(required=True, allow_none=False)
-    jurisdictionStatus = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
-    givenName = String(required=True, allow_none=False, validate=Length(1, 100))
-    middleName = String(required=False, allow_none=False, validate=Length(1, 100))
-    familyName = String(required=True, allow_none=False, validate=Length(1, 100))
-    suffix = String(required=False, allow_none=False, validate=Length(1, 100))
-    # This date is determined by the license records uploaded by a state
-    # they do not include a timestamp, so we use the Date field type
-    dateOfExpiration = Date(required=True, allow_none=False)
-    homeAddressStreet1 = String(required=True, allow_none=False, validate=Length(2, 100))
-    homeAddressStreet2 = String(required=False, allow_none=False, validate=Length(1, 100))
-    homeAddressCity = String(required=True, allow_none=False, validate=Length(2, 100))
-    homeAddressState = String(required=True, allow_none=False, validate=Length(2, 100))
-    homeAddressPostalCode = String(required=True, allow_none=False, validate=Length(5, 7))
-    emailAddress = Email(required=False, allow_none=False, validate=Length(1, 100))
-    phoneNumber = ITUTE164PhoneNumber(required=False, allow_none=False)
-    status = String(required=True, allow_none=False, validate=OneOf(['active', 'inactive']))
-    militaryWaiver = Boolean(required=False, allow_none=False)
-
-    privilegeJurisdictions = Set(String, required=False, allow_none=False, load_default=set())
-    providerFamGivMid = String(required=False, allow_none=False, validate=Length(2, 400))
-    providerDateOfUpdate = DateTime(required=False, allow_none=False)
-    birthMonthDay = String(required=False, allow_none=False, validate=Regexp('^[0-1]{1}[0-9]{1}-[0-3]{1}[0-9]{1}'))
-
-    # these records are present when getting provider information from the GET endpoint
-    # so we check for them here and sanitize them if they are present
-    licenses = List(Nested(LicenseReadGeneralSchema(), required=False, allow_none=False))
-    privileges = List(Nested(PrivilegeGeneralResponseSchema(), required=False, allow_none=False))
-    militaryAffiliations = List(Nested(MilitaryAffiliationGeneralResponseSchema(), required=False, allow_none=False))
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/user.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/user.py
index f542e4e51..79e9ab27c 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/user.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/data_model/schema/user.py
@@ -5,7 +5,8 @@
 from marshmallow.validate import Length, OneOf
 
 from cc_common.config import config
-from cc_common.data_model.schema.base_record import BaseRecordSchema, Set
+from cc_common.data_model.schema.base_record import BaseRecordSchema
+from cc_common.data_model.schema.fields import Set
 
 
 class CompactPermissionsRecordSchema(Schema):
diff --git a/backend/compact-connect/lambdas/python/common/cc_common/utils.py b/backend/compact-connect/lambdas/python/common/cc_common/utils.py
index ff1e9ee84..83494f628 100644
--- a/backend/compact-connect/lambdas/python/common/cc_common/utils.py
+++ b/backend/compact-connect/lambdas/python/common/cc_common/utils.py
@@ -10,8 +10,8 @@
 from aws_lambda_powertools.utilities.typing import LambdaContext
 from botocore.exceptions import ClientError
 
-from cc_common.config import logger
-from cc_common.data_model.schema.provider import SanitizedProviderReadGeneralSchema
+from cc_common.config import logger, metrics
+from cc_common.data_model.schema.provider.api import ProviderGeneralResponseSchema
 from cc_common.exceptions import (
     CCAccessDeniedException,
     CCInvalidRequestException,
@@ -52,6 +52,7 @@ def api_handler(fn: Callable):
     """
 
     @wraps(fn)
+    @metrics.log_metrics
     @logger.inject_lambda_context
     def caught_handler(event, context: LambdaContext):
         # We have to jump through extra hoops to handle the case where APIGW sets headers to null
@@ -263,6 +264,7 @@ def sqs_handler(fn: Callable):
     """
 
     @wraps(fn)
+    @metrics.log_metrics
     @logger.inject_lambda_context
     def process_messages(event, context: LambdaContext):  # noqa: ARG001 unused-argument
         records = event['Records']
@@ -451,6 +453,6 @@ def sanitize_provider_data_based_on_caller_scopes(compact: str, provider: dict,
         'Caller does not have readPrivate at compact or jurisdiction level, removing private information',
         provider_id=provider['providerId'],
     )
-    provider_read_general_schema = SanitizedProviderReadGeneralSchema()
-    # we dump the record to ensure that the schema is applied to the record to remove private fields
-    return provider_read_general_schema.dump(provider)
+    provider_read_general_schema = ProviderGeneralResponseSchema()
+    # we filter the record to ensure that the schema is applied to the record to remove private fields
+    return provider_read_general_schema.load(provider)
diff --git a/backend/compact-connect/lambdas/python/common/tests/__init__.py b/backend/compact-connect/lambdas/python/common/tests/__init__.py
index 3ace1318b..3ffe73870 100644
--- a/backend/compact-connect/lambdas/python/common/tests/__init__.py
+++ b/backend/compact-connect/lambdas/python/common/tests/__init__.py
@@ -22,7 +22,7 @@ def setUpClass(cls):
                 'PROV_FAM_GIV_MID_INDEX_NAME': 'providerFamGivMid',
                 'FAM_GIV_INDEX_NAME': 'famGiv',
                 'USER_POOL_ID': 'us-east-1-12345',
-                'USERS_TABLE_NAME': 'provider-table',
+                'USERS_TABLE_NAME': 'users-table',
                 'PROV_DATE_OF_UPDATE_INDEX_NAME': 'providerDateOfUpdate',
                 'COMPACTS': '["aslp", "octp", "coun"]',
                 'JURISDICTIONS': '["ne", "oh", "ky"]',
diff --git a/backend/compact-connect/lambdas/python/common/tests/function/__init__.py b/backend/compact-connect/lambdas/python/common/tests/function/__init__.py
index 5135f275c..55f1e9cb9 100644
--- a/backend/compact-connect/lambdas/python/common/tests/function/__init__.py
+++ b/backend/compact-connect/lambdas/python/common/tests/function/__init__.py
@@ -1,6 +1,8 @@
 import json
 import logging
 import os
+from decimal import Decimal
+from glob import glob
 
 import boto3
 from boto3.dynamodb.types import TypeDeserializer
@@ -26,16 +28,52 @@ def setUp(self):  # noqa: N801 invalid-name
 
         self.addCleanup(self.delete_resources)
 
+        import cc_common.config
+
+        cc_common.config.config = cc_common.config._Config()  # noqa: SLF001 protected-access
+        self.config = cc_common.config.config
+
     def build_resources(self):
-        self._table = boto3.resource('dynamodb').create_table(
+        self.create_compact_configuration_table()
+        self.create_provider_table()
+        self.create_users_table()
+
+        # Adding a waiter allows for testing against an actual AWS account, if needed
+        waiter = self._compact_configuration_table.meta.client.get_waiter('table_exists')
+        waiter.wait(TableName=self._compact_configuration_table.name)
+        waiter.wait(TableName=self._provider_table.name)
+        waiter.wait(TableName=self._users_table.name)
+
+        # Create a new Cognito user pool
+        cognito_client = boto3.client('cognito-idp')
+        user_pool_name = 'TestUserPool'
+        user_pool_response = cognito_client.create_user_pool(
+            PoolName=user_pool_name,
+            AliasAttributes=['email'],
+            UsernameAttributes=['email'],
+        )
+        os.environ['USER_POOL_ID'] = user_pool_response['UserPool']['Id']
+        self._user_pool_id = user_pool_response['UserPool']['Id']
+
+    def create_compact_configuration_table(self):
+        self._compact_configuration_table = boto3.resource('dynamodb').create_table(
             AttributeDefinitions=[
                 {'AttributeName': 'pk', 'AttributeType': 'S'},
                 {'AttributeName': 'sk', 'AttributeType': 'S'},
-                {'AttributeName': 'famGiv', 'AttributeType': 'S'},
             ],
-            TableName=self.config.users_table_name,
+            TableName=os.environ['COMPACT_CONFIGURATION_TABLE_NAME'],
             KeySchema=[{'AttributeName': 'pk', 'KeyType': 'HASH'}, {'AttributeName': 'sk', 'KeyType': 'RANGE'}],
             BillingMode='PAY_PER_REQUEST',
+        )
+
+    def create_users_table(self):
+        self._users_table = boto3.resource('dynamodb').create_table(
+            AttributeDefinitions=[
+                {'AttributeName': 'pk', 'AttributeType': 'S'},
+                {'AttributeName': 'sk', 'AttributeType': 'S'},
+                {'AttributeName': 'famGiv', 'AttributeType': 'RANGE'},
+            ],
+            TableName=os.environ['USERS_TABLE_NAME'],
             GlobalSecondaryIndexes=[
                 {
                     'IndexName': os.environ['FAM_GIV_INDEX_NAME'],
@@ -46,37 +84,118 @@ def build_resources(self):
                     'Projection': {'ProjectionType': 'ALL'},
                 },
             ],
+            KeySchema=[
+                {'AttributeName': 'pk', 'KeyType': 'HASH'},
+                {'AttributeName': 'sk', 'KeyType': 'RANGE'},
+            ],
+            BillingMode='PAY_PER_REQUEST',
         )
-        # Adding a waiter allows for testing against an actual AWS account, if needed
-        waiter = self._table.meta.client.get_waiter('table_exists')
-        waiter.wait(TableName=self._table.name)
 
-        # Create a new Cognito user pool
-        cognito_client = boto3.client('cognito-idp')
-        user_pool_name = 'TestUserPool'
-        user_pool_response = cognito_client.create_user_pool(
-            PoolName=user_pool_name,
-            AliasAttributes=['email'],
-            UsernameAttributes=['email'],
+    def create_provider_table(self):
+        self._provider_table = boto3.resource('dynamodb').create_table(
+            KeySchema=[{'AttributeName': 'pk', 'KeyType': 'HASH'}, {'AttributeName': 'sk', 'KeyType': 'RANGE'}],
+            BillingMode='PAY_PER_REQUEST',
+            AttributeDefinitions=[
+                {'AttributeName': 'pk', 'AttributeType': 'S'},
+                {'AttributeName': 'sk', 'AttributeType': 'S'},
+                {'AttributeName': 'providerFamGivMid', 'AttributeType': 'S'},
+                {'AttributeName': 'providerDateOfUpdate', 'AttributeType': 'S'},
+            ],
+            TableName=os.environ['PROVIDER_TABLE_NAME'],
+            GlobalSecondaryIndexes=[
+                {
+                    'IndexName': os.environ['PROV_FAM_GIV_MID_INDEX_NAME'],
+                    'KeySchema': [
+                        {'AttributeName': 'sk', 'KeyType': 'HASH'},
+                        {'AttributeName': 'providerFamGivMid', 'KeyType': 'RANGE'},
+                    ],
+                    'Projection': {'ProjectionType': 'ALL'},
+                },
+                {
+                    'IndexName': os.environ['PROV_DATE_OF_UPDATE_INDEX_NAME'],
+                    'KeySchema': [
+                        {'AttributeName': 'sk', 'KeyType': 'HASH'},
+                        {'AttributeName': 'providerDateOfUpdate', 'KeyType': 'RANGE'},
+                    ],
+                    'Projection': {'ProjectionType': 'ALL'},
+                },
+            ],
         )
-        os.environ['USER_POOL_ID'] = user_pool_response['UserPool']['Id']
-        self._user_pool_id = user_pool_response['UserPool']['Id']
 
     def delete_resources(self):
-        self._table.delete()
-        waiter = self._table.meta.client.get_waiter('table_not_exists')
-        waiter.wait(TableName=self._table.name)
+        self._compact_configuration_table.delete()
+        self._provider_table.delete()
+        self._users_table.delete()
+
+        waiter = self._users_table.meta.client.get_waiter('table_not_exists')
+        waiter.wait(TableName=self._compact_configuration_table.name)
+        waiter.wait(TableName=self._provider_table.name)
+        waiter.wait(TableName=self._users_table.name)
+
         # Delete the Cognito user pool
         cognito_client = boto3.client('cognito-idp')
         cognito_client.delete_user_pool(UserPoolId=self._user_pool_id)
 
+    def _load_compact_configuration_data(self):
+        """Use the canned test resources to load compact and jurisdiction information into the DB"""
+        test_resources = [
+            'tests/resources/dynamo/compact.json',
+            'tests/resources/dynamo/jurisdiction.json',
+        ]
+
+        for resource in test_resources:
+            with open(resource) as f:
+                record = json.load(f, parse_float=Decimal)
+
+            logger.debug('Loading resource, %s: %s', resource, str(record))
+            # compact and jurisdiction records go in the compact configuration table
+            self._compact_configuration_table.put_item(Item=record)
+
+    def _load_provider_data(self):
+        """Use the canned test resources to load a basic provider to the DB"""
+        test_resources = glob('../common/tests/resources/dynamo/provider.json')
+
+        def privilege_jurisdictions_to_set(obj: dict):
+            if obj.get('type') == 'provider' and 'privilegeJurisdictions' in obj:
+                obj['privilegeJurisdictions'] = set(obj['privilegeJurisdictions'])
+            return obj
+
+        for resource in test_resources:
+            with open(resource) as f:
+                record = json.load(f, object_hook=privilege_jurisdictions_to_set, parse_float=Decimal)
+
+            logger.debug('Loading resource, %s: %s', resource, str(record))
+            self._provider_table.put_item(Item=record)
+
+    def _load_license_data(self, status: str = 'active', expiration_date: str = None):
+        """Use the canned test resources to load a basic provider to the DB"""
+        license_test_resources = ['../common/tests/resources/dynamo/license.json']
+
+        for resource in license_test_resources:
+            with open(resource) as f:
+                record = json.load(f, parse_float=Decimal)
+                record['jurisdictionStatus'] = status
+                if expiration_date:
+                    record['dateOfExpiration'] = expiration_date
+
+            logger.debug('Loading resource, %s: %s', resource, str(record))
+            self._provider_table.put_item(Item=record)
+
+    def _load_military_affiliation_record_data(self, status: str = 'active'):
+        """Use the canned test resources to load a basic provider to the DB"""
+        with open('../common/tests/resources/dynamo/military-affiliation.json') as f:
+            record = json.load(f, parse_float=Decimal)
+            record['status'] = status
+
+        self._provider_table.put_item(Item=record)
+
     def _load_user_data(self) -> str:
         with open('tests/resources/dynamo/user.json') as f:
             # This item is saved in its serialized form, so we have to deserialize it first
             item = TypeDeserializer().deserialize({'M': json.load(f)})
 
         logger.info('Loading user: %s', item)
-        self._table.put_item(Item=item)
+        self._users_table.put_item(Item=item)
         return item['userId']
 
     def _create_compact_staff_user(self, compacts: list[str]):
@@ -89,7 +208,7 @@ def _create_compact_staff_user(self, compacts: list[str]):
         sub = self._create_cognito_user(email=email)
         for compact in compacts:
             logger.info('Writing compact %s permissions for %s', compact, email)
-            self._table.put_item(
+            self._users_table.put_item(
                 Item=schema.dump(
                     {
                         'userId': sub,
@@ -116,7 +235,7 @@ def _create_board_staff_users(self, compacts: list[str]):
             sub = self._create_cognito_user(email=email)
             for compact in compacts:
                 logger.info('Writing board %s/%s permissions for %s', compact, jurisdiction, email)
-                self._table.put_item(
+                self._users_table.put_item(
                     Item=schema.dump(
                         {
                             'userId': sub,
diff --git a/backend/compact-connect/lambdas/python/common/tests/function/test_data_client.py b/backend/compact-connect/lambdas/python/common/tests/function/test_data_client.py
new file mode 100644
index 000000000..86e1493c9
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/tests/function/test_data_client.py
@@ -0,0 +1,322 @@
+from datetime import UTC, date, datetime
+from unittest.mock import patch
+from uuid import uuid4
+
+from boto3.dynamodb.conditions import Key
+from moto import mock_aws
+
+from tests.function import TstFunction
+
+
+@mock_aws
+class TestDataClient(TstFunction):
+    sample_privilege_attestations = [{'attestationId': 'jurisprudence-confirmation', 'version': '1'}]
+
+    @patch('cc_common.config._Config.current_standard_datetime', datetime.fromisoformat('2024-11-08T23:59:59+00:00'))
+    def test_data_client_created_privilege_record(self):
+        from cc_common.data_model.data_client import DataClient
+
+        test_data_client = DataClient(self.config)
+
+        test_data_client.create_provider_privileges(
+            compact='aslp',
+            provider_id='test_provider_id',
+            jurisdiction_postal_abbreviations=['ca'],
+            license_expiration_date=date.fromisoformat('2024-10-31'),
+            provider_record={},
+            existing_privileges=[],
+            compact_transaction_id='test_transaction_id',
+            attestations=self.sample_privilege_attestations,
+        )
+
+        # Verify that the privilege record was created
+        new_privilege = self._provider_table.get_item(
+            Key={'pk': 'aslp#PROVIDER#test_provider_id', 'sk': 'aslp#PROVIDER#privilege/ca#'}
+        )['Item']
+        self.assertEqual(
+            {
+                'pk': 'aslp#PROVIDER#test_provider_id',
+                'sk': 'aslp#PROVIDER#privilege/ca#',
+                'type': 'privilege',
+                'providerId': 'test_provider_id',
+                'compact': 'aslp',
+                'jurisdiction': 'ca',
+                'dateOfIssuance': '2024-11-08T23:59:59+00:00',
+                'dateOfRenewal': '2024-11-08T23:59:59+00:00',
+                'dateOfExpiration': '2024-10-31',
+                'dateOfUpdate': '2024-11-08T23:59:59+00:00',
+                'compactTransactionId': 'test_transaction_id',
+                'attestations': self.sample_privilege_attestations,
+            },
+            new_privilege,
+        )
+
+        # Verify that the provider record was updated
+        updated_provider = self._provider_table.get_item(
+            Key={'pk': 'aslp#PROVIDER#test_provider_id', 'sk': 'aslp#PROVIDER'}
+        )['Item']
+        self.assertEqual({'ca'}, updated_provider['privilegeJurisdictions'])
+
+    @patch('cc_common.config._Config.current_standard_datetime', datetime.fromisoformat('2024-11-08T23:59:59+00:00'))
+    def test_data_client_updates_privilege_records(self):
+        from cc_common.data_model.data_client import DataClient
+        from cc_common.data_model.schema.privilege.record import PrivilegeRecordSchema
+
+        # Create the first privilege
+        provider_uuid = str(uuid4())
+        original_privilege = {
+            'pk': f'aslp#PROVIDER#{provider_uuid}',
+            'sk': 'aslp#PROVIDER#privilege/ky#',
+            'type': 'privilege',
+            'providerId': provider_uuid,
+            'compact': 'aslp',
+            'jurisdiction': 'ky',
+            'dateOfIssuance': '2023-11-08T23:59:59+00:00',
+            'dateOfRenewal': '2023-11-08T23:59:59+00:00',
+            'dateOfExpiration': '2024-10-31',
+            'dateOfUpdate': '2023-11-08T23:59:59+00:00',
+            'compactTransactionId': '1234567890',
+            'attestations': self.sample_privilege_attestations,
+        }
+        self._provider_table.put_item(Item=original_privilege)
+
+        test_data_client = DataClient(self.config)
+
+        # Now, renew the privilege
+        test_data_client.create_provider_privileges(
+            compact='aslp',
+            provider_id='test_provider_id',
+            jurisdiction_postal_abbreviations=['ky'],
+            license_expiration_date=date.fromisoformat('2025-10-31'),
+            provider_record={
+                'pk': 'aslp#PROVIDER#test_provider_id',
+                'sk': 'aslp#PROVIDER',
+            },
+            existing_privileges=[PrivilegeRecordSchema().load(original_privilege)],
+            compact_transaction_id='test_transaction_id',
+            attestations=self.sample_privilege_attestations,
+        )
+
+        # Verify that the privilege record was created
+        new_privilege = self._provider_table.query(
+            KeyConditionExpression=Key('pk').eq('aslp#PROVIDER#test_provider_id')
+            & Key('sk').begins_with('aslp#PROVIDER#privilege/ky#'),
+        )['Items']
+        self.maxDiff = None
+        self.assertEqual(
+            [
+                # Primary record
+                {
+                    'pk': 'aslp#PROVIDER#test_provider_id',
+                    'sk': 'aslp#PROVIDER#privilege/ky#',
+                    'type': 'privilege',
+                    'providerId': 'test_provider_id',
+                    'compact': 'aslp',
+                    'jurisdiction': 'ky',
+                    # Should be updated dates for renewal, expiration, update
+                    'dateOfIssuance': '2023-11-08T23:59:59+00:00',
+                    'dateOfRenewal': '2024-11-08T23:59:59+00:00',
+                    'dateOfExpiration': '2025-10-31',
+                    'dateOfUpdate': '2024-11-08T23:59:59+00:00',
+                    'compactTransactionId': 'test_transaction_id',
+                    'attestations': self.sample_privilege_attestations,
+                },
+                # A new history record
+                {
+                    'pk': 'aslp#PROVIDER#test_provider_id',
+                    'sk': 'aslp#PROVIDER#privilege/ky#UPDATE#1731110399/5a9ac1180424bee1436ed2be1c6884b4',
+                    'type': 'privilegeUpdate',
+                    'updateType': 'renewal',
+                    'providerId': 'test_provider_id',
+                    'compact': 'aslp',
+                    'jurisdiction': 'ky',
+                    'dateOfUpdate': '2024-11-08T23:59:59+00:00',
+                    'previous': {
+                        'dateOfIssuance': '2023-11-08T23:59:59+00:00',
+                        'dateOfRenewal': '2023-11-08T23:59:59+00:00',
+                        'dateOfExpiration': '2024-10-31',
+                        'dateOfUpdate': '2023-11-08T23:59:59+00:00',
+                        'compactTransactionId': '1234567890',
+                        'attestations': self.sample_privilege_attestations,
+                    },
+                    'updatedValues': {
+                        'dateOfRenewal': '2024-11-08T23:59:59+00:00',
+                        'dateOfExpiration': '2025-10-31',
+                        'compactTransactionId': 'test_transaction_id',
+                    },
+                },
+            ],
+            new_privilege,
+        )
+
+        # The renewal should still ensure that 'ky' is listed in provider privilegeJurisdictions
+        provider = self._provider_table.get_item(
+            Key={'pk': 'aslp#PROVIDER#test_provider_id', 'sk': 'aslp#PROVIDER'},
+        )['Item']
+        self.assertEqual({'ky'}, provider['privilegeJurisdictions'])
+
+    @patch('cc_common.config._Config.current_standard_datetime', datetime.fromisoformat('2024-11-08T23:59:59+00:00'))
+    def test_data_client_handles_large_privilege_purchase(self):
+        """Test that we can process privilege purchases with more than 100 transaction items."""
+        from cc_common.data_model.data_client import DataClient
+        from cc_common.data_model.schema.privilege.record import PrivilegeRecordSchema
+
+        test_data_client = DataClient(self.config)
+        provider_uuid = str(uuid4())
+
+        # Generate 51 jurisdictions (will create 102 records - 51 privileges and 51 updates)
+        jurisdictions = [f'j{i}' for i in range(51)]
+        original_privileges = []
+
+        # Create original privileges that will be updated
+        privilege_record_schema = PrivilegeRecordSchema()
+        for jurisdiction in jurisdictions:
+            # We'll use the schema to dump the privilege record to the table, but won't ever load again
+            # because we're using invalid jurisdiction abbreviations for testing convenience
+            original_privilege = {
+                'type': 'privilege',
+                'providerId': provider_uuid,
+                'compact': 'aslp',
+                'jurisdiction': jurisdiction,
+                'dateOfIssuance': datetime(2023, 11, 8, 23, 59, 59, tzinfo=UTC),
+                'dateOfRenewal': datetime(2023, 11, 8, 23, 59, 59, tzinfo=UTC),
+                'dateOfExpiration': date(2024, 10, 31),
+                'dateOfUpdate': datetime(2023, 11, 8, 23, 59, 59, tzinfo=UTC),
+                'compactTransactionId': '1234567890',
+            }
+            self._provider_table.put_item(Item=privilege_record_schema.dump(original_privilege))
+            original_privileges.append(original_privilege)
+
+        # Now update all privileges
+        test_data_client.create_provider_privileges(
+            compact='aslp',
+            provider_id=provider_uuid,
+            jurisdiction_postal_abbreviations=jurisdictions,
+            license_expiration_date=date.fromisoformat('2025-10-31'),
+            provider_record={
+                'pk': f'aslp#PROVIDER#{provider_uuid}',
+                'sk': 'aslp#PROVIDER',
+                'privilegeJurisdictions': set(jurisdictions),
+            },
+            existing_privileges=original_privileges,
+            compact_transaction_id='test_transaction_id',
+            attestations=self.sample_privilege_attestations,
+        )
+
+        # Verify that all privileges were updated
+        for jurisdiction in jurisdictions:
+            privilege_records = self._provider_table.query(
+                KeyConditionExpression=Key('pk').eq(f'aslp#PROVIDER#{provider_uuid}')
+                & Key('sk').begins_with(f'aslp#PROVIDER#privilege/{jurisdiction}#'),
+            )['Items']
+
+            self.assertEqual(2, len(privilege_records))  # One privilege record and one update record
+
+            # Find the main privilege record
+            privilege_record = next(r for r in privilege_records if r['type'] == 'privilege')
+            self.assertEqual('2025-10-31', privilege_record['dateOfExpiration'])
+            self.assertEqual('test_transaction_id', privilege_record['compactTransactionId'])
+
+            # Find the update record
+            update_record = next(r for r in privilege_records if r['type'] == 'privilegeUpdate')
+            self.assertEqual('renewal', update_record['updateType'])
+            self.assertEqual('2024-10-31', update_record['previous']['dateOfExpiration'])
+            self.assertEqual('2025-10-31', update_record['updatedValues']['dateOfExpiration'])
+
+        # Verify the provider record was updated correctly
+        provider = self._provider_table.get_item(
+            Key={'pk': f'aslp#PROVIDER#{provider_uuid}', 'sk': 'aslp#PROVIDER'},
+        )['Item']
+        self.assertEqual(set(jurisdictions), provider['privilegeJurisdictions'])
+
+    @patch('cc_common.config._Config.current_standard_datetime', datetime.fromisoformat('2024-11-08T23:59:59+00:00'))
+    def test_data_client_rolls_back_failed_large_privilege_purchase(self):
+        """Test that we properly roll back when a large privilege purchase fails."""
+        from botocore.exceptions import ClientError
+        from cc_common.data_model.data_client import DataClient
+        from cc_common.data_model.schema.privilege.record import PrivilegeRecordSchema
+        from cc_common.exceptions import CCAwsServiceException
+
+        test_data_client = DataClient(self.config)
+        provider_uuid = str(uuid4())
+
+        # Generate 51 jurisdictions (will create 102 records - 51 privileges and 51 updates)
+        jurisdictions = [f'j{i}' for i in range(51)]
+        original_privileges = []
+
+        privilege_record_schema = PrivilegeRecordSchema()
+        for jurisdiction in jurisdictions:
+            # We'll use the schema to dump the privilege record to the table, but won't ever load again
+            # because we're using invalid jurisdiction abbreviations for testing convenience
+            original_privilege = {
+                'type': 'privilege',
+                'providerId': provider_uuid,
+                'compact': 'aslp',
+                'jurisdiction': jurisdiction,
+                'dateOfIssuance': datetime(2023, 11, 8, 23, 59, 59, tzinfo=UTC),
+                'dateOfRenewal': datetime(2023, 11, 8, 23, 59, 59, tzinfo=UTC),
+                'dateOfExpiration': date(2024, 10, 31),
+                'dateOfUpdate': datetime(2023, 11, 8, 23, 59, 59, tzinfo=UTC),
+                'compactTransactionId': '1234567890',
+            }
+            dumped_privilege = privilege_record_schema.dump(original_privilege)
+            self._provider_table.put_item(Item=dumped_privilege)
+            original_privileges.append(original_privilege)
+
+        # Store original provider record
+        original_provider = {
+            'pk': f'aslp#PROVIDER#{provider_uuid}',
+            'sk': 'aslp#PROVIDER',
+            'providerId': provider_uuid,
+            'compact': 'aslp',
+            'privilegeJurisdictions': set(jurisdictions),
+        }
+        self._provider_table.put_item(Item=original_provider)
+
+        # Mock DynamoDB to fail after first batch
+        original_transact_write_items = self.config.dynamodb_client.transact_write_items
+        call_count = 0
+
+        def mock_transact_write_items(**kwargs):
+            nonlocal call_count
+            call_count += 1
+            if call_count == 2:  # Fail on second batch
+                raise ClientError(
+                    {'Error': {'Code': 'TransactionCanceledException', 'Message': 'Test error'}},
+                    'TransactWriteItems',
+                )
+            return original_transact_write_items(**kwargs)
+
+        self.config.dynamodb_client.transact_write_items = mock_transact_write_items
+
+        # Attempt to update all privileges (should fail)
+        with self.assertRaises(CCAwsServiceException):
+            test_data_client.create_provider_privileges(
+                compact='aslp',
+                provider_id=provider_uuid,
+                jurisdiction_postal_abbreviations=jurisdictions,
+                license_expiration_date=date.fromisoformat('2025-10-31'),
+                provider_record=original_provider,
+                existing_privileges=original_privileges,
+                compact_transaction_id='test_transaction_id',
+                attestations=self.sample_privilege_attestations,
+            )
+
+        # Verify that all privileges were restored to their original state
+        for jurisdiction in jurisdictions:
+            privilege_records = self._provider_table.query(
+                KeyConditionExpression=Key('pk').eq(f'aslp#PROVIDER#{provider_uuid}')
+                & Key('sk').begins_with(f'aslp#PROVIDER#privilege/{jurisdiction}#'),
+            )['Items']
+
+            self.assertEqual(1, len(privilege_records))  # Only the original privilege record should exist
+            privilege_record = privilege_records[0]
+
+            self.assertEqual('2024-10-31', privilege_record['dateOfExpiration'])
+            self.assertEqual('1234567890', privilege_record['compactTransactionId'])
+
+        # Verify the provider record was restored to its original state
+        provider = self._provider_table.get_item(
+            Key={'pk': f'aslp#PROVIDER#{provider_uuid}', 'sk': 'aslp#PROVIDER'},
+        )['Item']
+        self.assertEqual(set(jurisdictions), provider['privilegeJurisdictions'])
diff --git a/backend/compact-connect/lambdas/python/common/tests/function/test_data_model/test_user_client.py b/backend/compact-connect/lambdas/python/common/tests/function/test_data_model/test_user_client.py
index f1ceb543f..2a438be62 100644
--- a/backend/compact-connect/lambdas/python/common/tests/function/test_data_model/test_user_client.py
+++ b/backend/compact-connect/lambdas/python/common/tests/function/test_data_model/test_user_client.py
@@ -177,7 +177,7 @@ def test_update_user_permissions_compact_to_board_admin(self):
         user_id = UUID(user_data['userId'])
         # Convert our canned user into a compact admin
         user_data['permissions'] = {'actions': {'read', 'admin'}, 'jurisdictions': {}}
-        self._table.put_item(Item=user_data)
+        self._users_table.put_item(Item=user_data)
 
         from cc_common.data_model.user_client import UserClient
 
@@ -204,7 +204,7 @@ def test_update_user_permissions_no_change(self):
         user_id = UUID(user_data['userId'])
         # Convert our canned user into a compact admin
         user_data['permissions'] = {'actions': {'read', 'admin'}, 'jurisdictions': {}}
-        self._table.put_item(Item=user_data)
+        self._users_table.put_item(Item=user_data)
 
         from cc_common.data_model.user_client import UserClient
 
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/api/license-post.json b/backend/compact-connect/lambdas/python/common/tests/resources/api/license-post.json
index 6974e665b..1f475a1fa 100644
--- a/backend/compact-connect/lambdas/python/common/tests/resources/api/license-post.json
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/api/license-post.json
@@ -11,10 +11,10 @@
   "homeAddressCity": "Columbus",
   "homeAddressState": "oh",
   "homeAddressPostalCode": "43004",
-  "dateOfIssuance": "2024-06-06",
-  "dateOfBirth": "2024-06-06",
-  "dateOfExpiration": "2050-06-06",
-  "dateOfRenewal": "2024-06-06",
+  "dateOfIssuance": "2010-06-06",
+  "dateOfRenewal": "2020-04-04",
+  "dateOfExpiration": "2025-04-04",
+  "dateOfBirth": "1985-06-06",
   "emailAddress": "björk@example.com",
   "phoneNumber": "+13213214321",
   "militaryWaiver": false
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-detail-response.json b/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-detail-response.json
index c65c255a0..ee7c9d770 100644
--- a/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-detail-response.json
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-detail-response.json
@@ -20,9 +20,9 @@
   "militaryWaiver": false,
   "emailAddress": "björk@example.com",
   "phoneNumber": "+13213214321",
-  "dateOfBirth": "2024-06-06",
+  "dateOfBirth": "1985-06-06",
   "dateOfUpdate": "2024-07-08T23:59:59+00:00",
-  "dateOfExpiration": "2050-06-06",
+  "dateOfExpiration": "2025-04-04",
   "birthMonthDay": "06-06",
   "licenses": [
     {
@@ -38,11 +38,11 @@
       "givenName": "Björk",
       "middleName": "Gunnar",
       "familyName": "Guðmundsdóttir",
-      "dateOfIssuance": "2024-06-06",
-      "dateOfRenewal": "2024-06-06",
-      "dateOfExpiration": "2050-06-06",
-      "dateOfBirth": "2024-06-06",
-      "dateOfUpdate": "2024-07-08T23:59:59+00:00",
+      "dateOfIssuance": "2010-06-06",
+      "dateOfRenewal": "2020-04-04",
+      "dateOfExpiration": "2025-04-04",
+      "dateOfBirth": "1985-06-06",
+      "dateOfUpdate": "2024-06-06T12:59:59+00:00",
       "homeAddressStreet1": "123 A St.",
       "homeAddressStreet2": "Apt 321",
       "homeAddressCity": "Columbus",
@@ -50,7 +50,43 @@
       "homeAddressPostalCode": "43004",
       "emailAddress": "björk@example.com",
       "phoneNumber": "+13213214321",
-      "militaryWaiver": false
+      "militaryWaiver": false,
+      "history": [
+        {
+          "type": "licenseUpdate",
+          "updateType": "renewal",
+          "providerId": "89a6377e-c3a5-40e5-bca5-317ec854c570",
+          "compact": "aslp",
+          "jurisdiction": "oh",
+          "dateOfUpdate": "2020-04-07T12:59:59+00:00",
+          "previous": {
+            "ssn": "123-12-1234",
+            "npi": "0608337260",
+            "licenseType": "speech-language pathologist",
+            "jurisdictionStatus": "active",
+            "givenName": "Björk",
+            "middleName": "Gunnar",
+            "familyName": "Guðmundsdóttir",
+            "dateOfIssuance": "2010-06-06",
+            "dateOfRenewal": "2015-06-06",
+            "dateOfExpiration": "2020-06-06",
+            "dateOfBirth": "1985-06-06",
+            "dateOfUpdate": "2020-06-06T12:59:59+00:00",
+            "homeAddressStreet1": "123 A St.",
+            "homeAddressStreet2": "Apt 321",
+            "homeAddressCity": "Columbus",
+            "homeAddressState": "oh",
+            "homeAddressPostalCode": "43004",
+            "emailAddress": "björk@example.com",
+            "phoneNumber": "+13213214321",
+            "militaryWaiver": false
+          },
+          "updatedValues": {
+            "dateOfRenewal": "2020-04-04",
+            "dateOfExpiration": "2025-04-04"
+          }
+        }
+      ]
     }
   ],
   "privileges": [
@@ -60,11 +96,33 @@
       "compact": "aslp",
       "jurisdiction": "ne",
       "status": "active",
-      "dateOfIssuance": "2024-06-06T23:59:59+00:00",
-      "dateOfRenewal": "2024-11-08T23:59:59+00:00",
-      "dateOfUpdate": "2024-07-01T23:59:59+00:00",
-      "dateOfExpiration": "2050-06-06",
+      "dateOfIssuance": "2016-05-05T12:59:59+00:00",
+      "dateOfRenewal": "2020-05-05T12:59:59+00:00",
+      "dateOfExpiration": "2025-04-04",
+      "dateOfUpdate": "2020-05-05T12:59:59+00:00",
       "compactTransactionId": "1234567890",
+      "history": [
+        {
+          "type": "privilegeUpdate",
+          "updateType": "renewal",
+          "providerId": "89a6377e-c3a5-40e5-bca5-317ec854c570",
+          "compact": "aslp",
+          "jurisdiction": "ne",
+          "dateOfUpdate": "2020-05-05T12:59:59+00:00",
+          "previous": {
+            "dateOfIssuance": "2016-05-05T12:59:59+00:00",
+            "dateOfRenewal": "2016-05-05T12:59:59+00:00",
+            "dateOfExpiration": "2020-06-06",
+            "dateOfUpdate": "2016-05-05T12:59:59+00:00",
+            "compactTransactionId": "0123456789"
+          },
+          "updatedValues": {
+            "dateOfRenewal": "2020-05-05T12:59:59+00:00",
+            "dateOfExpiration": "2025-04-04",
+            "compactTransactionId": "1234567890"
+          }
+        }
+      ],
       "attestations": [
         {
           "attestationId": "jurisprudence-confirmation",
@@ -78,7 +136,7 @@
       "providerId": "89a6377e-c3a5-40e5-bca5-317ec854c570",
       "compact": "aslp",
       "type": "militaryAffiliation",
-      "documentKeys": ["/provider/<provider_id>/document-type/military-affiliations/2024-07-08/1234#military-waiver.pdf"],
+      "documentKeys": ["/provider/89a6377e-c3a5-40e5-bca5-317ec854c570/document-type/military-affiliations/2024-07-08/1234#military-waiver.pdf"],
       "affiliationType": "militaryMember",
       "fileNames": ["military-waiver.pdf"],
       "status": "active",
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-response.json b/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-response.json
index 7919bf431..fbc886fbd 100644
--- a/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-response.json
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/api/provider-response.json
@@ -20,6 +20,6 @@
   "emailAddress": "björk@example.com",
   "phoneNumber": "+13213214321",
   "dateOfUpdate": "2024-07-08T23:59:59+00:00",
-  "dateOfExpiration": "2050-06-06",
+  "dateOfExpiration": "2025-04-04",
   "birthMonthDay": "06-06"
 }
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/compact.json b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/compact.json
index 7b3ffb587..4e3c280e0 100644
--- a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/compact.json
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/compact.json
@@ -10,5 +10,5 @@
   "compactOperationsTeamEmails": ["<email address>"],
   "compactAdverseActionsNotificationEmails": ["<email address>"],
   "compactSummaryReportNotificationEmails": ["<email address>"],
-  "dateOfUpdate": "2024-10-04"
+  "dateOfUpdate": "2024-10-04T12:34:56+00:00"
 }
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/jurisdiction.json b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/jurisdiction.json
index 3e2785a17..ccdf85fbf 100644
--- a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/jurisdiction.json
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/jurisdiction.json
@@ -17,5 +17,5 @@
   "jurisprudenceRequirements": {
     "required": true
   },
-  "dateOfUpdate": "2024-10-04"
+  "dateOfUpdate": "2024-10-04T12:34:56+00:00"
 }
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/license-update.json b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/license-update.json
new file mode 100644
index 000000000..353a28179
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/license-update.json
@@ -0,0 +1,36 @@
+{
+  "pk": "aslp#PROVIDER#89a6377e-c3a5-40e5-bca5-317ec854c570",
+  "sk": "aslp#PROVIDER#license/oh#UPDATE#1586264399/10bd49b5c65f404b9b505884a61cd3c4",
+  "type": "licenseUpdate",
+  "updateType": "renewal",
+  "providerId": "89a6377e-c3a5-40e5-bca5-317ec854c570",
+  "compact": "aslp",
+  "jurisdiction": "oh",
+  "dateOfUpdate": "2020-04-07T12:59:59+00:00",
+  "previous": {
+    "ssn": "123-12-1234",
+    "npi": "0608337260",
+    "licenseType": "speech-language pathologist",
+    "givenName": "Björk",
+    "middleName": "Gunnar",
+    "familyName": "Guðmundsdóttir",
+    "dateOfIssuance": "2010-06-06",
+    "dateOfRenewal": "2015-06-06",
+    "dateOfExpiration": "2020-06-06",
+    "dateOfBirth": "1985-06-06",
+    "dateOfUpdate": "2020-06-06T12:59:59+00:00",
+    "homeAddressStreet1": "123 A St.",
+    "homeAddressStreet2": "Apt 321",
+    "homeAddressCity": "Columbus",
+    "homeAddressState": "oh",
+    "homeAddressPostalCode": "43004",
+    "emailAddress": "björk@example.com",
+    "phoneNumber": "+13213214321",
+    "militaryWaiver": false,
+    "jurisdictionStatus": "active"
+  },
+  "updatedValues": {
+    "dateOfRenewal": "2020-04-04",
+    "dateOfExpiration": "2025-04-04"
+  }
+}
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/license.json b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/license.json
index dabaab924..0a849d57e 100644
--- a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/license.json
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/license.json
@@ -1,6 +1,6 @@
 {
   "pk": "aslp#PROVIDER#89a6377e-c3a5-40e5-bca5-317ec854c570",
-  "sk": "aslp#PROVIDER#license/oh#2024-06-06",
+  "sk": "aslp#PROVIDER#license/oh#",
   "type": "license",
   "providerId": "89a6377e-c3a5-40e5-bca5-317ec854c570",
   "compact": "aslp",
@@ -11,11 +11,11 @@
   "givenName": "Björk",
   "middleName": "Gunnar",
   "familyName": "Guðmundsdóttir",
-  "dateOfIssuance": "2024-06-06",
-  "dateOfRenewal": "2024-06-06",
-  "dateOfExpiration": "2050-06-06",
-  "dateOfBirth": "2024-06-06",
-  "dateOfUpdate": "2024-07-08",
+  "dateOfIssuance": "2010-06-06",
+  "dateOfRenewal": "2020-04-04",
+  "dateOfExpiration": "2025-04-04",
+  "dateOfBirth": "1985-06-06",
+  "dateOfUpdate": "2024-06-06T12:59:59+00:00",
   "homeAddressStreet1": "123 A St.",
   "homeAddressStreet2": "Apt 321",
   "homeAddressCity": "Columbus",
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/military-affiliation.json b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/military-affiliation.json
index b10d83f63..f2aa2314b 100644
--- a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/military-affiliation.json
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/military-affiliation.json
@@ -4,7 +4,7 @@
       "providerId": "89a6377e-c3a5-40e5-bca5-317ec854c570",
       "compact": "aslp",
       "type": "militaryAffiliation",
-      "documentKeys": ["/provider/<provider_id>/document-type/military-affiliations/2024-07-08/1234#military-waiver.pdf"],
+      "documentKeys": ["/provider/89a6377e-c3a5-40e5-bca5-317ec854c570/document-type/military-affiliations/2024-07-08/1234#military-waiver.pdf"],
       "affiliationType": "militaryMember",
       "fileNames": ["military-waiver.pdf"],
       "status": "active",
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/privilege-update.json b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/privilege-update.json
new file mode 100644
index 000000000..88c3a0d77
--- /dev/null
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/privilege-update.json
@@ -0,0 +1,22 @@
+{
+  "pk": "aslp#PROVIDER#89a6377e-c3a5-40e5-bca5-317ec854c570",
+  "sk": "aslp#PROVIDER#privilege/ne#UPDATE#1735232821/1a812bc8f",
+  "type": "privilegeUpdate",
+  "updateType": "renewal",
+  "providerId": "89a6377e-c3a5-40e5-bca5-317ec854c570",
+  "compact": "aslp",
+  "jurisdiction": "ne",
+  "dateOfUpdate": "2020-05-05T12:59:59+00:00",
+  "previous": {
+    "dateOfIssuance": "2016-05-05T12:59:59+00:00",
+    "dateOfRenewal": "2016-05-05T12:59:59+00:00",
+    "dateOfExpiration": "2020-06-06",
+    "dateOfUpdate": "2016-05-05T12:59:59+00:00",
+    "compactTransactionId": "0123456789"
+  },
+  "updatedValues": {
+    "dateOfRenewal": "2020-05-05T12:59:59+00:00",
+    "dateOfExpiration": "2025-04-04",
+    "compactTransactionId": "1234567890"
+  }
+}
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/privilege.json b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/privilege.json
index ffb878d7a..f4a7f8542 100644
--- a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/privilege.json
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/privilege.json
@@ -1,14 +1,14 @@
 {
   "pk": "aslp#PROVIDER#89a6377e-c3a5-40e5-bca5-317ec854c570",
-  "sk": "aslp#PROVIDER#privilege/ne#2024-11-08",
+  "sk": "aslp#PROVIDER#privilege/ne#",
   "type": "privilege",
   "providerId": "89a6377e-c3a5-40e5-bca5-317ec854c570",
   "compact": "aslp",
   "jurisdiction": "ne",
-  "dateOfIssuance": "2024-06-06T23:59:59+00:00",
-  "dateOfRenewal": "2024-11-08T23:59:59+00:00",
-  "dateOfUpdate": "2024-07-01",
-  "dateOfExpiration": "2050-06-06",
+  "dateOfIssuance": "2016-05-05T12:59:59+00:00",
+  "dateOfRenewal": "2020-05-05T12:59:59+00:00",
+  "dateOfExpiration": "2025-04-04",
+  "dateOfUpdate": "2020-05-05T12:59:59+00:00",
   "compactTransactionId": "1234567890",
   "attestations": [
     {
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/provider.json b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/provider.json
index 7075cd793..8cb590bff 100644
--- a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/provider.json
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/provider.json
@@ -23,8 +23,8 @@
   "emailAddress": "björk@example.com",
   "phoneNumber": "+13213214321",
   "militaryWaiver": false,
-  "dateOfBirth": "2024-06-06",
-  "dateOfUpdate": "2024-07-08",
-  "dateOfExpiration": "2050-06-06",
+  "dateOfExpiration": "2025-04-04",
+  "dateOfBirth": "1985-06-06",
+  "dateOfUpdate": "2024-07-08T23:59:59+00:00",
   "birthMonthDay": "06-06"
 }
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/user.json b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/user.json
index cc2552e4a..ce626dc3d 100644
--- a/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/user.json
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/dynamo/user.json
@@ -12,7 +12,7 @@
     "S": "aslp"
   },
   "dateOfUpdate": {
-    "S": "2024-09-12"
+    "S": "2024-09-12T23:59:59+00:00"
   },
   "type": {
     "S": "user"
diff --git a/backend/compact-connect/lambdas/python/common/tests/resources/ingest/message.json b/backend/compact-connect/lambdas/python/common/tests/resources/ingest/message.json
index 302aa3a9a..8bd7766a7 100644
--- a/backend/compact-connect/lambdas/python/common/tests/resources/ingest/message.json
+++ b/backend/compact-connect/lambdas/python/common/tests/resources/ingest/message.json
@@ -24,10 +24,10 @@
     "emailAddress": "björk@example.com",
     "phoneNumber": "+13213214321",
     "militaryWaiver": false,
-    "dateOfIssuance": "2024-06-06",
-    "dateOfBirth": "2024-06-06",
-    "dateOfExpiration": "2050-06-06",
-    "dateOfRenewal": "2024-06-06",
+    "dateOfIssuance": "2010-06-06",
+    "dateOfBirth": "1985-06-06",
+    "dateOfExpiration": "2025-04-04",
+    "dateOfRenewal": "2020-04-04",
     "compact": "aslp",
     "jurisdiction": "oh"
   }
diff --git a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_data_client.py b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_data_client.py
index d8b24f6b8..fcb6f1d28 100644
--- a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_data_client.py
+++ b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_data_client.py
@@ -1,15 +1,15 @@
-from datetime import date, datetime
-from unittest.mock import MagicMock, patch
+from unittest.mock import MagicMock
 
 from botocore.exceptions import ClientError
-from cc_common.exceptions import CCAwsServiceException, CCNotFoundException
+from cc_common.exceptions import CCNotFoundException
 
 from tests import TstLambdas
 
 
 class TestDataClient(TstLambdas):
     def setUp(self):
-        from cc_common.data_model import client
+        from cc_common.config import _Config
+        from cc_common.data_model.data_client import DataClient
 
         self.mock_provider_table = MagicMock(name='provider-table')
         self.mock_ssn_table = MagicMock(name='ssn-table')
@@ -18,11 +18,11 @@ def setUp(self):
         # Ensure the context manager returns the mock_batch_writer
         self.mock_provider_table.batch_writer.return_value.__enter__.return_value = self.mock_batch_writer
 
-        self.mock_config = MagicMock(spec=client._Config)  # noqa: SLF001 protected-access
+        self.mock_config = MagicMock(spec=_Config)  # noqa: SLF001 protected-access
         self.mock_config.provider_table = self.mock_provider_table
         self.mock_config.ssn_table = self.mock_ssn_table
 
-        self.client = client.DataClient(self.mock_config)
+        self.client = DataClient(self.mock_config)
 
     def test_get_provider_id_success(self):
         # Mock response from DynamoDB
@@ -68,29 +68,3 @@ def test_get_provider_not_found(self):
         # Verify it raises CCNotFoundException
         with self.assertRaises(CCNotFoundException):
             self.client.get_provider(compact='aslp', provider_id='test_id', detail=True, consistent_read=False)
-
-    @patch('cc_common.config._Config.current_standard_datetime', datetime.fromisoformat('2024-11-08T23:59:59+00:00'))
-    def test_data_client_deletes_records_if_exception_during_create_privilege_records(self):
-        # Set the side effect to raise ClientError on put_item
-        self.mock_batch_writer.put_item.side_effect = ClientError(
-            error_response={'Error': {'Code': 'InternalServerError', 'Message': 'DynamoDB Internal Server Error'}},
-            operation_name='PutItem',
-        )
-
-        with self.assertRaises(CCAwsServiceException):
-            self.client.create_provider_privileges(
-                compact_name='aslp',
-                provider_id='test_provider_id',
-                jurisdiction_postal_abbreviations=['CA'],
-                license_expiration_date=date.fromisoformat('2024-10-31'),
-                existing_privileges=[],
-                attestations=[],
-                compact_transaction_id='test_transaction_id',
-            )
-
-        self.mock_batch_writer.delete_item.assert_called_with(
-            Key={
-                'pk': 'aslp#PROVIDER#test_provider_id',
-                'sk': 'aslp#PROVIDER#privilege/ca#2024-11-08',
-            }
-        )
diff --git a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_paginated.py b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_paginated.py
index 86919b7d2..a8153f4e5 100644
--- a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_paginated.py
+++ b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_paginated.py
@@ -14,7 +14,7 @@ def setUp(self):  # noqa: N801 invalid-name
 
     def test_pagination_parameters(self):
         from cc_common.data_model.query_paginator import paginated_query
-        from cc_common.data_model.schema.provider import ProviderRecordSchema
+        from cc_common.data_model.schema import ProviderRecordSchema
 
         calls = []
 
@@ -63,7 +63,7 @@ def test_multiple_internal_pages(self):
         multiple times to fill out the requested page size.
         """
         from cc_common.data_model.query_paginator import paginated_query
-        from cc_common.data_model.schema.provider import ProviderRecordSchema
+        from cc_common.data_model.schema import ProviderRecordSchema
 
         calls = []
 
@@ -169,7 +169,7 @@ def get_something(*args, **kwargs):
 
     def test_no_pagination_parameters(self):
         from cc_common.data_model.query_paginator import paginated_query
-        from cc_common.data_model.schema.provider import ProviderRecordSchema
+        from cc_common.data_model.schema import ProviderRecordSchema
 
         calls = []
 
diff --git a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_base_record.py b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_base_record.py
index b32d9edb0..c0e8700ac 100644
--- a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_base_record.py
+++ b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_base_record.py
@@ -5,10 +5,8 @@
 
 class TestRegistration(TstLambdas):
     def test_license_privilege_lookup(self):
+        from cc_common.data_model.schema import LicenseRecordSchema, PrivilegeRecordSchema, ProviderRecordSchema
         from cc_common.data_model.schema.base_record import BaseRecordSchema
-        from cc_common.data_model.schema.license import LicenseRecordSchema
-        from cc_common.data_model.schema.privilege import PrivilegeRecordSchema
-        from cc_common.data_model.schema.provider import ProviderRecordSchema
 
         with open('tests/resources/dynamo/privilege.json') as f:
             privilege_data = json.load(f)
diff --git a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_license.py b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_license.py
index e9d848dc4..c893624ca 100644
--- a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_license.py
+++ b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_license.py
@@ -1,5 +1,7 @@
 import json
-from uuid import UUID
+from datetime import UTC, datetime
+from unittest.mock import patch
+from uuid import UUID, uuid4
 
 from marshmallow import ValidationError
 
@@ -8,31 +10,31 @@
 
 class TestLicenseSchema(TstLambdas):
     def test_validate_post(self):
-        from cc_common.data_model.schema.license import LicensePostSchema
+        from cc_common.data_model.schema.license.api import LicensePostRequestSchema
 
         with open('tests/resources/api/license-post.json') as f:
-            LicensePostSchema().load({'compact': 'aslp', 'jurisdiction': 'oh', **json.load(f)})
+            LicensePostRequestSchema().load({'compact': 'aslp', 'jurisdiction': 'oh', **json.load(f)})
 
     def test_license_post_schema_maps_status_to_jurisdiction_status(self):
-        from cc_common.data_model.schema.license import LicenseIngestSchema
+        from cc_common.data_model.schema.license.ingest import LicenseIngestSchema
 
         with open('tests/resources/api/license-post.json') as f:
             result = LicenseIngestSchema().load({'compact': 'aslp', 'jurisdiction': 'oh', **json.load(f)})
             self.assertEqual('active', result['jurisdictionStatus'])
 
     def test_invalid_post(self):
-        from cc_common.data_model.schema.license import LicensePostSchema
+        from cc_common.data_model.schema.license.api import LicensePostRequestSchema
 
         with open('tests/resources/api/license-post.json') as f:
             license_data = json.load(f)
         license_data.pop('ssn')
 
         with self.assertRaises(ValidationError):
-            LicensePostSchema().load({'compact': 'aslp', 'jurisdiction': 'oh', **license_data})
+            LicensePostRequestSchema().load({'compact': 'aslp', 'jurisdiction': 'oh', **license_data})
 
     def test_serde_record(self):
         """Test round-trip serialization/deserialization of license records"""
-        from cc_common.data_model.schema.license import LicenseRecordSchema
+        from cc_common.data_model.schema import LicenseRecordSchema
 
         with open('tests/resources/dynamo/license.json') as f:
             expected_license = json.load(f)
@@ -54,7 +56,7 @@ def test_serde_record(self):
         self.assertEqual(expected_license, license_data)
 
     def test_invalid_record(self):
-        from cc_common.data_model.schema.license import LicenseRecordSchema
+        from cc_common.data_model.schema import LicenseRecordSchema
 
         with open('tests/resources/dynamo/license.json') as f:
             license_data = json.load(f)
@@ -67,7 +69,8 @@ def test_serialize(self):
         """Licenses are the only record that directly originate from external clients. We'll test their serialization
         as it comes from clients.
         """
-        from cc_common.data_model.schema.license import LicenseIngestSchema, LicenseRecordSchema
+        from cc_common.data_model.schema import LicenseRecordSchema
+        from cc_common.data_model.schema.license.ingest import LicenseIngestSchema
 
         with open('tests/resources/api/license-post.json') as f:
             license_data = LicenseIngestSchema().load({'compact': 'aslp', 'jurisdiction': 'oh', **json.load(f)})
@@ -88,7 +91,7 @@ def test_serialize(self):
         self.assertEqual(expected_license_record, license_record)
 
     def test_license_record_schema_sets_status_to_inactive_if_license_expired(self):
-        from cc_common.data_model.schema.license import LicenseRecordSchema
+        from cc_common.data_model.schema import LicenseRecordSchema
 
         with open('tests/resources/dynamo/license.json') as f:
             raw_license_data = json.load(f)
@@ -100,7 +103,7 @@ def test_license_record_schema_sets_status_to_inactive_if_license_expired(self):
         self.assertEqual('inactive', license_data['status'])
 
     def test_license_record_schema_sets_status_to_inactive_if_jurisdiction_status_inactive(self):
-        from cc_common.data_model.schema.license import LicenseRecordSchema
+        from cc_common.data_model.schema import LicenseRecordSchema
 
         with open('tests/resources/dynamo/license.json') as f:
             raw_license_data = json.load(f)
@@ -113,7 +116,7 @@ def test_license_record_schema_sets_status_to_inactive_if_jurisdiction_status_in
         self.assertEqual('inactive', license_data['status'])
 
     def test_license_record_schema_strips_status_during_serialization(self):
-        from cc_common.data_model.schema.license import LicenseRecordSchema
+        from cc_common.data_model.schema import LicenseRecordSchema
 
         with open('tests/resources/dynamo/license.json') as f:
             raw_license_data = json.load(f)
@@ -122,3 +125,83 @@ def test_license_record_schema_strips_status_during_serialization(self):
         license_data = schema.dump(schema.load(raw_license_data))
 
         self.assertNotIn('status', license_data)
+
+
+class TestLicenseUpdateRecordSchema(TstLambdas):
+    @patch('cc_common.config.datetime', autospec=True)
+    def test_load_dump(self, mock_datetime):
+        from cc_common.data_model.schema.license.record import LicenseUpdateRecordSchema
+
+        # We want to inspect how time-based fields are serialized in this schema, so we'll have to mock datetime.now
+        # for predictable results
+        mock_datetime.now.return_value = datetime(2020, 4, 7, 12, 59, 59, tzinfo=UTC)
+
+        schema = LicenseUpdateRecordSchema()
+
+        with open('tests/resources/dynamo/license-update.json') as f:
+            record = json.load(f)
+
+        loaded_record = schema.load(record)
+
+        dumped_record = schema.dump(loaded_record)
+
+        # Round-trip SERDE with a fixed timestamp demonstrates that our sk generation is deterministic for the same
+        # input values, which is an important property for this schema.
+        self.maxDiff = None
+        self.assertEqual(record, dumped_record)
+
+    def test_hash_is_deterministic(self):
+        """
+        Verify that our change hash is consistent for the same previous/updatedValues
+        """
+        from cc_common.data_model.schema.license.record import LicenseUpdateRecordSchema
+
+        schema = LicenseUpdateRecordSchema()
+
+        with open('tests/resources/dynamo/license-update.json') as f:
+            record = json.load(f)
+
+        loaded_record = schema.load(record)
+        change_hash = schema.hash_changes(schema.dump(loaded_record))
+
+        alternate_record = schema.dump(
+            {
+                'type': 'licenseUpdate',
+                'providerId': uuid4(),
+                'compact': 'different',
+                'jurisdiction': 'different',
+                # These two fields should determine the change hash:
+                'previous': loaded_record['previous'].copy(),
+                'updatedValues': loaded_record['updatedValues'].copy(),
+            }
+        )
+        self.assertEqual(change_hash, schema.hash_changes(alternate_record))
+
+    def test_hash_is_unique(self):
+        """
+        Verify that our change hash is unique for the different previous/updatedValues
+        """
+        from cc_common.data_model.schema.license.record import LicenseUpdateRecordSchema
+
+        schema = LicenseUpdateRecordSchema()
+
+        with open('tests/resources/dynamo/license-update.json') as f:
+            record = json.load(f)
+
+        loaded_record = schema.load(record)
+        change_hash = schema.hash_changes(schema.dump(loaded_record))
+
+        alternate_record = {
+            'type': 'licenseUpdate',
+            'providerId': uuid4(),
+            'compact': 'different',
+            'jurisdiction': 'different',
+            # These two fields should determine the change hash:
+            'previous': loaded_record['previous'].copy(),
+            'updatedValues': loaded_record['updatedValues'].copy(),
+        }
+        # Change one value in the previous values
+        alternate_record['previous']['dateOfUpdate'] = datetime(2020, 6, 7, 12, 59, 59, tzinfo=UTC)
+
+        # The hashes should now be different
+        self.assertNotEqual(change_hash, schema.hash_changes(schema.dump(alternate_record)))
diff --git a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_military_affiliation.py b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_military_affiliation.py
index 2869a05aa..b36e136c4 100644
--- a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_military_affiliation.py
+++ b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_military_affiliation.py
@@ -8,7 +8,7 @@
 class TestMilitaryAffiliationRecordSchema(TstLambdas):
     def test_serde(self):
         """Test round-trip deserialization/serialization"""
-        from cc_common.data_model.schema.military_affiliation import MilitaryAffiliationRecordSchema
+        from cc_common.data_model.schema.military_affiliation.record import MilitaryAffiliationRecordSchema
 
         with open('tests/resources/dynamo/military-affiliation.json') as f:
             expected_military_affiliation = json.load(f)
@@ -25,7 +25,7 @@ def test_serde(self):
         self.assertEqual(expected_military_affiliation, military_affiliation_data)
 
     def test_invalid(self):
-        from cc_common.data_model.schema.military_affiliation import MilitaryAffiliationRecordSchema
+        from cc_common.data_model.schema.military_affiliation.record import MilitaryAffiliationRecordSchema
 
         with open('tests/resources/dynamo/military-affiliation.json') as f:
             military_affiliation_data = json.load(f)
diff --git a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_privilege.py b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_privilege.py
index d2cce087a..c4e7d0f99 100644
--- a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_privilege.py
+++ b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_privilege.py
@@ -8,7 +8,7 @@
 class TestPrivilegeRecordSchema(TstLambdas):
     def test_serde(self):
         """Test round-trip deserialization/serialization"""
-        from cc_common.data_model.schema.privilege import PrivilegeRecordSchema
+        from cc_common.data_model.schema import PrivilegeRecordSchema
 
         with open('tests/resources/dynamo/privilege.json') as f:
             expected_privilege = json.load(f)
@@ -29,7 +29,7 @@ def test_serde(self):
         self.assertEqual(privilege_data, expected_privilege)
 
     def test_invalid(self):
-        from cc_common.data_model.schema.privilege import PrivilegeRecordSchema
+        from cc_common.data_model.schema import PrivilegeRecordSchema
 
         with open('tests/resources/dynamo/privilege.json') as f:
             privilege_data = json.load(f)
@@ -39,7 +39,7 @@ def test_invalid(self):
             PrivilegeRecordSchema().load(privilege_data)
 
     def test_status_is_set_to_inactive_when_past_expiration(self):
-        from cc_common.data_model.schema.privilege import PrivilegeRecordSchema
+        from cc_common.data_model.schema import PrivilegeRecordSchema
 
         with open('tests/resources/dynamo/privilege.json') as f:
             privilege_data = json.load(f)
@@ -50,7 +50,7 @@ def test_status_is_set_to_inactive_when_past_expiration(self):
         self.assertEqual(result['status'], 'inactive')
 
     def test_status_is_set_to_active_when_not_past_expiration(self):
-        from cc_common.data_model.schema.privilege import PrivilegeRecordSchema
+        from cc_common.data_model.schema import PrivilegeRecordSchema
 
         with open('tests/resources/dynamo/privilege.json') as f:
             privilege_data = json.load(f)
diff --git a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_provider.py b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_provider.py
index b2ce0ba62..eb5436781 100644
--- a/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_provider.py
+++ b/backend/compact-connect/lambdas/python/common/tests/unit/test_data_model/test_schema/test_provider.py
@@ -8,7 +8,7 @@
 class TestProviderRecordSchema(TstLambdas):
     def test_serde(self):
         """Test round-trip deserialization/serialization"""
-        from cc_common.data_model.schema.provider import ProviderRecordSchema
+        from cc_common.data_model.schema import ProviderRecordSchema
 
         with open('tests/resources/dynamo/provider.json') as f:
             expected_provider_record = json.load(f)
@@ -33,7 +33,7 @@ def test_serde(self):
         self.assertEqual(expected_provider_record, license_record)
 
     def test_invalid(self):
-        from cc_common.data_model.schema.provider import ProviderRecordSchema
+        from cc_common.data_model.schema import ProviderRecordSchema
 
         with open('tests/resources/dynamo/provider.json') as f:
             license_data = json.load(f)
@@ -44,7 +44,7 @@ def test_invalid(self):
 
     def test_provider_record_schema_sets_status_to_inactive_if_license_expired(self):
         """Test round-trip serialization/deserialization of license records"""
-        from cc_common.data_model.schema.provider import ProviderRecordSchema
+        from cc_common.data_model.schema import ProviderRecordSchema
 
         with open('tests/resources/dynamo/provider.json') as f:
             raw_provider_data = json.load(f)
@@ -57,7 +57,7 @@ def test_provider_record_schema_sets_status_to_inactive_if_license_expired(self)
 
     def test_provider_record_schema_sets_status_to_inactive_if_jurisdiction_status_inactive(self):
         """Test round-trip serialization/deserialization of license records"""
-        from cc_common.data_model.schema.provider import ProviderRecordSchema
+        from cc_common.data_model.schema import ProviderRecordSchema
 
         with open('tests/resources/dynamo/provider.json') as f:
             raw_provider_data = json.load(f)
diff --git a/backend/compact-connect/lambdas/python/common/tests/unit/test_sanitize_provider_data.py b/backend/compact-connect/lambdas/python/common/tests/unit/test_sanitize_provider_data.py
index b0b05969a..e810de8ff 100644
--- a/backend/compact-connect/lambdas/python/common/tests/unit/test_sanitize_provider_data.py
+++ b/backend/compact-connect/lambdas/python/common/tests/unit/test_sanitize_provider_data.py
@@ -32,37 +32,44 @@ def test_full_provider_record_returned_if_caller_has_read_private_permissions_fo
         )
 
     def when_testing_general_provider_info_returned(self, scopes: set[str]):
-        from cc_common.data_model.schema.provider import SanitizedProviderReadGeneralSchema
+        from cc_common.data_model.schema.provider.api import ProviderGeneralResponseSchema
         from cc_common.utils import sanitize_provider_data_based_on_caller_scopes
 
         with open('tests/resources/api/provider-detail-response.json') as f:
             full_provider = json.load(f)
-            expected_provider = full_provider.copy()
-            mock_ssn = full_provider['ssn']
-            mock_dob = full_provider['dateOfBirth']
-            mock_doc_keys = full_provider['militaryAffiliations'][0]['documentKeys']
-            # simplest way to set up mock test user as returned from the db
-            loaded_provider = SanitizedProviderReadGeneralSchema().load(full_provider)
-            loaded_provider['ssn'] = mock_ssn
-            loaded_provider['dateOfBirth'] = mock_dob
-            loaded_provider['militaryAffiliations'][0]['documentKeys'] = mock_doc_keys
-            loaded_provider['licenses'][0]['ssn'] = mock_ssn
-            loaded_provider['licenses'][0]['dateOfBirth'] = mock_dob
+            # Re-read data from file to have an independent second copy
+            f.seek(0)
+            expected_provider = json.load(f)
+        mock_ssn = full_provider['ssn']
+        mock_dob = full_provider['dateOfBirth']
+        mock_doc_keys = full_provider['militaryAffiliations'][0]['documentKeys']
+        # simplest way to set up mock test user as returned from the db
+        loaded_provider = ProviderGeneralResponseSchema().load(full_provider)
+        loaded_provider['ssn'] = mock_ssn
+        loaded_provider['dateOfBirth'] = mock_dob
+        loaded_provider['militaryAffiliations'][0]['documentKeys'] = mock_doc_keys
+        loaded_provider['licenses'][0]['ssn'] = mock_ssn
+        loaded_provider['licenses'][0]['dateOfBirth'] = mock_dob
+        loaded_provider['licenses'][0]['history'][0]['previous']['ssn'] = mock_ssn
+        loaded_provider['licenses'][0]['history'][0]['previous']['dateOfBirth'] = mock_dob
 
         # test provider has a license in oh and privilege in ne
         resp = sanitize_provider_data_based_on_caller_scopes(compact='aslp', provider=loaded_provider, scopes=scopes)
 
         # now create expected provider record with the ssn and dob removed
-        expected_provider.pop('ssn')
-        expected_provider.pop('dateOfBirth')
+        del expected_provider['ssn']
+        del expected_provider['dateOfBirth']
         # we do not return the military affiliation document keys if the caller does not have read private scope
-        expected_provider['militaryAffiliations'][0].pop('documentKeys')
+        del expected_provider['militaryAffiliations'][0]['documentKeys']
         # also remove the ssn from the license record
-        expected_provider['licenses'][0].pop('ssn')
-        expected_provider['licenses'][0].pop('dateOfBirth')
+        del expected_provider['licenses'][0]['ssn']
+        del expected_provider['licenses'][0]['dateOfBirth']
+        del expected_provider['licenses'][0]['history'][0]['previous']['ssn']
+        del expected_provider['licenses'][0]['history'][0]['previous']['dateOfBirth']
         # cast to set to match schema
         expected_provider['privilegeJurisdictions'] = set(expected_provider['privilegeJurisdictions'])
 
+        self.maxDiff = None
         self.assertEqual(expected_provider, resp)
 
     def test_sanitized_provider_record_returned_if_caller_does_not_have_read_private_permissions_for_jurisdiction(self):
diff --git a/backend/compact-connect/lambdas/python/custom-resources/handlers/compact_config_uploader.py b/backend/compact-connect/lambdas/python/custom-resources/handlers/compact_config_uploader.py
index fa99322f8..c432281e4 100755
--- a/backend/compact-connect/lambdas/python/custom-resources/handlers/compact_config_uploader.py
+++ b/backend/compact-connect/lambdas/python/custom-resources/handlers/compact_config_uploader.py
@@ -5,8 +5,8 @@
 from aws_lambda_powertools.utilities.typing import LambdaContext
 from cc_common.config import config, logger
 from cc_common.data_model.schema.attestation import AttestationRecordSchema
-from cc_common.data_model.schema.compact import CompactRecordSchema
-from cc_common.data_model.schema.jurisdiction import JurisdictionRecordSchema
+from cc_common.data_model.schema.compact.record import CompactRecordSchema
+from cc_common.data_model.schema.jurisdiction.record import JurisdictionRecordSchema
 from cc_common.exceptions import CCNotFoundException
 
 
diff --git a/backend/compact-connect/lambdas/python/data-events/handlers/data_events.py b/backend/compact-connect/lambdas/python/data-events/handlers/data_events.py
index 86bacba82..6e7feaf14 100644
--- a/backend/compact-connect/lambdas/python/data-events/handlers/data_events.py
+++ b/backend/compact-connect/lambdas/python/data-events/handlers/data_events.py
@@ -1,7 +1,7 @@
 from datetime import UTC, datetime
 
 from cc_common.config import config, logger
-from cc_common.data_model.schema.license import SanitizedLicenseIngestDataEventSchema
+from cc_common.data_model.schema.license.ingest import SanitizedLicenseIngestDataEventSchema
 from cc_common.utils import sqs_handler
 
 
diff --git a/backend/compact-connect/lambdas/python/data-events/tests/function/test_handlers.py b/backend/compact-connect/lambdas/python/data-events/tests/function/test_handlers.py
index 99c62dea1..fa11ddd1a 100644
--- a/backend/compact-connect/lambdas/python/data-events/tests/function/test_handlers.py
+++ b/backend/compact-connect/lambdas/python/data-events/tests/function/test_handlers.py
@@ -69,9 +69,9 @@ def test_handle_data_event_sanitizes_license_ingest_events(self):
                 'licenseType': 'speech-language pathologist',
                 'jurisdiction': 'oh',
                 'status': 'active',
-                'dateOfIssuance': '2024-06-06',
-                'dateOfRenewal': '2024-06-06',
-                'dateOfExpiration': '2050-06-06',
+                'dateOfExpiration': '2025-04-04',
+                'dateOfIssuance': '2010-06-06',
+                'dateOfRenewal': '2020-04-04',
             },
             saved_event,
         )
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/__init__.py b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/__init__.py
index f1edcd8c3..e1969b777 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/__init__.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/__init__.py
@@ -20,9 +20,10 @@ def get_provider_information(compact: str, provider_id: str) -> dict:
         raise CCInternalException('Unexpected provider data')
 
     provider = None
-    privileges = []
-    licenses = []
+    privileges = {}
+    licenses = {}
     military_affiliations = []
+
     for record in provider_data['items']:
         match record['type']:
             case 'provider':
@@ -30,19 +31,31 @@ def get_provider_information(compact: str, provider_id: str) -> dict:
                 provider = record
             case 'license':
                 logger.debug('Identified license record', provider_id=provider_id)
-                licenses.append(record)
+                licenses[record['jurisdiction']] = record
+                licenses[record['jurisdiction']].setdefault('history', [])
             case 'privilege':
                 logger.debug('Identified privilege record', provider_id=provider_id)
-                privileges.append(record)
+                privileges[record['jurisdiction']] = record
+                privileges[record['jurisdiction']].setdefault('history', [])
             case 'militaryAffiliation':
                 logger.debug('Identified military affiliation record', provider_id=provider_id)
                 military_affiliations.append(record)
 
+    # Process update records after all base records have been identified
+    for record in provider_data['items']:
+        match record['type']:
+            case 'licenseUpdate':
+                logger.debug('Identified license update record', provider_id=provider_id)
+                licenses[record['jurisdiction']]['history'].append(record)
+            case 'privilegeUpdate':
+                logger.debug('Identified privilege update record', provider_id=provider_id)
+                privileges[record['jurisdiction']]['history'].append(record)
+
     if provider is None:
         logger.error("Failed to find a provider's primary record!", provider_id=provider_id)
         raise CCInternalException('Unexpected provider data')
 
-    provider['licenses'] = licenses
-    provider['privileges'] = privileges
+    provider['licenses'] = list(licenses.values())
+    provider['privileges'] = list(privileges.values())
     provider['militaryAffiliations'] = military_affiliations
     return provider
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/bulk_upload.py b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/bulk_upload.py
index 943d5b1e5..0703cd305 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/bulk_upload.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/bulk_upload.py
@@ -7,7 +7,7 @@
 from botocore.exceptions import ClientError
 from botocore.response import StreamingBody
 from cc_common.config import config, logger
-from cc_common.data_model.schema.license import LicensePostSchema, LicenseReadGeneralSchema
+from cc_common.data_model.schema.license.api import LicenseGeneralResponseSchema, LicensePostRequestSchema
 from cc_common.exceptions import CCInternalException
 from cc_common.utils import ResponseEncoder, api_handler, authorize_compact_jurisdiction
 from event_batch_writer import EventBatchWriter
@@ -114,8 +114,8 @@ def process_bulk_upload_file(
     """
     Stream each line of the new CSV file, validating it then publishing an ingest event for each line.
     """
-    general_schema = LicenseReadGeneralSchema()
-    schema = LicensePostSchema()
+    general_schema = LicenseGeneralResponseSchema()
+    schema = LicensePostRequestSchema()
     reader = LicenseCSVReader()
 
     stream = TextIOWrapper(body, encoding='utf-8')
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/ingest.py b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/ingest.py
index 3ab44e67e..280d8f591 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/ingest.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/ingest.py
@@ -2,12 +2,15 @@
 
 from boto3.dynamodb.types import TypeSerializer
 from cc_common.config import config, logger
-from cc_common.data_model.schema.license import LicenseIngestSchema, LicenseRecordSchema
-from cc_common.data_model.schema.provider import ProviderRecordSchema
+from cc_common.data_model.schema import LicenseRecordSchema, ProviderRecordSchema
+from cc_common.data_model.schema.common import Status, UpdateCategory
+from cc_common.data_model.schema.license.ingest import LicenseIngestSchema
+from cc_common.data_model.schema.license.record import LicenseUpdateRecordSchema
 from cc_common.exceptions import CCNotFoundException
 from cc_common.utils import sqs_handler
 
 license_schema = LicenseIngestSchema()
+license_update_schema = LicenseUpdateRecordSchema()
 
 
 @sqs_handler
@@ -24,7 +27,7 @@ def ingest_license_message(message: dict):
     jurisdiction = license_post['jurisdiction']
 
     provider_id = config.data_client.get_or_create_provider_id(compact=compact, ssn=license_post['ssn'])
-    logger.info('Updating license data', provider_id=provider_id, compact=compact, jurisdiction=jurisdiction)
+    logger.info('Ingesting license data', provider_id=provider_id, compact=compact, jurisdiction=jurisdiction)
 
     # Start preparing our db transactions
     dynamo_transactions = [
@@ -65,11 +68,19 @@ def ingest_license_message(message: dict):
     # If at least one active: last issued active license
     # If all inactive: last issued inactive license
     # Set (or replace) the posted license for its jurisdiction
+    existing_license = licenses.get(license_post['jurisdiction'])
+    if existing_license is not None:
+        _process_license_update(
+            existing_license=existing_license,
+            new_license=license_post,
+            dynamo_transactions=dynamo_transactions,
+        )
     licenses[license_post['jurisdiction']] = license_post
-    best_license = find_best_license(licenses.values())
+    best_license = _find_best_license(licenses.values())
     if best_license is license_post:
-        logger.info('Updating provider data', provider_id=provider_id, compact=compact)
-        provider_record = populate_provider_record(
+        logger.info('Updating provider data', provider_id=provider_id, compact=compact, jurisdiction=jurisdiction)
+
+        provider_record = _populate_provider_record(
             provider_id=provider_id,
             license_post=license_post,
             privilege_jurisdictions=privilege_jurisdictions,
@@ -81,7 +92,7 @@ def ingest_license_message(message: dict):
     config.dynamodb_client.transact_write_items(TransactItems=dynamo_transactions)
 
 
-def populate_provider_record(*, provider_id: str, license_post: dict, privilege_jurisdictions: set) -> dict:
+def _populate_provider_record(*, provider_id: str, license_post: dict, privilege_jurisdictions: set) -> dict:
     dynamodb_serializer = TypeSerializer()
     return dynamodb_serializer.serialize(
         ProviderRecordSchema().dump(
@@ -97,7 +108,76 @@ def populate_provider_record(*, provider_id: str, license_post: dict, privilege_
     )['M']
 
 
-def find_best_license(all_licenses: Iterable) -> dict:
+def _process_license_update(*, existing_license: dict, new_license: dict, dynamo_transactions: list):
+    """
+    Examine the differences between existing_license and new_license, categorize the change, and add
+    a licenseUpdate record to the transaction if appropriate.
+    :param dict existing_license: The existing license record
+    :param dict new_license: The newly-uploaded license record
+    :param list dynamo_transactions: The dynamodb transaction array to append records to
+    """
+    # dateOfUpdate won't show up as a change because the field isn't in new_license, yet
+    updated_values = {
+        key: value
+        for key, value in new_license.items()
+        if key not in existing_license.keys() or value != existing_license[key]
+    }
+    # If any fields are missing from the new license, other than ones we add later, we'll consider them removed
+    removed_values = (existing_license.keys() - new_license.keys()) - {'type', 'providerId', 'status', 'dateOfUpdate'}
+    if not updated_values and not removed_values:
+        return
+    # Categorize the update
+    update_record = _populate_update_record(
+        existing_license=existing_license, updated_values=updated_values, removed_values=removed_values
+    )
+    dynamo_transactions.append({'Put': {'TableName': config.provider_table_name, 'Item': update_record}})
+
+
+def _populate_update_record(*, existing_license: dict, updated_values: dict, removed_values: dict) -> dict:
+    """
+    Categorize the update between existing and new license records.
+    :param dict existing_license: The existing license record
+    :param dict new_license: The newly-uploaded license record
+    :return: The update type, one of 'update', 'revoke', or 'reinstate'
+    """
+    logger.info(
+        'Processing license update',
+        provider_id=existing_license['providerId'],
+        compact=existing_license['compact'],
+        jurisdiction=existing_license['jurisdiction'],
+    )
+    update_type = None
+    if {'dateOfExpiration', 'dateOfRenewal'} == updated_values.keys():
+        original_values = {key: value for key, value in existing_license.items() if key in updated_values}
+        if (
+            updated_values['dateOfExpiration'] > original_values['dateOfExpiration']
+            and updated_values['dateOfRenewal'] > original_values['dateOfRenewal']
+        ):
+            update_type = UpdateCategory.RENEWAL
+    elif updated_values == {'jurisdictionStatus': Status.INACTIVE}:
+        update_type = UpdateCategory.DEACTIVATION
+    if update_type is None:
+        update_type = UpdateCategory.OTHER
+
+    dynamodb_serializer = TypeSerializer()
+    return dynamodb_serializer.serialize(
+        license_update_schema.dump(
+            {
+                'type': 'licenseUpdate',
+                'updateType': update_type,
+                'providerId': existing_license['providerId'],
+                'compact': existing_license['compact'],
+                'jurisdiction': existing_license['jurisdiction'],
+                'previous': existing_license,
+                'updatedValues': updated_values,
+                # We'll only include the removed values field if there are some
+                **({'removedValues': sorted(removed_values)} if removed_values else {}),
+            }
+        )
+    )['M']
+
+
+def _find_best_license(all_licenses: Iterable) -> dict:
     # Last issued active license, if there are any active licenses
     latest_active_licenses = sorted(
         [license_data for license_data in all_licenses if license_data['jurisdictionStatus'] == 'active'],
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/licenses.py b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/licenses.py
index 4c001ea60..77c5f97f4 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/licenses.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/licenses.py
@@ -3,13 +3,13 @@
 
 from aws_lambda_powertools.utilities.typing import LambdaContext
 from cc_common.config import config, logger
-from cc_common.data_model.schema.license import LicensePostSchema
+from cc_common.data_model.schema.license.api import LicensePostRequestSchema
 from cc_common.exceptions import CCInternalException, CCInvalidRequestException
 from cc_common.utils import api_handler, authorize_compact_jurisdiction
 from event_batch_writer import EventBatchWriter
 from marshmallow import ValidationError
 
-schema = LicensePostSchema()
+schema = LicensePostRequestSchema()
 
 
 @api_handler
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/provider_users.py b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/provider_users.py
index 3a4b412d0..1dfe1338b 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/provider_users.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/provider_users.py
@@ -6,10 +6,10 @@
 from cc_common.data_model.schema.military_affiliation import (
     MILITARY_AFFILIATIONS_DOCUMENT_TYPE_KEY_NAME,
     SUPPORTED_MILITARY_AFFILIATION_FILE_EXTENSIONS,
-    MilitaryAffiliationRecordSchema,
     MilitaryAffiliationType,
-    PostMilitaryAffiliationResponseSchema,
 )
+from cc_common.data_model.schema.military_affiliation.api import PostMilitaryAffiliationResponseSchema
+from cc_common.data_model.schema.military_affiliation.record import MilitaryAffiliationRecordSchema
 from cc_common.exceptions import CCInternalException, CCInvalidRequestException, CCNotFoundException
 from cc_common.utils import api_handler
 
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/providers.py b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/providers.py
index f0dda366d..c8b0bc495 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/providers.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/providers.py
@@ -2,7 +2,7 @@
 
 from aws_lambda_powertools.utilities.typing import LambdaContext
 from cc_common.config import config, logger
-from cc_common.data_model.schema.provider import SanitizedProviderReadGeneralSchema
+from cc_common.data_model.schema.provider.api import ProviderGeneralResponseSchema
 from cc_common.exceptions import CCInvalidRequestException
 from cc_common.utils import (
     api_handler,
@@ -93,7 +93,7 @@ def query_providers(event: dict, context: LambdaContext):  # noqa: ARG001 unused
     # Convert generic field to more specific one for this API and sanitize data
     pre_sanitized_providers = resp.pop('items', [])
     # for the query endpoint, we only return generally available data, regardless of the caller's scopes
-    general_schema = SanitizedProviderReadGeneralSchema()
+    general_schema = ProviderGeneralResponseSchema()
     sanitized_providers = [general_schema.dump(provider) for provider in pre_sanitized_providers]
 
     resp['providers'] = sanitized_providers
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/license_csv_reader.py b/backend/compact-connect/lambdas/python/provider-data-v1/license_csv_reader.py
index 84c5a2226..380c3e178 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/license_csv_reader.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/license_csv_reader.py
@@ -2,12 +2,12 @@
 from csv import DictReader
 from io import TextIOBase
 
-from cc_common.data_model.schema.license import LicensePostSchema
+from cc_common.data_model.schema.license.api import LicensePostRequestSchema
 
 
 class LicenseCSVReader:
     def __init__(self):
-        self.schema = LicensePostSchema()
+        self.schema = LicensePostRequestSchema()
 
     def licenses(self, stream: TextIOBase) -> Generator[dict, None, None]:
         reader = DictReader(stream, restkey='invalid', dialect='excel', strict=True)
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py
index 0b2554705..80c26b7c5 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/__init__.py
@@ -128,7 +128,7 @@ def _generate_providers(self, *, home: str, privilege: str, start_serial: int, n
         :param privilege: The jurisdiction for the privilege
         :param start_serial: Starting number for last portion of the provider's SSN
         """
-        from cc_common.data_model.client import DataClient
+        from cc_common.data_model.data_client import DataClient
         from handlers.ingest import ingest_license_message
 
         with open('../common/tests/resources/ingest/message.json') as f:
@@ -173,9 +173,11 @@ def _generate_providers(self, *, home: str, privilege: str, start_serial: int, n
                 )
             # Add a privilege
             provider_id = data_client.get_provider_id(compact='aslp', ssn=ssn)
+            provider_record = data_client.get_provider(compact='aslp', provider_id=provider_id, detail=False)
             data_client.create_provider_privileges(
-                compact_name='aslp',
+                compact='aslp',
                 provider_id=provider_id,
+                provider_record=provider_record,
                 jurisdiction_postal_abbreviations=[privilege],
                 license_expiration_date=date(2050, 6, 6),
                 compact_transaction_id='1234567890',
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_client.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_client.py
index bf4ee30ef..c6462516a 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_client.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_client.py
@@ -10,7 +10,7 @@
 @mock_aws
 class TestClient(TstFunction):
     def test_get_provider_id(self):
-        from cc_common.data_model.client import DataClient
+        from cc_common.data_model.data_client import DataClient
 
         with open('../common/tests/resources/dynamo/provider-ssn.json') as f:
             record = json.load(f)
@@ -30,7 +30,7 @@ def test_get_provider_id(self):
 
     def test_get_provider_id_not_found(self):
         """Provider ID not found should raise an exception"""
-        from cc_common.data_model.client import DataClient
+        from cc_common.data_model.data_client import DataClient
         from cc_common.exceptions import CCNotFoundException
 
         client = DataClient(self.config)
@@ -40,7 +40,7 @@ def test_get_provider_id_not_found(self):
             client.get_provider_id(compact='aslp', ssn='321-21-4321')
 
     def test_get_provider(self):
-        from cc_common.data_model.client import DataClient
+        from cc_common.data_model.data_client import DataClient
 
         provider_id = self._load_provider_data()
 
@@ -59,7 +59,7 @@ def test_get_provider_garbage_in_db(self):
         data into our database, we'll specifically validate data coming _out_ of the database
         and throw an error if it doesn't look as expected.
         """
-        from cc_common.data_model.client import DataClient
+        from cc_common.data_model.data_client import DataClient
         from cc_common.exceptions import CCInternalException
 
         provider_id = self._load_provider_data()
@@ -85,7 +85,7 @@ def test_get_provider_garbage_in_db(self):
             )
 
     def test_get_providers_sorted_by_family_name(self):
-        from cc_common.data_model.client import DataClient
+        from cc_common.data_model.data_client import DataClient
 
         self._generate_providers(home='oh', privilege='ne', start_serial=9999)
         self._generate_providers(home='ne', privilege='oh', start_serial=9989)
@@ -122,7 +122,7 @@ def test_get_providers_sorted_by_family_name(self):
         self.assertListEqual(sorted(family_names, key=quote), family_names)
 
     def test_get_providers_sorted_by_family_name_descending(self):
-        from cc_common.data_model.client import DataClient
+        from cc_common.data_model.data_client import DataClient
 
         self._generate_providers(home='oh', privilege='ne', start_serial=9999)
         client = DataClient(self.config)
@@ -139,7 +139,7 @@ def test_get_providers_sorted_by_family_name_descending(self):
         self.assertListEqual(sorted(family_names, key=quote, reverse=True), family_names)
 
     def test_get_providers_by_family_name(self):
-        from cc_common.data_model.client import DataClient
+        from cc_common.data_model.data_client import DataClient
 
         # We'll provide names, so we know we'll have one record for our friends, Tess and Ted Testerly
         self._generate_providers(
@@ -166,7 +166,7 @@ def test_get_providers_by_family_name(self):
             self.assertEqual('Testerly', provider['familyName'])
 
     def test_get_providers_by_family_and_given_name(self):
-        from cc_common.data_model.client import DataClient
+        from cc_common.data_model.data_client import DataClient
 
         # We'll provide names, so we know we'll have one record for our friends, Tess and Ted Testerly
         self._generate_providers(
@@ -194,7 +194,7 @@ def test_get_providers_by_family_and_given_name(self):
         self.assertEqual('Testerly', resp['items'][0]['familyName'])
 
     def test_get_providers_sorted_by_date_updated(self):
-        from cc_common.data_model.client import DataClient
+        from cc_common.data_model.data_client import DataClient
 
         self._generate_providers(home='oh', privilege='ne', start_serial=9999)
         self._generate_providers(home='ne', privilege='oh', start_serial=9989)
@@ -231,7 +231,7 @@ def test_get_providers_sorted_by_date_updated(self):
         self.assertListEqual(sorted(dates_of_update), dates_of_update)
 
     def test_get_providers_sorted_by_date_of_update_descending(self):
-        from cc_common.data_model.client import DataClient
+        from cc_common.data_model.data_client import DataClient
 
         self._generate_providers(home='oh', privilege='ne', start_serial=9999)
         client = DataClient(self.config)
@@ -271,7 +271,7 @@ def _get_military_affiliation_records(self, provider_id: str) -> list[dict]:
         )['Items']
 
     def test_complete_military_affiliation_initialization_sets_expected_status(self):
-        from cc_common.data_model.client import DataClient
+        from cc_common.data_model.data_client import DataClient
 
         # Here we are testing an edge case where there are two military affiliation records
         # both in an initializing state. This could happen in the event of a failed file upload.
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py
index d48f3f0e2..d93f622c9 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_data_model/test_provider_transformations.py
@@ -71,7 +71,7 @@ def test_transformations(self):
         # This should fully ingest the license, which will result in it being written to the DB
         ingest_license_message(event, self.mock_context)
 
-        from cc_common.data_model.client import DataClient
+        from cc_common.data_model.data_client import DataClient
 
         # We'll use the data client to get the resulting provider id
         client = DataClient(self.config)
@@ -80,14 +80,16 @@ def test_transformations(self):
             ssn=license_ssn,
         )
         self.assertEqual(expected_provider_id, provider_id)
+        provider_record = client.get_provider(compact='aslp', provider_id=provider_id, detail=False)
 
         # Add a privilege to practice in Nebraska
         client.create_provider_privileges(
-            compact_name='aslp',
+            compact='aslp',
             provider_id=provider_id,
+            provider_record=provider_record,
             # using values in expected privilege json file
             jurisdiction_postal_abbreviations=['ne'],
-            license_expiration_date=date(2050, 6, 6),
+            license_expiration_date=date(2025, 4, 4),
             compact_transaction_id='1234567890',
             existing_privileges=[],
             attestations=[{'attestationId': 'jurisprudence-confirmation', 'version': '1'}],
@@ -102,7 +104,7 @@ def test_transformations(self):
             affiliation_type=MilitaryAffiliationType.MILITARY_MEMBER,
             file_names=['military-waiver.pdf'],
             document_keys=[
-                '/provider/<provider_id>/document-type/military-affiliations/2024-07-08/1234#military-waiver.pdf'
+                f'/provider/{provider_id}/document-type/military-affiliations/2024-07-08/1234#military-waiver.pdf'
             ],
         )
 
@@ -112,7 +114,7 @@ def test_transformations(self):
             KeyConditionExpression=Key('pk').eq(f'aslp#PROVIDER#{provider_id}')
             & Key('sk').begins_with('aslp#PROVIDER'),
         )
-        # One record for reach of: provider, license, privilege, militaryAffiliation
+        # One record for each of: provider, license, privilege, militaryAffiliation
         self.assertEqual(4, len(resp['Items']))
         records = {item['type']: item for item in resp['Items']}
 
@@ -201,5 +203,10 @@ def test_transformations(self):
         del expected_provider['militaryAffiliations'][0]['dateOfUpload']
         del expected_provider['militaryAffiliations'][0]['dateOfUpdate']
 
+        # This lengthy test does not include change records for licenses or privileges, so we'll blank out the
+        # sample history from our expected_provider
+        expected_provider['licenses'][0]['history'] = []
+        expected_provider['privileges'][0]['history'] = []
+
         # Phew! We've loaded the data all the way in via the ingest chain and back out via the API!
         self.assertEqual(expected_provider, provider_data)
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_ingest.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_ingest.py
index 190ca6d93..3007aea07 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_ingest.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_ingest.py
@@ -7,60 +7,52 @@
 
 @mock_aws
 class TestIngest(TstFunction):
-    def test_new_provider_ingest(self):
+    def _with_ingested_license(self, omit_email: bool = False) -> str:
         from handlers.ingest import ingest_license_message
-        from handlers.providers import query_providers
+
+        with open('../common/tests/resources/dynamo/provider-ssn.json') as f:
+            ssn_record = json.load(f)
+
+        self._ssn_table.put_item(Item=ssn_record)
+        provider_id = ssn_record['providerId']
 
         with open('../common/tests/resources/ingest/message.json') as f:
-            message = f.read()
+            message = json.load(f)
 
-        event = {'Records': [{'messageId': '123', 'body': message}]}
+        if omit_email:
+            del message['detail']['emailAddress']
 
+        # Upload a new license
+        event = {'Records': [{'messageId': '123', 'body': json.dumps(message)}]}
         resp = ingest_license_message(event, self.mock_context)
-
         self.assertEqual({'batchItemFailures': []}, resp)
 
+        return provider_id
+
+    def _get_provider_via_api(self, provider_id: str) -> dict:
+        from handlers.providers import get_provider
+
         # To test full internal consistency, we'll also pull this new license record out
         # via the API to make sure it shows up as expected.
         with open('../common/tests/resources/api-event.json') as f:
             event = json.load(f)
 
-        event['pathParameters'] = {'compact': 'aslp'}
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/readGeneral'
-        event['body'] = json.dumps({'query': {'ssn': '123-12-1234'}})
-        resp = query_providers(event, self.mock_context)
+        event['pathParameters'] = {'compact': 'aslp', 'providerId': provider_id}
+        event['requestContext']['authorizer']['claims']['scope'] = (
+            'openid email stuff aslp/readGeneral aslp/aslp.readPrivate'
+        )
+        resp = get_provider(event, self.mock_context)
         self.assertEqual(resp['statusCode'], 200)
+        return json.loads(resp['body'])
 
-        with open('../common/tests/resources/api/provider-response.json') as f:
-            expected_provider = json.load(f)
-
-        # The canned response resource assumes that the provider will be given a privilege in NE. We didn't do that,
-        # so we'll reset the privilege array.
-        expected_provider['privilegeJurisdictions'] = []
-
-        provider_data = json.loads(resp['body'])['providers'][0]
-        # Removing dynamic fields from comparison
-        del expected_provider['providerId']
-        del provider_data['providerId']
-        del expected_provider['dateOfUpdate']
-        del provider_data['dateOfUpdate']
-
-        self.assertEqual(expected_provider, provider_data)
-
-    def test_existing_provider_ingest(self):
+    def test_new_provider_ingest(self):
         from handlers.ingest import ingest_license_message
-        from handlers.providers import get_provider
-
-        self._load_provider_data()
-        with open('../common/tests/resources/dynamo/provider-ssn.json') as f:
-            provider_id = json.load(f)['providerId']
+        from handlers.providers import query_providers
 
         with open('../common/tests/resources/ingest/message.json') as f:
-            message = json.load(f)
-        # What happens if their license goes inactive?
-        message['detail']['status'] = 'inactive'
+            message = f.read()
 
-        event = {'Records': [{'messageId': '123', 'body': json.dumps(message)}]}
+        event = {'Records': [{'messageId': '123', 'body': message}]}
 
         resp = ingest_license_message(event, self.mock_context)
 
@@ -71,42 +63,43 @@ def test_existing_provider_ingest(self):
         with open('../common/tests/resources/api-event.json') as f:
             event = json.load(f)
 
-        event['pathParameters'] = {'compact': 'aslp', 'providerId': provider_id}
-        event['requestContext']['authorizer']['claims']['scope'] = (
-            'openid email stuff aslp/readGeneral aslp/aslp.readPrivate'
-        )
-        resp = get_provider(event, self.mock_context)
+        event['pathParameters'] = {'compact': 'aslp'}
+        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/readGeneral'
+        event['body'] = json.dumps({'query': {'ssn': '123-12-1234'}})
+
+        # Find the provider's id from their ssn
+        resp = query_providers(event, self.mock_context)
         self.assertEqual(resp['statusCode'], 200)
+        provider_id = json.loads(resp['body'])['providers'][0]['providerId']
+
+        # Now get the full provider details
+        provider_data = self._get_provider_via_api(provider_id)
 
         with open('../common/tests/resources/api/provider-detail-response.json') as f:
             expected_provider = json.load(f)
-        # The license status and provider should immediately be inactive
-        expected_provider['jurisdictionStatus'] = 'inactive'
-        expected_provider['licenses'][0]['jurisdictionStatus'] = 'inactive'
-        # these should be calculated as inactive at record load time
-        expected_provider['status'] = 'inactive'
-        expected_provider['licenses'][0]['status'] = 'inactive'
-        # NOTE: when we are supporting privilege applications officially, they should also be set inactive. That will
-        # be captured in the relevant feature work - this is just to help us remember, since it's pretty important.
-        # expected_provider['privileges'][0]['status'] = 'inactive'
 
-        # add expected compactTransactionId to the expected provider
-        expected_provider['privileges'][0]['compactTransactionId'] = '1234567890'
+        # The canned response resource assumes that the provider will be given a privilege, military affiliation, and
+        # one license renewal. We didn't do any of that here, so we'll reset that data
+        expected_provider['privilegeJurisdictions'] = []
+        expected_provider['privileges'] = []
+        expected_provider['militaryAffiliations'] = []
+        for license_data in expected_provider['licenses']:
+            license_data['history'] = []
 
-        provider_data = json.loads(resp['body'])
-        # Removing dynamic fields from comparison
-        del expected_provider['providerId']
-        del provider_data['providerId']
+        # Removing/setting dynamic fields for comparison
         del expected_provider['dateOfUpdate']
         del provider_data['dateOfUpdate']
-        del expected_provider['licenses'][0]['dateOfUpdate']
-        del provider_data['licenses'][0]['dateOfUpdate']
+        expected_provider['providerId'] = provider_id
+        for license_data in expected_provider['licenses']:
+            del license_data['dateOfUpdate']
+            license_data['providerId'] = provider_id
+        for license_data in provider_data['licenses']:
+            del license_data['dateOfUpdate']
 
         self.assertEqual(expected_provider, provider_data)
 
     def test_old_inactive_license(self):
         from handlers.ingest import ingest_license_message
-        from handlers.providers import get_provider
 
         # The test resource provider has a license in oh
         self._load_provider_data()
@@ -128,22 +121,10 @@ def test_old_inactive_license(self):
 
         self.assertEqual({'batchItemFailures': []}, resp)
 
-        # To test full internal consistency, we'll also pull this new license record out
-        # via the API to make sure it shows up as expected.
-        with open('../common/tests/resources/api-event.json') as f:
-            event = json.load(f)
-
-        event['pathParameters'] = {'compact': 'aslp', 'providerId': provider_id}
-        event['requestContext']['authorizer']['claims']['scope'] = (
-            'openid email stuff aslp/readGeneral aslp/aslp.readPrivate'
-        )
-        resp = get_provider(event, self.mock_context)
-        self.assertEqual(resp['statusCode'], 200)
-
         with open('../common/tests/resources/api/provider-detail-response.json') as f:
             expected_provider = json.load(f)
 
-        provider_data = json.loads(resp['body'])
+        provider_data = self._get_provider_via_api(provider_id)
 
         # Removing dynamic fields from comparison
         del expected_provider['providerId']
@@ -165,7 +146,6 @@ def test_old_inactive_license(self):
 
     def test_newer_active_license(self):
         from handlers.ingest import ingest_license_message
-        from handlers.providers import get_provider
 
         # The test resource provider has a license in oh
         self._load_provider_data()
@@ -187,17 +167,7 @@ def test_newer_active_license(self):
 
         self.assertEqual({'batchItemFailures': []}, resp)
 
-        # To test full internal consistency, we'll also pull this new license record out
-        # via the API to make sure it shows up as expected.
-        with open('../common/tests/resources/api-event.json') as f:
-            event = json.load(f)
-
-        event['pathParameters'] = {'compact': 'aslp', 'providerId': provider_id}
-        event['requestContext']['authorizer']['claims']['scope'] = 'openid email stuff aslp/readGeneral'
-        resp = get_provider(event, self.mock_context)
-        self.assertEqual(resp['statusCode'], 200)
-
-        provider_data = json.loads(resp['body'])
+        provider_data = self._get_provider_via_api(provider_id)
 
         # The new name and jurisdiction should be reflected in the provider data
         self.assertEqual('Newname', provider_data['familyName'])
@@ -205,3 +175,454 @@ def test_newer_active_license(self):
 
         # And the second license should now be listed
         self.assertEqual(2, len(provider_data['licenses']))
+
+    def test_existing_provider_deactivation(self):
+        from handlers.ingest import ingest_license_message
+
+        provider_id = self._with_ingested_license()
+
+        with open('../common/tests/resources/ingest/message.json') as f:
+            message = json.load(f)
+
+        # What happens if their license goes inactive in a subsequent upload?
+        message['detail']['status'] = 'inactive'
+        event = {'Records': [{'messageId': '123', 'body': json.dumps(message)}]}
+        resp = ingest_license_message(event, self.mock_context)
+        self.assertEqual({'batchItemFailures': []}, resp)
+
+        with open('../common/tests/resources/api/provider-detail-response.json') as f:
+            expected_provider = json.load(f)
+
+        # The license status and provider should immediately be inactive
+        expected_provider['jurisdictionStatus'] = 'inactive'
+        expected_provider['licenses'][0]['jurisdictionStatus'] = 'inactive'
+        # these should be calculated as inactive at record load time
+        expected_provider['status'] = 'inactive'
+        expected_provider['licenses'][0]['status'] = 'inactive'
+
+        # NOTE: when we are supporting privilege applications officially, they should also be set inactive. That will
+        # be captured in the relevant feature work - this is just to help us remember, since it's pretty important.
+        # expected_provider['privileges'][0]['status'] = 'inactive'
+
+        provider_data = self._get_provider_via_api(provider_id)
+
+        # The canned response resource assumes that the provider will be given a privilege, military affiliation, and
+        # one license renewal. We didn't do any of that here, so we'll reset that data
+        expected_provider['privilegeJurisdictions'] = []
+        expected_provider['privileges'] = []
+        expected_provider['militaryAffiliations'] = []
+        for license_data in expected_provider['licenses']:
+            # We uploaded a 'deactivation' by just switching 'status' to 'inactive', so this change
+            # should show up in the license history
+            license_data['history'] = [
+                {
+                    'type': 'licenseUpdate',
+                    'updateType': 'deactivation',
+                    'providerId': '89a6377e-c3a5-40e5-bca5-317ec854c570',
+                    'compact': 'aslp',
+                    'jurisdiction': 'oh',
+                    'previous': {
+                        'ssn': '123-12-1234',
+                        'npi': '0608337260',
+                        'licenseType': 'speech-language pathologist',
+                        'jurisdictionStatus': 'active',
+                        'givenName': 'Björk',
+                        'middleName': 'Gunnar',
+                        'familyName': 'Guðmundsdóttir',
+                        'dateOfIssuance': '2010-06-06',
+                        'dateOfBirth': '1985-06-06',
+                        'dateOfExpiration': '2025-04-04',
+                        'dateOfRenewal': '2020-04-04',
+                        'homeAddressStreet1': '123 A St.',
+                        'homeAddressStreet2': 'Apt 321',
+                        'homeAddressCity': 'Columbus',
+                        'homeAddressState': 'oh',
+                        'homeAddressPostalCode': '43004',
+                        'emailAddress': 'björk@example.com',
+                        'phoneNumber': '+13213214321',
+                        'militaryWaiver': False,
+                    },
+                    'updatedValues': {'jurisdictionStatus': 'inactive'},
+                }
+            ]
+
+        # Removing/setting dynamic fields for comparison
+        del expected_provider['dateOfUpdate']
+        del provider_data['dateOfUpdate']
+        expected_provider['providerId'] = provider_id
+        for license_data in expected_provider['licenses']:
+            del license_data['dateOfUpdate']
+            license_data['providerId'] = provider_id
+        for license_data in provider_data['licenses']:
+            del license_data['dateOfUpdate']
+            for hist in license_data['history']:
+                del hist['dateOfUpdate']
+                del hist['previous']['dateOfUpdate']
+
+        self.assertEqual(expected_provider, provider_data)
+
+    def test_existing_provider_renewal(self):
+        from handlers.ingest import ingest_license_message
+
+        provider_id = self._with_ingested_license()
+
+        with open('../common/tests/resources/ingest/message.json') as f:
+            message = json.load(f)
+
+        message['detail'].update({'dateOfRenewal': '2025-03-03', 'dateOfExpiration': '2030-03-03'})
+
+        # What happens if their license is renewed in a subsequent upload?
+        event = {'Records': [{'messageId': '123', 'body': json.dumps(message)}]}
+        resp = ingest_license_message(event, self.mock_context)
+        self.assertEqual({'batchItemFailures': []}, resp)
+
+        with open('../common/tests/resources/api/provider-detail-response.json') as f:
+            expected_provider = json.load(f)
+
+        # The license status and provider should immediately reflect the new dates
+        expected_provider['dateOfExpiration'] = '2030-03-03'
+        expected_provider['licenses'][0]['dateOfExpiration'] = '2030-03-03'
+        expected_provider['licenses'][0]['dateOfRenewal'] = '2025-03-03'
+
+        provider_data = self._get_provider_via_api(provider_id)
+
+        # The canned response resource assumes that the provider will be given a privilege, military affiliation, and
+        # one license renewal. We didn't do any of that here, so we'll reset that data
+        expected_provider['privilegeJurisdictions'] = []
+        expected_provider['privileges'] = []
+        expected_provider['militaryAffiliations'] = []
+        for license_data in expected_provider['licenses']:
+            # We uploaded a 'renewal' by just updating the dateOfRenewal and dateOfExpiration
+            # This should show up in the license history
+            license_data['history'] = [
+                {
+                    'type': 'licenseUpdate',
+                    'updateType': 'renewal',
+                    'providerId': '89a6377e-c3a5-40e5-bca5-317ec854c570',
+                    'compact': 'aslp',
+                    'jurisdiction': 'oh',
+                    'previous': {
+                        'ssn': '123-12-1234',
+                        'npi': '0608337260',
+                        'licenseType': 'speech-language pathologist',
+                        'jurisdictionStatus': 'active',
+                        'givenName': 'Björk',
+                        'middleName': 'Gunnar',
+                        'familyName': 'Guðmundsdóttir',
+                        'dateOfIssuance': '2010-06-06',
+                        'dateOfBirth': '1985-06-06',
+                        'dateOfExpiration': '2025-04-04',
+                        'dateOfRenewal': '2020-04-04',
+                        'homeAddressStreet1': '123 A St.',
+                        'homeAddressStreet2': 'Apt 321',
+                        'homeAddressCity': 'Columbus',
+                        'homeAddressState': 'oh',
+                        'homeAddressPostalCode': '43004',
+                        'emailAddress': 'björk@example.com',
+                        'phoneNumber': '+13213214321',
+                        'militaryWaiver': False,
+                    },
+                    'updatedValues': {
+                        'dateOfRenewal': '2025-03-03',
+                        'dateOfExpiration': '2030-03-03',
+                    },
+                }
+            ]
+
+        # Removing/setting dynamic fields for comparison
+        del expected_provider['dateOfUpdate']
+        del provider_data['dateOfUpdate']
+        expected_provider['providerId'] = provider_id
+        for license_data in expected_provider['licenses']:
+            del license_data['dateOfUpdate']
+            license_data['providerId'] = provider_id
+        for license_data in provider_data['licenses']:
+            del license_data['dateOfUpdate']
+            for hist in license_data['history']:
+                del hist['dateOfUpdate']
+                del hist['previous']['dateOfUpdate']
+
+        self.assertEqual(expected_provider, provider_data)
+
+    def test_existing_provider_name_change(self):
+        from handlers.ingest import ingest_license_message
+
+        provider_id = self._with_ingested_license()
+
+        with open('../common/tests/resources/ingest/message.json') as f:
+            message = json.load(f)
+
+        message['detail'].update({'familyName': 'VonSmitherton'})
+
+        # What happens if their name changes in a subsequent upload?
+        event = {'Records': [{'messageId': '123', 'body': json.dumps(message)}]}
+        resp = ingest_license_message(event, self.mock_context)
+        self.assertEqual({'batchItemFailures': []}, resp)
+
+        with open('../common/tests/resources/api/provider-detail-response.json') as f:
+            expected_provider = json.load(f)
+
+        # The license status and provider should immediately reflect the new name
+        expected_provider['familyName'] = 'VonSmitherton'
+        expected_provider['licenses'][0]['familyName'] = 'VonSmitherton'
+
+        provider_data = self._get_provider_via_api(provider_id)
+
+        # The canned response resource assumes that the provider will be given a privilege, military affiliation, and
+        # one license renewal. We didn't do any of that here, so we'll reset that data
+        expected_provider['privilegeJurisdictions'] = []
+        expected_provider['privileges'] = []
+        expected_provider['militaryAffiliations'] = []
+        for license_data in expected_provider['licenses']:
+            # We uploaded a 'name change' by just updating the familyName
+            # This should show up in the license history
+            license_data['history'] = [
+                {
+                    'type': 'licenseUpdate',
+                    'updateType': 'other',
+                    'providerId': '89a6377e-c3a5-40e5-bca5-317ec854c570',
+                    'compact': 'aslp',
+                    'jurisdiction': 'oh',
+                    'previous': {
+                        'ssn': '123-12-1234',
+                        'npi': '0608337260',
+                        'licenseType': 'speech-language pathologist',
+                        'jurisdictionStatus': 'active',
+                        'givenName': 'Björk',
+                        'middleName': 'Gunnar',
+                        'familyName': 'Guðmundsdóttir',
+                        'dateOfIssuance': '2010-06-06',
+                        'dateOfBirth': '1985-06-06',
+                        'dateOfExpiration': '2025-04-04',
+                        'dateOfRenewal': '2020-04-04',
+                        'homeAddressStreet1': '123 A St.',
+                        'homeAddressStreet2': 'Apt 321',
+                        'homeAddressCity': 'Columbus',
+                        'homeAddressState': 'oh',
+                        'homeAddressPostalCode': '43004',
+                        'emailAddress': 'björk@example.com',
+                        'phoneNumber': '+13213214321',
+                        'militaryWaiver': False,
+                    },
+                    'updatedValues': {
+                        'familyName': 'VonSmitherton',
+                    },
+                }
+            ]
+
+        # Removing/setting dynamic fields for comparison
+        del expected_provider['dateOfUpdate']
+        del provider_data['dateOfUpdate']
+        expected_provider['providerId'] = provider_id
+        for license_data in expected_provider['licenses']:
+            del license_data['dateOfUpdate']
+            license_data['providerId'] = provider_id
+        for license_data in provider_data['licenses']:
+            del license_data['dateOfUpdate']
+            for hist in license_data['history']:
+                del hist['dateOfUpdate']
+                del hist['previous']['dateOfUpdate']
+
+        self.assertEqual(expected_provider, provider_data)
+
+    def test_existing_provider_no_change(self):
+        from handlers.ingest import ingest_license_message
+
+        provider_id = self._with_ingested_license()
+
+        with open('../common/tests/resources/ingest/message.json') as f:
+            message = json.load(f)
+
+        # What happens if their license is uploaded again with no change?
+        event = {'Records': [{'messageId': '123', 'body': json.dumps(message)}]}
+        resp = ingest_license_message(event, self.mock_context)
+        self.assertEqual({'batchItemFailures': []}, resp)
+
+        with open('../common/tests/resources/api/provider-detail-response.json') as f:
+            expected_provider = json.load(f)
+
+        # The license status and provider should remain unchanged
+        provider_data = self._get_provider_via_api(provider_id)
+
+        # The canned response resource assumes that the provider will be given a privilege, military affiliation, and
+        # one license renewal. We didn't do any of that here, so we'll reset that data
+        expected_provider['privilegeJurisdictions'] = []
+        expected_provider['privileges'] = []
+        expected_provider['militaryAffiliations'] = []
+        for license_data in expected_provider['licenses']:
+            # No changes should show up in the license history
+            license_data['history'] = []
+
+        # Removing/setting dynamic fields for comparison
+        del expected_provider['dateOfUpdate']
+        del provider_data['dateOfUpdate']
+        expected_provider['providerId'] = provider_id
+        for license_data in expected_provider['licenses']:
+            del license_data['dateOfUpdate']
+            license_data['providerId'] = provider_id
+        for license_data in provider_data['licenses']:
+            del license_data['dateOfUpdate']
+            for hist in license_data['history']:
+                del hist['dateOfUpdate']
+                del hist['previous']['dateOfUpdate']
+
+        self.assertEqual(expected_provider, provider_data)
+
+    def test_existing_provider_removed_email(self):
+        self.maxDiff = None
+        from handlers.ingest import ingest_license_message
+
+        provider_id = self._with_ingested_license()
+
+        with open('../common/tests/resources/ingest/message.json') as f:
+            message = json.load(f)
+
+        del message['detail']['emailAddress']
+
+        # What happens if their email is removed in a subsequent upload?
+        event = {'Records': [{'messageId': '123', 'body': json.dumps(message)}]}
+        resp = ingest_license_message(event, self.mock_context)
+        self.assertEqual({'batchItemFailures': []}, resp)
+
+        with open('../common/tests/resources/api/provider-detail-response.json') as f:
+            expected_provider = json.load(f)
+
+        # The license status and provider should immediately reflect the removal of the email
+        provider_data = self._get_provider_via_api(provider_id)
+
+        # The canned response resource assumes that the provider will be given a privilege, military affiliation, and
+        # one license renewal. We didn't do any of that here, so we'll reset that data
+        expected_provider['privilegeJurisdictions'] = []
+        expected_provider['privileges'] = []
+        expected_provider['militaryAffiliations'] = []
+
+        # Removing the field we just removed from the license
+        del expected_provider['emailAddress']
+
+        for license_data in expected_provider['licenses']:
+            # We uploaded a license with no email by just deleting emailAddress
+            # This should show up in the license history
+            del license_data['emailAddress']
+            license_data['history'] = [
+                {
+                    'type': 'licenseUpdate',
+                    'updateType': 'other',
+                    'providerId': '89a6377e-c3a5-40e5-bca5-317ec854c570',
+                    'compact': 'aslp',
+                    'jurisdiction': 'oh',
+                    'previous': {
+                        'ssn': '123-12-1234',
+                        'npi': '0608337260',
+                        'licenseType': 'speech-language pathologist',
+                        'jurisdictionStatus': 'active',
+                        'givenName': 'Björk',
+                        'middleName': 'Gunnar',
+                        'familyName': 'Guðmundsdóttir',
+                        'dateOfIssuance': '2010-06-06',
+                        'dateOfBirth': '1985-06-06',
+                        'dateOfExpiration': '2025-04-04',
+                        'dateOfRenewal': '2020-04-04',
+                        'homeAddressStreet1': '123 A St.',
+                        'homeAddressStreet2': 'Apt 321',
+                        'homeAddressCity': 'Columbus',
+                        'homeAddressState': 'oh',
+                        'homeAddressPostalCode': '43004',
+                        'emailAddress': 'björk@example.com',
+                        'phoneNumber': '+13213214321',
+                        'militaryWaiver': False,
+                    },
+                    'updatedValues': {},
+                    'removedValues': ['emailAddress'],
+                }
+            ]
+
+        # Removing/setting dynamic fields for comparison
+        del expected_provider['dateOfUpdate']
+        del provider_data['dateOfUpdate']
+        expected_provider['providerId'] = provider_id
+        for license_data in expected_provider['licenses']:
+            del license_data['dateOfUpdate']
+            license_data['providerId'] = provider_id
+        for license_data in provider_data['licenses']:
+            del license_data['dateOfUpdate']
+            for hist in license_data['history']:
+                del hist['dateOfUpdate']
+                del hist['previous']['dateOfUpdate']
+
+        self.assertEqual(expected_provider, provider_data)
+
+    def test_existing_provider_added_email(self):
+        self.maxDiff = None
+        from handlers.ingest import ingest_license_message
+
+        provider_id = self._with_ingested_license(omit_email=True)
+
+        with open('../common/tests/resources/ingest/message.json') as f:
+            message = json.load(f)
+
+        # What happens if their email is added in a subsequent upload?
+        event = {'Records': [{'messageId': '123', 'body': json.dumps(message)}]}
+        resp = ingest_license_message(event, self.mock_context)
+        self.assertEqual({'batchItemFailures': []}, resp)
+
+        with open('../common/tests/resources/api/provider-detail-response.json') as f:
+            expected_provider = json.load(f)
+
+        # The license status and provider should immediately reflect the new email
+        provider_data = self._get_provider_via_api(provider_id)
+
+        # The canned response resource assumes that the provider will be given a privilege, military affiliation, and
+        # one license renewal. We didn't do any of that here, so we'll reset that data
+        expected_provider['privilegeJurisdictions'] = []
+        expected_provider['privileges'] = []
+        expected_provider['militaryAffiliations'] = []
+
+        for license_data in expected_provider['licenses']:
+            # We added an emailAddress. This should show up in the license history
+            license_data['history'] = [
+                {
+                    'type': 'licenseUpdate',
+                    'updateType': 'other',
+                    'providerId': '89a6377e-c3a5-40e5-bca5-317ec854c570',
+                    'compact': 'aslp',
+                    'jurisdiction': 'oh',
+                    'previous': {
+                        'ssn': '123-12-1234',
+                        'npi': '0608337260',
+                        'licenseType': 'speech-language pathologist',
+                        'jurisdictionStatus': 'active',
+                        'givenName': 'Björk',
+                        'middleName': 'Gunnar',
+                        'familyName': 'Guðmundsdóttir',
+                        'dateOfIssuance': '2010-06-06',
+                        'dateOfBirth': '1985-06-06',
+                        'dateOfExpiration': '2025-04-04',
+                        'dateOfRenewal': '2020-04-04',
+                        'homeAddressStreet1': '123 A St.',
+                        'homeAddressStreet2': 'Apt 321',
+                        'homeAddressCity': 'Columbus',
+                        'homeAddressState': 'oh',
+                        'homeAddressPostalCode': '43004',
+                        'phoneNumber': '+13213214321',
+                        'militaryWaiver': False,
+                    },
+                    'updatedValues': {
+                        'emailAddress': 'björk@example.com',
+                    }
+                }
+            ]
+
+        # Removing/setting dynamic fields for comparison
+        del expected_provider['dateOfUpdate']
+        del provider_data['dateOfUpdate']
+        expected_provider['providerId'] = provider_id
+        for license_data in expected_provider['licenses']:
+            del license_data['dateOfUpdate']
+            license_data['providerId'] = provider_id
+        for license_data in provider_data['licenses']:
+            del license_data['dateOfUpdate']
+            for hist in license_data['history']:
+                del hist['dateOfUpdate']
+                del hist['previous']['dateOfUpdate']
+
+        self.assertEqual(expected_provider, provider_data)
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_provider_users.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_provider_users.py
index 6dcf7514c..21645e0ea 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_provider_users.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_provider_users.py
@@ -42,6 +42,8 @@ def test_get_provider_returns_provider_information(self):
 
         with open('../common/tests/resources/api/provider-detail-response.json') as f:
             expected_provider = json.load(f)
+
+        self.maxDiff = None
         self.assertEqual(expected_provider, provider_data)
 
     def test_get_provider_returns_400_if_api_call_made_without_proper_claims(self):
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_providers.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_providers.py
index afb511c9b..2bb2d9a0b 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_providers.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_providers.py
@@ -241,6 +241,13 @@ def test_query_providers_invalid_sorting(self):
 
 @mock_aws
 class TestGetProvider(TstFunction):
+    @staticmethod
+    def _get_sensitive_hash():
+        with open('../common/tests/resources/dynamo/license-update.json') as f:
+            sk = json.load(f)['sk']
+        # The actual sensitive part is the hash at the end of the key
+        return sk.split('/')[-1]
+
     def _when_testing_get_provider_response_based_on_read_access(self, scopes: str, expected_provider: dict):
         self._load_provider_data()
 
@@ -260,6 +267,12 @@ def _when_testing_get_provider_response_based_on_read_access(self, scopes: str,
         provider_data = json.loads(resp['body'])
         self.assertEqual(expected_provider, provider_data)
 
+        # The sk for a license-update record is sensitive so we'll do an extra, pretty broad, check just to make sure
+        # we guard against future changes that might accidentally send the key out via the API. See discussion on
+        # key generation in the LicenseUpdateRecordSchema for details.
+        sensitive_hash = self._get_sensitive_hash()
+        self.assertNotIn(sensitive_hash, resp['body'])
+
     def _when_testing_get_provider_with_read_private_access(self, scopes: str):
         with open('../common/tests/resources/api/provider-detail-response.json') as f:
             expected_provider = json.load(f)
@@ -318,7 +331,6 @@ def test_get_provider_missing_provider_id(self):
         self.assertEqual(400, resp['statusCode'])
 
     def test_get_provider_returns_expected_general_response_when_caller_does_not_have_read_private_scope(self):
-        """Provider detail response"""
         with open('../common/tests/resources/api/provider-detail-response.json') as f:
             expected_provider = json.load(f)
             expected_provider.pop('ssn')
@@ -326,8 +338,10 @@ def test_get_provider_returns_expected_general_response_when_caller_does_not_hav
             # we do not return the military affiliation document keys if the caller does not have read private scope
             expected_provider['militaryAffiliations'][0].pop('documentKeys')
             # also remove the ssn from the license record
-            expected_provider['licenses'][0].pop('ssn')
-            expected_provider['licenses'][0].pop('dateOfBirth')
+            del expected_provider['licenses'][0]['ssn']
+            del expected_provider['licenses'][0]['dateOfBirth']
+            del expected_provider['licenses'][0]['history'][0]['previous']['ssn']
+            del expected_provider['licenses'][0]['history'][0]['previous']['dateOfBirth']
 
         self._when_testing_get_provider_response_based_on_read_access(
             scopes='openid email aslp/readGeneral', expected_provider=expected_provider
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_license_csv_reader.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_license_csv_reader.py
index 429813a78..44f84859d 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_license_csv_reader.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_license_csv_reader.py
@@ -10,7 +10,7 @@
 class TestCSVParser(TstFunction):
     def test_csv_parser(self):
         from cc_common.config import logger
-        from cc_common.data_model.schema.license import LicensePostSchema
+        from cc_common.data_model.schema.license.api import LicensePostRequestSchema
         from license_csv_reader import LicenseCSVReader
 
         # Upload our test file to mocked 'S3' then retrieve it, so we can specifically
@@ -19,7 +19,7 @@ def test_csv_parser(self):
         self._bucket.upload_file('../common/tests/resources/licenses.csv', key)
         stream = TextIOWrapper(self._bucket.Object(key).get()['Body'], encoding='utf-8')
 
-        schema = LicensePostSchema()
+        schema = LicensePostRequestSchema()
         reader = LicenseCSVReader()
         for license_row in reader.licenses(stream):
             validated = schema.load({'compact': 'aslp', 'jurisdiction': 'oh', **license_row})
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/unit/test_license_csv_reader.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/unit/test_license_csv_reader.py
index 79e352b47..4120c8ead 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/unit/test_license_csv_reader.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/unit/test_license_csv_reader.py
@@ -4,10 +4,10 @@
 class TestCSVParser(TstLambdas):
     def test_csv_parser(self):
         from cc_common.config import logger
-        from cc_common.data_model.schema.license import LicensePostSchema
+        from cc_common.data_model.schema.license.api import LicensePostRequestSchema
         from license_csv_reader import LicenseCSVReader
 
-        schema = LicensePostSchema()
+        schema = LicensePostRequestSchema()
         with open('../common/tests/resources/licenses.csv') as f:
             reader = LicenseCSVReader()
             for license_row in reader.licenses(f):
diff --git a/backend/compact-connect/lambdas/python/purchases/handlers/privileges.py b/backend/compact-connect/lambdas/python/purchases/handlers/privileges.py
index b16210a20..d03bc6310 100644
--- a/backend/compact-connect/lambdas/python/purchases/handlers/privileges.py
+++ b/backend/compact-connect/lambdas/python/purchases/handlers/privileges.py
@@ -4,12 +4,13 @@
 
 from aws_lambda_powertools.utilities.typing import LambdaContext
 from cc_common.config import config, logger
-from cc_common.data_model.schema.compact import COMPACT_TYPE, Compact, CompactOptionsApiResponseSchema
+from cc_common.data_model.schema.compact import COMPACT_TYPE, Compact
+from cc_common.data_model.schema.compact.api import CompactOptionsResponseSchema
 from cc_common.data_model.schema.jurisdiction import (
     JURISDICTION_TYPE,
     Jurisdiction,
-    JurisdictionOptionsApiResponseSchema,
 )
+from cc_common.data_model.schema.jurisdiction.api import JurisdictionOptionsResponseSchema
 from cc_common.data_model.schema.military_affiliation import MilitaryAffiliationStatus
 from cc_common.exceptions import (
     CCAwsServiceException,
@@ -79,9 +80,9 @@ def get_purchase_privilege_options(event: dict, context: LambdaContext):  # noqa
     serlialized_options = []
     for item in options_response['items']:
         if item['type'] == JURISDICTION_TYPE:
-            serlialized_options.append(JurisdictionOptionsApiResponseSchema().load(item))
+            serlialized_options.append(JurisdictionOptionsResponseSchema().load(item))
         elif item['type'] == COMPACT_TYPE:
-            serlialized_options.append(CompactOptionsApiResponseSchema().load(item))
+            serlialized_options.append(CompactOptionsResponseSchema().load(item))
 
     options_response['items'] = serlialized_options
 
@@ -310,11 +311,12 @@ def post_purchase_privileges(event: dict, context: LambdaContext):  # noqa: ARG0
 
         # transaction was successful, now we create privilege records for the selected jurisdictions
         config.data_client.create_provider_privileges(
-            compact_name=compact_name,
+            compact=compact_name,
             provider_id=provider_id,
             jurisdiction_postal_abbreviations=selected_jurisdictions_postal_abbreviations,
             license_expiration_date=license_expiration_date,
             compact_transaction_id=transaction_response['transactionId'],
+            provider_record=provider_record,
             existing_privileges=existing_privileges,
             attestations=body['attestations'],
         )
diff --git a/backend/compact-connect/lambdas/python/staff-users/tests/function/test_handlers/test_patch_user.py b/backend/compact-connect/lambdas/python/staff-users/tests/function/test_handlers/test_patch_user.py
index d17cf3dd7..2eb7c081b 100644
--- a/backend/compact-connect/lambdas/python/staff-users/tests/function/test_handlers/test_patch_user.py
+++ b/backend/compact-connect/lambdas/python/staff-users/tests/function/test_handlers/test_patch_user.py
@@ -50,7 +50,7 @@ def test_patch_user_document_path_overlap(self):
                 'givenName': 'Test',
             },
             'compact': 'octp',
-            'dateOfUpdate': '2024-10-21',
+            'dateOfUpdate': '2024-09-12T12:34:56+00:00',
             'famGiv': 'User#Test',
             'permissions': {'actions': {'read'}, 'jurisdictions': {'oh': {'admin', 'write'}}},
             'type': 'user',
diff --git a/backend/compact-connect/stacks/api_stack/v1_api/api_model.py b/backend/compact-connect/stacks/api_stack/v1_api/api_model.py
index 0e52421a9..6766a6e3c 100644
--- a/backend/compact-connect/stacks/api_stack/v1_api/api_model.py
+++ b/backend/compact-connect/stacks/api_stack/v1_api/api_model.py
@@ -854,13 +854,84 @@ def _provider_detail_response_schema(self):
                                 format='date',
                                 pattern=cc_api.YMD_FORMAT,
                             ),
+                            'history': JsonSchema(
+                                type=JsonSchemaType.ARRAY,
+                                items=JsonSchema(
+                                    type=JsonSchemaType.OBJECT,
+                                    properties={
+                                        'type': JsonSchema(type=JsonSchemaType.STRING, enum=['licenseUpdate']),
+                                        'updateType': JsonSchema(
+                                            type=JsonSchemaType.STRING, enum=['renewal', 'deactivation', 'other']
+                                        ),
+                                        'compact': JsonSchema(
+                                            type=JsonSchemaType.STRING, enum=stack.node.get_context('compacts')
+                                        ),
+                                        'jurisdiction': JsonSchema(
+                                            type=JsonSchemaType.STRING, enum=stack.node.get_context('jurisdictions')
+                                        ),
+                                        'dateOfUpdate': JsonSchema(
+                                            type=JsonSchemaType.STRING, format='date', pattern=cc_api.YMD_FORMAT
+                                        ),
+                                        'previous': JsonSchema(
+                                            type=JsonSchemaType.OBJECT, properties=self._common_license_properties
+                                        ),
+                                        'updatedValues': JsonSchema(
+                                            type=JsonSchemaType.OBJECT, properties=self._common_license_properties
+                                        ),
+                                        'removedValues': JsonSchema(
+                                            type=JsonSchemaType.ARRAY,
+                                            description='List of field names that were present in the previous record'
+                                            ' but removed in the update',
+                                            items=JsonSchema(type=JsonSchemaType.STRING),
+                                        ),
+                                    },
+                                ),
+                            ),
                             **self._common_license_properties,
                         },
                     ),
                 ),
                 'privileges': JsonSchema(
                     type=JsonSchemaType.ARRAY,
-                    items=JsonSchema(type=JsonSchemaType.OBJECT, properties=self._common_privilege_properties),
+                    items=JsonSchema(
+                        type=JsonSchemaType.OBJECT,
+                        properties={
+                            'history': JsonSchema(
+                                type=JsonSchemaType.ARRAY,
+                                items=JsonSchema(
+                                    type=JsonSchemaType.OBJECT,
+                                    properties={
+                                        'type': JsonSchema(type=JsonSchemaType.STRING, enum=['privilegeUpdate']),
+                                        'updateType': JsonSchema(
+                                            type=JsonSchemaType.STRING, enum=['renewal', 'deactivation', 'other']
+                                        ),
+                                        'compact': JsonSchema(
+                                            type=JsonSchemaType.STRING, enum=stack.node.get_context('compacts')
+                                        ),
+                                        'jurisdiction': JsonSchema(
+                                            type=JsonSchemaType.STRING, enum=stack.node.get_context('jurisdictions')
+                                        ),
+                                        'dateOfUpdate': JsonSchema(
+                                            type=JsonSchemaType.STRING, format='date', pattern=cc_api.YMD_FORMAT
+                                        ),
+                                        'previous': JsonSchema(
+                                            type=JsonSchemaType.OBJECT, properties=self._common_privilege_properties
+                                        ),
+                                        'updatedValues': JsonSchema(
+                                            type=JsonSchemaType.OBJECT, properties=self._common_privilege_properties
+                                        ),
+                                        'removedValues': JsonSchema(
+                                            type=JsonSchemaType.ARRAY,
+                                            description='List of field names that were present in the previous record'
+                                            ' but removed in the update',
+                                            items=JsonSchema(type=JsonSchemaType.STRING),
+                                        ),
+                                    },
+                                ),
+                            ),
+                            **self._common_privilege_properties,
+                        },
+                    ),
                 ),
                 **self._common_provider_properties,
             },
diff --git a/backend/compact-connect/stacks/transaction_monitoring_stack/transaction_history_processing_workflow.py b/backend/compact-connect/stacks/transaction_monitoring_stack/transaction_history_processing_workflow.py
index 8828505c3..4eb4cb3d1 100644
--- a/backend/compact-connect/stacks/transaction_monitoring_stack/transaction_history_processing_workflow.py
+++ b/backend/compact-connect/stacks/transaction_monitoring_stack/transaction_history_processing_workflow.py
@@ -201,7 +201,7 @@ def __init__(
         )
 
         # Create alarm for failed step function executions
-        Alarm(
+        alarm = Alarm(
             self,
             f'{compact}-StateMachineExecutionFailedAlarm',
             metric=state_machine.metric_failed(),
@@ -212,10 +212,19 @@ def __init__(
             comparison_operator=ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
             treat_missing_data=TreatMissingData.NOT_BREACHING,
         )
-         # TODO: we have been asked to disable this until all compacts have valid authorize.net # noqa: FIX002
-         #  accounts put into place to avoid unnecessary alerting. Once the system is ready to
-         #  go live, this alarm action should be re-enabled.
-         # .add_alarm_action(SnsAction(persistent_stack.alarm_topic)))
+        # TODO: we have been asked to disable this until all compacts have valid authorize.net # noqa: FIX002
+        #  accounts put into place to avoid unnecessary alerting. Once the system is ready to
+        #  go live, this alarm action should be re-enabled.
+        # .add_alarm_action(SnsAction(persistent_stack.alarm_topic)))
+        NagSuppressions.add_resource_suppressions(
+            alarm,
+            suppressions=[
+                {
+                    'id': 'HIPAA.Security-CloudWatchAlarmAction',
+                    'reason': 'This alarm is temporary silenced until all compacts have valid authorize.net accounts',
+                }
+            ],
+        )
 
     def _get_secrets_manager_compact_payment_processor_arn_for_compact(
         self, compact: str, environment_name: str
diff --git a/backend/compact-connect/tests/app/base.py b/backend/compact-connect/tests/app/base.py
index b8ff8b373..c1b45ff04 100644
--- a/backend/compact-connect/tests/app/base.py
+++ b/backend/compact-connect/tests/app/base.py
@@ -305,6 +305,7 @@ def _check_no_stage_annotations(self, stage: BackendStage):
         self._check_no_stack_annotations(stage.ui_stack)
         self._check_no_stack_annotations(stage.api_stack)
         self._check_no_stack_annotations(stage.ingest_stack)
+        self._check_no_stack_annotations(stage.transaction_monitoring_stack)
         # There is on reporting stack if no hosted zone is configured
         if stage.persistent_stack.hosted_zone:
             self._check_no_stack_annotations(stage.reporting_stack)
diff --git a/backend/compact-connect/tests/resources/snapshots/PROVIDER_USER_RESPONSE_SCHEMA.json b/backend/compact-connect/tests/resources/snapshots/PROVIDER_USER_RESPONSE_SCHEMA.json
index 1c2454a8b..6094ad3b1 100644
--- a/backend/compact-connect/tests/resources/snapshots/PROVIDER_USER_RESPONSE_SCHEMA.json
+++ b/backend/compact-connect/tests/resources/snapshots/PROVIDER_USER_RESPONSE_SCHEMA.json
@@ -1,210 +1,24 @@
 {
-  "$schema": "http://json-schema.org/draft-04/schema#",
   "properties": {
-    "birthMonthDay": {
-      "format": "date",
-      "pattern": "^[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-      "type": "string"
-    },
-    "compact": {
-      "enum": [
-        "aslp",
-        "octp",
-        "coun"
-      ],
-      "type": "string"
-    },
-    "dateOfBirth": {
-      "format": "date",
-      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-      "type": "string"
-    },
-    "dateOfExpiration": {
-      "format": "date",
-      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-      "type": "string"
-    },
-    "dateOfUpdate": {
-      "format": "date",
-      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-      "type": "string"
-    },
-    "familyName": {
-      "maxLength": 100,
-      "minLength": 1,
-      "type": "string"
-    },
-    "givenName": {
-      "maxLength": 100,
-      "minLength": 1,
-      "type": "string"
-    },
-    "homeAddressCity": {
-      "maxLength": 100,
-      "minLength": 2,
-      "type": "string"
-    },
-    "homeAddressPostalCode": {
-      "maxLength": 7,
-      "minLength": 5,
-      "type": "string"
-    },
-    "homeAddressState": {
-      "maxLength": 100,
-      "minLength": 2,
-      "type": "string"
-    },
-    "homeAddressStreet1": {
-      "maxLength": 100,
-      "minLength": 2,
-      "type": "string"
-    },
-    "homeAddressStreet2": {
-      "maxLength": 100,
-      "minLength": 1,
-      "type": "string"
-    },
-    "licenseJurisdiction": {
-      "enum": [
-        "al",
-        "ak",
-        "az",
-        "ar",
-        "ca",
-        "co",
-        "ct",
-        "de",
-        "dc",
-        "fl",
-        "ga",
-        "hi",
-        "id",
-        "il",
-        "in",
-        "ia",
-        "ks",
-        "ky",
-        "la",
-        "me",
-        "md",
-        "ma",
-        "mi",
-        "mn",
-        "ms",
-        "mo",
-        "mt",
-        "ne",
-        "nv",
-        "nh",
-        "nj",
-        "nm",
-        "ny",
-        "nc",
-        "nd",
-        "oh",
-        "ok",
-        "or",
-        "pa",
-        "pr",
-        "ri",
-        "sc",
-        "sd",
-        "tn",
-        "tx",
-        "ut",
-        "vt",
-        "va",
-        "vi",
-        "wa",
-        "wv",
-        "wi",
-        "wy"
-      ],
-      "type": "string"
-    },
-    "licenseType": {
-      "enum": [
-        "audiologist",
-        "speech-language pathologist",
-        "speech and language pathologist",
-        "occupational therapist",
-        "occupational therapy assistant",
-        "licensed professional counselor",
-        "licensed mental health counselor",
-        "licensed clinical mental health counselor",
-        "licensed professional clinical counselor"
-      ],
-      "type": "string"
-    },
     "licenses": {
       "items": {
         "properties": {
-          "compact": {
+          "type": {
             "enum": [
-              "aslp",
-              "octp",
-              "coun"
+              "license-home"
             ],
             "type": "string"
           },
-          "dateOfBirth": {
-            "format": "date",
-            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-            "type": "string"
-          },
-          "dateOfExpiration": {
-            "format": "date",
-            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-            "type": "string"
-          },
-          "dateOfIssuance": {
-            "format": "date",
-            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-            "type": "string"
-          },
-          "dateOfRenewal": {
-            "format": "date",
-            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-            "type": "string"
-          },
-          "dateOfUpdate": {
-            "format": "date",
-            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-            "type": "string"
-          },
-          "familyName": {
-            "maxLength": 100,
-            "minLength": 1,
-            "type": "string"
-          },
-          "givenName": {
-            "maxLength": 100,
-            "minLength": 1,
-            "type": "string"
-          },
-          "homeAddressCity": {
-            "maxLength": 100,
-            "minLength": 2,
-            "type": "string"
-          },
-          "homeAddressPostalCode": {
-            "maxLength": 7,
-            "minLength": 5,
-            "type": "string"
-          },
-          "homeAddressState": {
-            "maxLength": 100,
-            "minLength": 2,
-            "type": "string"
-          },
-          "homeAddressStreet1": {
-            "maxLength": 100,
-            "minLength": 2,
+          "providerId": {
+            "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
             "type": "string"
           },
-          "homeAddressStreet2": {
-            "maxLength": 100,
-            "minLength": 1,
+          "compact": {
+            "enum": [
+              "aslp",
+              "octp",
+              "coun"
+            ],
             "type": "string"
           },
           "jurisdiction": {
@@ -265,6 +79,358 @@
             ],
             "type": "string"
           },
+          "dateOfUpdate": {
+            "format": "date",
+            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+            "type": "string"
+          },
+          "history": {
+            "items": {
+              "properties": {
+                "type": {
+                  "enum": [
+                    "licenseUpdate"
+                  ],
+                  "type": "string"
+                },
+                "updateType": {
+                  "enum": [
+                    "renewal",
+                    "deactivation",
+                    "other"
+                  ],
+                  "type": "string"
+                },
+                "compact": {
+                  "enum": [
+                    "aslp",
+                    "octp",
+                    "coun"
+                  ],
+                  "type": "string"
+                },
+                "jurisdiction": {
+                  "enum": [
+                    "al",
+                    "ak",
+                    "az",
+                    "ar",
+                    "ca",
+                    "co",
+                    "ct",
+                    "de",
+                    "dc",
+                    "fl",
+                    "ga",
+                    "hi",
+                    "id",
+                    "il",
+                    "in",
+                    "ia",
+                    "ks",
+                    "ky",
+                    "la",
+                    "me",
+                    "md",
+                    "ma",
+                    "mi",
+                    "mn",
+                    "ms",
+                    "mo",
+                    "mt",
+                    "ne",
+                    "nv",
+                    "nh",
+                    "nj",
+                    "nm",
+                    "ny",
+                    "nc",
+                    "nd",
+                    "oh",
+                    "ok",
+                    "or",
+                    "pa",
+                    "pr",
+                    "ri",
+                    "sc",
+                    "sd",
+                    "tn",
+                    "tx",
+                    "ut",
+                    "vt",
+                    "va",
+                    "vi",
+                    "wa",
+                    "wv",
+                    "wi",
+                    "wy"
+                  ],
+                  "type": "string"
+                },
+                "dateOfUpdate": {
+                  "format": "date",
+                  "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                  "type": "string"
+                },
+                "previous": {
+                  "properties": {
+                    "ssn": {
+                      "pattern": "^[0-9]{3}-[0-9]{2}-[0-9]{4}$",
+                      "type": "string"
+                    },
+                    "npi": {
+                      "pattern": "^[0-9]{10}$",
+                      "type": "string"
+                    },
+                    "givenName": {
+                      "maxLength": 100,
+                      "minLength": 1,
+                      "type": "string"
+                    },
+                    "middleName": {
+                      "maxLength": 100,
+                      "minLength": 1,
+                      "type": "string"
+                    },
+                    "familyName": {
+                      "maxLength": 100,
+                      "minLength": 1,
+                      "type": "string"
+                    },
+                    "dateOfBirth": {
+                      "format": "date",
+                      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                      "type": "string"
+                    },
+                    "homeAddressStreet1": {
+                      "maxLength": 100,
+                      "minLength": 2,
+                      "type": "string"
+                    },
+                    "homeAddressStreet2": {
+                      "maxLength": 100,
+                      "minLength": 1,
+                      "type": "string"
+                    },
+                    "homeAddressCity": {
+                      "maxLength": 100,
+                      "minLength": 2,
+                      "type": "string"
+                    },
+                    "homeAddressState": {
+                      "maxLength": 100,
+                      "minLength": 2,
+                      "type": "string"
+                    },
+                    "homeAddressPostalCode": {
+                      "maxLength": 7,
+                      "minLength": 5,
+                      "type": "string"
+                    },
+                    "licenseType": {
+                      "enum": [
+                        "audiologist",
+                        "speech-language pathologist",
+                        "speech and language pathologist",
+                        "occupational therapist",
+                        "occupational therapy assistant",
+                        "licensed professional counselor",
+                        "licensed mental health counselor",
+                        "licensed clinical mental health counselor",
+                        "licensed professional clinical counselor"
+                      ],
+                      "type": "string"
+                    },
+                    "dateOfIssuance": {
+                      "format": "date",
+                      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                      "type": "string"
+                    },
+                    "dateOfRenewal": {
+                      "format": "date",
+                      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                      "type": "string"
+                    },
+                    "dateOfExpiration": {
+                      "format": "date",
+                      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                      "type": "string"
+                    },
+                    "status": {
+                      "enum": [
+                        "active",
+                        "inactive"
+                      ],
+                      "type": "string"
+                    },
+                    "militaryWaiver": {
+                      "type": "boolean"
+                    }
+                  },
+                  "type": "object"
+                },
+                "updatedValues": {
+                  "properties": {
+                    "ssn": {
+                      "pattern": "^[0-9]{3}-[0-9]{2}-[0-9]{4}$",
+                      "type": "string"
+                    },
+                    "npi": {
+                      "pattern": "^[0-9]{10}$",
+                      "type": "string"
+                    },
+                    "givenName": {
+                      "maxLength": 100,
+                      "minLength": 1,
+                      "type": "string"
+                    },
+                    "middleName": {
+                      "maxLength": 100,
+                      "minLength": 1,
+                      "type": "string"
+                    },
+                    "familyName": {
+                      "maxLength": 100,
+                      "minLength": 1,
+                      "type": "string"
+                    },
+                    "dateOfBirth": {
+                      "format": "date",
+                      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                      "type": "string"
+                    },
+                    "homeAddressStreet1": {
+                      "maxLength": 100,
+                      "minLength": 2,
+                      "type": "string"
+                    },
+                    "homeAddressStreet2": {
+                      "maxLength": 100,
+                      "minLength": 1,
+                      "type": "string"
+                    },
+                    "homeAddressCity": {
+                      "maxLength": 100,
+                      "minLength": 2,
+                      "type": "string"
+                    },
+                    "homeAddressState": {
+                      "maxLength": 100,
+                      "minLength": 2,
+                      "type": "string"
+                    },
+                    "homeAddressPostalCode": {
+                      "maxLength": 7,
+                      "minLength": 5,
+                      "type": "string"
+                    },
+                    "licenseType": {
+                      "enum": [
+                        "audiologist",
+                        "speech-language pathologist",
+                        "speech and language pathologist",
+                        "occupational therapist",
+                        "occupational therapy assistant",
+                        "licensed professional counselor",
+                        "licensed mental health counselor",
+                        "licensed clinical mental health counselor",
+                        "licensed professional clinical counselor"
+                      ],
+                      "type": "string"
+                    },
+                    "dateOfIssuance": {
+                      "format": "date",
+                      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                      "type": "string"
+                    },
+                    "dateOfRenewal": {
+                      "format": "date",
+                      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                      "type": "string"
+                    },
+                    "dateOfExpiration": {
+                      "format": "date",
+                      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                      "type": "string"
+                    },
+                    "status": {
+                      "enum": [
+                        "active",
+                        "inactive"
+                      ],
+                      "type": "string"
+                    },
+                    "militaryWaiver": {
+                      "type": "boolean"
+                    }
+                  },
+                  "type": "object"
+                },
+                "removedValues": {
+                  "description": "List of field names that were present in the previous record but removed in the update",
+                  "items": {
+                    "type": "string"
+                  },
+                  "type": "array"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          },
+          "ssn": {
+            "pattern": "^[0-9]{3}-[0-9]{2}-[0-9]{4}$",
+            "type": "string"
+          },
+          "npi": {
+            "pattern": "^[0-9]{10}$",
+            "type": "string"
+          },
+          "givenName": {
+            "maxLength": 100,
+            "minLength": 1,
+            "type": "string"
+          },
+          "middleName": {
+            "maxLength": 100,
+            "minLength": 1,
+            "type": "string"
+          },
+          "familyName": {
+            "maxLength": 100,
+            "minLength": 1,
+            "type": "string"
+          },
+          "dateOfBirth": {
+            "format": "date",
+            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+            "type": "string"
+          },
+          "homeAddressStreet1": {
+            "maxLength": 100,
+            "minLength": 2,
+            "type": "string"
+          },
+          "homeAddressStreet2": {
+            "maxLength": 100,
+            "minLength": 1,
+            "type": "string"
+          },
+          "homeAddressCity": {
+            "maxLength": 100,
+            "minLength": 2,
+            "type": "string"
+          },
+          "homeAddressState": {
+            "maxLength": 100,
+            "minLength": 2,
+            "type": "string"
+          },
+          "homeAddressPostalCode": {
+            "maxLength": 7,
+            "minLength": 5,
+            "type": "string"
+          },
           "licenseType": {
             "enum": [
               "audiologist",
@@ -279,24 +445,19 @@
             ],
             "type": "string"
           },
-          "middleName": {
-            "maxLength": 100,
-            "minLength": 1,
-            "type": "string"
-          },
-          "militaryWaiver": {
-            "type": "boolean"
-          },
-          "npi": {
-            "pattern": "^[0-9]{10}$",
+          "dateOfIssuance": {
+            "format": "date",
+            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
             "type": "string"
           },
-          "providerId": {
-            "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
+          "dateOfRenewal": {
+            "format": "date",
+            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
             "type": "string"
           },
-          "ssn": {
-            "pattern": "^[0-9]{3}-[0-9]{2}-[0-9]{4}$",
+          "dateOfExpiration": {
+            "format": "date",
+            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
             "type": "string"
           },
           "status": {
@@ -306,114 +467,339 @@
             ],
             "type": "string"
           },
-          "type": {
-            "enum": [
-              "license-home"
-            ],
-            "type": "string"
+          "militaryWaiver": {
+            "type": "boolean"
           }
         },
         "type": "object"
       },
       "type": "array"
     },
-    "middleName": {
-      "maxLength": 100,
-      "minLength": 1,
-      "type": "string"
-    },
-    "militaryWaiver": {
-      "type": "boolean"
-    },
-    "npi": {
-      "pattern": "^[0-9]{10}$",
-      "type": "string"
-    },
-    "privilegeJurisdictions": {
-      "items": {
-        "enum": [
-          "al",
-          "ak",
-          "az",
-          "ar",
-          "ca",
-          "co",
-          "ct",
-          "de",
-          "dc",
-          "fl",
-          "ga",
-          "hi",
-          "id",
-          "il",
-          "in",
-          "ia",
-          "ks",
-          "ky",
-          "la",
-          "me",
-          "md",
-          "ma",
-          "mi",
-          "mn",
-          "ms",
-          "mo",
-          "mt",
-          "ne",
-          "nv",
-          "nh",
-          "nj",
-          "nm",
-          "ny",
-          "nc",
-          "nd",
-          "oh",
-          "ok",
-          "or",
-          "pa",
-          "pr",
-          "ri",
-          "sc",
-          "sd",
-          "tn",
-          "tx",
-          "ut",
-          "vt",
-          "va",
-          "vi",
-          "wa",
-          "wv",
-          "wi",
-          "wy"
-        ],
-        "type": "string"
-      },
-      "type": "array"
-    },
     "privileges": {
       "items": {
         "properties": {
-          "compact": {
+          "history": {
+            "items": {
+              "properties": {
+                "type": {
+                  "enum": [
+                    "privilegeUpdate"
+                  ],
+                  "type": "string"
+                },
+                "updateType": {
+                  "enum": [
+                    "renewal",
+                    "deactivation",
+                    "other"
+                  ],
+                  "type": "string"
+                },
+                "compact": {
+                  "enum": [
+                    "aslp",
+                    "octp",
+                    "coun"
+                  ],
+                  "type": "string"
+                },
+                "jurisdiction": {
+                  "enum": [
+                    "al",
+                    "ak",
+                    "az",
+                    "ar",
+                    "ca",
+                    "co",
+                    "ct",
+                    "de",
+                    "dc",
+                    "fl",
+                    "ga",
+                    "hi",
+                    "id",
+                    "il",
+                    "in",
+                    "ia",
+                    "ks",
+                    "ky",
+                    "la",
+                    "me",
+                    "md",
+                    "ma",
+                    "mi",
+                    "mn",
+                    "ms",
+                    "mo",
+                    "mt",
+                    "ne",
+                    "nv",
+                    "nh",
+                    "nj",
+                    "nm",
+                    "ny",
+                    "nc",
+                    "nd",
+                    "oh",
+                    "ok",
+                    "or",
+                    "pa",
+                    "pr",
+                    "ri",
+                    "sc",
+                    "sd",
+                    "tn",
+                    "tx",
+                    "ut",
+                    "vt",
+                    "va",
+                    "vi",
+                    "wa",
+                    "wv",
+                    "wi",
+                    "wy"
+                  ],
+                  "type": "string"
+                },
+                "dateOfUpdate": {
+                  "format": "date",
+                  "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                  "type": "string"
+                },
+                "previous": {
+                  "properties": {
+                    "type": {
+                      "enum": [
+                        "privilege"
+                      ],
+                      "type": "string"
+                    },
+                    "providerId": {
+                      "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
+                      "type": "string"
+                    },
+                    "compact": {
+                      "enum": [
+                        "aslp",
+                        "octp",
+                        "coun"
+                      ],
+                      "type": "string"
+                    },
+                    "licenseJurisdiction": {
+                      "enum": [
+                        "al",
+                        "ak",
+                        "az",
+                        "ar",
+                        "ca",
+                        "co",
+                        "ct",
+                        "de",
+                        "dc",
+                        "fl",
+                        "ga",
+                        "hi",
+                        "id",
+                        "il",
+                        "in",
+                        "ia",
+                        "ks",
+                        "ky",
+                        "la",
+                        "me",
+                        "md",
+                        "ma",
+                        "mi",
+                        "mn",
+                        "ms",
+                        "mo",
+                        "mt",
+                        "ne",
+                        "nv",
+                        "nh",
+                        "nj",
+                        "nm",
+                        "ny",
+                        "nc",
+                        "nd",
+                        "oh",
+                        "ok",
+                        "or",
+                        "pa",
+                        "pr",
+                        "ri",
+                        "sc",
+                        "sd",
+                        "tn",
+                        "tx",
+                        "ut",
+                        "vt",
+                        "va",
+                        "vi",
+                        "wa",
+                        "wv",
+                        "wi",
+                        "wy"
+                      ],
+                      "type": "string"
+                    },
+                    "status": {
+                      "enum": [
+                        "active",
+                        "inactive"
+                      ],
+                      "type": "string"
+                    },
+                    "dateOfIssuance": {
+                      "format": "date",
+                      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                      "type": "string"
+                    },
+                    "dateOfUpdate": {
+                      "format": "date",
+                      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                      "type": "string"
+                    },
+                    "dateOfExpiration": {
+                      "format": "date",
+                      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                      "type": "string"
+                    }
+                  },
+                  "type": "object"
+                },
+                "updatedValues": {
+                  "properties": {
+                    "type": {
+                      "enum": [
+                        "privilege"
+                      ],
+                      "type": "string"
+                    },
+                    "providerId": {
+                      "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
+                      "type": "string"
+                    },
+                    "compact": {
+                      "enum": [
+                        "aslp",
+                        "octp",
+                        "coun"
+                      ],
+                      "type": "string"
+                    },
+                    "licenseJurisdiction": {
+                      "enum": [
+                        "al",
+                        "ak",
+                        "az",
+                        "ar",
+                        "ca",
+                        "co",
+                        "ct",
+                        "de",
+                        "dc",
+                        "fl",
+                        "ga",
+                        "hi",
+                        "id",
+                        "il",
+                        "in",
+                        "ia",
+                        "ks",
+                        "ky",
+                        "la",
+                        "me",
+                        "md",
+                        "ma",
+                        "mi",
+                        "mn",
+                        "ms",
+                        "mo",
+                        "mt",
+                        "ne",
+                        "nv",
+                        "nh",
+                        "nj",
+                        "nm",
+                        "ny",
+                        "nc",
+                        "nd",
+                        "oh",
+                        "ok",
+                        "or",
+                        "pa",
+                        "pr",
+                        "ri",
+                        "sc",
+                        "sd",
+                        "tn",
+                        "tx",
+                        "ut",
+                        "vt",
+                        "va",
+                        "vi",
+                        "wa",
+                        "wv",
+                        "wi",
+                        "wy"
+                      ],
+                      "type": "string"
+                    },
+                    "status": {
+                      "enum": [
+                        "active",
+                        "inactive"
+                      ],
+                      "type": "string"
+                    },
+                    "dateOfIssuance": {
+                      "format": "date",
+                      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                      "type": "string"
+                    },
+                    "dateOfUpdate": {
+                      "format": "date",
+                      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                      "type": "string"
+                    },
+                    "dateOfExpiration": {
+                      "format": "date",
+                      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+                      "type": "string"
+                    }
+                  },
+                  "type": "object"
+                },
+                "removedValues": {
+                  "description": "List of field names that were present in the previous record but removed in the update",
+                  "items": {
+                    "type": "string"
+                  },
+                  "type": "array"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          },
+          "type": {
             "enum": [
-              "aslp",
-              "octp",
-              "coun"
+              "privilege"
             ],
             "type": "string"
           },
-          "dateOfExpiration": {
-            "format": "date",
-            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
-            "type": "string"
-          },
-          "dateOfIssuance": {
-            "format": "date",
-            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+          "providerId": {
+            "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
             "type": "string"
           },
-          "dateOfUpdate": {
-            "format": "date",
-            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+          "compact": {
+            "enum": [
+              "aslp",
+              "octp",
+              "coun"
+            ],
             "type": "string"
           },
           "licenseJurisdiction": {
@@ -474,10 +860,6 @@
             ],
             "type": "string"
           },
-          "providerId": {
-            "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
-            "type": "string"
-          },
           "status": {
             "enum": [
               "active",
@@ -485,10 +867,19 @@
             ],
             "type": "string"
           },
-          "type": {
-            "enum": [
-              "privilege"
-            ],
+          "dateOfIssuance": {
+            "format": "date",
+            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+            "type": "string"
+          },
+          "dateOfUpdate": {
+            "format": "date",
+            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+            "type": "string"
+          },
+          "dateOfExpiration": {
+            "format": "date",
+            "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
             "type": "string"
           }
         },
@@ -496,6 +887,12 @@
       },
       "type": "array"
     },
+    "type": {
+      "enum": [
+        "provider"
+      ],
+      "type": "string"
+    },
     "providerId": {
       "pattern": "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab]{1}[0-9a-f]{3}-[0-9a-f]{12}",
       "type": "string"
@@ -504,6 +901,39 @@
       "pattern": "^[0-9]{3}-[0-9]{2}-[0-9]{4}$",
       "type": "string"
     },
+    "npi": {
+      "pattern": "^[0-9]{10}$",
+      "type": "string"
+    },
+    "givenName": {
+      "maxLength": 100,
+      "minLength": 1,
+      "type": "string"
+    },
+    "middleName": {
+      "maxLength": 100,
+      "minLength": 1,
+      "type": "string"
+    },
+    "familyName": {
+      "maxLength": 100,
+      "minLength": 1,
+      "type": "string"
+    },
+    "licenseType": {
+      "enum": [
+        "audiologist",
+        "speech-language pathologist",
+        "speech and language pathologist",
+        "occupational therapist",
+        "occupational therapy assistant",
+        "licensed professional counselor",
+        "licensed mental health counselor",
+        "licensed clinical mental health counselor",
+        "licensed professional clinical counselor"
+      ],
+      "type": "string"
+    },
     "status": {
       "enum": [
         "active",
@@ -511,11 +941,180 @@
       ],
       "type": "string"
     },
-    "type": {
+    "compact": {
       "enum": [
-        "provider"
+        "aslp",
+        "octp",
+        "coun"
+      ],
+      "type": "string"
+    },
+    "licenseJurisdiction": {
+      "enum": [
+        "al",
+        "ak",
+        "az",
+        "ar",
+        "ca",
+        "co",
+        "ct",
+        "de",
+        "dc",
+        "fl",
+        "ga",
+        "hi",
+        "id",
+        "il",
+        "in",
+        "ia",
+        "ks",
+        "ky",
+        "la",
+        "me",
+        "md",
+        "ma",
+        "mi",
+        "mn",
+        "ms",
+        "mo",
+        "mt",
+        "ne",
+        "nv",
+        "nh",
+        "nj",
+        "nm",
+        "ny",
+        "nc",
+        "nd",
+        "oh",
+        "ok",
+        "or",
+        "pa",
+        "pr",
+        "ri",
+        "sc",
+        "sd",
+        "tn",
+        "tx",
+        "ut",
+        "vt",
+        "va",
+        "vi",
+        "wa",
+        "wv",
+        "wi",
+        "wy"
       ],
       "type": "string"
+    },
+    "privilegeJurisdictions": {
+      "items": {
+        "enum": [
+          "al",
+          "ak",
+          "az",
+          "ar",
+          "ca",
+          "co",
+          "ct",
+          "de",
+          "dc",
+          "fl",
+          "ga",
+          "hi",
+          "id",
+          "il",
+          "in",
+          "ia",
+          "ks",
+          "ky",
+          "la",
+          "me",
+          "md",
+          "ma",
+          "mi",
+          "mn",
+          "ms",
+          "mo",
+          "mt",
+          "ne",
+          "nv",
+          "nh",
+          "nj",
+          "nm",
+          "ny",
+          "nc",
+          "nd",
+          "oh",
+          "ok",
+          "or",
+          "pa",
+          "pr",
+          "ri",
+          "sc",
+          "sd",
+          "tn",
+          "tx",
+          "ut",
+          "vt",
+          "va",
+          "vi",
+          "wa",
+          "wv",
+          "wi",
+          "wy"
+        ],
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "homeAddressStreet1": {
+      "maxLength": 100,
+      "minLength": 2,
+      "type": "string"
+    },
+    "homeAddressStreet2": {
+      "maxLength": 100,
+      "minLength": 1,
+      "type": "string"
+    },
+    "homeAddressCity": {
+      "maxLength": 100,
+      "minLength": 2,
+      "type": "string"
+    },
+    "homeAddressState": {
+      "maxLength": 100,
+      "minLength": 2,
+      "type": "string"
+    },
+    "homeAddressPostalCode": {
+      "maxLength": 7,
+      "minLength": 5,
+      "type": "string"
+    },
+    "militaryWaiver": {
+      "type": "boolean"
+    },
+    "birthMonthDay": {
+      "format": "date",
+      "pattern": "^[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+      "type": "string"
+    },
+    "dateOfBirth": {
+      "format": "date",
+      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+      "type": "string"
+    },
+    "dateOfUpdate": {
+      "format": "date",
+      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+      "type": "string"
+    },
+    "dateOfExpiration": {
+      "format": "date",
+      "pattern": "^[12]{1}[0-9]{3}-[01]{1}[0-9]{1}-[0-3]{1}[0-9]{1}$",
+      "type": "string"
     }
   },
   "required": [
@@ -540,5 +1139,6 @@
     "licenses",
     "privileges"
   ],
-  "type": "object"
+  "type": "object",
+  "$schema": "http://json-schema.org/draft-04/schema#"
 }

From 6273a134a46a3537663f461af02543a377baf8cf Mon Sep 17 00:00:00 2001
From: landonshumway-ia <landon@inspiringapps.com>
Date: Tue, 21 Jan 2025 16:18:19 -0600
Subject: [PATCH 15/18] fix/make file extension matching case-insensitive
 (#462)

File extension matching should not fail if extension is a valid type by
uses different casing
---
 .../handlers/provider_users.py                 |  4 ++--
 .../test_handlers/test_provider_users.py       | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/provider_users.py b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/provider_users.py
index 1dfe1338b..a0c31ee70 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/handlers/provider_users.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/handlers/provider_users.py
@@ -81,7 +81,7 @@ def _post_provider_military_affiliation(event, context):  # noqa: ARG001 unused-
     # verify all files use supported file extensions
     for file_name in file_names:
         file_name_without_extension, file_extension = file_name.rsplit('.', 1)
-        if file_extension not in SUPPORTED_MILITARY_AFFILIATION_FILE_EXTENSIONS:
+        if file_extension.lower() not in [ext.lower() for ext in SUPPORTED_MILITARY_AFFILIATION_FILE_EXTENSIONS]:
             raise CCInvalidRequestException(
                 f'Invalid file type "{file_extension}" The following file types '
                 f'are supported: {SUPPORTED_MILITARY_AFFILIATION_FILE_EXTENSIONS}'
@@ -89,7 +89,7 @@ def _post_provider_military_affiliation(event, context):  # noqa: ARG001 unused-
 
         # generate a UUID for the document key, which includes a random UUID followed by the filename
         # and the file extension
-        document_uuid = f'{uuid.uuid4()}#{file_name_without_extension}.{file_extension}'
+        document_uuid = f'{uuid.uuid4()}#{file_name_without_extension}.{file_extension.lower()}'
         document_key = s3_document_prefix + document_uuid
         document_keys.append(document_key)
 
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_provider_users.py b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_provider_users.py
index 21645e0ea..511572201 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_provider_users.py
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_provider_users.py
@@ -148,6 +148,24 @@ def test_post_provider_military_affiliation_returns_affiliation_information(self
             military_affiliation_data,
         )
 
+    @patch('handlers.provider_users.uuid')
+    @patch('cc_common.config._Config.current_standard_datetime', datetime.fromisoformat('2024-12-04T08:08:08+00:00'))
+    def test_post_provider_military_affiliation_handles_file_with_uppercase_extension(self, mock_uuid):
+        from handlers.provider_users import provider_user_me_military_affiliation
+
+        mock_uuid.uuid4.return_value = '1234'
+
+        event = self._when_testing_post_provider_user_military_affiliation_event_with_custom_claims()
+        event['body'] = json.dumps(
+            {
+                'fileNames': [MOCK_MILITARY_AFFILIATION_FILE_NAME.upper()],
+                'affiliationType': 'militaryMember',
+            }
+        )
+
+        resp = provider_user_me_military_affiliation(event, self.mock_context)
+        self.assertEqual(200, resp['statusCode'])
+
     def test_post_provider_military_affiliation_sets_previous_record_status_to_inactive(self):
         from handlers.provider_users import provider_user_me_military_affiliation
 

From 89984909720329cb6f21943575a06e54b2e6994a Mon Sep 17 00:00:00 2001
From: John Sandoval <jsandoval81@users.noreply.github.com>
Date: Wed, 22 Jan 2025 11:48:44 -0700
Subject: [PATCH 16/18] Add aria-label to mobile nav logo (#484)

### Requirements List
- _None_

### Description List
- Add aria-label to mobile nav logo

### Testing List
- `yarn test:unit:all` should run without errors or warnings
- `yarn serve` should run without errors or warnings
- `yarn build` should run without errors or warnings
- Code review

Sprint PR hotfix.
---
 webroot/src/components/Page/PageHeader/PageHeader.vue | 1 +
 1 file changed, 1 insertion(+)

diff --git a/webroot/src/components/Page/PageHeader/PageHeader.vue b/webroot/src/components/Page/PageHeader/PageHeader.vue
index 800facbcf..a0674b73a 100644
--- a/webroot/src/components/Page/PageHeader/PageHeader.vue
+++ b/webroot/src/components/Page/PageHeader/PageHeader.vue
@@ -16,6 +16,7 @@
                 @keyup.enter="logoClick"
                 role="button"
                 tabindex="0"
+                :aria-label="$t('common.appName')"
             />
         </div>
         <div v-if="$matches.phone.only" class="nav-toggle-container">

From 39172cc9e996081390fc5164e1c8b9cad63535e7 Mon Sep 17 00:00:00 2001
From: John Sandoval <jsandoval81@users.noreply.github.com>
Date: Wed, 22 Jan 2025 11:48:47 -0700
Subject: [PATCH 17/18] Simplify password constraints to match server (#483)

### Requirements List
- _None_

### Description List
- Joi password plugin was not string matching all cases as expected, so
we just removed that constraint since it wasn't server enforced anyway.

### Testing List
- `yarn test:unit:all` should run without errors or warnings
- `yarn serve` should run without errors or warnings
- `yarn build` should run without errors or warnings
- Code review
- New password should now just enforce character length only, which
aligns exactly with the backend currently.

Hotfix for sprint merge.
---
 .../src/components/ChangePassword/ChangePassword.ts  | 12 ------------
 webroot/src/components/UserAccount/UserAccount.less  |  6 ++++++
 2 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/webroot/src/components/ChangePassword/ChangePassword.ts b/webroot/src/components/ChangePassword/ChangePassword.ts
index 6752ba03c..f71316c95 100644
--- a/webroot/src/components/ChangePassword/ChangePassword.ts
+++ b/webroot/src/components/ChangePassword/ChangePassword.ts
@@ -11,7 +11,6 @@ import { authStorage, AuthTypes, tokens } from '@/app.config';
 import MixinForm from '@components/Forms/_mixins/form.mixin';
 import InputPassword from '@components/Forms/InputPassword/InputPassword.vue';
 import InputSubmit from '@components/Forms/InputSubmit/InputSubmit.vue';
-import { User } from '@models/User/User.model';
 import { FormInput } from '@models/FormInput/FormInput.model';
 import { dataApi } from '@network/data.api';
 import Joi from 'joi';
@@ -42,10 +41,6 @@ class ChangePassword extends mixins(MixinForm) {
         return this.$store.state;
     }
 
-    get userStore() {
-        return this.$store.state.user;
-    }
-
     get authType(): AuthTypes {
         return this.globalStore.authType;
     }
@@ -70,10 +65,6 @@ class ChangePassword extends mixins(MixinForm) {
         return token;
     }
 
-    get user(): User {
-        return this.userStore.model || new User();
-    }
-
     get submitLabel(): string {
         return (this.isFormLoading) ? this.$t('common.saving') : this.$t('common.changePassword');
     }
@@ -100,9 +91,6 @@ class ChangePassword extends mixins(MixinForm) {
                 validation: joiPassword
                     .string()
                     .min(12)
-                    .doesNotInclude([
-                        this.user.email,
-                    ])
                     .messages({
                         ...this.joiMessages.string,
                         ...this.joiMessages.password,
diff --git a/webroot/src/components/UserAccount/UserAccount.less b/webroot/src/components/UserAccount/UserAccount.less
index cb5de3cbf..12d5803ce 100644
--- a/webroot/src/components/UserAccount/UserAccount.less
+++ b/webroot/src/components/UserAccount/UserAccount.less
@@ -6,6 +6,12 @@
 //
 
 .account-area-container {
+    width: 95%;
+
+    @media @tabletWidth {
+        width: 50rem;
+    }
+
     .card-title {
         margin-bottom: 3.2rem;
     }

From 1a3a88e3ff06d93b45b6d7a3b4e6cf28eab1deb2 Mon Sep 17 00:00:00 2001
From: Dana Stiefel <35410938+ChiefStief@users.noreply.github.com>
Date: Wed, 22 Jan 2025 11:49:25 -0700
Subject: [PATCH 18/18] Military modal focus and military page label contrast
 hotfixes (#485)

### Requirements List
-

### Description List
- Fixed military modal focus for accessibility
- Fixed military page text contrast

### Testing List
- `yarn test:unit:all` should run without errors or warnings
- `yarn serve` should run without errors or warnings
- `yarn build` should run without errors or warnings
- Smoke test focus change and capture on open military modal
- Confirm contrast issues are fixed
- Code review

Co-authored-by: Dana Stiefel <dana@inspiringapps.com>
---
 webroot/src/components/Forms/InputButton/InputButton.vue | 1 +
 webroot/src/pages/MilitaryStatus/MilitaryStatus.less     | 2 +-
 webroot/src/pages/MilitaryStatus/MilitaryStatus.ts       | 6 ++++++
 webroot/src/pages/MilitaryStatus/MilitaryStatus.vue      | 1 +
 4 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/webroot/src/components/Forms/InputButton/InputButton.vue b/webroot/src/components/Forms/InputButton/InputButton.vue
index db8194924..70f01a2c9 100644
--- a/webroot/src/components/Forms/InputButton/InputButton.vue
+++ b/webroot/src/components/Forms/InputButton/InputButton.vue
@@ -10,6 +10,7 @@
         <input
             type="button"
             :id="id"
+            ref="button"
             class="input-button"
             :class="{
                 'no-text-transform': !shouldTransformText,
diff --git a/webroot/src/pages/MilitaryStatus/MilitaryStatus.less b/webroot/src/pages/MilitaryStatus/MilitaryStatus.less
index 45119ec61..b950b93ac 100644
--- a/webroot/src/pages/MilitaryStatus/MilitaryStatus.less
+++ b/webroot/src/pages/MilitaryStatus/MilitaryStatus.less
@@ -96,7 +96,7 @@
                 }
 
                 .chunk-title {
-                    color: @darkGrey;
+                    color: @lightTextGrey;
                     font-weight: @fontWeightBold;
                     font-size: 1.4rem;
                 }
diff --git a/webroot/src/pages/MilitaryStatus/MilitaryStatus.ts b/webroot/src/pages/MilitaryStatus/MilitaryStatus.ts
index 4283f9bd8..5f56a619f 100644
--- a/webroot/src/pages/MilitaryStatus/MilitaryStatus.ts
+++ b/webroot/src/pages/MilitaryStatus/MilitaryStatus.ts
@@ -178,6 +178,12 @@ export default class MilitaryStatus extends mixins(MixinForm) {
 
     startEndAffiliationFlow() {
         this.shouldShowEndAffiliationModal = true;
+        this.$nextTick(() => {
+            const buttonComponent = this.$refs.noBackButton as any;
+            const button = buttonComponent.$refs.button as HTMLElement;
+
+            button.focus();
+        });
     }
 
     closeEndAffilifationModal() {
diff --git a/webroot/src/pages/MilitaryStatus/MilitaryStatus.vue b/webroot/src/pages/MilitaryStatus/MilitaryStatus.vue
index b92085bca..f24598162 100644
--- a/webroot/src/pages/MilitaryStatus/MilitaryStatus.vue
+++ b/webroot/src/pages/MilitaryStatus/MilitaryStatus.vue
@@ -99,6 +99,7 @@
                         <div class="action-button-row">
                             <InputButton
                                 id="no-back-button"
+                                ref="noBackButton"
                                 class="no-back-button"
                                 :label="backText"
                                 :aria-label="backText"