From 855743fef0aafbf94fa725741afd472cad91de36 Mon Sep 17 00:00:00 2001
From: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Date: Wed, 11 Sep 2024 08:29:19 -0500
Subject: [PATCH 01/44] UI: Fix sanitization and add tests (#28347)

---
 ui/lib/core/addon/utils/client-count-utils.ts |  5 +-
 .../utils/client-count-utils-test.js          | 72 +++++++++++++++++++
 2 files changed, 75 insertions(+), 2 deletions(-)

diff --git a/ui/lib/core/addon/utils/client-count-utils.ts b/ui/lib/core/addon/utils/client-count-utils.ts
index 91c6d08662e0..eb2024d2525b 100644
--- a/ui/lib/core/addon/utils/client-count-utils.ts
+++ b/ui/lib/core/addon/utils/client-count-utils.ts
@@ -85,8 +85,9 @@ export const filteredTotalForMount = (
   if (!nsPath || !mountPath || isEmpty(byNamespace)) return emptyCounts();
   return (
     byNamespace
-      .find((namespace) => namespace.label === nsPath)
-      ?.mounts.find((mount: MountClients) => mount.label === mountPath) || emptyCounts()
+      .find((namespace) => sanitizePath(namespace.label) === sanitizePath(nsPath))
+      ?.mounts.find((mount: MountClients) => sanitizePath(mount.label) === sanitizePath(mountPath)) ||
+    emptyCounts()
   );
 };
 
diff --git a/ui/tests/integration/utils/client-count-utils-test.js b/ui/tests/integration/utils/client-count-utils-test.js
index 68aa399cc6cb..137fee715596 100644
--- a/ui/tests/integration/utils/client-count-utils-test.js
+++ b/ui/tests/integration/utils/client-count-utils-test.js
@@ -13,6 +13,7 @@ import {
   destructureClientCounts,
   sortMonthsByTimestamp,
   filterByMonthDataForMount,
+  filteredTotalForMount,
 } from 'core/utils/client-count-utils';
 import clientsHandler from 'vault/mirage/handlers/clients';
 import {
@@ -481,4 +482,75 @@ module('Integration | Util | client count utils', function (hooks) {
       assert.deepEqual(result[0], this.getExpected('some-mount', 0), 'works when namespace is not found');
     });
   });
+
+  module('filteredTotalForMount', function (hooks) {
+    hooks.beforeEach(function () {
+      this.byNamespace = SERIALIZED_ACTIVITY_RESPONSE.by_namespace;
+    });
+
+    const emptyCounts = {
+      acme_clients: 0,
+      clients: 0,
+      entity_clients: 0,
+      non_entity_clients: 0,
+      secret_syncs: 0,
+    };
+
+    [
+      {
+        when: 'no namespace filter passed',
+        result: 'it returns empty counts',
+        ns: '',
+        mount: 'auth/authid/0',
+        expected: emptyCounts,
+      },
+      {
+        when: 'no mount filter passed',
+        result: 'it returns empty counts',
+        ns: 'ns1',
+        mount: '',
+        expected: emptyCounts,
+      },
+      {
+        when: 'no matching ns/mount exists',
+        result: 'it returns empty counts',
+        ns: 'ns1',
+        mount: 'auth/authid/1',
+        expected: emptyCounts,
+      },
+      {
+        when: 'mount and label have extra slashes',
+        result: 'it returns the data sanitized',
+        ns: 'ns1/',
+        mount: 'auth/authid/0/',
+        expected: {
+          label: 'auth/authid/0',
+          acme_clients: 0,
+          clients: 8394,
+          entity_clients: 4256,
+          non_entity_clients: 4138,
+          secret_syncs: 0,
+        },
+      },
+      {
+        when: 'mount within root',
+        result: 'it returns the data',
+        ns: 'root',
+        mount: 'kvv2-engine-0',
+        expected: {
+          label: 'kvv2-engine-0',
+          acme_clients: 0,
+          clients: 4290,
+          entity_clients: 0,
+          non_entity_clients: 0,
+          secret_syncs: 4290,
+        },
+      },
+    ].forEach((testCase) => {
+      test(`it returns correct values when ${testCase.when}`, async function (assert) {
+        const actual = filteredTotalForMount(this.byNamespace, testCase.ns, testCase.mount);
+        assert.deepEqual(actual, testCase.expected);
+      });
+    });
+  });
 });

From abdeda43ca0f04342123e5fd0c908da9fdacbd64 Mon Sep 17 00:00:00 2001
From: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Date: Wed, 11 Sep 2024 08:29:33 -0500
Subject: [PATCH 02/44] UI: hide client count nav link when chrooted listener
 (#28346)

---
 ui/app/components/sidebar/nav/cluster.hbs     |  6 +++--
 ui/app/components/sidebar/nav/cluster.js      |  6 ++++-
 .../components/sidebar/nav/cluster-test.js    | 26 +++++++++++++++++++
 3 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/ui/app/components/sidebar/nav/cluster.hbs b/ui/app/components/sidebar/nav/cluster.hbs
index 76012058daa7..30f295d3c2df 100644
--- a/ui/app/components/sidebar/nav/cluster.hbs
+++ b/ui/app/components/sidebar/nav/cluster.hbs
@@ -53,7 +53,7 @@
   {{#if
     (or
       (and this.isRootNamespace (has-permission "status" routeParams=(array "replication" "raft" "license" "seal")))
-      (has-permission "clients" routeParams="activity")
+      (and (has-permission "clients" routeParams="activity") (not this.hasChrootNamespace))
     )
   }}
     <Nav.Title data-test-sidebar-nav-heading="Monitoring">Monitoring</Nav.Title>
@@ -81,7 +81,9 @@
       data-test-sidebar-nav-link="Raft Storage"
     />
   {{/if}}
-  {{#if (and (has-permission "clients" routeParams="activity") (not this.cluster.dr.isSecondary))}}
+  {{#if
+    (and (has-permission "clients" routeParams="activity") (not this.cluster.dr.isSecondary) (not this.hasChrootNamespace))
+  }}
     <Nav.Link
       @route="vault.cluster.clients"
       @text="Client Count"
diff --git a/ui/app/components/sidebar/nav/cluster.js b/ui/app/components/sidebar/nav/cluster.js
index 6708ce61acba..371cfb62953d 100644
--- a/ui/app/components/sidebar/nav/cluster.js
+++ b/ui/app/components/sidebar/nav/cluster.js
@@ -17,8 +17,12 @@ export default class SidebarNavClusterComponent extends Component {
     return this.currentCluster.cluster;
   }
 
+  get hasChrootNamespace() {
+    return this.cluster?.hasChrootNamespace;
+  }
+
   get isRootNamespace() {
     // should only return true if we're in the true root namespace
-    return this.namespace.inRootNamespace && !this.cluster?.hasChrootNamespace;
+    return this.namespace.inRootNamespace && !this.hasChrootNamespace;
   }
 }
diff --git a/ui/tests/integration/components/sidebar/nav/cluster-test.js b/ui/tests/integration/components/sidebar/nav/cluster-test.js
index f36209c96eae..1aeea80f45a4 100644
--- a/ui/tests/integration/components/sidebar/nav/cluster-test.js
+++ b/ui/tests/integration/components/sidebar/nav/cluster-test.js
@@ -112,6 +112,32 @@ module('Integration | Component | sidebar-nav-cluster', function (hooks) {
     });
   });
 
+  test('it should hide client counts link in chroot namespace', async function (assert) {
+    this.owner.lookup('service:permissions').setPaths({
+      data: {
+        chroot_namespace: 'admin',
+        root: true,
+      },
+    });
+    this.owner.lookup('service:currentCluster').setCluster({
+      id: 'foo',
+      anyReplicationEnabled: true,
+      usingRaft: true,
+      hasChrootNamespace: true,
+    });
+    const links = ['Client Counts', 'Replication', 'Raft Storage', 'License', 'Seal Vault'];
+
+    await renderComponent();
+    assert
+      .dom('[data-test-sidebar-nav-heading="Monitoring"]')
+      .doesNotExist('Monitoring heading is hidden in chroot namespace');
+    links.forEach((link) => {
+      assert
+        .dom(`[data-test-sidebar-nav-link="${link}"]`)
+        .doesNotExist(`${link} is hidden in chroot namespace`);
+    });
+  });
+
   test('it should render badge for promotional links on managed clusters', async function (assert) {
     this.owner.lookup('service:flags').featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
     const promotionalLinks = ['Secrets Sync'];

From e1c56a300fd9935d86effa1a020673cb823641b2 Mon Sep 17 00:00:00 2001
From: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Date: Wed, 11 Sep 2024 09:19:33 -0500
Subject: [PATCH 03/44] UI: reorg replication (#28332)

* Add replication-overview-mode component + tests

* Move both primary view higher to template

* simplify replication-summary component

* remove replication-mode-summary

* Add jsdocs to replication-overview-mode

* fix overview-mode test

* fix page/mode-index test

* copyright

* address PR comments

* note to devs
---
 .../components/replication-mode-summary.scss  |  16 ---
 ui/app/styles/core.scss                       |   1 -
 .../components/replication-mode-summary.js    |  68 ----------
 .../components/replication-mode-summary.hbs   | 122 -----------------
 .../components/replication-mode-summary.js    |   6 -
 .../components/replication-overview-mode.hbs  |  49 +++++++
 .../components/replication-overview-mode.js   |  39 ++++++
 .../addon/components/replication-summary.js   |   8 +-
 .../components/replication-summary.hbs        | 113 +++++-----------
 ui/lib/replication/addon/templates/index.hbs  |  31 ++++-
 .../components/page/mode-index-test.js        |   2 +-
 .../replication-overview-mode-test.js         | 124 ++++++++++++++++++
 12 files changed, 282 insertions(+), 297 deletions(-)
 delete mode 100644 ui/app/styles/components/replication-mode-summary.scss
 delete mode 100644 ui/lib/core/addon/components/replication-mode-summary.js
 delete mode 100644 ui/lib/core/addon/templates/components/replication-mode-summary.hbs
 delete mode 100644 ui/lib/core/app/components/replication-mode-summary.js
 create mode 100644 ui/lib/replication/addon/components/replication-overview-mode.hbs
 create mode 100644 ui/lib/replication/addon/components/replication-overview-mode.js
 create mode 100644 ui/tests/integration/components/replication-overview-mode-test.js

diff --git a/ui/app/styles/components/replication-mode-summary.scss b/ui/app/styles/components/replication-mode-summary.scss
deleted file mode 100644
index a96a3d15c67b..000000000000
--- a/ui/app/styles/components/replication-mode-summary.scss
+++ /dev/null
@@ -1,16 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-.replication-description {
-  flex-shrink: 1;
-
-  .title {
-    margin-bottom: $spacing-8;
-  }
-
-  .detail-tags {
-    margin-bottom: $spacing-16;
-  }
-}
diff --git a/ui/app/styles/core.scss b/ui/app/styles/core.scss
index 2d020970b73c..73d9e179635a 100644
--- a/ui/app/styles/core.scss
+++ b/ui/app/styles/core.scss
@@ -91,7 +91,6 @@
 @import './components/read-more';
 @import './components/regex-validator';
 @import './components/replication-dashboard';
-@import './components/replication-mode-summary';
 @import './components/replication-page';
 @import './components/replication-summary';
 @import './components/role-item';
diff --git a/ui/lib/core/addon/components/replication-mode-summary.js b/ui/lib/core/addon/components/replication-mode-summary.js
deleted file mode 100644
index 0938b0399dc9..000000000000
--- a/ui/lib/core/addon/components/replication-mode-summary.js
+++ /dev/null
@@ -1,68 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { service } from '@ember/service';
-import { equal } from '@ember/object/computed';
-import { get, computed } from '@ember/object';
-import Component from '@ember/component';
-import layout from '../templates/components/replication-mode-summary';
-
-const replicationAttr = function (attr) {
-  return computed(`cluster.{dr,performance}.${attr}`, 'cluster', 'mode', function () {
-    const { mode, cluster } = this;
-    return get(cluster, `${mode}.${attr}`);
-  });
-};
-export default Component.extend({
-  layout,
-  version: service(),
-  router: service(),
-  namespace: service(),
-  classNameBindings: ['isMenu::box'],
-  attributeBindings: ['href', 'target'],
-  display: 'banner',
-  isMenu: equal('display', 'menu'),
-  href: computed(
-    'cluster.id',
-    'display',
-    'mode',
-    'replicationEnabled',
-    'version.hasPerfReplication',
-    function () {
-      const display = this.display;
-      const mode = this.mode;
-      if (mode === 'performance' && display === 'menu' && this.version.hasPerfReplication === false) {
-        return 'https://www.hashicorp.com/products/vault';
-      }
-      if (this.replicationEnabled || display === 'menu') {
-        return this.router.urlFor('vault.cluster.replication.mode.index', this.cluster.id, mode);
-      }
-      return null;
-    }
-  ),
-  target: computed('isPerformance', 'version.hasPerfReplication', function () {
-    if (this.isPerformance && this.version.hasPerfReplication === false) {
-      return '_blank';
-    }
-    return null;
-  }),
-  internalLink: false,
-  isPerformance: equal('mode', 'performance'),
-  replicationEnabled: replicationAttr('replicationEnabled'),
-  replicationUnsupported: equal('cluster.mode', 'unsupported'),
-  replicationDisabled: replicationAttr('replicationDisabled'),
-  syncProgressPercent: replicationAttr('syncProgressPercent'),
-  syncProgress: replicationAttr('syncProgress'),
-  secondaryId: replicationAttr('secondaryId'),
-  modeForUrl: replicationAttr('modeForUrl'),
-  clusterIdDisplay: replicationAttr('clusterIdDisplay'),
-  mode: null,
-  cluster: null,
-  modeState: computed('cluster', 'mode', function () {
-    const { cluster, mode } = this;
-    const clusterState = cluster[mode].state;
-    return clusterState;
-  }),
-});
diff --git a/ui/lib/core/addon/templates/components/replication-mode-summary.hbs b/ui/lib/core/addon/templates/components/replication-mode-summary.hbs
deleted file mode 100644
index bd2eec9950c7..000000000000
--- a/ui/lib/core/addon/templates/components/replication-mode-summary.hbs
+++ /dev/null
@@ -1,122 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#if this.isMenu}}
-  {{! this is the status menu }}
-  <div class="level is-mobile">
-    <div class="is-flex-grow-1">
-      {{#if this.replicationUnsupported}}
-        Unsupported
-      {{else if this.replicationEnabled}}
-        <div>
-          {{concat (if (eq this.mode "performance") "Performance " "Disaster Recovery ") (capitalize this.modeForUrl)}}
-        </div>
-        {{#if this.secondaryId}}
-          <small>
-            <code>
-              {{this.secondaryId}}
-            </code>
-          </small>
-        {{/if}}
-        <small>
-          <code>
-            {{this.clusterIdDisplay}}
-          </code>
-        </small>
-      {{else if (and (eq this.mode "performance") (not (has-feature "Performance Replication")))}}
-        Learn more
-      {{else if this.auth.currentToken}}
-        Enable
-        {{if (eq this.mode "performance") "Performance" "Disaster Recovery"}}
-      {{else}}
-        <span class="has-text-grey-light">
-          {{if (eq this.mode "performance") "Performance" "Disaster Recovery"}}
-        </span>
-      {{/if}}
-    </div>
-    <div class="level-right">
-      {{#if this.replicationEnabled}}
-        {{#if (cluster-states this.modeState)}}
-          <span class={{if (get (cluster-states this.modeState) "isOk") "has-text-success" "has-text-danger"}}>
-            <Icon @name={{get (cluster-states this.modeState) "glyph"}} />
-          </span>
-        {{else if this.syncProgress}}
-          <progress value={{this.syncProgressPercent}} max="100" class="progress is-small is-narrow is-info">
-            {{this.syncProgress.progress}}
-            of
-            {{this.syncProgress.total}}
-            keys
-          </progress>
-        {{/if}}
-      {{else}}
-        <Icon @name="minus-circle" aria-label="Replication not enabled" class="has-text-grey-light" />
-      {{/if}}
-    </div>
-  </div>
-{{else}}
-  {{! this is the replication index page }}
-  <div class="level">
-    <div class="replication-description level-left">
-      <div>
-        {{#if (and (eq this.mode "performance") (not (has-feature "Performance Replication")))}}
-          <p>
-            Performance Replication is a feature of Vault Enterprise Premium.
-            <ExternalLink
-              @href="https://hashicorp.com/products/vault/trial?source=vaultui_Performance%20Replication"
-              class="link"
-              data-test-upgrade-link-performance
-            >
-              Upgrade
-            </ExternalLink>
-          </p>
-        {{else if (and (eq this.mode "dr") (not (has-feature "DR Replication")))}}
-          <p>
-            Disaster Recovery is a feature of Vault Enterprise Premium.
-            <ExternalLink
-              @href="https://hashicorp.com/products/vault/trial?source=vaultui_Performance%20Replication"
-              class="link"
-              data-test-upgrade-link-dr
-            >
-              Upgrade
-            </ExternalLink>
-          </p>
-        {{else if this.replicationEnabled}}
-          <h6 class="title is-6 is-uppercase">
-            Enabled
-          </h6>
-          <div class="detail-tags">
-            <span class="has-text-grey">
-              {{capitalize this.modeForUrl}}
-            </span>
-            {{#if this.secondaryId}}
-              <span class="tag is-light has-text-grey-dark">
-                <code>
-                  {{this.secondaryId}}
-                </code>
-              </span>
-            {{/if}}
-            <span class="tag is-light has-text-grey-dark">
-              <code>
-                {{this.clusterIdDisplay}}
-              </code>
-            </span>
-          </div>
-        {{/if}}
-        <p class="help has-text-grey-dark">
-          {{replication-mode-description this.mode}}
-        </p>
-      </div>
-    </div>
-    <div class="level-right">
-      <Hds::Button
-        @route="mode.index"
-        @models={{array this.cluster.name this.mode}}
-        @color={{if this.replicationDisabled "primary" "secondary"}}
-        @text={{if this.replicationDisabled "Enable" "Details"}}
-        data-test-replication-details-link={{this.mode}}
-      />
-    </div>
-  </div>
-{{/if}}
\ No newline at end of file
diff --git a/ui/lib/core/app/components/replication-mode-summary.js b/ui/lib/core/app/components/replication-mode-summary.js
deleted file mode 100644
index 605fceb56334..000000000000
--- a/ui/lib/core/app/components/replication-mode-summary.js
+++ /dev/null
@@ -1,6 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export { default } from 'core/components/replication-mode-summary';
diff --git a/ui/lib/replication/addon/components/replication-overview-mode.hbs b/ui/lib/replication/addon/components/replication-overview-mode.hbs
new file mode 100644
index 000000000000..424b895fecaf
--- /dev/null
+++ b/ui/lib/replication/addon/components/replication-overview-mode.hbs
@@ -0,0 +1,49 @@
+{{!
+  Copyright (c) HashiCorp, Inc.
+  SPDX-License-Identifier: BUSL-1.1
+~}}
+
+<Hds::Card::Container @level="mid" @hasBorder={{true}} ...attributes>
+  <div class="has-padding-m">
+    <div class="flex">
+      <Icon @size="24" @name={{this.details.icon}} />
+      <Hds::Text::Display
+        @tag="h2"
+        @size="400"
+        data-test-overview-mode-title
+      >{{this.details.blockTitle}}</Hds::Text::Display>
+    </div>
+    <div class="has-top-padding-m has-bottom-padding-m" data-test-overview-mode-body>
+      {{#if (not (has-feature this.details.feature))}}
+        <Hds::Text::Body @size="300" @tag="div">
+          {{this.details.upgradeTitle}}
+          <Hds::Link::Inline @href={{this.details.upgradeLink}} data-test-upgrade-link={{@mode}}>
+            Upgrade
+          </Hds::Link::Inline>
+        </Hds::Text::Body>
+      {{else if @model.replicationEnabled}}
+        <Hds::Text::Body @tag="div" @size="300" @weight="semibold" @color="strong">ENABLED</Hds::Text::Body>
+        <div class="has-bottom-padding-s">
+          <Hds::Text::Body @color="faint">{{capitalize @model.modeForUrl}}</Hds::Text::Body>
+          {{#if @model.secondaryId}}
+            <Hds::Badge @text={{@model.secondaryId}} />
+          {{/if}}
+          {{#if @model.clusterIdDisplay}}
+            <Hds::Badge @text={{@model.clusterIdDisplay}} />
+          {{/if}}
+        </div>
+      {{/if}}
+
+      <Hds::Text::Body @color="faint">{{replication-mode-description @mode}}</Hds::Text::Body>
+    </div>
+    {{#if (has-feature this.details.feature)}}
+      <Hds::Button
+        @route="mode.index"
+        @models={{array @clusterName @mode}}
+        @color={{if @model.replicationEnabled "secondary" "primary"}}
+        @text={{if @model.replicationEnabled "Details" "Enable"}}
+        data-test-replication-details-link={{@mode}}
+      />
+    {{/if}}
+  </div>
+</Hds::Card::Container>
\ No newline at end of file
diff --git a/ui/lib/replication/addon/components/replication-overview-mode.js b/ui/lib/replication/addon/components/replication-overview-mode.js
new file mode 100644
index 000000000000..0a733d90c139
--- /dev/null
+++ b/ui/lib/replication/addon/components/replication-overview-mode.js
@@ -0,0 +1,39 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+
+/**
+ * @module ReplicationOverviewModeComponent
+ * ReplicationOverviewMode components are used on the Replication index page to display
+ * details about a given mode (DR or Performance) status.
+ *
+ * @example
+ * <ReplicationOverviewModeComponent @mode="dr" @model={{this.cluster.dr}} @clusterName={{this.cluster.name}} />
+ *
+ * @param {string} mode - should be "dr" or "performance"
+ * @param {ReplicationAttributesModel} model - either the dr or performance attribute of the cluster model
+ * @param {string} clusterName - used for the link to the mode details
+ */
+export default class ReplicationOverviewModeComponent extends Component {
+  get details() {
+    if (this.args.mode === 'dr') {
+      return {
+        blockTitle: 'Disaster Recovery (DR)',
+        upgradeTitle: 'Disaster Recovery is a feature of Vault Enterprise Premium.',
+        upgradeLink: 'https://hashicorp.com/products/vault/trial?source=vaultui_DR%20Replication',
+        feature: 'DR Replication',
+        icon: 'replication-direct',
+      };
+    }
+    return {
+      blockTitle: 'Performance',
+      upgradeTitle: 'Performance Replication is a feature of Vault Enterprise Premium.',
+      upgradeLink: 'https://hashicorp.com/products/vault/trial?source=vaultui_Performance%20Replication',
+      feature: 'Performance Replication',
+      icon: 'replication-perf',
+    };
+  }
+}
diff --git a/ui/lib/replication/addon/components/replication-summary.js b/ui/lib/replication/addon/components/replication-summary.js
index 6c9e1f576d7c..43632c646382 100644
--- a/ui/lib/replication/addon/components/replication-summary.js
+++ b/ui/lib/replication/addon/components/replication-summary.js
@@ -8,6 +8,13 @@ import { computed } from '@ember/object';
 import Component from '@ember/component';
 import ReplicationActions from 'core/mixins/replication-actions';
 
+/**
+ * @module ReplicationSummary
+ * ReplicationSummary component is a component to show the mode-specific summary for replication
+ *
+ * @param {ClusterModel} cluster - the cluster ember-data model
+ * @param {string} initialReplicationMode - mode for replication details we want to see, either "dr" or "performance"
+ */
 export default Component.extend(ReplicationActions, {
   'data-test-replication-summary': true,
   attributeBindings: ['data-test-replication-summary'],
@@ -22,7 +29,6 @@ export default Component.extend(ReplicationActions, {
       this.set('replicationMode', initialReplicationMode);
     }
   },
-  showModeSummary: false,
   initialReplicationMode: null,
   cluster: null,
 
diff --git a/ui/lib/replication/addon/templates/components/replication-summary.hbs b/ui/lib/replication/addon/templates/components/replication-summary.hbs
index 133144adbb92..138b364581c4 100644
--- a/ui/lib/replication/addon/templates/components/replication-summary.hbs
+++ b/ui/lib/replication/addon/templates/components/replication-summary.hbs
@@ -3,88 +3,39 @@
   SPDX-License-Identifier: BUSL-1.1
 ~}}
 
-{{#if (not (has-feature "DR Replication"))}}
-  <UpgradePage @title="Replication" />
-{{else if this.showModeSummary}}
-  {{#if (not (and this.cluster.dr.replicationEnabled this.cluster.performance.replicationEnabled))}}
-    <PageHeader as |p|>
-      <p.levelLeft>
-        <h1 class="title is-3" data-test-replication-title>
-          Replication
-        </h1>
-      </p.levelLeft>
-    </PageHeader>
-  {{/if}}
-
-  {{#if (and (eq this.cluster.dr.mode "primary") (eq this.cluster.performance.mode "primary"))}}
+{{#if (eq this.attrsForCurrentMode.mode "initializing")}}
+  The cluster is initializing replication. This may take some time.
+{{else}}
+  <p>{{this.cluster.replicationModeStatus.cluster_id}}</p>
+  <div class="replication">
     <ReplicationPage @model={{this.cluster}} as |Page|>
-      <Page.header @showTabs={{true}} />
-      <Page.dashboard @componentToRender="replication-summary-card" as |Dashboard|>
-        <Dashboard.card @title="Disaster Recovery" />
-        <Dashboard.card @title="Performance" />
-      </Page.dashboard>
-    </ReplicationPage>
-  {{else}}
-    <div class="box is-sideless is-fullwidth is-marginless">
-      <h3 class="title is-flex-center is-5 is-marginless">
-        <Icon @size="24" @name="replication-direct" />
-        Disaster Recovery (DR)
-      </h3>
-      {{#if this.cluster.dr.replicationEnabled}}
-        {{#if this.submit.isRunning}}
-          <LayoutLoading />
+      <Page.dashboard
+        @data={{this.cluster}}
+        @componentToRender={{if
+          (eq this.attrsForCurrentMode.mode "secondary")
+          "replication-secondary-card"
+          "replication-primary-card"
+        }}
+        as |Dashboard|
+      >
+        {{#if (eq this.attrsForCurrentMode.mode "secondary")}}
+          <Dashboard.card @title="Status" />
+          <Dashboard.card @title="Primary cluster" />
         {{else}}
-          <ReplicationModeSummary @mode="dr" @cluster={{this.cluster}} @tagName="span" />
+          <Dashboard.card
+            @title="State"
+            @description="The cluster’s current operating state."
+            @glyph={{get (cluster-states this.attrsForCurrentMode.state) "glyph"}}
+            @metric={{this.attrsForCurrentMode.state}}
+          />
+          <Dashboard.card
+            @title="Last WAL entry"
+            @description="Index of last Write Ahead Logs entry written on local storage. Updates every ten seconds."
+            @metric={{format-number this.attrsForCurrentMode.lastWAL}}
+          />
+          <Dashboard.secondaryCard @cluster={{this.cluster}} @replicationAttrs={{this.attrsForCurrentMode}} />
         {{/if}}
-      {{else}}
-        <ReplicationModeSummary @mode="dr" @cluster={{this.cluster}} @tagName="div" />
-      {{/if}}
-    </div>
-    {{#if (not (and this.submit.isRunning (eq this.cluster.dr.mode "bootstrapping")))}}
-      <div class="box is-bottomless is-fullwidth is-marginless">
-        <h3 class="title is-flex-center is-5 is-marginless">
-          <Icon @size="24" @name="replication-perf" />
-          Performance
-        </h3>
-        <ReplicationModeSummary @mode="performance" @cluster={{this.cluster}} @tagName="span" />
-      </div>
-    {{/if}}
-  {{/if}}
-{{else}}
-  {{#if (eq this.attrsForCurrentMode.mode "initializing")}}
-    The cluster is initializing replication. This may take some time.
-  {{else}}
-    <p>{{this.cluster.replicationModeStatus.cluster_id}}</p>
-    <div class="replication">
-      <ReplicationPage @model={{this.cluster}} as |Page|>
-        <Page.dashboard
-          @data={{this.cluster}}
-          @componentToRender={{if
-            (eq this.attrsForCurrentMode.mode "secondary")
-            "replication-secondary-card"
-            "replication-primary-card"
-          }}
-          as |Dashboard|
-        >
-          {{#if (eq this.attrsForCurrentMode.mode "secondary")}}
-            <Dashboard.card @title="Status" />
-            <Dashboard.card @title="Primary cluster" />
-          {{else}}
-            <Dashboard.card
-              @title="State"
-              @description="The cluster’s current operating state."
-              @glyph={{get (cluster-states this.attrsForCurrentMode.state) "glyph"}}
-              @metric={{this.attrsForCurrentMode.state}}
-            />
-            <Dashboard.card
-              @title="Last WAL entry"
-              @description="Index of last Write Ahead Logs entry written on local storage. Updates every ten seconds."
-              @metric={{format-number this.attrsForCurrentMode.lastWAL}}
-            />
-            <Dashboard.secondaryCard @cluster={{this.cluster}} @replicationAttrs={{this.attrsForCurrentMode}} />
-          {{/if}}
-        </Page.dashboard>
-      </ReplicationPage>
-    </div>
-  {{/if}}
+      </Page.dashboard>
+    </ReplicationPage>
+  </div>
 {{/if}}
\ No newline at end of file
diff --git a/ui/lib/replication/addon/templates/index.hbs b/ui/lib/replication/addon/templates/index.hbs
index 79aefcc04424..e2dc0b70e5db 100644
--- a/ui/lib/replication/addon/templates/index.hbs
+++ b/ui/lib/replication/addon/templates/index.hbs
@@ -6,6 +6,7 @@
 <section class="section">
   <div class="container is-widescreen">
     {{#if (eq this.model.mode "unsupported")}}
+      {{! Replication is unsupported in non-enterprise or when using non-transactional storage (eg inmem) }}
       <PageHeader as |p|>
         <p.levelLeft>
           <h1 class="title is-3 has-text-grey" data-test-replication-title>
@@ -98,8 +99,36 @@
         @onSuccess={{this.onEnableSuccess}}
         @doTransition={{true}}
       />
+    {{else if (not (has-feature "DR Replication"))}}
+      <UpgradePage @title="Replication" />
+    {{else if (and (eq this.model.dr.mode "primary") (eq this.model.performance.mode "primary"))}}
+      {{! Renders when cluster is primary for both replication modes }}
+      <ReplicationPage @model={{this.model}} as |Page|>
+        <Page.header @showTabs={{true}} />
+        <Page.dashboard @componentToRender="replication-summary-card" as |Dashboard|>
+          <Dashboard.card @title="Disaster Recovery" />
+          <Dashboard.card @title="Performance" />
+        </Page.dashboard>
+      </ReplicationPage>
     {{else}}
-      <ReplicationSummary @cluster={{this.model}} @showModeSummary={{true}} @onDisable={{this.onDisable}} />
+      {{! Renders when at least one mode is not enabled }}
+      <PageHeader as |p|>
+        <p.levelLeft>
+          <h1 class="title is-3" data-test-replication-title>
+            Replication
+          </h1>
+        </p.levelLeft>
+      </PageHeader>
+
+      <div class="box is-sideless is-fullwidth is-marginless flex-col">
+        <ReplicationOverviewMode
+          @mode="dr"
+          @model={{this.model.dr}}
+          @clusterName={{this.model.name}}
+          class="has-bottom-margin-m"
+        />
+        <ReplicationOverviewMode @mode="performance" @model={{this.model.performance}} @clusterName={{this.model.name}} />
+      </div>
     {{/if}}
   </div>
 </section>
\ No newline at end of file
diff --git a/ui/tests/integration/components/page/mode-index-test.js b/ui/tests/integration/components/page/mode-index-test.js
index c1a8db07adc5..1dca929ab7be 100644
--- a/ui/tests/integration/components/page/mode-index-test.js
+++ b/ui/tests/integration/components/page/mode-index-test.js
@@ -22,7 +22,7 @@ module('Integration | Component | replication page/mode-index', function (hooks)
   hooks.beforeEach(function () {
     this.store = this.owner.lookup('service:store');
     this.onEnable = () => {};
-    this.clusterModel = {};
+    this.clusterModel = { replicationAttrs: {} };
     this.replicationMode = '';
     this.replicationDisabled = true;
 
diff --git a/ui/tests/integration/components/replication-overview-mode-test.js b/ui/tests/integration/components/replication-overview-mode-test.js
new file mode 100644
index 000000000000..dc8729dc6dd6
--- /dev/null
+++ b/ui/tests/integration/components/replication-overview-mode-test.js
@@ -0,0 +1,124 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render, settled } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { setupEngine } from 'ember-engines/test-support';
+
+const OVERVIEW_MODE = {
+  title: '[data-test-overview-mode-title]',
+  body: '[data-test-overview-mode-body]',
+  detailsLink: '[data-test-replication-details-link]',
+};
+module('Integration | Component | replication-overview-mode', function (hooks) {
+  setupRenderingTest(hooks);
+  setupEngine(hooks, 'replication');
+
+  hooks.beforeEach(function () {
+    this.versionService = this.owner.lookup('service:version');
+    this.versionService.features = [];
+    this.mode = 'dr';
+    this.clusterName = 'foobar';
+    this.modeDetails = { mode: 'disabled' };
+
+    this.renderComponent = async () => {
+      return render(
+        hbs`
+        <ReplicationOverviewMode
+          @clusterName={{this.clusterName}}
+          @mode={{this.mode}}
+          @model={{this.modeDetails}}
+        />`,
+        { owner: this.engine }
+      );
+    };
+  });
+
+  test('without features', async function (assert) {
+    await this.renderComponent();
+    assert.dom(OVERVIEW_MODE.title).hasText('Disaster Recovery (DR)');
+    assert
+      .dom(OVERVIEW_MODE.body)
+      .includesText('Disaster Recovery is a feature of Vault Enterprise Premium. Upgrade');
+    assert.dom(OVERVIEW_MODE.detailsLink).doesNotExist('does not show link to replication (dr)');
+
+    this.set('mode', 'performance');
+    await settled();
+    assert.dom(OVERVIEW_MODE.title).hasText('Performance');
+    assert
+      .dom(OVERVIEW_MODE.body)
+      .includesText('Performance Replication is a feature of Vault Enterprise Premium. Upgrade');
+    assert.dom(OVERVIEW_MODE.detailsLink).doesNotExist('does not show link to replication (perf)');
+  });
+
+  module('with features', function (hooks) {
+    hooks.beforeEach(function () {
+      this.versionService.features = ['DR Replication', 'Performance Replication'];
+    });
+
+    test('it renders when replication disabled', async function (assert) {
+      await this.renderComponent();
+      assert.dom(OVERVIEW_MODE.title).hasText('Disaster Recovery (DR)');
+      assert
+        .dom(OVERVIEW_MODE.body)
+        .hasText(
+          'Disaster Recovery Replication is designed to protect against catastrophic failure of entire clusters. Secondaries do not forward service requests until they are elected and become a new primary.'
+        );
+      assert.dom(OVERVIEW_MODE.detailsLink).hasText('Enable');
+
+      this.set('mode', 'performance');
+      await settled();
+      assert.dom(OVERVIEW_MODE.title).hasText('Performance');
+      assert
+        .dom(OVERVIEW_MODE.body)
+        .hasText(
+          'Performance Replication scales workloads horizontally across clusters to make requests faster. Local secondaries handle read requests but forward writes to the primary to be handled.'
+        );
+      assert.dom(OVERVIEW_MODE.detailsLink).hasText('Enable');
+    });
+
+    test('it renders when replication enabled', async function (assert) {
+      this.mode = 'performance';
+      this.modeDetails = {
+        replicationEnabled: true,
+        mode: 'primary',
+        modeForUrl: 'primary',
+        clusterIdDisplay: 'foobar12',
+      };
+      await this.renderComponent();
+      assert.dom(OVERVIEW_MODE.title).hasText('Performance');
+      assert
+        .dom(OVERVIEW_MODE.body)
+        .includesText('ENABLED Primary foobar12', 'renders mode type and cluster ID if passed');
+      assert.dom(OVERVIEW_MODE.detailsLink).hasText('Details');
+
+      this.set('modeDetails', {
+        replicationEnabled: true,
+        mode: 'secondary',
+        modeForUrl: 'secondary',
+        clusterIdDisplay: 'foobar12',
+        secondaryId: 'some-secondary',
+      });
+      await settled();
+      assert.dom(OVERVIEW_MODE.title).hasText('Performance');
+      assert.dom(OVERVIEW_MODE.body).includesText('ENABLED Secondary some-secondary foobar12');
+      assert.dom(OVERVIEW_MODE.detailsLink).hasText('Details');
+    });
+
+    test('it renders when replication bootstrapping', async function (assert) {
+      this.modeDetails = {
+        replicationEnabled: true,
+        mode: 'bootstrapping',
+        modeForUrl: 'bootstrapping',
+      };
+      await this.renderComponent();
+      assert.dom(OVERVIEW_MODE.title).hasText('Disaster Recovery (DR)');
+      assert.dom(OVERVIEW_MODE.body).includesText('ENABLED Bootstrapping');
+      assert.dom(OVERVIEW_MODE.detailsLink).hasText('Details');
+    });
+  });
+});

From daab76c6e66236292973f0c08c2e31dd45b45f0e Mon Sep 17 00:00:00 2001
From: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Date: Wed, 11 Sep 2024 09:49:04 -0500
Subject: [PATCH 04/44] fix chroot nav tests (#28353)

---
 ui/tests/acceptance/chroot-namespace-test.js | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/ui/tests/acceptance/chroot-namespace-test.js b/ui/tests/acceptance/chroot-namespace-test.js
index 6e34c1fd0e7c..706d630efe90 100644
--- a/ui/tests/acceptance/chroot-namespace-test.js
+++ b/ui/tests/acceptance/chroot-namespace-test.js
@@ -32,10 +32,11 @@ module('Acceptance | chroot-namespace enterprise ui', function (hooks) {
   test('root-only nav items are unavailable', async function (assert) {
     await authPage.login();
 
-    ['Dashboard', 'Secrets Engines', 'Access', 'Tools', 'Policies', 'Client Count'].forEach((nav) => {
+    ['Dashboard', 'Secrets Engines', 'Access', 'Tools', 'Policies'].forEach((nav) => {
       assert.dom(navLink(nav)).exists(`Shows ${nav} nav item in chroot listener`);
     });
-    ['Replication', 'Raft Storage', 'License', 'Seal Vault'].forEach((nav) => {
+    // Client count is not root-only, but it is hidden for chroot
+    ['Replication', 'Raft Storage', 'License', 'Seal Vault', 'Client Count'].forEach((nav) => {
       assert.dom(navLink(nav)).doesNotExist(`Does not show ${nav} nav item in chroot listener`);
     });
 
@@ -83,10 +84,10 @@ module('Acceptance | chroot-namespace enterprise ui', function (hooks) {
     );
 
     await authPage.loginNs(namespace, reader);
-    ['Dashboard', 'Secrets Engines', 'Access', 'Policies', 'Tools', 'Client Count'].forEach((nav) => {
+    ['Dashboard', 'Secrets Engines', 'Access', 'Policies', 'Tools'].forEach((nav) => {
       assert.dom(navLink(nav)).exists(`Shows ${nav} nav item for user with read access policy`);
     });
-    ['Replication', 'Raft Storage', 'License', 'Seal Vault'].forEach((nav) => {
+    ['Replication', 'Raft Storage', 'License', 'Seal Vault', 'Client Count'].forEach((nav) => {
       assert.dom(navLink(nav)).doesNotExist(`Does not show ${nav} nav item for user with read access policy`);
     });
 
@@ -123,10 +124,10 @@ module('Acceptance | chroot-namespace enterprise ui', function (hooks) {
     });
 
     await authPage.loginNs(`${namespace}/child`, childReader);
-    ['Dashboard', 'Secrets Engines', 'Access', 'Policies', 'Tools', 'Client Count'].forEach((nav) => {
+    ['Dashboard', 'Secrets Engines', 'Access', 'Policies', 'Tools'].forEach((nav) => {
       assert.dom(navLink(nav)).exists(`Shows ${nav} nav item within child namespace`);
     });
-    ['Replication', 'Raft Storage', 'License', 'Seal Vault'].forEach((nav) => {
+    ['Replication', 'Raft Storage', 'License', 'Seal Vault', 'Client Count'].forEach((nav) => {
       assert.dom(navLink(nav)).doesNotExist(`Does not show ${nav} nav item within child namespace`);
     });
 

From cda20e39b1ed16ebbee8b7e26a899ad2166d9e2b Mon Sep 17 00:00:00 2001
From: Scott Miller <smiller@hashicorp.com>
Date: Wed, 11 Sep 2024 09:57:27 -0500
Subject: [PATCH 05/44] Ferry ocsp_ca_certificates over the OCSP ValidationConf
 (#28309)

* Ferry ocsp_ca_certificates over the OCSP ValidationConf

* changelog

* First check issuer, then check extraCAS

* Use the correct cert when the signature validation from issuer succeeds

* Validate via extraCas in the cert missing case as well

* dedupe logic

* remove CA test
---
 builtin/credential/cert/path_login.go      |  9 ++
 builtin/credential/cert/path_login_test.go | 93 +++++++++++++++-----
 changelog/28309.txt                        |  3 +
 sdk/helper/ocsp/client.go                  | 99 +++++++++++++++++-----
 sdk/helper/ocsp/ocsp_test.go               |  4 +-
 5 files changed, 163 insertions(+), 45 deletions(-)
 create mode 100644 changelog/28309.txt

diff --git a/builtin/credential/cert/path_login.go b/builtin/credential/cert/path_login.go
index 832036f12dc0..53571b26185e 100644
--- a/builtin/credential/cert/path_login.go
+++ b/builtin/credential/cert/path_login.go
@@ -693,6 +693,15 @@ func (b *backend) loadTrustedCerts(ctx context.Context, storage logical.Storage,
 			conf.QueryAllServers = conf.QueryAllServers || entry.OcspQueryAllServers
 			conf.OcspThisUpdateMaxAge = entry.OcspThisUpdateMaxAge
 			conf.OcspMaxRetries = entry.OcspMaxRetries
+
+			if len(entry.OcspCaCertificates) > 0 {
+				certs, err := certutil.ParseCertsPEM([]byte(entry.OcspCaCertificates))
+				if err != nil {
+					b.Logger().Error("failed to parse ocsp_ca_certificates", "name", name, "error", err)
+					continue
+				}
+				conf.ExtraCas = certs
+			}
 		}
 	}
 
diff --git a/builtin/credential/cert/path_login_test.go b/builtin/credential/cert/path_login_test.go
index 51d670ce8c40..ad1030464f35 100644
--- a/builtin/credential/cert/path_login_test.go
+++ b/builtin/credential/cert/path_login_test.go
@@ -5,6 +5,7 @@ package cert
 
 import (
 	"context"
+	"crypto"
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
@@ -281,19 +282,6 @@ func TestCert_RoleResolve_RoleDoesNotExist(t *testing.T) {
 }
 
 func TestCert_RoleResolveOCSP(t *testing.T) {
-	cases := []struct {
-		name        string
-		failOpen    bool
-		certStatus  int
-		errExpected bool
-	}{
-		{"failFalseGoodCert", false, ocsp.Good, false},
-		{"failFalseRevokedCert", false, ocsp.Revoked, true},
-		{"failFalseUnknownCert", false, ocsp.Unknown, true},
-		{"failTrueGoodCert", true, ocsp.Good, false},
-		{"failTrueRevokedCert", true, ocsp.Revoked, true},
-		{"failTrueUnknownCert", true, ocsp.Unknown, false},
-	}
 	certTemplate := &x509.Certificate{
 		Subject: pkix.Name{
 			CommonName: "example.com",
@@ -332,15 +320,76 @@ func TestCert_RoleResolveOCSP(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
+	tempDir, connState2, err := generateTestCertAndConnState(t, certTemplate)
+	if err != nil {
+		t.Fatalf("error testing connection state: %v", err)
+	}
+	ca2, err := ioutil.ReadFile(filepath.Join(tempDir, "ca_cert.pem"))
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	issuer2 := parsePEM(ca2)
+	pkf2, err := ioutil.ReadFile(filepath.Join(tempDir, "ca_key.pem"))
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	pk2, err := certutil.ParsePEMBundle(string(pkf2))
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	type caData struct {
+		privateKey crypto.Signer
+		caBytes    []byte
+		caChain    []*x509.Certificate
+		connState  tls.ConnectionState
+	}
+
+	ca1Data := caData{
+		pk.PrivateKey,
+		ca,
+		issuer,
+		connState,
+	}
+	ca2Data := caData{
+		pk2.PrivateKey,
+		ca2,
+		issuer2,
+		connState2,
+	}
+
+	cases := []struct {
+		name        string
+		failOpen    bool
+		certStatus  int
+		errExpected bool
+		caData      caData
+		ocspCaCerts string
+	}{
+		{name: "failFalseGoodCert", certStatus: ocsp.Good, caData: ca1Data},
+		{name: "failFalseRevokedCert", certStatus: ocsp.Revoked, errExpected: true, caData: ca1Data},
+		{name: "failFalseUnknownCert", certStatus: ocsp.Unknown, errExpected: true, caData: ca1Data},
+		{name: "failTrueGoodCert", failOpen: true, certStatus: ocsp.Good, caData: ca1Data},
+		{name: "failTrueRevokedCert", failOpen: true, certStatus: ocsp.Revoked, errExpected: true, caData: ca1Data},
+		{name: "failTrueUnknownCert", failOpen: true, certStatus: ocsp.Unknown, caData: ca1Data},
+		{name: "failFalseGoodCertExtraCas", certStatus: ocsp.Good, caData: ca2Data, ocspCaCerts: string(pkf2)},
+		{name: "failFalseRevokedCertExtraCas", certStatus: ocsp.Revoked, errExpected: true, caData: ca2Data, ocspCaCerts: string(pkf2)},
+		{name: "failFalseUnknownCertExtraCas", certStatus: ocsp.Unknown, errExpected: true, caData: ca2Data, ocspCaCerts: string(pkf2)},
+		{name: "failTrueGoodCertExtraCas", failOpen: true, certStatus: ocsp.Good, caData: ca2Data, ocspCaCerts: string(pkf2)},
+		{name: "failTrueRevokedCertExtraCas", failOpen: true, certStatus: ocsp.Revoked, errExpected: true, caData: ca2Data, ocspCaCerts: string(pkf2)},
+		{name: "failTrueUnknownCertExtraCas", failOpen: true, certStatus: ocsp.Unknown, caData: ca2Data, ocspCaCerts: string(pkf2)},
+	}
+
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
-			resp, err := ocsp.CreateResponse(issuer[0], issuer[0], ocsp.Response{
+			resp, err := ocsp.CreateResponse(c.caData.caChain[0], c.caData.caChain[0], ocsp.Response{
 				Status:       c.certStatus,
 				SerialNumber: certTemplate.SerialNumber,
 				ProducedAt:   time.Now(),
 				ThisUpdate:   time.Now(),
 				NextUpdate:   time.Now().Add(time.Hour),
-			}, pk.PrivateKey)
+			}, c.caData.privateKey)
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -351,18 +400,18 @@ func TestCert_RoleResolveOCSP(t *testing.T) {
 			var resolveStep logicaltest.TestStep
 			var loginStep logicaltest.TestStep
 			if c.errExpected {
-				loginStep = testAccStepLoginWithNameInvalid(t, connState, "web")
-				resolveStep = testAccStepResolveRoleOCSPFail(t, connState, "web")
+				loginStep = testAccStepLoginWithNameInvalid(t, c.caData.connState, "web")
+				resolveStep = testAccStepResolveRoleOCSPFail(t, c.caData.connState, "web")
 			} else {
-				loginStep = testAccStepLoginWithName(t, connState, "web")
-				resolveStep = testAccStepResolveRoleWithName(t, connState, "web")
+				loginStep = testAccStepLoginWithName(t, c.caData.connState, "web")
+				resolveStep = testAccStepResolveRoleWithName(t, c.caData.connState, "web")
 			}
 			logicaltest.Test(t, logicaltest.TestCase{
 				CredentialBackend: b,
 				Steps: []logicaltest.TestStep{
-					testAccStepCertWithExtraParams(t, "web", ca, "foo", allowed{dns: "example.com"}, false,
-						map[string]interface{}{"ocsp_enabled": true, "ocsp_fail_open": c.failOpen}),
-					testAccStepReadCertPolicy(t, "web", false, map[string]interface{}{"ocsp_enabled": true, "ocsp_fail_open": c.failOpen}),
+					testAccStepCertWithExtraParams(t, "web", c.caData.caBytes, "foo", allowed{dns: "example.com"}, false,
+						map[string]interface{}{"ocsp_enabled": true, "ocsp_fail_open": c.failOpen, "ocsp_ca_certificates": c.ocspCaCerts}),
+					testAccStepReadCertPolicy(t, "web", false, map[string]interface{}{"ocsp_enabled": true, "ocsp_fail_open": c.failOpen, "ocsp_ca_certificates": c.ocspCaCerts}),
 					loginStep,
 					resolveStep,
 				},
diff --git a/changelog/28309.txt b/changelog/28309.txt
new file mode 100644
index 000000000000..94574b312103
--- /dev/null
+++ b/changelog/28309.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/cert: ocsp_ca_certificates field was not honored when validating OCSP responses signed by a CA that did not issue the certificate.
+```
\ No newline at end of file
diff --git a/sdk/helper/ocsp/client.go b/sdk/helper/ocsp/client.go
index cef1f6896b48..872ca717da5e 100644
--- a/sdk/helper/ocsp/client.go
+++ b/sdk/helper/ocsp/client.go
@@ -321,6 +321,7 @@ func (c *Client) retryOCSP(
 	reqBody []byte,
 	subject,
 	issuer *x509.Certificate,
+	extraCas []*x509.Certificate,
 ) (ocspRes *ocsp.Response, ocspResBytes []byte, ocspS *ocspStatus, retErr error) {
 	doRequest := func(request *retryablehttp.Request) (*http.Response, error) {
 		if request != nil {
@@ -391,7 +392,7 @@ func (c *Client) retryOCSP(
 			continue
 		}
 
-		if err := validateOCSPParsedResponse(ocspRes, subject, issuer); err != nil {
+		if err := validateOCSPParsedResponse(ocspRes, subject, issuer, extraCas); err != nil {
 			err = fmt.Errorf("error validating %v OCSP response: %w", method, err)
 
 			if IsOcspVerificationError(err) {
@@ -443,7 +444,7 @@ func IsOcspVerificationError(err error) bool {
 	return errors.As(err, &errOcspIssuer)
 }
 
-func validateOCSPParsedResponse(ocspRes *ocsp.Response, subject, issuer *x509.Certificate) error {
+func validateOCSPParsedResponse(ocspRes *ocsp.Response, subject, issuer *x509.Certificate, extraCas []*x509.Certificate) error {
 	// Above, we use the unsafe issuer=nil parameter to ocsp.ParseResponse
 	// because Go's library does the wrong thing.
 	//
@@ -462,38 +463,59 @@ func validateOCSPParsedResponse(ocspRes *ocsp.Response, subject, issuer *x509.Ce
 	//
 	// This addresses the !!unsafe!! behavior above.
 	if ocspRes.Certificate == nil {
+		// With no certificate, we need to validate that the response is signed by the issuer or an extra CA
 		if err := ocspRes.CheckSignatureFrom(issuer); err != nil {
-			return &ErrOcspIssuerVerification{fmt.Errorf("error directly verifying signature: %w", err)}
+			if len(extraCas) > 0 {
+				// Perhaps it was signed by one of the extra configured OCSP CAs
+				matchedCA, overallErr := verifySignature(ocspRes, extraCas)
+
+				if overallErr != nil {
+					return &ErrOcspIssuerVerification{fmt.Errorf("error checking chain of trust %v failed: %w", issuer.Subject.String(), overallErr)}
+				}
+
+				err := validateSigner(matchedCA)
+				if err != nil {
+					return err
+				}
+			} else {
+				return &ErrOcspIssuerVerification{fmt.Errorf("error directly verifying signature: %w", err)}
+			}
 		}
 	} else {
 		// Because we have at least one certificate here, we know that
 		// Go's ocsp library verified the signature from this certificate
 		// onto the response and it was valid. Now we need to know we trust
-		// this certificate. There's two ways we can do this:
+		// this certificate. There are three ways we can do this:
 		//
 		// 1. Via confirming issuer == ocspRes.Certificate, or
 		// 2. Via confirming ocspRes.Certificate.CheckSignatureFrom(issuer).
+		// 3. Trusting extra configured OCSP CAs
 		if !bytes.Equal(issuer.Raw, ocspRes.Raw) {
-			// 1 must not hold, so 2 holds; verify the signature.
+			var overallErr error
+			var matchedCA *x509.Certificate
+
+			// Assumption 1 failed, try 2
 			if err := ocspRes.Certificate.CheckSignatureFrom(issuer); err != nil {
-				return &ErrOcspIssuerVerification{fmt.Errorf("error checking chain of trust %v failed: %w", issuer.Subject.String(), err)}
-			}
+				// Assumption 2 failed, try 3
+				overallErr = multierror.Append(overallErr, err)
 
-			// Verify the OCSP responder certificate is still valid and
-			// contains the required EKU since it is a delegated OCSP
-			// responder certificate.
-			if ocspRes.Certificate.NotAfter.Before(time.Now()) {
-				return &ErrOcspIssuerVerification{fmt.Errorf("error checking delegated OCSP responder OCSP response: certificate has expired")}
-			}
-			haveEKU := false
-			for _, ku := range ocspRes.Certificate.ExtKeyUsage {
-				if ku == x509.ExtKeyUsageOCSPSigning {
-					haveEKU = true
-					break
+				m, err := verifySignature(ocspRes, extraCas)
+				if err != nil {
+					overallErr = multierror.Append(overallErr, err)
+				} else {
+					matchedCA = m
 				}
+			} else {
+				matchedCA = ocspRes.Certificate
 			}
-			if !haveEKU {
-				return &ErrOcspIssuerVerification{fmt.Errorf("error checking delegated OCSP responder: certificate lacks the OCSP Signing EKU")}
+
+			if overallErr != nil {
+				return &ErrOcspIssuerVerification{fmt.Errorf("error checking chain of trust %v failed: %w", issuer.Subject.String(), overallErr)}
+			}
+
+			err := validateSigner(matchedCA)
+			if err != nil {
+				return err
 			}
 		}
 	}
@@ -512,6 +534,41 @@ func validateOCSPParsedResponse(ocspRes *ocsp.Response, subject, issuer *x509.Ce
 	return nil
 }
 
+func verifySignature(res *ocsp.Response, extraCas []*x509.Certificate) (*x509.Certificate, error) {
+	var overallErr error
+	var matchedCA *x509.Certificate
+	for _, ca := range extraCas {
+		if err := res.CheckSignatureFrom(ca); err != nil {
+			overallErr = multierror.Append(overallErr, err)
+		} else {
+			matchedCA = ca
+			overallErr = nil
+			break
+		}
+	}
+	return matchedCA, overallErr
+}
+
+func validateSigner(matchedCA *x509.Certificate) error {
+	// Verify the OCSP responder certificate is still valid and
+	// contains the required EKU since it is a delegated OCSP
+	// responder certificate.
+	if matchedCA.NotAfter.Before(time.Now()) {
+		return &ErrOcspIssuerVerification{fmt.Errorf("error checking delegated OCSP responder OCSP response: certificate has expired")}
+	}
+	haveEKU := false
+	for _, ku := range matchedCA.ExtKeyUsage {
+		if ku == x509.ExtKeyUsageOCSPSigning {
+			haveEKU = true
+			break
+		}
+	}
+	if !haveEKU {
+		return &ErrOcspIssuerVerification{fmt.Errorf("error checking delegated OCSP responder: certificate lacks the OCSP Signing EKU")}
+	}
+	return nil
+}
+
 // GetRevocationStatus checks the certificate revocation status for subject using issuer certificate.
 func (c *Client) GetRevocationStatus(ctx context.Context, subject, issuer *x509.Certificate, conf *VerifyConfig) (*ocspStatus, error) {
 	status, ocspReq, encodedCertID, err := c.validateWithCache(subject, issuer, conf)
@@ -564,7 +621,7 @@ func (c *Client) GetRevocationStatus(ctx context.Context, subject, issuer *x509.
 				defer wg.Done()
 			}
 			ocspRes, _, ocspS, err := c.retryOCSP(
-				ctx, ocspClient, retryablehttp.NewRequest, u, headers, ocspReq, subject, issuer)
+				ctx, ocspClient, retryablehttp.NewRequest, u, headers, ocspReq, subject, issuer, conf.ExtraCas)
 			ocspResponses[i] = ocspRes
 			if err != nil {
 				errors[i] = err
diff --git a/sdk/helper/ocsp/ocsp_test.go b/sdk/helper/ocsp/ocsp_test.go
index 111576653428..063756d28cae 100644
--- a/sdk/helper/ocsp/ocsp_test.go
+++ b/sdk/helper/ocsp/ocsp_test.go
@@ -677,7 +677,7 @@ func TestOCSPRetry(t *testing.T) {
 		context.TODO(),
 		client, fakeRequestFunc,
 		dummyOCSPHost,
-		make(map[string]string), []byte{0}, certs[0], certs[len(certs)-1])
+		make(map[string]string), []byte{0}, certs[0], certs[len(certs)-1], nil)
 	if err == nil {
 		fmt.Printf("should fail: %v, %v, %v\n", res, b, st)
 	}
@@ -692,7 +692,7 @@ func TestOCSPRetry(t *testing.T) {
 		context.TODO(),
 		client, fakeRequestFunc,
 		dummyOCSPHost,
-		make(map[string]string), []byte{0}, certs[0], certs[len(certs)-1])
+		make(map[string]string), []byte{0}, certs[0], certs[len(certs)-1], nil)
 	if err == nil {
 		fmt.Printf("should fail: %v, %v, %v\n", res, b, st)
 	}

From 2e4c6ed1eedceeb4ac0c06fcaee96f709e4408ce Mon Sep 17 00:00:00 2001
From: hc-github-team-secure-vault-core
 <github-team-secure-vault-core@hashicorp.com>
Date: Wed, 11 Sep 2024 13:36:37 -0400
Subject: [PATCH 06/44] Update vault-plugin-secrets-mongodbatlas to v0.13.0
 (#28348)

* Update vault-plugin-secrets-mongodbatlas to v0.13.0

* Add changelog

---------

Co-authored-by: hc-github-team-secure-vault-ecosystem <hc-github-team-secure-vault-ecosystem@users.noreply.github.com>
---
 changelog/28348.txt | 3 +++
 go.mod              | 2 +-
 go.sum              | 4 ++--
 3 files changed, 6 insertions(+), 3 deletions(-)
 create mode 100644 changelog/28348.txt

diff --git a/changelog/28348.txt b/changelog/28348.txt
new file mode 100644
index 000000000000..7b8177491b8c
--- /dev/null
+++ b/changelog/28348.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/mongodbatlas: Update plugin to v0.13.0
+```
diff --git a/go.mod b/go.mod
index f89c9682bbee..3262fedf7774 100644
--- a/go.mod
+++ b/go.mod
@@ -149,7 +149,7 @@ require (
 	github.com/hashicorp/vault-plugin-secrets-gcpkms v0.18.0
 	github.com/hashicorp/vault-plugin-secrets-kubernetes v0.9.0
 	github.com/hashicorp/vault-plugin-secrets-kv v0.20.0
-	github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.12.0
+	github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.13.0
 	github.com/hashicorp/vault-plugin-secrets-openldap v0.14.0
 	github.com/hashicorp/vault-plugin-secrets-terraform v0.10.0
 	github.com/hashicorp/vault-testing-stepwise v0.3.1
diff --git a/go.sum b/go.sum
index dd0c44bdb97a..419280cf0af7 100644
--- a/go.sum
+++ b/go.sum
@@ -1591,8 +1591,8 @@ github.com/hashicorp/vault-plugin-secrets-kubernetes v0.9.0 h1:HEgEjYzG/DYBbCOrm
 github.com/hashicorp/vault-plugin-secrets-kubernetes v0.9.0/go.mod h1:I/CF2GdsKiZ3ZgPrNVF+bs3XD7pUxp24iSKTVV4pHeE=
 github.com/hashicorp/vault-plugin-secrets-kv v0.20.0 h1:p1RVmd4x1rgGK0tN8DDu21J21bR3O93qBFXLGEdJSEo=
 github.com/hashicorp/vault-plugin-secrets-kv v0.20.0/go.mod h1:bCpMggD3Z0+H+3dOmTCoQjBHC53jA08lPqOLmFrHBi8=
-github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.12.0 h1:zbddJmujV0YrtePRSeCsXxfloL0RbDyLhQsJ6l3yjrw=
-github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.12.0/go.mod h1:SFCvcu7ypRUcsuSC3DPUu7BFFhGOTwmZfiIRz3zBinE=
+github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.13.0 h1:BeDS7luTeOW0braIbtuyairFF8SEz7k3nvi9e+mJ2Ok=
+github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.13.0/go.mod h1:sprde+S70PBIbgOLUAKDxR+xNF714ksBBVh77O3hnWc=
 github.com/hashicorp/vault-plugin-secrets-openldap v0.14.0 h1:hhuh8FwP2jJ6dlOKOO/wDmwt1eEmhy0Hw0OjdkioP5c=
 github.com/hashicorp/vault-plugin-secrets-openldap v0.14.0/go.mod h1:wqOf/QJqrrNXjnm0eLUnm5Ju9s/LIZUl6wEKmnFL9Uo=
 github.com/hashicorp/vault-plugin-secrets-terraform v0.10.0 h1:YzOJrpuDRNrw5SQ4i7IEjedF40I/7ejupQy+gAyQ6Zg=

From 10cbd8871ead017d7acd2907f3be4bdc2b7c4edb Mon Sep 17 00:00:00 2001
From: Angel Garbarino <Monkeychip@users.noreply.github.com>
Date: Wed, 11 Sep 2024 11:54:05 -0600
Subject: [PATCH 07/44] change the error (#28358)

---
 ui/app/components/secret-engine/configure-aws.hbs | 2 +-
 ui/app/helpers/mountable-secret-engines.js        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ui/app/components/secret-engine/configure-aws.hbs b/ui/app/components/secret-engine/configure-aws.hbs
index d26b0acc3c6d..46ab7e36c3d9 100644
--- a/ui/app/components/secret-engine/configure-aws.hbs
+++ b/ui/app/components/secret-engine/configure-aws.hbs
@@ -50,7 +50,7 @@
             @onChange={{fn this.onChangeAccessType "wif"}}
             @disabled={{this.disableAccessType}}
           />
-          <label for="access-type-wif">Workflow Identity Federation</label>
+          <label for="access-type-wif">Workload Identity Federation</label>
         </div>
       </fieldset>
     {{/if}}
diff --git a/ui/app/helpers/mountable-secret-engines.js b/ui/app/helpers/mountable-secret-engines.js
index 1577368cdedf..216eb960fa96 100644
--- a/ui/app/helpers/mountable-secret-engines.js
+++ b/ui/app/helpers/mountable-secret-engines.js
@@ -134,7 +134,7 @@ const MOUNTABLE_SECRET_ENGINES = [
   },
 ];
 
-// A list of Workflow Identity Federation engines. Will eventually include Azure and GCP.
+// A list of Workload Identity Federation engines. Will eventually include Azure and GCP.
 export const WIF_ENGINES = ['aws'];
 
 export function wifEngines() {

From 2b8d079754a15314a85a8ff03230cb661d5f8990 Mon Sep 17 00:00:00 2001
From: hc-github-team-secure-vault-core
 <github-team-secure-vault-core@hashicorp.com>
Date: Wed, 11 Sep 2024 14:11:26 -0400
Subject: [PATCH 08/44] Update vault-plugin-secrets-ad to v0.19.0 (#28361)

---------

Co-authored-by: hc-github-team-secure-vault-ecosystem <hc-github-team-secure-vault-ecosystem@users.noreply.github.com>
---
 changelog/28361.txt | 3 +++
 go.mod              | 2 +-
 go.sum              | 4 ++--
 3 files changed, 6 insertions(+), 3 deletions(-)
 create mode 100644 changelog/28361.txt

diff --git a/changelog/28361.txt b/changelog/28361.txt
new file mode 100644
index 000000000000..075bb21414f3
--- /dev/null
+++ b/changelog/28361.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/ad: Update plugin to v0.19.0
+```
diff --git a/go.mod b/go.mod
index 3262fedf7774..d3cb802e2f4d 100644
--- a/go.mod
+++ b/go.mod
@@ -142,7 +142,7 @@ require (
 	github.com/hashicorp/vault-plugin-database-redis-elasticache v0.5.0
 	github.com/hashicorp/vault-plugin-database-snowflake v0.12.0
 	github.com/hashicorp/vault-plugin-mock v0.16.1
-	github.com/hashicorp/vault-plugin-secrets-ad v0.18.0
+	github.com/hashicorp/vault-plugin-secrets-ad v0.19.0
 	github.com/hashicorp/vault-plugin-secrets-alicloud v0.18.0
 	github.com/hashicorp/vault-plugin-secrets-azure v0.20.0
 	github.com/hashicorp/vault-plugin-secrets-gcp v0.20.0
diff --git a/go.sum b/go.sum
index 419280cf0af7..779ce9d6a853 100644
--- a/go.sum
+++ b/go.sum
@@ -1577,8 +1577,8 @@ github.com/hashicorp/vault-plugin-database-snowflake v0.12.0 h1:rykZv8cV7W6iSeR9
 github.com/hashicorp/vault-plugin-database-snowflake v0.12.0/go.mod h1:grT3WmPmEiRY6zjEkJJ781jWq7h9Yg68jlU8G/BXuBU=
 github.com/hashicorp/vault-plugin-mock v0.16.1 h1:5QQvSUHxDjEEbrd2REOeacqyJnCLPD51IQzy71hx8P0=
 github.com/hashicorp/vault-plugin-mock v0.16.1/go.mod h1:83G4JKlOwUtxVourn5euQfze3ZWyXcUiLj2wqrKSDIM=
-github.com/hashicorp/vault-plugin-secrets-ad v0.18.0 h1:amSAV4+W3wBWfuOQk1TA8lHETsrQ7c8PC2PDjroRQMI=
-github.com/hashicorp/vault-plugin-secrets-ad v0.18.0/go.mod h1:Dz4s3LTMaZg1wZs41Zqe0vAW19c0HSUzQN36yGzzO+U=
+github.com/hashicorp/vault-plugin-secrets-ad v0.19.0 h1:jt5flxYYEaqXasCNzE8MUsA1qWe2FjOWhS1viRpqsbE=
+github.com/hashicorp/vault-plugin-secrets-ad v0.19.0/go.mod h1:FlrqHh3gDEOx81OEMFRPGgle+IlnKJUs+3HPYL8bawc=
 github.com/hashicorp/vault-plugin-secrets-alicloud v0.18.0 h1:LCaOtwItk9x4lYVKjNyj1+AG+8423O9jSYcw7NBeick=
 github.com/hashicorp/vault-plugin-secrets-alicloud v0.18.0/go.mod h1:We2m27w9q7uQgF1UULA3TtcUH6LnA4ItuiujhvvAGOU=
 github.com/hashicorp/vault-plugin-secrets-azure v0.20.0 h1:rWsyvZQzF2G1Wkvp624yNIoZHeB7gQ4/Nxk9WuA9HtA=

From c68cdaef105ca4009a8204390c79bc019cb8faac Mon Sep 17 00:00:00 2001
From: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Date: Wed, 11 Sep 2024 13:56:07 -0500
Subject: [PATCH 09/44] UI: Show filters and hide mount attribution when child
 clients only (#28357)

---
 ui/app/components/clients/page/counts.hbs   |  2 +-
 ui/app/components/clients/page/counts.ts    |  2 +-
 ui/app/components/clients/page/overview.hbs | 14 ++++++++------
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/ui/app/components/clients/page/counts.hbs b/ui/app/components/clients/page/counts.hbs
index 6fcad2c6f236..a81fb12a792d 100644
--- a/ui/app/components/clients/page/counts.hbs
+++ b/ui/app/components/clients/page/counts.hbs
@@ -36,7 +36,7 @@
       </Hds::Alert>
     {{/if}}
 
-    {{#if (or @mountPath this.mountPaths)}}
+    {{#if (or @namespace this.namespaces @mountPath this.mountPaths)}}
       <Hds::Text::Display @tag="p">
         Filters
       </Hds::Text::Display>
diff --git a/ui/app/components/clients/page/counts.ts b/ui/app/components/clients/page/counts.ts
index feffaf794279..8d1b6c56cf3b 100644
--- a/ui/app/components/clients/page/counts.ts
+++ b/ui/app/components/clients/page/counts.ts
@@ -131,7 +131,7 @@ export default class ClientsCountsPageComponent extends Component<Args> {
 
   // namespace list for the search-select filter
   get namespaces() {
-    return this.args.activity.byNamespace
+    return this.args.activity?.byNamespace
       ? this.args.activity.byNamespace
           .map((namespace) => ({
             name: namespace.label,
diff --git a/ui/app/components/clients/page/overview.hbs b/ui/app/components/clients/page/overview.hbs
index 897794fb1afc..7486ab37681f 100644
--- a/ui/app/components/clients/page/overview.hbs
+++ b/ui/app/components/clients/page/overview.hbs
@@ -21,10 +21,12 @@
     @responseTimestamp={{@activity.responseTimestamp}}
     @isSecretsSyncActivated={{this.flags.secretsSyncIsActivated}}
   />
-  <Clients::Attribution
-    @noun="mount"
-    @attribution={{this.namespaceMountAttribution}}
-    @responseTimestamp={{@activity.responseTimestamp}}
-    @isSecretsSyncActivated={{this.flags.secretsSyncIsActivated}}
-  />
+  {{#if this.namespaceMountAttribution}}
+    <Clients::Attribution
+      @noun="mount"
+      @attribution={{this.namespaceMountAttribution}}
+      @responseTimestamp={{@activity.responseTimestamp}}
+      @isSecretsSyncActivated={{this.flags.secretsSyncIsActivated}}
+    />
+  {{/if}}
 {{/if}}
\ No newline at end of file

From 146ad63256462cc54f4c25212838ee137b7ea48f Mon Sep 17 00:00:00 2001
From: "Luis (LT) Carbonell" <lt.carbonell@hashicorp.com>
Date: Wed, 11 Sep 2024 15:07:34 -0400
Subject: [PATCH 10/44] Add build for FIPS ARM Docker images (#28310)

* Add build for FIPS ARM Docker images

* arm64 build
---
 .github/actions/containerize/action.yml  | 4 ++--
 .github/workflows/build-artifacts-ce.yml | 2 +-
 .github/workflows/enos-run-k8s.yml       | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/actions/containerize/action.yml b/.github/actions/containerize/action.yml
index e269298e52b7..2c43266a6ff0 100644
--- a/.github/actions/containerize/action.yml
+++ b/.github/actions/containerize/action.yml
@@ -90,7 +90,7 @@ runs:
         [[ ! -d "$dest_dir" ]] && mkdir -p "$dest_dir"
         [[ ! -f "$dest_path" ]] && cp ${{ inputs.vault-binary-path }} "${dest_path}"
     - if: inputs.docker == 'true'
-      uses: hashicorp/actions-docker-build@v2
+      uses: hashicorp/actions-docker-build@f22d5ac7d36868afaa4be1cc1203ec1b5865cadd
       with:
         arch: ${{ inputs.goarch }}
         do_zip_extract_step: 'false' # Don't download and extract an already present binary
@@ -99,7 +99,7 @@ runs:
         revision: ${{ steps.vars.outputs.revision }}
         version: ${{ steps.vars.outputs.container-version }}
     - if: inputs.redhat == 'true'
-      uses: hashicorp/actions-docker-build@v2
+      uses: hashicorp/actions-docker-build@f22d5ac7d36868afaa4be1cc1203ec1b5865cadd
       with:
         arch: ${{ inputs.goarch }}
         do_zip_extract_step: 'false' # Don't download and extract an already present binary
diff --git a/.github/workflows/build-artifacts-ce.yml b/.github/workflows/build-artifacts-ce.yml
index c413ca1ac43d..9669ae3f78dc 100644
--- a/.github/workflows/build-artifacts-ce.yml
+++ b/.github/workflows/build-artifacts-ce.yml
@@ -93,7 +93,7 @@ jobs:
             redhat: true
           - goos: linux
             goarch: arm64
-            redhat: false
+            redhat: true
       fail-fast: true
     runs-on: ${{ fromJSON(inputs.compute-build) }}
     name: (${{ matrix.goos }}, ${{ matrix.goarch }})
diff --git a/.github/workflows/enos-run-k8s.yml b/.github/workflows/enos-run-k8s.yml
index c629e44b47ae..0edf7f034e6a 100644
--- a/.github/workflows/enos-run-k8s.yml
+++ b/.github/workflows/enos-run-k8s.yml
@@ -26,7 +26,7 @@ env:
 jobs:
   enos:
     name: Integration
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(contains(inputs.artifact-name, 'vault-enterprise') && (contains(inputs.artifact-name, 'arm64') && '["self-hosted","ondemand","os=ubuntu-arm","type=c6g.xlarge"]' || '["self-hosted","linux","small"]') || '"ubuntu-latest"') }}
     env:
       GITHUB_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
     steps:

From 9b99ac166b619b32429e54be8717210e5957b506 Mon Sep 17 00:00:00 2001
From: Hamza Shili <98858609+HamzaShili65@users.noreply.github.com>
Date: Wed, 11 Sep 2024 14:09:50 -0500
Subject: [PATCH 11/44] Update vault-plugin-auth-gcp to v0.19.0 (#28366)

* Update vault-plugin-auth-gcp to v0.19.0

* Add changelog
---
 changelog/28366.txt | 3 +++
 go.mod              | 2 +-
 go.sum              | 4 ++--
 3 files changed, 6 insertions(+), 3 deletions(-)
 create mode 100644 changelog/28366.txt

diff --git a/changelog/28366.txt b/changelog/28366.txt
new file mode 100644
index 000000000000..5f2d65783986
--- /dev/null
+++ b/changelog/28366.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/gcp: Update plugin to v0.19.0
+```
diff --git a/go.mod b/go.mod
index d3cb802e2f4d..e564992db3b1 100644
--- a/go.mod
+++ b/go.mod
@@ -130,7 +130,7 @@ require (
 	github.com/hashicorp/vault-plugin-auth-alicloud v0.19.0
 	github.com/hashicorp/vault-plugin-auth-azure v0.19.0
 	github.com/hashicorp/vault-plugin-auth-cf v0.19.0
-	github.com/hashicorp/vault-plugin-auth-gcp v0.18.0
+	github.com/hashicorp/vault-plugin-auth-gcp v0.19.0
 	github.com/hashicorp/vault-plugin-auth-jwt v0.22.0
 	github.com/hashicorp/vault-plugin-auth-kerberos v0.13.0
 	github.com/hashicorp/vault-plugin-auth-kubernetes v0.19.0
diff --git a/go.sum b/go.sum
index 779ce9d6a853..90be45aba2a1 100644
--- a/go.sum
+++ b/go.sum
@@ -1553,8 +1553,8 @@ github.com/hashicorp/vault-plugin-auth-azure v0.19.0 h1:TdInvToRpn0tCl/+R4qqAAov
 github.com/hashicorp/vault-plugin-auth-azure v0.19.0/go.mod h1:elSxwfldjnRJQsJIAfD305g7gvUnFDykGvuY5phNNgw=
 github.com/hashicorp/vault-plugin-auth-cf v0.19.0 h1:/I084ZCypbhTO5ZiYjxhjzokuDqOWWLLxHatyViU9ss=
 github.com/hashicorp/vault-plugin-auth-cf v0.19.0/go.mod h1:LiH/IttNxAgto2ooR9l2g6+CiXc5c/1uPE0pT0hILRg=
-github.com/hashicorp/vault-plugin-auth-gcp v0.18.0 h1:chiaa1NLN/B2fcoN/WY/YWVxB8F+hE5koudzLWQcG2c=
-github.com/hashicorp/vault-plugin-auth-gcp v0.18.0/go.mod h1:HtXlc4HKAmUe8/WE4hP0dirpkq4joxhvm8EZ/TvOZk0=
+github.com/hashicorp/vault-plugin-auth-gcp v0.19.0 h1:mMTnAGDi6GigGmP9DlLjDzp5VRF8/sZzw8hlfOLFbbU=
+github.com/hashicorp/vault-plugin-auth-gcp v0.19.0/go.mod h1:+0+ufeudu8nKVS448iHnzKp5SgLtMcs2U9E0nOUoL/Q=
 github.com/hashicorp/vault-plugin-auth-jwt v0.22.0 h1:ihjx6HszRSt8Vfknc5t0AKXBQqFhqTQ4Wdd/PK+EboU=
 github.com/hashicorp/vault-plugin-auth-jwt v0.22.0/go.mod h1:+Ne5sCgAza7aDIzxE4aruv6PeQI9ORWIvg/dFe2jlJU=
 github.com/hashicorp/vault-plugin-auth-kerberos v0.13.0 h1:KN+nY7XJANb7IRILf0EnaCT04JI9ctiUhq/W9sgyJnk=

From 28d69301ca22b283d16fcf7c3f823bf15e01231f Mon Sep 17 00:00:00 2001
From: hc-github-team-secure-vault-core
 <github-team-secure-vault-core@hashicorp.com>
Date: Wed, 11 Sep 2024 15:52:22 -0400
Subject: [PATCH 12/44] Update vault-plugin-secrets-gcpkms to v0.19.0 (#28360)

* Update vault-plugin-secrets-gcpkms to v0.19.0

* Add changelog

---------

Co-authored-by: hc-github-team-secure-vault-ecosystem <hc-github-team-secure-vault-ecosystem@users.noreply.github.com>
---
 changelog/28360.txt | 3 +++
 go.mod              | 2 +-
 go.sum              | 4 ++--
 3 files changed, 6 insertions(+), 3 deletions(-)
 create mode 100644 changelog/28360.txt

diff --git a/changelog/28360.txt b/changelog/28360.txt
new file mode 100644
index 000000000000..722c8361eaaa
--- /dev/null
+++ b/changelog/28360.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/gcpkms: Update plugin to v0.19.0
+```
diff --git a/go.mod b/go.mod
index e564992db3b1..a2674de9e077 100644
--- a/go.mod
+++ b/go.mod
@@ -146,7 +146,7 @@ require (
 	github.com/hashicorp/vault-plugin-secrets-alicloud v0.18.0
 	github.com/hashicorp/vault-plugin-secrets-azure v0.20.0
 	github.com/hashicorp/vault-plugin-secrets-gcp v0.20.0
-	github.com/hashicorp/vault-plugin-secrets-gcpkms v0.18.0
+	github.com/hashicorp/vault-plugin-secrets-gcpkms v0.19.0
 	github.com/hashicorp/vault-plugin-secrets-kubernetes v0.9.0
 	github.com/hashicorp/vault-plugin-secrets-kv v0.20.0
 	github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.13.0
diff --git a/go.sum b/go.sum
index 90be45aba2a1..dabb769dd0b1 100644
--- a/go.sum
+++ b/go.sum
@@ -1585,8 +1585,8 @@ github.com/hashicorp/vault-plugin-secrets-azure v0.20.0 h1:rWsyvZQzF2G1Wkvp624yN
 github.com/hashicorp/vault-plugin-secrets-azure v0.20.0/go.mod h1:PW7g5lgIcwudoZAthoc3xNqiumHHI1gvNw9en/iI3TQ=
 github.com/hashicorp/vault-plugin-secrets-gcp v0.20.0 h1:yTRId8Y8rpf6LBUcnAEMQZfMBApiKFxPh7669RcE2zg=
 github.com/hashicorp/vault-plugin-secrets-gcp v0.20.0/go.mod h1:FiAMuQ67Wyy2qvXZyezcMFo0ZCh/Prk5FtBABdc1cPc=
-github.com/hashicorp/vault-plugin-secrets-gcpkms v0.18.0 h1:SwD+EsAuLwWXWt+Zj7xcVSpOIfuFLivMFz5tT7FTAdQ=
-github.com/hashicorp/vault-plugin-secrets-gcpkms v0.18.0/go.mod h1:lgOxzYMEpF/1KyncqD9L0qFx91gnGlCD/yYjihE61Xw=
+github.com/hashicorp/vault-plugin-secrets-gcpkms v0.19.0 h1:XMVCbZtI5UwJ19KoYZpg4Q6byVccRvUzm/I4SGaFJ4o=
+github.com/hashicorp/vault-plugin-secrets-gcpkms v0.19.0/go.mod h1:3OEx2UIpLZ0f4biNj60hRZTULuTzJV43Tn6+jKj9xdY=
 github.com/hashicorp/vault-plugin-secrets-kubernetes v0.9.0 h1:HEgEjYzG/DYBbCOrm3Pr43XPNwZWMool1EzcRFw3lgg=
 github.com/hashicorp/vault-plugin-secrets-kubernetes v0.9.0/go.mod h1:I/CF2GdsKiZ3ZgPrNVF+bs3XD7pUxp24iSKTVV4pHeE=
 github.com/hashicorp/vault-plugin-secrets-kv v0.20.0 h1:p1RVmd4x1rgGK0tN8DDu21J21bR3O93qBFXLGEdJSEo=

From 2b4e99fa75f21b74e1287e1179c4ebc8e34c0e04 Mon Sep 17 00:00:00 2001
From: hc-github-team-secure-vault-core
 <github-team-secure-vault-core@hashicorp.com>
Date: Wed, 11 Sep 2024 16:19:28 -0400
Subject: [PATCH 13/44] Update vault-plugin-auth-kubernetes to v0.20.0 (#28289)

* Update vault-plugin-auth-kubernetes to v0.20.0

* Add changelog

---------

Co-authored-by: hc-github-team-secure-vault-ecosystem <hc-github-team-secure-vault-ecosystem@users.noreply.github.com>
---
 changelog/28289.txt | 3 +++
 go.mod              | 3 +--
 go.sum              | 6 ++----
 3 files changed, 6 insertions(+), 6 deletions(-)
 create mode 100644 changelog/28289.txt

diff --git a/changelog/28289.txt b/changelog/28289.txt
new file mode 100644
index 000000000000..e203556fb134
--- /dev/null
+++ b/changelog/28289.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/kubernetes: Update plugin to v0.20.0
+```
diff --git a/go.mod b/go.mod
index a2674de9e077..f56479f88e94 100644
--- a/go.mod
+++ b/go.mod
@@ -133,7 +133,7 @@ require (
 	github.com/hashicorp/vault-plugin-auth-gcp v0.19.0
 	github.com/hashicorp/vault-plugin-auth-jwt v0.22.0
 	github.com/hashicorp/vault-plugin-auth-kerberos v0.13.0
-	github.com/hashicorp/vault-plugin-auth-kubernetes v0.19.0
+	github.com/hashicorp/vault-plugin-auth-kubernetes v0.20.0
 	github.com/hashicorp/vault-plugin-auth-oci v0.17.0
 	github.com/hashicorp/vault-plugin-database-couchbase v0.12.0
 	github.com/hashicorp/vault-plugin-database-elasticsearch v0.16.0
@@ -239,7 +239,6 @@ require (
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9 // indirect
-	gopkg.in/go-jose/go-jose.v2 v2.6.3 // indirect
 )
 
 require (
diff --git a/go.sum b/go.sum
index dabb769dd0b1..fbe76f5d5946 100644
--- a/go.sum
+++ b/go.sum
@@ -1559,8 +1559,8 @@ github.com/hashicorp/vault-plugin-auth-jwt v0.22.0 h1:ihjx6HszRSt8Vfknc5t0AKXBQq
 github.com/hashicorp/vault-plugin-auth-jwt v0.22.0/go.mod h1:+Ne5sCgAza7aDIzxE4aruv6PeQI9ORWIvg/dFe2jlJU=
 github.com/hashicorp/vault-plugin-auth-kerberos v0.13.0 h1:KN+nY7XJANb7IRILf0EnaCT04JI9ctiUhq/W9sgyJnk=
 github.com/hashicorp/vault-plugin-auth-kerberos v0.13.0/go.mod h1:tJ4upLp8+7xxNHBFwpXQaQQQjkwSwI4P/Hic9EKkWvQ=
-github.com/hashicorp/vault-plugin-auth-kubernetes v0.19.0 h1:zJLrTPyVp62BEDrK3+ZimyELCx0ShBBQppFnloy/fJ8=
-github.com/hashicorp/vault-plugin-auth-kubernetes v0.19.0/go.mod h1:JHa4MgsZh6PopoDW4kyRi1E/F9g8eYLavyvva7z0llU=
+github.com/hashicorp/vault-plugin-auth-kubernetes v0.20.0 h1:C+3gSOE+M1JT/6K/CNbQXCAUAA2wFQ7IFpD9Y9IPXxU=
+github.com/hashicorp/vault-plugin-auth-kubernetes v0.20.0/go.mod h1:5//ywSXEdrni78mPcOAE+BnF8XUnbvSMCIwMvmHSbzI=
 github.com/hashicorp/vault-plugin-auth-oci v0.17.0 h1:t2PNAWSZNNm7sf+l2vK4wod0fQ4DckVZuCb3N9Dgark=
 github.com/hashicorp/vault-plugin-auth-oci v0.17.0/go.mod h1:vCuIzHclwIyL+Vk6OfIoqjOomuvPmwRUbnnxlxHCyqM=
 github.com/hashicorp/vault-plugin-database-couchbase v0.12.0 h1:WBPE3nsbM03HxmBBEa2dca2XR/6wZqm1eKZDo3NFxOg=
@@ -3053,8 +3053,6 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EV
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2/go.mod h1:Xk6kEKp8OKb+X14hQBKWaSkCsqBpgog8nAV2xsGOxlo=
-gopkg.in/go-jose/go-jose.v2 v2.6.3 h1:nt80fvSDlhKWQgSWyHyy5CfmlQr+asih51R8PTWNKKs=
-gopkg.in/go-jose/go-jose.v2 v2.6.3/go.mod h1:zzZDPkNNw/c9IE7Z9jr11mBZQhKQTMzoEEIoEdZlFBI=
 gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=

From 49b46ead82b1d6db93c18a9a5d60cd8cc3120364 Mon Sep 17 00:00:00 2001
From: claire bontempo <68122737+hellobontempo@users.noreply.github.com>
Date: Thu, 12 Sep 2024 06:51:11 -0700
Subject: [PATCH 14/44] UI: Fix enabling replication capabilities bug (#28371)

* add capabilities service to replication engine

* fix capabilities paths in route file

* pass updated capabilities using getters

* add changelog

* fix logic so default is based on undefined capabilities (not no mode)
---
 changelog/28371.txt                           |  3 ++
 ui/app/app.js                                 |  1 +
 .../components/enable-replication-form.js     | 17 ++++---
 .../addon/components/page/mode-index.hbs      |  4 +-
 .../addon/components/page/mode-index.js       | 40 ++++++++++++++++
 ui/lib/replication/addon/controllers/index.js | 20 ++++++++
 ui/lib/replication/addon/engine.js            |  1 +
 .../replication/addon/routes/application.js   | 46 +++++++++++++------
 ui/lib/replication/addon/templates/index.hbs  |  4 +-
 .../components/page/mode-index-test.js        | 42 +++++++++++++++++
 10 files changed, 150 insertions(+), 28 deletions(-)
 create mode 100644 changelog/28371.txt
 create mode 100644 ui/lib/replication/addon/components/page/mode-index.js

diff --git a/changelog/28371.txt b/changelog/28371.txt
new file mode 100644
index 000000000000..c719c4be56c0
--- /dev/null
+++ b/changelog/28371.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix UI improperly checking capabilities for enabling performance and dr replication
+```
diff --git a/ui/app/app.js b/ui/app/app.js
index e5484bf392e1..9409b0cd916f 100644
--- a/ui/app/app.js
+++ b/ui/app/app.js
@@ -27,6 +27,7 @@ export default class App extends Application {
       dependencies: {
         services: [
           'auth',
+          'capabilities',
           'flash-messages',
           'namespace',
           'replication-mode',
diff --git a/ui/lib/replication/addon/components/enable-replication-form.js b/ui/lib/replication/addon/components/enable-replication-form.js
index f27f13709367..bd1145e0d417 100644
--- a/ui/lib/replication/addon/components/enable-replication-form.js
+++ b/ui/lib/replication/addon/components/enable-replication-form.js
@@ -19,16 +19,15 @@ import { waitFor } from '@ember/test-waiters';
  * but otherwise it handles the rest of the form inputs. On success it will clear the form and call the onSuccess callback.
  *
  * @example
- * ```js
  * <EnableReplicationForm @replicationMode="dr" @canEnablePrimary={{true}} @canEnableSecondary={{false}} @performanceReplicationDisabled={{false}} @onSuccess={{this.reloadCluster}} />
- *    @param {string} replicationMode - should be one of "dr" or "performance"
- *    @param {boolean} canEnablePrimary - if the capabilities allow the user to enable a primary cluster
- *    @param {boolean} canEnableSecondary - if the capabilities allow the user to enable a secondary cluster
- *    @param {boolean} performanceMode - should be "primary", "secondary", or "disabled". If enabled, form will show a warning when attempting to enable DR secondary
- *    @param {Promise} onSuccess - (optional) callback called after successful replication enablement. Must be a promise.
- *    @param {boolean} doTransition - (optional) if provided, passed to onSuccess callback to determine if a transition should be done
- *  />
- * ```
+ *
+ * @param {string} replicationMode - should be one of "dr" or "performance"
+ * @param {boolean} canEnablePrimary - if the capabilities allow the user to enable a primary cluster, parent getter returns capabilities based on type (i.e. "dr" or "performance")
+ * @param {boolean} canEnableSecondary - if the capabilities allow the user to enable a secondary cluster, parent getter returns capabilities based on type (i.e. "dr" or "performance")
+ * @param {boolean} performanceMode - should be "primary", "secondary", or "disabled". If enabled, form will show a warning when attempting to enable DR secondary
+ * @param {Promise} onSuccess - (optional) callback called after successful replication enablement. Must be a promise.
+ * @param {boolean} doTransition - (optional) if provided, passed to onSuccess callback to determine if a transition should be done
+ *
  */
 export default class EnableReplicationFormComponent extends Component {
   @service version;
diff --git a/ui/lib/replication/addon/components/page/mode-index.hbs b/ui/lib/replication/addon/components/page/mode-index.hbs
index bc45bcc4c37f..d35e024b0f28 100644
--- a/ui/lib/replication/addon/components/page/mode-index.hbs
+++ b/ui/lib/replication/addon/components/page/mode-index.hbs
@@ -45,8 +45,8 @@
   </div>
   <EnableReplicationForm
     @replicationMode={{@replicationMode}}
-    @canEnablePrimary={{@cluster.canEnablePrimary}}
-    @canEnableSecondary={{@cluster.canEnableSecondary}}
+    @canEnablePrimary={{this.canEnable "Primary"}}
+    @canEnableSecondary={{this.canEnable "Secondary"}}
     @performanceReplicationDisabled={{@cluster.performance.replicationDisabled}}
     @performanceMode={{if @cluster.performance.replicationDisabled "disabled" @cluster.performance.modeForUrl}}
     @onSuccess={{@onEnableSuccess}}
diff --git a/ui/lib/replication/addon/components/page/mode-index.js b/ui/lib/replication/addon/components/page/mode-index.js
new file mode 100644
index 000000000000..4b6e438d8ffc
--- /dev/null
+++ b/ui/lib/replication/addon/components/page/mode-index.js
@@ -0,0 +1,40 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+
+/**
+ * @module PageModeIndex
+ *
+ * @example
+ * <Page::ModeIndex
+ *  @cluster={{this.model}}
+ *  @onEnableSuccess={{this.onEnableSuccess}}
+ *  @replicationDisabled={{this.replicationForMode.replicationDisabled}
+ *  @replicationMode={{this.replicationMode}}
+ * />
+ *
+ * @param {model} cluster - cluster route model
+ * @param {function} onEnableSuccess - callback after enabling is successful, handles transition if enabled from the top-level index route
+ * @param {boolean} replicationDisabled - whether or not replication is enabled
+ * @param {string} replicationMode - should be "dr" or "performance"
+ */
+export default class PageModeIndex extends Component {
+  canEnable = (type) => {
+    const { cluster, replicationMode } = this.args;
+    let perm;
+    if (replicationMode === 'dr') {
+      // returns canEnablePrimaryDr or canEnableSecondaryDr
+      perm = `canEnable${type}Dr`;
+    }
+    if (replicationMode === 'performance') {
+      // returns canEnablePrimaryPerformance or canEnableSecondaryPerformance
+      perm = `canEnable${type}Performance`;
+    }
+    // if there's a problem checking capabilities, default to true
+    // since the backend can gate as a fallback
+    return cluster[perm] ?? true;
+  };
+}
diff --git a/ui/lib/replication/addon/controllers/index.js b/ui/lib/replication/addon/controllers/index.js
index cab8fc4eb9ac..e5be14b7a7fc 100644
--- a/ui/lib/replication/addon/controllers/index.js
+++ b/ui/lib/replication/addon/controllers/index.js
@@ -8,4 +8,24 @@ import { tracked } from '@glimmer/tracking';
 
 export default class ReplicationIndexController extends ReplicationModeBaseController {
   @tracked modeSelection = 'dr';
+
+  getPerm(type) {
+    if (this.modeSelection === 'dr') {
+      // returns canEnablePrimaryDr or canEnableSecondaryDr
+      return `canEnable${type}Dr`;
+    }
+    if (this.modeSelection === 'performance') {
+      // returns canEnablePrimaryPerformance or canEnableSecondaryPerformance
+      return `canEnable${type}Performance`;
+    }
+  }
+
+  // if there's a problem checking capabilities, default to true
+  // since the backend will gate as a fallback
+  get canEnablePrimary() {
+    return this.model[this.getPerm('Primary')] ?? true;
+  }
+  get canEnableSecondary() {
+    return this.model[this.getPerm('Secondary')] ?? true;
+  }
 }
diff --git a/ui/lib/replication/addon/engine.js b/ui/lib/replication/addon/engine.js
index f3ddb560ea47..b7757a16b6d4 100644
--- a/ui/lib/replication/addon/engine.js
+++ b/ui/lib/replication/addon/engine.js
@@ -16,6 +16,7 @@ const Eng = Engine.extend({
   dependencies: {
     services: [
       'auth',
+      'capabilities',
       'flash-messages',
       'namespace',
       'replication-mode',
diff --git a/ui/lib/replication/addon/routes/application.js b/ui/lib/replication/addon/routes/application.js
index 72bdd69741fb..e54b870f9793 100644
--- a/ui/lib/replication/addon/routes/application.js
+++ b/ui/lib/replication/addon/routes/application.js
@@ -5,7 +5,6 @@
 
 import { service } from '@ember/service';
 import { setProperties } from '@ember/object';
-import { hash } from 'rsvp';
 import Route from '@ember/routing/route';
 import ClusterRoute from 'vault/mixins/cluster-route';
 
@@ -14,6 +13,23 @@ export default Route.extend(ClusterRoute, {
   store: service(),
   auth: service(),
   router: service(),
+  capabilities: service(),
+
+  async fetchCapabilities() {
+    const enablePath = (type, cluster) => `sys/replication/${type}/${cluster}/enable`;
+    const perms = await this.capabilities.fetchMultiplePaths([
+      enablePath('dr', 'primary'),
+      enablePath('dr', 'primary'),
+      enablePath('performance', 'secondary'),
+      enablePath('performance', 'secondary'),
+    ]);
+    return {
+      canEnablePrimaryDr: perms[enablePath('dr', 'primary')].canUpdate,
+      canEnableSecondaryDr: perms[enablePath('dr', 'primary')].canUpdate,
+      canEnablePrimaryPerformance: perms[enablePath('performance', 'secondary')].canUpdate,
+      canEnableSecondaryPerformance: perms[enablePath('performance', 'secondary')].canUpdate,
+    };
+  },
 
   beforeModel() {
     if (this.auth.activeCluster.replicationRedacted) {
@@ -29,21 +45,21 @@ export default Route.extend(ClusterRoute, {
     return this.auth.activeCluster;
   },
 
-  afterModel(model) {
-    return hash({
-      canEnablePrimary: this.store
-        .findRecord('capabilities', 'sys/replication/primary/enable')
-        .then((c) => c.canUpdate),
-      canEnableSecondary: this.store
-        .findRecord('capabilities', 'sys/replication/secondary/enable')
-        .then((c) => c.canUpdate),
-    }).then(({ canEnablePrimary, canEnableSecondary }) => {
-      setProperties(model, {
-        canEnablePrimary,
-        canEnableSecondary,
-      });
-      return model;
+  async afterModel(model) {
+    const {
+      canEnablePrimaryDr,
+      canEnableSecondaryDr,
+      canEnablePrimaryPerformance,
+      canEnableSecondaryPerformance,
+    } = await this.fetchCapabilities();
+
+    setProperties(model, {
+      canEnablePrimaryDr,
+      canEnableSecondaryDr,
+      canEnablePrimaryPerformance,
+      canEnableSecondaryPerformance,
     });
+    return model;
   },
   actions: {
     refresh() {
diff --git a/ui/lib/replication/addon/templates/index.hbs b/ui/lib/replication/addon/templates/index.hbs
index e2dc0b70e5db..25f497dc9487 100644
--- a/ui/lib/replication/addon/templates/index.hbs
+++ b/ui/lib/replication/addon/templates/index.hbs
@@ -92,8 +92,8 @@
       </div>
       <EnableReplicationForm
         @replicationMode={{this.modeSelection}}
-        @canEnablePrimary={{this.model.canEnablePrimary}}
-        @canEnableSecondary={{this.model.canEnableSecondary}}
+        @canEnablePrimary={{this.canEnablePrimary}}
+        @canEnableSecondary={{this.canEnableSecondary}}
         @performanceReplicationDisabled={{this.model.performance.replicationDisabled}}
         @performanceMode={{if this.model.performance.replicationDisabled "disabled" this.model.performance.modeForUrl}}
         @onSuccess={{this.onEnableSuccess}}
diff --git a/ui/tests/integration/components/page/mode-index-test.js b/ui/tests/integration/components/page/mode-index-test.js
index 1dca929ab7be..9af014881efb 100644
--- a/ui/tests/integration/components/page/mode-index-test.js
+++ b/ui/tests/integration/components/page/mode-index-test.js
@@ -13,7 +13,9 @@ const S = {
   title: 'h1',
   subtitle: 'h2',
   enableForm: '[data-test-replication-enable-form]',
+  enableBtn: '[data-test-replication-enable]',
   summary: '[data-test-replication-summary]',
+  notAllowed: '[data-test-not-allowed]',
 };
 module('Integration | Component | replication page/mode-index', function (hooks) {
   setupRenderingTest(hooks);
@@ -43,6 +45,8 @@ module('Integration | Component | replication page/mode-index', function (hooks)
 
       assert.dom(S.title).hasText('Enable Disaster Recovery Replication');
       assert.dom(S.enableForm).exists();
+      assert.dom(S.notAllowed).doesNotExist();
+      assert.dom(S.enableBtn).exists('Enable button shows by default if no permissions available');
     });
     test('it renders correctly when replication enabled', async function (assert) {
       this.replicationDisabled = false;
@@ -51,6 +55,24 @@ module('Integration | Component | replication page/mode-index', function (hooks)
       assert.dom(S.enableForm).doesNotExist();
       assert.dom(S.summary).exists();
     });
+
+    test('it hides enable button if no permissions', async function (assert) {
+      this.clusterModel.canEnablePrimaryDr = false;
+      await this.renderComponent();
+
+      assert.dom(S.enableForm).exists();
+      assert.dom(S.notAllowed).exists();
+      assert.dom(S.enableBtn).doesNotExist();
+    });
+
+    test('it shows enable button if has permissions', async function (assert) {
+      this.clusterModel.canEnablePrimaryDr = true;
+      await this.renderComponent();
+
+      assert.dom(S.enableForm).exists();
+      assert.dom(S.notAllowed).doesNotExist();
+      assert.dom(S.enableBtn).exists();
+    });
   });
 
   module('Performance mode', function (hooks) {
@@ -62,6 +84,8 @@ module('Integration | Component | replication page/mode-index', function (hooks)
 
       assert.dom(S.title).hasText('Enable Performance Replication');
       assert.dom(S.enableForm).exists();
+      assert.dom(S.notAllowed).doesNotExist();
+      assert.dom(S.enableBtn).exists('Enable button shows by default if no permissions available');
     });
     test('it renders correctly when replication enabled', async function (assert) {
       this.replicationDisabled = false;
@@ -70,5 +94,23 @@ module('Integration | Component | replication page/mode-index', function (hooks)
       assert.dom(S.enableForm).doesNotExist();
       assert.dom(S.summary).exists();
     });
+
+    test('it hides enable button if no permissions', async function (assert) {
+      this.clusterModel.canEnablePrimaryPerformance = false;
+      await this.renderComponent();
+
+      assert.dom(S.enableForm).exists();
+      assert.dom(S.notAllowed).exists();
+      assert.dom(S.enableBtn).doesNotExist();
+    });
+
+    test('it shows enable button if has permissions', async function (assert) {
+      this.clusterModel.canEnablePrimaryPerformance = true;
+      await this.renderComponent();
+
+      assert.dom(S.enableForm).exists();
+      assert.dom(S.notAllowed).doesNotExist();
+      assert.dom(S.enableBtn).exists();
+    });
   });
 });

From f52b98482178b4077c5a25f5f193d4d442f81ab5 Mon Sep 17 00:00:00 2001
From: Scott Miller <smiller@hashicorp.com>
Date: Thu, 12 Sep 2024 09:14:22 -0500
Subject: [PATCH 15/44] Mention the cert forwarding header in cert auth docs
 (#28377)

* Mention the cert forwarding header in cert auth docs

* Move to own section and fix link
---
 website/content/docs/auth/cert.mdx | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/website/content/docs/auth/cert.mdx b/website/content/docs/auth/cert.mdx
index ea4027ea3f26..e13790a4a386 100644
--- a/website/content/docs/auth/cert.mdx
+++ b/website/content/docs/auth/cert.mdx
@@ -23,7 +23,7 @@ CA certificates are associated with a role; role names and CRL names are normali
 lower-case.
 
 Please note that to use this auth method, `tls_disable` and `tls_disable_client_certs` must be false in the Vault
-configuration. This is because the certificates are sent through TLS communication itself.
+configuration. This is because the certificates are sent through TLS communication itself. 
 
 ## Revocation checking
 
@@ -140,6 +140,18 @@ management tool.
    clients is given by the "web-cert.pem" file. Lastly, an optional `ttl` value
    can be provided in seconds to limit the lease duration.
 
+### Load Balancing / Proxying Consideration
+
+If the Vault server is fronted by a reverse proxy or load balancer, TLS is
+terminated before Vault.  In that case the proxy must provide the validated
+client certificate via header, and [configured in the Vault configuration's
+listener stanza](/vault/docs/configuration/listener/tcp#tcp-listener-parameters).
+
+Configure the listener with the header name that your load balancer provides.  
+In this mode, the security of authentication depends on the load balancer performing 
+full TLS verification to the client, and that the connection between the load
+balancer and Vault is secured, ideally with Mutual TLS.
+
 ## API
 
 The TLS Certificate auth method has a full HTTP API. Please see the

From cc38383732dc5d58c75fc05e1068c2d785cfb839 Mon Sep 17 00:00:00 2001
From: JMGoldsmith <spartanaudio@gmail.com>
Date: Thu, 12 Sep 2024 17:26:46 +0200
Subject: [PATCH 16/44] VAULT-30694 Adding a check for nil values returned by
 the queue (#28330)

* adding a check for nil values returned by the queue

* adding changelog

* changing to be more idiomatic

* fixing error message to be a bit more clear

* reverting change to error handling

* Update builtin/logical/aws/path_static_roles.go

Co-authored-by: John-Michael Faircloth <fairclothjm@users.noreply.github.com>

---------

Co-authored-by: John-Michael Faircloth <fairclothjm@users.noreply.github.com>
---
 builtin/logical/aws/path_static_roles.go | 6 ++++++
 changelog/28330.txt                      | 3 +++
 2 files changed, 9 insertions(+)
 create mode 100644 changelog/28330.txt

diff --git a/builtin/logical/aws/path_static_roles.go b/builtin/logical/aws/path_static_roles.go
index f07eab54ab18..1bc5667e5575 100644
--- a/builtin/logical/aws/path_static_roles.go
+++ b/builtin/logical/aws/path_static_roles.go
@@ -219,6 +219,12 @@ func (b *backend) pathStaticRolesWrite(ctx context.Context, req *logical.Request
 		if err != nil {
 			return nil, fmt.Errorf("expected an item with name %q, but got an error: %w", config.Name, err)
 		}
+		// check if i is nil to prevent panic because
+		// 1. PopByKey returns nil if the key does not exist; and
+		// 2. the static cred queue is not repopulated on reload (see VAULT-30877)
+		if i == nil {
+			return nil, fmt.Errorf("expected an item with name %q, but got nil", config.Name)
+		}
 		i.Value = config
 		// update the next rotation to occur at now + the new rotation period
 		i.Priority = time.Now().Add(config.RotationPeriod).Unix()
diff --git a/changelog/28330.txt b/changelog/28330.txt
new file mode 100644
index 000000000000..57f8ff979554
--- /dev/null
+++ b/changelog/28330.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/aws: Fixed potential panic after step-down and the queue has not repopulated.
+```
\ No newline at end of file

From d01db33b339367daf0876757a247cb2afc6a6535 Mon Sep 17 00:00:00 2001
From: kpcraig <3031348+kpcraig@users.noreply.github.com>
Date: Thu, 12 Sep 2024 11:31:32 -0400
Subject: [PATCH 17/44] Update release notes and knowns issues for aws auth
 external id bug (#28129)

* add documentation for external_id bug

* Update website/content/docs/release-notes/1.17.0.mdx

Co-authored-by: Ellie <ellie.sterner@hashicorp.com>

* fix partials include

* Update website/content/partials/known-issues/aws-auth-external-id.mdx

Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>

* Update website/content/partials/known-issues/aws-auth-external-id.mdx

Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>

---------

Co-authored-by: Ellie <ellie.sterner@hashicorp.com>
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
---
 website/content/docs/release-notes/1.17.0.mdx |  1 +
 .../docs/upgrading/upgrade-to-1.17.x.mdx      |  2 ++
 .../known-issues/aws-auth-external-id.mdx     | 19 +++++++++++++++++++
 3 files changed, 22 insertions(+)
 create mode 100644 website/content/partials/known-issues/aws-auth-external-id.mdx

diff --git a/website/content/docs/release-notes/1.17.0.mdx b/website/content/docs/release-notes/1.17.0.mdx
index e01908838a00..00134af12c49 100644
--- a/website/content/docs/release-notes/1.17.0.mdx
+++ b/website/content/docs/release-notes/1.17.0.mdx
@@ -22,6 +22,7 @@ description: |-
 | Known issue (1.17.0)                           | [Vault Agent and Vault Proxy consume excessive amounts of CPU](/vault/docs/upgrading/upgrade-to-1.17.x#agent-proxy-cpu-1-17)                                        |
 | Known issue (1.15.8 - 1.15.9, 1.16.0 - 1.16.3) | [Autopilot upgrade for Vault Enterprise fails](/vault/docs/upgrading/upgrade-to-1.16.x#new-nodes-added-by-autopilot-upgrades-provisioned-with-the-wrong-version)    |
 | Known issue (1.17.0 - 1.17.2)  | [Vault standby nodes not deleting removed entity-aliases from in-memory database](/vault/docs/upgrading/upgrade-to-1.17.x#dangling-entity-alias-in-memory)          |
+| Known issue (1.17.0 - 1.17.3)  | [AWS Auth AssumeRole requires an external ID even if none is set](/vault/docs/upgrading/upgrade-to-1.17.x#aws-auth-role-configuration-requires-an-external_id)                                      |
 | Known Issue (0.7.0+)           | [Duplicate identity groups created](/vault/docs/upgrading/upgrade-to-1.17.x#duplicate-identity-groups-created-when-concurrent-requests-sent-to-the-primary-and-pr-secondary-cluster)
 | Known Issue (0.7.0+)           | [Manual entity merges fail](/vault/docs/upgrading/upgrade-to-1.17.x#manual-entity-merges-sent-to-a-pr-secondary-cluster-are-not-persisted-to-storage)
 | Known Issue (1.17.3-1.17.4)    | [Some values in the audit logs not hmac'd properly](/vault/docs/upgrading/upgrade-to-1.17.x#client-tokens-and-token-accessors-audited-in-plaintext)
diff --git a/website/content/docs/upgrading/upgrade-to-1.17.x.mdx b/website/content/docs/upgrading/upgrade-to-1.17.x.mdx
index 7b94b6646ed1..83cf1090000b 100644
--- a/website/content/docs/upgrading/upgrade-to-1.17.x.mdx
+++ b/website/content/docs/upgrading/upgrade-to-1.17.x.mdx
@@ -146,3 +146,5 @@ kubectl exec -ti <NAME> -- wget https://github.com/moparisthebest/static-curl/re
 @include 'known-issues/duplicate-identity-groups.mdx'
 
 @include 'known-issues/manual-entity-merge-does-not-persist.mdx'
+
+@include 'known-issues/aws-auth-external-id.mdx'
diff --git a/website/content/partials/known-issues/aws-auth-external-id.mdx b/website/content/partials/known-issues/aws-auth-external-id.mdx
new file mode 100644
index 000000000000..e4774161255d
--- /dev/null
+++ b/website/content/partials/known-issues/aws-auth-external-id.mdx
@@ -0,0 +1,19 @@
+### AWS Auth Role configuration requires an external_id
+
+#### Affected Versions
+
+- 1.17.0 - 1.17.3
+
+#### Issue
+
+You must set the `external_id` parameter during role configuration, or the Vault
+AWS authentication plugin returns a validation error.
+
+#### Workaround
+
+To avoid the error during configuration:
+
+1. Set the `external_id` parameter when configuring AWS authentication plugin
+   with a valid ID or any string longer than two characters.
+1. Configure any desired roles. 
+1. If you used an arbitrary string, remove the external ID.

From 978b3aee529598c05107d8a3223598219efb0c5b Mon Sep 17 00:00:00 2001
From: Rachel Culpepper <84159930+rculpepper@users.noreply.github.com>
Date: Thu, 12 Sep 2024 11:32:51 -0500
Subject: [PATCH 18/44] add ce changes and documentation for tidying cmpv2
 nonce store (#28362)

* add ce changes and documentation for tidying cmpv2 nonce store

* add build tag

* fix test failures

* fix backend test
---
 builtin/logical/pki/backend_test.go           |  2 +
 builtin/logical/pki/cmpv2_util_oss.go         | 16 +++++
 builtin/logical/pki/fields.go                 |  5 ++
 builtin/logical/pki/path_tidy.go              | 61 ++++++++++++++++++-
 website/content/api-docs/secret/pki/index.mdx |  7 ++-
 5 files changed, 89 insertions(+), 2 deletions(-)
 create mode 100644 builtin/logical/pki/cmpv2_util_oss.go

diff --git a/builtin/logical/pki/backend_test.go b/builtin/logical/pki/backend_test.go
index 0a8827f131fa..af079b13f781 100644
--- a/builtin/logical/pki/backend_test.go
+++ b/builtin/logical/pki/backend_test.go
@@ -4114,6 +4114,7 @@ func TestBackend_RevokePlusTidy_Intermediate(t *testing.T) {
 			"tidy_revocation_queue":                 false,
 			"tidy_cross_cluster_revoked_certs":      false,
 			"tidy_cert_metadata":                    false,
+			"tidy_cmpv2_nonce_store":                false,
 			"pause_duration":                        "0s",
 			"state":                                 "Finished",
 			"error":                                 nil,
@@ -4136,6 +4137,7 @@ func TestBackend_RevokePlusTidy_Intermediate(t *testing.T) {
 			"acme_account_deleted_count":            json.Number("0"),
 			"total_acme_account_count":              json.Number("0"),
 			"cert_metadata_deleted_count":           json.Number("0"),
+			"cmpv2_nonce_deleted_count":             json.Number("0"),
 		}
 		// Let's copy the times from the response so that we can use deep.Equal()
 		timeStarted, ok := tidyStatus.Data["time_started"]
diff --git a/builtin/logical/pki/cmpv2_util_oss.go b/builtin/logical/pki/cmpv2_util_oss.go
new file mode 100644
index 000000000000..9e7574795d34
--- /dev/null
+++ b/builtin/logical/pki/cmpv2_util_oss.go
@@ -0,0 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package pki
+
+import (
+	"context"
+
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+func (b *backend) doTidyCMPV2NonceStore(_ context.Context, _ logical.Storage) error {
+	return nil
+}
diff --git a/builtin/logical/pki/fields.go b/builtin/logical/pki/fields.go
index 05b1a3a025ed..7e666d9c299a 100644
--- a/builtin/logical/pki/fields.go
+++ b/builtin/logical/pki/fields.go
@@ -598,6 +598,11 @@ primary node.`,
 		Description: `Set to true to enable tidying up certificate metadata`,
 	}
 
+	fields["tidy_cmpv2_nonce_store"] = &framework.FieldSchema{
+		Type:        framework.TypeBool,
+		Description: `Set to true to enable tidying up the CMPv2 nonce store`,
+	}
+
 	return fields
 }
 
diff --git a/builtin/logical/pki/path_tidy.go b/builtin/logical/pki/path_tidy.go
index a768ca8836a3..e18540cc334b 100644
--- a/builtin/logical/pki/path_tidy.go
+++ b/builtin/logical/pki/path_tidy.go
@@ -53,6 +53,7 @@ type tidyStatus struct {
 	tidyCrossRevokedCerts bool
 	tidyAcme              bool
 	tidyCertMetadata      bool
+	tidyCMPV2NonceStore   bool
 	pauseDuration         string
 
 	// Status
@@ -70,6 +71,7 @@ type tidyStatus struct {
 	revQueueDeletedCount     uint
 	crossRevokedDeletedCount uint
 	certMetadataDeletedCount uint
+	cmpv2NonceDeletedCount   uint
 
 	acmeAccountsCount        uint
 	acmeAccountsRevokedCount uint
@@ -92,6 +94,7 @@ type tidyConfig struct {
 	CrossRevokedCerts bool `json:"tidy_cross_cluster_revoked_certs"`
 	TidyAcme          bool `json:"tidy_acme"`
 	CertMetadata      bool `json:"tidy_cert_metadata"`
+	CMPV2NonceStore   bool `json:"tidy_cmpv2_nonce_store"`
 
 	// Safety Buffers
 	SafetyBuffer            time.Duration `json:"safety_buffer"`
@@ -106,7 +109,7 @@ type tidyConfig struct {
 }
 
 func (tc *tidyConfig) IsAnyTidyEnabled() bool {
-	return tc.CertStore || tc.RevokedCerts || tc.IssuerAssocs || tc.ExpiredIssuers || tc.BackupBundle || tc.TidyAcme || tc.CrossRevokedCerts || tc.RevocationQueue || tc.CertMetadata
+	return tc.CertStore || tc.RevokedCerts || tc.IssuerAssocs || tc.ExpiredIssuers || tc.BackupBundle || tc.TidyAcme || tc.CrossRevokedCerts || tc.RevocationQueue || tc.CertMetadata || tc.CMPV2NonceStore
 }
 
 func (tc *tidyConfig) AnyTidyConfig() string {
@@ -132,6 +135,7 @@ var defaultTidyConfig = tidyConfig{
 	QueueSafetyBuffer:       48 * time.Hour,
 	CrossRevokedCerts:       false,
 	CertMetadata:            false,
+	CMPV2NonceStore:         false,
 }
 
 func pathTidy(b *backend) *framework.Path {
@@ -228,6 +232,11 @@ func pathTidyCancel(b *backend) *framework.Path {
 								Description: `Tidy cert metadata`,
 								Required:    false,
 							},
+							"tidy_cmpv2_nonce_store": {
+								Type:        framework.TypeBool,
+								Description: `Tidy CMPv2 nonce store`,
+								Required:    false,
+							},
 							"pause_duration": {
 								Type:        framework.TypeString,
 								Description: `Duration to pause between tidying certificates`,
@@ -337,6 +346,11 @@ func pathTidyCancel(b *backend) *framework.Path {
 								Description: `The number of metadata entries removed`,
 								Required:    false,
 							},
+							"cmpv2_nonce_deleted_count": {
+								Type:        framework.TypeInt,
+								Description: `The number of CMPv2 nonces removed`,
+								Required:    false,
+							},
 						},
 					}},
 				},
@@ -420,6 +434,11 @@ func pathTidyStatus(b *backend) *framework.Path {
 								Description: `Tidy cert metadata`,
 								Required:    true,
 							},
+							"tidy_cmpv2_nonce_store": {
+								Type:        framework.TypeBool,
+								Description: `Tidy CMPv2 nonce store`,
+								Required:    true,
+							},
 							"pause_duration": {
 								Type:        framework.TypeString,
 								Description: `Duration to pause between tidying certificates`,
@@ -525,6 +544,11 @@ func pathTidyStatus(b *backend) *framework.Path {
 								Description: `The number of metadata entries removed`,
 								Required:    false,
 							},
+							"cmpv2_nonce_deleted_count": {
+								Type:        framework.TypeInt,
+								Description: `The number of CMPv2 nonces removed`,
+								Required:    false,
+							},
 						},
 					}},
 				},
@@ -618,6 +642,11 @@ available on the tidy-status endpoint.`,
 								Description: `Tidy cert metadata`,
 								Required:    true,
 							},
+							"tidy_cmpv2_nonce_store": {
+								Type:        framework.TypeBool,
+								Description: `Tidy CMPv2 nonce store`,
+								Required:    true,
+							},
 							"safety_buffer": {
 								Type:        framework.TypeInt,
 								Description: `Safety buffer time duration`,
@@ -716,6 +745,11 @@ available on the tidy-status endpoint.`,
 								Description: `Tidy cert metadata`,
 								Required:    true,
 							},
+							"tidy_cmpv2_nonce_store": {
+								Type:        framework.TypeBool,
+								Description: `Tidy CMPv2 nonce store`,
+								Required:    true,
+							},
 							"safety_buffer": {
 								Type:        framework.TypeInt,
 								Description: `Safety buffer time duration`,
@@ -790,6 +824,7 @@ func (b *backend) pathTidyWrite(ctx context.Context, req *logical.Request, d *fr
 	tidyAcme := d.Get("tidy_acme").(bool)
 	acmeAccountSafetyBuffer := d.Get("acme_account_safety_buffer").(int)
 	tidyCertMetadata := d.Get("tidy_cert_metadata").(bool)
+	tidyCMPV2NonceStore := d.Get("tidy_cmpv2_nonce_store").(bool)
 
 	if safetyBuffer < 1 {
 		return logical.ErrorResponse("safety_buffer must be greater than zero"), nil
@@ -846,6 +881,7 @@ func (b *backend) pathTidyWrite(ctx context.Context, req *logical.Request, d *fr
 		TidyAcme:                tidyAcme,
 		AcmeAccountSafetyBuffer: acmeAccountSafetyBufferDuration,
 		CertMetadata:            tidyCertMetadata,
+		CMPV2NonceStore:         tidyCMPV2NonceStore,
 	}
 
 	if !atomic.CompareAndSwapUint32(b.tidyCASGuard, 0, 1) {
@@ -983,6 +1019,17 @@ func (b *backend) startTidyOperation(req *logical.Request, config *tidyConfig) {
 				}
 			}
 
+			// Check for cancel before continuing.
+			if atomic.CompareAndSwapUint32(b.tidyCancelCAS, 1, 0) {
+				return tidyCancelledError
+			}
+
+			if config.CMPV2NonceStore {
+				if err := b.doTidyCMPV2NonceStore(ctx, req.Storage); err != nil {
+					return err
+				}
+			}
+
 			return nil
 		}
 
@@ -1701,6 +1748,7 @@ func (b *backend) pathTidyStatusRead(_ context.Context, _ *logical.Request, _ *f
 			"tidy_cross_cluster_revoked_certs":      nil,
 			"tidy_acme":                             nil,
 			"tidy_cert_metadata":                    nil,
+			"tidy_cmpv2_nonce_store":                nil,
 			"pause_duration":                        nil,
 			"state":                                 "Inactive",
 			"error":                                 nil,
@@ -1721,6 +1769,7 @@ func (b *backend) pathTidyStatusRead(_ context.Context, _ *logical.Request, _ *f
 			"acme_orders_deleted_count":             nil,
 			"acme_account_safety_buffer":            nil,
 			"cert_metadata_deleted_count":           nil,
+			"cmpv2_nonce_deleted_count":             nil,
 		},
 	}
 
@@ -1755,6 +1804,7 @@ func (b *backend) pathTidyStatusRead(_ context.Context, _ *logical.Request, _ *f
 	resp.Data["tidy_cross_cluster_revoked_certs"] = b.tidyStatus.tidyCrossRevokedCerts
 	resp.Data["tidy_acme"] = b.tidyStatus.tidyAcme
 	resp.Data["tidy_cert_metadata"] = b.tidyStatus.tidyCertMetadata
+	resp.Data["tidy_cmpv2_nonce_store"] = b.tidyStatus.tidyCMPV2NonceStore
 	resp.Data["pause_duration"] = b.tidyStatus.pauseDuration
 	resp.Data["time_started"] = b.tidyStatus.timeStarted
 	resp.Data["message"] = b.tidyStatus.message
@@ -1771,6 +1821,7 @@ func (b *backend) pathTidyStatusRead(_ context.Context, _ *logical.Request, _ *f
 	resp.Data["acme_orders_deleted_count"] = b.tidyStatus.acmeOrdersDeletedCount
 	resp.Data["acme_account_safety_buffer"] = b.tidyStatus.acmeAccountSafetyBuffer
 	resp.Data["cert_metadata_deleted_count"] = b.tidyStatus.certMetadataDeletedCount
+	resp.Data["cmpv2_nonce_deleted_count"] = b.tidyStatus.cmpv2NonceDeletedCount
 
 	switch b.tidyStatus.state {
 	case tidyStatusStarted:
@@ -2056,6 +2107,13 @@ func (b *backend) tidyStatusIncCertMetadataCount() {
 	b.tidyStatus.certMetadataDeletedCount++
 }
 
+func (b *backend) tidyStatusIncCMPV2NonceDeletedCount() {
+	b.tidyStatusLock.Lock()
+	defer b.tidyStatusLock.Unlock()
+
+	b.tidyStatus.cmpv2NonceDeletedCount++
+}
+
 const pathTidyHelpSyn = `
 Tidy up the backend by removing expired certificates, revocation information,
 or both.
@@ -2168,5 +2226,6 @@ func getTidyConfigData(config tidyConfig) map[string]interface{} {
 		"revocation_queue_safety_buffer":           int(config.QueueSafetyBuffer / time.Second),
 		"tidy_cross_cluster_revoked_certs":         config.CrossRevokedCerts,
 		"tidy_cert_metadata":                       config.CertMetadata,
+		"tidy_cmpv2_nonce_store":                   config.CMPV2NonceStore,
 	}
 }
diff --git a/website/content/api-docs/secret/pki/index.mdx b/website/content/api-docs/secret/pki/index.mdx
index b196456b304e..1b8e6fa23705 100644
--- a/website/content/api-docs/secret/pki/index.mdx
+++ b/website/content/api-docs/secret/pki/index.mdx
@@ -4415,6 +4415,9 @@ expiration time.
  - `tidy_cert_metadata` `(bool: false)` - Specifies whether to tidy metadata
   for expired certificates.
 
+ - `tidy_cmpv2_nonce_store` `(bool: false)` - Specifies whether to tidy expired
+nonces in the CMPv2 nonce store.
+
 #### Sample payload
 
 ```json
@@ -4476,7 +4479,8 @@ $ curl \
     "tidy_revocation_queue": false,
     "tidy_revoked_cert_issuer_associations": false,
     "tidy_revoked_certs": false,
-    "tidy_cert_metadata": false
+    "tidy_cert_metadata": false,
+    "tidy_cmpv2_nonce_store": false
   },
   "auth": null
 }
@@ -4572,6 +4576,7 @@ The result includes the following fields:
 * `last_auto_tidy_finished`: the time when the last auto-tidy operation finished; may be different than `time_finished` especially if the last operation was a manually executed tidy operation. Set to current time at mount time to delay the initial auto-tidy operation; not persisted.
 * `tidy_cert_metadata`: the value of this parameter when initiating the tidy operation
 * `cert_metadata_deleted_count`: the number of metadata entries deleted
+* `cmpv2_nonce_deleted_count`: the number of CMPv2 nonces deleted
 
 
 | Method | Path               |

From 84c58f66bb65f4517691a81256efd1f5a0315d50 Mon Sep 17 00:00:00 2001
From: Ellie <ellie.sterner@hashicorp.com>
Date: Thu, 12 Sep 2024 14:26:09 -0500
Subject: [PATCH 19/44] add warning to identify which entities have 1+ aliases
 with the same mount accessor (#28054)

* add warning to identity which entities have 1+ aliases with the same mount accessor

* remove redundant log
---
 vault/identity_store_util.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/vault/identity_store_util.go b/vault/identity_store_util.go
index 19395e0c689f..4e963e48e719 100644
--- a/vault/identity_store_util.go
+++ b/vault/identity_store_util.go
@@ -459,6 +459,10 @@ LOOP:
 
 				mountAccessors := getAccessorsOnDuplicateAliases(entity.Aliases)
 
+				if len(mountAccessors) > 0 {
+					i.logger.Warn("Entity has multiple aliases on the same mount(s)", "entity_id", entity.ID, "mount_accessors", mountAccessors)
+				}
+
 				for _, accessor := range mountAccessors {
 					if _, ok := duplicatedAccessors[accessor]; !ok {
 						duplicatedAccessors[accessor] = struct{}{}
@@ -498,10 +502,6 @@ LOOP:
 		accessorCounter++
 	}
 
-	if len(duplicatedAccessorsList) > 0 {
-		i.logger.Warn("One or more entities have multiple aliases on the same mount(s), remove duplicates to avoid ACL templating issues", "mount_accessors", duplicatedAccessorsList)
-	}
-
 	if i.logger.IsInfo() {
 		i.logger.Info("entities restored")
 	}

From 1c16994bc3aa1fa320ad85bcac165283bc7bb25a Mon Sep 17 00:00:00 2001
From: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Date: Thu, 12 Sep 2024 14:50:37 -0500
Subject: [PATCH 20/44] UI: stabilize replication tests (#28384)

* Add specificity to replication title selectors

* Use specific selectors for replication titles in tests
---
 .../addon/components/replication-header.hbs   |  2 +-
 .../addon/components/page/mode-index.hbs      |  2 +-
 ui/lib/replication/addon/templates/index.hbs  |  6 ++--
 ui/lib/replication/addon/templates/mode.hbs   |  2 +-
 .../enterprise-replication-modes-test.js      | 32 ++++++++++++-------
 .../acceptance/enterprise-replication-test.js | 14 ++++----
 .../components/replication-page-test.js       |  6 ++--
 7 files changed, 36 insertions(+), 28 deletions(-)

diff --git a/ui/lib/core/addon/components/replication-header.hbs b/ui/lib/core/addon/components/replication-header.hbs
index 69816fb40c87..be2fd0892ce0 100644
--- a/ui/lib/core/addon/components/replication-header.hbs
+++ b/ui/lib/core/addon/components/replication-header.hbs
@@ -13,7 +13,7 @@
     {{/if}}
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-replication-title>
+    <h1 class="title is-3" data-test-replication-title={{@title}}>
       {{@title}}
       {{#if @data.anyReplicationEnabled}}
         <span class="tag is-light has-text-grey-dark" data-test-mode>
diff --git a/ui/lib/replication/addon/components/page/mode-index.hbs b/ui/lib/replication/addon/components/page/mode-index.hbs
index d35e024b0f28..720da2235cab 100644
--- a/ui/lib/replication/addon/components/page/mode-index.hbs
+++ b/ui/lib/replication/addon/components/page/mode-index.hbs
@@ -6,7 +6,7 @@
 {{#if @replicationDisabled}}
   <PageHeader as |p|>
     <p.levelLeft>
-      <h1 class="title is-3" data-test-replication-title>
+      <h1 class="title is-3" data-test-replication-title={{@replicationMode}}>
         {{#if (eq @replicationMode "dr")}}
           Enable Disaster Recovery Replication
         {{else if (eq @replicationMode "performance")}}
diff --git a/ui/lib/replication/addon/templates/index.hbs b/ui/lib/replication/addon/templates/index.hbs
index 25f497dc9487..9b2c9c326ebc 100644
--- a/ui/lib/replication/addon/templates/index.hbs
+++ b/ui/lib/replication/addon/templates/index.hbs
@@ -9,7 +9,7 @@
       {{! Replication is unsupported in non-enterprise or when using non-transactional storage (eg inmem) }}
       <PageHeader as |p|>
         <p.levelLeft>
-          <h1 class="title is-3 has-text-grey" data-test-replication-title>
+          <h1 class="title is-3 has-text-grey" data-test-replication-title="Replication unsupported">
             Replication unsupported
           </h1>
         </p.levelLeft>
@@ -20,7 +20,7 @@
     {{else if this.model.allReplicationDisabled}}
       <PageHeader as |p|>
         <p.levelLeft>
-          <h1 class="title is-3" data-test-replication-title>
+          <h1 class="title is-3" data-test-replication-title="Enable Replication">
             Enable Replication
           </h1>
         </p.levelLeft>
@@ -114,7 +114,7 @@
       {{! Renders when at least one mode is not enabled }}
       <PageHeader as |p|>
         <p.levelLeft>
-          <h1 class="title is-3" data-test-replication-title>
+          <h1 class="title is-3" data-test-replication-title="Replication">
             Replication
           </h1>
         </p.levelLeft>
diff --git a/ui/lib/replication/addon/templates/mode.hbs b/ui/lib/replication/addon/templates/mode.hbs
index befb396e7ed8..40a846511245 100644
--- a/ui/lib/replication/addon/templates/mode.hbs
+++ b/ui/lib/replication/addon/templates/mode.hbs
@@ -17,7 +17,7 @@
             </Hds::Breadcrumb>
           </p.top>
           <p.levelLeft>
-            <h1 class="has-top-margin-m title is-3" data-test-replication-title>
+            <h1 class="has-top-margin-m title is-3" data-test-replication-title={{this.model.replicationModeForDisplay}}>
               {{this.model.replicationModeForDisplay}}
               <span class="tag is-light has-text-grey-dark" data-test-replication-mode-display>
                 {{this.model.replicationAttrs.modeForHeader}}
diff --git a/ui/tests/acceptance/enterprise-replication-modes-test.js b/ui/tests/acceptance/enterprise-replication-modes-test.js
index d042fe7f3e17..50ddc1b8c75f 100644
--- a/ui/tests/acceptance/enterprise-replication-modes-test.js
+++ b/ui/tests/acceptance/enterprise-replication-modes-test.js
@@ -12,7 +12,7 @@ import { STATUS_DISABLED_RESPONSE, mockReplicationBlock } from 'vault/tests/help
 
 const s = {
   navLink: (title) => `[data-test-sidebar-nav-link="${title}"]`,
-  title: '[data-test-replication-title]',
+  title: (t) => `[data-test-replication-title="${t}"]`,
   detailLink: (mode) => `[data-test-replication-details-link="${mode}"]`,
   summaryCard: '[data-test-replication-summary-card]',
   dashboard: '[data-test-replication-dashboard]',
@@ -20,6 +20,13 @@ const s = {
   knownSecondary: (name) => `[data-test-secondaries-node="${name}"]`,
 };
 
+// wait for specific title selector as an attempt to stabilize flaky tests
+async function assertTitle(assert, title, altSelector) {
+  const selector = altSelector || title;
+  await waitFor(s.title(selector));
+  assert.dom(s.title(selector)).hasText(title);
+}
+
 module('Acceptance | Enterprise | replication modes', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
@@ -42,7 +49,8 @@ module('Acceptance | Enterprise | replication modes', function (hooks) {
 
     await authPage.login();
     await visit('/vault/replication');
-    assert.dom(s.title).hasText('Replication unsupported', 'it shows the unsupported view');
+
+    await assertTitle(assert, 'Replication unsupported');
 
     // Nav links
     assert.dom(s.navLink('Performance')).doesNotExist('hides performance link');
@@ -52,7 +60,8 @@ module('Acceptance | Enterprise | replication modes', function (hooks) {
   test('replication page when disabled', async function (assert) {
     await this.setupMocks(STATUS_DISABLED_RESPONSE);
     await visit('/vault/replication');
-    assert.dom(s.title).hasText('Enable Replication', 'it shows the enable view');
+
+    await assertTitle(assert, 'Enable Replication');
 
     // Nav links
     assert.dom(s.navLink('Performance')).exists('shows performance link');
@@ -64,7 +73,8 @@ module('Acceptance | Enterprise | replication modes', function (hooks) {
     assert.dom(s.enableForm).exists();
 
     await click(s.navLink('Disaster Recovery'));
-    assert.dom(s.title).hasText('Enable Disaster Recovery Replication', 'it shows the enable view for dr');
+
+    await assertTitle(assert, 'Enable Disaster Recovery Replication', 'dr');
   });
 
   ['primary', 'secondary'].forEach((mode) => {
@@ -75,7 +85,7 @@ module('Acceptance | Enterprise | replication modes', function (hooks) {
       });
       await visit('/vault/replication');
 
-      assert.dom(s.title).hasText('Replication', 'it shows default view');
+      await assertTitle(assert, 'Replication');
       assert.dom(s.detailLink('performance')).hasText('Details', 'CTA to see performance details');
       assert.dom(s.detailLink('dr')).hasText('Enable', 'CTA to enable dr');
 
@@ -89,7 +99,7 @@ module('Acceptance | Enterprise | replication modes', function (hooks) {
       assert.dom(s.dashboard).exists(`it shows the replication dashboard`);
 
       await click(s.navLink('Disaster Recovery'));
-      assert.dom(s.title).hasText('Enable Disaster Recovery Replication', 'it shows the dr title');
+      await assertTitle(assert, 'Enable Disaster Recovery Replication', 'dr');
       assert.dom(s.enableForm).exists('it shows the enable view for dr');
     });
   });
@@ -100,7 +110,7 @@ module('Acceptance | Enterprise | replication modes', function (hooks) {
       performance: mockReplicationBlock(),
     });
     await visit('/vault/replication');
-    assert.dom(s.title).hasText('Replication', 'it shows default view');
+    await assertTitle(assert, 'Replication');
     assert.dom(s.detailLink('performance')).hasText('Enable', 'CTA to enable performance');
     assert.dom(s.detailLink('dr')).hasText('Details', 'CTA to see dr details');
 
@@ -114,7 +124,7 @@ module('Acceptance | Enterprise | replication modes', function (hooks) {
     assert.dom(s.enableForm).exists('it shows the enable view for performance');
 
     await click(s.navLink('Disaster Recovery'));
-    assert.dom(s.title).hasText(`Disaster Recovery primary`, 'it shows the dr title');
+    await assertTitle(assert, 'Disaster Recovery primary', 'Disaster Recovery');
     assert.dom(s.dashboard).exists(`it shows the replication dashboard`);
   });
 
@@ -124,15 +134,15 @@ module('Acceptance | Enterprise | replication modes', function (hooks) {
       performance: mockReplicationBlock('primary'),
     });
     await visit('/vault/replication');
-    assert.dom(s.title).hasText('Disaster Recovery & Performance primary', 'it shows primary view');
+    await assertTitle(assert, 'Disaster Recovery & Performance primary', 'Disaster Recovery & Performance');
     assert.dom(s.summaryCard).exists({ count: 2 }, 'shows 2 summary cards');
 
     await click(s.navLink('Performance'));
-    assert.dom(s.title).hasText(`Performance primary`, `it shows the performance mode details`);
+    await assertTitle(assert, 'Performance primary', 'Performance');
     assert.dom(s.enableForm).doesNotExist();
 
     await click(s.navLink('Disaster Recovery'));
-    assert.dom(s.title).hasText(`Disaster Recovery primary`, 'it shows the dr mode details');
+    await assertTitle(assert, 'Disaster Recovery primary', 'Disaster Recovery');
     assert.dom(s.enableForm).doesNotExist();
   });
 });
diff --git a/ui/tests/acceptance/enterprise-replication-test.js b/ui/tests/acceptance/enterprise-replication-test.js
index d079d49708ec..8998ee118e5c 100644
--- a/ui/tests/acceptance/enterprise-replication-test.js
+++ b/ui/tests/acceptance/enterprise-replication-test.js
@@ -165,14 +165,12 @@ module('Acceptance | Enterprise | replication', function (hooks) {
         'shows the correct title of the empty state'
       );
 
-    assert.ok(
-      find('[data-test-replication-title]').textContent.includes('Disaster Recovery'),
-      'it displays the replication type correctly'
-    );
-    assert.ok(
-      find('[data-test-replication-mode-display]').textContent.includes('primary'),
-      'it displays the cluster mode correctly'
-    );
+    assert
+      .dom('[data-test-replication-title="Disaster Recovery"]')
+      .includesText('Disaster Recovery', 'it displays the replication type correctly');
+    assert
+      .dom('[data-test-replication-mode-display]')
+      .includesText('primary', 'it displays the cluster mode correctly');
 
     // add dr secondary
     await click('[data-test-replication-link="secondaries"]');
diff --git a/ui/tests/integration/components/replication-page-test.js b/ui/tests/integration/components/replication-page-test.js
index 07dbc502be83..d9b6ed17b73f 100644
--- a/ui/tests/integration/components/replication-page-test.js
+++ b/ui/tests/integration/components/replication-page-test.js
@@ -62,11 +62,11 @@ module('Integration | Component | replication-page', function (hooks) {
     await render(
       hbs`<ReplicationPage @model={{this.model}} as |Page|><Page.header @showTabs={{true}} /></ReplicationPage>`
     );
-    await waitFor('[data-test-replication-title]');
+    await waitFor('[data-test-replication-title="dr"]');
     // Title has spaces and newlines, so we can't use hasText because it won't match exactly
-    assert.dom('[data-test-replication-title]').includesText('Disaster Recovery');
+    assert.dom('[data-test-replication-title="dr"]').includesText('Disaster Recovery');
     this.set('model', { ...MODEL, replicationMode: 'performance' });
     await settled();
-    assert.dom('[data-test-replication-title]').includesText('Performance');
+    assert.dom('[data-test-replication-title="performance"]').includesText('Performance');
   });
 });

From 6cf885f85a1b3620d31765afc508f2c6911fc8a1 Mon Sep 17 00:00:00 2001
From: Steven Clark <steven.clark@hashicorp.com>
Date: Fri, 13 Sep 2024 13:38:43 -0400
Subject: [PATCH 21/44] Fix key usage changelog entry (#28391)

- Change it from a feature to an improvement.
---
 changelog/28237.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/changelog/28237.txt b/changelog/28237.txt
index da5104c03360..8b5728f3f434 100644
--- a/changelog/28237.txt
+++ b/changelog/28237.txt
@@ -1,3 +1,3 @@
-```release-note:feature
-**Set KeyUsage on PKI-CAs**: Key Usage can now be set on intermediate and root CAs, and CSRs generated by the PKI secret's engine.
+```release-note:improvement
+secrets/pki: Key Usage can now be set on intermediate and root CAs, and CSRs generated by the PKI secret's engine.
 ```

From c7ed13f1a22c530a562eebc125800ae544b6205a Mon Sep 17 00:00:00 2001
From: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Date: Fri, 13 Sep 2024 15:00:57 -0500
Subject: [PATCH 22/44] UI: Add expected attr to pass tests (#28389)

* Add expected attr to pass tests

* add tidyCmpv2NonceStore to tidy forms
---
 ui/app/models/pki/tidy.js                                 | 6 ++++++
 ui/tests/helpers/openapi/expected-secret-attrs.js         | 6 ++++++
 ui/tests/integration/components/pki/pki-tidy-form-test.js | 5 +++--
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/ui/app/models/pki/tidy.js b/ui/app/models/pki/tidy.js
index c7cd17f0f5bb..ee4f335a1f82 100644
--- a/ui/app/models/pki/tidy.js
+++ b/ui/app/models/pki/tidy.js
@@ -97,6 +97,11 @@ export default class PkiTidyModel extends Model {
   })
   tidyCrossClusterRevokedCerts; // enterprise only
 
+  @attr('boolean', {
+    label: 'Tidy CMPv2 nonce store',
+  })
+  tidyCmpv2NonceStore; // enterprise only
+
   @attr('boolean', {
     subText: 'Automatically remove expired issuers after the issuer safety buffer duration has elapsed.',
   })
@@ -155,6 +160,7 @@ export default class PkiTidyModel extends Model {
         'Cross-cluster operations': [
           'tidyRevocationQueue',
           'tidyCrossClusterRevokedCerts',
+          'tidyCmpv2NonceStore',
           'revocationQueueSafetyBuffer',
         ],
       });
diff --git a/ui/tests/helpers/openapi/expected-secret-attrs.js b/ui/tests/helpers/openapi/expected-secret-attrs.js
index 35e664877dde..cd0d3cac83fe 100644
--- a/ui/tests/helpers/openapi/expected-secret-attrs.js
+++ b/ui/tests/helpers/openapi/expected-secret-attrs.js
@@ -1457,6 +1457,12 @@ const pki = {
       fieldGroup: 'default',
       type: 'boolean',
     },
+    tidyCmpv2NonceStore: {
+      editType: 'boolean',
+      fieldGroup: 'default',
+      helpText: 'Set to true to enable tidying up the CMPv2 nonce store',
+      type: 'boolean',
+    },
     tidyCrossClusterRevokedCerts: {
       editType: 'boolean',
       helpText:
diff --git a/ui/tests/integration/components/pki/pki-tidy-form-test.js b/ui/tests/integration/components/pki/pki-tidy-form-test.js
index e2d801fee372..d1d758cc28fc 100644
--- a/ui/tests/integration/components/pki/pki-tidy-form-test.js
+++ b/ui/tests/integration/components/pki/pki-tidy-form-test.js
@@ -32,7 +32,7 @@ module('Integration | Component | pki tidy form', function (hooks) {
   });
 
   test('it hides or shows fields depending on auto-tidy toggle', async function (assert) {
-    assert.expect(39);
+    assert.expect(41);
     const sectionHeaders = [
       'Universal operations',
       'ACME operations',
@@ -82,7 +82,7 @@ module('Integration | Component | pki tidy form', function (hooks) {
   });
 
   test('it renders all attribute fields, including enterprise', async function (assert) {
-    assert.expect(27);
+    assert.expect(29);
     this.autoTidy.enabled = true;
     const skipFields = ['enabled', 'tidyAcme', 'intervalDuration']; // combined with duration ttl or asserted separately
     await render(
@@ -190,6 +190,7 @@ module('Integration | Component | pki tidy form', function (hooks) {
           tidy_acme: true,
           tidy_cert_metadata: true,
           tidy_cert_store: true,
+          tidy_cmpv2_nonce_store: true,
           tidy_cross_cluster_revoked_certs: true,
           tidy_expired_issuers: true,
           tidy_move_legacy_ca_bundle: true,

From 7112c7be5d219f8ef4db1ad1a1569a705de252a1 Mon Sep 17 00:00:00 2001
From: Robert <17119716+robmonte@users.noreply.github.com>
Date: Fri, 13 Sep 2024 17:40:31 -0500
Subject: [PATCH 23/44] Add activation-flags cluster known issue (#28341)

---
 .../docs/upgrading/upgrade-to-1.17.x.mdx      |  2 ++
 ...ync-activation-flags-cache-not-updated.mdx | 23 +++++++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 website/content/partials/known-issues/sync-activation-flags-cache-not-updated.mdx

diff --git a/website/content/docs/upgrading/upgrade-to-1.17.x.mdx b/website/content/docs/upgrading/upgrade-to-1.17.x.mdx
index 83cf1090000b..0fb20e75a6c6 100644
--- a/website/content/docs/upgrading/upgrade-to-1.17.x.mdx
+++ b/website/content/docs/upgrading/upgrade-to-1.17.x.mdx
@@ -148,3 +148,5 @@ kubectl exec -ti <NAME> -- wget https://github.com/moparisthebest/static-curl/re
 @include 'known-issues/manual-entity-merge-does-not-persist.mdx'
 
 @include 'known-issues/aws-auth-external-id.mdx'
+
+@include 'known-issues/sync-activation-flags-cache-not-updated.mdx'
diff --git a/website/content/partials/known-issues/sync-activation-flags-cache-not-updated.mdx b/website/content/partials/known-issues/sync-activation-flags-cache-not-updated.mdx
new file mode 100644
index 000000000000..942146ba08f7
--- /dev/null
+++ b/website/content/partials/known-issues/sync-activation-flags-cache-not-updated.mdx
@@ -0,0 +1,23 @@
+### Cached activation flags for secrets sync on follower nodes are not updated
+
+#### Affected versions
+
+- 1.16.0 - 1.16.2
+- 1.17.0 - 1.17.5
+
+#### Issue
+
+Vault 1.16 introduced secrets sync with a one-time flag required to activate the
+feature before use. Writing the activation flag to enable secrets sync is forwarded
+to leader nodes for storage and distributed to follower nodes, but the in-memory
+cache for this flag is not updated on the followers. 
+
+This prevents any secrets sync endpoints (those starting with `sys/sync/`) from
+being usable on follower nodes in a cluster.
+
+#### Workaround
+
+The cache is force-updated on all nodes when the leader node steps down and the
+cluster promotes a new leader. First, activate the secrets sync feature as described
+in the [documentation](/vault/docs/sync#activating-the-feature). Then, have the leader node
+step down.

From a439428855c29b2cc4f96a2fda6ffa1a9f9c6b61 Mon Sep 17 00:00:00 2001
From: Raja Nadar <rajanadar@gmail.com>
Date: Mon, 16 Sep 2024 06:04:56 -0700
Subject: [PATCH 24/44] Remove 100% dup section for 1.13.6 (#28398)

removed the section
---
 CHANGELOG.md | 40 ----------------------------------------
 1 file changed, 40 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3556b87346ee..29e05c7e51cb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2335,46 +2335,6 @@ BUG FIXES:
 * secrets/transit (enterprise): Apply hashing arguments and defaults to managed key sign/verify operations
 * secrets/transit: Do not allow auto rotation on managed_key key types [[GH-23723](https://github.com/hashicorp/vault/pull/23723)]
 
-## 1.13.6
-### August 30, 2023
-
-CHANGES:
-
-* core: Bump Go version to 1.20.7.
-
-IMPROVEMENTS:
-
-* core: Log rollback manager failures during unmount, remount to prevent replication failures on secondary clusters. [[GH-22235](https://github.com/hashicorp/vault/pull/22235)]
-* replication (enterprise): Make reindex less disruptive by allowing writes during the flush phase.
-* secrets/database: Improves error logging for static role rotations by including the database and role names. [[GH-22253](https://github.com/hashicorp/vault/pull/22253)]
-* storage/raft: Cap the minimum dead_server_last_contact_threshold to 1m. [[GH-22040](https://github.com/hashicorp/vault/pull/22040)]
-* ui: KV View Secret card will link to list view if input ends in "/" [[GH-22502](https://github.com/hashicorp/vault/pull/22502)]
-* ui: enables create and update KV secret workflow when control group present [[GH-22471](https://github.com/hashicorp/vault/pull/22471)]
-
-BUG FIXES:
-
-* activity (enterprise): Fix misattribution of entities to no or child namespace auth methods [[GH-18809](https://github.com/hashicorp/vault/pull/18809)]
-* api: Fix breakage with UNIX domain socket addresses introduced by newest Go versions as a security fix. [[GH-22523](https://github.com/hashicorp/vault/pull/22523)]
-* core (enterprise): Remove MFA Configuration for namespace when deleting namespace
-* core/quotas (enterprise): Fix a case where we were applying login roles to lease count quotas in a non-login context.
-Also fix a related potential deadlock. [[GH-21110](https://github.com/hashicorp/vault/pull/21110)]
-* core:  Remove "expiration manager is nil on tokenstore" error log for unauth requests on DR secondary as they do not have expiration manager. [[GH-22137](https://github.com/hashicorp/vault/pull/22137)]
-* core: Fix bug where background thread to update locked user entries runs on DR secondaries. [[GH-22355](https://github.com/hashicorp/vault/pull/22355)]
-* core: Fix readonly errors that could occur while loading mounts/auths during unseal [[GH-22362](https://github.com/hashicorp/vault/pull/22362)]
-* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-21470](https://github.com/hashicorp/vault/pull/21470)]
-* expiration: Fix a deadlock that could occur when a revocation failure happens while restoring leases on startup. [[GH-22374](https://github.com/hashicorp/vault/pull/22374)]
-* license: Add autoloaded license path to the cache exempt list. This is to ensure the license changes on the active node is observed on the perfStandby node. [[GH-22363](https://github.com/hashicorp/vault/pull/22363)]
-* replication (enterprise): Fix bug sync invalidate CoreReplicatedClusterInfoPath
-* replication (enterprise): Fix panic when update-primary was called on demoted clusters using update_primary_addrs
-* replication (enterprise): Fixing a bug by which the atomicity of a merkle diff result could be affected. This means it could be a source of a merkle-diff & sync process failing to switch into stream-wal mode afterwards.
-* sdk/ldaputil: Properly escape user filters when using UPN domains
-sdk/ldaputil: use EscapeLDAPValue implementation from cap/ldap [[GH-22249](https://github.com/hashicorp/vault/pull/22249)]
-* secrets/ldap: Fix bug causing schema and password_policy to be overwritten in config. [[GH-22331](https://github.com/hashicorp/vault/pull/22331)]
-* secrets/transform (enterprise): Tidy operations will be re-scheduled at a minimum of every minute, not a maximum of every minute
-* ui: Fix blank page or ghost secret when canceling KV secret create [[GH-22541](https://github.com/hashicorp/vault/pull/22541)]
-* ui: fixes `max_versions` default for secret metadata unintentionally overriding kv engine defaults [[GH-22394](https://github.com/hashicorp/vault/pull/22394)]
-* ui: fixes model defaults overwriting input value when user tries to clear form input [[GH-22458](https://github.com/hashicorp/vault/pull/22458)]
-
 ## 1.13.8
 ### September 27, 2023
 

From 352bbeb06cc3ac3fe6ae33c40f27b2ad72411b06 Mon Sep 17 00:00:00 2001
From: "Luis (LT) Carbonell" <lt.carbonell@hashicorp.com>
Date: Mon, 16 Sep 2024 11:00:08 -0400
Subject: [PATCH 25/44] VAULT-12732: Add Heap Profiling Option to Vault Server
 Command Line (#27033)

* Add pprof output option to CLI

* Add to docs

* Add changelog

* Update website/content/docs/commands/server.mdx

Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>

* some changes

* Update changelog/27033.txt

Co-authored-by: Josh Black <raskchanky@gmail.com>

---------

Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
Co-authored-by: Josh Black <raskchanky@gmail.com>
---
 changelog/27033.txt                      |  3 ++
 command/server.go                        | 59 +++++++++++++++++++++++-
 website/content/docs/commands/server.mdx |  5 ++
 3 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100644 changelog/27033.txt

diff --git a/changelog/27033.txt b/changelog/27033.txt
new file mode 100644
index 000000000000..a06152dedc2b
--- /dev/null
+++ b/changelog/27033.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+command/server: Add support for dumping pprof files during startup using CLI option `pprof-dump-dir`
+```
diff --git a/command/server.go b/command/server.go
index 54e921bbab5f..5aba92cbd36d 100644
--- a/command/server.go
+++ b/command/server.go
@@ -119,6 +119,7 @@ type ServerCommand struct {
 	flagConfigs            []string
 	flagRecovery           bool
 	flagExperiments        []string
+	flagCLIDump            string
 	flagDev                bool
 	flagDevTLS             bool
 	flagDevTLSCertDir      string
@@ -221,6 +222,13 @@ func (c *ServerCommand) Flags() *FlagSets {
 			"Valid experiments are: " + strings.Join(experiments.ValidExperiments(), ", "),
 	})
 
+	f.StringVar(&StringVar{
+		Name:       "pprof-dump-dir",
+		Target:     &c.flagCLIDump,
+		Completion: complete.PredictDirs("*"),
+		Usage:      "Directory where generated profiles are created. If left unset, files are not generated.",
+	})
+
 	f = set.NewFlagSet("Dev Options")
 
 	f.BoolVar(&BoolVar{
@@ -1593,6 +1601,11 @@ func (c *ServerCommand) Run(args []string) int {
 		coreShutdownDoneCh = core.ShutdownDone()
 	}
 
+	cliDumpCh := make(chan struct{})
+	if c.flagCLIDump != "" {
+		go func() { cliDumpCh <- struct{}{} }()
+	}
+
 	// Wait for shutdown
 	shutdownTriggered := false
 	retCode := 0
@@ -1707,7 +1720,6 @@ func (c *ServerCommand) Run(args []string) int {
 
 			// Notify systemd that the server has completed reloading config
 			c.notifySystemd(systemd.SdNotifyReady)
-
 		case <-c.SigUSR2Ch:
 			logWriter := c.logger.StandardWriter(&hclog.StandardLoggerOptions{})
 			pprof.Lookup("goroutine").WriteTo(logWriter, 2)
@@ -1759,6 +1771,51 @@ func (c *ServerCommand) Run(args []string) int {
 			}
 
 			c.logger.Info(fmt.Sprintf("Wrote pprof files to: %s", pprofPath))
+		case <-cliDumpCh:
+			path := c.flagCLIDump
+
+			if _, err := os.Stat(path); err != nil && !errors.Is(err, os.ErrNotExist) {
+				c.logger.Error("Checking cli dump path failed", "error", err)
+				continue
+			}
+
+			pprofPath := filepath.Join(path, "vault-pprof")
+			err := os.MkdirAll(pprofPath, os.ModePerm)
+			if err != nil {
+				c.logger.Error("Could not create temporary directory for pprof", "error", err)
+				continue
+			}
+
+			dumps := []string{"goroutine", "heap", "allocs", "threadcreate", "profile"}
+			for _, dump := range dumps {
+				pFile, err := os.Create(filepath.Join(pprofPath, dump))
+				if err != nil {
+					c.logger.Error("error creating pprof file", "name", dump, "error", err)
+					break
+				}
+
+				if dump != "profile" {
+					err = pprof.Lookup(dump).WriteTo(pFile, 0)
+					if err != nil {
+						c.logger.Error("error generating pprof data", "name", dump, "error", err)
+						pFile.Close()
+						break
+					}
+				} else {
+					// CPU profiles need to run for a duration so we're going to run it
+					// just for one second to avoid blocking here.
+					if err := pprof.StartCPUProfile(pFile); err != nil {
+						c.logger.Error("could not start CPU profile: ", err)
+						pFile.Close()
+						break
+					}
+					time.Sleep(time.Second * 1)
+					pprof.StopCPUProfile()
+				}
+				pFile.Close()
+			}
+
+			c.logger.Info(fmt.Sprintf("Wrote startup pprof files to: %s", pprofPath))
 		}
 	}
 	// Notify systemd that the server is shutting down
diff --git a/website/content/docs/commands/server.mdx b/website/content/docs/commands/server.mdx
index ce0b987534ad..de61d671ef75 100644
--- a/website/content/docs/commands/server.mdx
+++ b/website/content/docs/commands/server.mdx
@@ -92,6 +92,11 @@ flags](/vault/docs/commands) included on all commands.
   `VAULT_EXPERIMENTS` environment variable as a comma-separated list, or via the
   [`experiments`](/vault/docs/configuration#experiments) config key.
 
+- `-pprof-dump-dir` `(string: "")` - Directory where the generated profiles are
+  created. Vault does not generate profiles when `pprof-dump-dir` is unset.
+  Use `pprof-dump-dir` temporarily during debugging sessions. Do not use
+  `pprof-dump-dir` in regular production processes.
+
 - `VAULT_ALLOW_PENDING_REMOVAL_MOUNTS` `(bool: false)` - (environment variable)
   Allow Vault to be started with builtin engines which have the `Pending Removal`
   deprecation state. This is a temporary stopgap in place in order to perform an

From d466d7949bc61941b5791e89820974d36f910592 Mon Sep 17 00:00:00 2001
From: Robert <17119716+robmonte@users.noreply.github.com>
Date: Mon, 16 Sep 2024 10:40:03 -0500
Subject: [PATCH 26/44] Add activation flags cluster note (#28399)

---
 website/content/docs/release-notes/1.17.0.mdx | 1 +
 1 file changed, 1 insertion(+)

diff --git a/website/content/docs/release-notes/1.17.0.mdx b/website/content/docs/release-notes/1.17.0.mdx
index 00134af12c49..96b23723917c 100644
--- a/website/content/docs/release-notes/1.17.0.mdx
+++ b/website/content/docs/release-notes/1.17.0.mdx
@@ -26,6 +26,7 @@ description: |-
 | Known Issue (0.7.0+)           | [Duplicate identity groups created](/vault/docs/upgrading/upgrade-to-1.17.x#duplicate-identity-groups-created-when-concurrent-requests-sent-to-the-primary-and-pr-secondary-cluster)
 | Known Issue (0.7.0+)           | [Manual entity merges fail](/vault/docs/upgrading/upgrade-to-1.17.x#manual-entity-merges-sent-to-a-pr-secondary-cluster-are-not-persisted-to-storage)
 | Known Issue (1.17.3-1.17.4)    | [Some values in the audit logs not hmac'd properly](/vault/docs/upgrading/upgrade-to-1.17.x#client-tokens-and-token-accessors-audited-in-plaintext)
+| Known Issue (1.17.0-1.17.5)    | [Cached activation flags for secrets sync on follower nodes are not updated](/vault/docs/upgrading/upgrade-to-1.17.x#cached-activation-flags-for-secrets-sync-on-follower-nodes-are-not-updated)
 
 ## Vault companion updates
 

From 336e0c7f0d032a35859dea26638280077e888ef9 Mon Sep 17 00:00:00 2001
From: Andrew Talbot <import_visions_06@icloud.com>
Date: Mon, 16 Sep 2024 13:09:09 -0400
Subject: [PATCH 27/44] docs(lambda-extension): add line to document new revoke
 token header feature; (#28318)

---
 website/content/docs/platform/aws/lambda-extension.mdx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/website/content/docs/platform/aws/lambda-extension.mdx b/website/content/docs/platform/aws/lambda-extension.mdx
index e2ef7f40f7ce..94b6b8b8d99e 100644
--- a/website/content/docs/platform/aws/lambda-extension.mdx
+++ b/website/content/docs/platform/aws/lambda-extension.mdx
@@ -280,7 +280,8 @@ processing with returned secrets such as automatic lease renewal. The proxy serv
 own Vault auth token is the only thing that gets automatically refreshed. It will
 synchronously refresh its own token before proxying requests if the token is
 expired (including a grace window), and it will attempt to renew its token if the
-token is nearly expired but renewable.
+token is nearly expired but renewable. The proxy will also immediately refresh its token
+if the incoming request header `X-Vault-Token-Options: revoke` is present.
 
 <Note title="Not SnapStart compatible">
 

From 7a5d99d3169a0b025010107331d023e3066063d4 Mon Sep 17 00:00:00 2001
From: hc-github-team-secure-vault-core
 <github-team-secure-vault-core@hashicorp.com>
Date: Mon, 16 Sep 2024 13:41:35 -0400
Subject: [PATCH 28/44] Update vault-plugin-database-redis to v0.4.0 (#28404)

* Update vault-plugin-database-redis to v0.4.0

* Add changelog

---------

Co-authored-by: hc-github-team-secure-vault-ecosystem <hc-github-team-secure-vault-ecosystem@users.noreply.github.com>
---
 changelog/28404.txt |  3 +++
 go.mod              | 14 +++++++-------
 go.sum              | 32 ++++++++++++++++----------------
 3 files changed, 26 insertions(+), 23 deletions(-)
 create mode 100644 changelog/28404.txt

diff --git a/changelog/28404.txt b/changelog/28404.txt
new file mode 100644
index 000000000000..cca52cce8b67
--- /dev/null
+++ b/changelog/28404.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/redis: Update plugin to v0.4.0
+```
diff --git a/go.mod b/go.mod
index f56479f88e94..6684145582de 100644
--- a/go.mod
+++ b/go.mod
@@ -138,7 +138,7 @@ require (
 	github.com/hashicorp/vault-plugin-database-couchbase v0.12.0
 	github.com/hashicorp/vault-plugin-database-elasticsearch v0.16.0
 	github.com/hashicorp/vault-plugin-database-mongodbatlas v0.13.0
-	github.com/hashicorp/vault-plugin-database-redis v0.3.0
+	github.com/hashicorp/vault-plugin-database-redis v0.4.0
 	github.com/hashicorp/vault-plugin-database-redis-elasticache v0.5.0
 	github.com/hashicorp/vault-plugin-database-snowflake v0.12.0
 	github.com/hashicorp/vault-plugin-mock v0.16.1
@@ -204,9 +204,9 @@ require (
 	go.etcd.io/etcd/client/v3 v3.5.13
 	go.mongodb.org/atlas v0.37.0
 	go.mongodb.org/mongo-driver v1.16.1
-	go.opentelemetry.io/otel v1.29.0
-	go.opentelemetry.io/otel/sdk v1.29.0
-	go.opentelemetry.io/otel/trace v1.29.0
+	go.opentelemetry.io/otel v1.30.0
+	go.opentelemetry.io/otel/sdk v1.30.0
+	go.opentelemetry.io/otel/trace v1.30.0
 	go.uber.org/atomic v1.11.0
 	go.uber.org/goleak v1.3.0
 	golang.org/x/crypto v0.27.0
@@ -248,7 +248,7 @@ require (
 	cloud.google.com/go/compute/metadata v0.5.0 // indirect
 	cloud.google.com/go/iam v1.2.0 // indirect
 	cloud.google.com/go/kms v1.19.0 // indirect; indirect\
-	dario.cat/mergo v1.0.0 // indirect
+	dario.cat/mergo v1.0.1 // indirect
 	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
 	github.com/99designs/keyring v1.2.2 // indirect
 	github.com/Azure/azure-pipeline-go v0.2.3 // indirect
@@ -340,7 +340,7 @@ require (
 	github.com/digitalocean/godo v1.7.5 // indirect
 	github.com/dimchansky/utfbom v1.1.1 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/cli v25.0.6+incompatible // indirect
+	github.com/docker/cli v26.1.5+incompatible // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dvsekhvalnov/jose2go v1.6.0 // indirect
@@ -518,7 +518,7 @@ require (
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 // indirect
-	go.opentelemetry.io/otel/metric v1.29.0 // indirect
+	go.opentelemetry.io/otel/metric v1.30.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/mod v0.21.0 // indirect
diff --git a/go.sum b/go.sum
index fbe76f5d5946..940efc53ccd1 100644
--- a/go.sum
+++ b/go.sum
@@ -617,8 +617,8 @@ cloud.google.com/go/workflows v1.7.0/go.mod h1:JhSrZuVZWuiDfKEFxU0/F1PQjmpnpcoIS
 cloud.google.com/go/workflows v1.8.0/go.mod h1:ysGhmEajwZxGn1OhGOGKsTXc5PyxOc0vfKf5Af+to4M=
 cloud.google.com/go/workflows v1.9.0/go.mod h1:ZGkj1aFIOd9c8Gerkjjq7OW7I5+l6cSvT3ujaO/WwSA=
 cloud.google.com/go/workflows v1.10.0/go.mod h1:fZ8LmRmZQWacon9UCX1r/g/DfAXx5VcPALq2CxzdePw=
-dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
-dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
+dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
 git.sr.ht/~sbinet/gg v0.3.1/go.mod h1:KGYtlADtqsqANL9ueOFkWymvzUvLMQllU5Ixo+8v3pc=
@@ -995,8 +995,8 @@ github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
 github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
 github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
-github.com/docker/cli v25.0.6+incompatible h1:F1mCw1kUGixOkM8WQbcG5kniPvP8XCFxreFxl4b/UnY=
-github.com/docker/cli v25.0.6+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v26.1.5+incompatible h1:NxXGSdz2N+Ibdaw330TDO3d/6/f7MvHuiMbuFaIQDTk=
+github.com/docker/cli v26.1.5+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/docker v26.1.5+incompatible h1:NEAxTwEjxV6VbBMBoGG3zPqbiJosIApZjxlbrG9q3/g=
 github.com/docker/docker v26.1.5+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
@@ -1569,8 +1569,8 @@ github.com/hashicorp/vault-plugin-database-elasticsearch v0.16.0 h1:gArlFh8W0SVQ
 github.com/hashicorp/vault-plugin-database-elasticsearch v0.16.0/go.mod h1:IqiX9rT/8wCsriRogV4kOCIgAV21yEgjK1D+Oucda3Y=
 github.com/hashicorp/vault-plugin-database-mongodbatlas v0.13.0 h1:QfqA3GYVtuVOBe02snoEoU1BS6u3hUkzObd27lVb6FQ=
 github.com/hashicorp/vault-plugin-database-mongodbatlas v0.13.0/go.mod h1:4JKUfOniWUxWjnrsBKyPpy3u7dCxkncYAH6VM0BCPhg=
-github.com/hashicorp/vault-plugin-database-redis v0.3.0 h1:chSbAsc7cYkn5ajQ/528nKoCm9ExGpJaDjTDos2IUa4=
-github.com/hashicorp/vault-plugin-database-redis v0.3.0/go.mod h1:Tr6VELF9q/VAslIO7+ROykrzrvEONVaONrcsthX9qcY=
+github.com/hashicorp/vault-plugin-database-redis v0.4.0 h1:caNySLrAoKnwYun2kLlwntMKDp+T4yFl/ToCI+ebu1A=
+github.com/hashicorp/vault-plugin-database-redis v0.4.0/go.mod h1:OAKaJH4fj4t0MXPBU8FTb7Ca+DzyQD8wjvq4Dq7I8pU=
 github.com/hashicorp/vault-plugin-database-redis-elasticache v0.5.0 h1:XCbJLn02bRf9+eyjoMVaEx5TPoIJD9YV7u+shjr4paU=
 github.com/hashicorp/vault-plugin-database-redis-elasticache v0.5.0/go.mod h1:o1ac/VruWlSmjIaTx4GVCOiXw6+aUuXxHs3btG0XYjU=
 github.com/hashicorp/vault-plugin-database-snowflake v0.12.0 h1:rykZv8cV7W6iSeR9vEAFB3FivLz/tTuO8s8mNd9Xrbw=
@@ -2234,18 +2234,18 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.5
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0/go.mod h1:B9yO6b04uB80CzjedvewuqDhxJxi11s7/GtiGa8bAjI=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 h1:TT4fX+nBOA/+LUkobKGW1ydGcn+G3vRw9+g5HwCphpk=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0/go.mod h1:L7UH0GbB0p47T4Rri3uHjbpCFYrVrwc1I25QhNPiGK8=
-go.opentelemetry.io/otel v1.29.0 h1:PdomN/Al4q/lN6iBJEN3AwPvUiHPMlt93c8bqTG5Llw=
-go.opentelemetry.io/otel v1.29.0/go.mod h1:N/WtXPs1CNCUEx+Agz5uouwCba+i+bJGFicT8SR4NP8=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.29.0 h1:dIIDULZJpgdiHz5tXrTgKIMLkus6jEFa7x5SOKcyR7E=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.29.0/go.mod h1:jlRVBe7+Z1wyxFSUs48L6OBQZ5JwH2Hg/Vbl+t9rAgI=
+go.opentelemetry.io/otel v1.30.0 h1:F2t8sK4qf1fAmY9ua4ohFS/K+FUuOPemHUIXHtktrts=
+go.opentelemetry.io/otel v1.30.0/go.mod h1:tFw4Br9b7fOS+uEao81PJjVMjW/5fvNCbpsDIXqP0pc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.30.0 h1:lsInsfvhVIfOI6qHVyysXMNDnjO9Npvl7tlDPJFBVd4=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.30.0/go.mod h1:KQsVNh4OjgjTG0G6EiNi1jVpnaeeKsKMRwbLN+f1+8M=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.29.0 h1:JAv0Jwtl01UFiyWZEMiJZBiTlv5A50zNs8lsthXqIio=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.29.0/go.mod h1:QNKLmUEAq2QUbPQUfvw4fmv0bgbK7UlOSFCnXyfvSNc=
-go.opentelemetry.io/otel/metric v1.29.0 h1:vPf/HFWTNkPu1aYeIsc98l4ktOQaL6LeSoeV2g+8YLc=
-go.opentelemetry.io/otel/metric v1.29.0/go.mod h1:auu/QWieFVWx+DmQOUMgj0F8LHWdgalxXqvp7BII/W8=
-go.opentelemetry.io/otel/sdk v1.29.0 h1:vkqKjk7gwhS8VaWb0POZKmIEDimRCMsopNYnriHyryo=
-go.opentelemetry.io/otel/sdk v1.29.0/go.mod h1:pM8Dx5WKnvxLCb+8lG1PRNIDxu9g9b9g59Qr7hfAAok=
-go.opentelemetry.io/otel/trace v1.29.0 h1:J/8ZNK4XgR7a21DZUAsbF8pZ5Jcw1VhACmnYt39JTi4=
-go.opentelemetry.io/otel/trace v1.29.0/go.mod h1:eHl3w0sp3paPkYstJOmAimxhiFXPg+MMTlEh3nsQgWQ=
+go.opentelemetry.io/otel/metric v1.30.0 h1:4xNulvn9gjzo4hjg+wzIKG7iNFEaBMX00Qd4QIZs7+w=
+go.opentelemetry.io/otel/metric v1.30.0/go.mod h1:aXTfST94tswhWEb+5QjlSqG+cZlmyXy/u8jFpor3WqQ=
+go.opentelemetry.io/otel/sdk v1.30.0 h1:cHdik6irO49R5IysVhdn8oaiR9m8XluDaJAs4DfOrYE=
+go.opentelemetry.io/otel/sdk v1.30.0/go.mod h1:p14X4Ok8S+sygzblytT1nqG98QG2KYKv++HE0LY/mhg=
+go.opentelemetry.io/otel/trace v1.30.0 h1:7UBkkYzeg3C7kQX8VAidWh2biiQbtAKjyIML8dQ9wmc=
+go.opentelemetry.io/otel/trace v1.30.0/go.mod h1:5EyKqTzzmyqB9bwtCCq6pDLktPK6fmGf/Dph+8VI02o=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.opentelemetry.io/proto/otlp v0.15.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
 go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=

From c14047063943872f5a5cfeabb864f8217b0a3e61 Mon Sep 17 00:00:00 2001
From: Violet Hynes <violet.hynes@hashicorp.com>
Date: Mon, 16 Sep 2024 15:54:38 -0400
Subject: [PATCH 29/44] Fix Vercel error caused by spaces before code snippet
 (#28408)

---
 website/content/docs/sync/github.mdx | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/website/content/docs/sync/github.mdx b/website/content/docs/sync/github.mdx
index 6632a9176b04..5a00a2ab2228 100644
--- a/website/content/docs/sync/github.mdx
+++ b/website/content/docs/sync/github.mdx
@@ -35,11 +35,11 @@ Use `vault write` to configure a repository sync destination with an access toke
       repository_owner="GITHUB_OWNER_NAME"                \
       repository_name="GITHUB_REPO_NAME"
   ```
-  
+
   For example:
 
   <CodeBlockConfig hideClipboard>
-  
+
   ```
   $ vault write sys/sync/destinations/gh/hcrepo-sandbox       \
       access_token="github_pat_11ABC000000000000000000000DEF" \
@@ -64,11 +64,11 @@ Use `vault write` to configure a repository sync destination with an access toke
       repository_name="GITHUB_REPO_NAME"                  \
       environment_name="GITHUB_ENVIRONMENT_NAME"
   ```
-  
+
   For example:
 
   <CodeBlockConfig hideClipboard>
-  
+
   ```
   $ vault write sys/sync/destinations/gh/hcrepo-sandbox       \
       access_token="github_pat_11ABC000000000000000000000DEF" \
@@ -177,7 +177,7 @@ depending on whether you have configured
 If using the secret-path granularity, it is strongly advised to mask individual values for each sub-key to prevent the
 unintended disclosure of secrets in any GitHub Action outputs. The following snippet illustrates how to mask each secret values:
 
-  ```yaml
+```yaml
   name: Mask synced secret values
 
   on:
@@ -192,7 +192,7 @@ unintended disclosure of secrets in any GitHub Action outputs. The following sni
             for v in $(echo '${{ secrets.VAULT_KV_1234_MY_SECRET }}' | jq -r '.[]'); do
               echo "::add-mask::$v"
             done
-  ```
+```
 
 If the GitHub destination uses the default `secret-key` granularity, the values are masked by GitHub automatically.
 

From d00715d1292ef91db668dcb7dd172ad3cce24c8a Mon Sep 17 00:00:00 2001
From: miagilepner <mia.epner@hashicorp.com>
Date: Tue, 17 Sep 2024 10:53:18 +0200
Subject: [PATCH 30/44] VAULT-28478: Updates to autopilot docs (#28331)

* restructure

* update command

* fixes

* fix command flags

* revert makefile change

* remove tick log
---
 .../api-docs/system/storage/raftautopilot.mdx | 112 ++++++------
 .../content/docs/commands/operator/raft.mdx   | 165 ++++++++++++------
 .../concepts/integrated-storage/autopilot.mdx |  43 +----
 .../concepts/integrated-storage/index.mdx     |  18 +-
 .../docs/enterprise/redundancy-zones.mdx      |   4 +
 .../docs/internals/integrated-storage.mdx     |  22 +++
 website/content/partials/autopilot/config.mdx |  53 ++++++
 .../content/partials/autopilot/node-types.mdx |   6 +
 .../partials/autopilot/redundancy-zones.mdx   |  25 +++
 9 files changed, 294 insertions(+), 154 deletions(-)
 create mode 100644 website/content/partials/autopilot/config.mdx
 create mode 100644 website/content/partials/autopilot/node-types.mdx
 create mode 100644 website/content/partials/autopilot/redundancy-zones.mdx

diff --git a/website/content/api-docs/system/storage/raftautopilot.mdx b/website/content/api-docs/system/storage/raftautopilot.mdx
index 19b453b8144d..ea02f25539cb 100644
--- a/website/content/api-docs/system/storage/raftautopilot.mdx
+++ b/website/content/api-docs/system/storage/raftautopilot.mdx
@@ -35,54 +35,69 @@ $ curl \
 
 ```json
 {
-  "healthy": true,
   "failure_tolerance": 1,
+  "healthy": true,
+  "leader": "vault_1",
   "servers": {
-    "raft1": {
-      "id": "raft1",
-      "name": "raft1",
+    "vault_1": {
       "address": "127.0.0.1:8201",
-      "node_status": "alive",
+      "healthy": true,
+      "id": "vault_1",
       "last_contact": "0s",
+      "last_index": 63,
       "last_term": 3,
-      "last_index": 459,
-      "healthy": true,
-      "stable_since": "2021-03-19T20:14:11.831678-04:00",
+      "name": "vault_1",
+      "node_status": "alive",
+      "node_type": "voter",
+      "stable_since": "2024-08-29T16:02:45.639829+02:00",
       "status": "leader",
-      "meta": null
+      "version": "1.17.3"
     },
-    "raft2": {
-      "id": "raft2",
-      "name": "raft2",
-      "address": "127.0.0.2:8201",
-      "node_status": "alive",
-      "last_contact": "516.49595ms",
-      "last_term": 3,
-      "last_index": 459,
+    "vault_2": {
+      "address": "127.0.0.1:8203",
       "healthy": true,
-      "stable_since": "2021-03-19T20:14:19.831931-04:00",
+      "id": "vault_2",
+      "last_contact": "678.62575ms",
+      "last_index": 63,
+      "last_term": 3,
+      "name": "vault_2",
+      "node_status": "alive",
+      "node_type": "voter",
+      "stable_since": "2024-08-29T16:02:47.640976+02:00",
       "status": "voter",
-      "meta": null
+      "version": "1.17.3"
     },
-    "raft3": {
-      "id": "raft3",
-      "name": "raft3",
-      "address": "127.0.0.3:8201",
-      "node_status": "alive",
-      "last_contact": "196.706591ms",
-      "last_term": 3,
-      "last_index": 459,
+    "vault_3": {
+      "address": "127.0.0.1:8205",
       "healthy": true,
-      "stable_since": "2021-03-19T20:14:25.83565-04:00",
+      "id": "vault_3",
+      "last_contact": "3.969159375s",
+      "last_index": 63,
+      "last_term": 3,
+      "name": "vault_3",
+      "node_status": "alive",
+      "node_type": "voter",
+      "stable_since": "2024-08-29T16:02:49.640905+02:00",
       "status": "voter",
-      "meta": null
+      "version": "1.17.3"
     }
   },
-  "leader": "raft1",
-  "voters": ["raft1", "raft2", "raft3"],
-  "non_voters": null
+  "voters": [
+    "vault_1",
+    "vault_2",
+    "vault_3"
+  ]
 }
 ```
+The `failure_tolerance` of a cluster is the number of nodes in the cluster that could
+fail gradually without causing an outage.
+
+When verifying the health of your cluster, check the following fields of each server:
+- `healthy`: whether Autopilot considers this node healthy or not
+- `status`: the voting status of the node. This will be `voter`, `leader`, or [`non-voter`](/vault/docs/concepts/integrated-storage#non-voting-nodes-enterprise-only)")
+- `last_index`: the index of the last applied Raft log. This should be close to the `last_index` value of the leader.
+- `version`: the version of Vault running on the server
+- `node_type`: the type of node. On CE, this will always be `voter`. See below for an explanation of Enterprise node types.
 
 ### Enterprise only
 Vault Enterprise will include additional output in its API response to indicate the current state of redundancy zones,
@@ -149,7 +164,7 @@ automated upgrade progress (if any), and optimistic failure tolerance.
       }
     },
     "status": "await-new-voters",
-    "target_version": "1.12.0",
+    "target_version": "1.17.5",
     "target_version_non_voters": [
       "vault_5"
     ]
@@ -161,6 +176,11 @@ automated upgrade progress (if any), and optimistic failure tolerance.
 }
 ```
 
+`optimistic_failure_tolerance` describes the number of healthy active and
+back-up voting servers that can fail gradually without causing an outage.
+
+@include 'autopilot/node-types.mdx'
+
 ## Get configuration
 
 This endpoint is used to get the configuration of the autopilot subsystem of Integrated Storage.
@@ -203,31 +223,7 @@ This endpoint is used to modify the configuration of the autopilot subsystem of
 
 ### Parameters
 
-- `cleanup_dead_servers` `(bool: false)` - Controls whether to remove dead servers from
-  the Raft peer list periodically or when a new server joins. This requires that
-  `min_quorum` is also set.
-
-- `last_contact_threshold` `(string: "10s")` - Limit on the amount of time a server can
-  go without leader contact before being considered unhealthy.
-
-- `dead_server_last_contact_threshold` `(string: "24h")` - Limit on the amount of time
-  a server can go without leader contact before being considered failed. This
-  takes effect only when `cleanup_dead_servers` is `true`. This can not be set to a value
-  smaller than 1m. **We strongly recommend that this is kept at a high duration, such as a day,
-  as it being too low could result in removal of nodes that aren't actually dead.**
-
-- `max_trailing_logs` `(int: 1000)` - Amount of entries in the Raft Log that a server
-  can be behind before being considered unhealthy.
-
-- `min_quorum` `(int: 3)` - Minimum number of servers allowed in a cluster before
-  autopilot can prune dead servers. This should at least be 3. Applicable only for
-  voting nodes.
-
-- `server_stabilization_time` `(string: "10s")` - Minimum amount of time a server must
-  be in a stable, healthy state before it can be added to the cluster.
-
-- `disable_upgrade_migration` `(bool: false)` - Disables automatically upgrading Vault using
-  autopilot. (Enterprise-only)
+@include 'autopilot/config.mdx'
 
 ### Sample request
 
diff --git a/website/content/docs/commands/operator/raft.mdx b/website/content/docs/commands/operator/raft.mdx
index 9b7f91da94ef..59fa0ead31e6 100644
--- a/website/content/docs/commands/operator/raft.mdx
+++ b/website/content/docs/commands/operator/raft.mdx
@@ -128,6 +128,13 @@ Usage: vault operator raft list-peers
 }
 ```
 
+Use the output of `list-peers` to ensure that your cluster is in an expected state.
+If you've removed a server using `remove-peer`, the server should no longer be
+listed in the `list-peers` output. If you've added a server using `add-peer` or
+through `retry_join`, check the `list-peers` output to see that it has been added
+to the cluster and (if the node has not been added as a non-voter)
+it has been promoted to a voter.
+
 ## remove-peer
 
 This command is used to remove a node from being a peer to the Raft cluster. In
@@ -229,14 +236,9 @@ Subcommands:
 ### autopilot state
 
 Displays the state of the raft cluster under integrated storage as seen by
-autopilot. It shows whether autopilot thinks the cluster is healthy or not,
-and how many nodes could fail before the cluster becomes unhealthy ("Failure Tolerance").
-
-State includes a list of all servers by nodeID and IP address. Last Index
-indicates how close the state on each node is to the leader's.
+autopilot. It shows whether autopilot thinks the cluster is healthy or not.
 
-A node can have a status of "leader", "voter", and
-"[non-voter](/vault/docs/concepts/integrated-storage#non-voting-nodes-enterprise-only)".
+State includes a list of all servers by nodeID and IP address.
 
 ```text
 Usage: vault operator raft autopilot state
@@ -249,34 +251,60 @@ Usage: vault operator raft autopilot state
 #### Example output
 
 ```text
-Healthy:                      true
-Failure Tolerance:            1
-Leader:                       raft1
+Healthy:                         true
+Failure Tolerance:               1
+Leader:                          vault_1
 Voters:
-   raft1
-   raft2
-   raft3
+   vault_1
+   vault_2
+   vault_3
 Servers:
-   raft1
-      Name:            raft1
-      Address:         127.0.0.1:8201
-      Status:          leader
-      Node Status:     alive
-      Healthy:         true
-      Last Contact:    0s
-      Last Term:       3
-      Last Index:      38
-   raft2
-      Name:            raft2
-      Address:         127.0.0.2:8201
-      Status:          voter
-      Node Status:     alive
-      Healthy:         true
-      Last Contact:    2.514176729s
-      Last Term:       3
-      Last Index:      38
+   vault_1
+      Name:              vault_1
+      Address:           127.0.0.1:8201
+      Status:            leader
+      Node Status:       alive
+      Healthy:           true
+      Last Contact:      0s
+      Last Term:         3
+      Last Index:        61
+      Version:           1.17.3
+      Node Type:         voter
+   vault_2
+      Name:              vault_2
+      Address:           127.0.0.1:8203
+      Status:            voter
+      Node Status:       alive
+      Healthy:           true
+      Last Contact:      564.765375ms
+      Last Term:         3
+      Last Index:        61
+      Version:           1.17.3
+      Node Type:         voter
+   vault_3
+      Name:              vault_3
+      Address:           127.0.0.1:8205
+      Status:            voter
+      Node Status:       alive
+      Healthy:           true
+      Last Contact:      3.814017875s
+      Last Term:         3
+      Last Index:        61
+      Version:           1.17.3
+      Node Type:         voter
 ```
-Vault Enterprise will include additional output related to automated upgrades and redundancy zones.
+
+The "Failure Tolerance" of a cluster is the number of nodes in the cluster that could
+fail gradually without causing an outage.
+
+When verifying the health of your cluster, check the following fields of each server:
+- Healthy: whether Autopilot considers this node healthy or not
+- Status: the voting status of the node. This will be `voter`, `leader`, or [`non-voter`](/vault/docs/concepts/integrated-storage#non-voting-nodes-enterprise-only).
+- Last Index: the index of the last applied Raft log. This should be close to the "Last Index" value of the leader.
+- Version: the version of Vault running on the server
+- Node Type: the type of node. On CE, this will always be `voter`. See below for an explanation of Enterprise node types.
+
+Vault Enterprise will include additional output related to automated upgrades, optimistic failure tolerance, and redundancy zones.
 
 #### Example Vault enterprise output
 
@@ -292,7 +320,7 @@ Redundancy Zones:
       Failure Tolerance: 1
 Upgrade Info:
    Status: await-new-voters
-   Target Version: 1.12.0
+   Target Version: 1.17.5
    Target Version Voters:
    Target Version Non-Voters: vault_5
    Other Version Voters: vault_1, vault_3
@@ -310,6 +338,11 @@ Upgrade Info:
          Other Version Non-Voters: vault_4
 ```
 
+"Optimistic Failure Tolerance" describes the number of healthy active and
+back-up voting servers that can fail gradually without causing an outage.
+
+@include 'autopilot/node-types.mdx'
+
 ### autopilot get-config
 
 Returns the configuration of the autopilot subsystem under integrated storage.
@@ -337,29 +370,49 @@ Usage: vault operator raft autopilot set-config [options]
 
 Flags applicable to this command are the following:
 
-- `cleanup-dead-servers` `(bool)` - Controls whether to remove dead servers from
+- `cleanup-dead-servers` `(bool: false)` - Controls whether to remove dead servers from
   the Raft peer list periodically or when a new server joins. This requires that
-  `min-quorum` is also set. Defaults to `false`.
-
-- `last-contact-threshold` `(string)` - Limit on the amount of time a server can
-  go without leader contact before being considered unhealthy. Defaults to `10s`.
-
-- `dead-server-last-contact-threshold` `(string)` - Limit on the amount of time
-  a server can go without leader contact before being considered failed.
-  This takes effect only when `cleanup_dead_servers` is set as `true`. Defaults to `24h`.
-  
-  -> **Note:** A failed server that autopilot has removed from the raft configuration cannot rejoin the cluster without being reinitialized.  
-
-- `max-trailing-logs` `(int)` - Amount of entries in the Raft Log that a server
-  can be behind before being considered unhealthy. Defaults to `1000`.
-
-- `min-quorum` `(int)` - Minimum number of servers that should always be present in a cluster.
-  Autopilot will not prune servers below this number. This should be set to the expected number
-  of voters in your cluster. There is no default.
-
-- `server-stabilization-time` `(string)` - Minimum amount of time a server must be in a healthy state before it
+  `min-quorum` is also set.
+
+- `last-contact-threshold` `(string: "10s")` - Limit on the amount of time a server can
+  go without leader contact before being considered unhealthy.
+
+- `dead-server-last-contact-threshold` `(string: "24h")` - Limit on the amount of time
+a server can go without leader contact before being considered failed. This
+takes effect only when `cleanup_dead_servers` is set. When adding new nodes
+to your cluster, the `dead_server_last_contact_threshold` needs to be larger
+than the amount of time that it takes to load a Raft snapshot, otherwise the
+newly added nodes will be removed from your cluster before they have finished
+loading the snapshot and starting up. If you are using an [HSM](/vault/docs/enterprise/hsm), your
+`dead_server_last_contact_threshold` needs to be larger than the response
+time of the HSM.
+
+<Warning>
+
+  We strongly recommend keeping `dead_server_last_contact_threshold` at a high
+  duration, such as a day, as it being too low could result in removal of nodes
+  that aren't actually dead
+
+</Warning>
+
+- `max-trailing-logs` `(int: 1000)` - Amount of entries in the Raft Log that a server
+  can be behind before being considered unhealthy. If this value is too low,
+  it can cause the cluster to lose quorum if a follower falls behind. This
+  value only needs to be increased from the default if you have a very high
+  write load on Vault and you see that it takes a long time to promote new
+  servers to becoming voters. This is an unlikely scenario and most users
+  should not modify this value.
+
+- `min-quorum` `(int)` - The minimum number of servers that should always be
+present in a cluster. Autopilot will not prune servers below this number.
+**There is no default for this value** and it should be set to the expected
+number of voters in your cluster when `cleanup_dead_servers` is set as `true`.
+Use the [quorum size guidance](/vault/docs/internals/integrated-storage#quorum-size-and-failure-tolerance)
+to determine the proper minimum quorum size for your cluster.
+
+- `server-stabilization-time` `(string: "10s")` - Minimum amount of time a server must be in a healthy state before it
   can become a voter. Until that happens, it will be visible as a peer in the cluster, but as a non-voter, meaning it
-  won't contribute to quorum. Defaults to `10s`.
+  won't contribute to quorum.
 
-- `disable-upgrade-migration` `(bool)` - Controls whether to disable automated
-  upgrade migrations, an Enterprise-only feature. Defaults to `false`.
+- `disable-upgrade-migration` `(bool: false)` - Controls whether to disable automated
+  upgrade migrations, an Enterprise-only feature.
diff --git a/website/content/docs/concepts/integrated-storage/autopilot.mdx b/website/content/docs/concepts/integrated-storage/autopilot.mdx
index 327c87d47bcf..497d336fd790 100644
--- a/website/content/docs/concepts/integrated-storage/autopilot.mdx
+++ b/website/content/docs/concepts/integrated-storage/autopilot.mdx
@@ -17,7 +17,7 @@ These two features were introduced in Vault 1.11.
 Server stabilization helps to retain the stability of the Raft cluster by safely
 joining new voting nodes to the cluster. When a new voter node is joined to an
 existing cluster, autopilot adds it as a non-voter instead, and waits for a
-pre-configured amount of time to monitor it's health. If the node remains to be
+pre-configured amount of time to monitor its health. If the node remains
 healthy for the entire duration of stabilization, then that node will be
 promoted as a voter. The server stabilization period can be tuned using
 `server_stabilization_time` (see below).
@@ -31,7 +31,7 @@ and `min_quorum` (see below).
 
 ## State API
 
-State API provides detailed information about all the nodes in the Raft cluster
+The [State API](/vault/api-docs/system/storage/raftautopilot#get-cluster-state) provides detailed information about all the nodes in the Raft cluster
 in a single call. This API can be used for monitoring for cluster health.
 
 ### Follower health
@@ -50,40 +50,7 @@ although dead server cleanup is not enabled by default. Upgrade of
 Raft clusters deployed with older versions of Vault will also transition to use
 Autopilot automatically.
 
-Autopilot exposes a [configuration
-API](/vault/api-docs/system/storage/raftautopilot#set-configuration) to manage its
-behavior. Autopilot gets initialized with the following default values. If these default values do not meet your expected autopilot behavior, don't forget to set them to your desired values.
-
-- `cleanup_dead_servers` - `false`
-  - This controls whether to remove dead servers from
-    the Raft peer list periodically or when a new server joins. This requires that
-    `min-quorum` is also set.
-
-- `dead_server_last_contact_threshold` - `24h`
-  - Limit on the amount of time
-    a server can go without leader contact before being considered failed. This
-    takes effect only when `cleanup_dead_servers` is set. **We strongly recommend
-    that this is kept at a high duration, such as a day, as it being too low could
-    result in removal of nodes that aren't actually dead.**
-
-- `min_quorum` - This doesn't default to anything and should be set to the expected
-  number of voters in your cluster when `cleanup_dead_servers` is set as `true`.
-  - Minimum number of servers that should always be present in a cluster.
-  Autopilot will not prune servers below this number.
-
-- `max_trailing_logs` - `1000`
-  - Amount of entries in the Raft Log that a server
-    can be behind before being considered unhealthy.
-
-- `last_contact_threshold` - `10s`
-  - Limit on the amount of time a server can go without leader contact before being considered unhealthy.
-
-- `server_stabilization_time` - `10s`
-  - Minimum amount of time a server must be in a healthy state before it can become a voter. Until that happens,
-    it will be visible as a peer in the cluster, but as a non-voter, meaning it won't contribute to quorum.
-
-- `disable_upgrade_migration` - `false`
-  - Controls whether to disable automated upgrade migrations, an Enterprise-only feature.
+@include 'autopilot/config.mdx'
 
 ~> **Note**: Autopilot in Vault does similar things to what autopilot does in
 [Consul](https://www.consul.io/). However, the configuration in these 2 systems
@@ -94,7 +61,7 @@ provide the autopilot functionality.
 
 ## Automated upgrades
 
-Automated Upgrades lets you automatically upgrade a cluster of Vault nodes to a new version as
+[Automated Upgrades](/vault/docs/enterprise/automated-upgrades) lets you automatically upgrade a cluster of Vault nodes to a new version as
 updated server nodes join the cluster. Once the number of nodes on the new version is
 equal to or greater than the number of nodes on the old version, Autopilot will promote
 the newer versioned nodes to voters, demote the older versioned nodes to non-voters,
@@ -104,7 +71,7 @@ nodes can be removed from the cluster.
 
 ## Redundancy zones
 
-Redundancy Zones provide both scaling and resiliency benefits by deploying non-voting
+[Redundancy Zones](/vault/docs/enterprise/redundancy-zones) provide both scaling and resiliency benefits by deploying non-voting
 nodes alongside voting nodes on a per availability zone basis. When using redundancy zones,
 each zone will have exactly one voting node and as many additional non-voting nodes as desired.
 If the voting node in a zone fails, a non-voting node will be automatically promoted to
diff --git a/website/content/docs/concepts/integrated-storage/index.mdx b/website/content/docs/concepts/integrated-storage/index.mdx
index 6e1d8c79ca0b..5fe51e63aca0 100644
--- a/website/content/docs/concepts/integrated-storage/index.mdx
+++ b/website/content/docs/concepts/integrated-storage/index.mdx
@@ -60,6 +60,11 @@ API (both methods described below). When joining a node, the API address of the
 recommend setting the [`api_addr`](/vault/docs/concepts/ha#direct-access) configuration
 option on all nodes to make joining simpler.
 
+Always join nodes to a cluster one at a time and wait for the node to become
+healthy and (if applicable) a voter before continuing to add more nodes. The
+status of a node can be verified by performing a [`list-peers`](/vault/docs/commands/operator/raft#list-peers)
+command or by checking the [`autopilot state`](/vault/docs/commands/operator/raft#autopilot-state).
+
 #### `retry_join` configuration
 
 This method enables setting one, or more, target leader nodes in the config file.
@@ -95,9 +100,10 @@ provided, Vault will use [go-discover](https://github.com/hashicorp/go-discover)
 to automatically attempt to discover and resolve potential Raft leader
 addresses.
 
-See the go-discover
+Check the go-discover
 [README](https://github.com/hashicorp/go-discover/blob/master/README.md) for
-details on the format of the [`auto_join`](/vault/docs/configuration/storage/raft#auto_join) value.
+details on the format of the [`auto_join`](/vault/docs/configuration/storage/raft#auto_join)
+value per cloud provider.
 
 ```hcl
 storage "raft" {
@@ -167,6 +173,14 @@ $ vault operator raft remove-peer node1
 Peer removed successfully!
 ```
 
+#### Re-joining after removal
+
+If you have used `remove-peer` to remove a node from the Raft cluster, but you
+later want to have this same node re-join the cluster, you will need to delete
+any existing Raft data on the removed node before adding it back to the cluster.
+This will involve stopping the Vault process, deleting the data directory containing
+Raft data, and then restarting the Vault process.
+
 ### Listing peers
 
 To see the current peer set for the cluster you can issue a
diff --git a/website/content/docs/enterprise/redundancy-zones.mdx b/website/content/docs/enterprise/redundancy-zones.mdx
index f905ff20b524..c4cb9f903a8e 100644
--- a/website/content/docs/enterprise/redundancy-zones.mdx
+++ b/website/content/docs/enterprise/redundancy-zones.mdx
@@ -36,3 +36,7 @@ wait to begin leadership transfer until it can ensure that there will be as much
 new Vault version as there was on the old Vault version.
 
 The status of redundancy zones can be monitored by consulting the [Autopilot state API endpoint](/vault/api-docs/system/storage/raftautopilot#get-cluster-state).
+
+## Optimistic Failure Tolerance
+
+@include 'autopilot/redundancy-zones.mdx'
diff --git a/website/content/docs/internals/integrated-storage.mdx b/website/content/docs/internals/integrated-storage.mdx
index 1679575f7b5f..5fa5e0756e6e 100644
--- a/website/content/docs/internals/integrated-storage.mdx
+++ b/website/content/docs/internals/integrated-storage.mdx
@@ -271,6 +271,28 @@ For example, if you start with a 5-node cluster:
 You should always maintain quorum to limit the impact on failure tolerance when
 changing or scaling your Vault instance.
 
+### Redundancy Zones
+
+If you are using autopilot with [redundancy zones](/vault/docs/enterprise/redundancy-zones),
+the total number of servers will be different from the above, and is dependent
+on how many redundancy zones and servers per redundancy zone that you choose.
+
+@include 'autopilot/redundancy-zones.mdx'
+
+<Highlight title="Best practice">
+
+  If you choose to use redundancy zones, we **strongly recommend** using at least 3
+  zones to ensure failure tolerance.
+
+</Highlight>
+
+Redundancy zones | Servers per zone | Quorum size | Failure tolerance | Optimistic failure tolerance
+:--------------: | :--------------: | :---------: | :---------------: | :--------------------------:
+2                | 2                | 2           | 0                 | 2
+3                | 2                | 2           | 1                 | 3
+3                | 3                | 2           | 1                 | 5
+5                | 2                | 3           | 2                 | 6
+
 [consensus protocol]: https://en.wikipedia.org/wiki/Consensus_(computer_science)
 [consistency]: https://en.wikipedia.org/wiki/CAP_theorem
 ["Raft: In search of an Understandable Consensus Algorithm"]: https://raft.github.io/raft.pdf
diff --git a/website/content/partials/autopilot/config.mdx b/website/content/partials/autopilot/config.mdx
new file mode 100644
index 000000000000..cede26434b8d
--- /dev/null
+++ b/website/content/partials/autopilot/config.mdx
@@ -0,0 +1,53 @@
+Autopilot exposes a [configuration
+API](/vault/api-docs/system/storage/raftautopilot#set-configuration) to manage its
+behavior. These items cannot be set in Vault server configuration files.
+Autopilot gets initialized with the following default values. If these default
+values do not meet your expected autopilot behavior, don't forget to set them to your desired values.
+
+- `cleanup_dead_servers` `(bool: false)` - This controls whether to remove dead servers from
+the Raft peer list periodically or when a new server joins. This requires that
+`min-quorum` is also set.
+
+- `dead_server_last_contact_threshold` `(string: "24h")` - Limit on the amount of time
+a server can go without leader contact before being considered failed. This
+takes effect only when `cleanup_dead_servers` is set. When adding new nodes
+to your cluster, the `dead_server_last_contact_threshold` needs to be larger
+than the amount of time that it takes to load a Raft snapshot, otherwise the
+newly added nodes will be removed from your cluster before they have finished
+loading the snapshot and starting up. If you are using an [HSM](/vault/docs/enterprise/hsm), your
+`dead_server_last_contact_threshold` needs to be larger than the response
+time of the HSM.
+
+<Warning>
+
+  We strongly recommend keeping `dead_server_last_contact_threshold` at a high
+  duration, such as a day, as it being too low could result in removal of nodes
+  that aren't actually dead
+
+</Warning>
+
+- `min_quorum` `(int)` - The minimum number of servers that should always be
+present in a cluster. Autopilot will not prune servers below this number.
+**There is no default for this value** and it should be set to the expected
+number of voters in your cluster when `cleanup_dead_servers` is set as `true`.
+Use the [quorum size guidance](/vault/docs/internals/integrated-storage#quorum-size-and-failure-tolerance)
+to determine the proper minimum quorum size for your cluster.
+
+- `max_trailing_logs` `(int: 1000)` - Amount of entries in the Raft Log that a
+server can be behind before being considered unhealthy. If this value is too low,
+it can cause the cluster to lose quorum if a follower falls behind. This
+value only needs to be increased from the default if you have a very high
+write load on Vault and you see that it takes a long time to promote new
+servers to becoming voters. This is an unlikely scenario and most users
+should not modify this value.
+
+- `last_contact_threshold` `(string "10s")` - Limit on the amount of time a
+server can go without leader contact before being considered unhealthy.
+
+- `server_stabilization_time` `(string "10s")` - Minimum amount of time a server
+must be in a healthy state before it can become a voter. Until that happens,
+it will be visible as a peer in the cluster, but as a non-voter, meaning it
+won't contribute to quorum.
+
+- `disable_upgrade_migration` `(bool: false)` - Disables automatically upgrading
+Vault using autopilot (Enterprise-only)
diff --git a/website/content/partials/autopilot/node-types.mdx b/website/content/partials/autopilot/node-types.mdx
new file mode 100644
index 000000000000..8ee7c5b9f498
--- /dev/null
+++ b/website/content/partials/autopilot/node-types.mdx
@@ -0,0 +1,6 @@
+#### Enterprise Node Types
+- `voter`: The server is a Raft voter and contributing to quorum.
+- `read-replica`: The server is not a Raft voter, but receives a replica of all data.
+- `zone-voter`: The main Raft voter in a redundancy zone.
+- `zone-extra-voter`: An additional Raft voter in a redundancy zone.
+- `zone-standby`: A non-voter in a redundancy zone that can be promoted to a voter, if needed.
diff --git a/website/content/partials/autopilot/redundancy-zones.mdx b/website/content/partials/autopilot/redundancy-zones.mdx
new file mode 100644
index 000000000000..e681b1e26baa
--- /dev/null
+++ b/website/content/partials/autopilot/redundancy-zones.mdx
@@ -0,0 +1,25 @@
+The majority of the voting servers in a cluster need to be available to agree on
+changes in configuration. If a voting node becomes unavailable and that causes
+the cluster to have fewer voting nodes than the quorum size, then Autopilot will not
+be able to promote a non-voter to become a voter. This is the **failure tolerance** of
+the cluster. Redundancy zones are not able to improve the failure tolerance of a
+cluster.
+
+Say that you have a cluster configured to have 2 redundancy zones and each zone
+has 2 servers within it (for total of 4 nodes in the cluster). The quorum size
+is 2. If the zone voter in either of the redundancy zones becomes unavailable,
+the cluster does not have quorum and is not able to agree on the configuration
+change needed to promote the non-voter in the zone into a voter.
+
+Redundancy zones do improve the **optimistic failure tolerance** of a cluster.
+The optimistic failure tolerance is the number of healthy active and back-up
+voting servers that can fail gradually without causing an outage. If the Vault
+cluster is able to maintain a quorum of voting nodes, then the cluster has the
+capability to lose nodes gradually and promote the standby redundancy zone nodes
+to take the place of voters.
+
+For example, consider a cluster that is configured to have 3 redundancy zones
+with 2 nodes in each zone. If a voting node becomes unreachable, the zone standby
+in that zone is promoted. The cluster then maintains 3 voting nodes with 2 remaining
+standbys. The cluster can handle an additional 2 gradual failures before it loses
+quorum.

From 1736addedfa62ddabe38280d8bf5122f88f87969 Mon Sep 17 00:00:00 2001
From: Kuba Wieczorek <kuba.wieczorek@hashicorp.com>
Date: Tue, 17 Sep 2024 12:29:04 +0100
Subject: [PATCH 31/44] Send the UI test results from the CI to DataDog
 (#28412)

---
 .github/workflows/ci.yml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a5ee95076fe6..2419ef3b2fc9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -194,6 +194,7 @@ jobs:
           secrets: |
             kv/data/github/hashicorp/vault-enterprise/github-token username-and-token | PRIVATE_REPO_GITHUB_TOKEN;
             kv/data/github/hashicorp/vault-enterprise/license license_1 | VAULT_LICENSE;
+            kv/data/github/${{ github.repository }}/datadog-ci DATADOG_API_KEY;
       - if: needs.setup.outputs.is-enterprise == 'true'
         name: Set up Git
         run: git config --global url."https://${{ steps.secrets.outputs.PRIVATE_REPO_GITHUB_TOKEN }}@github.com".insteadOf https://github.com
@@ -217,6 +218,32 @@ jobs:
         with:
           name: test-results-ui
           path: ui/test-results
+      - name: Prepare datadog-ci
+        if: (github.repository == 'hashicorp/vault' || github.repository == 'hashicorp/vault-enterprise') && (success() || failure())
+        continue-on-error: true
+        run: |
+          if type datadog-ci > /dev/null 2>&1; then
+            exit 0
+          fi
+          # Curl does not always exit 1 if things go wrong. To determine if this is successful
+          # we'll silence all non-error output and check the results to determine success.
+          if ! out="$(curl -sSL --fail https://github.com/DataDog/datadog-ci/releases/latest/download/datadog-ci_linux-x64 --output /usr/local/bin/datadog-ci 2>&1)"; then
+            printf "failed to download datadog-ci: %s" "$out"
+          fi
+          if [[ -n "$out" ]]; then
+            printf "failed to download datadog-ci: %s" "$out"
+          fi
+          chmod +x /usr/local/bin/datadog-ci
+      - name: Upload test results to DataDog
+        if: success() || failure()
+        continue-on-error: true
+        env:
+          DD_ENV: ci
+        run: |
+          if [[ ${{ github.repository }} == 'hashicorp/vault' ]]; then
+            export DATADOG_API_KEY=${{ secrets.DATADOG_API_KEY }}
+          fi
+          datadog-ci junit upload --service "$GITHUB_REPOSITORY" 'ui/test-results/qunit/results.xml'
       - if: always()
         uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 # v2.4
         with:

From 1082629d1f3f5d1e9a851535386633c901036428 Mon Sep 17 00:00:00 2001
From: Ryan Cragun <me@ryan.ec>
Date: Tue, 17 Sep 2024 12:32:15 -0600
Subject: [PATCH 32/44] VAULT-30819: Fix two potential flakes in DR replication
 (#28409)

Fix two occasional flakes in the DR replication scenario:
* Always verify that all nodes in the cluster are unsealed before
  verifying test data. Previously we only verified seal status on
  followers.
* Fix an occasional timeout when waiting for the cluster to unseal by
  rewriting the module to retry for a set duration instead of
  exponential backoff.

Signed-off-by: Ryan Cragun <me@ryan.ec>
---
 enos/enos-dev-scenario-pr-replication.hcl     |  6 +-
 enos/enos-modules.hcl                         |  4 +-
 enos/enos-scenario-agent.hcl                  |  2 +-
 enos/enos-scenario-autopilot.hcl              |  2 +-
 enos/enos-scenario-dr-replication.hcl         | 11 ++--
 enos/enos-scenario-pr-replication.hcl         |  8 +--
 enos/enos-scenario-proxy.hcl                  |  2 +-
 enos/enos-scenario-seal-ha.hcl                |  6 +-
 enos/enos-scenario-smoke.hcl                  |  2 +-
 enos/enos-scenario-upgrade.hcl                |  2 +-
 enos/modules/vault_upgrade/main.tf            |  2 +-
 .../scripts/verify-vault-node-unsealed.sh     | 42 --------------
 .../main.tf                                   | 14 +++++
 .../scripts/verify-vault-node-unsealed.sh     | 58 +++++++++++++++++++
 14 files changed, 96 insertions(+), 65 deletions(-)
 delete mode 100644 enos/modules/vault_verify_unsealed/scripts/verify-vault-node-unsealed.sh
 rename enos/modules/{vault_verify_unsealed => vault_wait_for_cluster_unsealed}/main.tf (74%)
 create mode 100644 enos/modules/vault_wait_for_cluster_unsealed/scripts/verify-vault-node-unsealed.sh

diff --git a/enos/enos-dev-scenario-pr-replication.hcl b/enos/enos-dev-scenario-pr-replication.hcl
index f184937876d1..4f3797c3c8b2 100644
--- a/enos/enos-dev-scenario-pr-replication.hcl
+++ b/enos/enos-dev-scenario-pr-replication.hcl
@@ -638,7 +638,7 @@ scenario "dev_pr_replication" {
     description = <<-EOF
       Wait for the for the primary cluster to unseal and reach a healthy state.
     EOF
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on = [
       step.create_primary_cluster
     ]
@@ -658,7 +658,7 @@ scenario "dev_pr_replication" {
     description = <<-EOF
       Wait for the for the secondary cluster to unseal and reach a healthy state.
     EOF
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on = [
       step.create_secondary_cluster
     ]
@@ -840,7 +840,7 @@ scenario "dev_pr_replication" {
     description = <<-EOF
       Verify that the secondary cluster is unsealed after we enable PR replication.
     EOF
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on = [
       step.unseal_secondary_followers
     ]
diff --git a/enos/enos-modules.hcl b/enos/enos-modules.hcl
index 3c776c0f7dc5..d9fb53c470d1 100644
--- a/enos/enos-modules.hcl
+++ b/enos/enos-modules.hcl
@@ -326,8 +326,8 @@ module "vault_verify_undo_logs" {
   vault_install_dir = var.vault_install_dir
 }
 
-module "vault_verify_unsealed" {
-  source = "./modules/vault_verify_unsealed"
+module "vault_wait_for_cluster_unsealed" {
+  source = "./modules/vault_wait_for_cluster_unsealed"
 
   vault_install_dir = var.vault_install_dir
 }
diff --git a/enos/enos-scenario-agent.hcl b/enos/enos-scenario-agent.hcl
index 73a2b0f12cad..0f362a085f08 100644
--- a/enos/enos-scenario-agent.hcl
+++ b/enos/enos-scenario-agent.hcl
@@ -406,7 +406,7 @@ scenario "agent" {
 
   step "verify_vault_unsealed" {
     description = global.description.verify_vault_unsealed
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on  = [step.wait_for_leader]
 
     providers = {
diff --git a/enos/enos-scenario-autopilot.hcl b/enos/enos-scenario-autopilot.hcl
index b03a102142ac..036814cecb6f 100644
--- a/enos/enos-scenario-autopilot.hcl
+++ b/enos/enos-scenario-autopilot.hcl
@@ -412,7 +412,7 @@ scenario "autopilot" {
 
   step "verify_vault_unsealed" {
     description = global.description.verify_vault_unsealed
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on = [
       step.create_vault_cluster,
       step.create_vault_cluster_upgrade_targets,
diff --git a/enos/enos-scenario-dr-replication.hcl b/enos/enos-scenario-dr-replication.hcl
index 210269e8e482..51f41d807575 100644
--- a/enos/enos-scenario-dr-replication.hcl
+++ b/enos/enos-scenario-dr-replication.hcl
@@ -511,7 +511,7 @@ scenario "dr_replication" {
 
   step "verify_that_vault_primary_cluster_is_unsealed" {
     description = global.description.verify_vault_unsealed
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on = [
       step.create_primary_cluster,
       step.wait_for_primary_cluster_leader,
@@ -537,7 +537,7 @@ scenario "dr_replication" {
 
   step "verify_that_vault_secondary_cluster_is_unsealed" {
     description = global.description.verify_vault_unsealed
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on = [
       step.create_secondary_cluster,
       step.wait_for_secondary_cluster_leader,
@@ -814,7 +814,7 @@ scenario "dr_replication" {
 
   step "verify_secondary_cluster_is_unsealed_after_enabling_replication" {
     description = global.description.verify_vault_unsealed
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on = [
       step.unseal_secondary_followers
     ]
@@ -992,7 +992,7 @@ scenario "dr_replication" {
 
   step "verify_new_primary_cluster_unsealed" {
     description = global.description.verify_vault_unsealed
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on = [
       step.wait_for_demoted_cluster_leader,
     ]
@@ -1009,7 +1009,8 @@ scenario "dr_replication" {
     ]
 
     variables {
-      hosts             = step.get_secondary_cluster_ips.follower_hosts
+      hosts             = step.create_secondary_cluster_targets.hosts
+      timeout           = 120 // seconds
       vault_addr        = step.create_secondary_cluster.api_addr_localhost
       vault_install_dir = global.vault_install_dir[matrix.artifact_type]
     }
diff --git a/enos/enos-scenario-pr-replication.hcl b/enos/enos-scenario-pr-replication.hcl
index 4d580c24f3b9..93001420bda5 100644
--- a/enos/enos-scenario-pr-replication.hcl
+++ b/enos/enos-scenario-pr-replication.hcl
@@ -533,7 +533,7 @@ scenario "pr_replication" {
 
   step "verify_that_vault_primary_cluster_is_unsealed" {
     description = global.description.verify_vault_unsealed
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on = [
       step.create_primary_cluster,
       step.wait_for_primary_cluster_leader,
@@ -559,7 +559,7 @@ scenario "pr_replication" {
 
   step "verify_that_vault_secondary_cluster_is_unsealed" {
     description = global.description.verify_vault_unsealed
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on = [
       step.create_secondary_cluster,
       step.wait_for_secondary_cluster_leader,
@@ -843,7 +843,7 @@ scenario "pr_replication" {
 
   step "verify_secondary_cluster_is_unsealed_after_enabling_replication" {
     description = global.description.verify_vault_unsealed
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on = [
       step.unseal_secondary_followers
     ]
@@ -1012,7 +1012,7 @@ scenario "pr_replication" {
 
   step "verify_additional_primary_nodes_are_unsealed" {
     description = global.description.verify_vault_unsealed
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on  = [step.add_additional_nodes_to_primary_cluster]
 
     providers = {
diff --git a/enos/enos-scenario-proxy.hcl b/enos/enos-scenario-proxy.hcl
index 394de37bb9bb..6865d1b62146 100644
--- a/enos/enos-scenario-proxy.hcl
+++ b/enos/enos-scenario-proxy.hcl
@@ -383,7 +383,7 @@ scenario "proxy" {
 
   step "verify_vault_unsealed" {
     description = global.description.verify_vault_unsealed
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on  = [step.create_vault_cluster]
 
     providers = {
diff --git a/enos/enos-scenario-seal-ha.hcl b/enos/enos-scenario-seal-ha.hcl
index 8cc3a7494981..5478a6a99842 100644
--- a/enos/enos-scenario-seal-ha.hcl
+++ b/enos/enos-scenario-seal-ha.hcl
@@ -389,7 +389,7 @@ scenario "seal_ha" {
 
   step "verify_vault_unsealed" {
     description = global.description.verify_vault_unsealed
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on  = [step.wait_for_leader]
 
     providers = {
@@ -646,7 +646,7 @@ scenario "seal_ha" {
 
   step "verify_vault_unsealed_with_new_seal" {
     description = global.description.verify_vault_unsealed
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on  = [step.wait_for_new_leader]
 
     providers = {
@@ -934,7 +934,7 @@ scenario "seal_ha" {
 
   // Make sure we unsealed
   step "verify_vault_unsealed_after_migration" {
-    module     = module.vault_verify_unsealed
+    module     = module.vault_wait_for_cluster_unsealed
     depends_on = [step.wait_for_leader_after_migration]
 
     providers = {
diff --git a/enos/enos-scenario-smoke.hcl b/enos/enos-scenario-smoke.hcl
index ae40fb3fe9fa..cfbfe3a07ca2 100644
--- a/enos/enos-scenario-smoke.hcl
+++ b/enos/enos-scenario-smoke.hcl
@@ -425,7 +425,7 @@ scenario "smoke" {
 
   step "verify_vault_unsealed" {
     description = global.description.verify_vault_unsealed
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on  = [step.wait_for_leader]
 
     providers = {
diff --git a/enos/enos-scenario-upgrade.hcl b/enos/enos-scenario-upgrade.hcl
index 501542d9d5e6..bc746ac12790 100644
--- a/enos/enos-scenario-upgrade.hcl
+++ b/enos/enos-scenario-upgrade.hcl
@@ -583,7 +583,7 @@ scenario "upgrade" {
 
   step "verify_vault_unsealed" {
     description = global.description.verify_vault_unsealed
-    module      = module.vault_verify_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on = [
       step.get_updated_vault_cluster_ips,
     ]
diff --git a/enos/modules/vault_upgrade/main.tf b/enos/modules/vault_upgrade/main.tf
index 6e8b0deeeea7..2d6d7d2f0426 100644
--- a/enos/modules/vault_upgrade/main.tf
+++ b/enos/modules/vault_upgrade/main.tf
@@ -169,7 +169,7 @@ resource "enos_vault_unseal" "followers" {
 }
 
 module "wait_for_followers_unsealed" {
-  source = "../vault_verify_unsealed"
+  source = "../vault_wait_for_cluster_unsealed"
   depends_on = [
     enos_remote_exec.restart_followers,
     enos_vault_unseal.followers,
diff --git a/enos/modules/vault_verify_unsealed/scripts/verify-vault-node-unsealed.sh b/enos/modules/vault_verify_unsealed/scripts/verify-vault-node-unsealed.sh
deleted file mode 100644
index 0e5576f43d80..000000000000
--- a/enos/modules/vault_verify_unsealed/scripts/verify-vault-node-unsealed.sh
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-set -e
-
-fail() {
-  echo "$1" 1>&2
-  exit 1
-}
-
-[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
-[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
-
-binpath=${VAULT_INSTALL_DIR}/vault
-test -x "$binpath" || fail "unable to locate vault binary at $binpath"
-
-count=0
-retries=5
-while :; do
-    health_status=$(curl -s "${VAULT_ADDR}/v1/sys/health" | jq '.')
-    if unseal_status=$($binpath status -format json | jq -Mre --argjson expected "false" '.sealed == $expected'); then
-      echo "$health_status"
-      exit 0
-  fi
-
-    wait=$((2 ** count))
-    count=$((count + 1))
-    if [ "$count" -lt "$retries" ]; then
-      sleep "$wait"
-  else
-      if [ -n "$HOST_IPV6" ]; then
-        fail "expected ${HOST_IPV6} to be unsealed, got unseal status: $unseal_status"
-    else
-        if [ -n "$HOST_IPV4" ]; then
-          fail "expected ${HOST_IPV4} to be unsealed, got unseal status: $unseal_status"
-      else
-          fail "expected ${VAULT_ADDR} to be unsealed, got unseal status: $unseal_status"
-      fi
-    fi
-  fi
-done
diff --git a/enos/modules/vault_verify_unsealed/main.tf b/enos/modules/vault_wait_for_cluster_unsealed/main.tf
similarity index 74%
rename from enos/modules/vault_verify_unsealed/main.tf
rename to enos/modules/vault_wait_for_cluster_unsealed/main.tf
index 86eb2b57f9ff..ce9ee25e1939 100644
--- a/enos/modules/vault_verify_unsealed/main.tf
+++ b/enos/modules/vault_wait_for_cluster_unsealed/main.tf
@@ -18,6 +18,18 @@ variable "hosts" {
   description = "The vault cluster instances that were created"
 }
 
+variable "retry_interval" {
+  type        = number
+  description = "How many seconds to wait between each retry"
+  default     = 2
+}
+
+variable "timeout" {
+  type        = number
+  description = "The max number of seconds to wait before timing out"
+  default     = 60
+}
+
 variable "vault_addr" {
   type        = string
   description = "The local vault API listen address"
@@ -36,6 +48,8 @@ resource "enos_remote_exec" "verify_node_unsealed" {
   environment = {
     HOST_IPV4         = each.value.public_ip
     HOST_IPV6         = each.value.ipv6
+    RETRY_INTERVAL    = var.retry_interval
+    TIMEOUT_SECONDS   = var.timeout
     VAULT_ADDR        = var.vault_addr
     VAULT_INSTALL_DIR = var.vault_install_dir
   }
diff --git a/enos/modules/vault_wait_for_cluster_unsealed/scripts/verify-vault-node-unsealed.sh b/enos/modules/vault_wait_for_cluster_unsealed/scripts/verify-vault-node-unsealed.sh
new file mode 100644
index 000000000000..1bce52094cfd
--- /dev/null
+++ b/enos/modules/vault_wait_for_cluster_unsealed/scripts/verify-vault-node-unsealed.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$RETRY_INTERVAL" ]] && fail "RETRY_INTERVAL env variable has not been set"
+[[ -z "$TIMEOUT_SECONDS" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+getStatus() {
+  $binpath status -format json
+}
+
+isUnsealed() {
+  local status
+  if ! status=$(getStatus); then
+    echo "failed to get vault status" 1>&2
+    return 1
+  fi
+
+  if status=$(jq -Mre --argjson expected "false" '.sealed == $expected' <<< "$status"); then
+    echo "vault is unsealed: $status"
+    return 0
+  fi
+
+  echo "vault is sealed" 1>&2
+  return 1
+}
+
+begin_time=$(date +%s)
+end_time=$((begin_time + TIMEOUT_SECONDS))
+while [ "$(date +%s)" -lt "$end_time" ]; do
+  echo "waiting for vault to be unsealed..."
+
+  if isUnsealed; then
+    exit 0
+  fi
+
+  sleep "$RETRY_INTERVAL"
+done
+
+if [ -n "$HOST_IPV6" ]; then
+  fail "timed out waiting for Vault cluster on ${HOST_IPV6} to be unsealed"
+fi
+if [ -n "$HOST_IPV4" ]; then
+  fail "timed out waiting for Vault cluster on ${HOST_IPV4} to be unsealed"
+fi
+fail "timed out waiting for Vault cluster to be unsealed"

From 450506ba9c8575cdf96c46ba114c1367b4ba8d76 Mon Sep 17 00:00:00 2001
From: Violet Hynes <violet.hynes@hashicorp.com>
Date: Tue, 17 Sep 2024 15:22:06 -0400
Subject: [PATCH 33/44] Fix link to mongodb atlas page (#28403)

* Fix link to mongodb atlas page

* Fix missing space
---
 website/content/docs/secrets/databases/mongodbatlas.mdx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/website/content/docs/secrets/databases/mongodbatlas.mdx b/website/content/docs/secrets/databases/mongodbatlas.mdx
index 25741aff20d0..62313bb859c3 100644
--- a/website/content/docs/secrets/databases/mongodbatlas.mdx
+++ b/website/content/docs/secrets/databases/mongodbatlas.mdx
@@ -19,8 +19,8 @@ more information about setting up the database secrets engine.
 
 <Note>
   The information below relates to the MongoDB Altas <b>database plugin</b> for the Vault database secrets engine.
-  Refer to the <a href="vault/docs/secrets/mongodbatlas">MongoDB Atlas secrets engine</a> 
-  for information about using the MongoDB Atlas secrets engine for the Vault.
+  Refer to the <a href="/vault/docs/secrets/mongodbatlas">MongoDB Atlas secrets engine</a> for
+  information about using the MongoDB Atlas secrets engine for the Vault.
 </Note>
 
 ## Capabilities

From e17fc068246b20c1559984cd902e7ed149fd1598 Mon Sep 17 00:00:00 2001
From: Violet Hynes <violet.hynes@hashicorp.com>
Date: Tue, 17 Sep 2024 15:22:34 -0400
Subject: [PATCH 34/44] Add note about vault kv get to Proxy docs (#28400)

---
 .../proxy/caching/static-secret-caching.mdx            | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/website/content/docs/agent-and-proxy/proxy/caching/static-secret-caching.mdx b/website/content/docs/agent-and-proxy/proxy/caching/static-secret-caching.mdx
index 1af6c0a2d304..c080c3da9f94 100644
--- a/website/content/docs/agent-and-proxy/proxy/caching/static-secret-caching.mdx
+++ b/website/content/docs/agent-and-proxy/proxy/caching/static-secret-caching.mdx
@@ -90,6 +90,16 @@ request to Vault but caches the response before forwarding it to the client. If
 that client makes subsequent `GET` requests for the same secret, Vault Proxy
 serves the cached response rather than forwarding the request to Vault.
 
+<Tip title="'Offline' Secret Access and CLI KV Get">
+
+  Vault Proxy does not cache any non-KV API responses. While KV secrets can be retrieved even if
+  Vault is unavailable, other requests cannot be served. As a result, using the `vault kv`
+  CLI command, which sends a request to `/sys/internal/ui/mounts` before the KV `GET` request,
+  will require a real request to Vault and cannot be served entirely from the cache or
+  when Vault is unavailable (you can use `vault read` instead).
+
+</Tip>
+
 Similarly, when a token requests access to a KV secret, it must complete a
 success `GET` request. If the request is successful, Proxy caches the fact that
 the token was successful in addition to the result. Subsequent requests by the

From 75bea5c05a88fb54d86e6e6ddb5a0f3b2dc643de Mon Sep 17 00:00:00 2001
From: Chris Capurso <1036769+ccapurso@users.noreply.github.com>
Date: Tue, 17 Sep 2024 15:50:03 -0400
Subject: [PATCH 35/44] add end-to-end test for audit HMACing (#28415)

* add end-to-end test for audit HMACing

* fix some comments

* add clarification for entry count assertion

* more comment clarity

* use const for hmac prefix

* add check for disabling audit device
---
 vault/external_tests/audit/audit_test.go | 214 +++++++++++++++++++++++
 1 file changed, 214 insertions(+)
 create mode 100644 vault/external_tests/audit/audit_test.go

diff --git a/vault/external_tests/audit/audit_test.go b/vault/external_tests/audit/audit_test.go
new file mode 100644
index 000000000000..dbe56fd73151
--- /dev/null
+++ b/vault/external_tests/audit/audit_test.go
@@ -0,0 +1,214 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/vault/api"
+	"github.com/hashicorp/vault/api/auth/userpass"
+	"github.com/hashicorp/vault/helper/testhelpers/minimal"
+	"github.com/stretchr/testify/require"
+)
+
+// TestAudit_HMACFields verifies that all appropriate fields in audit
+// request and response entries are HMACed properly. The fields in question are:
+//   - request.headers.x-correlation-id
+//   - request.data: all sub-fields
+//   - respnse.auth.client_token
+//   - response.auth.accessor
+//   - response.data: all sub-fields
+//   - response.wrap_info.token
+//   - response.wrap_info.accessor
+func TestAudit_HMACFields(t *testing.T) {
+	const hmacPrefix = "hmac-sha256:"
+
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+
+	tempDir := t.TempDir()
+	logFile, err := os.CreateTemp(tempDir, "")
+	require.NoError(t, err)
+	devicePath := "file"
+	deviceData := map[string]any{
+		"type":        "file",
+		"description": "",
+		"local":       false,
+		"options": map[string]any{
+			"file_path": logFile.Name(),
+		},
+	}
+
+	_, err = client.Logical().Write("sys/config/auditing/request-headers/x-correlation-id", map[string]interface{}{
+		"hmac": true,
+	})
+	require.NoError(t, err)
+
+	// Request 1
+	// Enable the audit device. A test probe request will audited along with the associated
+	// to the creation response
+	_, err = client.Logical().Write("sys/audit/"+devicePath, deviceData)
+	require.NoError(t, err)
+
+	// Request 2
+	// Ensure the device has been created.
+	devices, err := client.Sys().ListAudit()
+	require.NoError(t, err)
+	require.Len(t, devices, 1)
+
+	// Request 3
+	// Enable the userpass auth method (this will be an audited action)
+	err = client.Sys().EnableAuthWithOptions("userpass", &api.EnableAuthOptions{
+		Type: "userpass",
+	})
+	require.NoError(t, err)
+
+	username := "jdoe"
+	password := "abc123"
+
+	// Request 4
+	// Create a user with a password (another audited action)
+	_, err = client.Logical().Write(fmt.Sprintf("auth/userpass/users/%s", username), map[string]interface{}{
+		"password": password,
+	})
+	require.NoError(t, err)
+
+	authInput, err := userpass.NewUserpassAuth(username, &userpass.Password{FromString: password})
+	require.NoError(t, err)
+
+	newClient, err := client.Clone()
+	require.NoError(t, err)
+
+	correlationID := "correlation-id-foo"
+	newClient.AddHeader("x-correlation-id", correlationID)
+
+	// Request 5
+	authOutput, err := newClient.Auth().Login(context.Background(), authInput)
+	require.NoError(t, err)
+
+	// Request 6
+	hashedPassword, err := client.Sys().AuditHash(devicePath, password)
+	require.NoError(t, err)
+
+	// Request 7
+	hashedClientToken, err := client.Sys().AuditHash(devicePath, authOutput.Auth.ClientToken)
+	require.NoError(t, err)
+
+	// Request 8
+	hashedAccessor, err := client.Sys().AuditHash(devicePath, authOutput.Auth.Accessor)
+	require.NoError(t, err)
+
+	// Request 9
+	wrapResp, err := client.Logical().Write("sys/wrapping/wrap", map[string]interface{}{
+		"foo": "bar",
+	})
+	require.NoError(t, err)
+
+	// Request 10
+	hashedBar, err := client.Sys().AuditHash(devicePath, "bar")
+	require.NoError(t, err)
+
+	// Request 11
+	hashedWrapAccessor, err := client.Sys().AuditHash(devicePath, wrapResp.WrapInfo.Accessor)
+	require.NoError(t, err)
+
+	// Request 12
+	hashedWrapToken, err := client.Sys().AuditHash(devicePath, wrapResp.WrapInfo.Token)
+	require.NoError(t, err)
+
+	// Request 13
+	hashedCorrelationID, err := client.Sys().AuditHash(devicePath, correlationID)
+	require.NoError(t, err)
+
+	// Request 14
+	// Disable the audit device. The request will be audited but not the response.
+	_, err = client.Logical().Delete("sys/audit/" + devicePath)
+	require.NoError(t, err)
+
+	// Request 15
+	// Ensure the device has been deleted. This will not be audited.
+	devices, err = client.Sys().ListAudit()
+	require.NoError(t, err)
+	require.Len(t, devices, 0)
+
+	entries := make([]map[string]interface{}, 0)
+	scanner := bufio.NewScanner(logFile)
+
+	for scanner.Scan() {
+		entry := make(map[string]interface{})
+
+		err := json.Unmarshal(scanner.Bytes(), &entry)
+		require.NoError(t, err)
+
+		entries = append(entries, entry)
+	}
+
+	// This count includes the initial test probe upon creation of the audit device
+	require.Equal(t, 27, len(entries))
+
+	loginReqEntry := entries[8]
+	loginRespEntry := entries[9]
+
+	loginRequestFromReq := loginReqEntry["request"].(map[string]interface{})
+	loginRequestDataFromReq := loginRequestFromReq["data"].(map[string]interface{})
+	loginHeadersFromReq := loginRequestFromReq["headers"].(map[string]interface{})
+
+	loginRequestFromResp := loginRespEntry["request"].(map[string]interface{})
+	loginRequestDataFromResp := loginRequestFromResp["data"].(map[string]interface{})
+	loginHeadersFromResp := loginRequestFromResp["headers"].(map[string]interface{})
+
+	loginAuth := loginRespEntry["auth"].(map[string]interface{})
+
+	require.True(t, strings.HasPrefix(loginRequestDataFromReq["password"].(string), hmacPrefix))
+	require.Equal(t, loginRequestDataFromReq["password"].(string), hashedPassword)
+
+	require.True(t, strings.HasPrefix(loginRequestDataFromResp["password"].(string), hmacPrefix))
+	require.Equal(t, loginRequestDataFromResp["password"].(string), hashedPassword)
+
+	require.True(t, strings.HasPrefix(loginAuth["client_token"].(string), hmacPrefix))
+	require.Equal(t, loginAuth["client_token"].(string), hashedClientToken)
+
+	require.True(t, strings.HasPrefix(loginAuth["accessor"].(string), hmacPrefix))
+	require.Equal(t, loginAuth["accessor"].(string), hashedAccessor)
+
+	xCorrelationIDFromReq := loginHeadersFromReq["x-correlation-id"].([]interface{})
+	require.Equal(t, len(xCorrelationIDFromReq), 1)
+	require.True(t, strings.HasPrefix(xCorrelationIDFromReq[0].(string), hmacPrefix))
+	require.Equal(t, xCorrelationIDFromReq[0].(string), hashedCorrelationID)
+
+	xCorrelationIDFromResp := loginHeadersFromResp["x-correlation-id"].([]interface{})
+	require.Equal(t, len(xCorrelationIDFromResp), 1)
+	require.True(t, strings.HasPrefix(xCorrelationIDFromReq[0].(string), hmacPrefix))
+	require.Equal(t, xCorrelationIDFromResp[0].(string), hashedCorrelationID)
+
+	wrapReqEntry := entries[16]
+	wrapRespEntry := entries[17]
+
+	wrapRequestFromReq := wrapReqEntry["request"].(map[string]interface{})
+	wrapRequestDataFromReq := wrapRequestFromReq["data"].(map[string]interface{})
+
+	wrapRequestFromResp := wrapRespEntry["request"].(map[string]interface{})
+	wrapRequestDataFromResp := wrapRequestFromResp["data"].(map[string]interface{})
+
+	require.True(t, strings.HasPrefix(wrapRequestDataFromReq["foo"].(string), hmacPrefix))
+	require.Equal(t, wrapRequestDataFromReq["foo"].(string), hashedBar)
+
+	require.True(t, strings.HasPrefix(wrapRequestDataFromResp["foo"].(string), hmacPrefix))
+	require.Equal(t, wrapRequestDataFromResp["foo"].(string), hashedBar)
+
+	wrapResponseData := wrapRespEntry["response"].(map[string]interface{})
+	wrapInfo := wrapResponseData["wrap_info"].(map[string]interface{})
+
+	require.True(t, strings.HasPrefix(wrapInfo["accessor"].(string), hmacPrefix))
+	require.Equal(t, wrapInfo["accessor"].(string), hashedWrapAccessor)
+
+	require.True(t, strings.HasPrefix(wrapInfo["token"].(string), hmacPrefix))
+	require.Equal(t, wrapInfo["token"].(string), hashedWrapToken)
+}

From a9e67042675456e23adf9694dada02bc21c4b750 Mon Sep 17 00:00:00 2001
From: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Date: Tue, 17 Sep 2024 14:59:01 -0500
Subject: [PATCH 36/44] UI: Handle some deprecations (#28276)

* don't update the passed object directly
fixes deprecation https://deprecations.emberjs.com/id/setting-on-hash

* replace hasRecordForId with peekRecord -- ember-data:deprecate-has-record-for-id

* fix deprecation ember-data:deprecate-has-record-for-id

* update deprecation workflow
---
 ui/app/adapters/named-path.js             |  2 +-
 ui/app/app.js                             |  1 +
 ui/app/controllers/vault/cluster/init.js  |  3 ++-
 ui/app/initializers/deprecation-filter.js |  3 ++-
 ui/app/models/auth-config.js              |  7 ++++++-
 ui/config/deprecation-workflow.js         | 21 ++++++++++-----------
 6 files changed, 22 insertions(+), 15 deletions(-)

diff --git a/ui/app/adapters/named-path.js b/ui/app/adapters/named-path.js
index 535cf33e3d9a..6b8fb7297483 100644
--- a/ui/app/adapters/named-path.js
+++ b/ui/app/adapters/named-path.js
@@ -30,7 +30,7 @@ export default class NamedPathAdapter extends ApplicationAdapter {
     const [store, { modelName }, snapshot] = arguments;
     const name = snapshot.attr('name');
     // throw error if user attempts to create a record with same name, otherwise POST request silently overrides (updates) the existing model
-    if (store.hasRecordForId(modelName, name)) {
+    if (store.peekRecord({ type: modelName, id: name }) !== null) {
       throw new Error(`A record already exists with the name: ${name}`);
     } else {
       return this._saveRecord(...arguments);
diff --git a/ui/app/app.js b/ui/app/app.js
index 9409b0cd916f..5de9c28a3a33 100644
--- a/ui/app/app.js
+++ b/ui/app/app.js
@@ -8,6 +8,7 @@ import Resolver from 'ember-resolver';
 import loadInitializers from 'ember-load-initializers';
 import config from 'vault/config/environment';
 
+// TODO: DEPRECATION https://ember-engines.com/docs/deprecations#-use-alias-for-inject-router-service-from-host-application
 export default class App extends Application {
   modulePrefix = config.modulePrefix;
   podModulePrefix = config.podModulePrefix;
diff --git a/ui/app/controllers/vault/cluster/init.js b/ui/app/controllers/vault/cluster/init.js
index 9083f2dddef8..ddcd72e5e3de 100644
--- a/ui/app/controllers/vault/cluster/init.js
+++ b/ui/app/controllers/vault/cluster/init.js
@@ -40,7 +40,8 @@ export default Controller.extend(DEFAULTS, {
   }),
 
   actions: {
-    initCluster(data) {
+    initCluster(payload) {
+      const data = { ...payload };
       const isCloudSeal = !!this.model.sealType && this.model.sealType !== 'shamir';
       if (data.secret_shares) {
         const shares = parseInt(data.secret_shares, 10);
diff --git a/ui/app/initializers/deprecation-filter.js b/ui/app/initializers/deprecation-filter.js
index 3063b376152f..5e163149da38 100644
--- a/ui/app/initializers/deprecation-filter.js
+++ b/ui/app/initializers/deprecation-filter.js
@@ -10,7 +10,8 @@ export function initialize() {
   registerDeprecationHandler((message, options, next) => {
     // filter deprecations that are scheduled to be removed in a specific version
     // when upgrading or addressing deprecation warnings be sure to update this or remove if not needed
-    if (options?.until.includes('5.0') && options?.id.startsWith('ember-data')) {
+    if (options?.until.includes('6.0')) {
+      // ignore all deprecations for 6+
       return;
     }
     next(message, options);
diff --git a/ui/app/models/auth-config.js b/ui/app/models/auth-config.js
index 46ab4f9700cc..46f7318569ec 100644
--- a/ui/app/models/auth-config.js
+++ b/ui/app/models/auth-config.js
@@ -6,5 +6,10 @@
 import Model, { belongsTo } from '@ember-data/model';
 
 export default Model.extend({
-  backend: belongsTo('auth-method', { inverse: 'authConfigs', readOnly: true, async: false }),
+  backend: belongsTo('auth-method', {
+    inverse: 'authConfigs',
+    readOnly: true,
+    async: false,
+    as: 'auth-config',
+  }),
 });
diff --git a/ui/config/deprecation-workflow.js b/ui/config/deprecation-workflow.js
index cf343738e691..7ddd86cbb1d0 100644
--- a/ui/config/deprecation-workflow.js
+++ b/ui/config/deprecation-workflow.js
@@ -5,20 +5,19 @@
 
 /* global self */
 self.deprecationWorkflow = self.deprecationWorkflow || {};
-//self.deprecationWorkflow.config = {
-//throwOnUnhandled: true
-//}
+self.deprecationWorkflow.config = {
+  throwOnUnhandled: false,
+};
+
 self.deprecationWorkflow.config = {
   // current output from deprecationWorkflow.flushDeprecations();
-  // deprecations that will not be removed until 5.0.0 are filtered by deprecation-filter initializer rather than silencing below
   workflow: [
-    { handler: 'silence', matchId: 'ember-data:model-save-promise' },
-    { handler: 'silence', matchId: 'ember-engines.deprecation-camelized-engine-names' },
     { handler: 'silence', matchId: 'ember-engines.deprecation-router-service-from-host' },
-    { handler: 'silence', matchId: 'ember-modifier.use-modify' },
-    { handler: 'silence', matchId: 'ember-modifier.no-element-property' },
-    { handler: 'silence', matchId: 'ember-modifier.no-args-property' },
-    { handler: 'silence', matchId: 'ember-cli-mirage-config-routes-only-export' },
-    { handler: 'silence', matchId: 'setting-on-hash' },
+    // ember-data
+    { handler: 'silence', matchId: 'ember-data:deprecate-early-static' },
+    { handler: 'silence', matchId: 'ember-data:deprecate-model-reopen' },
+    { handler: 'silence', matchId: 'ember-data:deprecate-promise-proxies' },
+    { handler: 'silence', matchId: 'ember-data:no-a-with-array-like' },
+    { handler: 'silence', matchId: 'ember-data:deprecate-promise-many-array-behaviors' },
   ],
 };

From fdc871370d632cb7b144339ed20e907b88f4533b Mon Sep 17 00:00:00 2001
From: Violet Hynes <violet.hynes@hashicorp.com>
Date: Tue, 17 Sep 2024 16:12:23 -0400
Subject: [PATCH 37/44] Update Okta SDK to latest minor version (#28407)

---
 go.mod |  3 +--
 go.sum | 10 ++++------
 2 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/go.mod b/go.mod
index 6684145582de..7fdf614a7e33 100644
--- a/go.mod
+++ b/go.mod
@@ -178,7 +178,7 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2
 	github.com/ncw/swift v1.0.47
 	github.com/oklog/run v1.1.0
-	github.com/okta/okta-sdk-golang/v2 v2.12.1
+	github.com/okta/okta-sdk-golang/v2 v2.20.0
 	github.com/oracle/oci-go-sdk v24.3.0+incompatible
 	github.com/ory/dockertest v3.3.5+incompatible
 	github.com/ory/dockertest/v3 v3.10.0
@@ -530,7 +530,6 @@ require (
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/jcmturner/goidentity.v3 v3.0.0 // indirect
 	gopkg.in/resty.v1 v1.12.0 // indirect
-	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/go.sum b/go.sum
index 940efc53ccd1..61d64936cf07 100644
--- a/go.sum
+++ b/go.sum
@@ -1675,8 +1675,8 @@ github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0f
 github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.3.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jarcoal/httpmock v0.0.0-20180424175123-9c70cfe4a1da/go.mod h1:ks+b9deReOc7jgqp+e7LuFiCBH6Rm5hL32cLcEAArb4=
-github.com/jarcoal/httpmock v1.0.7 h1:d1a2VFpSdm5gtjhCPWsQHSnx8+5V3ms5431YwvmkuNk=
-github.com/jarcoal/httpmock v1.0.7/go.mod h1:ATjnClrvW/3tijVmpL/va5Z3aAyGvqU3gCT8nX0Txik=
+github.com/jarcoal/httpmock v1.2.0 h1:gSvTxxFR/MEMfsGrvRbdfpRUMBStovlSRLw0Ep1bwwc=
+github.com/jarcoal/httpmock v1.2.0/go.mod h1:oCoTsnAz4+UoOUIf5lJOWV2QQIW5UoeUI6aM2YnWAZk=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
@@ -1910,8 +1910,8 @@ github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
 github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
-github.com/okta/okta-sdk-golang/v2 v2.12.1 h1:U+smE7trkHSZO8Mval3Ow85dbxawO+pMAr692VZq9gM=
-github.com/okta/okta-sdk-golang/v2 v2.12.1/go.mod h1:KRoAArk1H216oiRnQT77UN6JAhBOnOWkK27yA1SM7FQ=
+github.com/okta/okta-sdk-golang/v2 v2.20.0 h1:EDKM+uOPfihOMNwgHMdno+NAsIfyXkVnoFAYVPay0YU=
+github.com/okta/okta-sdk-golang/v2 v2.20.0/go.mod h1:FMy5hN5G8Rd/VoS0XrfyPPhIfOVo78ZK7lvwiQRS2+U=
 github.com/olekukonko/tablewriter v0.0.0-20180130162743-b8a9be070da4/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
 github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
@@ -3064,8 +3064,6 @@ gopkg.in/ory-am/dockertest.v3 v3.3.4 h1:oen8RiwxVNxtQ1pRoV4e4jqh6UjNsOuIZ1NXns6j
 gopkg.in/ory-am/dockertest.v3 v3.3.4/go.mod h1:s9mmoLkaGeAh97qygnNj4xWkiN7e1SKekYC6CovU+ek=
 gopkg.in/resty.v1 v1.12.0 h1:CuXP0Pjfw9rOuY6EP+UvtNvt5DSqHpIxILZKT/quCZI=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
-gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=
-gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=

From b977fac936acc7d3365313ff23254d666a5a7e25 Mon Sep 17 00:00:00 2001
From: Ryan Cragun <me@ryan.ec>
Date: Wed, 18 Sep 2024 10:29:03 -0600
Subject: [PATCH 38/44] VAULT-30819: DR replicatio: wait for seal rewrap before
 enabling DR (#28425)

Ensure that both clusters have completed their seal rewrap before
enabling DR on the secondary. We don't want the secondary to come back
up in an in-between state.

Signed-off-by: Ryan Cragun <me@ryan.ec>
---
 enos/enos-scenario-dr-replication.hcl | 110 ++++++++++++++++++--------
 1 file changed, 75 insertions(+), 35 deletions(-)

diff --git a/enos/enos-scenario-dr-replication.hcl b/enos/enos-scenario-dr-replication.hcl
index 51f41d807575..e39e6b0c04fe 100644
--- a/enos/enos-scenario-dr-replication.hcl
+++ b/enos/enos-scenario-dr-replication.hcl
@@ -695,12 +695,15 @@ scenario "dr_replication" {
   # ================================================
   #     DISASTER RECOVERY (DR) REPLICATION SETUP
   # ================================================
-  # 1. Configure DR primary replication on cluster A.
-  # 2. Generate secondary token on cluster A.
-  # 3. Configure DR secondary replication on cluster B.
-  # 4. Confirm replication status on both clusters.
+  # - Wait for seal rewrap to complete on both clusters.
+  # - Configure DR primary replication on cluster A.
+  # - Generate secondary token on cluster A.
+  # - Configure DR secondary replication on cluster B.
+  # - Confirm replication status on both clusters.
 
 
+  // Wait for our seals to finish any inflight rewraps before we enable DR replication as we don't
+  // want to accidentally swap seal info on the secondary before it has finished.
   step "configure_dr_replication_primary" {
     description = <<-EOF
       Create the necessary superuser auth policy necessary for DR replication, assign it
@@ -711,7 +714,7 @@ scenario "dr_replication" {
     depends_on = [
       step.get_primary_cluster_ips,
       step.get_secondary_cluster_ips,
-      step.verify_secrets_engines_on_primary
+      step.verify_secrets_engines_on_primary,
     ]
 
     providers = {
@@ -759,13 +762,53 @@ scenario "dr_replication" {
     }
   }
 
+  step "wait_for_primary_seal_rewrap" {
+    module = module.vault_wait_for_seal_rewrap
+    depends_on = [
+      step.generate_secondary_token,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      hosts             = step.create_primary_cluster.hosts
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "wait_for_secondary_seal_rewrap" {
+    module = module.vault_wait_for_seal_rewrap
+    depends_on = [
+      step.wait_for_primary_seal_rewrap,
+
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      hosts             = step.create_secondary_cluster.hosts
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_secondary_cluster.root_token
+    }
+  }
+
   step "configure_dr_replication_secondary" {
     description = <<-EOF
       Enable dr replication on the secondary cluster with the wrapping token created by
       the primary cluster.
     EOF
     module      = module.vault_setup_replication_secondary
-    depends_on  = [step.generate_secondary_token]
+    depends_on = [
+      step.wait_for_secondary_seal_rewrap,
+      step.generate_secondary_token,
+    ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
@@ -786,16 +829,13 @@ scenario "dr_replication" {
 
   step "unseal_secondary_followers" {
     description = <<-EOF
-        After replication is enabled the secondary cluster followers need to be unsealed.
-        Secondary unseal keys are passed differently depending primary and secondary seal
-        type combinations. See the guide for more information:
-          https://developer.hashicorp.com/vault/docs/enterprise/replication#seals
-      EOF
+      After replication is enabled the secondary cluster followers need to be unsealed.
+      Secondary unseal keys are passed differently depending primary and secondary seal
+      type combinations. See the guide for more information:
+        https://developer.hashicorp.com/vault/docs/enterprise/replication#seals
+    EOF
     module      = module.vault_unseal_nodes
     depends_on = [
-      step.create_primary_cluster,
-      step.create_secondary_cluster,
-      step.get_secondary_cluster_ips,
       step.configure_dr_replication_secondary
     ]
 
@@ -899,10 +939,10 @@ scenario "dr_replication" {
 
   step "vault_failover_promote_dr_secondary_cluster" {
     description = <<-EOF
-        Promote the secondary cluster to be the primary cluster. This step will also
-        generate a new DR operation token for the secondary cluster to connect to the new
-        primary cluster.
-      EOF
+      Promote the secondary cluster to be the primary cluster. This step will also
+      generate a new DR operation token for the secondary cluster to connect to the new
+      primary cluster.
+    EOF
     module      = module.vault_failover_promote_dr_secondary
     depends_on  = [step.generate_batch_dr_operation_token]
 
@@ -946,10 +986,10 @@ scenario "dr_replication" {
 
   step "vault_failover_demote_dr_primary_cluster" {
     description = <<-EOF
-        Demote the primary cluster to be the secondary cluster. This step will also
-        generate a new DR operation token for the secondary cluster to connect to the new
-        primary cluster.
-      EOF
+      Demote the primary cluster to be the secondary cluster. This step will also
+      generate a new DR operation token for the secondary cluster to connect to the new
+      primary cluster.
+    EOF
     module      = module.vault_failover_demote_dr_primary
     depends_on  = [step.wait_for_promoted_cluster_leader]
 
@@ -1047,10 +1087,10 @@ scenario "dr_replication" {
 
   step "generate_demoted_secondary_public_key" {
     description = <<-EOF
-          Generate a random token and configure the DR replication primary secondary-token and
-          configure the Vault cluster primary replication with the token. Export the wrapping token
-          so that secondary clusters can utilize it.
-        EOF
+      Generate a random token and configure the DR replication primary secondary-token and
+      configure the Vault cluster primary replication with the token. Export the wrapping token
+      so that secondary clusters can utilize it.
+    EOF
     module      = module.generate_secondary_public_key
     depends_on = [
       step.verify_replicated_data_during_failover,
@@ -1073,10 +1113,10 @@ scenario "dr_replication" {
 
   step "generate_demoted_secondary_token" {
     description = <<-EOF
-        Generate a random token and configure the DR replication primary secondary-token and
-        configure the Vault cluster primary replication with the token. Export the wrapping token
-        so that secondary clusters can utilize it.
-      EOF
+      Generate a random token and configure the DR replication primary secondary-token and
+      configure the Vault cluster primary replication with the token. Export the wrapping token
+      so that secondary clusters can utilize it.
+    EOF
     module      = module.generate_failover_secondary_token
     depends_on  = [step.generate_demoted_secondary_public_key]
 
@@ -1098,8 +1138,8 @@ scenario "dr_replication" {
 
   step "vault_failover_update_dr_primary_cluster" {
     description = <<-EOF
-          Update the secondary cluster to connect to the new primary cluster.
-        EOF
+      Update the secondary cluster to connect to the new primary cluster.
+    EOF
     module      = module.vault_failover_update_dr_primary
     depends_on = [
       step.generate_demoted_secondary_token,
@@ -1123,9 +1163,9 @@ scenario "dr_replication" {
 
   step "verify_failover_dr_replication" {
     description = <<-EOF
-        Verify that the DR replication status meets our expectations after enabling replication
-        and ensuring that all secondary nodes are unsealed.
-      EOF
+      Verify that the DR replication status meets our expectations after enabling replication
+      and ensuring that all secondary nodes are unsealed.
+    EOF
     module      = module.vault_verify_dr_replication
     depends_on  = [step.vault_failover_update_dr_primary_cluster]
 

From 3df04b8aaed3a148fe1c8aba8d44f9c513a5db77 Mon Sep 17 00:00:00 2001
From: Violet Hynes <violet.hynes@hashicorp.com>
Date: Wed, 18 Sep 2024 13:37:48 -0400
Subject: [PATCH 39/44] Update LTS language to not contradict (#28424)

---
 website/content/docs/enterprise/lts.mdx | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/website/content/docs/enterprise/lts.mdx b/website/content/docs/enterprise/lts.mdx
index 33d4bae8b0d6..1940abb883df 100644
--- a/website/content/docs/enterprise/lts.mdx
+++ b/website/content/docs/enterprise/lts.mdx
@@ -91,7 +91,7 @@ upgrade frequently, quickly, or easily.
 Vault upgrades are challenging, especially for sensitive or critical workflows,
 extensive integrations, and large-scale deployments. Strict upgrade policies
 also require significant planning, testing, and employee hours to execute
-successfully. 
+successfully.
 
 Customers who need assurances that their current installation will receive
 critical bug fixes and security patches with minimal service disruptions should
@@ -111,8 +111,8 @@ the current version ("N") and the two previous versions ("N&minus;2").
 Vault versions typically update 3 times per calendar year (CY), which means that
 **standard maintenance** for a given Vault version lasts approximately 1 year.
 After the first year, LTS Vault versions move from standard maintenance to
-**extended maintenance** for an additional year with patches for bugs that
-may cause outages and critical vulnerabilities and exposures (CVEs).
+**extended maintenance** for three additional major version releases (approximately one additional year)
+with patches for bugs that may cause outages and critical vulnerabilities and exposures (CVEs).
 
 Maintenance updates               | Standard maintenance | Extended maintenance
 --------------------------------- | -------------------- | --------------------
@@ -152,10 +152,10 @@ The goal is to establish a predictable upgrade path with a longer timeline
 rather than extending the lifetime for every Vault version.
 
 Long-term support ensures your Vault Enterprise version continues to receive
-critical patches for an additional year. If you upgrade to a non-LTS version,
-you are moving your Vault instance to a version that lacks extended support.
-Non-LTS versions stop receiving updates once they leave the standard maintenance
-window.
+critical patches for an additional three major version releases (approximately one additional year).
+If you upgrade to a non-LTS version,you are moving your Vault instance to a version
+that lacks extended support. Non-LTS versions stop receiving updates once they leave
+the standard maintenance window.
 
 @include 'assets/lts-upgrade-path.mdx'
 
@@ -164,7 +164,7 @@ Version | Expected release | Standard maintenance ends  | Extended maintenance e
 1.19    | CY25 Q1          | CY26 Q1 (1.22 release)     | CY27 Q1 (1.25 release)
 1.18    | CY24 Q3          | CY25 Q3 (1.21 release)     | Not provided
 1.17    | CY24 Q2          | CY25 Q2 (1.20 release)     | Not provided
-1.16    | CY24 Q1          | CY25 Q1 (1.19 release)     | CY26 Q1 (1.22 release) 
+1.16    | CY24 Q1          | CY25 Q1 (1.19 release)     | CY26 Q1 (1.22 release)
 
 If a newer version of Vault Enterprise includes features you want to take
 advantage of, you have two options:
@@ -180,4 +180,4 @@ advantage of, you have two options:
 You should follow your existing upgrade process for major version upgrades but
 allow additional time. Upgrading from version LTS to LTS+1 translates to jumping
 3 major Vault Enterprise versions, which **may** require transitional upgrades
-to move through the intermediate Vault versions.
\ No newline at end of file
+to move through the intermediate Vault versions.

From 66fa7606ac34e3a25fb56c4414ccb1babb811e6a Mon Sep 17 00:00:00 2001
From: Jonathan Frappier <92055993+jonathanfrappier@users.noreply.github.com>
Date: Wed, 18 Sep 2024 14:12:06 -0400
Subject: [PATCH 40/44] Add set up vault service doc (#28272)

* Add set up vault service doc
* Suggestions/edits (#28394)
---------

Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
---
 website/content/docs/install.mdx              |  92 -----
 .../content/docs/install/build-from-code.mdx  |  95 +++++
 website/content/docs/install/index.mdx        |  35 ++
 .../content/docs/install/install-binary.mdx   | 340 ++++++++++++++++++
 website/content/docs/run-as-service.mdx       | 235 ++++++++++++
 website/data/docs-nav-data.json               |  21 +-
 .../img/install/windows-system-path.png       | Bin 0 -> 75105 bytes
 7 files changed, 724 insertions(+), 94 deletions(-)
 delete mode 100644 website/content/docs/install.mdx
 create mode 100644 website/content/docs/install/build-from-code.mdx
 create mode 100644 website/content/docs/install/index.mdx
 create mode 100644 website/content/docs/install/install-binary.mdx
 create mode 100644 website/content/docs/run-as-service.mdx
 create mode 100644 website/public/img/install/windows-system-path.png

diff --git a/website/content/docs/install.mdx b/website/content/docs/install.mdx
deleted file mode 100644
index fea6ea4bc71f..000000000000
--- a/website/content/docs/install.mdx
+++ /dev/null
@@ -1,92 +0,0 @@
----
-layout: docs
-page_title: Install Vault
-description: |-
-  Download a precompiled binary, compile from source, or use a package.
----
-
-# Installing Vault
-
-There are several options to install Vault:
-
-1. Install from a [Package Manager](#package-manager).
-
-1. Use a [precompiled binary](#precompiled-binaries).
-
-1. Install [from source](#compiling-from-source).
-
-1. [Helm for Kubernetes](/vault/docs/platform/k8s/helm)
-
-@include 'versions.mdx'
-
-## Package manager
-
-HashiCorp manages packages for Ubuntu, Debian, Fedora, RHEL, Amazon
-Linux, and other distributions. Follow the instructions at [HashiCorp
-Tutorials][learn-vault-install] to add our PGP key, add a repository, and
-install.
-
-## Precompiled binaries
-
-To install the precompiled binary, [download](/vault/downloads) the applicable
-package for your system. Vault is packaged as a zip file.
-
-Once the zip is downloaded, unzip the file into your designated directory. The `vault` binary
-inside is all that is necessary to run Vault (or `vault.exe` for Windows). No
-additional files are required to run Vault.
-
-Copy the binary to your system. If you intend to access it from the
-command-line, ensure that you place the binary somewhere on your `PATH`.
-
-Refer to the [HashiCorp Tutorials][learn-vault-dev-server] to start a server, `put`
-your first secret, and use other features of Vault.
-
-## Compiling from source
-
-To compile from source, you will need [Go](https://golang.org) installed and
-properly configured (including a `GOPATH` environment variable set), as well as
-a copy of [`git`](https://www.git-scm.com/) in your `PATH`.
-
-Clone the Vault repository from GitHub into your `GOPATH`:
-
-```shell-session
-$ mkdir -p $GOPATH/src/github.com/hashicorp && cd $_
-$ git clone https://github.com/hashicorp/vault.git
-$ cd vault
-```
-
-Bootstrap the project. This will download and compile libraries and tools needed
-to compile Vault:
-
-```shell-session
-$ make bootstrap
-```
-
-Build Vault for your current system and put the binary in `./bin/` (relative to
-the git checkout). The `make dev` target is just a shortcut that builds `vault`
-for only your local build environment (no cross-compiled targets).
-
-```shell-session
-$ make dev
-```
-
-## Verifying the installation
-
-To verify Vault is installed, run `vault -h` on your system. You should
-see the help output. If you are executing it from the command line, ensure it is
-on your `PATH` to avoid receiving an error that Vault is not found.
-
-```shell-session
-$ vault -h
-```
-
-## Tutorial
-
-Following tutorials provide some guidance on production cluster deployment: 
-
-- [Day One Preparation](/vault/tutorials/day-one-raft) 
-- [Recommended Patterns](/vault/tutorials/recommended-patterns)
-
-
-[learn-vault-install]: /vault/tutorials/getting-started/getting-started-install
-[learn-vault-dev-server]: /vault/tutorials/getting-started/getting-started-dev-server
diff --git a/website/content/docs/install/build-from-code.mdx b/website/content/docs/install/build-from-code.mdx
new file mode 100644
index 000000000000..4843539ecd3d
--- /dev/null
+++ b/website/content/docs/install/build-from-code.mdx
@@ -0,0 +1,95 @@
+---
+layout: docs
+page_title: Build Vault from code
+description: >-
+  Build Vault locally from source code.
+---
+
+# Build Vault from code
+
+Clone the official Vault repo and build a Vault binary from source code for your
+system.
+
+<Tip title="Assumptions">
+
+- You have [Go](https://golang.org) installed and the `GOPATH` environment
+  variable configured.
+- You have [`git`](https://www.git-scm.com/) installed.
+
+</Tip>
+
+<Tabs>
+
+<Tab heading="Linux shell" group="nix">
+
+1. Create a `hashicorp` source directory under your `GOPATH` and change to the
+   new directory:
+
+  ```shell-session
+  $ mkdir -p ${GOPATH}/src/hashicorp && cd $_
+  ```
+
+1. Clone the Vault repository from GitHub:
+  ```shell-session
+  $ git clone https://github.com/hashicorp/vault.git
+  ```
+
+1. Change to the cloned Vault directory:
+  ```shell-session
+  $ cd vault
+  ```
+
+1. Bootstrap the Go project to download and compile the libraries and tools
+   needed to compile Vault:
+  ```shell-session
+  $ make bootstrap
+  ```
+
+1. Use `make` to build Vault for your current system:
+  ```shell-session
+  $ make dev
+  ```
+
+  You can copy the compiled binary from `${GOPATH}/src/hashicorp/vault/bin/`.
+
+</Tab>
+
+<Tab heading="Powershell" group="ps">
+
+1. Create a `hashicorp` source directory under your `GOPATH` and change to the
+   new directory:
+  
+  ```powershell
+  New-Item -ItemType Directory -Force -Path "${env:GOPATH}/src/hashicorp" | Set-Location
+  ```
+
+1. Clone the Vault repository from GitHub:
+  
+  ```powershell
+  git clone https://github.com/hashicorp/vault.git
+  ```
+
+1. Change to the cloned Vault directory:
+  
+  ```powershell
+  Set-Location vault
+  ```
+
+1. Use the included `make` tool to bootstrap the Go project to download and
+   compile the libraries and tools needed to compile Vault:
+  
+  ```powershell
+  .\make bootstrap
+  ```
+
+1. Use the included `make` tool to build Vault for your current system:
+
+  ```powershell
+  .\make dev
+  ```
+
+  You can copy the compiled binary from `${env:GOPATH}/src/hashicorp/vault/bin/`.
+
+</Tab>
+
+</Tabs>
\ No newline at end of file
diff --git a/website/content/docs/install/index.mdx b/website/content/docs/install/index.mdx
new file mode 100644
index 000000000000..c6a538548170
--- /dev/null
+++ b/website/content/docs/install/index.mdx
@@ -0,0 +1,35 @@
+---
+layout: docs
+page_title: Install Vault
+description: |-
+  Download a precompiled binary, compile from source, or use a package manager.
+---
+
+# Install Vault
+
+## Install options
+
+<Tip title="Use Helm for Kubernetes">
+
+  If you plan to run Vault on Kubernetes, we recommend
+  [installing with Helm](/vault/docs/platform/k8s/helm).
+
+</Tip>
+
+1. [Install official Vault packages](/vault/install) with supported package
+   managers for macOS, Ubuntu/Debian, CentIS/RHEL, Amazon Linux, and Homebrew.
+1. [Download a precompiled binary](/vault/install) or
+   [build Vault from code](/vault/docs/install/build-from-code) and
+   [install the binary manually](/vault/docs/install/install-binary).
+
+@include 'versions.mdx'
+
+## Related tutorials
+
+The following tutorials provide additional guidance for installing Vault and
+production cluster deployment:
+
+- [Get started: Install Vault](/vault/tutorials/getting-started/getting-started-install)
+- [Day One Preparation](/vault/tutorials/day-one-raft)
+- [Recommended Patterns](/vault/tutorials/recommended-patterns)
+- [Start the server in dev mode]: /vault/tutorials/getting-started/getting-started-dev-server
\ No newline at end of file
diff --git a/website/content/docs/install/install-binary.mdx b/website/content/docs/install/install-binary.mdx
new file mode 100644
index 000000000000..e3ab10820782
--- /dev/null
+++ b/website/content/docs/install/install-binary.mdx
@@ -0,0 +1,340 @@
+---
+layout: docs
+page_title: Install Vault manually
+description: >-
+  Manually install a Vault binary.
+---
+
+# Manually install a Vault binary
+
+Install Vault using a compiled binary.
+
+## Before you start
+
+- **You must have a valid Vault binary**. You can
+  [download and unzip a precompiled binary](/vault/install) or
+  [build a local instance of Vault from source code](/vault/docs/install/build-from-code).
+
+## Step 1: Configure the environment
+
+<Tabs>
+
+<Tab heading="Linux shell" group="nix">
+
+1. Set the `VAULT_DATA` environment variable to your preferred Vault data
+  directory. For example, `/opt/vault/data`:
+
+   ```shell-session
+   export VAULT_DATA=/opt/vault/data
+   ```
+
+1. Set the `VAULT_CONFIG` environment variable  to your preferred Vault
+   configuration directory. For example, `/etc/vault.d`:
+
+   ```shell-session
+   export VAULT_CONFIG=/etc/vault.d
+   ```
+
+1. Move the Vault binary to `/usr/bin`:
+
+  ```shell-session
+  $ sudo mv PATH/TO/VAULT/BINARY /usr/bin/
+  ```
+
+1. Ensure the Vault binary can use `mlock()` to run as a non-root user:
+
+   ```shell-session
+   $ sudo setcap cap_ipc_lock=+ep $(readlink -f $(which vault))
+   ```
+
+  See the support article
+  [Vault and mlock()](https://support.hashicorp.com/hc/en-us/articles/115012787688-Vault-and-mlock)
+  for more information.
+
+1. Create your Vault data directory:
+
+  ```shell-session
+   $ sudo mkdir -p ${VAULT_DATA}
+  ```
+
+1. Create your Vault configuration directory:
+
+   ```shell-session
+   $ sudo mkdir -p ${VAULT_CONFIG}
+   ```
+
+<Highlight title="Best practice">
+  We recommend storing Vault data and Vault logs on different volumes than the
+  operating system.
+</Highlight>
+
+</Tab>
+
+<Tab heading="Powershell" group="ps">
+
+1. Run Powershell as Administrator.
+
+1. Set a `VAULT_HOME` environment variable to your preferred Vault home
+   directory. For example, `c:\Program Files\Vault`:
+
+   ```powershell
+   $env:VAULT_HOME = "${env:ProgramFiles}\Vault"
+   ```
+
+1. Create the Vault home directory:
+
+  ```powershell
+  New-Item -ItemType Directory -Path "${env:VAULT_HOME}"
+  ```
+
+1. Create the Vault data directory. For example, `c:\Program Files\Vault\Data`:
+
+  ```powershell
+  New-Item -ItemType Directory -Path "${env:VAULT_HOME}/Data"
+  ```
+   
+1. Create the Vault configuration directory. For example,
+   `c:\Program Files\Vault\Config`:
+  
+  ```powershell
+  New-Item -ItemType Directory -Path "${env:VAULT_HOME}/Config"
+  ```
+
+1. Create the Vault logs directory. For example, `c:\Program Files\Vault\Logs`:
+
+  ```powershell
+  New-Item -ItemType Directory -Path "${env:VAULT_HOME}/Logs"
+  ```
+
+1. Move the Vault binary to your Vault directory:
+
+  ```powershell
+  Move-Item                      `
+    -Path <PATH/TO/VAULT/BINARY> `
+    -Destination ${env:VAULT_HOME}\vault.exe
+  ```
+
+1. Add the Vault home directory to the system `Path` variable.
+
+  [![System PATH editor in Windows OS GUI](/img/install/windows-system-path.png)](/img/install/windows-system-path.png)
+
+</Tab>
+
+</Tabs>
+
+
+## Step 2: Configure user permissions
+
+<Tabs>
+
+<Tab heading="Linux shell" group="nix">
+
+1. Create a system user called `vault` to run Vault when your Vault data
+   directory as `home` and `nologin` as the shell:
+
+   ```shell-session
+   $ sudo useradd --system --home ${VAULT_DATA} --shell /sbin/nologin vault
+   ```
+
+1. Change directory ownership of your data directory to the `vault` user:
+
+      ```shell-session
+      $ sudo chown vault:vault ${VAULT_DATA}
+      ```
+
+1. Grant the `vault` user full permission on the data directory, search
+   permission for the group, and deny access to others:
+
+      ```shell-session
+      $ sudo chmod -R 750 ${VAULT_DATA}
+      ```
+
+</Tab>
+
+<Tab heading="Powershell" group="ps">
+
+1. Create an access rule to grant the `Local System` user access to the Vault
+   directory and related files:
+
+  ```powershell
+  $SystemAccessRule = 
+    New-Object System.Security.AccessControl.FileSystemAccessRule(
+      "SYSTEM",
+      "FullControl",
+      "ContainerInherit,Objectinherit",
+      "none",
+      "Allow"
+    )
+  ```
+
+1. Create an access rule to grant yourself access to the Vault directory and
+   related files so you can test your Vault installation:
+
+  ```powershell
+  $myUsername = Get-CimInstance -Class Win32_Computersystem |    `
+                Select-Object UserName | foreach {$_.UserName} ; `
+  $AdminAccessRule =
+    New-Object System.Security.AccessControl.FileSystemAccessRule(
+      "$myUsername",
+      "FullControl",
+      "ContainerInherit,Objectinherit",
+      "none",
+      "Allow"
+    )
+  ```
+
+  <Highlight title="Create additional access rules for human users if needed">
+
+    If you expect other accounts to start and run the Vault server, you must
+    create and apply access rules for those users as well. While users can run
+    the Vault CLI without explicit access, if they try to start the Vault
+    server, the process will fail with a permission denied error.
+
+  </Highlight>
+
+1. Update permissions on the `env:VAULT_HOME` directory:
+
+  ```powershell
+  $ACLObject = Get-ACL ${env:VAULT_HOME} ;       `
+  $ACLObject.AddAccessRule($AdminAccessRule) ;   `
+  $ACLObject.AddAccessRule($SystemAccessRule) ;  `
+  Set-Acl ${env:VAULT_HOME} $ACLObject
+  ```
+
+</Tab>
+
+</Tabs>
+
+## Step 3: Create a basic configuration file
+
+Create a basic Vault configuration file for testing and development.
+
+<Warning title="Always enable TLS for production">
+
+  The sample configuration below disables TLS for simplicity and is not
+  appropriate for production use. Refer to the
+  [configuration documentation](/vault/docs/configuration) for a full list of
+  supported parameters.
+
+</Warning>
+
+<Tabs>
+
+<Tab heading="Linux shell" group="nix">
+
+1. Create a file called `vault.hcl` under your configuration directory:
+  ```shell-session
+   $ sudo tee ${VAULT_CONFIG}/vault.hcl <<EOF
+   ui            = true
+   cluster_addr  = "http://127.0.0.1:8201"
+   api_addr      = "https://127.0.0.1:8200"
+   disable_mlock = true
+
+   storage "raft" {
+     path    = "${VAULT_DATA}"
+     node_id = "127.0.0.1"
+   }
+
+   listener "tcp" {
+     address       = "0.0.0.0:8200"
+     cluster_address = "0.0.0.0:8201"
+     tls_disable = 1
+   }
+   EOF
+  ```
+
+1. Change ownership and permissions on the Vault configuration file.
+
+   ```shell-session
+   $ sudo chown vault:vault "${VAULT_CONFIG}/vault.hcl" && \
+     sudo chmod 640 "${VAULT_CONFIG}/vault.hcl"
+   ```
+
+</Tab>
+
+<Tab heading="Powershell" group="ps">
+
+Create a file called `vault.hcl` under your configuration directory:
+
+```powershell
+@"
+ui            = true
+cluster_addr  = "http://127.0.0.1:8201"
+api_addr      = "https://127.0.0.1:8200"
+disable_mlock = true
+
+storage "raft" {
+  path    = "$(${env:VAULT_HOME}.Replace('\','\\'))\\Data"
+  node_id = "127.0.0.1"
+}
+
+listener "tcp" {
+  address       = "0.0.0.0:8200"
+  cluster_address = "0.0.0.0:8201"
+  tls_disable = 1
+}
+"@ | Out-File -FilePath ${env:VAULT_HOME}/Config/vault.hcl -Encoding ascii
+```
+
+<Note title="The double backslashes (\\) are not an error">
+
+  You **must** escape the Windows path character in your Vault configuration
+  file or the Vault server will fail with an error claiming the file contains
+  invalid characters.
+  
+</Note>
+
+</Tab>
+
+</Tabs>
+
+## Step 4: Verify your installation
+
+To confirm your Vault installation, use the help option with the Vault CLI to
+confirm the CLI is accessible and bring up the server in development mode to
+confirm you can run the binary.
+
+<Tabs>
+
+<Tab heading="Linux shell" group="nix">
+
+1. Bring up the help menu in the Vault CLI:
+  ```shell-session
+  $ vault -h
+  ```
+
+1. Use the Vault CLI to bring up a Vault server in development mode:
+  ```shell-session
+  $ vault server -dev -config ${VAULT_CONFIG}/vault.hcl
+  ```
+
+</Tab>
+
+<Tab heading="Powershell" group="ps">
+
+1. Start a new Powershell session without Administrator permission.
+
+1. Bring up the help menu in the Vault CLI:
+  ```powershell
+  vault -h
+  ```
+
+1. Use the Vault CLI to bring up a Vault server in development mode:
+  ```powershell
+  vault server -dev -config ${env:VAULT_HOME}\Config\vault.hcl
+  ```
+
+</Tab>
+
+</Tabs>
+
+
+## Related tutorials
+
+The following tutorials provide additional guidance for installing Vault and
+production cluster deployment:
+
+- [Get started: Install Vault](/vault/tutorials/getting-started/getting-started-install)
+- [Day One Preparation](/vault/tutorials/day-one-raft)
+- [Recommended Patterns](/vault/tutorials/recommended-patterns)
+- [Start the server in dev mode](/vault/tutorials/getting-started/getting-started-dev-server)
\ No newline at end of file
diff --git a/website/content/docs/run-as-service.mdx b/website/content/docs/run-as-service.mdx
new file mode 100644
index 000000000000..e2f2d599135b
--- /dev/null
+++ b/website/content/docs/run-as-service.mdx
@@ -0,0 +1,235 @@
+---
+layout: docs
+page_title: Run Vault as a service
+description: >-
+  Configure and deploy Vault as a service for Linux or Windows.
+---
+
+# Run Vault as a service
+
+Instead of starting your Vault server manually from the command line, you can
+configure a service to start Vault automatically.
+
+## Before you start 
+
+- **You must install Vault**. You can [use a package manager](/vault/install)
+  or [install a binary manually](/vault/docs/install/install-binary).
+
+
+## Step 1: Create a new service
+
+<Tabs>
+
+<Tab heading="Linux shell" group="nix">
+
+<Highlight title="Example tested on Ubuntu 22.04">
+
+   The following service definition is a simpler version of the `vault.service`
+   example in the Vault GitHub repo: [vault/.release/linux/package/usr/lib/systemd/system/vault.service](https://github.com/hashicorp/vault/blob/main/.release/linux/package/usr/lib/systemd/system/vault.service)
+   
+</Highlight>
+
+1. Set the `VAULT_CONFIG` environment variable to your Vault configuration
+   directory. The default configuration directory is `/etc/vault.d`:
+
+   ```shell-session
+   $ VAULT_CONFIG=/etc/vault.d
+   ```
+
+1. Confirm the path to your Vault binary:
+   ```
+   $ VAULT_BINARY=$(which vault)
+   ```
+   
+1. Create a `systemd` service called `vault.service` that uses the Vault
+   binary:
+
+   ```shell-session
+   $ sudo tee /lib/systemd/system/vault.service <<EOF
+   [Unit]
+   Description="HashiCorp Vault"
+   Documentation="https://developer.hashicorp.com/vault/docs"
+   ConditionFileNotEmpty="${VAULT_CONFIG}/vault.hcl"
+
+   [Service]
+   User=vault
+   Group=vault
+   SecureBits=keep-caps
+   AmbientCapabilities=CAP_IPC_LOCK
+   CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
+   NoNewPrivileges=yes
+   ExecStart=${VAULT_BINARY} server -config=${VAULT_CONFIG}/vault.hcl
+   ExecReload=/bin/kill --signal HUP
+   KillMode=process
+   KillSignal=SIGINT
+
+   [Install]
+   WantedBy=multi-user.target
+   EOF
+   ```
+
+1. Change the permissions on `/lib/systemd/system/vault.service` to `644`:
+
+   ```shell-session
+   $ sudo chmod 644 /lib/systemd/system/vault.service
+   ```
+
+</Tab>
+
+<Tab heading="Powershell" group="ps">
+
+The Windows binary for Vault does not support the Windows Service Application
+API. To run Vault as a service, you must use a Windows service wrapper. You can
+use whatever wrapper is appropriate for your environment, but the easiest we
+have found is `nssm`.
+
+1. Download and install [`nssm`](https://nssm.cc/) manually or install the
+   package with [Chocolatey](https://chocolatey.org/):
+
+   ```powershell
+   choco install nssm
+   ```
+
+1. Set a `VAULT_HOME` environment variable to your preferred Vault home
+   directory. For example, `c:\Program Files\Vault`:
+
+   ```powershell
+   $env:VAULT_HOME = "${env:ProgramFiles}\Vault"
+   ```
+
+1. Use `nssm` to create a new Windows service:
+   ```powershell
+   nssm install MS_VAULT "${env:VAULT_HOME}\vault.exe"
+   ```
+
+1. Set the working directory for your Vault installation:
+   ```powershell
+   nssm set MS_VAULT AppDirectory "${env:VAULT_HOME}" ; `
+   nssm set MS_VAULT AppParameters "server -config Config\vault.hcl"
+   ```
+
+1. Define the runtime parameters for Vault, including the
+   `-config` flag with the relative path to your Vault configuration file, for
+   example `Config\vault.hcl`:
+   ```powershell
+   nssm set MS_VAULT AppDirectory "${env:VAULT_HOME}" ; `
+   nssm set MS_VAULT AppParameters "server -config Config\vault.hcl"
+   ```
+
+1. Set the display name and description for the "Services"
+   management console:
+   ```powershell
+   nssm set MS_VAULT DisplayName "Vault Service" ; `
+   nssm set MS_VAULT Description "Vault server running as a service"
+   ```
+
+1. Set the startup type for your service. We recommend setting startup to
+   "Manual" until you confirm the service is working as expected:
+   ```powershell
+   nssm set MS_VAULT Start SERVICE_DEMAND_START
+   ```
+
+1. Configure the service to pipe information from `stdout` and `stderr` to files
+   under your logging directory, for example `${env:VAULT_HOME}\Logs`:
+   ```powershell
+   nssm set MS_VAULT AppStdout "${env:VAULT_HOME}\Logs\vault-stdout.log" ; `
+   nssm set MS_VAULT AppStderr "${env:VAULT_HOME}\Logs\vault-error.log"
+   ```
+
+1. Optionally, you can use the `AppEnvironmentExtra` parameter to set relevant
+   variables for the service environment. For example, to set the `VAULT_ADDR`
+   environment variable:
+
+   ```powershell
+   nssm set MS_VAULT AppEnvironmentExtra `$env:VAULT_ADDR=https://localhost:8200
+   ```
+
+1. Confirm your Vault service settings with `nssm`:
+
+   ```powershell
+   nssm dump MS_VAULT | Foreach {$_ -replace '.+nssm\.exe ',''}
+   ```
+
+</Tab>
+
+</Tabs>
+
+## Step 2: Start the new service
+
+<Tabs>
+
+<Tab heading="Linux shell" group="nix">
+
+1. Reload the `systemd` configuration:
+
+   ```shell-session
+   $ sudo systemctl daemon-reload
+   ```
+
+1. Start the Vault service:
+
+   ```shell-session
+   $ sudo systemctl start vault.service
+   ```
+
+1. Verify the service status:
+
+   ```shell-session
+      $ systemctl status vault.service
+
+      vault.service - "HashiCorp Vault"
+         Loaded: loaded (/lib/systemd/system/vault.service; disabled; vendor preset: enabled)
+         Active: active (running) since Thu 2024-09-05 13:58:45 UTC; 4s ago
+            Docs: https://developer.hashicorp.com/vault/docs
+         Main PID: 3145 (vault)
+            Tasks: 8 (limit: 2241)
+         Memory: 23.6M
+            CPU: 200ms
+         CGroup: /system.slice/vault.service
+                  └─3145 /usr/bin/vault server -config=/etc/vault.d/vault.hcl
+   ```
+
+</Tab>
+
+<Tab heading="Powershell" group="ps">
+
+<Highlight title="Use Powershell commands or wrapper commands to manage your service">
+
+   Once you create the service, you can control it using standard `*-Service`
+   cmdlets **or** the relevant commands for the associated wrapper. For example,
+   to control the service with `nssm` use `nssm start MS_VAULT`.
+
+</Highlight>
+
+1. Start the Vault service::
+   ```powershell
+   Start-Service -Name MS_VAULT
+   ```
+
+1. Confirm service status:
+
+   ```powershell
+   Get-Service -Name MS_VAULT
+
+   Status   Name               DisplayName
+   ------   ----               -----------
+   Running  MS_VAULT           Vault Service
+   ```
+
+</Tab>
+
+</Tabs>
+
+## Step 3: Verify the service is running
+
+To confirm the service is running and your Vault service is available, open the
+Vault GUI in a browser at the default address:
+[http://localhost:8200](http://localhost:8200)
+
+## Related tutorials
+
+The following tutorials provide additional guidance for installing Vault and
+production cluster deployment:
+
+- [Day One Preparation](/vault/tutorials/day-one-raft)
+- [Recommended Patterns](/vault/tutorials/recommended-patterns)
diff --git a/website/data/docs-nav-data.json b/website/data/docs-nav-data.json
index d7a97dcd8ea6..1e2a16b6f0a5 100644
--- a/website/data/docs-nav-data.json
+++ b/website/data/docs-nav-data.json
@@ -34,8 +34,25 @@
   },
 
   {
-    "title": "Installing Vault",
-    "path": "install"
+    "title": "Install Vault",
+    "routes": [
+      {
+        "title": "Overview",
+        "path": "install"
+      },
+      {
+        "title": "Install manually",
+        "path": "install/install-binary"
+      },
+      {
+        "title": "Build from code",
+        "path": "install/build-from-code"
+      }
+    ]
+  },
+  {
+    "title": "Run Vault as a service",
+    "path": "run-as-service"
   },
   {
     "title": "Internals",
diff --git a/website/public/img/install/windows-system-path.png b/website/public/img/install/windows-system-path.png
new file mode 100644
index 0000000000000000000000000000000000000000..18204689fa14a1025e2a49238258938b8a71e788
GIT binary patch
literal 75105
zcmb@tbx>SS^yrxcg1bAx-Q9z`yUXD2HozpfyK8V8+&y@3cXtTx4v&0)Ra^C5?biOW
zJ5{%)x@T_p=|0`(p8lM3!;};x5#jLQK7IOxC@m$X^6As(rB9!}K*2zL)Zh%>ntgnI
zc2SWO`BXVhaP(1tv=EjT{`9FP2L8qP>qi;ZQA*q8(<h|ff7j<hhZ56IpWX|l#e~&7
z4NkJYW)g@mhvY12dw6(6wV`ywo{e`qZEf=Ha&zBoLN0ul`tn)i2MjF9*;%dj0=VrN
zJaIDWGgpUC;V6vtMROvCa%FC9&P?^)yS%JiP2w|Jm>6lCl%M-3)LW7i`A6xBjZ9qQ
zql!FUSR@?$??>{0Kn(5w{ssk0Q~TcyKFG95;k&!LKkFRw^;FMz@DIM#W_W(*2YWic
zcpA<8E}T(1%lHEf+MejSPxX8`Hw-u2$vR*=NF*xWU21yhwE5Rjm#B&g+76WhZ}}vx
z{V>N~cAZmn@(H9lCXRCFopN*xBeCNfV-NA(kIPRn!E{tzN@l*xd>}dmljRr68PN~H
z#)TxJ35IeZp1UaO2fu2x6s@{&ntIgyC-Zv{ThN^zq{dcp7`RlnwhP{C8~6wj4L8WZ
zzPCY_Iw4FHfpVW!k@JWlq*eyqmjDMb(RKejjPY+6rAt-pJ!STkeuwlb+ogcho?3bJ
z`#CgGs^|2?%(_b%@y2bXYNZ|TBlt>h3mD#Iu}=3O?4-QfMQ7K^ls%j?xZ(8I#bUr~
zvjd`=@0kq(BQrgwxbHx19FOZ`5+66V)N%!|e{$r4A8uZ4*~c-OXqxVb*@8x-@6%qX
z2K=?r`x;;ew7(9gIiK2sa)xjhILFx)n6nVtubU5gUi*MaT`_I&oa6jN!E75tKMbiR
z6!|rnN4U2lffG-aI}4Pftalq_dVKvG4r|X4JI?!T#d)h9^Pbtmr4#pE2RGa~W9JS+
zE~I`NGAVVh6`4da86Ok&;t-dZXj)%g%SkxA@g7CYLivnZM6%T5Q%gCzJ@oT(=|VC`
zQf*NPp+9CPIn#thpX8)9)Bk70cGjRk*Ne`U2i9YFT;YoV==KLiL)e@)Rj(s2db8KS
z?;iz60&FdJ558M5S1+RhnVxeV9V3CwcaQn0KCJp5QmUT6vN$~oeoS4sx=k%LrtE{7
z0_;kf&jcIQ_I-sb?j~@D@?#CY<7Y05`&chr-a8RR4vmZ9SW;1{<Gvq*%SODMHL#dE
zG^MtHOmS}4k$yk9nI3ZgHA$8&({zf7&|dsQ8(oeIBy{j1NAjo*0rHE;VYC0Y0#~+2
zSr*v_ExRI!nQFJ<`iOlZxuBsAFi5!9M0lYwg!)v&V_#5uELIUlHg?DMF8M)>GZxV6
zbx#l9^H8!<_H#^@-Uwd)H2V-+L|F(UK~wdi<-X`Q|J;L?uiTip7j%i;!-wjzZFNs}
z#SLthCPy1`2s%&Sb!8L*Mw0?%G;_J1s0Q`MCGjm--^2ZyfX&*AycRpom04bmLjrI;
zG5*@25mYaN$GatLusI~_oH>t|3vk5aL2vh_h=J;uHJKUkP^}#xPCq%lP9{4@i-?0g
zMb?PHP^FhHs*nel8q==(G}yj_Rkm2h7}Tyy+oLP8Yw3U69Xb+^<FD=)VCIfU`NyW&
z)$sUlTO*(ybf^B$p6^mD_#^Yr9<WMD#r<a)Ok-n7={_`pHuR0;|J_0$psAQr{A(1K
z{QqjGWO-#J3M#;OQ|+HsK^vL~DyyiFXEdb$pH{!MMf{(4{QuVV|JR1p?Ck6$x_=)b
z7nhd<H<|uf!%So?ZS7nQS^U2~n^a+7(rWyslb-Q$q$KO#%KygKg{QwJ(AO`9f{Dtz
z>3mk-)C6G0ff^@22#<<FOioUQuqeJx5O+WSDOTC`<h*1Z|6y{kf6U(4dIN!BF;N7L
zJY4lU3|3ZFl-;qJd;$Uj508&q$H#n|&b&eqf7U(M5J+nOe%Aaa%8O1xf!WmB+H1ZT
zCm&x%Y%Gdet<6=Ym8B&!ha5((0RHq#;y>g5f2Tr|3-Ni&f+|Iezvr4r`Z?JNWWS+q
zT2&{$N(3}_DSDkiN(8(`9t36>Jd|?XY*fwUzW>}AmJl_3zYh2zTqWu7V7&FHt~9;r
z*_oM+MJn$`Dlfl~SpUk<C;rbui$ZCdM)|U17G3PwybsDZt@bc*ZS<2VGJY#=Q*4pa
zl%<S#dlU>QYk0kf=e2QpyjVMU<SjJ+-7ls8#GC#6TxUDxAm-rA7TdKakp1W?&>yr!
z@BMi0Q_B+JKGWcmPqSx}{p8B#mcITuB_~3`xru%&;VYlj3s1+qoASmq1s*!Yfe>bX
z_Ofrz^+DRb;|K%SMe)Hwyhb79VrV60LX6>Sxnoxv{#n`(-9`Z{YO=_`B`%aGjG;}&
z5VYcX-QP6S)RL&VKL%KTW@2#(#*c~`9_7HaZop6GJR*=TCqPlGu50M6ElTR!716=m
z8J-k(^MjI{uLKynGYEtW9_#*59Pb%eCcOXcY43fbZJ&h}mNgXOlHb%24oHeB)*ci>
zc5iOQrzw@mFDpH^xHin_ilZ{nm5D}K&goSQKpC4?;5zf&GTR>q29++q((C!A&Yv03
z;@?Cz@A|Fh+zT?T3&h7)37Ls%Bv>y0)ADY}FTedXi#MK&dt`~?<9u*l_+qNm=%~Vi
zO@8N3hVxEw=S}^Woj5ueclW;TA;g?bsV}z6e^!Bk-gJsDnGFR5j1;cBj+sdgUUN{(
zG6_NIh2}ShkObZ~i;Z5$h4Ps7K*WRTt*ymIV!%)t{|l8IS$BR+UJrqq!cXpWn?C}i
zXLgnpR?kpKMH<GZ*r9D%UupB>h7;$&OSLg%+DWdQn9j{(S;v%p00%P#O*1^3c?XmC
z+<bEE1;D|6Ksm=Qr5#1rNYHmK-KY8_aytRJ6j^3_PTHwZ?%zMH+5Bz!c&c64blnN_
zet`+!bDb<zkW?+O71VyvVHFjy<W<NSFQqdO@WzXm52O0d`NiXdVeed78{Bo^?&_$z
zu!)NeqBFO1TEwZs@Ud%5JcxYFC1#NXAzPLw<GV5(I8SyRO*kve#~(a-0f!}IbUWX~
zy&g|CIwEdF;-DBS)yVBFX6_&`G;lBA?gz&8qI4}GKik`LF9VIi8$(al(3Ln`kQ<+b
zUS8Ur+#LschkkCaiv1-3;Gpk?wV+{!i8-&UsOmc4IbYv6;(zS%8}E)I7YuCd6vJI~
zq5uO~;cau3k!Q!-yWifMbV~X*6p~l8)h>?R16MEa?Dgg4@E;!nLPBUg1&c}grOxnt
zFptU5EH1#Qi4)uX_>;NytO&OUqt0mK4U`^4Ud^Gxj+C&=yBj=JUWoY2oT|8}4R%&V
z)a;GB^OicBB@=yKO>s)m6=^uwF6_nwRl*K7LxTw=Z&f~~C{eviXly0NF277xas3YY
zVe>ek{^p2=uR3%=X#Kmg4O2Z<jn#rNZN~GnOB?O9*2Q=+0kw^YBrylBt|#z~HN5PY
zhW7#yzHxurZgwWVJ-#^moht%K(}dk}Xqh)>47aer{v~}cV|o&Xt*wwcLL`6~KxRA`
z=gPjuJHv-i!Q=Bb@Z}Dx!NjsO_g8!7Rc1$f(+hP)PZ|4R#!{0jQih65Ac#)kzDjlR
zmGm>v^>t@rSlVUYd>!qQ-uj5M-{P@d{Dj(GWJay0)+1+YMt-=hO<MbvGlu_}Gh@2^
z@T}7KcJTaiE)GsLRm~a`%51ekFeU(ZKavPFA}i_--BwqcHYoZQPN?;;dwm=VJ|W_t
zsdas7UFLqdm3`Tn^E&xchRWd}B;eNK)8WQtCf^l90fd$}jjCXnJzBfC;Fgu`V+_p5
z@k(zilGr>V6sa$VH#_oz0F+s`f9Y|oETw3uRj3~hKLjJ2u5z&9tmug;s0(<d;V$Yv
zY@bu==oMKgn3x~P^#$UtJ`X;79mZ%*cJd`y>my1oQ0xfqGZOheFpXw<2`xmzcMplc
zBnxZJ0o_%s1T)h>eu3{9j~3ZJn@~Ox@KTkNo7e<M+E$5;xA86)Fxi0M8DDT{W41_q
z{0R=;iG-UKMB{pIvvT|O8??PyK{acDq<jw<U)IaKy((9EXK`GQ2}eRzOEgdn$G*)I
zLzGg1s+Btl94zSShD-1Vem}1?w>~lFY~yQ<lOC%t9*Glr%jG<N8o}~NrJ3%bJMPdJ
z*ZQBiCcQzJVn9J*(j>z&q7FXSc9G$PFWY;cZ<Aptzzw3evOOgYls<Giqc0^*TPUhE
zug_rR^Kc<&4}3rz?x1w)PsOnfydWxW%Z=6F0RQS^4u>Cv3eEg5*zq~Y_{Mf2k2s6(
zw-VtQisNHEm;giMim@n4y0(@E2xFVcg*6F)<oWN(wCuA+EMD*D3AuX@*Bnl-y9Lup
zF^$EE#gh6%SBtRHWvs4HW}nOombzQ>)#mTsI;^FZ(`jh(r`Y3=#3V)1j~J$VO2jO|
zp+8X2dj3jJl>RE{`~H1YiC?c%|8#|i7X=s73Jo4;fjz1-QbJcz_-i=)w<XASEGSfq
z2aW8^skRA1o=yA6?69Zjg7a20!}u6mtl5qUQQo&XxF5wxS43MJYbY&F&wUETb|hhl
zFI}Yem>Dh4Cln7;%;HLKJ*&>2+}OQrP67-;>2lhPcUL?&O-HZJwg4j$ePVtM{k}VM
z+rsW~SaU69BqjzMGCfQ!D<GwQ;us7K_b%bL(lt}UV65rQy0QT3n?V-(6A;t!Cpc4L
zbgV*&eR^&rLP<!Ger#^B<tzFb=FgmB#C>a<)z!?SnZJP-<<)M{2WOzJ@yvxcIkge<
zbx#YzJ-otS$5s`8_9DC->dJY4bn$ypDc@Nbrl|h&GwIEfE9II!q288R8w)U}-3G9U
z2RaRg6F9HVY?v-a>zFR4LHpGd<=OF~h8I0A9J7t^<szE>t=bdU`_p3V0#NMY&#7%U
z_*Z}1pnM+PaM|NHu3-TsK#I~M4xG+=bQDa#8Zu@&1~Qr|yo&e%b3p|3WOJ)2W7g=s
zEo{P{buIWcy**0}-eh5R>dnDWMjpwNbnc5oZi!KO95W%psUCQCbQPo!(N(?`r$-o|
z<D`rr9Nfu!xGkRSE?z<b-+e6|-R*sBDzF`&v&ZQ#J(#n@MG{Zwg<9af^2>G}Y^@8q
z^OJ8o$GLv+4LQrPp+jA99t4|<4e6l#=3;t9qU&E}-6!WAm-DOX940Ez)N%Xup2o7{
zH~U2;T6YJd-ZN_ngs8s$f$Y$_2M@e`tVLZ(m;39w2a_Y#WCq>wj}wvS_FwK3da)~-
zwT`lcuzZy?m*FF6wPbEM;X5SU{?i4;TpE_7)k>me8@7j&g!__<w%`N9<`~p$r0MVv
zw>`kWWdg>&b3A4>DubpH8|&}~Uk`?5xfEb*0D#c-%CinS=Xm2Di-Ra%$iIde%qz%L
zF~)FBgad#(;tC>tmKz9XHPyDr5qO~aRz8FL^r7TU=f<b>UI$@!=~G86@TY_RSWUS%
zsU`q_>~1?Z(rf)Gs>cgFgPo!Crwi6e0D&{d*Zm5w!-$}0GM3^C09y4qC~$16fbAN-
z_5c83HUg&o0lx(GOAh~X<}O1UwaxtGO6=f(ewZ5P?T-p**dAxwwWeeUFAi60z94n4
zR3BO6Qz)Pj6?lsp8?z1DwwsnV@Efs^9)a44mZm~=7vKC7C0t#Mif!apa9R`dd|TjO
z9c4K&PeM^j=Cy`YvPV3GImxB0g=p22y;YBMW_mtrv7glgnp(RC6eEwVJs}TDhPL&H
z8%H_X`egEX-M>7LcKoN33;Y_g+cnG@oshp;@yyn{8*$gYzwj~R*htCJNai02mscDd
zb|Vnv_rTU3k^pveSiMbJZo|VCbxSA1+K&@*F8<+^9*;$JJ>1Eja6;VrJ47wMC!#W!
zyV`3bTD}zDKAWnJp@WqKOKVyQ0OkPm@t3P|9qRG&K|W`Me4sUT8F)*}icVti8^J_^
zFVcq=)Xneu6x%|m&LSyxu8W&h9~JJ#pS>QB0gKumO7U?D!e$XACrNFmVQIW*uj>M)
zT(G$)jP4|WX3J2f=(w5Cd(3XN(wbZRk-dadCl?(5E=|yVVcIep5GYAMOPkPdez5C5
z_ZveisfBR7ayvbVF5&zI0^kbt-0E&?xm}8}tdF4-oD}!85gn!QV7ayy(&%_&_E>f1
zQ}po(B;i^cNJYWk>SD`96<!Q^V&h+h#+TI0dwp?4n|HGf<>Is!z?59L-u7*B+~}=R
zC4PsljC4_2k8bE->XiT{G?^nO`QqJ;dSwf(Ibkz7l$ecDXriB(P|)w;^yHC+g@=>#
zPU>s@vbdk1w}ixg#$<lZVPbYL{1DPRQ1*4k>$OJ6@tDEmVmLgY{<e%oh(Z8kHo0*z
zV%puOWNvz17(;N1f9jZK^#<$xesHCEFB#}1w37Y&=7TupKDo3c@|dm8|9a5Y&k^Ua
z?Rl9HrS=|+9QScJ-6c?7@n*X#yF7HSG6Fd3zaRMLMNc>07~%3p<8tW_x-G2zw!41`
z>Jq&AQPKv1BRHQD8A(sO;vK{(XD;HypdB<<k9Pwp9%2H@cI`rZV&s?cumh@+=|iXv
zs`ZH6plnaCtcR`lKmiMTun!yNz)uSse==_16!r1^The|K$<x{S&U-d5Bh^Di-dO)V
zn&jI&F<IFNqUl+moAMuC#>IEJ^sq^ov{keXYLb{jv$py>Fu(TICIQ4y?|vi}tz%>Z
zkj_zN0ITS#V%G^Th|B8owF;7%?<aF}!@fUtb#zY_7k1>M%koKX6-iVbOU#t^kFS50
zbum7Ih3{ynfbX~%nw~<`T-hORJuICtm}sB4V>{}`#ywpXO{qL*e|JM%8qIpeeX6;?
zoW!irDv#XQ+W7v^_FV1k*e@=ow6Y{8+tvsoSdn3;CODPPfzOgcb~0hVo1U7EXsAOm
za2i`I&n;X~S+xnf^YqSqYL}W#I2Q^FiV{#jx+67&BKV*NUPBIM*hF?fh-1Mwe0jjS
z(LTAu)}+XGZIBNwcq#o??#uD|iX-h(Ur0G#^VtwIF1k^S@`}8qBry`Bdp)N8?pza^
zQ<#TEPoW3;QhR1s71%sAive5khP+n*N(c$A>q9HyZbye_QB5B2TZJ%1)iQPjgo-d=
z|Fjk=vZ~h4R4x^<SmK<c)mR$&M{jSskhEZe4o5!5YPdY+MYt&z*gTWd)*E>6QT#HV
zrlPn}5?jAe)0?9w^+qu7ChxcEqH?Up<`!UDC9oCwf$IlpxWYIi<xh2`h=HFGbqOe1
zdqhbn-=-Xy`zMYueyXF85;3PMt4f%d&2Am;`%QyL#*>EV9xSI+!VwJQ@bTy&HN5uQ
zUhrYMQc|RiFzHXlo>I@Qu@JFC{ElyDZ%|6qG`OkfU%tDlX+$^k>cDR(NXMw=2%WxC
zA#+jDRDVDLlp0s#KZPkQeWjVx{+!BtOPhSIcx3Ig+6|i!f`+xBOeuc-(FM*=VgeR>
zcs~HI#&8+@Fo-DL+t|@SeOSCf)WGI<)-OOtgk=*9Aq=z8xqhK!7Gs%|qsN5rLYNIn
ztSda(-xp?}VIn0UDmePpZkt)X2BIPnd7eW?|4}&6hYEU$DF>A1O>CU75Z|sXBm2`I
z4od7(%1(Vj&)d7Z5|(n1jRQ!nKy@v?W^^uRNWpEth88lvxOFk)obQQM5Xn71F0P#^
zd`@tB^uY3OuV^n#{nUQRXWRId>a7ulX=ML!3}@-llJm@+VeI?7{!3lxNrR@owe{Bz
zC>OT7AbO-c%A-Loeuuq_jk<K6@j(91sWgn<815_HfbV+hqxy$gq~0{+{+|(8-#0}c
z*6A6of$;{zYL<r2nERez6?ZBn%~4E^B^)FLSFp{{oUa@DTJM-zC+C#<p6qll@qFP`
zN%iFI$G!r!TW@jDE8CKCJEMz|h5NTC=*zDT8kG$QwA<i%FYwb?Xfj>&D{C1%=-{si
zAA3I-3jNu)f8%oV`w((=R?XIKA|~h-M0ay@lS(P@`1FL-oH_n292_^^ih<S6pCYG@
zpt;5gi>!}akyKbhx!PYSY~89Wt93OjbeMJtg)D!`QPEl8z-Y7%TK{EzNbGfoyyM7x
z7u#|tKm@#_E9&S>9At_a(3l&T_aL%}m^tP57~x)~4OjZW{0H`+@wR?7J5a>)z4z4;
zdei2qCC4W1Kk@ARz<=-%pm=$CA8NcWx+15Um9YxA@dGGpB|3uj>vFcP2QK;V4;uo#
zZs32_G-cW6^VlWL9cE=&aknPA@%Zsyq#R$U)K@lTN7Zc@soq;=zpcnW;FN1$zP0(Z
zI+JyRUVeC-r3K46U{$^P5;ZOe^!TbmSUG?Ph8ZxhGX($2L`>=MP8;Y7OXd)EJ56~m
z>!w2LsisK_%Tw{P@u>xsdy?>_PC$!k6qk||SI65|5P`E`U=jOAy5pb1^>}UlVQ#C@
zgA_%@?J+rpl|2_>W!q~~(JJWT?5&4oWlQXidZq`mVpEy*==U%@KbG^zH9%a0l^bC>
z72L@ZHkYA`1MH^=%rY@90~1uwVb$#JX=-~{L&d~eS}yiZZT}Qdt<Vd_MGY^iNF7MF
zZ`H-4{(EYEwKr2TJXYAyloI`y^$M&X2InrSn=ph;+%?c0kJOs(@_0oI+TN(csx=)V
zU4LHKNUftuK<bDa0JM4Dk7=g89$C;oy~uVh`XmmFzv;u*kC}n9o*B;>9}*|9LE|Sp
zb)NU-gtN2ibqD1Oo<Mz09fW%Gid_db;;oTBsHxD&xYm7j!Nqjx%TD$7*ZF6kT1Qw}
z!T0o8^A_fie_H`c*%Xmu4&&|#mB6}!UfGLxzEjU<LSHX_Gon}#QaIXu*8*$OuGR9V
zp(6&Ty!<XZyYhyTv_k+}LRD9^vD@A*2YW(F8tv>dEJ%}TG;jlo#Pb#ZFaFWd6o8OD
zZqP8hA0AnO9CRyO_Ke3<Ym1q_sq1yy(c*J4ydwu!BeJnVMs!3DI;TWZ_q_f+<G^fj
z2R-_>GUs}}HnugaAmUGUsMe^8=C9{!1Z~$TsAh&eSz1N<T#{|v&1g!wzlGxh!8GBW
z@&59vk(V{zFr)J^B=Rnc566l{6~1K_IdlV8tCiLCFGg^1v&qrsNMM}s&1|t!{?U13
z;|;u7qAzBeBpmhdP{A^gpJi$a;hK?zt}1=ngrVD*?85#1POB`S9G`43YG6zzC<Fw<
z8D%!BrV*!UBDz|_tydBFX&K1oH_P0vXPcWJR!`=IvlEPNmabMfz(Ja9jO1-?-R1-r
z)~A^xE-sH67AC0YwufUIU8tOx-6yEd&k|=4*ypX<_Kdi0Sf8T9e_0==-~S(K7mHK(
zdP3dNl2tZ_53YkfbsD9I!H@qg>BKW6-f)PK)c|KQ%FRSOJpE^UWRQdM3l}`owghyI
z%Z@_yyygzZ8E9VKYb?;p#>?c>^0)Q1fXc$G^l>EKppC(h9Q7h)ou4q7l~w2U9jZy?
zuWhH=o2V!;<xO9gpxu?XF((#tYaSpIopz0QD|>@cj!tBHBA>l(8>p(K^hRA`y87dS
z{WA3aP4oK-Li(SwwVjp+UeKLiXX=_2rX{ANC~^8<0LC0ge5VUnsaeHg;HQj7F{hfG
z>{SA@?YO)@<`0q-lg^$DE76>6q>PXa)seoWfWzg+G_V0*uo$%SxQl-l1P*F0#jz3P
z*f8ZDVZ(_~x(GlQd$AP__cWOD@tc<$Vfd-Mi!f)91hfc*UbV+H`FQV7vItJ2P-LoM
zCIm?fttQf>Plg`0M+Lc+c%qwo{BJqXxF$(b5<mYZ0E&?JCq1o=`Dh@dnXfg0$-pZ!
zgxD`NgxD*xsdH7_MUsOLo55Vy8dE31>}a@TBxJhroLSs%jgoAd#hCzot-gLSie!F6
z4=2TZF(ewG<H$D9>FNLS+_k52m#c2hNw?EEoHuX2k5%Nf{AOc4$}p<D^yD-pu&@=^
z6^i}-Mh)_^VoZ}y*3w@35kw|xu{ykGj5zvyu)|N<^LVn#;A!Yg1L)!JzgB>J)>h4D
zK|$Y+sHlVAs&seNg+{~v8xU2KHOc_*b+;wy`DA!)3ESpx6(<t(FX(b5H1Uf`BKO#;
zken-K-@wV*JUU93xu&~u7JI>He=DS^&h7oaM!(<Z@#MPR@Er<S;YzY%IvfaB(i@S=
z?2(9MB$|^P98a&q;12`q-mBuJup(_|hv-g3!ky}&s;Lv61md^n++HI@#K3OaK}V;o
zgnbWprm@2ywLcd5QBHBn4L347Mn1WmEaNO|Ethkl#odgKh38)<56blBa7&zZ-z3Bd
zt!qfH+_#oVM}&laGPbb))zTUmKWu)ppWOU)5Y;`o#^mEE{YVj;bCGG7$)&r7d#l6B
zHEtZ_&da372kCPAgXiB9Dc(gQ{N%BJbByurXUS|b`KV{$L6vmumw(_te&g#w)F0ZC
z(OIqZ98KYmkj#g7AbDNqifss-D?Ge)P9po)1qTZo8`*)@=e0F~+O`M&Eerevbym&)
zObFwLmm%aW*VxfPXqNwJ2)TD)07_QYjP|UF$AMDtKX0S>TD7rNR#uh`Hh6dS5woc^
z;a@O}X-pAy>Ey&#L_|c+21#l>DmWNQwO0&vxsK%7^Ph_Tw@6x!*M1rZ>E$(G>gb8O
zyo8jK@`{g2@Te_adZQ`ZZ3QVdGgHDT>2sB%gYB5wja9kSN?b(u3ijYn`SGN=q-aXQ
zf|+S}kLS0ayV1*l6aLufpf=>_`B(gEF6<Kv7e8o&d7Wu@hvJ@1{{@=o`8TfCvgsvP
zFrkpgLC#}cu7P!oS)ArnL_{$gR<UOVSSzW`0oSI9n3RSmh&~E&tFyA}%tE#UFPd;|
zd|19sT7IHnZ8_$<2cH@(+43+(a>Y_lE}5is#Sz8iLO^FS8f$!6_2sRJkudn}MS5g#
zX%1d@#BXrl-`7^Aa&T<{oezG?oLwcYF}wG6z8T+IYN)EOyC3~n6<z8B$eLPPA0Hhb
z_s;a%{oY$u>O@g)71Y<$GxfMc{`J4%awQvXJ4xK~bzlH;3Q?Z8)8ui<h=7=N1uIZq
zZTs|;K#M1%qNS*uQcYm&M7J@u>W*l`P(#-2uf)3F{?|_F%Ay7K%Zdmv1N>6Fnm-b}
zG6-L;=UG%DS=YIV#o?9YgDG;^zdtHXsWj(QE!h1kljqtj0$a}YWCvBTIso971yNNl
z4c#=LPFvSqkUb2Uf<hMR9CgpWFTc39rl$|dE3odxG`9V45KNtjbFP4?3eIm+Etz)>
zqpKii$QV4q9GYFgsJ5CDnJ!a+6_))xvd?G?RL=i{9K^`V#kkpky}oH=Mg@f`ENY1U
z97K#?$4>d#pwk##y@F~+@?&lK#eA4uJj6BAir2)sB*xX-`{Kvr(X>&YO+TmA-!K+r
z>HC}roPv=Z<k45XX_iptQM$a%C`WrDs>(d+23v}X@Zw$#hi%7y=&DfX>zYeDGVAqV
z;9>g4r_xANnT*u}u{8z+c~{bpEEguV3}x-~*#w>v(2BH%+!}g1a)a#Gjy7)byxC{x
z!fb|bi!?|AUlD&Q$j?ZVaNgxvS#Ld98EV2aWRZS<GSErKlbhh=yhUMlMj&!k(pu_q
zf?a4L0z9W9_!Pa17j#36zRbMx`y3QDYn4w~E<>$T8Ia(Sp5jH(_(&L=-G!8XmT!vA
zPIiWi_o(r6fJ$P>DzbZ)yKlPbdY*mwE4G-<2b^S|PpfQjh1)tg&Kue_M9*4&i`8y<
zW<71}O1(N*UpXh!VtP?zK&R*pPK~HK*a{&s*&mhkI{E7uO(c`I!V#Hj$rWBJ6F9aW
z)1k;bm8_3}#g&UWWNk@Dv6qS}={!VhbB?`KL=X?(frGb4r!(|AaqGsB!y$ywYM+jO
z3_Yz1ST2>$)l^lq0YWn%$`Dvj-QY~Q*;p#Qlwdwykx^azOBXO=v0Ur-mWR7GG!XrL
z3fc)~@k{j%NFsCr6IP#&?d%+^laBGmZwXsZ-=7b#ny`{E?!&a<=ToNWw?rWjvV0k=
zgqtT+=v!I|Ysb=M%tDEg2VfbJbF#kWl|I0BVfo#CCd@{^P{zL417(}qSySky_>FE;
z99v!DcTXB=dLQ>UXiqR7Upr`Zk!4-|CA}K!X*P5I!WoPd?f3fmJ?)-`PP1YU-?-a~
zzCF}cwdSbqKwFt`bk<XmH+=pwMsmG~<wPXdJ0sz4Oz833LKy0RoPpOKqM&Z$PcrE}
zPx%gvoas5+ihEOAxo`7Wv<T*e80X6}6{_^gB%RzV=>RK$sE0aK-9e{l%PmSUB=?kl
z)_6$WdhzTk_So51{@XJV&dOz(u&Jc8c1)jIONNk`A{X#X@D|G!&hXuJcU#rf);7n<
zn)46d5Gj-1RceE0#kbcz1=c2dK=(mT9a-B?q&TRN{qe1tApAd5Jgl}-)JVx#S}V)x
ztxLCKg#<k5k<W`ZxC}ie0EdVcY1A?0ru}MGe8vvjF9xS+C!^Nnr0&#}oTM8SwnycQ
z-Saw{jCi;|D|f%iUbW$Ftw_sA;%LUe7jk*f5o0$yAG_^T+YB3Ns&I~(E%}i2G`fx%
zl&RSxgk23z|0;aggfjpg=wmT#^sW0Y9YSowT-R=2SRh{wr0c0H_zhSX((f82Wsh$|
z_*}j53mP^D=$tzShj^NJ`QTHA?SfF2^j}7<%H6Q>W#Fal;VIoqB1%f231R?eV!I`%
zfk58vBkYinthket?Kc678d7djqPl2K8J%TI`%>YRg8iOj2h#eY;O%*LxLVb~EKBKM
z<q4rb;wtYbjbU+v%!-Q}f5lp>V<`GvP)w|zjjR{8mCV~n>9L29-%_-{4XGq|y;`(e
z6}6}z!JQVqY~m%K%{o8V)je7-p$YmJVGJ39<W1bTgbg~?3J;VQ0Kc{;&7)mi<Fm7w
zz(thdD%RqA4kK^!A=Tj>5ix@AiJHVM1d4pv+k?>syet9Bl|-r@)yu5@5$B!ZjiN4|
zk8?}(D{(S5O+?Th4n0A)262WT=ey|OD?q(FH~Oi;L|GEU>SK<V&+Sq9DnCcMG}l{J
z*E$d#d;OX8I;Sn+TLv7bPbc2(SH+r#^8WVA2X+-~UkMpNPPHk=?!Hax!vg`<xG!qX
z%N{+y>A2|mgvD6|wz8`$)6!lAjvU}m$iq`Ua$1uky!?8TOFy-usse%Jir&Dod?_Rn
zV)w*&_U7W2rA--iiOt`Q6NA0)Jr^YG*va9p*2S%0G%lcGk)9JFr`KbmTSG$oJBs_;
zXUJup^wvANYZWWx*6@}bzwQu4xm=@OXLr+i6~oLw(^YIZ&&5qzwVr}8`e!|N{UbDg
zQG!}>)BW+_?Ll@d#9i(}4CNLzo%S$Q^g4fR*j|@f{fKV~2TyH2oIBm`3pztTE9kU8
zPK&>5;vtrjZZc~^e@#tN{T(umm(lGDi%TD^u-!-!uJij<e#~!nF<_chDR()cjW5RO
zr{{bwpvT!mtZN}e+4nGQ5GUOGn>i=Skoj^MEnYR8W_+Y*-kshlKZI?VGX<Q7Cv&w7
zb4MH<1ANb}E#5vn?JbaHB>gj#9vZ03t&yy(Zz!!0%>gKq`!>0RBwK}3+3HB}*<NFE
zNoxAd7Az@eZkx!&nd}Z3linwW4?&@x#SQ&+XDVLCN|ZwKUf1!~4cjOqLEg(4Z3RC+
z6z=}_$i~kyh@2YAQmlwyxnjH}j?t~LBbhT&U`xrPZuPV@blyE81K^f4<BhG+qa@Sy
z!yum}D>p3sc*5NkyEXo@m``2cgWh-7SYqL`h7*HJ8cDv6P_zR^4Xh$*721YsfANvR
z>qSPa3R!Zi-a-ERzJ!<KgoZqdbTRQL&)hUzVe}&A;RV=(Smt0TgoF5@-b*)UN^*KA
zLuh;*U;}APB7(}9Cg9vSBq2966HxIQMzgwNbM^4_swsVfKlZwy_ai^4<xh^W-ruSZ
z{s3o&?DKW-54TAfk|T9p;*CEgLEp1KdT{KdOX6xCtFyCRDl<J4AHK`Xs{t9~!4r+B
zql%br!9BSyL?MMbMzOtFZzY+n)&-WL&?~>oJRyqHaIy4D<t(RrpnSFjID^C9Nfh@~
zAh1+ba@+h=ZZ#J21OZB?A6bFsBL!@?Nmx;zaisCAsJ77Jw|LspbQN*2$>Hg@gWp_W
z>2j8_UKSjN$s@JAGF9UeX+ZZdgj%@7-Q(ReF?*bPix-;pjFi57lhw%upYjR{8*O&<
zm57QA{xbvFvl3;bOHnO#g8vKus7c;s%^lW!E>)WcA!&XQYDnle<*f`KZbX*`9ktzg
z2n(p2p77I3yIgQXf`RNcdY*%o8QEFGCu0HYW!}S@dW?hD1!k_nVG;fni(uVNCH{_j
zQ{pwr&M~Edn8<-%o{U*h9<4|mh0J2;kC1Z2AaQ%(ws_TL)8KymT&bwt!AOCX@re#F
z@M&i!${b6iUeaZRY~pG-pN-jGcjztNz!-PHXmU0oK1ak|0v9$Rc;^sh+-^dkyHF5s
zJ?9a{fq^f4e|DP;O`Qt-WKgB7=X-Cr>NJ?O3Va8&KkU;p#$e3ng_a~_jfL40CslKv
z+G2Rj9MNcP6AJvycykp3H6O|N^TBJ?zI<}q)=w`J!}8-!acz?I{2R7{d$zY|Xhg4%
zE5wj|vKB&Pf65vpbIKW6y7MF@JDjJL-_0;f?D72Fe`j>5(GP!V5f$aofA4!(9p;gp
zlh0@L23%_wI<VN;J*OLhkRvJM-7zF|Mt}7kG;vi0;vZsWDqQ>3)4yK%j(f?*uF7NV
za9;r<{c-BSv96+K?EEWX-}UP5q&E@B4Vqbi5B|wRCBx+&P+}8}-!yE_N|XyLmyH$?
zP?<4MOMgcwms?O7Hond#w`rIrjIPaA#Z4*CY4OaJ@rTZVNQ!_=N1ib1RDTu&D@}(n
zJjntRV}$zJ-MOw@Zmm-$#YxGPU0rg%hO9Jv3KliBoE{b?BG3DjH@;usQdyWFW%@n5
z13y<#AkjQ!CfD>wW58-Vpx({ZzoDb#C2JCEPkF5jv(^?RPfyq@22oHjnj83ty0;^J
zHyq`P9QKWb84jq3S+04~zp;Q0Y(NcIPLB<{zvy%E*q&+03c$4sC*8yoN~_)$El{@>
zF3xSP{hGzvJv1EmZA!}Vw6w5HJ*F`9-O`PX=9n{9ODO*G@~*@?@aqXjBHg*Kf5`bo
z5%nobLsX9~JI>U-<q^8I)e*LQyDD*VV=e+QS9A>^1buraB;fYG!CFDG*rs@l9bPA>
zB?{BMM?@o=^NzjdZ3p?!U2`ban<K?f3m+mgY_4pUtU)QdsZ>hNQZ@Iy8kF%V#1U%C
zAB!lUDJ4|<_4NYZj&unSagTt$;)Alfd!+v|=M#cAZ{V$8y#Y)~7d#P3ci_^Y(-oE#
z={CD_AIi&`UbV9OY03v~;e!#)Bei2Y@3_HH6u3uTe=tG~k<pR6jbhzmGn*UnX>I#4
z&?8E3(3qL%Ym>(IEIJP>d+%fNkriQgG#2?xY@#>v*#PvYzCW5X@#5w3@KQdvs|I5u
z-ORA2x%w_0orbJh8J2fvi8n|13P`ng+QBI+-_!!KPkrt&#bm%9Os$FJU=o`llGLhB
zD3#sHtVTYlT^X3F0evR+eIdCPdXB6(x~;!WhwpZ=n8i#%op*}$s<XJ9dO`MjPvF2A
zj5K#m<-!s{fzbEnN!Jp0tQJD5WDMjjDYd@&CO8U>ug@UK=`+w)hh1yZYXBqlt$RYd
zeOAsANTAB7l+ezXGCyvM)p5&6Jn<a*NXlT|)tG*!%$CY5rWImsmfS#`bmXOF$Q=Y@
z!}e5$T<v%k;`4IEillBCCL21qw2lWYDd`=*aB&n&cH<qnm2QP)oA%1Ij_x;}b}eWK
zR>+m52|5UjmN2gHyX_`GEsF63jq};kx@|XRP;M`04s>@Q-ppgwS|5q1rV72DxWo_h
z$_44!VUCM0JjOM$&9GDE)ziO*D3Dgy#Cq3RepwC5)LBAdCjH#i$V)&7xNzlJqOY|d
zGaIZ`)V>&ketGUy*Fq$o_^O;67}er`DOgDFeU2%J;>F_eMg<m9;=izp{QwjKCg2Ic
zb$ZqFpsA)kMO$qWqrBisirw#{yaUhk0BwF>Re~flH_A(OYi@lHe7iO8)x4t1gXc5z
zzIt8H{T8Zbr<<h|u9pU!zJBV!LbHSZ*sxwlj{2!}y7>Mctc43{Io!Vi5gA;@amEj=
zi@)Tc8mgP}EN@e0#pR4co2t{nS(nJLWbV`Aa-ny>MYQa#;i>#hUPAG`K3{IxQ_HHS
zYHRJB?2Ae{;*2+Ha5sCRW8g+*RKR@%n=1vo`})43qoB#BW_+zkH$Y${(et^aki*55
zjO^mOBO*Z{#Ea~#%OXNmSg2;v^L-40Y^8Om{w)l9ToNaTgBp?1K{&2J1R0GpociEM
zaB8cJ|1`<oWMqEcA4+#_>|9ct8X)z#K?>ctf@s|j<6Jrg&3H;2p!lBpGwa^bzWEt$
zd-X()fiPnoZ@xgs<=|BlZObHRco++y%VsCQtJgE=d=!*$iGGG8_}O#i=2ycNIW2wS
zqB8nr!%S#!h_Y6FWuIKSNPSy{lr_~01R2b&yD$Ufqz0^u81uS}cX@^5)dh(NJ08ES
z?V)vPL7^s04&YmYeOpQdK)+uAD=%&{IICZ}n-e?lh%o&}Rl@QtqMdyy)m}MfiG-m@
zU>(nXqkUjd2&?t5>ox>I&|KNT@OsE*GqXfAp=@Z1z;Gydc{uu)v1+JCQ$b-q^1+|W
zRmanyK(ED6$2K$`awK4Wa3xU^OcPb_K+NFA)E7EQCZC`=;*%oR0Nu^QJw+v3YI{yn
z{ybZ+M`$$szfn=~XJ|w3)Ljir{mVrr?&Ne4OAnhRqf5+9{VNmL8FvWow!sm^slu@p
z6v;^TC4Uo2+z5K>skvxX7F4adehy7#r*dFd3)ZDbV<YsB6oI<)48z|!+aB7NzWpva
z-#(m9(dt2LcUp0z2Vr9t##N>x2<q2=nK+7Z9FdCoe4jvF{=K0|-Ra?&2Rs+K^Z4F|
zMcno_Bz(Zv8jUv(dgA3ljk#FG%!R1@7slIdY83tsT<0{<%9vPdTJ691{W+KQuND8z
zSI~P&!r+0BRC^MhuLqrOO8c;I6Yya{9hKnW=CixkTa-mrbib!9A~L=8mIJ6ONy}mi
z=KOvSdyA`1_=k+$$RGS1R9LKcK2)u*#$jH_TW`=gMiTAEKUR)h=MS#u_!O^<oxXV(
z3Spjag#M=0S_Hbx<rwVdmVSm{{6|+^e)X)55j#ZC%E+)6@d)_ZC7EI;89!8RRogSP
zx)9Mm?{Qbn%4wJMT-&M!gGNHJa-%xX@A4?zISG7rTHXz1weGG&BavL*#dVE@2rose
z-MafV#$`VEq)_(EfN6gXSs_l+y;PARbM5uDmrso;i(%!4s78fKOm<<i>lJAUTSiny
zQ>@l1|E8zk#Xp?sacfre=JP=n<6gX}T>!N%*GFe(k7KUbbP>wrl$0v-o>zR@=Z7qj
zVaUDh#p$~OK$>He0h#agy?VTs^$})jzaSbOLrUrujMQQil#Up~(eC3_^2t0GO$P$0
z6BI$XZ@M0r6Qs3Vdcc0Bbeezsl85got>wQ6tf81GC^}5>U*+S`%RHsv>-^)GoX`K@
z*8AZ9^KBypw1DPqRUs&S<c7i}(}NThZEbNt#Aj$^NqTkKNC`xBFAf}ntZI$>n9qj|
zS!x;>Gl2ac9qR8~`ODD~aI&<@D|{w)m7MaMXZExd#g*7pbR{(W5_R2BlE88odyYeP
zj@{Y2O%sQJCyO<ZnxZ6t@OF&X7Nbk?cG<F^lROFh!WxH_q~@l(d1U&`*7XjZw=k`h
zrYK>Lnxw9Nqs6^rvd|UxLs?bYT7$@J4^yr2$kE9?FdM6EM5h`Bq>Dh_NCPVSTU~?x
z$a@i0M*|vWU*ucKahy>zQ(m?InO_!=*RFDNH@>KIcW}@$xuPX!Tn?uRv{8NVvu96A
zGu=y4GEk<uD*hah1%EfcUxYd2hdQn!Xe)Q@yTI-icGIAFr@~E@c*A7Jv2AG+)ma`E
z{$vgYN6li+X5Rsy&v6dzD_+O%GyJL^t#+~0l_>mH#w$tN8E!3@-s24+TXIgAMnJlk
zR!ZU;RW>9}{n(?1&5;m;aDQYc_O&!Hk@5#nOw04?SYnvoZyBSeR70;1-vt|+&Ty{R
z{Q?NCxh2HCe_`dRw>pr3e4ROin`!!<c>tBu@$C;hf>L#+KB0t?oZzBy%D~u9n&Y<-
zW38{m*9&fLdi<<UfvNBOH}Q3s@K~p1-%Pal$2DG$OxWGyI=onjne@d>tUsq|FBK%Z
zvY5LjTJ7Ap^h`?X8{<i<L-}+hn!$s3I}rD5_1H7apr?mM1f@*8sf=M^o0nYUYMohf
z>=&iY2T11a`K4l1sn7JSd>${oPl6T6f9DE8re{X+KhJY5_D7PBifU7;$WG^3JRb7_
zLsJE#jHb|7@2nQNk4cg_DVWz=lE;pbjIju$e?*+}a6~44?XH{e7>EdS*AwD>uy9DF
zrgJz=bHScq7%wOS#}=GsEM;woTlyem-vxBZt$3uwpwN1NXopofwnT$>e4^V-b}PN&
zT4<~(k-~ma+|rp>@kEBSL1b)X`!1iKJ}XU=du*5prd=c9N0;JoZr|L~c{$sjJDdC7
z&`1w{c$U3H^*^^#i>m-bXEP&RyD6gKAKI&;svQuNarYZ-+rV(?769$kgq&?Jj});8
zcH<@$Vn^>ojm~o3xKYOG9E}}rbyEJUXFks7qzOAgLLP{Y{;jYfvV2!zyHtyRTa7Ch
zcG)kZJDyy~SA*+}t18hS%j`~C^V7bEmopDLNH&e3;-!26UpdT?kcmmAF!y*Sp9{x|
ziRVwcif&~ViUXRqnWzzkpp39;CEcZR_RReeibYSlGC#{?v8^tbqkO69jl^EM^25qI
zxceL0N@qs?(AVa`0kmJ>I=bxHrXsfc{;xOsw@mBaFGS{gez-d#Yt?S3CN%5CDu{uq
zfgOsE`&yYLk>2%1%(#6mQijIjMGjAqk5(FT_}JkU@%u&3&wVj6fzOE#w8qD5Wl!&z
zZ?}Wp%qWsuIn9b;3Bm=fHbw*s8(z>Uk<sM9r3}+n`5k{pplkA*p6^P9p2uFlSR>(f
z{@STrmnS!&TUvctZy2H*3v5S}7xIzK{R|d+CaUq7mTO9l*Cprlm5L)Sh;HZ02}}4x
z)dPP}HJyWni3m9vWi(0Om_pywx9QPu(}oV=0S~H)@TkyRRsIIM+Mrd0*#lcZ2xX?O
z*eYh6`nLJ7BE>{x9&^UD=x!XhP<D2B7uB@*g9VC}844&Z?ESvDBA%19qTkDEnwEF)
zJ-{QoJqCWzE3Wf}3{HTOg=BW=Mh~=fI03J^99ErnwL$(sN?e}@PA%={*z3sS57U*8
z`ix4MMJ@Tdx8wODhC6rEr<=qL2U=lGyPt4KLFUs0>RclyXgiEe=E5%OA_Qtal(*lu
zU3GB+Aj0&!<%o%bDk*~?`m-YO1TZbsm#w;**k+E!9?|P9z&la*T}652Un_W{k5na{
zonxTM1S)9gfyZnom7oZakPqRMd74jSd%9D~fO5L3tIlJ}i}MRcTt!(K>zJIqjZMNJ
z4-p|DA>~guM@Jl~p_z{y-#L$ii~bRKWy3c}WIfyfW<Bv!ljy>H?8;!YPHzCw(cf>|
z5cE<TZP0_wr4Kxz8KYxU9A?hns*<+IBsM2ihk`pon7LC`i`@36Yibr7cdIQygs?M3
zXnC|2{hHTSE<|BXUOeUNps*}2#E+~9)@$tZJ`}-p9AfAv-oHz4{X$+=^FGO70TFRg
zj{g1bRcf*Mc{$0;Y_s;8JKg^>A)2UW4zQ%bZE^C3FBxubpXEYbi_6`aT;5nxihd1=
zwPwUMnPIuGG2q&(4@sVPjqAE}8ZG2He<?Byl-;64vhl$oI*Ku&#z(j<s9X!y?xBc8
za6z{>U*zGLqN2Z76!gu3JLWd=Jvp-aW3gnB6F)}=zG~;-zn!MX0@bAZ3v$)BM0lR>
zRPn@T%BZ*zUrs4&HSN{B^n$KGUI?-Xs73-ppoiYM6u3Uquj_&mBh`to$5&&Pbj$j?
zmHI8J+Iya_7nH5{N2(z~wiWbF&TjoGacSe6&UNm&G0pzcBJ^2n`qiv^<rIwq{ovsf
zz_QuSh2_M7l08`*tf>6jt(Nwrc5~J%L$(|~mW1IWYNwPP$!bR&Kj4dI6r7l5b41Ma
zN%Q_w*kYpX7Mn3H5K;nABJd|ZMrg~@8!88MK{V26y2I;}S?w2;)8GZpy!Low1G3P0
z5ao-jDip54*kh8?S$m>&rHu)#KmF*J?c6T!HS_!mU#_a@E#s}D9M|fPyuK9r8Vl>G
zU0>&L3k@!Jr&4hV#WnyYJm%0JScXMcZ#mT$(ii_W#={;20%*VsWv}Hl?&+h<>PRjd
zzG2$e*mZJRcj6ChoU2)*>hC5R;XK%V(0P9a2K+7F<y-fZf+2aPJzZI<&TYvB7bC{=
zAhsXhnU8y`7F(M>6$i#aa@W@Z#@WE*B}TpYveb<Y1$115$85tPg=v<0yM)`8!VtGd
zD{0T&gSHd4WVXAG{9yGW#<RLT5MW;-zE!lvF_5&jlz{fs<YsZ`fzLIe{(1MjqK@<6
zWKZ!x(bg1&q;~+_*g#x602*BZQ=4SqGzj?M9T0v@)E52?pU#%BO<KPm>3QUgq}lx1
zYR~X$<nkl$sKy{mEG=OWnQwJ<)zRJkZG1vYQF9;%)mIq{SoQ^%W9Yq4VvUOV)SAhl
zvi5f`6BJ*D{j|&Q(|smK9R)w7LH!knT7%m!tBU;mj+l|k7NUi}I<&lPG-Haz5|9FY
zYp6+$31wFzI&I>z1`EP><8~)Z>^t+I(d{!>0Wd0-x_r*VB@-y33hw3Mx@#S9HnU)2
zNnKQ1soJijD7p+K_`sfp>cKyD;&pz#nzU~F;zJU)ho?tB`bVCwKw7Js1A3u`n<q<P
z=<x=ZmzqC4yrabRu5$T%#TvVT_p$t&_caWCg#ZpGY2rx%eR^wal2&eG^hfAIBDVEP
z-Q2e(X!b?MJFpaB;SduwFC{FDso(Qt1^)A^q<|3AX5E>YGZgr2Xf!?&!|Ikw44cCL
z+qX%tHxQp_Yi!VgVzx6Z3SOxA_cP^s7F$NKLxj=sV1)F-&6Kk4@5-?u$kiKq2mWVh
z*JtzVo;>GDpTFYSucGWB?)Klx!Rj@|hnDnIJCmOqE0?}kZaFjJ9{}L4of3muV#v)m
zaZaLBqS#QCmDy)Cl++e%Yx|ViSbXFV8q9|61=nUZlZ}s0y8BZMf*7kpt?ih!C6V*)
zuThN~#mY+y3(Dp(Kv~t}$Q1^Px&2CS=fq6R>ogG#8UzL68v`0sO3Q0pS?}#aAs%n+
ziQ9l6S67;h^&{%V`X7oOcrA}D3u%1k`fmj46YV^PGr!n+^HgOkr6$JD7-f*F4(bYQ
zS>ekk@8(sL;-WL`_+$l_qZbl|F3<3p9G`=XH=ambxztrwj6*_DQYS2``fP7<Jb~-b
z?N5{9v-XdPd(gv<Zf+z@HQ)Otq$CFnICstKyg^7hqR3{rLwR~DxelY|TRrmJ@}R)`
z4N#IU`jgh%kc<q_yL3!}q7H`feS&S(Z)r}?E&0kRb9GIU8Q+U;g8!8&)7rh(YlDTC
zcchE$eIoj+y<qYCdT05|*APgfgYCgdPa)eUVnM=7{CUps8w7;jg;{@%<i(qTg{lz7
ztevLeuH6?&mPCw*k8}#sm~)}Tv+eT_o`vO0tdsv$BiZ7Jz7~1s?jUFX4qn8`8Qv(f
zi%PzKiQVd%iSGdlZCYt~YL!(c!rAICes`=DI?hIlyoNMlkoFv;H$t~&=t&y)6Ew@-
z)d&vW_F$hCwsDT3h+76qoEX^-V{7KtmheNL;@&uJKCC0E{K>imnnxjk>x$Hvf(m7m
z@K5tdl}T+)#%h_n-j^@cOtMAwrD3zLV|vcF?BM7<WioKU|KjT{gBoert=(rB0S0#`
zxVt+K?gSa!-Q9g)a2?!baCdiicXtc!1V5Q~?^C-@o&9}(Q>jWi-RZt%t!rgI35f=I
z>RXwG74B0NXhQc60gY1XaHqg<sndzVmLka|w8{mIrppt+>&ZN|IXC-Hz^*IC&6VF`
zAqBLg!s|gQzr}oHpbtDe>RaWBDCRM|Ze1;9SS=n2M)rwO+}oOWLDmsLnQ&RQh<8bs
zMiZ-atEV^1jlQ3~zLy4>H2->KQO+jI+ACt^<_NrUKubZz9hwg_3PT9fUk{Y}vYM{E
zwUXzYrsPEz+aQxv*Cj3E-Ol@*<R6I)5u`7_9JH159YQo4@<S7oP$Anp+WHH^@=^r+
zg-NmBAFr^zoseSHmE=|BNg1+4!mxRhi0>tasToO0OOk6~VY#wQ9$lu0^P0^^zwDCq
zrm#5hJ-4IcYDUMVo<Ig>dQu75jPH4she%jryZZE+5t%{O>k5;<@hS~Ge^3c*{?Yax
zyBAGHkDs#=OG)Rp83>wZQ&Y;=8jB38smDlE)bmUb8Bi1r;)46btd!~U)AN)_JQ_zN
zG;<oEBl^{+?CCB(#^W{$SbU!$8_JU{?Sj9g%^k~RC%8K(do(I(M^h_3^D>02>XwqB
ziC_UOjpKB{1||KS%7#kcFNxjP)^+~y;;?&1sWgVX#^M&S7FR5<<_1RPo@Al?{0hJw
z1gp5o#mmFIYkiQ{)OE_?ylSG&MUw?47Qq2vO3O%LG<@~y;{E9QOq<N=YloO+#^~pJ
z#DrL}lvl?jSb&P+mkI)1%=nhQ%8-4O{gu$+XIydEp(Pbp^L5^nD#Ic$T>`3Vkt;S~
zYs^a>hf8Mfw8Se>w3$XDYcq_{33<iUtlN>l>g|eaIUOr}8!F{>2>aeA_9N2FklOc-
zq1TzSp<*Jzp;nyjAPT+dn8``W6qVMk#NPP^8Q~vVgIZ@rtvS)6U;K-o5ug&I=qEXN
zT6w$qow+s%>Gw?th|5Gm#{wm_;Y*AOCWTpz$wZ*qaRm0H83?{v>3YR3ZD~jZReLT>
z#%g=kpsh6;&y_~{)4Zpxp|CxRzq5OBOz8sp|9pkx)-)ipmPF4?W2u#ij*U;0+1{UV
zZxwag_@$<w+?AS4=oMt*1;^D=Thy(e(^Q+`ondc(JS9#$gv`)+Dl`a=_^wpYJGOuW
zSJ0;RYGZonpN@R|uI#`N{az7c1C#AcIyIFwAZVs5JQdsE-AspK5_Z1%ptMMr(U<n!
z?EPvPkctU1Sw+Ic6J%&7`#Jwv>PN$)U2PR6f<Iiye7qx9cKaen28r;M^LH|;!idkj
zh_MwelziIxPa3U==hik3)t6hpmd3~b1**|z3X9&f(mU9nSDhs?i<qfRy&HrjQG}<9
z`SJj!fY%wnKFgaD)Vp#cv(t(HxWo8?p07OZf|4B5Sdhn^9WZa*IwViA%KJ0oq9s@{
z`e6KRsBB!rI}~##grt_nU;;-h5Nc>^kThmP+}w(P0aJc?4WWIw7uAar4*pyxrHz7#
zuQPdmKF^rb9fg2Dmg|K~DH>Dx5+sw~1*d6}R9!&&@U}<J^&GvOre#aME|#CF8I@jE
zW&y9Zb9RvD7w>IGDPdin@D`QGc2cM_Clq2n?XC9iN4fRfv4ZT7baTXkTzDxKSXNaT
z<XZ3#47_Ko9sMC!*w*aIXcq+SGW_qv^{vq%+7Oud+<MhM^f3B8Y82zyv+Z~RG|d(P
zFxKlT>!_|J@k$#WF2=5oJcEsh$z?Mk^-_w!VJ5?+Wz`ZU%^TLNNfNceGl=amyBy@f
zQ*~|Tu2)uBjZ_6m%{?k9>PW@Fz^OL6duT?CR^vw1*0jTvRJMeDt8gEb3$1WN-tpbs
zuiT0>RsSLqu;+j<U*~vF2nFSB&&)YA$(w}pDA1S3TJ%TiBm5jR(d&qjw0{L>&qY$6
z?0Kyuf<%A*8Ki$X0ghlG5>k_ORY7Vbc7UI0`dx2<CJ{lB!nTf(s2lVF#(V0b%sN;#
zusK`lj0!K*Md2fk%AIBTF2?c*Pcb-=4y(34^2Tb$;&cdTc`6-)b>dIPtp#-GMoiAr
zm-G%U!~`mErj?z7W?ia}#+sJr52r-@Qb)k%cJi4qCoDhIT?<O`lN%o0-qKr8nb{IV
zv{aSmmr3ca|FNdaguTBuz1+1czHuY#?<>&DpZbbN$!B9(QhA1j<D7|}oSaUPYj7!C
zt;KjBbnl$*DIUb6rZ#7O9uZQ8u^D>}KJk=X@5DL>@5qK?C6!l3(re9yg~JYri!RZ-
zesAKtg7<44Pi*%YlcK)pAD>MMrRH?}$bRn!*rhS_o`(KP#zRb#Hqdx<>p5v#wZKH+
zpykBE&(IFTV@^nu)1tnurzE2a4rFF1*KGSLqj;Dg9{npBP}8}i?LFs1;%9m@^m1`<
z0@}Ocsq+W(ABdp5)m<CievEIWJNmZ279@$Mk8Zgcq9<9l1-lv;Xax<RF6qizRKPUV
zAjv7B$eHGa!En5|J|#=OOF&vim9=k<=fB+c9E`acC!PZ~LXe!?FI^jL)JOij8hKyG
zU_DuT3Fw3uYkqYYG5M5mv_CVyvZVsT;0*rV3O^I~NXjEQFWDR55RNCMZH0SZQIm`6
z#{JmMJ75n|=}EXy?=9T$;%aw7pmjA>T%f7c@M6B{WmYH9n%cEnth>AtSftYvvysFm
zCH1LkbRiqA{H0T-d<~D-JF$TQ&?5b+u_zkyq@Pzt;xOdcx#<x3{D4S2$^cF&bWAt6
z<PHGsc}nppNf*I97CB+nIUNZgM$|92I`b}U=7mO}R`{M0QA9QoKW-DV<rSgYRf+30
zDhHa;hSZgU>KeO&p@|g*<Vlt?o;UH!$;#2Ieo$D03pI`pA=W(Jp*m|zH}|7`^_g`C
zIR$?x5+`U~LzxH+*A@$`CC_(m$|$xsQ~DdD*qdP^%4^8x&<{x^q7^oC*<t-x1+s9|
zcw#fuMT^|CS<2Y;hq>?_W0V%rg1bV<X{@YvFoQ%C1sbDa!L4f#T@Uz7kAy>!wD`*%
z?kH=BgvMKo80En7KgyI}`l-`os^E)!_maIktgu25FHN6j<(9SCl2Ec-)tjGC{)`zv
zwR-LbhwM_(sdYswDUFe0W1I%GQfIoHF4i7M!t!GtHb>OE)bY#2%c&=QA}vBS${MX@
zOsd<v`qXHP9>o_G&Wr`$voZ>WWT!^sX8lL*JSKbCi&4;Tb+$C9d2svUP~THPDRDUN
zYs7Q*R(o_5Z>{`gBJ!ON@JS)^(axZ7kl6YrX6%F2&u-Vdmx>)HBu3xkT7?YWJIzJa
z6L0x`B)$E9gpdb6gvC*vG(CyVbjY9HyORZF3$M~N6!Zj{#F-OHlYPX)@4D5RF1G|T
zS;`V2jA*T7rbwCUa_iU{H5;}gbyV;-2a2Iw?1gHon=B%l=KEc<Z}d^3kkd&vRG=Xy
z(PRYc(p+GvmR)U)ufv*!AZq6^81Ekc8&6*5O*50nx(g7HRTuE|<axP@#*666lUASD
z$W?MBvVB#^-9xpv88aBlBF%4DX7xD{HO$S004HL+^r7-{%OzKuBKk-&<XoB89oHuM
zU#N6aRF_v%^KKB0N5Ae}xjFSC^7DKk7e?bnhy22*7{EDOuGdi~$Q0Fi3$5ncklRQx
zJ<P4OsM7yv)P^dG?xC{*Xd#iuWu;14L<n+z+}lz>x8>3eZ5yvl26uF<U*))0g+x{V
zXxP74AFb>gVdL(1db?jjCGIt1+}z6SN+!MMfG1#ytU(k1L%T6L>640{z`4VJh$;@v
zJ-1XLbdD?T9g2i$`FSHvK)bIOR&jPMM{LeaOx+z@_XIJnk<Mr>R`z?D3w+DH;zbI6
zsOFZKjtxDAn1*rKm1#I>RWnrEv_oK<mSG`F-)wG(4_wnWlL<{vu0aka0;&WYDRI0h
z6ZIq-oI#W3N~=C83ytHMb8uiwssP@MRoii$BRL-%JTx4?<}dc1nbD?}Zw?h&Y&7j*
z02KQ2Nvip;UdygTQQj(CoU(vuF9rO)UjFNFe3^QQc;t?a{K5nM(2SmrC1Br>P`i*x
zOvf+8+wE9wZn@Au9i$JfuAzW2mAu~SMwUDl3r1cyf}H%mU~0|@W8rFq)hu~B@8H<&
zOXHJP)oRBFv;I(InmM-`Gd~)Pb5+^4gHMG+G#l*@OFFLs$a3U2EEX!(et1;kFt3$N
zupUvr3L8zr(Vk%k6>wwHpLFF13@w-Eu9#?x*7RIOAGI~xPOeZukpE$ST_O@zB)<-c
zv~OV0SBQ!}zo-ma>yl}AHxHYH4)l@qVd?{6_<#ta^H>V$N7q1IoV?oj1m+j_`lE@;
zuuiInX@H^7#xgjkWQAO#gh#w%Yvor&5)Otqa3B|t(_$DOjTrygH^NTedho_W#9hgO
zp!qCUg1Pj!YyfYYIty0@XWJF_GuzqAu~esnXK0fh9!cQNdK=%A9=!QzG}F=CfvENe
z6epq+j=kX51Kxp7M3ye!Uv9UCPg7`|DETl0c0YCHxW~49{KFkSc2;CQf72%K`s$my
zwZ@&`H!?LDvk@c#`4mB|jW8x>wj{+;7xK-^Gg`A(OvR+c^2)M-)fFta7dy@a-qRbf
z=Vl!p1HulYpGQKO#J7y<+)1~DFyRW9f_jZ7v@_R9(*3wwf4$?!hb>4?c_aZb4g{?O
zAC|=Peax%~&cESlXX0100qPALAxl2NpXe*M5!qtKRb7XUe=r0mk^Zw@<D<$xGBG`p
zisg^_Z5sdAI|TvioiQZ+bsL~S>;td=h1q+J22+!)ZEi-_(kAVP7#JD-DmYl7e31GJ
z--5hRP}R8M|3HKK4`^%Ot^a@g18Bu$N5Qo-9T2Zw;Da?h#J+f-HTsbB&C<$BPQu8E
zl2Vn0{b6=<-F9{TnQK&h*(Qyn-iMOlzJq|R!TgxFfH~*X@{jJ^nxCICT4teG*c5?C
z%;4Q?jFql8;F~8e&+)M;hnHad`;<#`k=RB~`v<h)ab8}91(B?a`7>4whr!u`g4z;b
zaWzSP4*o{K28$r=;&NHzAQBwbPPk5>-pR|Kc;i5FCRg$KU_{c*43D6rC>f)`yTQdd
z0_@Yq2LX?b01c3nRnS$^itD8jZH+hEAR77=9*(LlAtg&v0W|SlD}=OX_|DfOZ%v~i
zw2RrUQAG(Ap1Li+c*6*;;BU02Xn4hZcjUm=J<?EIiTvcxmWf%BReIYCKK$_a(=~^E
z-1{XWp)f8-+JbIX{8zAkT3Q47flOz9i#i3ol6v>#dY5J7Y{aP05qtE)1S%G7VCM%o
z?|O6oQ%)NLi7<aDQc}O}m!M)c6~#rv?v<HmGYeu+`WV>sqRSn$cVNBM5p>1_y=$0w
zfao=%^8q{6@rF{i=-oG~<H7Y3VyNSm!gyrYX8^`-w*evuaSlMc)#xv>j=x!=rE}Pt
zj``zT^MAg+bs4xZv%~RI^Ayjyur(gbT}om7a8fPb94-|R<AN4NJ;^s)o8?qjJ(#+~
zj``%5b9k(@sps{Ngck<hmbSg7M}nlU)$6he#=U392#u42Lu}I7UsJ?beRg>**5wK|
zpUk3p4#$(#W>yDkNLbAEO05Z<7GI3tE46N*v_}OF$HS*DVw~|=+N0M5vIH3$u*b@=
ziHfpihCe`SC3G}Jd=`RX9``Ac$TkEXsZn2^zHAe+WW0Rb<GRU5?bGpY`A~k-;hZ?v
zp`^>sMuHaJ^$Bv(`PW1w#GK?V&u(fjqUlgE>xwNRiD9p7K=0=AG+5t4Q|195WJBpR
z2c@f(6;QkJI^~Zk5v=2wJ)B(yKECfV?C?Vzi^pTaZaC(ryj^?^qSI^qS!9^5(d>?-
zX(nh*P&Q0k%xd%OlM$S;(Ed6qthom;^QZRBzTGciD1Y7d;W*?(T))4)&IDO(N}Z%3
zX=I%CkyiQjuqa+&@_7l0w9ogJa-`9%W6lj;QZnDc!ZmiFIi=erOZ?qdQ^Ti`TTLg{
z+$=m6<J_ucwc7Dj9v&9cS2$dK?^$Y3qt~m<AD)eYVZ<nTnY|+9_yja*-_RCQlfw-g
z=zu`?;6t)#IL`V0wbJ8t;UL!Lp!vSmXhgTFB%WUj(`G~J<!YO=#*E8(%kxkU&Pb^B
z<Y0XLS;c8;fPn(csbd%SVZ=GzGFTkat1(sMsHjjew)AQC73O<LGG#Nh+39Ej)OsIi
za^Tam(RULb>+5f|#&FFaiUf3#cBIj%`hgK}vkkz!CB=L<7-Ki{{cG$sXSYaC;4wR{
zxS4;a`>%`Z+#JWTg@r>YM?FEoo2aggt3j70ZcH5GUuk8Wv^(0FIFf5E&mGgsMPME4
zgw`~B7G12U=3BP4n?lsge8x)`cuP21b0>62HfzE^Qx8#{F;NQeeM!&4ZS=VpxTII_
ziPqsRJRgG6E-#VS?!C!JbzG$1pDUmpv27R}%S{`o6WAWZfHtqYCFWZuz|+#=dwZ=>
zOE)rQ%42h5zt6&ArC)`v`WJv-PN!IQ?x3tz$EVnrfP>~RhaRgmE8^_U_7L7<W^H)1
z{y2Q!5nc3g`Q6)^j;X1-pO*~trLdxW%}l?)S-sSC!c@yYskTFp>7@?iZ2W?Pj^PWI
z)lQgh^QB&Yx)Wxt=Y%cIePv*f=Ztdv=tC6V$b_^Rs5j_Lwse4$gV3$+rmnCkN`vzW
zx>0!(XM8?lXvfwpx}&bH`jtQ-ELcVNL|)oj!f626PMKR}I)T!uxISXWh!Smker$%n
zC_y4@pEJ1L*iXZkT}D+et+&u9OSY2?w{5RY2_OMuDkaYIRVB0ec~IX<mAHI9?cFL@
zI3_ekWNAq>sxTtDQCzc)w*{PL#mrchU)Yv>vTO81y%_e|F<?@B7S&B@v0Q9zqq|e=
zR->Icrdr09cyt#Au5(@7Cp&2!0dV!6<hjexp0!pKq?C~;t0<T3{>OjO$SalCi{QCh
zYTbE=UiRL~sAv5t{|DQgn%eN<=dbm6@N9${6X|-s1Dq1ynXy~B8~r{n*x({oVD4(}
z44W)%c7HWktWWb`W$DQj2?N!KUeTnih&$~Z2wCfa0Ro#DVtL{?pTE#H#101VAs+si
zqqXi!8ikK0<O=^&76{zj3=}&HT6bOH;uCx476Y2S7RLrgr%cKvNA^qz_hnUKRo4v0
zoZ59o$&h-1Z+>CmpMvt3{Q!ECTEY^;=#{NR;gRHwH`{B_SDDTzSfUnkn7Z;RZPf1_
z1U78*Ka`!_@k%E4n$2H9pTXe^dg|K24OO2jRVPKozbLE3N+@>RwCDT@{k*c+4<rl^
zIhPvKwy_a0_oh4akf64jRZeS;b362w?L6nQZM*-@SEkBp1@dim=An6{-`j{%5e0Sy
zuQA3@`c1Gb=BrFEY7VY?IIU>w8=sLU8!5Ji2bD$7-V=brR#U+>Xw~H!lVi84acY%k
zQC_1&Wt}n6NrPy6&7(8Zv;G#tswQC}TQ~=Q`H{X*e=YKVF3!ch@Xw}ZNor%Zv;00H
zUKk?#H)wx<QA0Y3IheLS@nh?oV1$V&m5z&`EuosoQ$d?5re!d0r$|1#!M&M_*)ae_
zb+sX{uvR}@8LUU*H5=ZzSGGK`%$JD$a8rw`?MMTInw-wb=dk@|*w>wRkfAaLK0jkB
zx#Ite=S}RU<42AanLd8csVgR|RfbHAVEZnlen_djzAiNA4<QKcLyg}?n46E8`jtX6
z3spM1;8r)*ck|kkDOa|}#o8u;k=lM9hqKkDwaMxXj&k_yUHW7lRU+(Nz4#q$7U`M|
z%zVF#CWJ@2Dx_shrXWU7Y$54%MGHgXC@NBpO0I%4P&T!HYW_kZVibmSKgds&q{#e^
zjT>F<A@}LsKxjEMsi-9xPZa}im<Gk}N2&p*F>107S0<cYb1-!$AsKvT_Z=wNzK<Pi
z$E32Tv_g5<lk&-{b2t0r5ysA@%;d~O`C9n_g!gY1#!{2tWWa=GWyg(hJ3)m596;Jz
z4X(w+#hEtt^t?dFDym@vXD@|B*0i^m?ew$&xL+~T8{K`qWIweqm%_ATc+qY|lbP-o
zr=;Awh~dS&?7nxZ|7&yrjnRd|!(-vjT+9JBY$unt>R{F)zQysxymb!FLNSw{zrlxw
zPeQxz_QM^$t9OC#Whun{sZ69$N|9o<bh+-zgwXq{2W`md(pSv2!cj4(VlDN*t`0uP
z)iFwuJ87zOmtwiYs!&pcQrOTDRh&?<j>Aiy5#34`e%dA%kbe_xEG-KyM*W0Nlc+P#
zBrJM>#hD+nKQH{9_T?%(Y;Xd!*3(qe*t;}^1?Mo*I|?OYh9OsQkIqqQf8)gAvhjVO
zZ-^6{7f;K4N#TdKNKqTF{KFgC@A*kv@T!%C74t5kz!$+I8tL#jDQbezAmzMjJ86nX
zg>M4}q}Z5;W4|p(ucpuRFK91oyp0eE#6M$Zk+yhhBDFmv&u}vhsM;J&fKLHtJy@3x
zB9in@o3DZ8n(VQC0TwnBMLD?%>+SH`gE4(utid2P&-eywOuLS@@H{cOW1vkH%vft1
zQD#K}M*f-ZNZf#odILRPNHg;n?ozo8{!j0|g&q7VmJQ}#zMvc*8HRUh+V}_AD-Tj7
zGVg<FFR(BVNH*Q|*@9>V4L3*OdHOLrDuX^-VczUKLlwS*fZCia{cJU|2gp4b$;<Is
z31aaqofa14n|XOnWkA?PsRZU}TLPb?2lX&$`tgM?-+~@4Eog8*J-qvaExe8^DoIM}
z6UNW@%fXh+5y_PW>ogfuerg7wUv+h?gtnE1{GJt}sUX|3qK@0P**Y2R>TdQMC0*~2
z&$^i&pFmcJw+D;s@8A5bkdp;(3P<7ueZ8+@1b=VO0ru+>A$5qO?Qxsdh(NPHxlB?@
zbk&kA#n8MFxN9sYtUMLSmIqa~(!q#Sagi^j&vwilI@$zWa@)N{TnZ&_URwMerz2KX
zqUuC$D*A<-n^$U_hKNTVCVe%Q>iV(=<5cpjbcmDgikFfnQy_~-*O0AGc0pQ18Od|N
zk2s*BBI?+=x3#9af20TA$BMV(^Q}Q-CP6*y*!bqicdTp}D4&gyjoQTLKq~P-gdWoR
z%&2q-q>V5jxq-e@gz@M)dGlbg#`O&Bh`1Kh0BgWXsXvas%3()Q)i8B8DR6L*>u<1w
zF-E|8X{h8y6B6ELk10&Jx+1-sWs`5*!s1cig)B@-vGIn^$o~N&aG(BU_(W04KJ?kV
zpK7<*^?`)O9t!F0MaOh1%Z5kSXNP+5>CtT^D+wNIfm+J}Q1pRkfkHuRWk4LWU(4)^
zo_{!FJssP4XwxZay`L76y>kecYtJ=vUe)V1Z)_cp7^|`2-$R}OH<%J1mm+O7G(s)X
z8qHBV%ff{ADBetS4)ytdqN4CsZ8op1IYo(eX8EQb4YL-xtL<Y_>yr8!{PS@$b6`Wc
zk6YmS`Hl|b`eX9$OmxW%c}eVfnFqyV=bVpaCFmxB4)>eysVRwF!h(i8K4$N#z`)0U
zicLp`JD2%7tB~S6nYI4Q`k2*mdOFSeq_{<Yym#ooBTwEyhjTsKoR@TuSF?B1@Wkt?
za6?BVJ7YWBPh)yMQDR=<$4Ylg0tsV9?h4-J$Z~EUoROO~dG@r+Q<ZeQyS<_aHm1Q&
z>r7B^NDAwyy}zj#i4l%MWzey7_T>i$?IcHO3k!*28`feJ)`>*N2IF_)Lvs1sBURdz
zsj4uNb~-l_cv_GFhrcp^p&7_`SbrEIA@&HldwJ|q!*Azz=!kytG}us+d46{}V_>GV
zcE_)I@4$9eEgaqIaidG_XLsbP`=q1wE!(#<Y(2nnj!XZ22cD)vBv8zTo~}=U0s%sT
zaDfvun8UuH5bg42+&UZ07djX^9x-rN4-*g5jcP$oawV20uh>`)mN%%?LzFS~lPg3H
zs@;Wew3E#j1Eup*KAT$(>u*&Wk;t;6W1Sl<#d?a%;e~lAe=kcW>@(^&5#<g8M8x^I
zxHwzBXo*`c?P&8(MD|BY*IQyyY&eh_h-tas)=ea+sVFP!j4Te=)iF;*;ay|}+=xYX
z7G=Jk!)c`dka9Ut?0ohHASxGyvqkLX!tsy1z8W<~h^x5Rz`it|7ZsOY*W-*A<$hG&
z-5rxST=FbhPqDSAp`*uYEr-kf1h^jY#DeJl-qkZm<vSx=j&UI_9C_QWYnt)&$5_=u
zZ-bnovW}n!*QjE*)ngUhvCmr|TC~c9JQw{#KRq|RD1xCbucf(-MPUiMkJOqf3AV#T
zZtT$|s5F1GbkGU!fu~d6NJmS<p4!KS&$KC4*^fgCS|)+z$b6OTYV!pO4qINyAfB|b
zAuolvlqec5e=w2S_{6w_{j9@PT}AOwH2L@dZbK%&j|=%-u<qbQ^1x0G=3;RR!E>SP
z520iSkh8(Y_fwH4vb@~JPhBan;8kZu6>a~u=?GXSm6<tB5rfpMzz7EY{%J{P(CL%o
z3eDnyGqblOdgZ&KEC4gCs+!Db9T#jmLZa$j=kFZF%em>qXe6Q&C}#1ipffg?P>UhW
zff=QfA*D%GG3UW_kUaj%?T2EuAN{QvqrR2WC*S1Ppf!rGaB#BfN{5)(n&Hb$ZE@3Z
z0aUuLIB;s-eX9s~%bC`LD!}(t+TdqH^4Zaa&iDzf^p<^pUhLDOpMQ#i5pD%pf;eUH
zy6>CTCw~)BmRB_F+r7o91ks4c;0`sTyrZ9IO&#gkm>%`8(d8B~bFaovrfK8S_hAzd
zkoC^WxX6<y890d2f;QG<<qKHqIB|hC)LY{|Q9xB|{i9gn*Gl(L=ql-Majk)!4hc!=
z^@$`oyk(-^b|*cOliyOJUTZm+9;POn6u1D1t5$nHVnU(*0T1Q+Ycv6!#-#i7M#VGc
z%&w0uet0DN!SS3TIuCLaj_czGzmeXB7mLu=V6)3EY=DH8cW$uJQgbR}a_Fl@TM%jl
z5k<6gx9*m#iwF`#PPAvUCgJ77twJyfpMDG+Q8Sa8+Q~AXb-O;u0IJt`prtpO83>;7
zTy)vt>RJ*Ys0`dSBbc<$+T-OEwPcLiTJ0L5+Ox~8Kf8Lox&nTRI{MyNO)@OHvB$<G
z21R|qpuQ3um(!BhHD?viC|~6#umfJx<)kpqG*g3JthqSuOXxCQ1oSG`1~1;ACCjH#
z2~i~_ZiIDL6-I_3PK|L(_4`9Vb)B8bVRJoC8CO=fK1IHa@)7lW<|?1g;LmH(IoDwn
zvva{|2~p!OU}aUC<$+kzuh`zCun)DoZh2?WH(RDyA5dd7xHG5Dlxpvat&eo$OyThC
z;av-#-<-ecplNM-CTyTg-Ojowsu!zZ-|;-do9_DFhe=Q7Eah^-L|m|O&O9^Mb<2`(
zE>OO!YLO6PRdGxg%|*zJHoU()C;SYB%4hqYKtyd6Pto7OqsSyDMO>K<=g&72M1}t%
z>ORrmVY-_(t5Sl6SulHEyq@Rm{|I|Jb60H9ek(d`&agfL4X85e2k0K&z|f*RpurN0
zE_)NbYf5vr_bGdIfTviS&_Hx_2Fk6}Iwx;C{5V<ucm1->_g#8hMfqWl=ld^-OrWUU
z7Jn((Z_1wO2<<>HF`+^j8xy~u^m_*U2lb`kS5_yP87ifBme~!Z?&PXY$)(6gckA$?
z5jm-kJp&Zjzyc4yXBt|k^AwlQcs}m~Wt{zCcUYHP2dx2$TOqdF2ISU<Bt9yIeCMn|
zWrD}jns|y4ubeQCbp=I=EfV`LVYIm!5aI7A?{mV%HJS$*vcr7D9Sa&l$ezpC%4i<M
zYP`Lqty<GWoE;<R9U^?MFbLL~RZkJII<DaJo}wyWb5sY9v$92g@ILBsVyYS8SZzHA
z-lX7x`=Uf@Y^(G)UOmv=H-|};HQgOlIhq9C{(;qzaKFrp;WlrMd-`Y(uIx{=rmr)T
zZcifzVAwC5BC!f<NrkmQ+Y)%ty?I0XFKzXa$37&SY4_%$)4qfIeFE1IzucIKTco^}
zj?tvi2u3ImbtR0-hh`N28w2;3=?9l*>zOjLgP4nY>BfnMVfFDw$&3c&S$a%E^>{Cs
z`=kCdlobyKM#F(r4cn91_g_K9-HG833Bmr&OS|rnA>7j!idf|@6<dl0U|u5oLMLKO
z%+J@n9V{GuBX;O&8{Tj`48ku#3R#lSC=BH9I#C1V8E;&ES{l@Jdo_Vv_<D8HQcdyy
zb+Y+P@D;;u9sFXt^kC;4AV@%57|J;<F!QuN*UlEsRQAKWa<nhxWdjpHcYzy!H`Uf2
zt!kK=JnUErRA~-Oy=Lf9*kh)H4$hFkdwG!L*89HdD<AngMGyMYw{>8<6%oH&6BR-W
z+C@<^)&ap5s_ZpMgVZ$i<X1D=7>IucTHiLxD2Gv%pk+Vt0cli|s|7WS30=>NeM3xw
zTj8YVj#gru;pB@Kmf)ZqVc0+o6mCW@wyDm)zAA779{27N(FV>y1hGVRd^BGif?p2z
z*8}p&eU0~c)J^cjqZ{GDMqVo(Oo^Fe0=o@MoBOxtQf%xPb2qfnupdw)UePc+H!y&)
z#J*SgvNPY)Vw(&c0Y|8r&4<qnMMek516Lron|U<9qu`M)`iPP7-r$_T5?Liv_BX5q
z@rB`Zy~95dM!t9subD{_VaC(k%oJX{ZkvvuiFJbTm(%4UROdr-V{NQVY)<%3=IZBi
zYEcn({EzzW<ZbBTiF_EpMf?*Sb5Bl68Zp|aYyC#SO5B-L-fO9e;2B`pdvzzby;*cY
z-pU)#3Gj_g95HdO|KE_G|I|>bDZULnX$%@0<&uh~QL_phT#FzXu<Yz#gj7M4?$Uf~
z{9Q33Y*c3(_KnQEW9%NoB7}lVifUW#zL6u(+=kPQap@@{*+4qjox^<qU*N>=vd{-6
zk)<`^haNWT-Vl@%n~>J3U#}uB)UzSX4whsLNtyWS4uKrdPKHCWl!GnNU$tuOkJ-(Z
z>*20d8m3S2$s<$L>1di_*LUPHkmp8c8G?1ZsY!DKuAH3)rES788=^;FrJu`fj;$*4
zgp9feb7j`oLQ^~PnvaH>^8I3&S57NC#}kD9W7WA=I7~A>!pr~|)%GAd*DuBC*^NxN
zt&6o=v5#%K<0bP7?yjoCJ-2FdHJ|Zw9B3gY<j|pL0eyZ&D=xi;mCVRHvzuH^z5$h3
z?sVUu=IOaOFAjr_1cw}!b@<+o*~T4JS<H%}|9#Xw85@J?+-4}0NU5`U=gq%+LMGUW
zkuK_+F@sM=u-Q59sv_N~5j6C=vWoj*)a>ESo86u~u}~%0Ct3yQk{b8Ji%)zR`MX58
z4ApbmjqjA`tJ&wzPe!0?u{`(}96AyS>rhx#6qZ}hR-RjgcD8=`QSw+uZv%rbkm>M8
zzK|HVqcLLlZi8((O5eGhljhpnbyu<e(;ha#t|(9$<;Asdy7;t@*_{e4L}Jf6udwXT
z@BV(#(zWjO#Z<7vT&Sxx>A5*K18na}#Yi3@P?*noKc5|y!-H*;LvS-L@jnR350PQH
zH9w8XUn>KDe_KcZ56S-<s`5XH9N`Lx8{N4GZ`jk>wdUOrF)6xp>-$Thh(_MSkc;_8
zE%rU-p2sU!i+b-=&&u5C8C8T-=;H?zteIxyUjKLWUp?1B%-`gJLX5MoZE@-v|Lon}
z{LRwoqWeV)F^r^rR|elSeC!o!+3qBzU+%_IV*NJKL|XixR1P2mP1W@87XPCUZ+6Zt
zZ#d2^cW5L*!R$!!4G$d+8e!$;YXsYlb5mQzU7F~%4|`5VACKRIjaeU^=@FF?&q<Y+
zC<B-BRdoi_oHafd%5=c;(=A#TWJO5b&>Mu#?(5ea*@2t3HbqR|DaQJ8IAwa>`1;;Z
z2|ew?QRlMbM8~fwxb28)Vp3F}San;K+?lIRYt|_P0dt1@U-LO~T5Ct6|2v<9&xRPR
zD@VVvN$T;sRp<V(Fa%?<(bGP~sj$XAY<aEBgsZ@jvV_=?`6!Um*Y4ru4iRmGG`K^|
zbe{u^h8|hp5bK}tJa!uj_F?|;w@v!Gd1fNy{Yf62HTq%kt;-^JUrkDdo`0(ewaGki
z9-up}x3wYqM%~7eiO1mn#1Ws7<X;HERg?JF_M1YCM(jgwlssP{2L#6P+t~@JB$=-7
z`t$ef-@vba`y}r3S!>fLV!yi$JVdI7e0CQ4D;`gvC-%#7eQe7k%)M$BnA=K<TU+{g
zc!vwA{Phnt@X%fi5Ko~eD_YEm*h=zX!p7{Z{v~R~YlN}tXm}C+hkqy6tk7ZSefgSe
z_YYV#9BtS~R~CAlVrQ(w3$4M`^AJe}bD<4oQSo?;9zxZ5$jq{=CTgAjg?c(=?_g%4
zhy8S=<pWuYJ28dZ3!)qSC9f=@Iw%x=bF<Rrg#`*yQEzKjifzu6TSHP%H|eHb$I~K?
zYFJrY-rx-s)MfiZDIu}m-iysVo7ji9q;Q(jeGH=pNfgoOazulUiyuLsdj9HZXicO4
za>A%y!y6;ON@@uWfU-$j@ez0T=EJXHwmLfgGdCymr;H_v{gkujV_Fe1*0R5L{Np@@
zd$JKcn_QQe83M=D{Imx$x6yRHnSY6oIIVHI?b+zu60vc@X=|!9Y8%d5H$>5^vR}9U
zQNMqAn2x~9oslAHDaYvFsk{9Blk&}}f&~^t_cAo6Dx>i%uvoD+7(4Ggx>^AX?_89p
z&q&*;3qf5J6x+}{I6X2yX{5EMCZ<39&QLP{o{eThMhSqx)W*;WebiV%QW7B7+q~;-
z-+4tN7>5Q>_U_i2&_fS<Jr}%~R&)CKOFXb07$#*ii8vay32swY$gBxDGgZ_@vN1f}
zbk-ctxW0DgIOnB{ea!;1bHaf2_PglCnaxSo)H>6f4i8xGcV4hB&D>^<RZ|TXRmNvI
z1q!>l{T*VX^Wl0<9tdUHfgifYMJlTg!tK!nBvlLkf0!q&J?`z!ik%=J=U>}QoTE()
zyO4wc^_NzoN-N`|MSkZN@z`xM;9%*}lf4eEDxrWnJ67#gM9fNY*kPsACK<hF>eQmi
zoXuf4P=Sfz9OrDfvX4l#@_kuov51|;TAeScVhDVEFtnm}L_y;-yxRDa(N!%6jaexo
zxW5qt&m0bC0NW4RvaYeFj5I)NFbJ_c&&qUFw3D7TC_^47j&NOYF|7Hplwx2uBXm+|
z$7PB!Nd;iX;0{^N*pM-{#@^YP;abASJTeP310%Ov-;ogr@OQM*C_UY6d^J9%3%Yuk
zUR;T)v*T)L>oWB61;|5mxRg~!D&l~=p#ejc>;bb&U+GrIu8Oqh0MW*Lc4PqHmyR8M
zx<KYo+B!!@P>O}tD3hmLZ-pzIU1viYjn|BO^{jGAb5thABE<bFtQPM|(xv^3E4A4b
z^@?aUet&<a-WBC~`6btSjcSrl*0BS@K_oBiJ7Ny21vQ`oC~<HcXkvp&+xP<o{j_`2
zE=j={XK9OyntMEMD%mK>o<25H`1dJEvvFt>wGT$DoCaq)LW?JUAb@70`=xys=g>-G
zH?FI$)P@XefZP6VEZO62P9&v`XGSBbceP^(hLHQapF|njDXt7z7qoBqu&Rnms=$ZE
z|L&wprnmu7Ak1B4NjJaYV5GM2`(O8AV`4=n$FoOitR&R8F&V4>Gy2XNK727%K}^K;
zO{9-`k?#4M(YlH@(|l4SL7PMKaTNr$=AOY5ukp}B9Q=A<@$P<)J_sMyQ^1j$83GTV
zYCT!F#Ifx>x8(tDl)=FOh)ZmmezzHNTnqdsUM${(JylT96KgM*zq-){3kpk4_6J)H
zq0gCsQaG?z;dNYV#pf8tfc1Sa+b&By$A&(nNzLiWXv*QX{)=^bOl{p_a>U@5=~sG)
zQLZ$Pfir$p9!VV5|MupJ)bv=vkfitOWOApBj<>SYlEvX6)0*Dt=!38$zUE!Nca>Mm
zJs9QuRCcZeWMWQg@+RDf;o-2g7h`{)a1D?0v|~_3?zM)C+h==dhqO5wD7oBphwYCw
zG+S@>SprWOyr=ikj}bq}M4`kc*~uNrK?jvy=tHNcJ8Tm35zotjH#PhR7R+P5d_AL9
z->*GEinK90Ka+=Zu{81U6$F+C1c}IChQx4&YvbEL!jV%5BpvGuj?<v6tf6-=Bm>EY
z)kmTizhwE{X$H`RYuwGUw2E)^Z>Y%=@d&e}xH1-yJ}Vj4tDviCA`9~UZrvxqr+zp}
z<1O4a+MKLZ`6{ZzgNkGjKtqz=?uQ^3>$m;%VrRTt?7prUx7=Qqcr4XtE~6pu-^a!f
z?e=GXTHMi^;%2*#wZ%Gt*CTzF*b;{M)8s3-K^GD_76YKI4ZlCx-zSR!xHq@7?3|sw
zW?G5C>zbu9W!wDFB<?rELHn_`ODQ@yw1Ug3Wj7cFmtRC4A6^(ApKgh&c00-%bJetj
zX_Rt@McC;A#Xy3%==$*GD>Pi!J*4!hZkmWV4t&25YDh%BY(}=W9J8RKCa)SuU;eYH
z4%5L}cdM^18)z}c^)(S$NROCivr!tOOl(elEIP>UCOPCIW=QWTA;0}weegT8xEdp)
z@Ef08+u;8vp(M6@^3Ec$;;8f2rtYe!OwrPyrm-+q;z|jf`;(&S`_^9j%e|0h+G>!B
zH^mk~mR&(|VQTpuMR^D!<*-P8K<d{<*J$+!b4^VR6zVS<Qe;0X;%QYo*ncF>$EK<V
zGtj}?Df`voH2Mk!u06~uY)YDF3aAj~g~rrMRGgU_?FHu*2Ko%O+5>O{BU)zN754B^
zq^c{U!w3D(KS3YQH7eEnkyZ&lVi9`2e(hXNm9PU|Hc{|`B4*VS<3<;&bdP322=^I*
zT_UC8E1Q!M%U|>~*|-x_RO8c=qYsv^zi5;=L^b~e5rfWvR{XJ>t`G8L{e$VMo}j4@
zb8W4)V{THB1aW<J?{@00iZlG`qNvqih8a&lvk=J>K;kKi3Ug&8P?T`Xk7{FJYv4ai
z0&I~DS}D1zo~w@Rn&PVn0)GvQROC2IVzRf&cdYdhEdagYQ}3h4%_PVjNxiR-X0tvh
z{X46P7wa$No4t6=#HpZqPxwRC;s%|1(CV?k#h;wEHiEsM_B2$y!YR|L)i?KUE0s8t
zR@vSoxo+>1fyME>V^n)>rls*x5aFrcDCklDUu7*x-;VI&8Rp{B#@maCv6_y3YD`9*
z@l(G}7|OLe<H^V1qsTj!^AVcdO4bYt*CEBmJ6`|VsnY7T@^OUT@AF~aIQC1RV-V|*
z5=>$uOmwOOVPDBEDK5pLsU~q!aQu|H7l=dM$e@5FD&}EM#A27TotrXq<l_-Dq6?ft
zX^ZdrP_au_aea+D6@SUNU1l<--gsu!iE80ErLOjx7qYXsDr`7w%Q6ce3BWQ~wbxkD
zCz57MnB_RjwI!Nzc@}8(f|eKEZq-_wQD4qjU)e*K-*19N!Rol?rAYmYZ=CAmmKul=
zI>(<_@XPpjGN8q~k(eOrW}_InC2jpP8CG(gNsll`!2;2VjRB3g{eXhiO-$n43a>&0
zt?GPtXC5XcCo_LoF_TRn1<NdPP=g);dSYeL<f5YzVu2y2E!(F*ijj9!#xJd;Y|i)7
zI$6WDnM3BM0ui9uIgyab;N}{UYo=2Q$^&GL7MIUhe%O><i5QsHAYFl!7xF}T(q_XH
zz{!K{9imVqK90Yb7cm|u<=iGW5%Q?I3ncwyqvN=(wM&q%s4#go3If2cKhx>+Z^z}~
z#iL@J$SXD3-ej%0CemHsYPGZZcw3bpRYHol14+t?{?pS-@=(4ud8or(fA0)IB?$Qf
zsjwm&i9BX3Sx&V;3zoy1oxg%pzU+F-<Jc|X9nU%MpyP|l7IU^fvo%^zoo!L+^%Um<
z`)f3oLPpKdu?CjvoItjv33h%6=f;HN`C|J)iv5=XzY*h>Dk(P%aP!`vd7Kj~?t`Pr
zGx!|KTIJ+B<S_6zYoga%byw3_RvLIv)@qEd>Ns@%s_yg>A-Jl<RQ~I^i=8lDqY>~c
z^~H})f{t5X-S=l~*F}N^<9ua>6_)DXKlz!JC33ggLe2^if2clitvyZ=@nZ}G)H^w%
zB&C4hwJzN+{B8vBodotfwQLV7Q>Wq#Iimz&PDf^lGw|L$1?44<SZ*iRnol=unmwPk
z4|5`)(+m!_gY)jY;m(Ac-NmU&BJ}pN1m7|fxoLJK0uBDCS6j-Qof81h{7W0_2R3I8
z`v<R*8WFix)l=xKof^I(Xl))<^4jhtrQ7ZKci9a(J#X;6CtC%P+Xm}&b1`764p<?r
zk7NQF{kO59yc1KWNkoN6o0qG8u6%g=dq}`<;bi&BOI2a=&m^x8*eKIKooxB-N3Q{P
zqoyAIphTf-VFAzR63-{TTGFEUsg={)gkn5SwXeoNvf#!EAj5Gq0Ki~au8Emq9_=!4
z4BWS|H}blxc+q;#@cw@Dz4XVVw*6z?dYr<L7VtGp%dX|u(&I_XLl%xGw|ZKuh1^p?
z<Dj4c-;OI}O?0sa9&3ZPkBJ!)%WsjkKo^TL$#-Q13f|LbNmsPo^bEn2yk$sSc4lhX
zb;STt6M^vw2rK6}zB63YTr3B{u+7=a-nvooKr&(m&)El)S%wQ|B$%PC+AO3GSGcCB
zS5B{tqN^*&ToKJpi`#QozruRCl83)b1(U0p+sKOfHwUEgW|4${hBRIf?jsW}NNF(}
zxj1lOf5%YF&WqC1AaxneUuoK^Oyj<)E0z<4k<~t}rY@sdZgU3Q+FmOzDr=B3k1Q%C
zifO|E+1lk!+(BU^McX!~4QeD>dGcuCS}fr*Kh)Q{Zu(IHKHxuEc`%Lap!vnE@U357
zFc4Z9G*?$q#4(dNTnjsN=*w-YQT&`;>T_yc2M2{$;2M&nlXS~7gRa88624+;deS?%
z)?;2yPcM7k@Tw(_;+g@?%H>6SB=yYTqRx9gF>;TL&E&nRaNV%9h+n>WvOxl09$|&-
z2S$Y59<J2yif&6l_wxnBIj1=)bHwH1#1FZ|+xylropl%$1#r>Q|G@LGRb-~{@)%fE
z@{o6mkB>vFOD8ee0XLxd!irSFOjKx@48A}v$Sgb>XK1geu@=qYVhV8ZK1mo$A?+LX
z5`7dhx{j&lCHnkW6ti;uI-MR79M1ZnY6`IhT7XV~%y3$i+G3x@$@3c>w!8_SSBL8u
z*T)px2F|%U_A9d|0-Pxc-LG_^#?wKnD`E9^MQRXc*dh+2L;*2*oM^sF$ml05E%w%n
zhxjM@-Web9r+7(U#@A&8D6(ID9(8arGt&|lyOtdFlvmq9v6N;<@9Lr%G|H-Vw0WOQ
z-k^L`$URE!FP=^(;GJsUC$yLZy*x81AzuxmjSs-kV!cZDX7uYcjWk!dkN9wCEmP8P
ztxp<3D?&ar;QgCpfu28{rT1#v)T*4sO$S_olpC4}UxVileIv7(Q_UHNdQM4`UybVt
zqR7s5Czw_6St(+;3=*XwuyF{W<7wbOAe^$$@&tyzBEkj;5Ic#)i}3otQ%E%F|Dy`-
zA{=e1<R1E7Fq|dvYWtrs+<iZk6&-Ki|AhcPeDNRHIl;AZYsA{x8goYNUHSfcb&X<@
zBmbCYCDea{x^H-Qhr-Ki@vSvA)1;Wlj^u$rBwt@&@PB86M3l#74YIgaz6C^;AQUqV
z(YoWh@w5CQf@AgMy;<p`ivOKnMZV~wpGYC()FXh&_!j>9%_N9i1}a4MXpy&yX!@b4
zZd>?ZN6fqZglR(O%>Xgm5w1y>EAkZq5NE`knr@3Lw$aGF&!soPp7(3AGxWV_dQQPP
z;qwbyWak0u>m-;S``OdHbbQ<1ka-4cLprc*I4@Xuk<mB1Bj{V~yJdz?h{N1CucUnw
zUlrEA`Pjy2fVafE{k5d_<g%!cMra<j6&}E^?$^no?#^~kKIE1dUL!ze2Ts84I&HSG
z-tOLbJFo!FSej~kviI25LdCvzK2ejTXJ*PtO2R-$L{1Vb$GR3NRKi{y-yCEYCCzlc
z13q2^%jKI6W_d5RqtmMl66{!qN)t~<9lew0F{@0~Oy9x^U@#z2wIh~iM(YKf4r7rH
z&J@0r<&3VgR3~#=-{pd!M>wCI23(pPLqcE3jdC4o8^|CIgTiQpp~;*g7AL$HIIV<%
zl1UUX3NP-Ywxs&mhfhtuk^DB+Z&#OmSJNWx5I$2w=G(>SF5*x)94t0v;89`OmF4P)
z)+JqT&f5@sxi2+ODa&$N2GDK`q@yP8gT>v3b$yA2X#|trFDKp7%7^QTS7LQWbTn=G
zfW?Niz7eC8)kw%CT5-tv<LBS8XaM91nAe#}DueZVpDT(o>w{G-5^tz^M7ibe8879m
zprEiiv`|1oTozA4c^2hls`$ft{TDWeBYZq#TU;4qcs?^@>N6%n1NllqLSmc)S9+^F
zy{8TmyBG*xz&oW+BKo(6ulL+1e}$^&UG!*tlqIFxl8SNCrdAd0rMwdA{QAzM*L`P4
zxKq%A1(h_ASn-;YJAU+#VUDoa(}t2AV~C1=l=R@(Aa0hWWC^CJ*E*U|Kv>h1JJW1!
z6lfA0?}u(Q815d?JoKg2$i~9IC5rxG5;4POV109tL@5qcOgnC*%36F0@DJ{oliW40
zBN<+W6IacSe}dW3ECh%;(n^E!F#0b;>w%ImJf+uHbUOU?FhZU*Smi>;^9n2@wTA3~
zxRbiU$Gb-prKLZ8#pgL}K=t8Xdh(9n&xPM^q@|DNX+BNQ&8W*uNfC^e2#v&)DxIJU
zp@FtEQ)P08vEu!{?h?kEXOX`Jl@+qY8^;b7Ua=tr9>Jqu>ogp~{PA-S2(j&mgG+F9
zdAis3>Vff2(E0Q?Yk*JqZJc%L)oJ?@5GlVTp&^D*!yH=}lLHjnvWMtNc!sNAK4K#B
zwB^q<^H`dCb7^CqraHw6efW&}Dx~<E5saqEND}3SzNXz6BPO~sJMO#l5&U4oAdl5B
z>-kOP#nFC)wP@_>NLTQ!sTtXmg@eWG0_#jL2`I1nT`PX{>U%WN@I+GFn;w(dro`C<
z9kC#52!fTMnV1bxQ}pfjH09LQOsjD%B4$p__23j=M37$P(Z92b4;QO)j(KS)*E`sj
zbE&r{dMhc~K!ax#jw;>pKaTVV7SJnx`kZBIggut?*t;9Rs-067&bWDqUW_!iy5S6%
zzWKnjIPR5@hdGCXMb_))&ixf}u9<5yU6(ixFs0YM`X;qcDA1o(kJ%m~YN+Cp@>C~a
zD00I*8U#KLmNP1D{TW4_C_0GH*H_t<u6vH!-(S+_u!I?3-{lXcHAUY4!e5a{R)9Z1
z`u;t)gAQa(PtM-*4^T~}(Qeh-(_75*Bpm5#r{ppMC)j3Ed^5Exqd(FJeLumd+GZzS
zEd4qZSN^vS^qPQYmS1_X!CAlJvV|kqdxp|{eP~CqDIRGneX8|N`+IHNN)0EhQ<Y?{
z_XIci8U(tu&6;|B+%y`S!H+gMh|P+Z@AN=-lO+i7`Dm08?rEduyF$Q2t7rlFr^C8n
zW9K3x;5s=uDH{>FTynCx>kUQ{Z@w*kk@i?kS?Jz}RlatM_1c#5-I||YoLgE7DGFKp
zIo9%rjw;{Tr?t6x_+l6EubNu2#hj~2-%A~{c~beG!n9sp!2pp8v0wx)!lBjVh|87;
z8C37<JCuN9b4t<bpYH_1FN%X3^*r<y3j_G;@xdK-WRvoTke;-eLVJ|;@-=9ta^Xz9
zJ*L|#+vMR4$^9}Bt9hX#5@RfSwwTsvEx@Ljf`7<scXe%QLnOfm`kT*(>%ZR=b9lyu
zTkaFFo^C6Q?482)E-15h&fPY5&LtT0s40UYOF81%7Zxk~>}D(4uLjd!&le5Qtv7(j
z4Ssu3oF5YvMy)HYte5rG=}gDetIx1g{7+O!g0HBw4_FX%r)&94w#5@}I(M`4*MbME
ztKCyONQn((4bMB{Nf428{g${v>S3@*r|WaTJP77S!)C<~Y4tQn<jlpp>Lp{tJgGA+
zu2t-i&o^=Nf}>t*nlr=@k$fGt8)|CLDt%?$JTf6V9cIQivfVz=u)EFf+8PBf!w9#s
z?I$$MDyfMyR2!$S1$|vxmsJ)a=XXK;;%>eS-ucEh^T;BT|6zT7ri{f~ds4^$<DNRb
zH#_dVDKNh2{~upO%kuKWnP+wE#M}|0u#{7Ug8cVi{~w~hI;f5A4fks)&_XHhRthw@
zyB7E0?q1y8THGzT7I$}d_uvrRHN_on`nz}L?&P1{$;|G~**WJu&-;iu%%Xyo9p^C7
zr@bqxfL5dsX!tXfHt9>JEFQk7yblt48faVD>z**{!S8kwj;WN!s$0L16146G=!l*6
z!bKDMpeS0i=yH}@X|<~Bg)1Z~1b?J@Bnd^c{Am#z8@uk6X=3*J^!**i$Kyv#u{)m=
zZ5C)p3v}IS1L8DAf57L9dM9whFk~Zs(VgGJg)FkzJD9aOEJ-wvP%2Mqpq+*I5{zI>
z-<j9wOwnqGTh5|1GQlU|*opdr5M)roByxn;U!4_KNT!Y1dwCmuE?nJF|DR;c3?!{L
zbK~MJ1iE*z*hRsR^Gj=nFu`$m^GrgeT5th}AmcsH>>6XZfgd$T8U4F=>ud`P`bw_2
zX#B_rq3>XV#Z1{OzN9R}^ZKrCZH0uvLO8^w7PCU?#$#esIm6}O#tACNHFsA-e16Q?
za=P6mNWATVd!-H$hR)^D`3Y>LegkaArYk~)uRHI)uRU?%WZvv{7JbJ&oCA79nJppe
z-113yJ%59YY&?+7;+%dbRoCHvImFkHcQyOYt*NQPersB8hix8TD=FxdCVO!1u1;j!
zhfm*OcjOO>?MelQ1C^Lw%31T1kxLqr{9H(=kF>tEMR>B~E|fIz`m_#h@7tRO5?l25
z%Q_SI?r8Dj<Kw4pBz{q@HLKJMT-^sHX$?-<wkZ`K&2gt4JEaoIjTO}tTsWU_1go#7
z50>L+|D8<W{p8RnPC%p*il9v{>r|3Bk33db>4HuH(tHN6cMsNLI6AwqHL$oxg5R{X
z%#Z3@B!`?ev-?o(x+bsr_xUadhrBNqSg&L36Dv~`$`XnhDzk8K^1vDTkeWF&U?XcM
z{exX{q4+ft_3(37>f@fQ*<{8<E-YW{CXD~nkprup?*ke0Jfi!_46deEp#sE8%KEJ`
z-!5jy+QKDW%=pX@b2?K(|0$u$+_$I5PCz2NTYRBGU5}NWB$Lr=eVO1Jj9_uM?)UB{
zC#e1Ld5DM(dkTsvH<*ewY5s{;z@97bkxFt*o}89E;!l>Y0~1?#>s%A@09q|4D@WI7
zn_YcfDLpxMcBPI6tim<>V;bznb=xJiB9PYuMQ3DW<hYAu2(@N`6IS1lSKZT7&?#S5
z5Rk{>XD$n8YQ4V^(0W7a`N45^n<Pkrs;}dkg3?U6$jUYldtZ&KrFrZ8JU9>Q@2Ybn
zws4rmi*cAjw%OaHO6dT#j|jDSG$8MDOg}l(FUcX<=u??Ial3v6&!p@x6w0g982p{=
z?1@+j8sLL{^!~>-1=R#OJ=<06QsVGDQhwo0Z-{1EIkCNyo2b5SjNZl%F+CbFjt=+x
z8$U-UQG|=4F}ZNb*%Dmxvs$hUt@YQRLbO;k?5@%AbZZVy^`Z_9mju@;y07hdsaU%Q
zMt_M1uI%`M=2s#aeA+QG&g##TBqp<!CVZY^VD3WR1Nrk!dmVOIwplUXx1)pfz8pCK
zwFO2}QBG1_+nq8#UQkz`=^Bccek;NWSH~MxK|_@A(SF_CU*>RHOKsbqLKeTx7dt;J
z7uD{rx@0g`S?Li`p36^+7Oh;zj|>m%*v;($Y7OUEaOky6cyJi?#*;9)=Qv;D!=~F&
zE)I`A(44$w2>s-d9idVAa@}<Xg%GOswYy~>loVxcmlS31?L6>ORZN;b`3G5tO$nLD
z*O0GC3@Fq9qU*zXB9RiSajM4C*zg&tKhGv9<(O3Xc-p@Oba21zczt^TcpSH=FKZo7
zRJh&t43I@S#6Tp^!`(bymy6u@uSknIv_74bc%VlKmx#M;q2pv-A6xZx!joS1M!Xqb
zWXaBPa7;8NxJTC`-usK06)J>Jg-5t1371%M8nmWzZLF`W7gP^o(T7p1r0qjtoTEOU
zJ2aKnjJNj7aw#>ti8WE%Fooa?!OI1wsY?j5ox|KYg1GAi`bHf10z;Z5A)x_L)+qy*
zX-{5b9XHF`Rr6I&r=tCl=aRusubw|ld;fA&S^nzM&rE6I=zDPBQeO3^?_l}>P{Hdp
zQk}#Ry11Lqm*w-m!*lve1JcQgn6<FW%_dooSA69)zx1C&axqc8>K{9!o*R@NhISmy
z-o1Gq;b(b2$p907GI4f!%a^^^o~q<~?1yVMDc`?2$lkO#>hRpd<jA!4O-^VSAkw)u
zyn4DF#}d$~PIe4<Kf(Bge|UJ<84KIo?P_hoo#t3;p&t)vng0pdY+^;W(IUBbo?2e8
z|M84>xXN<qN9(U@K1(GxR=*tw8sCxQ`^+PIbF8SFy?j8y*N4w&TJRMhLG;%otgJDS
zt?i(;jvy(rL#rv~x5UNb)*BI$<MP7l!C!4<ggD1CqiP!(azf$=`|FB2f2qIP;E%}3
zf79msp`-<TjdON{c@fdCWrH$)RI+`su$5X_x#ONY@({?vl9BV}nHOGm=hjTks-hkH
zPR$>~(}7`*s~+dXssqujQ9K-;n(7;+{LiZbzcmfx@+!^#)88Lf3!-vTUp(YstMgJL
z{+CK>9*LZFbU)6g2qd7^wMsll7<Blb`w|uP6t76h_g_D#yTsv4H9uvHlrd|TYT*hB
z`{;-Yw@?)9=3<V57ia^Ss*sQHOD1{yBRM<2Z9Xuj;xT;c|9Yt|3UtjJ&K6uCAcNDD
zD|^--HEi2+aT?6+{Bw52S3xx<2jFkR^09i5ewdK@Ue=TN7dTlQ$%8Z-gl&B;m!N({
z!<*L`=jb3WZ5t)EtUubNmm#<){wjX-WFcjO6#+~tfD?!&D6OWP8!NFv><P@OJyii;
zjmoYDi=w{k0{(8+qNN7L06Oybd~7{7{B^EP!tVNpW|3*5%B@XbS9D?~sV?s(w+lpo
z-j~A@%}YP~p&h}Ic~2>VZrEx~p}?2FXrKXgeO>WHDRkNzNBeFiQ}Od0F>g%u(R^M~
zvi<=gV`YBq#Cf*kD5`laYwHT;GTN=vX!!P)so#rPq%zfc6^9zMD{@e+E15~EO2Vda
z@s4O^LbGaN&IHau7o4QiH+?*C=UAPv1$%g~MzU*Qfx}It*Mp)hn)K#M#N(X=V|k+u
zZRdVDbd8UBscNqrHl4q*_#seQ39Ac1{HIcr@h7aRVuo@yu>={kha3Bq=Av+53n}j1
z+DbqnNQRMS*#L2vuQm(nyCe-vMc3B$3tqqbFDH@k{<RIhTxtQ0_4)g&E7YXbvTjvw
zYJPjgwf^l#jQkt1nKa5wUiN;2c5YRee`0y@6`--!WJVZ=L1!2><VM#0(iY)O468g4
z3{Kqwz4he5F|?p1#KpxuDF0y@VxJ})3jan^CbLxc6Q26k_}*Xz*ZZ+*wPd3!K43X9
zIRn}7&$kn<GER!wy-M}e+lMDUw*DlavIU`WT|S4Y4@MFK{V;n9VMhIzDoN<wR;ywy
z2G~1ye_M3z4VAS(i|Xv){;=*yHd`RGL^<2=XR%jXR?_RZq*K?i)igEiDdHYFm}#&I
z**P8|JLRixX-*e}_s?rh9?<mpd|V1gfg%sWg0MmaM@+XmA3wg;WZ#J=s9*n`c8r3O
zWAvpoB~4<r!bE=;_#EVqsV)z7Q>$GxX?BN9kjt$LoBTUox$=E>!$!<Y%F5m_KjS7l
z9u9Gr(;bZ_2qm^(Ke~GIyAty2R>&=6*ALIrf5i~l-rnEZ{sbysV+OgoX<trn1aGgz
ziy>>9dw1}c@L$s_yEb2L(HcAOv?WRC*$DExomgo%ZrA{C9h<^g{vBO{7XXaPH}2&^
zX^icKYD*7{wYOU&kqqVg?Trm%-q%mxr6z;0JV%jeYMdL3b`RstD0wezRiw)9kB7bu
zcHMLF`;;>u9~W2J_71McgMBtGpT)h_y`0{kn*vf?6R*ctms>91wvrQ0*>7~|R3p8I
zL;n4q9focW+nRZ<J`&zi{-I^0;AZ}f=^(-7T1oWuu8Acl1YlW#+!$`nQ3d&-rAlp4
z^u>v)h2%|vG-m*VJBgkLCDUu`Y)e=S{N0sE?i+wJ00aQWYn#d`0L*imu9lk&IUn|M
znmt9g?Ubi&JvkQLLwXn=7|yHzd-wm|dND6vwV2+aT45&Nj)YxR>yg>ySwr0UmgNC6
zc43F>K@4rTFt4`vtAN#~&?DhMn2y~^hDg`vudCa@%EIsNzXo(s^K<MehK4(`CQX&@
zA5S!F4kD`pvUmd6^#nRUNc7jIufq$%FNW(Y)h<rpkihCs{M0u=$LZURWWoP;j-T2^
zKrEnBUPZsxpXE}%RvVKi5#z)#^h-OojhY1rVhGt;jc021GAe7Cb1I#bH(MPfU8;c=
z-%nE4j`hs1W~zOOsPvMaIyannlsgrqO5CFIKv8SvU5;<`Lm8?~Y<}WWayH_Zn*ZX?
zqY;*6JcjFs1D6P2lED`rurPZj?SYp@CArd9%dXAsz57ujCYxetQ!=(~O*L4uGE47h
zxr1n&eS80>*8mP#iErZ@R><T$ri4rsL>Uy<5*@oU^4j@qcws{6Jb&<T0n;;EUc4L4
z$9xpe`S1lToADuuEw`-HXajY2Im4vYGp@F-O|#XO+#^wrP1U6Cs7*e#Lm+FEc6&s(
z%Vdz=s3#gzg`MqbCShIE2LwE1Cl=339nlouUZ~P^WO^FCuT>wA^syiy^vf8#$Y?~j
zMv*HxeLVLO$nH$KYBeLxMnO4P?%ZNiRhN4^J~AcN>WwEJDz<TD@PRigoUjS*iZn+3
zHv-Xr`sg(Ca-u=BMa+Pnq>w_s0UL4zaGf??&5SRXrY2ZL7ha2SJnDcuEkDP~&2L;=
z>vVKHuV0<Ze(J@~d~O<60T0yOxPM~SHJ;{BRoa-AH1!~+p+!#U^(?ETDk#qlKRzaK
zHY2FVRgb|hp=QjlZ%;e+grhM=QH`Q;Sc`ldWl?^fTZv~OP{>haS5(sw7Hep3szfgk
zC#T~I8riUyvtdVRU{6R^S5mJMDNs|?R{WkteVNNDlGg!Fqvd+Rq;}<G+RJIfn=V2m
z6PWxtF|Prmh(V!Y3*$dLAuN+CpAFp;+Nc$NfT|xOq-jLCkC~|0f6hsd=U;}kCxx4<
zFR~e)8OV#RYdW5+g(111b0<%OI=slTZ5fQabx|)jZOD(-DhSt%+Q7>jaEJg}kp7;`
zQ3MM|nxUy-w3-!A>U{4g>^Xa-J8tF2BRsDn?Hc2*Ia#9eHBN#hvJM>2)|o+6P01u1
zXH{8MPI<fVTof$!LH#y{jQncot9ES{qu<i85ey?R>!>5hZYyNUDZ(wBF`)hy8HAFA
zLOt$#V;rp=I6WXg64t>x^8xj1cTP(fZ2I^esnzOo5|ExL?HzsavoP+EiI79y=QrtX
zQJvwdP<_po#{MAl%S%&Ai!(i8lZ~lcYxLjE9~l)B)WDU=Mbei5{0NR(Q#*_c;S%~W
zXG2+BiS16WL_1DW!_|x^ip5pT!`Q*=CPCwK@E)ChR|pX+fG5OrHkN+$V!*0=!!gBW
z43=|p=6RV$7pl)5Vh0O>JS$Yud2}V8F65@_ftQsoWr#J@6{(qH8!ODIjcusY+x+Tt
zw4Y~_XM%#QS)O%8P3p^^%}&dSkzGXbmFDBvHpu&FYt@_S0P)t2KfHDotrsQiluOrI
zi~pb)+v0>p<MoK>n*V%zeWqrq{+by}+R2)jP7bNDh7L5(y1sK}hg;)&MxaK-6|pjs
z%_QiiGH_vSmznir^zC+5Ooh^JXUq<_*7`;9SO+dFA-E-m!EhxF&fO(kJi8;aN+5Og
zTx96MaOS;QWsC^%dV~U}j0c{k_&(|nwf_x~eGM6TVjlLZXg`;|*d|;eG1*!h#;#>V
znK}i7nm7i=B>PZCM`ZA*krFVwZ+(_j+lsOP-{a5+;qPOHI{vQO;J%$&F7)=ZQxb#W
z`nBIokrLaZOtj*%O7|e6ISBurZG%B;6rwIMn*tIBT0}|ChgP=wkL#cq3wkG0-`(|z
zLx(FEyM~@ABkqrn1c+8|F)vd0@cKKJ!>Cil<ab|E>pYA?v5^J!f9<3sr*J<J2fOE2
z8yR0FdT<g@hi;7fw`?$3EjZo+4kElFd;J;mOSc@M8tg>+%*n*;x*l#YqiLTzf-HP(
zS=$~UDGWvxLlsEx3dM)=(V6T^{t(4=_TbK-r$Xl_|MN9uhuhUXxGhgrCR$~(&gRDZ
z0%E7xx&LwCktUikyRXsz<NCcNiA*xXW(WE{UG@Xq0nO)o-K?zcV!LfwX_n*8sT%tW
zzV+<g-hDe<P=bC$XUXr<Qkq#u@4TA0dgCHyamXm|Y!NeaZ3ewyKf63CY_Bl<95d@M
z7(8>GZNYGfRIeB5zA0dPdK^{If$P)9Uoy%grC4UslWTn9elUOF{#bCgoB$n*%0t*T
z`b2;T=xw{{UlbRz8P#hnXk~tkUT?MtoZmkjibeOC$pC((efunB(HV)iifCTJo%Gs~
z%Eg96dzJJ~F$klo^5y8<G(x<hdqt37sC=URX|T+j#f|(R(4XEecJA8}Lf|z0_s{AQ
z+V9&?j5HMTt4n<x>ThzjlhG_kX-e#XH{Znbet#!hFHCw+kotT!Ws5XAS?jy%i*Z|J
zcznXhx_8DHCc`c2YRj$#z`fQa)M&Z*kDWoWpR1(iI@~nhjWVo+TatM)UD@uXDlo1!
zqmS;<k&s)A+8UxNJ4Y`P>R8*OV=Qz17rkF{>s*?ky7?Rb?^yZ2f5IT^W4Oppytxvg
zPclxDbe7G%J&j%_pW(cQwzo_qOq}UVvWn`@u&Q9CZuWl`gz{=?IH{?rmlw1#wY9a`
z4bQx?BWc_%7{&C3U#rd!h*@YG0^MSAc~}#T@dt3}sjW7Cif?!VQ2DOEzPaydA_TXP
zd$g-iCu&&GQ_zbWd%!>Z3<Cdr{elFKgp5*J=;_=7pFe-1sHH>GJ_xzYWy<#}r)!wV
zM(I7yd?a1J7f7tmX|g|P-U{?wPCW-rha>)E$0f;Sp)QFat@5vLSt%PsfxK;!^F1D(
zU86tP@&18?uMp%U5FN6Zy$79Vjqi@2{*Adazku!EKAx}#Q`<pe9^wZ0obIfwLFHCa
z<UYZovDK{6PJ0b_Hbj5jEdMaI`4@gy1kNnuak#R$#Ss2V*ZSnbo-oH21}$N5@no|c
zpGYgN!d)nStiA3xm10QBh2ZLwP;+&Fb%<~=ngd(Vf}Pp&a0TbI2wp`a=3vFD=vbi=
zItfX1RaKSuGp+=zx5vQ1K(Evu4};l|nj{}l6>41e#FbcNv=fTZbxq$5s5a~t6vpYQ
z#q9pq4`K8_FQtjca4fd6UKoZs$QT6;th7m}`!gVi+6uG15>y%Zs~k~e(g=rtva`lG
z${G=cVusc=(Z1vG$dID?0gz=hwqcgQoC5!`D!Qqn-j_AvU$e~|uIPK(fm#cR$hnLS
zY`o)D|K?q;Ft3eCG@H5J;e|$m6_}pM9V|{9&Aj8WJ#UV`=^DvDbjcigsUdcoV=l)s
zG)v386wK^cj#}ci=)gusxVG0pz{}a&K{&$atw!Z!u~(B7&T2kfcQdf6sx?l*LsT(~
zsh>=gkRdN%SxT;Gg+&~?(>w@wm-J)`E9bQ&Pb~92#CUmmAMP1ZEr7R{&MEP#mJs}x
zzpxf!V+`uLM+|<Q8MD>?=T80F@c!~TI*bDxD0hfONJMXdP*Y&M-#u5$yi(pPEt9el
z=CnSQn2f966?JyRwYfKQ6w1iW=QJ)f`9&&m2u6QSi*hQn7mogvzU=b@LXKXg!eTD+
z!4Ctp445rU%ZB$*eD;?(eTRp33q&L0@nWff8R%P@#m2bFLOH(o>lzQZ&S_++D>g>(
zDLQCuAr1-&TKX?$AG>p32*R`;v9l_#XvswGJ@+E}mt*INQD75UYN5`Y)oxy3T;#n&
zHHzU}W<U*BO9Epj=A!81Ebb6Gn<0~KW}pjW?eus4j$*6;D!&;ioGDnQvS#+hAf)da
zk25lh{%-7l(;W-(VWhA|nwqWiIc`K=j(;ga4$piN7s8FXLS%hKe<qMD^RM%C8Xb8<
z1Gh!lzA_qLsD?f#gzx3z?pCy{Gq!T~St}?ifY+DIkjo+{cSd7-qXku<(Ip{?{ZEZ+
z-qXaLlSnf;QUMOMn(95Qz?vseXqCXQP7*CyHLyM3jwq-=7I@d=&a0g_y%gTH#x%P)
zV^B}gerGTK`A9saixb$$vBc|vwn-Y=p%%2#O8`LCe}-E_C#|V&?Cax<{c+d0(6|Er
zVz*)7u-;S8FCqNsXEoAgW<YV?XgO}P_7_X7y$giHn=RQ3S5Zt?ft!?%lwHiwANXi&
zY$_y|Q$2{SCi=N0Q<2$rqEjF!SJmR0NW1oZ9SQkI7e^NQ@5nV(fBwiGe@!vm!|4y@
z9YQy&>RktfA1WY9U(!w!CfwgPhiN0Y^-Sh+FD4h^ZtcmsPvwaI9HlCq-CT8J!<29y
z=ux7_s>Nm?QF?KQ$y9eXX?C}u5e?#{PTG(c|Bp$#vp_#_aq&Xqhl;WYQ=Z_HLAM%3
z{jn{W{5tfLx4Stm+u~OuMG@0?dkx|sQ%H($to#AdpMyH(X7b(wICbwAUpBRan)6ju
z$<MxN>UK!h+)t}53r8><^ZE5zZDW9ixX%Uq>koZ>u`pmj*_mqc#}~`bp2Q)^?LD|w
z%Eh)nH2iWPJbPre=a}Q{(aTSWM)@U;88m_H)O6!-f{Q#b2tRd$P;*32|G6OVucQ}0
zVZnnKrWuuLX@p4Azg?Z5m<gqqkAqyo>3t1nT6@sH&uaMDLDI??BYyHDr8Xn&@=2go
zt_dKr?Fj5E{l6WVU?gTyyot;$&o(2!4jnl;`BhgipN_ZBg}R0bE$oz>+)4Kvt>(Y~
z;-`KQR;&GYBNi57(U7ST0)i9jVcD&A>i%ea95s>;5|0K2OnpDgDF6jnCqD#F<=&a6
z&#2;pd>ImJwT?g-w1}uY@E*nwfVA5R+L5o6{Mnu(s@2_t^uNB6s?)H@D_c5~{{hjW
zaBtg13HnYh#MAEU2UQjZ`a?W3-gm4F=hd*p^v_uzJ147oXnO=>?3>0sa*8W(5)e`i
zOG+FO_(#n9t&*0JA2@Rm`1xg2%zw92$FSK5F`HBSB1|I0^}3I=pq!cvOdW+|1kkFy
zsjA(m;NmLj*+r)pk>e6azQEtNY^d9M@SodeY3QgKbW{ds)U#bjzuvbt?6B(Ww@PGz
zIyw)3G=*;?u4)YCU|*%MyHP*IPsKZa`@K8Mz2poH%PzoYAD|w8n=;1=LHP#Wi-!w`
zh(x&Wtf6veWXOZ#xLnV9{3luc4dio}UMZpswo$7tw<B*dWX8TyU$7<O=zVBjwl`Z9
zj>h7~AUf`i<Cd?^XG$YOx9xI#vn7WgSxvo~*D7zl?mG~6b`|P5uX5j9gU>I@B&THl
ztz2|h>*Vwe#Z#M4n7{hD>JE{xgr0vQ*X>PAXtP4J<;88HqLVqh0s0bRe9M1$Y~{vW
z{6oYroI3WEGaWP{Bfm9QLVmhRDzSZp0QvS3m^=R*yp?EqJLwzL0PpLJe6=mi)~7E4
z7e=^WV<3UkQ=_<){-#=AeqrvXKdVmKFIbMquwWB3uaGr1N$U6K2jP!jF^A6e8OaY<
zU)xmMI}e+229`tzC!whg7j*nkkIbXlB37Rj#P*A4d%hrHTgy3^ZF#}iS1+Y6S?I3v
zw2=rIZIJ#kJD*WpRsjQ}^5_XGj#%X!k&U^Zp1%oP<WeBAA8FgAGC<p3r9-eJ+u0ur
z_pf*^_yY92oAz3Tq=yXtNC7f2sl&`U8uN27GZFjXPxLYtPts+l5-X*Mk&m>LjmHkY
zcZ}HVV1I;ZGyfvqZ_Zj2)(W~<>GNd}A96m3k+gIGZntsrhUJaRHp{{0vsYqS*SJ%J
zi~`z4tbH>8jE(=`N~E}j_w;(Hvdm|F-a~!(=C9kQ1fLRy#NGeS-py(dCC@vmJGG?G
zVho8%5KriMzQS`847>>M7nX;5v+2=P%}mc7>rvPHjPb|oh`k)%OkOv0N7e^Osp#Dj
z1;~8F%=V~z$V_>KhYI*1?n}vdn4fb<YrkJ<1nQT@a0JjR>4vpSE~cG`@D$ipO3dz+
zb&yWnN$ZsQVZYP;rpSpEtEn*aOpH0PX9GSF)5;alVzHO<1#{1qBt5fb+hIYM2WBgF
zOE4YVehKBnvYS!1wXU9ArF_-Bx)}NDd>&*h^tm>!>$(_AbimLaXS=dH-IK$ydw{-?
zcQ#O?aaY3gE!~eWc^3eiI!+FmV7_9>!|iVSxkNYbW1>Du;8hA2lua+SZvB)r9|>XQ
z&bcNZm6!-yYpaeTicFTPgRR&e32^ug&L<0qoQO__FBFcuI&d@Sz|-_A4#H@&>dQKp
zL-JnxQhD=-<hT6_i;X&?37%UVEieE~S|Kjw;)^6W?jF`u$haF~6K0aRHkwAKjS#fz
z;Qb&$7sfl0bksXKsfxL)Jj`k5(_O#pq|xk&TA=pYkI<r&?3G5j;WwO=8KTKz#S^h$
zCt-ddc3Fz={ddHA0ZKz*Z%=ogoGK4r#9^QR|M#{vg$eY?>$~>KpJzyL@`vbm$|ul*
zC0ay$xI-4kcQ;7ojC<PWGwABR@qPbj<3V86^%SZukTDSK62c7S`Sn$Vz(HytP;|&(
z(dds#=IT`1m0IKpVNk<xL~1X_)DN-{$V)lD?c^`QZ_^2x=2wtAk3EnkoqlHqyHtZS
zj>~~{g^<4XU{2z!$IA|*MzaCgkaWc-lxlJp=odOKh*0sKN0Q$oNkn53#x(7(+UCUe
zyBUe`S6g^5OqvVm3jXS#Q+e8}o$|{wlMDYS3G*DOri9HVN?;q?s;Jz&7!jB2=doX%
z&Q~C#TbdfzTS`bnWC1e9Cz2ULQe?OTSNgp(d4c`(mI#gZ8!9;<S^quHM|!a2)={SS
z#gVpbX2UPJHq;!Hqmaw-?~~d$f80{|Exd3pj@oFa;e&SaF`=XCc9#nW8+E>C?+Co}
zK3yp}dM}6Ip1dg}V*2ifWt3n4kqK=Y!QeQQS>oBrF6T)dctpjGvptjh<;35H>pg5m
z>N62enLfgC2Vfb7H(pTe%y<+aok|&shD&XBfrf=>?ooO$Xno6aA>n+pf3I_$q16<L
z@<jU=8(LD}KDj<Hww!9)KUNluLVsxmebH<4rJp~C3v*PC?eu%VzI4k;=%X#XI@O+i
zFg#MD@i7kV7=>EN3*&@uQ<#NDPr8k{HF#_!)2E6B`EWv1Q=hrcY#NKOYWBz6QX1@e
zga42OdMyoaeW@~rt*MW>Fs#jI#lm&(9^BEzNzb#7kqe-|3B@+E)M@Xn0WUawyYQBQ
z1u7r9xM1yJZyz30W0{j5d^rW=jf5b=SU<n@P^=#;IRNaOm*?Y*57!$pI}Wb+%IZW#
zdip(PGfbz}1T+N2_}-89=D_o1X~;4LwJHo=<Ej-*pOojD*a1D|Qez<<OaeqjxTDko
z_qC?;j?tNnxJf`1K$9&8`=<Qc6aOFr*2V1@sS=J0;LR6G{XXrM$<Ifr&7*3Bzi*}w
zF)V@?=qW@Q<w-1dARnjh;UTL{Z0?uV2LW;LJwFb4Kb*ti!MuMaet!U-ZwyC&aMOF-
zMPB!~6we^a`1A#(fJ!i;-XE-%w3tXWQE?ITxx4TyXnR!p)`vG!)f~><;uv>4<rXJT
z<>}$DEmMVU-pLha*WIExbynrwot)h<nv&I1`1Jt;OtjtzKf9z!Tb}V0k|PJ{k5oPS
z?0b)5=6#8gc_T%q+mXEec&v8A8Z@)!iMb{<@%r+q(7j7tBFsmUswWD57mHH?uPckO
zlV50Ygpt*!usDYK-1^>^;R!5LGRi&Ll+DmTy@xLFu&w-h@mDf~9hZko9E@7Av#RRw
zLB2ge0Q|&!=QY{7F=@_Pcy*cCW1ZCzi<x+1bMm&%{P~PPvNvuvVUA<fTU-S0;nPKi
zbbzAW3y2q?*~xodb|KkqYhtQvvo1N<$!wYLHb2XBHN0V08)fS(MsT|&On0XEMmTHZ
z;>?vCQy=>>;{o3fncieSa?d0|T{$&d1nA2hrL-3Y6tQr{@erHOon6uL1wZLBu5Vco
zu@jE8=}&IHBtyxkXTrBJPgdjJY{BtOwI-_EcO4Jhv-+8`DNQ@7e)_4xK#8<mkB74u
z_nX`QT&q&1))O$CQP_7)3YGK#<u-BIfoIxF>7@qX6XljBJN`0UTe7M|RR-9^e&r0Y
zuVJ$`RWV+->=_U%=XF@LVsu*U{&AY&eRy^zJ<{?)+L?Y4KG7mXvvE_qGvyY0Y?~nT
zXq6Cm22-886?49hl=<}wUhU43(`c~vIiXx&8{+SrwN$2D-UdWqyk^pPiMzRNv&-ik
zy)1V((y<rLK!aI~6_g;1<jMei$TBIegiHo6YGJx6nOCFr)?5olsSFKuaS10i^A!;N
z`g}R4I`)TW4Bo)UuK!y5oxf8sC85I!Q;$;@7IM!=Ncw{6<j)O{wu9(&nzQcf_q#98
zltACh%eh98>cTc^!Wt0ci>vshEiIYNEGw#aL9kTIdKs9*^oi~7Og~(NwB)!Hy{|l&
z^cM9Y!oNpX5UldD27B|$mzRfQL+pw|ngCh37ab3`iW*^Gen@ZO!y<RkS<J9RMDh9G
zd$ATvq*U7n-RSC$o<GcLx-LXLk+vmg37CD0Y2!+clTd=#F4zc)>WR^`984-HP82+T
zvhQ7(%$m&fGD>WWaq2>Y+mN*ii<17GQyD74D{nA=h9G_$J~*_Nyq;%k_Nyj3--$be
zza@F@yPqw=atu)Kx2P+j5T_qJc)R1d&+6XumZ06%)4xqzG-rH$D2=_SghtYEto7!U
zCq079kI;NlhQEE`#x6)=j_GlMguJu(c00B_H3)ls4Pl0Jj`*Z?wp`0C{CJe;wp@QG
z7*i9k^wvpQ<IlbpO5#z-$n-MWocYI^V`q-?sr;)zZ9D>+-6N9Wzr41TbT33<rYM4|
z%$85SP~#y7a&kb}-D)4`*J0e}kLCNrldikju1Pc<{EwG9EZ|uM(a(kkfaJ2*&ePUt
z<ICdC4^I!XUe_83N|P4}?+F;ZvaLH_@Ys&U6|?oO2_4}U%)uiSprJ@p6JL7bLX!#W
zQ+st)1x<$XMp|ExS#Fe-!$MUfWux7PMD8$(eHA_HU-^Coo4Z;7L0i9DRa;Ut{{pTe
z#j@(Ax;|NrK9t_~k}OMx2Y;;fI%o)h$N=r}lhI<}6j=c<Aj<e^RE?Dt{x-T2H>9Cp
zzWvKBcvSnyi5d~dcciPR5>QbNG+7+K?%MzAk(*O9XJl?VpAp@QVO4>wrdB9Fanvxo
zpAvQ%w0@69nznDEzqil{CR$Xbq9v=)2vMT)qSpUIDediMt#7z?Lo(U#AVBo=s;uX`
z#S2VaFqrdXwhlzSc#4iyzF`$QPj^<q!cyKkiwOAXJvCQa;{r|@CF7U0v5U|(rcTtP
z%%H6s=vjP6rgxOvY~30$81B8@NZLQn8Vt;eraG}4nZnFOBSS?7m6Y|Cjs3JGo+p*C
zDSM1#pr-p9ei)r>gYy*Alqq5x5m!iL2=iv$skF)c+7w7YXcgz{L_z^?U1gJBnI9g0
zEi7#V=ip%L;WCjhA(D*1uNl%*4d{!q%?<dfDlg*t-MqSQu<$|8Y4yM0jVmtx4%OuO
zuIhp_5j<{4G<`Y-m0jv;qS`nwH%}UvbJrB4k<;HwNgp&C=L^a*3seB>O2inN(3ShX
z>3jb@(yB#5;!<A;?bV}QcbGk+vbL^PR#Db-*dy{Cb1n{Rgu0QGjH0#si24>pY!j<3
z=!?B_qV#hX6W;MHWP)w3-1kQ0m#BFnqSPOJxL1~qY-act4a~?!7BO5-BJ02INyLM$
zy;*~b0lLhIs_H&FFldh<ui#VjEftK_G}{s$b%Ls(wPs&qXkl4gkW&*k3U;(iOPkU{
z6vt4~?;QbY;?lD|0r{J4E(7=;yLCTD+;nm|d!Wxqm+Ev}u<XVs&ssa=;!0CCC5U^W
zp6XcJD;<E+b=TT8@@j&eQd0|qh}0F7ySHr2?Fsqf4zheRRwZr+`wI6~puZd7epdoN
zNPITE42Zcr%tLj$%X9-XLWp77nHNAu_tg|6NaDeAfplD0D`6LnoUSF(9hgyN>Bk(N
z6MZ_jX1$sww4vB%@8$+rYE5a6M3ObaU9eFV$H896;_~9%hR*#kv?Ox@Cy|Sg-_UFS
zrqh9Id8y&8;ciHPs*x567Yt0yXHIvYM|MHc;}#{{H#?v3X2|hYX=$X`z(Cs%EnFa<
zzg)ecZ5VMet)*-W6_DTZO}_n)t=s2jzZrOwrKzX8+?@zyWT?QJTf3G~9m$v+iOX1t
z?9eDMC;K#&sj73eFpQ<=<(0sC2lAjuI2m}_l5Ym_`q;Imhma=jKB8gTk%$3?X!X5V
za};#jKKJi$asY7~PunbmQbB;3^XUFBY29!!Y>P9*JA>#aC4(#E{xhi0AafF8;k__Q
zYkmoBkMO2C0nTJ2WO+k&tH4VRrH!wtiNY51Do6#IUt2wrXU?DKeR+}SE6+v+MV%e#
zLW!>2vNA6zI!<G1%vK#rEpN_VJ1@nG$hwqD(Q?LFStY4h!@pDn4QpSyz)%q@k$*J6
z0>&MZF5KjRF?X+HKG(qk^d>J_?S;4Q->f6!UN8FN%bo}`2p=)~V$eAsV^dRvrJ~Nm
zvwYh=A`ceM{%0FXV|KRaw2bHWi&$H&=0bsIW(RS52Y=*O=e~7%(=Ym`yE^kLqy^&9
zyuuk1%=!T;O?L&=6rtz!vvRGb#QbZ0yp8sxr66WUSu{<-Nu!6`GosMd5%2&Zm(w}l
zQAiTA`P!#i8CquCaBv?`L#?-7NlSv+Gm=;WwLsCyP}Rl)VJMpD8*tbY8ocNIaD#x<
z3YqLD0se$|v6=<)KXtuCs|u4m-Psr|2fMd_hx|zKQdvEKVvTxFS%e3E#Ii&d4u%ZW
z-Q5Cw2CRL#(tf)^NvPy2O<u#<Ps3LGjuWl8z7qU(rB^K=Uwaf4_W6z<l-oz1Syn|s
z&b*#5)y%K0dH*1rq#nq!wQt+Jge>E%AwLdUtg+u~-M>zLk@WomXchZ_K4-&3W)`Ax
zz4pHGY_;cBu8b>T#-z6W?Af^GZUk_s;}h88gab00PZZjMe`b0q+rKkDAxL^dlNc~9
z%S=}^I9o}~=^*5CWC~CtFZ-S#?3*XCRO7TC8F8syYmMvSVL`Og7`e9^PhDO*xW4ud
zH9PCO2aavZ)Fm;m>`jaHg?K&Zb#7T1>-q0!6SH&U6M4a!qoSzOb<oOXf?9q1M&CE>
zOFsiaUeQcj`KH{H=`8ipH+LRN>XZB1p%)7CPl-0>Hpk7WWkCzp2Y2%ct(i9`9Mx7E
zuKN?(;$eqW*Qgi$?U~sjum+7?5!~GfO||3aKVI_s;nB8c2RX_a(j)l`B>>Kwi$6K-
zBq6|@4<1XoSSa~HQT~`$Ny>`_f<3+AbLqSoSa^YFLEI|8g*51I*yWlfZhKeNevkG>
zhn}w~?w%bKRfKS*>xvB@0#fESaAA_|Uz1zKv#vF!8xBf`qIN|(;Teytogt`lE)5!<
z!RX)0xe|lmI<sQ!-5DJ|J-Cab{_%>j?-l0RvaP^KYC?zp!GqW&7Shv4iF^4Q@feoP
z&E}W&{UrS%3rObhLLxk&3GzJ>Rrxg}W{y@!Pwb+)gm|3`stXQ&B$y+q5q(<PA%I}&
z+mtGNa3B(l69t)Lbr_4(6pxuMmNpOp$Gc6Z17t~-J|QQvWt5?rmYYvO<d!}YL^kDW
zX#m6ehmg6mdBiR~Xl*^89nJ~S0~*B1R;*DvXZSBTzE|7!=>a3IGoIGQ`izaL!Bh?w
zFVBG(L;-nWf17ZTYCgpjcZ!O;3`&4{dv=zc2`;~Kin7^zLrK1n%H@mhiQcVu*e@bQ
zRH(k_bVIa69$Q`VSA)^c4t^NF;sZ0d<a#aQ7W?^#j0dlJXLmk2*0NB`Xv4fjNGvC7
z_<2Jyp>koWTy7BVI4V?Hy3>xZNPBWtU)rZHnFY<0LFaJ1#${Ek^X4ihSm@jEqXIPn
zTFJf;7Bi;ctMuj011xh^8GBen6Nzsl+d^aMTT(fV%C>IVs1Y=Y!u!c>sI>&W4agrz
zS&1H8i;x{^%cTM}y}I3@pvdausU>~+=2JYvHP9HPEj3(1=6pIE8R62ypO0(EKxw^R
z4Z7b6!xI+2>aGy^TV2yVBlurasrBty7%q-AQ=jdLOsxLb*DSR|Mz1arBjcarv6tE1
z58r5cP)~(S-09E-Zq$c2G<ExO=B<_p{Rn!8SdIqunl+@lvT6PFSAI>pt7ID=tQ+rY
z1UoHuG|f&d0w3cP?L0S(9p;a<=Zo;=P+W3BmLew5$!3k=m3vPyJzZ}fhc(eHW;WH@
zgA-g$i#s=gmbxpuTctSyDKd@*JbF3J5cjLKfqVX2d6JW@m*ge?X@%60+Nt%gWp~=`
zEa0NO)0@!f{yn=Z2Uj-%cM~jzg~hT6IJm?ERF<7p(+?Yu2u%Y#^%-whv*=xnsVA7r
zJF_<fH<-u3-JI5YK71aD+;(ei;Hzu?e8&atTVK6uQAsf-yp4U%)C=lm_gU@`V|hW>
z`*>3wy;z~37S31TN>be-p!JeyQdJx6c#lGkQ?E(VmedLPGHBq`Vny&dd5hq!)1*@W
zA0mH|91SQdqb?{v?j@=sAe7)OXE-nUAE)nx3<k+Zz#w_M4$}mS>|7YDJaU{gq`q)V
z1s2X?Qbo>V?NamaB8;8L<9D=W^bdu9W8dA{K0#iNPy9#7i#z&iLivA@`dOi2X*E~}
z1J=U`IJBpvJ=-g%q5UQ(xZ#YIykI}WT3++J6kNI=t6wqAsiLej=k4d~`_42m`CHzz
z=Ff8ayg!@5_?Ofm$TEJ^Tmr75;u=v{0gTB}nvIg@L@C#*RZ4qO85@$*8Q(i9BaoZU
ztfZ|fy|(xMRqQh?NVf6*i*3a2W?pW7Ai)~tTW9bfk8}jG_NbPqhs;AIygDt^Zs1x#
zO+BY=vtXBie59yV3(1Pg^j_F!Q9)Nt$R?udT;|#PMG`6@rCGKS0ej=@=r6kWCRoyJ
zJ{#hl`qjVs;62BqaNO^2_j;O0irO;$NB!ORyISIb%6dD4-7?IUj$gc|%AkHio$HuR
z30&~E2A9e)%+(<BW5KX9AIl>wz58=2ODAeDEa|U_ZzO<I+{x$ykz!@NH{kB>yTd}?
zsiR+<Uv$)CB8j`R3Gq`{!5A3twRg6kOF!OYy%N9OemF{=v<;tgb^nkCB@w<n>juNL
zLtwM!-Fcx?S2T_5#62JcLb6+v-Ug1(2rGrm(xovYUggBtKUFia-Rx1=XpN7PHpVJj
zh?X>c^WLoByPT`|Q2)4Yw{yJrQZaV`U~!sZfjkP1>hkkzPwMfG&Z1tvfGGoGyg)sA
zF4m9YrO;0IebOSfZ4MHGS$r!OC*3!l7nq&s7e<fdhJ$bJ_t}_#lXV0}ho6yN1(CB$
zOG}yXcnaYj)y2!^b7$(I?S(rD<ugClXT;iHX3X9X@{RJlUH9kIB*i;j>~f*zwuSf)
zrU`TS+#!5Am%oCXp~F-HCTFPwfK}w?x8LR;8|lmj%<Zam`TaSwvm>+5vh!-VYyL`g
z(h-gOk>Ew;6=1LiVI=;fipss1Bh3G6?b#@w*^Lmx`CzYfTIK4bu5O>!vN1VeF?=O^
zxI^9gbz;~0B_+hIjpZPS*S@RR<Vy4L0uJlTb1<&$UzW@#7nRzZ9l-M0qnloHo*N-0
zEtwb#OB(e+9U*s%=G;7|RHXO5h4|f<{@TjG`YX+1A5R#Z(T<^4(cYE#*#1Evlb`T_
zOxfMJyTMINGmB(s+^&<t2#gECu(47~Qt~-C&m0AKK|GF@SO2~y-jI9HgT8$(VW-bI
zH!<;r?@}E(cIJsD6|_~tW9iCzeDrK@Z~uF3-8H*zD82A!%wWAvnG53v1Nu?{;Hb!i
zU)-y<xWM_Wi!fVaNE)%Q=k#=?9O`V{X{}Vt8}6|icMx`srnYq~|6mQ^yO|Rm{ZdJW
ziaI%j4Ss7Gac-zEyeow+qv?O3ae7AB7?{m7W>%MyZcpH+6)>HcL5hr?`5eX)Z!Y*N
zB;+2{YQqeOtW1D%p)iZIoQYd4_;p0yXJ8P}`?Op{^S0EKp+<?7oUXKm)jF~&VPIHP
zUzlE>H7R=8V{1p78SU_<JY^9FyqRX@Q&95OnczYB*l++KkSq1LKD$KYcv0yrMKHW}
zO+{k7>Zc$V-wh+Ps)(Z61^>f1%v5({^;3e&<vK&^G1nra${TaY4oHDWufGy(K+@_*
zWJ})_qOVq)HD`9VmtM6Hucb-5JCo`~nkC6e%1b5Cw_Pw6Cd1G>Q$~nMN+`14G*v6c
zn|9c$Of));?y^I1j<<~M(h@uL+Trfp6`&BI?0wTK!6thjdN6daj~=a{uP^m1@1#*p
zKEVbli^3m6#zfq<%mY|l<#Jp?aZ?84zS+IEjH&U|Cy=|HnRvKTvA5q_Jf*VGU2moB
z^lNxjj+oS&N$sH1?u^|1=9Iz5tEibNyA+D+QJ>AbJj4mpp1LC4AdHLY3cL=>eOM8>
zG(FmIFlS_dveq+X3q1$7LU@AWvL3wOeCpzfiF2DZHbmO5?jJX1?K__2Y@=Mnj+Il7
z5AvQQQN0N^YJG_K^<&JFYxp=k{)^sDlv-yA5PhnFfcv8Av~iu{fp|c>t?m|?8$-8_
z*564FefMuv%YlI(-oJk@3#2#kB^DDCD~t}y|GApihoFChKeUu`I{FLUP($}Ts;eaY
z8U)}<R}RQC=Sm8v`%<vmpko~&q#@VPz@w8vtbk9$UF-Oc7qc{!h|}MIkof7qX95*a
zj>ql6(iC$fwv|+M?=6Di=|k*w@Ej5Zn1e7~0KdB`)>xlg??WfLf6j#sy6{@z+6<tr
zhWzdb5cQqP`*_qt4>~uf*2liuAKy^{Vz(X}H8N%l+<wOP5nuB+Uv|y%I;W4u_s4UQ
zAsyYuWi`KA9@`g&b%2xV$HzFP45ghW%)eA@i2`lLh;d<*OLOXMn_)8RLwX21O*m^=
za_yrAffOQV^<|OpV`N*z1wW)jbs3%L^q)r9B1n~f!){PR9Vj$L^f&0?^f<{wHLvG~
z#fnFHTZ{o%7xQpjQQ+Q{7=FOx^vMApvCg{10rCOCwf0Z@h^&TzXLR{%7{S}?XQ<^=
zbb%9htfFjY?9heCD!0Cp{LK-U>plXDeRtx8Z&a`+up*`Bv|->n#U9ZO*!n4%HR8d3
zOYb<1pfc8PEp^SC^+xcN>dLT}c;~1*@?f?~Enc_4qNqKptM!$p7RY3`u(-=}y>lC8
z{7JQ-R)AqBAzVmZ-c*RWGgpLsZ;IUsKD&}jRD}1Tj>TsOV`49TRJ}}V)Xj<0I{)KY
zh4_lrViOpgeLjO@y_6nVsao8z((BA&xAM7%)A4DdgL;`agmDo7rr6E)u|)P#9+QPy
zsXcR;`S2x6Z#3RqY)l-&=p@hUFqRGb!h(`%{or70CP|zN6ATL`B_YD`uS;i~iDtn1
z4p3St9r#H#v41}!Vy%Bi9<f-si9Qc!?iH65#kvJ&yIUxfqme{xday1&DEPp{d2>GT
zM~IW9L?6v#H3p;!>fJi?d|ZEJB7eFmn2Ks*t;y!RT}gUQp{|a`>!;5{L_^;Ul$m3)
zJtvN=XhD#7!*w>rHc_8r<215;y(VIb-x5JY8sPEQK<0gfFooy9N!X8l6=a#*cksB@
zwD>KzJ-FO{e~QWXdY?|W0g{#*YoPr(ZgLgAhF5>?zVegV$$mi2BRnDBy0nZisCRag
z1Wz)irir<Gj39XvFV}KRl1Kl?TF|Z5hUm;|!L!ro?6yZtdbGKoXMic<Slo)UMe|DD
zox9<hM~>3ZPuDKFTzS88#VvB8-yug4+zs1)ZuR)QmXW_@1OFOeYcxK*6-nZUIU`QV
z{gB9}cPfWBvpA<z;@n-EIYa3)FSYQTA`$aMvfudb<#6=?;rj+h?6J*7h6R&panv)r
zne=HZWIS_6e5MPE_I*PTXYoEj_+im#qa^e4we*oTZ`1odC3X$OwJ27%O9;Yd#wHSw
zCP9pa!|~ycn3e};foi<`;;xbW!I@(ZJPb^~wkaN!+zQ2d<2e5)rNnewiuv5UP0`b|
zKJ`JdQ=sp=lM^E&T@{9Mx2z%1AUTJNWJ5-Hf|4?#16MalmFH;i^)mrqcw4Z`H>*Ad
zB}Okz-xdKF;8iKXV~ZchlzoQXFsE;gtxZOtQc*#_pv9iTJ8PwYHV<FKt*+rVgGMC?
zpxYu%uJ*Jen7M23?K5sQpuNruYT>T5wJjdVbTJ2UX`BQWRjFR-WJ(9*b@8r%y+>zR
zq)Hq6#x@4o*vt!SyQhXo3u;?_CkBf^`1opOBsa>xyS(9aW<64}c0TD*-K?2le}Z3S
zi9G*l7g7f5pe9aSz~|&;%s8D-2`jRsrw<fn*D)MPqn_`F+<x1b)E);HkUHIM#?qGO
zL}2aOQ;-KJe`?dHF(E_7ts<M{3svw#eQvwWuaiJR7JNuxJUA^Xt`u@+^KY>TWCuiN
z6y`Tls<cuipG=25SWdpbXfG%<e&w8PY3hQD|82^a<mf!l(wWYYsCk9^x9`?HeDq}6
ziYSx>f}K2S1M7bs(5=QwHq02r$0WzZNC_YnU^HlQi&5tKYPkersi|q;9~W2IanB%$
z3~GK!Oxr;}{n|+jl$0J@#Y{dX3a5!o9_eZk@NR#xuSp7SotSR++9qeIw8FT9MSSV2
z`tcAaE-z!Hd2Q}e%_qCBS+8B({?s#>%O5ja496bNU=HApNUFV&q-lK=R~{<0d1TKg
zSsFw|7F(lx{+%ho8VHu#`xzt{x27wKC<Mt>FlJbzeOV*f&TK+G9oQUZb0r$?z{6Sx
zL*DB%>eqwA1!kX4V(QQi_mHEjv`EjM+y8wUr2iC_e7%R~>0^`p)Q9==g!Fh~wDc4D
z?Cc!6kfbd<2>!t{Uo_?JSA1>^+qI#~sU|_w$Dy~a9K{(8nY3K^k{<N85b!#Qmk4)a
zBE3F_#iHsQ*u(<h+>UQH_-%BIFvuT$G14<!21zt;ZZbHuRfl6rSE2?=wf^Q!K-zx&
zwZ?aW9ycAmq~V#8jK6DdD!WJ4^7A|aTd%ZA!{{6KPkM)@8{@eS#*2%C*;IiSWPvwp
znmeR{)9v}xko9MOz>rv6%_}PmnX;*s<!?jnz8roB+*3pLXv`-kaI^^0KG_le;pk)W
ze#{IyxOB%XkS!49$InBc4?uPh(`aVSbALUXN|_rAx4AN}W^ZYKkV&3x1&}2aiv7S6
zTKV8gJkB<6!8*7<AGYAyTtZt+18QVo&$gqZ&r`G6cs&emrtZoYrBXf8MTbhLeIJoq
z_<5#M_-NbIj@xYcg0F~2SX_cRRbllSUzrm;8m@Ga{JZq}h3-utE3{4D`0*h7a=c<~
z#&V?$fatmQ;I^L0Fh9}8=PMykB)3<V-`ZZ_oofuX#A?=^OXBz-)*s*DLCEbgaX{dV
zk~^!oOt(@fKFZ=mJuMBbI=Y-9?{sdV`ZubK|3=k@hxvTu(_BTyh<2Utb_Sb7ic55U
zGs-EDXRP*a-Mpug&9Z=Fo+nl@K!+<iL)vt$3W7~V;86w)z&p(BkH@FwrcAhgm~+29
z<&Ay{eZ7AW2LoW9j>rq~2_Tu<5gWP<kEGfa*R+D~a7a#u7Ry=+nO@N^ZH<n*CWim`
zsZUI{c>ALzQ1iN*YfZ<i+2uM@MhpB@6B6x-m<yNYATdmAYAlHWlen-i!N$0QD2n!n
zCLFD_^^=KsLGOMV77Y$8`-fi@-COK1Oq#0;yO02GD^1N?!-2Zr!v5NJPrENWZo4w~
zjglvg+_@d}7eQH!Rf$rSh_hujB_UrhR6CkWvZJF|aWIk-MQnjc+KXr6{LcSv(IfY0
zk-Kz;?<D;n(%vyVk~UD+{RXjZ+sVY9*tRF^SRHd_V%xTD+qRR5ZFh8fzO~L?d#}CE
z`Eky5^}qhpRn=AX;(6}-YIoDb(Gg9n!~V<Qq~7s?nW=}AZ)3YgnP38izTV63nC)UY
z)-&4WR!GOG76H>J16!UF6}d&;fOuIpHGAX&UZkRubI%}HFOWI0uOs;Oa&VKeGWMQt
zWQnJ3YmQU^ArR964IJHbY902=E};+WJH@KLbs{{RJo|BeGWQjc=x0@Xwv_k*)32MX
zkJrO4o%i=D3-rY!_nB@{|DbHe`h_JkGg^GU-yt^|_IpEinpeBx9M&reiQmGNymci7
z<A0`fDdPJ?_O2=$8ZQmMbEhdioCE~rDBj&M1j9#h*!Z@5SMlcNKCHD5#gV6yFr?7t
zMnTzE*vu&y2fafz4pHoUyD}tfr@_UO@%-HDJ-h+pzfG(%mibjJu1iPld@<&)zZst)
zDB=eM@VGjP7;pbfbN+Pdt2vIOBX4wp6RAKYm}``K_05i$w+p)J%IArjx|o5ExJy#R
zt;-xA9U&gWL^&TO+n^qhHXxWFtb}gGGeb5$RX?jG%v4_dd)$QW6FBtFSwv13V_Bqs
z2kX+uT27}vAjsl76IHHP7vj`F^wt_=Jj~O57S(04kjPKnx;5pO*ZKpH!#uL2tJbsV
z4&{Ki2sLzao6pY0S`4Hzj9?!tzrW>y0vQ7M240_Kw3-Byrk5q@H@+Ni(M89K;3c!a
z@p2Gxhb;wDwbXTSs%g<A?HL!7@>5`?RWtgxCdX(j(<Au;bofMg(aaO33Mqh^on~aG
zkK|Hj93q}UsDv01q{d$ieA?o(d{(85_XzlWmWbEO!_kYHqzz1({@jVn)A1O(d+-C3
zZ1((3kuu$#_+l;=3x)g|_s=6KFVCuqyUct2{I2KG>)d08w-)=*c?X$^$00td2}L2E
zzK<YwzW8vjq2Aq{;87x!F_$M1HB@Xx(Y<`7o>zYg3{V0Z5pFT)P8|>&a}C`QuLp$P
zT-RE+Q-7E%SP(U*440+$8cT5Lm6OnqC-CH$Bxp;>2XBEPjx^?=jlM9nHsb;|eGfsN
z73I_!A8)n~pVV7&GP0N?14$JXv`R*K27nKNN5^Kp@?uX<51R-1?P+mEg;<5Uv6a=D
zV<AJA2s$AdXmC)5&~rSWL={3@DW|X_k%2A>A%emh^n~LA*)_Pf8!#)bNhSQ;SYZ{T
z9>+Wqk308z1OX2cPt_(Qo(Rxi1+IE^v4s~g$#37f3ItqNUGG$XM;HGBnO6<X1iu?P
z6|plAFG|9I8e2=jz@ZcjFL^8jw4Kmm555U*FVT5mgoP`g`4I@JO_Z-4zaxDc3koUl
zj)P=vFvp&deIZUmzA+!MyX_o4V39app)I(BkMYTiPB>04T>ysX{t_5_eS8-?KbmrP
z$*vm?Qp#UwBwXcF7%j8lT7(Z6PEu93xU5tSq;%N43&(tBM>;i#j#658Ea_Yw712!y
zlnyv!#7?fbU1^l9m~4{zm`yBdx@be;tr(6=q3)7)zQ##PdQABw51ult?kVgEnVL0g
zCWbx7Wl{;qL}t&Qn5EQ9eb7qYu!pF|mJC<Li(5U{C;GBR<lALU%y&S(KQu|eV4P<Q
zX)FEk$ZV#+DYBqwgS#A>S_lf4wR$gR;G1pB^l*bq3H+z^F}S;P!909MbMlx0irVFJ
zyqkIo(Zfy*PbpJwwdM1AZ|kmOPnVJnN>Ci^6+B|^++uFaMrYuwp^h6P2`=PZyU7>{
zF0)0m3JJQTl@OgOqEpu!4dmCAU`Qzv+_*7}a(_vg1@#_jYJa2V=y$OI3fzKzgshv@
zF_q+Rrm#%yckBx>Xf4LsSx=qAzs!Tz*s{Soj7&ic3+MqdXWV>9ZDHvTWp%MlMruu%
zn8|%u_1-<N+zd!<5*}zQTwPYBK^cPI2UA$!A7MSWTOdC&0IZl}?OR_Bih1M{cU4HZ
z>!w357fm}1;bSjinn00xPCUtdejNbR?-f;etuAWlxCfWT{<c&b`X5)L>sf#%3s$MC
z@FgHzM^I!`<n%`W-P>WO^nQubmlUaD%#p=+_O{<ObxVP!Wo)(!Hr7jSE6HRv(o1`+
z3x{35CJ#rjR4@{A@ZfZ(rQ+80*W!Pi`SJVjDmD-fW1Bl2DPfYsc5S$|q^7)KiQ~ox
zlL!3!1b)9xdPN(nbmTlvO)2(|%eA^P=APAdBDb;(Y{h(-L`9BJ=fhZP^v|i6J_t*w
z4p7*CJ2WYn-RzC5zuckmd2ca)W(4A11H^L{cd+=A-+LJJ`QH1Ta39!IZ1L93JpMSo
z)9x>DfmoU)&cq&*z<F?tdi7pq`jNx#oIRN}+<T1lP+svC{Tp=G5{IRwgtYSSb4p59
zxB;=^f7@707ZjYhsl}D0xt#+`Zr;vXW3JL`*AVYxlE+K)s&k4OVm0yd4m1n*qy`L2
zyuYo!QQ;9{(tkB+pG3513xvze)MsF<O0Py&7k+sh9U}5Bu76n8N@?<x6W9|G@Oe{G
z)O-yZA31SuNS9mo+obuYpc3YzS`xnjHnldY=7$}Mex--BH7U;80+xsxVcOxu4^XU{
z^;T;D!q7KGUbk(tVYBz&cEjvQWb1Q*t-nPvCsSm=qaC|%n*6?$bxD<grNWN<MP5|=
zvtJ7XGel$!6o*{iJZP7dBG<JR+<FOpk;W@e;$pkXS%a~cMUHGVaST=(H+_Q{<mkeR
z$$~ED44qFHuZ+Oj-JwnMQeyBzJ5GuqqQxgm;n@{I6M1zFwf@x=mEr4-3=rA%*Nt~%
zV<UX-HVc^3+VNxSl>QqKir1SW7HX2uSZ&>;tQQEgw<02agD2=XjoxjWh)hzuDHcAc
zhmX0Fb$^Jn+C&eMEUP)Jy~Ut<%AHF=?j*$YT}a^B4WVYLv-e0IkztNCH_qOSE-dM+
z;IYrnf#qG|f<*s=GV(p{BELwCV{X$uacA=5&pt0yPKCfglL2F&?VrAN-fy47wz2`f
z;GT`E<`ejt4bE<PUP~}|wPu^hc)X`2v)-;43d9Emx!=s)V6X*5QWUyy&%p&<-G7BL
zdj;S`#u5IB6!?@JCc&;Yz`A?P?%(nL_0!>E%{QT*eBPnxrc)gbjl08VJS+F}5+<5k
zgn=!2h(K*e<=7+8o-QHLAK_ca05gg<^J{$&pQAIy%f_o649*KBrvz_kReX)>rYnB&
z@%UR5{Lnt<_@CF<*bbiq6L3ukTon4OiOSN9h0iamd!to)@6tcm2urN2A>*!x<`HqT
z1HxmCz>UyCLqMSQ68X)dnqbev|BF>h%ikqRSVv8+AcfQ04tJpWdbh>7*Cf+@_lxc6
z!FukGv=~h2#rY*AE#L@KiT;*JDzM`Rq@^nDoUjBM=@-}p?gN76U`6%Xzm<k>OXzf$
zj83i!h7+ZFdp!NfN6VIiQ5CE`7alkA`6~KMa;zsM(h5b>gK(|@go90?e(C}S!8NJM
zGwCKpy76@Hqq9$z1$a3uHBQH<5mjYWh^vcv)za1kUJi~8#AIZ688j9IhsvnbgFnj}
z7W2)=q;I6AMp^Zi6855_<D+`!FwWIpBR_m&63YMG@L?CraiMe(^}Tz(cRI!il(UjE
z-k-|W@yL_XA6hSf)2cTo1ZoiV`Kl7-o-z2dpHOxhD_APyMsmVaP7D8<Wl2TJBa_tS
z@Uz2YGTQFtreC)Yj|DXner9*cyo<V`v>K8Ik0DUPI<v-V&sUs|`SAsl%rsgKoLkbD
z8xkSl4p}^}m1D2X+^T-8-adFR95F{JV6os@#BwZf9?OO0<s&@Kc1-MBxSai<JbPQ*
zk9%mAF5At2Dd?lFOoah<?!tqtqR;~*9AE8A;9-?)S>u54BPBoYnsTJ5$fwVkx0j3@
zrGMOHOsf;xWC2>Y0dpOEzF3GQKC<%2jJ!<GAZAv{_rkO>hffw#UUOA$ncy9v%RZum
zYbmdx*}+dtTgbZB^TpO1FfL)lg+ZL!4ss<8LkoRT@|7IR;BE-6xrDnzg85Xu+aSED
z+a<L1cp8**#o30#6?~rSlzlomk}E8QybsFPmgC}bWFC<m3gSXI6#d!UB6W8)bNhR^
zZ|(_Yl_dk&wdBo1isBDZY}`ZU#luwGyh-v(Zw{&)+4XQg{v^*hUAI)DKX)BQ-9MRF
z=aS!lwMz7vD9sb24#!>pV*6*rm55lmEWh!Ld`xgt{t8WDdg(T{Lf_2@AxripHXgOY
zd_c`j6mi#1g)p}c2qaGs`~vU=MK>K@6z1yhX_@fs3<kM7=^Df)b`7BnKoh!KGpERW
zNTtvDy`BeFbI8+F%9FXn@M^t@Fp6Y#Bq68CY+1bV8OH@)#kk%+LJj?~TJUMbY3njP
zS-;Q6Ixa?K$_q$fIM}(m;7&i9ZLpR#&&{d*iCgd`QXMzmkdt|lHR9{JT)V@TV);Dm
z-Mw=8MpQ~&QEKJe5b%S)&pxrq2fVqIGc2@LC2wlRcbhcH%HV}d2wKCivU=|hP!Jzg
zZn~Q364(xRA-|kV9~rl>y9ERPLc<DR<8}MFb7nIC{JFMPajSu2Q$0{Q+>AKfN*}F%
z%%sTn!ei|+Q1G$24crs_(m;_?Y-GE;q0sfCkox5|4sv_nXe!#X=;|rM+kp+2dP?p<
z*MZkzr!o}RN(av}bw^5;!D6=~|Nd6M^WMeM)qCtLf~urbx?AZ|KhEvkFU9L>H18`&
z%dwB_!{}f>%KbbiL^ktV29AN(q+UmZx#!lvp~3i{FdEly`K}7Ija8;&+%#^j=wE$U
z1#M`vHM;C!fst`4%2wJxz&A1(kUw|Y+~FR+Ti<a5#5-fyHz4kfk|ywyoY(ny1)AgB
zwzCV1$Uq}}CwVfb<7#*z4mhZETRG*zOcMIh#JJpqU6+s|5i(|(`|)%8E0l-PT=HOM
z97TUWq)K{q8f!`b{<;?`tAT=b$-(@8QZa@UVvX&|hc_nK{D~2UD9^P<Q!AjjJR0Fm
zy>Y2z#;;vjs4n+x<*_uP>n)f7bZX5l^EJNrJdKz9-7)>v=ns|6U}rM=;`(vii<As^
z-)06cS4^s3fFGGwP-Csbsem#Nz8Rv$c*PQ0E%(nnWF&h4tIKyzT>_h$dgOpP&e#~I
zXk{SLdPTy2^&Qf5#S$}CMn><~LU`l9xAYPsX?V^@B#;wrjw0c?I_#(-y7U-oCT39;
ze3x<){Re9^VR7mf_DU$GCc)d3@a`&b9?jjHe`A{VF5ZmXfv*O&=pWa!igG3Pgu0I_
zpLUP+$!tl5at77hUE_#^g2ePZI<9iU{ys9Jn!3jR*-4CzXXmq#t84=#K;&fBq~W8K
zY)cnbK@gJS4-C=bC^BVp)xR%rNbc|53p1L$XoM>W3ZB3@=-q}tNr7R!<=obzJmV*R
zxR6m70d?lhOo<XVJ*&|}4-jxGj=9hhS<Lg!L)>oaq1P*j;&~SGi#?OLB6^5;0=|AN
zR$%%&alE-6#&y}j&3!D_Xn#cn0>mrVAzWg=Y3jN|hVDHHYvNgU{mf66L*&c$d%I0-
zXV{LM$bPx4>-(ZQZnw@}HVN$%$N1frg87ik{fyTT1v4<>H9xX7)+y2FL7{WQ?e}Oa
zPh<tizsTU(KZ44!xNOXL;cN<w0x9FJN-{LJ6kRG7DT@0{j%`uSu-{!ewVdwc-mXqo
zP~^L_%dI0xSLS!amN=o?-8j!TyUTg|mM*uqh{Li+9;<34W*$vfVsV|$WD6thffFm@
zHR9f0=a+ah-d7H?W#x|Tu`Z^%eBwxC6flon@(o*^jm-QKB;0F;ICO5JS4h>gK8r=A
zL*x<A-RKt^j;nK#2o52%yhp$K7?`0sQ-hPZ5&Nd-M;Z1G7DMz+us?PL4GuDUdYW6I
zkPnW!pV4R}{i3m^m(&y$qZL+5$gFjJzsh7$r=KNYvo${5<4%zIqAk{t1`t@WVqXo1
z@jV{py`JYtG&6~hZ7)a++en%&jXHg{^NA_?c;F=Tc=E9gukO+IHvB#ZAE2Rd;kF}S
zi;EpD^Fxqw%N?&N0&j}n_{C5?Rz}*ezye#R$eGj;Y=nF|BI9#gVzvf`1ryx<6D4p%
z?TX<1XE`QZ#)n5II^JtG)#CO1owsE-67X!+cT9KD5-bo!Aj7G2I2{qvv@y8MJ2<z%
zn6i5fpcx-2(8cP0db!;F1t2tzjv~k;sd-9BinZ^IUfh;(PN1Mnp}1HZSAeoQLO+R6
z4;}NVP&B`SKNm_?_yTuG-`hIG41!#Sma@FM+$2i!M@y%vvSJNq_&ajzk{v=ggSpkR
zD$J|t;1(*N(C^8(s&4vjcr1Up**Tw-L0YyKn|IJIQs(xUrNFxX7Jv;B98rk_?GWEJ
z1SGKgyuXv$@Gpc6E$eNIYu49U<kiit<8BTAQ~#WTUId6%K9Cm;=e3-%QqpWe#v=@u
zUT8Ov(atzsp}}^Qu~4av9NqD1oOlbS%JTSqxb>DuMk98VZ`%G@f|K)ehwe;qye9WE
z+8$<jQW<8#>}M(}&s6^cj~1ht-qwI{ujEI8jGpn753|{9WJXc_*59vAF6msOi_QkO
z;8@1(Q{9J=w-F015N}<i&%Ru*uRh8QoO`S}`gN?tBgRtL^~=A%PBl4q6Rx1rj@)6_
zTHosdMnA<nIa$KMSUKw_2aD~;M{<q}tjP~7&RW=tBNV(}d3%*&KekzaI&|DFd-7!k
zhB+Yo9b3LP9WzsuT^)&r139j#ZkTnU*;X0N+{B#3VjT3T8+CJ*Q>Q$T+S8)C^t)?Y
z=G?9?a+-D0!gveX0=}`gJRv6*i$}~7qqoR|0>7^^=Fb@`rsT~pD9>mLZ3KLUaCTPf
z?QOr)ayKN@N*X{S@)}$mWo-YL@WS*0p?ZrjiFw2vxMG+kiBdoy+udK67FV3v1A#*u
z8xXuPA7wsb)IL^W%opA^w6~Z{rpL3U<xdXmOyLndOqN`BKD<HK0;cpHw`x9o8BFC?
z6ha-4iZxbDQUmOi5KIHVB3jPHIy0J*_qW=I`1_3Qr|WSGlaOy_78Vrm@igK%jU$tM
znQdc!HEU_<-{s~iY9Y_IF^!aQ#_7*_;H3SVDq`#sR(s`$e=rR9E@leZ@*YXQrz)O5
z7X4x%ravnXnK@=M=L%eL<BRf;65)abs)R!TVp&Tp%$0sC<1d6=3$2Y5Dn=(}fMzBR
zu&ol$ioWL?sAP`Re7V-Vzxbu_gL<RAZl(2sSghfG-jvYj_`!tsWL4>(`+HSR%aAh+
zzp&iMeq$)E4Ap7JYu9d;;9vY~{Y+XC(k=DEO__B=Xd`rtl!ER|K{D&uE{`4IXUZ}z
ziSn}v#qA!<jJd!4q{NPNcv#Fv;l8yYuc`hLFDt0urUy*!tEeT8M`C!=Si_Lr>%_Pm
zNt1oDVQW5eUWU9gE#Bou%q+3yrUBn!0O8faxP$~TGqXak*U`N4@-qNds52PP!^(;<
z*-7$M6TQZ?$LWAxXJV9S3E18r`Od$=_1*^=nof3vy7yZ<r)RS=FynTo`f?5;s1+Xd
z7BBc@{R`G9CQ;n)LXeSiBz|A%m?o*NS}}bFG-Cb1_=CIbhZ&01;$=3;kr`nJkh#(Y
z(G6l5=rOS5)pQ4?PPO<4peItGV_<u^FXz)M6l#-ujCl~z62QI)VpC_#7@B4Gq@G<f
zJU<f#Q@5V9=3~=igMm*7U)!ilXl1D=YJOeedF<p`XEVQ{hahyWPtO@FyCqS}@ph+B
z8i1S;#n)=r)wdKyKqVV&Pm%dSRTM2DydyQ|eSai<`TTyH%W4fag(cQ`jlk}}(jUz*
zeD*$p6nJ`cim7sr{~Esk?%?Opqy+t}{lip$IB);}-A;lz@a(6-r=VP`?a52cI}vKJ
zRc)q$BA-*KY4LjODe`qzn@dlPWJo@vTP&Vw@o@HpYvfpL@%Ws)%m`<RwOa0{y`B~&
z)Er%KWaz-!c5i+a4s8OrnVQtux|-PDAA4<^U2x3pIpYc3$)^xA1OTXrKK8fw_WV0K
z-qif|oZQd}^J+p$V~s3z+6_`HtQ{Pfi*iaKJG8?Z8r>sRtH$<+K4eJ>KHA#3#^WGo
z@@l8Go1ABV%&X|=e_pKA)VB|yxzX296An23WM*!iVb3;EC%tqxACI9@z-m;^1eh3a
z8a}&KcxUDKY%IclFAir-p9Ww+h-ipcQzZc*^n&V86N!r%>dgm;8WwVkj129R^~H_9
zESMr_F0Z9FmSW@4(pVv9eANl#==&^3`j$#b(Wt(v4w)4bI7*7kHo2@#ZC*~3w>l0P
zl=ymLDNR#`nppazV_{1%TQ6=}UXb4mTjDf(qA#)b7X-<`Gs0=-<G<j|+RUWAGI^V7
zF}t9sL_5pOIy9*yBGQ1fh{zz)A?(AhR)9TmUSoUR==dpP*q~(-b!qH(n9OaLnzJw@
zW}^9O__re(S<RtwZqMV7{xx{GXnvKysexB@0Qz4{0XP_`9g*f>j&WL+>+Yo~i8pr4
zNirJmZH>Vzk4bV)J9B6fXN1}BJtarJIJpBWb_eKJG#Clt7mPI$Oqb$k>~{tkTa=HR
z-d1ib2SnxjMvIJTfrn#TaR1T^Om|15`!Z677VF+b1tL5QaZ1~dSUvtRv~48dMEUp4
z2SxUuxk#$;xcKt&)_+$B%y+=*GHEcWAeDN>fisG&WiR$`{_%M?8Z(=cvIyKM1VapX
z{}W;m{1;+C5_LWLF9g8}x%U4(E%^sLcR2~0s`H-U<LJjS420$UAX&e?Gk=|j#Vwtx
zcJ871Oc_bmdma1IKU?Ri+3W@b2qj07!S&)rGM(Mv+_ri?bRdZ#X!^M#IH;t(mVTHm
z<jQQJNe@``70dPbr)g_5<2M7VWIfRs1OKbG7s3asN9ZhKot**&{{{B1q{jVv7%~vZ
zQu*;?c${5g`ZNMt4fi!@eT+4a7aU;Y4r^Luy}4csu5HSe($#>8!7^a)u#yp*HS6Rx
z9((I++qR$4O9D@j8^raWoV;g#C6>pe{x%->xn)q#s5aT#8<EX)gWKSjk(x}XOfxi}
zjrO$#UrCHqT^RjrO2Lr10l7OucV5@<3%QA$%M>0v-hm3gBK^bo{ENfznY6S)1*2N(
zm*7mpWi3nSWA^x-j^EYajz$C;0y;`eV}YdxAvn^wlJeSp*WrsZt~n)?aRo#jgY^T4
zM-Hb1J1MRXr^$>*Q|OAOY(FlyBJk`kqOv+L>vC0OvsjY!EGTx;&Wl_tN+!8S4)Orz
z=AaJ<s_4HLmUYJP)8}vy?Ssz?3*P+~x95VkV+`Ejsw}|_aQfWBG@pws4mX0pCDk!9
ztC+l9hYQQ-ld2ivzI{&MjInK=r!{n=Gngo*B%NeCa}=gbQ(8_z#|?#lHj~P(93At$
zHwC^H=t#|~xlQ`~m;f)5(*ZlT%k6!@w<6Y1d^cdCR%TzTu9Dyz+0H`{Fan-F(N;Ii
z0N<THm*5<Z&{BVa!;3R8^{Wj0y$*~=PqJrZNJ!89rkc2@YL-FqEXyNi3TdrtJ)?^m
zkn?9=T)xE9{&J!Z8s=_bU=lS!S@Y64f!caQtc8T%76)Jx$jmpou_s=e!xa%1Qj$J3
zUW5r}UC~ge=rgba;7W-XmzU?}$kacA{WelrOUXA67a?`VGg<x;YNx{I_9q1jXNDbK
z(2nTy=iZQzEAR+peeZXTx^YyVw!+1AgjXF1TAU6~x5G<GV=qQ;gQvrcai1zIRGi&~
zLtS-`GDb&RL|^;caqb0zHWWOD7CB`)30)B)od$0`L!=aKoq_`oMaKB+w^B#>nvUVj
zYwx^jjxIJ!67Wpe=DFh2XL4}Rw79COC?`iq;5|%a)>mU~a1}f&mV;PxfA6$|_B5uA
zx_2mO$nvFCxE*0tVF~w5<Q2Jjw!PqK-F)OQ?yZnZs(TpUi6a=`yBWR}_2@2H$huh&
z0ur{m61NGuMVb`FEYGh2Z&{nRV_Py-!hCYamDw&rDWw;LUf*I~u(5Y!L7VR5+E-)&
zv`pm-9IEJ9#7rRWMfu~A%&9EH6?Z6W%km?(SIj}t!`t)6Hk$I1oZNQEAi}1rlRnNo
z2A;urq<5)GcZIVE43i8&KfNZHuSdWUnqjmIcm`MR8@mf=Aj|&SXDUpAk?~l=_S<RA
z^zu~GImMKzo02G{d0)yYcqg;9c^K;}w>TuKf!SowaJx>O{_Ed7^rt5!u17s0OzUDr
zH)P}Qjwm4!iEh|zcW&Dlt)@(-Ab~HwFKc=JZLl_a8T~~H9U|w&G<=>`NnsfYi|M+r
z@O7d-`h<8w>#rJaz!i6|wnwvR{~+wDmA<>TL78J1OEC$+1E7ve5fE5c1DggW^q4!j
zKFDTu51#z`s-qs0<nuc)8pf%ijGU7y>~3x!-tCki^8`!wIVEE}nLF(caz+a!gT`15
z)gf|M>!WI<*#Oi2ySVtl>a|W#SOK%^P!y3w*?G5nUKg=)QUBN&oWj(@+mLHA#aeu8
z6w}hux1AWnuWM{jx?RC3uvS#Ah6|9}mzHviBPu4GEogLXrEEG>TD31zYN!NrUu-7a
zeYD&Cakp~rE{&!_?(vlFJb(MPGZPB#<EZ=Gka6r9>@@%`jmNtyle6@PKyit8M`ea@
zI$Me?M`D|ALw(^F7jmPW3F&p`Lwh~~CT9jyIVaSF&yR57=M3d7lo%NxBtS2NG4|e8
ze^i?M4$1<Af+<d#F9>D{h3R^ViV7uH+Uz)1G*Iw^LqYx|iWUf`1M7`5Ba%O(%Yz0%
zwOH#kfw+S-0B-dd&#!vyoEDO}Um~f#L>5GKEl|jCDEDoyY}qg85`DNmU#`1|0AO91
z$VSGof_n4L<R7+)=Ja<TKE*6^wf-@-BDURynI{3SFRo?NOPckJs=f}w7qnG<k!vZ^
zWPSm5YBdM;72(00;fQV=BjA_b15CO$osh1{Nfajhsj{};eT0^^kJbtS^oEB^L^T~g
z$W<MWq>te^;-c9|jlHmuTb;qymm}?Ot8;fqC4hyygl2_T&MHCvOypgZPVREkabk^~
zPEe{zQ%(EzAaI?9JaBYx;;iIu`@&GqR7PFA@XK>WV)<S}Ret_gK|w*4qsE8c){&uv
zpq?M!3zQA5JZV(TtyV1utwMxp;v+L%cKxjIkNMn?Sw2OYTk{>SO+<lujrY{_Ym0Ap
z)o-STF1I&}Husw+s0owVumOf9TFc95_&6bXtKaXBzgUmmW^YaZAji|RIhJ(VV$?Lv
zk4<xr-18y=A;9)18wSp@1RL^`)lAnH3(wG8{p)ZLclzfJd!mA7{h7em_er17_f2L8
z6}A|IsWhGp%1$u%_ghWl^dI!;lnWoFuP?lz_0}-ZSA{i=nS%$aOoo*7-T#Zkfo(1L
z{Qs6Xh-)@KZVvoETO8EN|I6Y~;BKjenUK;`zbqweb19a!y^FIp7BIg7pneI638kAw
zdtPzLj|s+W+XYad=N2<5Xh_fpe6q9vD456s@Fym!?_mn-RIqC@I+!`<c6Lu0WdHD-
zlmexsmQYvp=Ht)>rdBfqHjEvB)z&`Q|IWyu|8|*mJD{5;s2Cb#%|VHA=Q)aVB|x@?
z!*ATFi3-MH0`~u#rGaBWPz^euL<vre20f^=CZ=^!Ec!rfz&BQ&B{3m7uPm=50mdf&
zeJR&If9`;kV9wMVQLz1uXYMiib{LQ7c0gxpTCi8G)kwHPIk%MypAkJ3Y-zY7wJ7YK
z<c-hl@R)0J1$gP)Y%$739AOB_x?OC^zBy8|0w&F7q6Du&{h9uE%_*E+uhGdTU)t}F
z!piwos4p7G8+|oqn}!@3>v8ic=(aZ_ObRikvstszGa{yoE1kk%yGzxct3q#T??exU
z0n^#abXA)11<3o~mUOE{Cq!8al4}`=m=x8-{?#z>*LxYPue^fmao{!#GWaYdOe(<>
zT~1tFV%6TdVe%a3=Y))|o6N$7a@TlMT_28Fpu=izqm0@!@k@oQ%)?NS<S;k&jtn5U
zx^m(({R`Q9(EiXQoiAGHVok7gkls=pP1zlx?jyT~h9{n7i6eWNEe4bQbMEK`2_y>}
zb0|E#tSo71sB7}4Cdh*CU2{sQ)7sZ(6T`Z`MEcx8|GISmSk$_7Pi&xgJ9kve;uR0e
z6bu()A$7eg*hUT$zdN-^Iau)A8|CX^2C0nA=s-B^>eZmz7>t7mLguj<=fcmG)Ff>3
zGU48`IF47ILtoh(J^FlV11zlO6Jm7~X-^9G4-9&Hf+~A><SzxqEGnw6%WhXZpRflo
z8W=eLg?-sg8%nF^IA(v?_#SRn;~sRp@G0=$qbu;g(GyK=30XKZu3^!e$ao?0#0l8v
zzZ7HBKJ>?^D+MX#e5>g1z-Kiqp;fgsl#?Pt*L=DA^A6<+d>?ug1u5Lj1FLEq=F@a8
z&-}tfuy+YtV%9M(Z(i#ZuE!4r6>aKK7p>}63KUC~^xXUds5(Ha)pk8W?N>X#n(b6*
z4H0s6=M<S_3@5GCZp*Sc=vf$8=idU97i@pJvpRHkbW}+vNbhw$w+k0oyjKQbajv@}
z2^EYzPti@Kn%pn0%k3pX?-PBH+3`QpPjy^jN}SvNFu@|aCZHi;nxTQFFg^d|m<s>&
zklMe?`FJpW)8ux6LvmV_d9X0$+h1tM$ye~&G#RD%TQ5Bn3~FvlZhS|N$VHo_<Zl=<
zeRdDvPLo$AiMKv|m8pu7)_hJ9;8;paDdF37;I8}W+i?f4(D_DDB+ZtbHU>xg?|RbF
z|F97#TBh=<<~ZL_^=`%X0^O-~+wGg0m}%&}&$$n}ZgAC_e1=6b7SI>5?OmPwguSI!
zPVmZThKIY?d0~qZA6BO|6>L3FS9U(d&N|*i<;MYUPt=az)AznQ7C6WNWo8#Ur*h<{
zZm;t-EpO&ZFh>{0Mn><v^t3pnj@{>v6S&%%L(|i?cP>IBge81@2-O)sEn7`YFT_V@
zE&0p*gwn2~w3K!nwsIuy?rWT|x0jpYhP{t`YFjZ-6%M2%px~xq3qkxD6cKyV&Khs|
z89M&PicK*wp*y7=H?E-6`I>BgNQ^vQMp>GXC+EzjLm2wDH99lqq+Mj(ZI|wI=0|ME
zwzdjL?D#rAiEXJ!xuS=x8E&)DENNdtLCb~q7-FG#<9EnIBIOyA4AXeKn$LXmlXLIT
zN^IzQ;_F(e#cV=coN}m$CUK)BS?dj-vNXFt1W(?#6KYu*(mYM4RC<Cdhk3;Sh8%tQ
zr1)C!UC(~_QP;{vLh|e9&wsA*5`6Q!5_5A&=R&P50vtSbIdd+;JqU_8#(xCZQrm@}
z($nXD_)^HcuuZ{I%oJlWDXyX<4lb}>>`S!tj6LL1fB@nKI^&HP2EfHf+f3}UCC7&*
zaJVE6Jo9*qNjSS4%Mu@v#zyeKMKCjGjNE;92?vSGf80UbHfH8^N@+Te5)TUaKz$M3
zShH?;t}~wJoFTV1zh^&+m()GI1OHEa40xnRaQ#W*|EDC5nusM^BG6;(Q|JaSEAwdG
z22H)yug=Q!y(jPV;bL>{FPM`)cV{bTmy0+cf@cbfmyad0C1i`vTWxSWhP5E|XlCkq
z1^|w@dh@6h3G_{OCI3!{KG3cz5N`hu(jdEeX$7(EicUKx5C!J>o&k_nBDpe|OL3dr
z!ivym$F}N&Ah!^3w%nK~f|X#+pCZ9|Gk{mOoTfwy?|&L)Wi%4m=ALgsRtJ8_{%s=e
zp;NOwmsgvdR<%%+mC+jA2Q}T^&k);s9Z9`&kSy+H{o@VcdEnchOE7}&>KiELdr8G}
z0vorWrM<Bu^xZh1u7W~bgp6I-E?GxA59JXXL2iD2K4(_jkOaOQbn>nAgj}tpf3)Y5
zjM|zP8+wM}!wv=4gHLjshcsd0ohnv_@okeqU1nzc+a4ERIXgCPDNRLrU;c{f!Sagq
z6l-2%D}LS}CS8Pb@)l3&*y;50YKT>Ag02v|HvNPX8@3v?C@wqc3vLBFhdSm2obB4S
zD;{GfxU%%`(OrT?vHplSjEV7Qt6B;u8YrO^BFJ$UU2()v7;-5u?!NCn)(M9puIa;P
zK_C*FwY6G%Oge>w>}fo6d&I+sHQS;tD+oA^@^0flTg?q=RL;*uTGf9f@PqjJp`%b2
z8UC9#;)_O@j7p3KtriSfLy_;^$|G9yX&>PD(tK|((0zQvS^9{Yp9fDNaMKBIx2?6t
zbH9kZWosxtt*>O_DMVp&Lvn9x>!5KmF<twGq%5MZWdg)i78P$~QA|qH@DK1(^WyEr
z&&gq_u`Tfse3Xf_Vt;ct;LrPVo(Rj_pSc#^1Bl~v9*ytDDg*%ef^3Hy^8UF_v7GtX
zW*_dC(BJN$j;ZA9ebsjs#Xit;8nx2O4!}mj)`O58BrXk{EiSL2m{*Wn&&9}Jj@tIK
zFt|GIvMuuYkVZ7qxEWh}pO|)gM$RwJmDMcdmT0Or%ZhYR=p4Z^kU!iQVF5$9GIt^F
z-P)R!qMaglAo<;gTu=;jWMZGnS>xl}OOXW?6b$t^?GM~&_4|nSGnz6fG<^e`$t>y#
zh(GR!4~qW1U{!;?{INnL;*;cAd9_?gPr!g?2$!CXM$-WqcSznHX=sAYBxX-5HcLF=
z7bN0#(x`eKE8#Ec#gkIm#rdJ*KtS=sNr=Il)Z#hsM9UL`*Zaj<`{RV=EF3C#)|}If
z)%uii|Bu3MO`XvY5t?L)`+S+~dI;69rXzHxCEQ`!;=aW(uzurft;`L#gXY8)o@Wlf
zXJUGI+!@2EXm-*f8~xc<9h074yS<YOMSq{)Njs`+-g4I`t&x8hp<c26d%^`|a5JH=
zA=5G~=^;l)C4kG0TStkDtNIl9)wq~;+sWfI*!~55P8iTwnkvm|2ijx{b=VyOp8AjQ
z-3~&nFHWrNc^w|ksHDY6bt*7-BEnjhSz0KTf!$JK1;Tl3Kg_@N_0WB$!XludLW;3P
z5o#(X#<x+C3>OUJp^ZfzGV4On297vi1blUx=RA6<7>oSR9`UV#;r>Rz#RW~dRzsL>
z5cX#Ro%6M7XUb(gh0PGB(Nl_v{32TZ3}HN`^$hl8PbieU_{LXjs+L;14dDuA;6qLw
zRB?i>|6u=Yfec$`WhR%oZ%;Tohmw}tZwk5xl-UMe!;48bkCj=scYKHh9{Aqg3Z`)~
zjiP~p1xP%A>u0@mu9rE)lfE~Yd)WR_sh&avsB3%RptQ5a`=j=ZVa^3(cGCDG|EXr1
zDUn1J;h}EirzT=o6_a#IJ;b3V3PbzHes!P)V-AmCiVdFckD<=I9p0j0MkozC*ZQT-
zR|4_l6@GB|F60fW;2S<gRS&EymCo!#)wX6Msw<I1sC+q9$?7KssO#9b(h~Il(nVB6
z@U03k#W)7=6IMRdJ0>sGU`Ln`=?t96d2+cuQD3_wJbAQ+j*jolUyF|8d)0JWV&^tW
z-useMz~Mn@jGu&ZdEY?aV`7?E3ko;*;UTIs{33vtLnl8sTuH6K7jWz+2OM*0Xi8dW
zqa;}3#cf%+OT><Upnha2y3UdkLP0^z5b8bW&74|t1Fcz|_4|%5E`L`zL!|kR8cpxP
z^fxD~#McIWVgIzgUdB4<!cKm^D(<E9=@2cd?o#m^;ad<Zc`sbVC?ws6gSxF$Kj8Jt
zI{LxS*<KtSF^)71TjGk+_<EHf?s(lO-(n<=+1V}3y9NsUwWbsmoc(yS3=Eqw7{p6{
zp&Sh+%J8Gev<?OrMCn>2TVuNucgNXSE~g`GP<Le^wY5v`dGQqAa4b>m5efal#V^G9
zbiu*JFU*d;2)V%Qg1dDVW$Aj+0a4?k(*5-sGLv1ADBBEwRNE0rI!h}nCAhI?%bW`y
z)sd6ZsXC8UaJL3XSdql4trU{LeP{uHCQqfqdNKyo;@>r{^@5rkxK+lk|NTUi+-X8a
z`|?lyJp}%8b0k}XV1^%GG-=Trj^xUfK-ML7|J(uwFaf90)&~qYR?0||4d_K9V#3?O
z>gbQc*k~r1ebcbr<WP)p_NRbT&kezs{MlEqX?%K!6Q;b}Y>UOyr76s3-E58F1*JGv
z60vo=(&|QE-?$@@pI@Dg8ugtCeLzB!#}1)U&$f4}a{s~Ld+CQAM;19(E!JwO2_{pj
zSe^!vG>6Z)zMO`Kt0Q`-3i{}@q_-5MR7$~w%>Dg+KH+Ofg*%5^;w3;QlbxUJZKl+e
zf$p|TM1n?Z1hu-}p?i$;D;6F*t&Z#O4btG_?Fe;U70Yvn`>VXTYV3195g3H}y!K{T
zKcNu7xMJXAWOre~r>0uhp&r)oP5wTITE%29^8a1xB0^_yObRE>&Vh+LQ`nG>_6Xt9
z@oUZQBA`q$8x<3AQ&iN=xVWNF2<jo1pxsc?w_SFUR#lUiYj>@MbtCt;Sdd;=MFg4t
z%r+R~3@7qEV00Z4OF>Y@O`(K=wW(%^uA7KSW6dQZQBZaS7r{AQmpg(Rrjd_rpT-uC
zB|3A%C?w*cZ)7yK@Pu}H^@lCr)C@U-UfYZDCMhS4xu;jam&f%FS8;^%KpQo%eJ%-k
zjvdlQh2kC|LN#$IrxsN`wA!qc4!mVjoZH$8nUMl{K9Cs|lj>-=0LJF&*?l)H&nZ=+
zsDy(s&=Rkh3IFRH@&ChKN;wKEQ(TPsxX7M6Z!YWELGIhlu57xnsHm?mrPqO&pe<%2
zmf}`895x9bp$;5q_Ut*%lB{X_MT4|4@Kb;v`Whtz9>}gfnfdhM8JaX}5B{mDb+I<6
z>b^=+0n`!%kOhzt+94^b0x?U<*JmfGl-IwPRbpHd*F9Wwh4n-ytGqV5eNg7JbSE;E
zT_MGvgEzC{ml|&@&<~|g&^1%b{MCw!8q33Zu6v~kK8qL=m^MUA)VKzawoz~4D!EiZ
z&<500yjlX6uNFSj8ei-V1lbiRMA<qaJr1q(qz1;SMiR*Mk(DAX2Er=2Le66zFf10t
zw2mrEkBY98p0d<U=b|`9pL~25XV_@H?`fpTA{#>7#pKT<%s5%DX^Tx3FkF_DmqDkc
z*ZX|5T9MY=L>J?OTZ@Vc(_sqR^uTQV@!<5@D!xrCd*qS|4>tIa6BL*fWYZ#EWPl57
z@d=8hmR9SZb*rN<FoFsc(|<88&Sp(y5rF9@;iNn~+V#GbHm}ok^@vYk*e*5AGTfmk
zNL~P?@Fg!V7uvqgD(?pcIxSGwTO{q0g#hIVPRwg$-CW#eS6I<J|2XqXzH_;86*9lk
zv43g`iWkm8RQ6Xu1>G+J!U<1+jzC)rG=vqXxOZ^@Evk%KGX(s%JE4nWIn7vjT4xV{
z;qPFMfRsV8p|`HKmNa}QBLc3I`ZM}S%b#t8P`drB9#2&hKNVk`kf#tB0<z6XIwd2d
z6?Jwaz09pJe-N)O+tUMgli%NU#&ug0Bi0&gdG#dR?1?8A574P>4o{=rd&0%=R%$sz
z+;Zj<O<S1@!^j-AI!2q)qN>4m-`LZ07$-?%&{`IY>#<{E)s{$P3R;Fphs7}F{?iWo
zq8;~m>pq-TjSIiK9A<x2Y9A*ssoF(_meIQn#e5Dw{?F(C#-aWH<5-ck7ln^pJ*d|a
zoEnuD>Z!?+B#)guI83=8S<@IUvixu=Eay_ls@z_tsZIG<MaL{`n`x>;LIC*ebnJWD
zKf+1Gv?MVJct%xWR+>E)dZRD<BhQSalWlc6O8I!moH+rw4NPTzm?PVA<of+EG`zuA
zV<<m)<9!4&GNiDFVO2YN<DXpV`?qQ-Q=PbPk0U+pwe4Gj9O$GP7z+uD1vuYfDNa%O
zQ>hK;W*aBT)@-nAGBFDs4f?aGjE7vu$0D|Ccs;gvsCmd<4(%0J!UQt%H|@u~!HIVV
zp7GcOizKjfN@Hf?!xtW>1i#{niga*$bX)pA6fWc*P?h>I&6+q;l3Yvpz=v<Rv|&=*
z-iV$GzSb29@n(BDk2u|@Kz-9_9h|f-t&q+&)^V*?fA_f$v8>T^uZBJB1UU%nS4WPN
zUkbP9xdr3i&TJ9fG<)%j!Kx8QrF6sN3(OCFt|^Ybg4TDD>!2IYaf906s?3YN8XG~B
zEG^qqt|@uh9(oVb%c=AUG?8-6r{~Z3L+$<JE0@guWC0j>aaH4OGm=8DW|-q|fm(Hm
zb%NXm>ttF#160{{J7p^Zcj*pl^9t!MCsU_tFZKIajl(RYUXDfDq$-bk0Jm5yyBR?N
z<M=SaN52`Fg6beBdLcVvPhQ#Nixzjz)dv>c1smyzg0k(|0LoGfOG*i;-;GQKUXZ91
zXB5S32i@`G7tJHI%0GNCMt^<$*p3bGdU{3P!5ZJzbl5e$N$UnP0J_^;STDOcBc98e
z96Ik}MPX+hr$x8^CxeSpDU-=*xqG@}J2-vJxcyRsq}b(6*fyo1Yif{=gSpr#>feIe
z_1H|~V{Zk|zH+vlD0L|0eGLXb1&jtvc93z`+!nhfo<+!lHzJ~P`r^x{sb+mAM4*!L
z?v47tJUSR_*wLSN9N}F^sVz!{o@iIXg+^BFW@u#X9w%)AR63bBBXNVnD9rKGp)VKF
z4DcWtXgpUEPX>>8J$4IOh8AbQE+$YecgA=1cbwQ+FC3Oeq)BZc{hKGNgE_kT0mGMa
z*uUMrxs5T*2<=}DzHE_NY3`3;dZ5XL_#_O3&L(k*STzE4j*cvLWn{1NDMzrOP)u*>
z!@$g9n5~|0F-=*!QC{tgdA3w=Q;C?dq>;IXt7LqJ>09F)`I$lA{E~s$=$Zj)l4J1M
zx@EmQ<53+)wd3w5OWoXH2W8`9j4{beX;c+pv{7yva-#0)ft}m^0Kn}e%OG~2Bi)CC
z`)tbGK;RkC@NS+mCYpwarRe4=5?k^EBpb_G%ax!V+Qayd=>Z~UIe&l5eVzM#0M_#q
zr<JI}Bea%#F1gKKQ9licGSm0i`665u<*|<~^T`CpVqijOb%V?pdzlv#iHesr&zR(v
zF93j4<MhI!j9B?+0?Xh}fdZBT<s(<gAzoE0lf0p=oXJwBTm0F!wZ&T6Xl!FmUI|@Z
zt7i(2vl%Q#=1ks^Qd1aN%Tk_%%3o*^1h{SbKj~#S(f(Jx4D0`{mq~jtEQyycug9d6
zsi|rI?Ny&_pxIE0j2X^Gv#A=z*z~jBgI_vKMqA(5*4+VH6f`udy!N_6T)tWIu^n-#
z0)yuP=NgG8U%XVH#-n}xPsKs6i0Y2JaLsG4w3Y?w*8kBjBYpb+!7np0suSPGZS+sm
zx(ihl|1&+4fGg+rfjDdxDNzT{PyH|6+#Y+_IHt~;&j<kXCEcC4Z!|NUDCijBjisTG
zO&8%EkMc1^ZSH@z0nba|lZBCMK_`f2X0F$Z^OD?rxGw=Su{;ncqBRfuX2$4GK`?PN
zb8K0{RGGg%o|S`UyU(a};CbO4&gq++>HE(=6k<}MLaG936W-qIj1Y5O_yM>}-PG&l
zWh>5C^vc0TXo0Zug9JlOo?HT?3KPkO$9ocw*l-+nT+$0u9e#g%5MZ|hjaGmT`5RR6
za;qa5O-cd7=v;7R?a!T3?HlE}VMerw4)fRXH`1fZQc@a{pw_{IMa9!IiSlYq&&MO_
zY12<La>0XoyBM<3v>Ev-Vug@P%jC2CaUq*j$N)Qy&(=3waf(0XHRA?XjUp*S1GQXx
z?ySV*SOBP}$1bO$wgj6*z5qB}OGcvTv+rlRAy+lRYIbt=vaTMF7ea1|$hIyA*tpJI
zgW-oE8d;`4*H|9#$A*YUjWJe&GTBG)73>^%&HiiOLWi92LAd2T+)LMb0_JQ5Y9KQM
zpSBV?(VAS(Q=-oMl+v;8{>hy?<T41wbjg44TQp;b=UkZv)@Q!<>Y8R*<Kxp|I_g4w
zDod@Bo|P^%pVDvAW2IFmsB+u5-;wMT%i4o4R%GH^@O}{raOvP`UzigW<l)5-GOChO
zDl4yfRdt@>zbI&;;+)X&h!(0)qHD{1CT%lHa*UowbsyFQKj0pVzz;a(-N~b%5BbYl
zZ?CIK&+%mTFfCTV)my9@xmkv33|Eue6gO_Zi}H3)wvO<KpjZ0(38)OItZ`5_MDDw9
z4m!ii+eDEU<80RT02>GS607;ncRsy5YzG<SpaXf+!80u{eqWaBLp=Z5E@3^m-T7bL
z#9ST57{IRQND4s$(ykp>>-Y*k9Ciz4(3=74d0NVND!boQmyU#o3nR`8*3C6wtHyqX
z=O&{K8SjswwnGsc(oW#DKK_<ZsIoV2=rPvbZlP*$q%85nbDJdn9Wh%sB3_rhE^tcO
za4YDCYr^qM6TDKL1;{tGOVAkiR-GX4!Es_Gc_5YBfc1WtNpy3-n~0IPCzr0n6O`TI
zwPFA#eQ3M>jU^Cmt78bD{N}};QI$xPEeZSnQn!rEPmF1*#RIsZmCb0X4QEYnQs3FP
zc6DfQW<6*Qa-tfR(QKuvTg|vl0*6SBC3)<#%B$Hb){oYiFeOAF)DUtF)pd5T=d*-Z
z2)Vdg=4kTKG7%>_Nf#Cm@+(pmgszB<yf^G`?}oP4RM=**W)sp4!UDH?2)d$~)9Zz2
z%;~Q$*P)2kcnsP9&t4svFo|PAscJ3M0$ab9mN2HoM#iVFUw6-~BZQ6V-d(_~VG{&#
znO;vMK!3EY|Fh?=iIrbR9Mq?GVG;|lk+a<4=4wE2n&27*&We}M>kEvNos~@)!}-+%
z0_GtB<HfIp_pQ}QoULxjxGV*r4kup##^q)Hz$8`d)pt5tnbUy#qF$=fFpI53bfc0&
zMa^AUI?}-P$zp5^u7(wqX6d}c<yeg5du$>9pk0iq7w%`tEsfH%tB5Pg)+yv%ud^9V
zu0NN@vPa#&{6qMpwjRSS0*cfq64b;EXLwLIeUS|()isyFM6|3`d>vylwT1@C-LJHG
zzT)z@3R#Mr^|*BSx&iI46ae&DUc<091LPhd{aiw0=v(XTa#<$OSMA@Pca(!mBjm<d
zQ3s%=+Ink>4>Opu0NESYii7%GG`-*JN+qgpF0drD(@0}uiz{^OmX>po_D8w|D0;co
zEuphXG0$aJA6k0padF0>e^iu|NQk;_iYqHQD(D+)YAj+*bSkxq+hlwQeeuM-8G^97
zCP*o-wlnl(Yal<m*i<nU^{v>n1|yE4o}DH?c?j?Z@RI8C*bgjSN*Fs6o_4<d?Eh2b
zeqY#~SoZ;U#QiwOCLnd%kN3D9oOV7X7mY_PP!kx{wD;{g((~wK?j1=;{Gh70X1B;!
zrI^>R=Z7+Omm1M4lQB*BC$M4-yeT2AF8u#!{6St!AdS~4;_ILA{$0~qt$wHw6;rtC
zSXw>UbK^TE8i#Kdzl7&dUBecE{E9E$QC)kATU}i(3S3ZA1CMnPe9B@Ij<GB0C_F1z
zPSVWVxeRC!qDp-VUWETGFH+UUc62sVO1r!+<H_wlqbe&$Xy_=@f|KQBbB2;S_$tc(
zT?(}0Gotd0z*oaVlu^$q@fRd`;F?z#1QGQ$K6hzE`oUv66$xv|bdkkey|Db>-kuM@
z<Hhp198mBVR=B4|{P+C<euMb`$G0XXJkbBS`Z?@`Oi*cpA<f#J!5|BSn4KBWi_jZm
z#ARir_*IFUz6R>;>(!O=2i(4Ocrye$C>h^Uogyx4mL2bS=fG<l;j3u|e{<tWLp#nF
zb~L^;v6GLcUiPgk85YhX9d4=Mlf6MbEN2X(p)Me@t$M98E|ETl;4QUqsQ!-*B;K*&
z0tEvV5$<VsS0MMbNjXDY+p?pt0xx8Pn_qRq>{U~ae7LJs8iKC@o<RFZLQ#JQ(w*a<
zt-g$wB?amj!I<20%>Ch{ymYtxH0mbmmk0sN_44?Bms-Q*BwVPRXYo7x1EQGJGKq|q
z&#dbi4DN=}U-+5sRKGq{s<*SuhA7EPGdAZd(yFd=&L?Q(u?PE1`Ua4H_}({AXqHmN
zv@jDf@Dnf<{LMc8Yf)*SusIHaZaBP#MhHU0y4_3toT;rdeCk;y#fls7nIliA$XKE9
zm%U+yJ}f;|32HHI`F37K0AEXMu&KK}5MbriU`E;1F`I+3)fN2=msPOq7(l_D)od>Z
zdg*nZ+u9MbJm%doI8K?}!n(jnl9S|((-u@|m1w2h-@4PvUvjk436D-w8X3cbb(fBR
z^Fwn^ubQnpwudoDFC{Zr&qanQVd9e{_U^oTT@*hq`1ajUj6WnnxUupiEa&zn4411y
z#lf!$b`0}WW#2@KNrHc9@>ukpv0#m-OBqKyY)qBoy2?q<qmTyqm-_$J+m{D5m38|D
zy3s}iR0ISC1QnFIfiMIx7)0jD5JH$~ndccH3<}sN$RIOeQf3lDm;w@ns3;)w7$iWD
z*?@oyAp!<&x^LBcb#L`o^}Tv^@A+?^+UJ~g)?RD<etXwidk=hZSNEk){G{IF`Ohp*
zP|Z|kLD!scX}Ns)^N&={OhXCIdl|p{j2Gvma|g`p$M6bF(X3i+MkXkG%uS)j1$u7!
z-j!2&9*0*;<qTSkd(73JyY&9L3Xo#Lrx6;bF15MiJS8L?`TN^by1TBxKm01^=Pzqm
zMO5-9`321<U$#AX*>*$lN$fkj!iPBGwc?qT-u$Q<_RzYe33FfRj=m&VSnDn%p3PE>
z^R#+Uk-$PP@;$0ZZ6v9@rEOO)Hye4_R;Q&AbgU|I*qn$s3d&7VFj`xGug#K^oXRo2
zK>i|Y5{Yb+Fx=W-YK&G6zEDxxW!?GuxVGlv5GpL;GS9~I0%`A(MjYQ3$1CW1$cJU6
z^9#6-CSwITmxw1`TP80{37Z<JC!SD`x#8IB=blC>=5Hs`XT|NmcNl^4$9Pta1`9T?
z`z-DmrQbFIX?}V>TlgWPzVMRY!{iO=F6B#O&F{K6u0H<ohjW@0{%YC%EKl6%3|z9?
zu}<c>@P+RT|6sFOG<|I%4oalQY*E4#VQWcWVMM6gz?BMJEF;LUT$s>gmeGG4pf=F)
zrs=K<{Pq2;T6H;_FnjYd!@$CrBh&c-|248&=bl65k~@WZgFv6r$fE5wvI4x%BH-Z_
zuFH7_o`$yX;{NR4hsCi&N1B6m$1j9=d4_jYR@_=&RK8&s-eFkSkt@cYAf9)%diw+I
zyOfZ))|JEFypJF?QfYC=XS9g)`u&&ErYA~@hOH(!wP4KM)iwxWRZiwGfqo5TQHX^a
zV($;V8WqEtV7IG|+f8QSmo1d$st0I=hwqB5X_&)Y*`hpV-kfbUa<)iG7M?X<7u{ZC
zCwHVlSWkD7^q{XhWCweOS!Vm@W{3Act0}gru5iR;sUmPNK4-EFF(Hp*?>0T1rL9<T
zk!q8rui0E<JQp=k`MJk-Rv82h^4tk|-~l0qx57?-76Dt4kjvAhy*+eK?^-Da_h(EP
zN_&UbWlb74_G^_*#z3>5=NZr9@W*WuC3DisM{XXKpff=sNBVg?paMa=HFKAUP9fo(
zuDtHfQ5D|$yZtPKhU*}j#RD@#_|_P)X3ZR#yFCOLc4&T5gLh3Wg}=}?<`zu(D#~L;
z^nH$=6&W*tR-4GrD@GDC2W0!lX^I?sb3>BjoTY`<tv6~&Y3wUzwj$o#o)aDMw-g&g
zqV*v$h>c0X7~A9xCr!#ZSV$I}C-4o*oQ%oB&!Trf;u~9ShJ2GGzi%tmSD<~TXG{6R
zbSC(W(BViezq>OaugH`x-qxkTV2|h3OEt!cd5PcgLQWHS9sD2KT3(=1>o)bW!<47T
zpD#jP9^2?dc`+_0s3l&qM`80_ttOp=LLvx_W1`{hgh)uX!5dj)!HiNVj6&w>r{NFt
zt`g!I6)2i}WD(S7Ai8}#%VM2UN8wTrX-2GePgY-(5p5q^9$yNqoC*^_6&8<Aw=I&V
zUG}#&p9V?=2EWTS`WPW3X!r2@esuOrcG{pGE_Obi4Ec0CK;r=D)yp{#@Hfa&?>nWy
zDutvyAhNzu4<s%`;MBzO(h3od@3C9d@jnqN$vdb2h*$#CJ?ERBMpnqU3Nlubz#gQv
zTl?<u%mV`@LfDmf3!E}aw$JA5^!5i8*&nc0Oli2xj-xxh$BtWIn_S`-4F^QNj6P{h
z3>j(-M|q-+ypY(H)E0GTNy5v6dOrMSiVK61QN%JszPBDyeEht9B^lLn5bU;w`ev_5
zxsnBD%-jjIMfV5YTu|8>q2Jk~bjfOZazT{6ch}z~2MmD1bB~93bwJnpZn-H{<On_x
zR2j6OQ93q^_qv*zZq<4K5ul)l6$X&su_{L;!B#1ogeEI^UiyTW<)%D1YAc}5H0BiG
z?TdOD=L|b1tZ&X>Q8sp=zvF7%>sb?*)+>@d%6D=%%f=@7MzYInf-pw-97@R}#PJhQ
zvG9+VHin@eofALDT_-HA1rmTIJtHbkglb_9V_x)2k1dm4KN14wjW*w1;mUz7)|>;6
zOAPLPeZHN?%&sNjEJLY7$)X#Lt|DM-F?M{e*388D(F{!6-dm(yM9Cm-StfvIg<ZyB
z`W2G0mJODJPp0hlpgdbbkb2WWjlrb44pES0mERnn#Y-_$2cfMId#FoGUR-MWj`TqP
z)AefJqdhGjt;;{DrK~|cY4R|v%0y@HD-Gx@*KQeou`(~`^}c%YS-@A3X^65f8ry9d
zjA;~e0E1i1a;z40x|v~(nRa7Koe;{&rVc)%bO>X%tLzVMR?KJRNt%Yu96&0ra5SB6
zYU-@+Gm#mcaAoi(4~-cEecRisb@SCbt?LzEwN_qqFACqRxpe>{?qr+;r&T{RPF!7X
z1<rae{`}O6vUZ%VRkJd^Yp9$617Xb^F6WmjqJ#D}pgX~V`hSY2$PCjfB48fM8Wf&M
zUreHknm}rN|2r*+;yt%2`S!lpcXcG4H-s8;AqYR~*&E<>ugq+;JOE~Ir>bTOPY$k(
zQ>yLK)E~&p&WRxUnS3JM+)WKId*LPH_x?3O8XD9$)2o`;#s)|Usb%Bf`+1#l<dpPr
z!IM&N2o*O?8=InUw2kpkzMtr@s1%QpuLuk4viM!hrZQjdAj3ej_skR8X!C0YBlmC9
z{N{1hs@T4=<2r4(!Cv@w(Myu9kxrIg)hkWOxoF;U;L`Q(bu*};p0W7F#riVR#&1&Q
zxmg5?YR7Q3aemug!aYoe#r=Hx-Et=c%BHYde=t}1gQg_spL@1YBLVS##;iGZ%P5z2
zy{Xe83Yawo`uOXoqWv_=w7|qE9*ee;_G&Ie8)JOCx_4;qt;?Dz@yfX&Vd6r8$b!KA
z4^5$dwlDTVt!s)tj5u0&O)n;vXY>h{WGsiEef+FMPDNz7WOIh-Hj%tLH}~s8B@}~E
z2Uip&6_$2%_qsN#AhIokg_)Qs7h$|oUT<`gM`LI%!tLh#_?wI%UM1dd;=3y(DxIW<
zOP_U;Ik=g5IO~T#e3%V)OHnv2?<(@9PPC@IqslTrs_hl<l~@oUFtproy7|v0N+g9K
zRKXgWyLPh35HUbY%wQ6GrIYus<I%v{uiel+)=T&AU3?gffL#aXgd(VQ!BVHj((;~k
zpP^!gWG3P7?Ffsr!;d0g*gSUUG_8Ma{P}pAjm;B*hZE&Rj{;6AA0RBVb>~{^jGh?#
z90o8(G>DvzHybu(yQMX>`_j}7a*V`jho^-IVGn|}SV?HXAr!16!MA37ti^I|8+Q@y
z6=#~NBqGA%#jd*$5vkKA><hBLeI9Vd;m>hi<zg`Uu=X+gSqy!rjdrxxNo-zA;kTj9
zy4lc(f)Mh-a^k+|r?qe66kZtg(QXSs{vu}&b-@eQp#g0AI65vcMr<DmcxxsAc*O8b
zR16N+Z!2*!;pgW4MYsX*=$+H7Vsuoe>l275B=qT}?<uCtdyN&%MQK8iOSInrkBomq
z007>Q9#()O4}=c@$UoNr0DO*5V*|VukCz4jltrCc0CnstrGQ6^JuhaSzu%(wp=#I?
zB&4Jane!y7?rAY+mM^M1F51e1$>`>0W!_6)iT<iJ%q?+X%+q^pxbF6_z71H?gETYi
z8-PGyHS%g{40(DQdRp9aSoqB3-)|S?_y<AG>TNBo*S5w|+yU~xj$`MT&C;()5&YbG
zJ%hwGg&P;11xo=O<y8w!fZj8K<J!vO4R`wB6BwyWrkbIuJ4(w1K|s8M!zRNr>$eb(
zF<qNwnc}kFKl%bYh_*7d+o+)4OD>fTK{aZUqJ63ez$L*`4+^~dY=~nqNCJX?5LFW^
z-BM7?YOEGiTakP-Gl&S&A%n-`OmCMjjQLF(D{|mNXbKyF#$(l$&n>rf{ip{r2ZXhB
zs-(Zr!yAgNm6jZH)R7xG{pPS*c!G_a2z948A%Lk|q*_6*u%hnd+`~rScADjE<d}xB
z$P|CwGk3E>p^a+!wH@6|BmR)u=hDf!(ak2sKm&nyQREH}EFZDeM4cWYh5E5XN+Ina
z^VeylX|E<MUR(1;M`ML0%p2R--md-F-<D+E$x=)}_9OS&AuJA+1jcNF?Xi1+j8)wi
z3F;iTjWi#8H^mO65Dr;WVgoq(Z+Lh>HH6`Rd4}PMRnE_vVM$3z&^H6+x+r}1W-qB+
z!qg&#p3#VU=B~%tCo;j{)~F)N+F%JX$R_nmX0#7uO7&OKlYFzK*4^H`o00k){F;@#
z7!`E=wX$Aw9t*pfFl6_jj30GdHyW1%S9YJ?v{W;Y@VsxYWmpttMno=zw>SUb1U9L`
z5O!r<@Z*=d4t^uKQ#{Kvt&kJ?aW`y^TpQ9?r0#f-ac`-Tq<Jp(-AfJO)SX@Kb`z%6
zrd*5TX%KO*XRmjM=PUcTn?*re5~U1yrw%%bqCK-*qZq}sb{n~gTnabsn@uu^I?ka~
z{-K%^W1s2wLx=F?ITTnfUlTDjbvUW+H?ov|1<FSE(cZ5cK_RkU0gnR?=L_dZt&0u#
z`H$WBGGuxOJ#}tkfZt>|`$mj8bl!QO(7d*A3u^&ik>5ZZHZ;TRONd0DqQOhlS-*n|
ztz5giQAKiR5b5Uu{>~9dUPI7D!@a^Yp&%iHuFf^zsaIuT&90`GUw!+=3L8>2T{YHJ
z{VBwiGvf<ov5Col8@Lf8I{9nK^m2CR6uqFWO&^D|!VZW?PiPYlpKKn`9#|ilW3Bi1
zZeoH7gK93BmU(9mMuc1l`#Wlq`?<_?is+LN5jLhXf9Z*2k|E>W!SNoA)L0oTd81dJ
zg-lndWG9^6IzPC>!&NP1`_hBoz7|tkh&$Nz8xQ0A37LESFg;LF(ZW;mt8*AeEWFd=
z#k#<-iHXB0rrTb6C~g*Hn3ToiN!lc(MGT0<AR7f+TFM;!>nQ#fQFggpq8EV^4dJr5
zyF8MO%PGzn*PY-26wq!_ccSV;e1t}w_STzL9iE{hlu4?xyZ)@KPL0dH!|n5yHqb`v
zNGG-^A5RLY#O(UZjr?ZxwI6v~$K?UWe~q~I0?Ioojula=L?GB63Ff#jucbC&4zztf
ze||}C(N&@?H3G}W%eg0|&8yb_D6}ms)eB3ql#PbUP>izpaxkjh8TM_N&qF;Kqmy`G
zQCf?8i3!@oePCe~-_Z!2RvGtLCfi9?OHZV57ftTCR?4<+D-Q^FK!-GJDif(=uoqLi
zpLSA&+YjD8AZMDFe-kpKeP`~n1iW3V1GXvq-o$i?>ti78S-;>&)<--&j`1~P8Q2n|
zmIbO;16Rgr9o|x4#N8*J_fpflEfSq{Qw&T&4!c9B8uM$qsB;5mq4qD(Xo)H%Iqjm@
z3o!m07Y$Y_x(YT$8U|;a1kJNw=~-3NOcZ#(y<YP^XsZ#u;|nt?sCahGaQyNPCa_Bf
zrPge9aHA78pB{+0hlzZ6Akha;nfQV7gry3VzvxWJ^A|2RFU43`nwO*4OZ!*-g-N$o
zm?r9bj|I?uUfc&vsQHEGug2S}SO0a0mXANp90^^8c()BQzIX7pWu>Xem3e<vU}R-O
zgTid!OBVL2_1bz!cF85cscACdPdVO(PtNxrYiT(sbDKDm9zP4wPSh4iOKV^0HH3z7
zumH{quMZ+GD+8me)1GLm+MNY-zmP)`F71E0BKLo==pWJIpJD6Y>KgDPvcvuw<NNnt
z<3!tAcQoySmdg#UU!Yn7-a7h&3dwaINsw1{6~=jKz8@V0nZiaNzZnP1GUFx|>m@IG
zS<E@%DGLW8r!UKw4RAIah^NJWI|n&n{|8L_|B&);9RBpkh<y75-Iu9%eH6<?@-M-l
ziMnm=ClDub9}%%r*PU@~D`(WMr2K`9bxh23hbZ6e;X41zg@(zYVu}AM;d|h}h5Y}P
z3jdQN{N44G^XNX4oY*>q3IQHHW*S3Nhm&GPGq<S4U&O*$OLA&`btt26*`S3LaH<bQ
zj*y%ZjW_t$%;W#{`~R2EWU%BlF$i9@X`S<We|^kw_Ar^LzWB5ML?9qNT%!NmYGS&E
zxQ_&m#j%cQNRFfXqRv{7eUy|OOzg$q0>_Op=g!8-OlwlODvD%8V$ws(ZCC(tF2+8Z
zqU!PfDg6JEul+ZzWnAkJ_;^{0GKPmc4Epf0IQ~{;*K%jxKR4g}?0MZQ4M`4mwKFpX
z!5mCN#TF5Z0)@X3H@%YM`_2(ml7_ds!wmEwCf*(dREjvs3k5LQ;v?-vh~)p6Oa5(7
z&pKCkX@b-QfP7O(d^(w&rw3*(v+z#nFZ;T@z7oZm@P&SqWh6e9I_!WzAedRgdSK8w
zQI0RUJMMO7V5`x>==fvFzJN6vF01VLcBZ=$noK5JIKDi2KVQeJxwSwb@_g0)exRXF
zxhf`dqEg*8TuE%J5u*^f@PvEOQ=$8YUsR*TaxqT>CnqPmy81=uyXXzv{{H^><7d3g
z!%TZvRV%DSk2-JM)<hatxMq!E%fNhZ&QEv^=tD@S94<Ee<o<6w`oE0J+xfMPi6R>A
z>wz1e$4H4z#EzU49;059+U*f<t?cPBtISp!r84k!gIodUKS5vw)iX8joDSL(UnJLW
zhG;UzGhB-`tKEu_x^1x|#0^FD5MVnFmLGQO3iwdHIF0R5=WzZ^CEdZQ>L{9MJ8;Y_
zZt$5kB%DwrChFvJ&u}^{+C+Fy3DWK^7@P|8I)HLhvw+w$;xnN0r@OB&+F8@~{AfoB
zIiB!-(D$#fKZcI1+av-lxIm$k$B3BdHv9R{BgA}O<}Wd_Eo>NPG+W+SLTe8R9lHa#
zb&`$W#Kzolw(II7^%EQ})ilQ+u0W{{IXNh?KdLfQnTaeNEVg>d<M*2<L`FoK6tvER
z3fi4pPr)7YHxBuZB+tFpsmxsMEq~2wcXWTzc$&Tmy?VtE-onntuv??DyU*G0+9Gqr
zj%JM&&#$f7bp8A>%3BYUIUOlP-T%b_Y{iTNUvcrK$zE$q)hNvFijjpSNIuBGD|qmu
zo8+6l5Uh`Bg14Wo4fr7<X)+=BV@t;?X!lZa8m#7zw!IYxcy(k~E66Q0`OugAHBG9;
zV!4&;2I2N-vGC8V<JH(Unko3OKKh^sLl$^?a~!WTG}od<jQ)Op7CDsK^yMgw`Uz&7
zm^-SnGL40cbeM)QQrkl4c5{<N@NR|m&-S&?J1NmIbEYAyv*1xp@bQzP$VT(WcW#4C
zdsww%Xg}~#NQ<I1bIJa>t@W`oH&?{7L}YU{Rtg5a^?I9Alkq-ZP?;W4s8)a1ca>eB
z{yq{TXuS)JjI37Bq&71?l-LiTV%nnjMTjFO9qX>G`IPbXb!#J`{9#IkI3CosrVeg5
zookPHZONee;Kf<V-$y&G8`|&99Zj_#ZbX46Wmb)|B${A2aLe7=vCU!P$v!xkzEO#p
zf8quM_hjfZfo#}M{3a4<91prpl*HRF_NKR}n05&HtQiyoG({2Wy^%kM$iE2OxTd60
zuWicM%pq)@Fw8mCf9}xZFRBbJXJ@Zx2Cbka!O#cd#_;GqS^Op$y}b2ptjut5xU9t1
zWhr_1hxu~gMud%=EEYD~pmVsa37(8Hm4WGYgEl<M)7c(9(7sn;VDKg}>>IQUHv|>g
z)fA>Q>dsDGgWY$(|8d@8@HI4K+J|52ko1f7kDs0gCgTMIpHxHzMmjWEZrrxB*gw^@
zjqj%IA|0TEWsSkhy!;+3pGWsH()*|u%_@qFn;zNRH)nY7!#_*m*zI?NMS{$DwzzKI
z2ifJ=hT&I+igB0yTJ28!>8T-<T<y#u-SdArLly#^v0?&iV%TA;d@Q9$!Wh8MBV{*m
zZ=|}z`8`7Oq$b33Y<Lw1$2cd8ORzW%EdQLZg(~Ba$G|?z<aVi^NNuF?I(VkkJpzKF
zXkp0e3^HTncGl2sha89CX7Oaf3ac+16~FgOjr^Er->9B;eNQS26|2#bm)51K8uusl
zWx%l2jjkS~{%S#lvTduqBm$u7dbT*=v2QNW)(?DiS|(!Q*|_S|oJ^!en_cDl)=F`O
zH~m;5y&dI$%z4<hYuMyH4{2`*Op28tYaw)NUF{e!JD3ouls<>k?LThVpMEeTO*)M=
z$+B3gYNQIae_s-7|K4juCN-bjiq-BBC=bGc?4C`Sex0ur9xKrmAr)JCTh;`p$lmV6
zs_;=N!MXH@OD_^=-Q~11oI3%@UhiVr!1^a#0Bw68LnA|Q;@2+yiu?VH8L85Je`j>y
z!o}oUdY(9<UxC}ZAFZeuTDV~0s<B;cu<Mfh!;gB&80qZkJZxh91DHoql1moa)%k^n
zZupg<hL!l{!wA{{Lalc|bq^_V;o10bPDx1#OYzzuRnlyrNnbFJH*?59Gr>^pnrm6a
zWjG9WvzrHYbJH?lz=QB@Vain`*(^LdW#>$<Qi*HL8LaP2tu$|T^6+c+Yp~w~W4mB(
zeRD4R#6~k9k9e+2FEC<9I?L_!#jjM@J<C^J18Q~;k`#?Y@^Oi1L0ArNkJ{T}nM-GT
z7q@RRtHx&oudZaU`5QUip6cw5Y}l{oGRigO13bE;^^eOjd$Onejp`%#PaL0_wwTi0
zEm+zej~4#|sx`j$B%kj(?MdtiKzC+0iH*j96Tj4Isp{piPr5ir9n7TJwS{6E8XL!C
zzNY%C7M%Iq+uIx5_m~+ZyEB`M%1}|-jwQnnjQ%u4*{>Y*A9!bcDr0^8s3)$|O(@q&
orA+nW-)lp|+wA`a;}B)U(4UTc+hV=01YlnJIwp5(A&#;C0lzup#sB~S

literal 0
HcmV?d00001


From 20b48f69630a78cc07107039a864bcdf4e770664 Mon Sep 17 00:00:00 2001
From: Tony Wittinger <anwittin@users.noreply.github.com>
Date: Wed, 18 Sep 2024 15:38:14 -0700
Subject: [PATCH 41/44] Update CHANGELOG.md (#28435)

* Update CHANGELOG.md

* Update CHANGELOG.md
---
 CHANGELOG.md | 193 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 193 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 29e05c7e51cb..6f7fe531285b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,199 @@
 - [v1.0.0 - v1.9.10](CHANGELOG-pre-v1.10.md)
 - [v0.11.6 and earlier](CHANGELOG-v0.md)
 
+## 1.18.0-rc1
+## September 18, 2024
+
+CHANGES:
+
+* activity (enterprise): filter all fields in client count responses by the request namespace [[GH-27790](https://github.com/hashicorp/vault/pull/27790)]
+* activity (enterprise): remove deprecated fields distinct_entities and non_entity_tokens [[GH-27830](https://github.com/hashicorp/vault/pull/27830)]
+* activity log: Deprecated the field "default_report_months". Instead, the billing start time will be used to determine the start time
+when querying the activity log endpoints. [[GH-27350](https://github.com/hashicorp/vault/pull/27350)]
+* activity log: Deprecates the current_billing_period field for /sys/internal/counters/activity. The default start time
+will automatically be set the billing period start date. [[GH-27426](https://github.com/hashicorp/vault/pull/27426)]
+* activity: The [activity export API](https://developer.hashicorp.com/vault/api-docs/system/internal-counters#activity-export) now requires the `sudo` ACL capability. [[GH-27846](https://github.com/hashicorp/vault/pull/27846)]
+* activity: The [activity export API](https://developer.hashicorp.com/vault/api-docs/system/internal-counters#activity-export) now responds with a status of 204 instead 400 when no data exists within the time range specified by `start_time` and `end_time`. [[GH-28064](https://github.com/hashicorp/vault/pull/28064)]
+* activity: The startTime will be set to the start of the current billing period by default.
+The endTime will be set to the end of the current month. This applies to /sys/internal/counters/activity,
+/sys/internal/counters/activity/export, and the vault operator usage command that utilizes /sys/internal/counters/activity. [[GH-27379](https://github.com/hashicorp/vault/pull/27379)]
+* api: Update backoff/v3 to backoff/v4.3.0 [[GH-26868](https://github.com/hashicorp/vault/pull/26868)]
+* auth/alicloud: Update plugin to v0.19.0 [[GH-28263](https://github.com/hashicorp/vault/pull/28263)]
+* auth/azure: Update plugin to v0.19.0 [[GH-28294](https://github.com/hashicorp/vault/pull/28294)]
+* auth/cf: Update plugin to v0.18.0 [[GH-27724](https://github.com/hashicorp/vault/pull/27724)]
+* auth/cf: Update plugin to v0.19.0 [[GH-28266](https://github.com/hashicorp/vault/pull/28266)]
+* auth/gcp: Update plugin to v0.19.0 [[GH-28366](https://github.com/hashicorp/vault/pull/28366)]
+* auth/jwt: Update plugin to v0.21.0 [[GH-27498](https://github.com/hashicorp/vault/pull/27498)]
+* auth/jwt: Update plugin to v0.22.0 [[GH-28349](https://github.com/hashicorp/vault/pull/28349)]
+* auth/kerberos: Update plugin to v0.13.0 [[GH-28264](https://github.com/hashicorp/vault/pull/28264)]
+* auth/kubernetes: Update plugin to v0.20.0 [[GH-28289](https://github.com/hashicorp/vault/pull/28289)]
+* auth/oci: Update plugin to v0.17.0 [[GH-28307](https://github.com/hashicorp/vault/pull/28307)]
+* cli: The undocumented `-dev-three-node` and `-dev-four-cluster` CLI options have been removed. [[GH-27578](https://github.com/hashicorp/vault/pull/27578)]
+* consul-template: updated to version 0.39.1 [[GH-27799](https://github.com/hashicorp/vault/pull/27799)]
+* core(enterprise): Updated the following two control group related errors responses to respond with response code 400 instead of 500: `control group: could not find token`, and `control group: token is not a valid control group token`.
+* core: Bump Go version to 1.22.7
+* database/couchbase: Update plugin to v0.12.0 [[GH-28327](https://github.com/hashicorp/vault/pull/28327)]
+* database/elasticsearch: Update plugin to v0.16.0 [[GH-28277](https://github.com/hashicorp/vault/pull/28277)]
+* database/mongodbatlas: Update plugin to v0.13.0 [[GH-28268](https://github.com/hashicorp/vault/pull/28268)]
+* database/redis-elasticache: Update plugin to v0.5.0 [[GH-28293](https://github.com/hashicorp/vault/pull/28293)]
+* database/redis: Update plugin to v0.4.0 [[GH-28404](https://github.com/hashicorp/vault/pull/28404)]
+* database/snowflake: Update plugin to v0.12.0 [[GH-28275](https://github.com/hashicorp/vault/pull/28275)]
+* sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.0, which also bumps github.com/docker/docker to v26.1.5+incompatible [[GH-28269](https://github.com/hashicorp/vault/pull/28269)]
+* secrets/ad: Update plugin to v0.19.0 [[GH-28361](https://github.com/hashicorp/vault/pull/28361)]
+* secrets/alicloud: Update plugin to v0.18.0 [[GH-28271](https://github.com/hashicorp/vault/pull/28271)]
+* secrets/azure: Update plugin to v0.19.2 [[GH-27652](https://github.com/hashicorp/vault/pull/27652)]
+* secrets/azure: Update plugin to v0.20.0 [[GH-28267](https://github.com/hashicorp/vault/pull/28267)]
+* secrets/gcp: Update plugin to v0.20.0 [[GH-28324](https://github.com/hashicorp/vault/pull/28324)]
+* secrets/gcpkms: Update plugin to v0.18.0 [[GH-28300](https://github.com/hashicorp/vault/pull/28300)]
+* secrets/gcpkms: Update plugin to v0.19.0 [[GH-28360](https://github.com/hashicorp/vault/pull/28360)]
+* secrets/kubernetes: Update plugin to v0.9.0 [[GH-28287](https://github.com/hashicorp/vault/pull/28287)]
+* secrets/kv: Update plugin to v0.20.0 [[GH-28334](https://github.com/hashicorp/vault/pull/28334)]
+* secrets/mongodbatlas: Update plugin to v0.13.0 [[GH-28348](https://github.com/hashicorp/vault/pull/28348)]
+* secrets/openldap: Update plugin to v0.14.0 [[GH-28325](https://github.com/hashicorp/vault/pull/28325)]
+* secrets/terraform: Update plugin to v0.10.0 [[GH-28312](https://github.com/hashicorp/vault/pull/28312)]
+* secrets/terraform: Update plugin to v0.9.0 [[GH-28016](https://github.com/hashicorp/vault/pull/28016)]
+* ui: Uses the internal/counters/activity/export endpoint for client count export data. [[GH-27455](https://github.com/hashicorp/vault/pull/27455)]
+
+FEATURES:
+
+* **AWS secrets engine STS session tags support**: Adds support for setting STS
+session tags when generating temporary credentials using the AWS secrets
+engine. [[GH-27620](https://github.com/hashicorp/vault/pull/27620)]
+* **Adaptive Overload Protection (enterprise)**: Enables Adaptive Overload Protection
+for write requests as a GA feature (enabled by default) for Integrated Storage.
+* **Audit Entry Exclusion**: Audit devices support excluding fields from entries being written to them, with expression-based rules (powered by go-bexpr) to determine when the specific fields are excluded.
+* **Workload Identity Federation UI for AWS (enterprise)**: Add WIF fields to AWS secrets engine. [[GH-28148](https://github.com/hashicorp/vault/pull/28148)]
+* **KV v2 Patch/Subkey (enterprise)**: Adds GUI support to read the subkeys of a KV v2 secret and patch (partially update) secret data. [[GH-28212](https://github.com/hashicorp/vault/pull/28212)]
+* **Self-Managed Static Roles**: Self-Managed Static Roles are now supported for select SQL database engines (Postgres, Oracle). Requires Vault Enterprise. [[GH-28199](https://github.com/hashicorp/vault/pull/28199)]
+* **Vault Minimal Version**: Add the ability to build a minimal version of Vault
+with only core features using the BUILD_MINIMAL environment variable. [[GH-27394](https://github.com/hashicorp/vault/pull/27394)]
+* **Vault PKI 3GPP CMPv2 Server (Enterprise)**: Support for the PKI 3GPP CMPv2 certificate management protocol has been added to the Vault PKI Plugin. This allows standard CMPv2 clients to request certificates from a Vault server with no knowledge of Vault APIs.
+
+IMPROVEMENTS:
+
+* activity log: Changes how new client counts in the current month are estimated, in order to return more
+visibly sensible totals. [[GH-27547](https://github.com/hashicorp/vault/pull/27547)]
+* activity: The [activity export API](https://developer.hashicorp.com/vault/api-docs/system/internal-counters#activity-export) can now be called in non-root namespaces. Resulting records will be filtered to include the requested namespace (via `X-Vault-Namespace` header or within the path) and all child namespaces. [[GH-27846](https://github.com/hashicorp/vault/pull/27846)]
+* activity: The [activity export API](https://developer.hashicorp.com/vault/api-docs/system/internal-counters#activity-export) now includes identity metadata about entity clients. [[GH-28064](https://github.com/hashicorp/vault/pull/28064)]
+* activity: `/sys/internal/counters/activity` will now include a warning if the specified usage period contains estimated client counts. [[GH-28068](https://github.com/hashicorp/vault/pull/28068)]
+* agent/sink: Allow configuration of the user and group ID of the file sink. [[GH-27123](https://github.com/hashicorp/vault/pull/27123)]
+* agent: Add metric (vault.agent.authenticated) that is set to 1 when vault agent has a valid token and zero if it does not. [[GH-26570](https://github.com/hashicorp/vault/pull/26570)]
+* agent: Add the ability to dump pprof to the filesystem using SIGUSR2 [[GH-27510](https://github.com/hashicorp/vault/pull/27510)]
+* audit: Adds TRACE logging to log request/response under certain circumstances, and further improvements to the audit subsystem. [[GH-28056](https://github.com/hashicorp/vault/pull/28056)]
+* audit: Ensure that any underyling errors from audit devices are logged even if we consider auditing to be a success. [[GH-27809](https://github.com/hashicorp/vault/pull/27809)]
+* audit: Internal implementation changes to the audit subsystem which improve performance. [[GH-27952](https://github.com/hashicorp/vault/pull/27952)]
+* audit: Internal implementation changes to the audit subsystem which improve relability. [[GH-28286](https://github.com/hashicorp/vault/pull/28286)]
+* audit: sinks (file, socket, syslog) will attempt to log errors to the server operational 
+log before returning (if there are errors to log, and the context is done). [[GH-27859](https://github.com/hashicorp/vault/pull/27859)]
+* auth/cert: Cache full list of role trust information separately to avoid
+eviction, and avoid duplicate loading during multiple simultaneous logins on
+the same role. [[GH-27902](https://github.com/hashicorp/vault/pull/27902)]
+* cli: Add a `--dev-no-kv` flag to prevent auto mounting a key-value secret backend when running a dev server [[GH-16974](https://github.com/hashicorp/vault/pull/16974)]
+* cli: Allow vault CLI HTTP headers to be specified using the JSON-encoded VAULT_HEADERS environment variable [[GH-21993](https://github.com/hashicorp/vault/pull/21993)]
+* cli: `vault operator usage` will now include a warning if the specified usage period contains estimated client counts. [[GH-28068](https://github.com/hashicorp/vault/pull/28068)]
+* core/activity: Ensure client count queries that include the current month return consistent results by sorting the clients before performing estimation [[GH-28062](https://github.com/hashicorp/vault/pull/28062)]
+* core/cli: Example 'help' pages for vault read / write docs improved. [[GH-19064](https://github.com/hashicorp/vault/pull/19064)]
+* core/identity: allow identity backend to be tuned using standard secrets backend tuning parameters. [[GH-14723](https://github.com/hashicorp/vault/pull/14723)]
+* core/metrics: ensure core HA metrics are always output to Prometheus. [[GH-27966](https://github.com/hashicorp/vault/pull/27966)]
+* core: make authLock and mountsLock in Core configurable via the detect_deadlocks configuration parameter. [[GH-27633](https://github.com/hashicorp/vault/pull/27633)]
+* database/postgres: Add new fields to the plugin's config endpoint for client certificate authentication. [[GH-28024](https://github.com/hashicorp/vault/pull/28024)]
+* db/cassandra: Add `disable_host_initial_lookup` option to backend, allowing the disabling of initial host lookup. [[GH-9733](https://github.com/hashicorp/vault/pull/9733)]
+* identity: alias metadata is now returned when listing entity aliases [[GH-26073](https://github.com/hashicorp/vault/pull/26073)]
+* license utilization reporting (enterprise): Auto-roll billing start date. [[GH-27656](https://github.com/hashicorp/vault/pull/27656)]
+* proxy/sink: Allow configuration of the user and group ID of the file sink. [[GH-27123](https://github.com/hashicorp/vault/pull/27123)]
+* proxy: Add the ability to dump pprof to the filesystem using SIGUSR2 [[GH-27510](https://github.com/hashicorp/vault/pull/27510)]
+* raft-snapshot (enterprise): add support for managed identity credentials for azure snapshots
+* raft/autopilot: Persist Raft server versions so autopilot always knows the versions of all servers in the cluster. Include server versions in the Raft bootstrap challenge answer so autopilot immediately knows the versions of new nodes. [[GH-28186](https://github.com/hashicorp/vault/pull/28186)]
+* sdk/helper: Allow setting environment variables when using NewTestDockerCluster [[GH-27457](https://github.com/hashicorp/vault/pull/27457)]
+* secrets-sync (enterprise): add support for specifying the replication regions for secret storage within GCP Secret Manager destinations
+* secrets-sync (enterprise): add support for syncing secrets to github environments within repositories
+* secrets-sync (enterprise): add support for syncing secrets to github organizations (beta)
+* secrets/database/hana: Update HANA db client to v1.10.1 [[GH-27950](https://github.com/hashicorp/vault/pull/27950)]
+* secrets/database: Add support for GCP CloudSQL private IP's. [[GH-26828](https://github.com/hashicorp/vault/pull/26828)]
+* secrets/pki: Key Usage can now be set on intermediate and root CAs, and CSRs generated by the PKI secret's engine. [[GH-28237](https://github.com/hashicorp/vault/pull/28237)]
+* serviceregistration: Added support for Consul ServiceMeta tags from config file from the new `service_meta` config field. [[GH-11084](https://github.com/hashicorp/vault/pull/11084)]
+* storage/azure: Updated metadata endpoint to `GetMSIEndpoint`, which supports more than just the metadata service. [[GH-10624](https://github.com/hashicorp/vault/pull/10624)]
+* storage/dynamodb: Speed up list and delete of large directories by only requesting keys from DynamoDB [[GH-21159](https://github.com/hashicorp/vault/pull/21159)]
+* storage/etcd: Update etcd3 client to v3.5.13 to allow use of TLSv1.3. [[GH-26660](https://github.com/hashicorp/vault/pull/26660)]
+* storage/raft: Bump raft to v1.7.0 which includes pre-vote. This should make clusters more stable during network partitions. [[GH-27605](https://github.com/hashicorp/vault/pull/27605)]
+* storage/raft: Improve autopilot logging on startup to show config values clearly and avoid spurious logs [[GH-27464](https://github.com/hashicorp/vault/pull/27464)]
+* ui/secrets-sync: Hide Secrets Sync from the sidebar nav if user does not have access to the feature. [[GH-27262](https://github.com/hashicorp/vault/pull/27262)]
+* ui: AWS credentials form sets credential_type from backing role [[GH-27405](https://github.com/hashicorp/vault/pull/27405)]
+* ui: Creates separate section for updating sensitive creds for Secrets sync create/edit view. [[GH-27538](https://github.com/hashicorp/vault/pull/27538)]
+* ui: For AWS and SSH secret engines hide mount configuration details in toggle and display configuration details or cta. [[GH-27831](https://github.com/hashicorp/vault/pull/27831)]
+* ui: Mask obfuscated fields when creating/editing a Secrets sync destination. [[GH-27348](https://github.com/hashicorp/vault/pull/27348)]
+* ui: Move secret-engine configuration create/edit from routing `vault/settings/secrets/configure/<backend>` to  `vault/secrets/<backend>/configuration/edit` [[GH-27918](https://github.com/hashicorp/vault/pull/27918)]
+* ui: Remove deprecated `current_billing_period` from dashboard activity log request [[GH-27559](https://github.com/hashicorp/vault/pull/27559)]
+* ui: Update the client count dashboard to use API namespace filtering and other UX improvements [[GH-28036](https://github.com/hashicorp/vault/pull/28036)]
+* ui: remove initial start/end parameters on the activity call for client counts dashboard. [[GH-27816](https://github.com/hashicorp/vault/pull/27816)]
+* ui: simplify the date range editing experience in the client counts dashboard. [[GH-27796](https://github.com/hashicorp/vault/pull/27796)]
+* website/docs: Added API documentation for Azure Secrets Engine delete role [[GH-27883](https://github.com/hashicorp/vault/pull/27883)]
+* website/docs: corrected invalid json in sample payload for azure secrets engine create/update role [[GH-28076](https://github.com/hashicorp/vault/pull/28076)]
+
+BUG FIXES:
+
+* activity: The sys/internal/counters/activity endpoint will return current month data when the end_date parameter is set to a future date. [[GH-28042](https://github.com/hashicorp/vault/pull/28042)]
+* agent: Fixed an issue causing excessive CPU usage during normal operation [[GH-27518](https://github.com/hashicorp/vault/pull/27518)]
+* auth/appid, auth/cert, auth/github, auth/ldap, auth/okta, auth/radius, auth/userpass: fixed an issue with policy name normalization that would prevent a token associated with a policy containing an uppercase character to be renewed. [[GH-16484](https://github.com/hashicorp/vault/pull/16484)]
+* auth/aws: fixes an issue where not supplying an external id was interpreted as an empty external id [[GH-27858](https://github.com/hashicorp/vault/pull/27858)]
+* auth/cert: Merge error messages returned in login failures and include error when present [[GH-27202](https://github.com/hashicorp/vault/pull/27202)]
+* auth/cert: Use subject's serial number, not issuer's within error message text in OCSP request errors [[GH-27696](https://github.com/hashicorp/vault/pull/27696)]
+* auth/cert: ocsp_ca_certificates field was not honored when validating OCSP responses signed by a CA that did not issue the certificate. [[GH-28309](https://github.com/hashicorp/vault/pull/28309)]
+* auth/token: fixes an edge case bug that "identity_policies" is nil and causes cli vault login error [[GH-17007](https://github.com/hashicorp/vault/pull/17007)]
+* cli: Fixed an erroneous warning appearing about `-address` not being set when it is. [[GH-27265](https://github.com/hashicorp/vault/pull/27265)]
+* cli: Fixed issue with `vault hcp connect` where HCP resources with uppercase letters were inaccessible when entering the correct project name. [[GH-27694](https://github.com/hashicorp/vault/pull/27694)]
+* command: The `vault secrets move` and `vault auth move` command will no longer attempt to write to storage on performance standby nodes. [[GH-28059](https://github.com/hashicorp/vault/pull/28059)]
+* config: Vault TCP listener config now correctly supports the documented proxy_protocol_behavior 
+setting of 'deny_unauthorized' [[GH-27459](https://github.com/hashicorp/vault/pull/27459)]
+* core (enterprise): Fix 500 errors that occurred querying `sys/internal/ui/mounts` for a mount prefixed by a namespace path when path filters are configured. [[GH-27939](https://github.com/hashicorp/vault/pull/27939)]
+* core (enterprise): Fix HTTP redirects in namespaces to use the correct path and (in the case of event subscriptions) the correct URI scheme. [[GH-27660](https://github.com/hashicorp/vault/pull/27660)]
+* core (enterprise): Fix deletion of MFA login-enforcement configurations on standby nodes
+* core/audit: Audit logging a Vault request/response checks if the existing context 
+is cancelled and will now use a new context with a 5 second timeout.
+If the existing context is cancelled a new context, will be used. [[GH-27531](https://github.com/hashicorp/vault/pull/27531)]
+* core/config: fix issue when using `proxy_protocol_behavior` with `deny_unauthorized`, 
+which causes the Vault TCP listener to close after receiving an untrusted upstream proxy connection. [[GH-27589](https://github.com/hashicorp/vault/pull/27589)]
+* core/identity: Fixed an issue where deleted/reassigned entity-aliases were not removed from in-memory database. [[GH-27750](https://github.com/hashicorp/vault/pull/27750)]
+* core: Fixed an issue where maximum request duration timeout was not being added to all requests containing strings sys/monitor and sys/events. With this change, timeout is now added to all requests except monitor and events endpoint. [[GH-28230](https://github.com/hashicorp/vault/pull/28230)]
+* core: Fixed an issue with performance standbys not being able to handle rotate root requests. [[GH-27631](https://github.com/hashicorp/vault/pull/27631)]
+* helper/pkcs7: Fix parsing certain messages containing only certificates [[GH-27435](https://github.com/hashicorp/vault/pull/27435)]
+* identity/oidc: prevent JWKS from being generated by multiple concurrent requests [[GH-27929](https://github.com/hashicorp/vault/pull/27929)]
+* licensing (enterprise): fixed issue where billing start date might not be correctly updated on performance standbys
+* proxy/cache (enterprise): Fixed an issue where Proxy with static secret caching enabled would not correctly handle requests to older secret versions for KVv2 secrets. Proxy's static secret cache now properly handles all requests relating to older versions for KVv2 secrets. [[GH-28207](https://github.com/hashicorp/vault/pull/28207)]
+* proxy/cache (enterprise): Fixed an issue where Proxy would not correctly update KV secrets when talking to a perf standby. Proxy will now attempt to forward requests to update secrets triggered by events to the active node. Note that this requires `allow_forwarding_via_header` to be configured on the cluster. [[GH-27891](https://github.com/hashicorp/vault/pull/27891)]
+* proxy/cache (enterprise): Fixed an issue where cached static secrets could fail to update if the secrets belonged to a non-root namespace. [[GH-27730](https://github.com/hashicorp/vault/pull/27730)]
+* proxy: Fixed an issue causing excessive CPU usage during normal operation [[GH-27518](https://github.com/hashicorp/vault/pull/27518)]
+* raft/autopilot: Fixed panic that may occur during shutdown [[GH-27726](https://github.com/hashicorp/vault/pull/27726)]
+* replication (enterprise): fix cache invalidation issue leading to namespace custom metadata not being shown correctly on performance secondaries
+* secrets-sync (enterprise): Destination set/remove operations will no longer be blocked as "purge in progress" after a purge job ended in failure.
+* secrets-sync (enterprise): Normalize custom_tag keys and values for recoverable invalid characters.
+* secrets-sync (enterprise): Normalize secret key names before storing the external_name in a secret association.
+* secrets-sync (enterprise): Patching github sync destination credentials will properly update and save the new credentials.
+* secrets-sync (enterprise): Properly remove tags from secrets in AWS when they are removed from the source association
+* secrets-sync (enterprise): Return an error immediately on destination creation when providing invalid custom_tags based on destination type.
+* secrets-sync (enterprise): Return more accurate error code for invalid connection details
+* secrets-sync (enterprise): Secondary nodes in a cluster now properly check activation-flags values.
+* secrets-sync (enterprise): Skip invalid GitHub repository names when creating destinations
+* secrets-sync (enterprise): Validate corresponding GitHub app parameters `app_name` and `installation_id` are set
+* secrets/database: Skip connection verification on reading existing DB connection configuration [[GH-28139](https://github.com/hashicorp/vault/pull/28139)]
+* secrets/identity (enterprise): Fix a bug that can cause DR promotion to fail in rare cases where a PR secondary has inconsistent alias information in storage.
+* secrets/pki: fix lack of serial number to a certificate read resulting in a server side error. [[GH-27681](https://github.com/hashicorp/vault/pull/27681)]
+* secrets/transit (enterprise): Fix an issue that caused input data be returned as part of generated CMAC values.
+* storage/azure: Fix invalid account name initialization bug [[GH-27563](https://github.com/hashicorp/vault/pull/27563)]
+* storage/raft (enterprise): Fix issue with namespace cache not getting cleared on snapshot restore, resulting in namespaces not found in the snapshot being inaccurately represented by API responses. [[GH-27474](https://github.com/hashicorp/vault/pull/27474)]
+* storage/raft: Fix auto_join not working with mDNS provider. [[GH-25080](https://github.com/hashicorp/vault/pull/25080)]
+* sys: Fix a bug where mounts of external plugins that were registered before Vault v1.0.0 could not be tuned to
+use versioned plugins. [[GH-27881](https://github.com/hashicorp/vault/pull/27881)]
+* ui: Allow creation of session_token type roles for AWS secret backend [[GH-27424](https://github.com/hashicorp/vault/pull/27424)]
+* ui: Display an error and force a timeout when TOTP passcode is incorrect [[GH-27574](https://github.com/hashicorp/vault/pull/27574)]
+* ui: Ensure token expired banner displays when batch token expires [[GH-27479](https://github.com/hashicorp/vault/pull/27479)]
+* ui: Fix UI improperly checking capabilities for enabling performance and dr replication [[GH-28371](https://github.com/hashicorp/vault/pull/28371)]
+* ui: Fix cursor jump on KVv2 json editor that would occur after pressing ENTER. [[GH-27569](https://github.com/hashicorp/vault/pull/27569)]
+* ui: fix issue where enabling then disabling "Tidy ACME" in PKI results in failed API call. [[GH-27742](https://github.com/hashicorp/vault/pull/27742)]
+* ui: fix namespace picker not working when in small screen where the sidebar is collapsed by default. [[GH-27728](https://github.com/hashicorp/vault/pull/27728)]
+* ui: fixes renew-self being called right after login for non-renewable tokens [[GH-28204](https://github.com/hashicorp/vault/pull/28204)]
+* ui: fixes toast (flash) alert message saying "created" when deleting a kv v2 secret [[GH-28093](https://github.com/hashicorp/vault/pull/28093)]
+
 ## 1.17.5 
 ## August 30, 2024 
 

From 343cc88e03fdfe3ec42551d9fa019576c582a543 Mon Sep 17 00:00:00 2001
From: Sarah Chavis <62406755+schavis@users.noreply.github.com>
Date: Wed, 18 Sep 2024 16:27:45 -0700
Subject: [PATCH 42/44] Update index.mdx (#28436)

Fix list typo
---
 website/content/docs/install/index.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/website/content/docs/install/index.mdx b/website/content/docs/install/index.mdx
index c6a538548170..15ffab520749 100644
--- a/website/content/docs/install/index.mdx
+++ b/website/content/docs/install/index.mdx
@@ -32,4 +32,4 @@ production cluster deployment:
 - [Get started: Install Vault](/vault/tutorials/getting-started/getting-started-install)
 - [Day One Preparation](/vault/tutorials/day-one-raft)
 - [Recommended Patterns](/vault/tutorials/recommended-patterns)
-- [Start the server in dev mode]: /vault/tutorials/getting-started/getting-started-dev-server
\ No newline at end of file
+- [Start the server in dev mode](/vault/tutorials/getting-started/getting-started-dev-server)

From 2e6944d93eac05698c996921bf17a4faf21cfd7b Mon Sep 17 00:00:00 2001
From: gerardma77 <115136373+gerardma77@users.noreply.github.com>
Date: Thu, 19 Sep 2024 20:44:00 +0200
Subject: [PATCH 43/44] Adding AD lifetime period of an old password  note to
 Vault LDAP secrets Engine Documentation. (#28428)

* adding_OldPasswordAllowedPeriod_waring

* Updated note for AD passwords

* Update website/content/docs/secrets/ldap.mdx

Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>

---------

Co-authored-by: Equus quagga <jan.prinsloo@hashicorp.com>
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
---
 website/content/docs/secrets/ldap.mdx | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/website/content/docs/secrets/ldap.mdx b/website/content/docs/secrets/ldap.mdx
index 5ac9b4aa9042..114d513fdb9e 100644
--- a/website/content/docs/secrets/ldap.mdx
+++ b/website/content/docs/secrets/ldap.mdx
@@ -199,6 +199,18 @@ Some important things to remember when crafting your LDIF entries:
 
 ### Active directory (AD)
 
+<Note> 
+
+  Windows Servers hosting Active Directory include a 
+  `lifetime period of an old password` configuration setting that lets clients
+  authenticate with old passwords for a specified amount of time.
+
+  For more information, refer to the
+ [NTLM network authentication behavior](https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security new-setting-modifies-ntlm-network-authentication)
+  guide by Microsoft.
+
+</Note>
+
 For Active Directory, there are a few additional details that are important to remember:
 
 To create a user programmatically in AD, you first `add` a user object and then `modify` that user to provide a

From 17664bcfbe6a79853772757860ddcd370f767fe7 Mon Sep 17 00:00:00 2001
From: gerardma77 <115136373+gerardma77@users.noreply.github.com>
Date: Thu, 19 Sep 2024 21:08:32 +0200
Subject: [PATCH 44/44] Adding AD lifetime period of an old password note to
 Vault LDAP secrets Engine API Documentation (#28429)

* adding_OldPasswordAllowedPeriod_waring

* Updated note for AD password

* Update website/content/api-docs/secret/ldap.mdx

Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>

---------

Co-authored-by: Equus quagga <jan.prinsloo@hashicorp.com>
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
---
 website/content/api-docs/secret/ldap.mdx | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/website/content/api-docs/secret/ldap.mdx b/website/content/api-docs/secret/ldap.mdx
index 511d13194312..a2151ac719f6 100644
--- a/website/content/api-docs/secret/ldap.mdx
+++ b/website/content/api-docs/secret/ldap.mdx
@@ -170,6 +170,18 @@ The `static-role` endpoint configures Vault to manage the passwords of existing
 | `POST`   | `/ldap/static-role/:role_name` |
 | `DELETE` | `/ldap/static-role/:role_name` |
 
+<Note> 
+
+  Windows Servers hosting Active Directory include a 
+  `lifetime period of an old password` configuration setting that lets clients
+  authenticate with old passwords for a specified amount of time.
+
+  For more information, refer to the
+ [NTLM network authentication behavior](https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security new-setting-modifies-ntlm-network-authentication)
+  guide by Microsoft.
+
+</Note>
+
 ### Parameters
 
 - `role_name` `(string: <required>)` – URL parameter specifying the name of the