From 6b2fc62ba8b9db0fd0503db8079eb8dbc896f520 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Henrik=20tom=20W=C3=B6rden?= <h.tomwoerden@indiscale.com>
Date: Fri, 12 Feb 2021 09:24:27 +0100
Subject: [PATCH] DOC: added documentation from old wiki
---
src/doc/Data-Model.md | 40 ++
src/doc/Glossary.md | 17 +
src/doc/Permissions.rst | 96 +++++
src/doc/administration.rst | 10 +
src/doc/administration/configuration.rst | 1 +
src/doc/administration/curl-access.rst | 265 +++++++++++++
.../administration/server_side_scripting.rst | 2 +-
src/doc/concepts.rst | 32 +-
src/doc/entities.png | Bin 0 -> 40816 bytes
src/doc/index.rst | 4 +-
src/doc/roles.md | 35 ++
src/doc/specification/AbstractProperty.md | 331 ++++++++++++++++
src/doc/specification/Authentication.md | 82 ++++
src/doc/specification/Datatype.md | 95 +++++
src/doc/specification/Fileserver.md | 142 +++++++
src/doc/specification/Paging.md | 25 ++
src/doc/specification/Record.md | 367 ++++++++++++++++++
src/doc/specification/RecordType.md | 164 ++++++++
.../Server-side-scripting.md | 28 +-
.../Specification-of-the-Entity-API.md | 191 +++++++++
.../Specification-of-the-Message-API.md | 167 ++++++++
src/doc/specification/index.rst | 22 ++
22 files changed, 2081 insertions(+), 35 deletions(-)
create mode 100644 src/doc/Data-Model.md
create mode 100644 src/doc/Glossary.md
create mode 100644 src/doc/Permissions.rst
create mode 100644 src/doc/administration.rst
create mode 100644 src/doc/administration/curl-access.rst
create mode 100644 src/doc/entities.png
create mode 100644 src/doc/roles.md
create mode 100644 src/doc/specification/AbstractProperty.md
create mode 100644 src/doc/specification/Authentication.md
create mode 100644 src/doc/specification/Datatype.md
create mode 100644 src/doc/specification/Fileserver.md
create mode 100644 src/doc/specification/Paging.md
create mode 100644 src/doc/specification/Record.md
create mode 100644 src/doc/specification/RecordType.md
rename src/doc/{specs => specification}/Server-side-scripting.md (86%)
create mode 100644 src/doc/specification/Specification-of-the-Entity-API.md
create mode 100644 src/doc/specification/Specification-of-the-Message-API.md
create mode 100644 src/doc/specification/index.rst
diff --git a/src/doc/Data-Model.md b/src/doc/Data-Model.md
new file mode 100644
index 00000000..3fa64ec2
--- /dev/null
+++ b/src/doc/Data-Model.md
@@ -0,0 +1,40 @@
+
+# CaosDB Data Model
+
+The data structure is build from some basic building blocks which are shown in the following picture:
+
+
+
+It has a base object called **Entity**. Entities are either **Record Types**, **Records**, or **Abstract
+Properties** (and Record like objects for files).
+What *kind of data* is stored is defined by the Record Types. Actual data is then stored in CaosDB as Records which are of some Record Type. Those Records can have Properties that contain information about the Record. The following is a more detailed explanation (also see this [paper](https://www.mdpi.com/2306-5729/4/2/83)).
+
+> Record Types and Abstract Properties are used to define the ontology for a particular
+> domain in which the RDMS is used. Records are used to store the actual data and therefore
+> represent individuals or particular things, e.g. a particular experiment, a particular time series, etc.
+
+**Record Types** define classes or types of things, e.g. persons, experiments, timeseries, etc. Records
+can be viewed as members of the class defined by its Record Type. These classes can contain
+Abstract Properties which define key-value relationships for properties of the things along
+with the expected data type and possibly the default unit, a default value, or a range of permitted
+values. As files on the back-end file system are a major focus of this database management system,
+there is a special entity File that encapsulates typical file properties like path, size and checksum.
+
+**Entities** can be related via binary, directed, transitive is-a relations which model both subtyping
+and instantiation, depending on the relata. These relations construct a directed graph of the
+Entities. If A is-a B we call A the child of B and B the parent of A. No adamant restrictions are
+imposed on the relate of the is-a relation and thus, Entities can be children of multiple Entities.
+
+Each Entity has a list of Entity Properties, or in short just **Properties**. An Entity Property is not an Entity of its own, but a triple of an Abstract Property, a value or Null, and
+an Importance. The values can be numericals, strings, dates, any other valid value that fits into
+one of several builtin data types, or, most notably, references to other Entities. The importance
+is either obligatory, recommended, suggested, or fix. A valid child of an Entity implicitly
+inherits its parent’s Properties according to their Importance, which means that it is obliged,
+recommended or only suggested to have a Property with the same Abstract Property (or
+any subtype thereof).
+
+As opposed to Properties with other priorities, **Fixed Properties** have no effect on the Entity’s children. During the creation or update of Entities, the importances of the parents are
+being checked by the Server. Missing obligatory Properties invalidate the transaction and
+result in an error, by default. Missing Properties, when they are recommended, result in a
+warning, but the transaction is considered valid. Entities with missing suggested Properties
+are silently accepted as valid.
diff --git a/src/doc/Glossary.md b/src/doc/Glossary.md
new file mode 100644
index 00000000..080c2aea
--- /dev/null
+++ b/src/doc/Glossary.md
@@ -0,0 +1,17 @@
+# Glossary
+
+## Valid Unique Existing Name
+
+A name of an exiting entity which is unique among the names of all existing entities.
+
+## Valid Unique Prospective Name
+
+A name of a to-be-inserted/updated entity _e_ which is unique among the names of all other entities that are to be inserted or updated along with the entity _e_.
+
+## Valid ID
+
+The ID of an existing entity. It is by definition unique among the IDs of all existing entities and is a positive integer."
+
+## Valid Unique Temporary ID
+
+The negative integer ID of a to-be-inserted entity _e_ which is unique among the ids of all other entities that are to be inserted along with the entity _e_.
diff --git a/src/doc/Permissions.rst b/src/doc/Permissions.rst
new file mode 100644
index 00000000..c624092a
--- /dev/null
+++ b/src/doc/Permissions.rst
@@ -0,0 +1,96 @@
+#Permissions
+
+CaosDB has a fine grained role based permission system. Each interaction
+with the server is governed by the current rules of the user, by default
+this is the ``anonymous`` role. The permissions for an action which
+involves one or more objects are set either manually or via default
+permissions which can be configured. For more detailed information,
+there is separate
+:doc:``documentation of the permission system<permissions>``.
+
+Permissions are needed to perform particular elementary *actions* during
+any interaction with the the server. E.g. retrieving an Entity requires
+the requesting user to have the ``RETRIEVE:ENTITY`` permission for that
+entity, and ``DELETE:ENTITY`` to delete the entity.
+
+The permissions of every user are calculated from a set of *Permission
+Rules*. These rules have several sources. Some are global defaults, some
+are defined by administrators or the owners of an entity.
+
+As a side note on the implementation: The server uses `Apache
+Shiro <https://shiro.apache.org/documentation.html>`__ for its
+permission system.
+
+What is a Permission Rule?
+--------------------------
+
+A Permission Rule consists of:
+
+- A type: Permission Rules can be of ``Grant`` or ``Deny`` type, either
+ granting or denying specific permissions.
+- A `role <manuals/general/roles>`__ (or user): For which users the
+ permission shall be granted or denied.
+- A permission action: Which action shall be permitted or forbidden,
+ for example all retrieval, or modifications of a specific entity.
+- An optional priority: May be ``true`` or ``false``. Permissions with
+ priority = ``true`` override those without, see the calculation rules
+ below.
+
+Permission calculation
+----------------------
+
+For each action a user tries to perform, the server tests, in the
+following order, which rules apply:
+
+1. *Grant* rules, without priority.
+2. *Deny* rules, without priority.
+3. *Grant* rules, with priority.
+4. *Deny* rules, with priority.
+
+If at the end the user’s permission is *granted*, the action may take
+place. Otherwise (the result is *denied* or the permission still
+undefined), the action can not take place. In other words, if you have
+not been given the permission explicitly at some point, you don’t have
+it.
+
+Possible actions
+----------------
+
+Until it is completely added to this documentation, a detailed
+description of the actions governed by these permissions can be found
+`in the
+sources <https://gitlab.com/caosdb/caosdb-server/blob/dev/src/main/java/caosdb/server/permissions/EntityPermission.java#L119>`__.
+
+Typical permissions are:
+
+- ``RETRIEVE:ENTITY`` :: To retrieve the full entity (name,
+ description, data type, …) with all parents and properties (unless
+ prohibited by another rule on the property level).
+- ``RETRIEVE:ACL`` :: To retrieve the full and final ACL of this
+ entity.
+- ``RETRIEVE:ENTITY:1234`` :: To retrieve the entity ``1234``.
+- ``RETRIEVE:*:1234`` :: For all “retrieve†actions concerning the
+ entity ``1234``.
+
+How to set permissions
+----------------------
+
+- Config file :: Some default permissions are typically set in the
+ ``global_entity_permissions.xml`` file, see also the `documentation
+ for that
+ file </manuals/server/conf/global_entity_permissions.xml>`__.
+- API :: The REST API allows to set the permissions. (*to be documented
+ here*)
+- The Python library :: The permissions can also conveniently be set
+ via the Python library. Currently the best documentation is inside
+ various files which use the permission API:
+
+ - The `example
+ file <https://gitlab.com/caosdb/caosdb-pylib/blob/HEAD/examples/set_permissions.py>`__
+ - The ```caosdb_admin.py`` utility
+ script <https://gitlab.com/caosdb/caosdb-pylib/blob/HEAD/src/caosdb/utils/caosdb_admin.py>`__
+ - The `integration
+ tests <https://gitlab.com/caosdb/caosdb-pyinttest/blob/HEAD/tests/test_permissions.py>`__
+ also cover quite a bit of the permission API.
+
+- WebUI :: Not implemented (or documented?) yet.
diff --git a/src/doc/administration.rst b/src/doc/administration.rst
new file mode 100644
index 00000000..819ce5a5
--- /dev/null
+++ b/src/doc/administration.rst
@@ -0,0 +1,10 @@
+Administration
+==============
+
+.. toctree::
+ :maxdepth: 1
+ :glob:
+
+ administration/*
+
+
diff --git a/src/doc/administration/configuration.rst b/src/doc/administration/configuration.rst
index 4170fd0e..bbafcf22 100644
--- a/src/doc/administration/configuration.rst
+++ b/src/doc/administration/configuration.rst
@@ -23,6 +23,7 @@ In each of these directories, the server looks for the following files:
``global_entity_permissions.xml``
:ref:`Permissions <concepts:Permissions>` which are automatically set, based on user roles.
+ See the `default file <https://gitlab.com/caosdb/caosdb-server/-/blob/dev/conf/core/global_entity_permissions.xml>`_.
``usersources.ini``
This file defines possible sources which are checked when a user tries to authenticate. Each
diff --git a/src/doc/administration/curl-access.rst b/src/doc/administration/curl-access.rst
new file mode 100644
index 00000000..79b10a71
--- /dev/null
+++ b/src/doc/administration/curl-access.rst
@@ -0,0 +1,265 @@
+Curl Access for CaosDB
+======================
+
+As the API that is used to communicate with the CaosDB server is XML
+over HTTP also simple HTTP clients, such as
+`cURL <https://curl.haxx.se/>`__ can be used. cURL is an old and
+established command line program for transferring files over networks
+that implements various protocols including HTTP/HTTPS. It is installed
+by default on many Linux distributions and can therefore be very useful
+for testing and debugging of CaosDB.
+
+This small manual also gives some practical insights about the CaosDB
+protocol itself.
+
+Doing a simple retrieve
+-----------------------
+
+So, let’s start right away with a few basic examples.
+
+Let’s do a query on our demo instance:
+
+.. code:: bash
+
+ curl "https://demo.indiscale.com/Entity/?query=FIND%20Experiment"
+
+By default cURL sends an HTTP GET request which is needed for doing
+queries for CaosDB. CaosDB requires sending them to ``/Entity``. The
+query itself is specified after the HTTP query string ``?query=``.
+``%20`` is specific to URL encoding and corresponds to a space (see
+https://en.wikipedia.org/wiki/Percent-encoding for details). So the
+actual query we were doing was ``FIND Experiment`` which should return
+all entities with name or with parent ``Experiment``.
+
+The response should look like:
+
+.. code:: xml
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <?xml-stylesheet type="text/xsl" href="https://demo.indiscale.com/webinterface/webcaosdb.xsl" ?>
+ <Response srid="b56e3d1a442460c46dde924a54e8afba" timestamp="1561453363382" baseuri="https://demo.indiscale.com" count="3">
+ <UserInfo>
+ <Roles>
+ <Role>anonymous</Role>
+ </Roles>
+ </UserInfo>
+ <Query string="FIND Experiment" results="3">
+ <ParseTree>(cq FIND (entity Experiment) <EOF>)</ParseTree>
+ <Role />
+ <Entity>Experiment</Entity>
+ <TransactionBenchmark since="Tue Jun 25 11:02:43 CEST 2019" />
+ </Query>
+ <RecordType id="212" name="Experiment">
+ <Permissions />
+ </RecordType>
+ <RecordType id="215" name="UnicornExperiment">
+ <Permissions />
+ <Parent id="212" name="Experiment" />
+ </RecordType>
+ <Record id="230">
+ <Permissions />
+ <Parent id="215" name="UnicornExperiment" />
+ <Property id="216" name="date" datatype="DATETIME" importance="FIX">
+ 2025-10-11
+ <Permissions />
+ </Property>
+ <Property id="217" name="species" datatype="TEXT" importance="FIX">
+ Unicorn
+ <Permissions />
+ </Property>
+ <Property id="214" name="Conductor" datatype="TEXT" importance="FIX">
+ Anton Beta
+ <Permissions />
+ </Property>
+ <Property id="221" name="Photo" datatype="Photo" importance="FIX">
+ 226
+ <Permissions />
+ </Property>
+ <Property id="220" name="LabNotes" datatype="LabNotes" importance="FIX">
+ 227
+ <Permissions />
+ </Property>
+ <Property id="218" name="UnicornVideo" datatype="UnicornVideo" importance="FIX">
+ 228
+ <Permissions />
+ </Property>
+ <Property id="219" name="UnicornECG" datatype="UnicornECG" importance="FIX">
+ 229
+ <Permissions />
+ </Property>
+ </Record>
+ </Response>
+
+We can see, that in fact two ``RecordTypes`` and one ``Record`` are
+returned. Furthermore the response contains some additional information:
+
+- Attributes in the ``Response`` tag:
+
+ - ``srid="b56e3d1a442460c46dde924a54e8afba"`` A unique identifier
+ for this request.
+ - ``timestamp="1561453363382"`` The `UNIX
+ timestamp <https://en.wikipedia.org/wiki/Unix_time>`__ for this
+ request.
+ - ``baseuri="https://demo.indiscale.com"`` The base URI of the
+ instance of CaosDB that performed the request.
+ - ``count="3"`` The number of results (2 ``RecordTypes`` and 1
+ ``Record``)
+
+- Information about the user in ``UserInfo``. In this case we have not
+ logged in, so we are anonymous.
+- Detailled information about the query. This includes for example the
+ parse tree and can be used for debugging and testing. Depending on
+ the settings of the server instance, this tag includes more or less
+ detail, for example a more detailled transaction benchmark.
+
+More details about the retrieve
+-------------------------------
+
+The cURL statement used in the previous section made use of a lot of
+default settings for cURL. Let’s have a closer look behind the options.
+(I assigned the above URL to a shell variable, to make the statement
+more readable.)
+
+.. code:: bash
+
+ URL="https://demo.indiscale.com/Entity/?query=FIND%20Experiment"
+
+ curl -X GET -b cookie.txt -D head.txt $URL
+
+This command specifies three more options:
+
+- ``-X GET`` Do a GET request. This can of course be replaced by POST,
+ PUT, DELETE or any other HTTP operation.
+- ``-b cookie.txt`` This instructs cURL to use cookies from the file
+ ``cookie.txt`` (which we don’t have yet, see below)
+- ``-D head.txt`` Tell cURL to store the received header in the file
+ ``head.txt``.
+
+Running this command will give us a similar response than in the
+previous section, but additionally a file ``head.txt``:
+
+::
+
+ HTTP/1.1 200 OK
+ Content-Type: text/xml; charset=UTF-8
+ Date: Tue, 25 Jun 2019 09:17:23 GMT
+ Accept-Ranges: bytes
+ Server: Restlet-Framework/2.3.12
+ Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept
+ Transfer-Encoding: chunked
+
+There is nothing special in that header. Most importantly the request
+has lead to a response without HTTP error.
+
+Logging in
+----------
+
+You might have asked yourself, what we need the cookie for. The simple
+answer is: authentication. For many operations done on the CaosDB server
+we have to log in first. The demo instance is configured to allow for
+anonymous read access by default. But depending on the instance you are
+accessing, even this might be disallowed.
+
+You can log in to the server using cURL with the following command:
+
+.. code:: bash
+
+ URL="https://demo.indiscale.com/login"
+
+ curl -X POST -c cookie.txt -D head.txt -H "Content-Type: application/x-www-form-urlencoded" -d username=salexan -d password=$PW $URL
+
+So here we are doing a ``POST`` request instead of a ``GET``. We are
+instructing cURL to use the ``cookie.txt`` file to **store** the cookies
+it recieves. This is done using the ``-c`` option (instead of the ``-b``
+option above). This time we are explicitely specifying the content type
+of the content we are sending (using the ``POST`` request) with the
+``-H`` option. The actual content sent are the two fields specified
+using the ``-d`` options. This boils down to the two key-value-pairs
+“username=†and “password=â€.
+
+This time we are sending the information to a different context
+indentified by ``/login``.
+
+If you don’t want to supply your passowrd in plain text you can for
+example use a password manager (like I do), in my case
+`pass <https://www.passwordstore.org/>`__ as follows to store your
+password in the variable ``$PW``:
+
+.. code:: bash
+
+ PW=$(pass your/passowrd/identifier)
+
+Custom Certificates
+-------------------
+
+If you are running your own CaosDB instance it might be necessary to use
+a custom SSL certificate.
+
+You can specify this using the option ``--cacert``, e.g.:
+
+::
+
+ --cacert "/path/to/certificate/root.cert.pem"
+
+Uploading files
+---------------
+
+According to the specification, a file upload is a POST with multipart
+form data. This can be achieved using CURL with the following simple
+command line:
+
+.. code:: bash
+
+ curl -b cookie.txt \
+ -F "FileRepresentation=<file.xml" \
+ -F "testfile.bla=@testfile.bla" \
+ $URL
+
+Here I am using a previously stored cookie from cookie.txt.
+
+There are two prerequisites to executing the above command: - The file
+representation ``file.xml`` which is in this case stored in a file. -
+The actual file to be uploaded with name ``testfile.bla``. The left hand
+side of the assignment is very important as the identifier given here
+(which in this case is ``testfile.bla``) will be used in the XML for
+identifying the file that is described in the corresponding XML tag.
+
+Let’s have a look at the contents of file.xml:
+
+.. code:: xml
+
+ <Post>
+ <File upload="testfile.bla" destination="/test/testfile.bla" description="bla"
+ checksum="672f8ff4ae8530de295f9dd963724947841e6277edec3b21820b5e44d0a64baef90fb04e22048028453d715f79357acc5bd2d566fe6ede65f981ba3dda06bae4"
+ size="3"/>
+ </Post>
+
+The attributes have the following meaning: - ``upload=testfile.bla`` The
+filename given here is actually no filename, but an identifier to find
+the multipart data chunk that contains the file. I called it
+``testfile.bla`` for simplicity here. -
+``destination="/test/testfile.bla"`` The destination path on the CaosDB
+server file system.
+
+Before looking at the other attributes let’s have a look at the file
+``testfile.bla`` itself:
+
+::
+
+ ok
+
+The file has size “3†which can be verified on linux using a:
+
+.. code:: bash
+
+ stat testfile.bla
+
+It’s hashsum is important for checking the integrity after the transfer
+to the server. It can be computed on linux using:
+
+.. code:: bash
+
+ sha512sum testfile.bla
+
+These information has to be supplied as the remaining attributes to the
+XML.
diff --git a/src/doc/administration/server_side_scripting.rst b/src/doc/administration/server_side_scripting.rst
index 59bce986..b187d1d5 100644
--- a/src/doc/administration/server_side_scripting.rst
+++ b/src/doc/administration/server_side_scripting.rst
@@ -81,5 +81,5 @@ An invocation via a button in javascript could look like:
return scripting_form[0];
}
-For more information see the :doc:`specification of the API <../specs/Server-side-scripting>`
+For more information see the :doc:`specification of the API <../specification/Server-side-scripting>`
diff --git a/src/doc/concepts.rst b/src/doc/concepts.rst
index ec937195..0db61863 100644
--- a/src/doc/concepts.rst
+++ b/src/doc/concepts.rst
@@ -1,29 +1,15 @@
-===================================
+
Basic concepts of the CaosDB server
===================================
+.. toctree::
+ :hidden:
+ :glob:
+
+ Data Model <Data-Model>
+ Permissions
+ roles
+
The CaosDB server provides the HTTP API resources to users and client libraries. It uses a plain
MariaDB/MySQL database as backend for data storage, raw files are stored separately on the file
system.
-
-
-Configuration
--------------
-
-Administrators may configure the server through :doc:`configuration
-files<administration/configuration>`. Additionally, configurations may be set via the API if the
-server is in debug mode.
-
-
-Permissions
------------
-
-CaosDB has a fine grained role based permission system. Each interaction with the server is
-governed by the current rules of the user, by default this is the ``anonymous`` role. The
-permissions for an action which involves one or more objects are set either manually or via default
-permissions which can be configured. For more detailed information, there is separate
-:doc:`documentation of the permission system<permissions>`.
-
-
-
-
diff --git a/src/doc/entities.png b/src/doc/entities.png
new file mode 100644
index 0000000000000000000000000000000000000000..ba3e111a78ddec275636ff0b7e8b324edb13f7be
GIT binary patch
literal 40816
zcmb@tbyQVf)Hb>SN$Kt`LAtvRp&%jM9ZGj|Kw4T!X^;{S5Rh&uY3c6nls<Rk?|bif
z$NlH~=k75W#93?Yxn?}`S#vHTRh8v2&`8k$0Kj;q0C@`l&%htyo}nOt-+tD}af9EU
zxk|s%Kmi{=6pIM(cT^_@T~`3W@_hP&Gi5#(1pi3lCadG7?r7!aY3gDLczSxWzjLs4
zH8*v#WOsD2PCpVQ1psQ`6+}wIE8}3%(+hvPLE_|?@X|=_7=Db4!d#emp~+cs!Rd{|
z0hvgZql-DyRqbb|!|Rk^1R|~VINDC#CgZ+b6p#c-#LK0+<Htwhnz`9lGwu1-?Cr5&
zD?uLDnm@_s!$QZ;v2k!3jsgHp0R4WAs7>@t6JdpjnwHjuF0xKU5&{XZ#ta-<@kJR^
zt;cQuyL9vn2L}<U<iC%$^_)&rcs0JCdmu+dFgtMq;P~$!Pr%<kpkzBjARGMX0J!|q
zg9z8~Z_Xo!s3>`y*i~v>lhnqv5%j^`&C}Dji3|e4Z?6yg91&q~DI6%T<VjCYpHp5w
zq_{|fhCVwxTU=7YwfrC+*wivgK}(A!X#fwt>gmCMMht+`K0Rpg|Lbi?K*WE~2LJ*1
zZzx165DxfnXdZPt0Q@JI8ny`#_}@@wl)jclIB>)no2I6w&AWG84sn!Xq^ql|Mh8!W
z8xa02MSpgGKC*5MyG?Pvn<!By<}wQ*@_l;6(Z59z*~+z|CMGoMG94$sY3ls2h@2mm
z2S43VeiBbj)z;C`bH0I>G-iI7PsiQez5Z&>HfBDGkgYQtc5fYLSW#C;<hnJ;<)D(z
zk5SQb^`-aw)AZopCyCVnwbDsJr<FkGrsCqh{OR#sx4eA@Mn<0tA8-t>*FO!Ud2J-f
zW0R4I6q}2Q%}}yv8#p6=`usU&o_qrD$$I~Eqa=Dcq24z%bm<|`yjPg+(D_DSapTYd
zG*?3UtN+ySq^mR0|E0;4Cu?E^wfO$cYic3`s1p<_O*-J$VK0(iml?H??oXA=xV!Vs
z&CladQN`uu(Y`clCKgz5LXei0KFEUh#!{%VB-z;6;U7BM+5HN`AhV;?e*5-AS=r06
z)<1vVPE1ac)N!<2yoJcgeVjX(twt6T6WiI}$2)Yix3BeW>Fku=*xt@BDnj<XI^a5r
zi;V23c{gqc3*;w8N3xr%K}8CN3p|+_&X%CUjr_Ig`k#FhX7&N}LSs}^R3zxvF&p$P
z2}MiG0{QQJ&TEi$K2WmgJBgbOJejv|KgmicwSA0=!kDjftn+<5IIwHluDraQv#rq0
z*nhk`CaM*3-%FHDKV9#|+VdF^`<u~Wf=ziB9gV*JI6A5-V{V>55VxPqrVrURt~3c6
z*ghf9)zzJ%tp2<3cY=X7&!m^($rFvvCe&3-cmEXFfV-OiURH*lVjLjE@3<ri5jz)c
zFo;E_^lGm!*D9@Y*?gTcQf=0aHg*+^CGJ&aNC!H(&Og`RKxEY_Yd_l@fCEfTO;ZIN
zDGQa-KFrMMxOsS(&HuEY`DveC)gqnSzUa9ev)&u0&!+CxOW~Q*(n7JgxOn}y4Q9V!
ztfRxM=V0P+u`?FD2LsI?@@~9P7kz<;hsSwRQ+rm_VeMCB&v6Qyei)IF7o1)>A#idv
z@3=0|b`vu`{#RdLzsl$G{kq5d_blJr9({<Qxc>#$k5EMbslyF55JJlp5*9`Z5Pxsj
zA_YC8cGA2R_UJ3)=2lY-<!HPAvAD0Hp%F31Vc0ma*(zN9EXUZ|x~TXtPd3V+aSB6V
zfm%4AD-1)K>h5fSBP!N^ucXMJ@n^*<E*QmUyu(j%&t3I?l7*gup~25UN(zpU-C##U
zKez*^)r--0Y#}JsD*vFwSUu;^|B1otuy)$%@1iH!-xk>8-SuS!^w0(7H`#?H5zS{i
zMO>#{reo^aBP|i!5m>hzFkjD>pa4-s`wtj))(|hy13Lm1T?W`ZDlCN&fIu2HwxQA4
z+1<)G;Y?*WYaN!PIkDkoD`4l+N5<K?YM>veb6E6Io4%CIfCHf_tA{@D$@V9sGFZBX
z1CGipNoHetvOV@KMseo7vEDyyWnR-JtmKAMayyhxzHk1Uwa&%y8TJG^vHw7eL#NrR
zYTRD&^=rud(9qD)QLOf&>xdXAAE!gx!__<|F*^Tz-OrzEQ5>zD4n+k8tBw2L&uyq8
zBO>78T%Y1LP0(cn<wte3p*TA)??k~>zFdq;qrIPBvrSWJ=|F+)P2<<E^b0=w<vk)W
zOH0d{W^bOYk!;7>2V^Qgpy2Jhh1S1IzBstJ-1Pnop#H7@gPMq_C>d$#5Aqc>Nv|`%
zJT8y;IhBstEG#lq_+GDu%c{ek^vVO62tOEuTb})4NqI~K!Wi|+lM(Z17(e%Ce0QgM
zS*Vg7`|2|zN!@grZg62CW0VKz#9jTLnf@W8w3Jjw{6#`UMBg&kQ;va%ccfVa78bw;
z<7hyiyZbK%WIJtVdVWkcZoZt-&$9@mprFuc@u_tdVPnJ4Huk@azj|6A`~NIJ!_AHB
zx#V5sd<O!}%n!>bXWz}=Ng&$rIB@9yjP8elnl<<@N!&!sQ~7HoQg!gIE{hyDo8KF;
zB&~sXK=r2;w9k#mKY)afxS?<km0s1JCKGa@w;IW^Uofh+!uXP&US-~knIY)hSr0v3
z>+TyEXezb^ry-L4H%&oFDcYu~p<y<EIw~R}&_G;ObB1Et7X<L=<x&lnW>DvOX#nug
z6)=$g<sUeDMn)uOXXl>7Z{JwrjCojD2d@3??b&!qhh#I4!^j-kD^0ti=PTMCg~eg_
zuInCFR*c^p_r66nB7vIcG<!;S%z+B@xJns<WA%pG+TkkVH^1_yGkD*9I=#!vq8!tE
z=s>~1=>B0j5Is*oK#*5}2nJ5J%@iCcxKQ|U7H9!RaEoF)9h(H&20@^9Cx^sb7XK6|
zR(YRWtzS`iE(Adz&$F3XSUN#jAg`{T075BS{2{O6Z#R)KaUGTag<6?G11<vt12MlH
z@z*~=cNkAF2zuP{Nd}ha3GjH9(k59n9(grj!L8=>l%X^JWx#~Uy}dmts`-hDjh-y@
zC9%H?!2-*Ec;Q%7NKe6cu+V@f;(1hKlm7X$>lj=hnPW4~`PL8~BE{9=e7OJJm2OSU
z$B!;7Kzw?76l+B@?y}!`j1BA)gJL{5LG1x_Z8WWa5Q}fp+1Xhc@ZhrmMtyw01!Y^7
z5@XliWT`W#41Ep6dSWbz`^xTCFg!->x0%3s{Qp8-N)Zg?WPJzc`J02qSH|^DG-%JC
z!?kZpc?Sfv7H8kw++fDNdh@2cC_CWe+?<}>aw|naL4l2fgPe*AmIg~wm7$tiLU+|?
zCKWkt?G)$v<{yE4r>Cbn4K57H9LBNb`gI^I<2{Y{^b|;ZT~M`Htd>unRhs>d9YIoo
zzi$Hyng@Jjw%q}w@rsa;X9x*RY{sny7oJxK)gwMlij+x7NtT>Y2RN@05fxWZaL9jj
zN?g8Ze04}*nb%=p(`5k)d-z9t5@6>42$J9M7d~63qXnV$tMa;~k6?P_xB{)x2m3z}
zC0nAg*07z$<Df{7d%q>nc4`&}ehmK~XWHP=)6;W0Zuz@5Q)S-cA4SB`6M~A@Ji`it
zKzlpOQ(oNQ+uYo&Km0il0EUK!#bsq7a`{}3Z3gVU&pDb`%8#Cc2LE5s^x5L0A!3pX
znw-N@IE)?CFyp}&A%!bGQNF(IjjgRUFkQAoAGe`CO|0O`aKSwPKC*RjaXHy7$|kMb
zbP)oL!euo`tWeObBK1Gy3@2gwS9kX+XuMMo0dTPo@G|>Pssx|^J9qrYexHW^-zjO}
z!aN0-ykJFdODe(i?&ulZS8;iD<<s;WoW1gdW_eLl)6?PMls<j)i{MCFT9Nu^PcZ;K
z%qaiy?6<y62oR}|5dn~^{{xdgP5tIYxIF3~-A}9MwbT5g<$cE)@YqNuq}Sro8!t!!
z*t3&Qbt2LbNRZ6hAtp9X!tzI?_`O4AuU9C6ynqn!0}eg-M90E-CIzvzxA8Sb4vyq_
zD0Ia5x)oLOGW1Zn;?iNK7T7uSU;-tnJn2FO`C<V!O7OKG;B5ulLQn{YwuE27+k|7+
zoNS{>8e+r4O#<)P{WR13j4>ovYnPrNQxJN40*bJqj0&LH`E9n>A^-LVI#&f#;*i>x
z0a1ii%qH@7FW@<x0g?%Spw5W<IBO!X2V^vzXgdBd#LB^ymJ9)3zw=KKLBIV1v*A{U
z{ow*}0kx(5FEWS3#O+@&Ei8cm43lKM?HP=f0D$SRh6@Ab<ugt^$zM6XhZ1u%nCPj<
zXy4#$TBbxm{bHFuIr+WjGbE&oE#vN!Ly`F@q?`w1YrrkNHU+^8zCD|o-lRs}Id@SJ
zaAUt35T$k^2}wihD3(AmXH`{2oTf4cm#O%Nu6~-tfl4}5D@5=Se~qTexwFF@Zruqb
z!=G=HBCi+%pEGQlFxt5R%kOSevAHNH%rq}mBEq0aOjD8y6V{E*?e}-D0UwS_Fn;>r
zpCEsOEf*X2P&Yl#7@(QWs%TXyp`p*@$<AAr0LlQ9`aatb1TWHdsFYXP!S1sYeZaA4
zwebpFRx*dM^GB#0ii9>A(xdpFl_n_OR5A6v=+p;<!e#IzfPo72!2<ygh6`_cVrBa!
zfIWoouvGzpX1=-n-EGpzLFS?&Tr+~nS3LV^crO%bNwZ>E$<#DXJZVW2LUIl@r%54z
zjNR`r1lx%dgHZQwDLZwTu!@kJS>7p0f*#cAKV`6oNm&1>OSY+i4d}mGp{21nfa1mm
z(;Z@4p_HAt6&YZon$U)^Q&*x&md?V`x56q3$xkltv8QIxa4#IS;dV~-jzK**{<HPf
zGc(2qVHEYjyXI-WQY)GIed7bj{0MLlFIg?`>vl>@GiX(hF0E?9PtIZOl$0MB$hU<`
zKZJlNgzbWRjd%X*(^k-jb8M@h;6V)g3D%hF5!D&}jR}xVgaVOQuKgR}I@_VOMIxIt
zYJgR{D;%6ypgQ0oiGpJHY?Qyxm7$%RBXsv?#fVc?kDevM__6LRxJLUE0^-l4zFMv`
zL|l1;(vN+}1zcmduM^(~P7z%qKfA?4Qx1(6=`?f$l+CHBE8#k+XAEzx`(}Q>S{d+W
zFEh17pv?oG(pv(QXXLA+IDmSkblb{8(5?ssY(eJH04!<ZW~4?NV0?8pu-z1;|CuLn
zjgy5zpT^W#L&)403{8^IkV278+os{fz@MOV%5DNr?nBxV__#O;foT^ABW!?C@QH72
zFOXZdjEA!H%yA1Y=$+GX&0Q`giq5!%A`><%nU124PI!A-hYV!H^9h8`#I62dVeVoh
zJqiep{UirHR$pw64u*$7gHn0YInCg7yy$u!*p77)gX{NDfMt(}{E>R&(+N{73z<e2
z^vnwz=LX{mutnq2E`rmab!x!00eWGZQp6MPKx-PMTE@FD7El?WxmW|)1+tbi?UE$W
zCw?PcVkh^W@PS50eBzjfqP}St;WETuufIw5e?2ZegDVT<6m;KU4!ncA-x#Ar<X1s{
zRs+PgOTfcVrE2qYV&PkKwFnV~eaQcflo1JmSbTV5(7mazvJDtQIYVKVg01`C;7$a9
z5lMw;g`>~#G~w+^C~!fMPRG_%<AIV;Rms(!b6=SpO@81PPnr&B;t!-xVHlM1YWX7A
zp4$4)Urkxy5iz%?g|3Na;ZkCEj8d%)ROCS*cF1%3Ae~uBj2wb8J4uLCySBtAE>6Se
ze5G6OlSQo3!LP>>8`#`eFx1X69N$|&6gd|^XSnNucK$8gV34Y*2_rGKQ;I6kUpXja
zLdvWV4E4vX)tYU;@EtCurEObL;b?|Ht~fu7dyfkO$MC5eka>ITWaLEe8hKvgF6zOB
z6Aej8xE1OU$#x`Q9;dmV^6sBqQ!$r~jVxoze<M9Cr*yQr$YHAiPtkdg$g}&I0}c6v
zHxTy0X?i?M8E8X1;TKGrG5!jdifG!<ZVAXW+}!&Em_cxG`sAAYePNDFy0txOmcg%q
zmZd#%97J)@#(mnLOgHKO0~c)wC!8UE7#nTG*e7CFEMyjvI%@>G<--`btYp{;y-%?$
z6PkAMLKPz2Hv^+5x0Z1X=aexCEfSG6O2DMSUg-~PXGfVt^pMmM?|hB(-Bn|@eL5vl
z*PKnkq|p#@i-?An^~pm$O&R^skg7o&aCqb$S_1)aIkWj<w8o!;g3u76sGE-()Hy<a
z<DjF|XYX=XOP1N0u&K8HMuJH7X-h=oB^*CZw{ixO5xjudWs!Xv^!sVAM)i$zB?R~s
z8Lv#YqQ}5?BowKj7Hp&Az6bcKA3<o6YzN!)#pfU>_0iq$%6^Ox<xu6>b!DM9j4lP5
zQBA|5#E<|gcrS9vbZ|ET{k+tb#FF3BN0t#xut04jKNdLrOeVd)brG-yJ&U;=)CIl)
z=$n1sC4dq92@lhp7T|^5*&fxWi%85YRR2smXEGC%hm4w@c*BnA_=o0f4(!ehs507L
zTuI&T=fc9*kh<2Vr=<c<D{3ZOBVmI|w~%1h=YiAIFMX^23-}degGR3`OcXbnRD$-v
zKu1uY)I_Zmm32LHzM`N>yx~Cqeq<o;Oo!%J{^1B$rOWJ_{{yPS(J9YfD9{r4=~E+*
zKZwQ&dMJBH<KLrSfq}3egeO?Pej^nwy9!Yykb(Qy(0|&82t9V;Z5urGn3O(SU<#b*
z^C_F6TuV~yRODXo7Y38?rv2@hV6+9V?EjRg)_NRu6CsLKOuNO!2x(LE6+&g{pe9T(
zY!!~DM$;Jls<PqxFWxI%{@-}V5h{|PuEds>q@Eqxb`0Z`34{x3w=kM**UJe^!ia#6
zmJrL0eDZ6&8{`)uFYY-IB0NU5P**Adqi6fyKOdjDN#>xoi*r(AD}nC316#@#{ASl~
z8Hqm%dX!6Mi_$F}9K@%>7L)6<c!CLUpeLZ@nRn=b;`yKgDgkn24Q>UCx*vS^hj;{Y
zrjQ%}0luT3S3-?ii@!3tIX(%a&k;-r7X8aSyZXM>W{m!{LFCdsj}lV#)s`w$f!oxH
z@EZq2XwM4af)JfDjypADfS+J+{jkt`9M#LAMvk>MyCFUQjkJ~BGAyGb{%S*=7|1dC
z1zNS^ooFBw?tce8WQi`6)7G9*lnC1fsHEt03CaYN>u>JybwKB`d18t|5os5ZeHwy+
zMR50+(zMFH!f^M5?ei<HF(0DPB~g*!;h)o>_bo)i!8Phkv5=((jDYchdA&y+(MM_Z
zhl$qO5N-84G!oDLUrbYzt5tr6O9gT_R+NCKl}8enOJW7)dbrLz>alK4ShNkBYCQ7t
zLxxQZsU+*mbL><kw7rfTKA}iB;7k)VCxnO&x19&b3R!QG`X2@maX+Jq{45}Zb3dkU
z5x(I^P;E%4J1`8tbE0?LR|IZhsT17$#*2Sp?($!l=Pn812vz*^1632kKtTcHE?(*r
zgb-a9h)f5FO|<o}<Hd2%zQstNWswn)fIfA2zR!>EDi59~RD49JByUG>x_{KdGF@rw
z8PB9e!*xN4<iA6JuU>up<GB6g=3*hb?vN!jJ<zYtIwec(RIyC8Fdf})giu3Jj?97Y
z;f~Ah49m2kmBTFP(tlbwt2vC7+w;OJ35^j=4U>K!M5$ja77?~DQ%^)<J_`l1LMyWt
zvZt_+5Ksfvu#e^h|G=AON@VXJO~S2+0aRX1bPl-4D{(-flvg(0v;sAHycrGphrHFt
z5hNBAsT)eb5PNC7zfMCMW$@_SMPk8{H*gt&Im}hyttGaRgf#oT?X5q|+6LN0QyP4-
zFmAGPUbFl6JttLA9W(U?j}L0#lolOopoEOhodRS7l@uj%Cg99Np8c(8;M?ovM#;R~
zpXi;q=+HWXPD4A|MnN<H4=&^10O63|1V`Uvr8XQY;IFatVJ{F*Rz@#FBR;621p2lt
zq6*ZLlHcPA(P4{gCk6&XX+0wWr<6L8RV0DnVCWgv->%_k))#@la`&I(AeKmaWxhHC
z+XMFyYSCqcRcq=qhM<#-wQb;x2#2V(Y>iaw>8t~u38_tLlYKPalbdlb7|ta{e2{W|
z$L97v-CG`hxMl)BM1e%HV8!iQJ|5fag1ROy3*5JIG@_!|4i>oH%I1fZJC_~jLMA>-
z777fH$-Qy#vTx+YzRlYj2=}}PsG$z1JutguePLNh$7U(=lAMZ6(bF1BseE|-tHbnJ
zOlYEUM>C<0rQcc>V`z9xZ$I}9>aT#M@tYbI?dV`V0?}-QC8Jw3X$zXABP7I<I*;;S
ztoloCyTnUB{}ccJk5&Ze_fLn(|IcyK#nCeme!Ro8Zf)bsL(gG1$719L&hCHb^uHQO
z{s^_-<{ik=MA2z-xlk~oWbORmX!G8N7kh&1yj;Kq1n-wTYLW#6?TAQ8kh~$xd2h|)
zRRz&Y^0{#c$yQ_8Rj~z6hOOK*YQ64-tFv1PY1B+9+c3eCcU+gRk({S|sA4Zfu86K_
z#RZ+}j^`Hxp>MJE#`7<GS5igl2!O>8&aYNVr!H|3%&H9xz^KP}9E|W%194@R6dKp}
za6OA$c&82hM>}YUl|QRvY=n*0Pxp6fh2xBaL9&<7n&p!reoHw_eh1KTcmwN25~yh}
zC*~Jvv1VG2QdBSa;Q`uw9;fw|rj`XdS~Lx#A-J6BJ*NO|l2+(FLdMNeyg(Cps)THO
zMn@8Rjnx`zZ%g$-s^Zea6I?ycn;u!xY?TvI)T@7>{g-)cekSth7IQ41MJxQl(H>%>
zA$YbGdjUyd2IvVfgEiP)zuAwUl8$BGf6e0!frto{FVEUy<9O?*zYY~LhFUKe#is?q
zJa^r|B1i@wtnqI`0*`!+N|Cx$`JS}=z$?%eQLaU;flC(c#`+DYy#YQ1>xJUt6N?PA
zE_36{qH%95=cDKMDId`z6OzqkfE{&K&cBmjBZ%j`Xf27%=){XEI87cNkWGn`Jx#*1
zdxWa^BggvxK;Gu3q?&mL1o-&kaTnn`J@D!By_*#+nh$WE-dFXwBB^6yPmh`y)6Lo;
z9E%qkpN-UxrSzO(S7MY&G>H9m!WkVA)m8r$vH_9DlEQjdOai!lo9sChXFJBc<4Jpo
zj+5{rqVJWI&#)bSOe;ltYb)7%&7!KIei>Fyvx5;F!i1gfEL^o59ru;z2c_a(YTFU$
zk?m31usUb`T(ulUq4<jllhJw6DImDmK3mUO&7Y>X`7I)~uoxu|rSXRy(<;Hn_bJY8
z-xPyf)0Itr@!_?MvC-0IPvvQ>Htn4U3wubv#XTZXizYier*?L%i|CX2G|t{}fjCfQ
ze<;)APwLL`o`pZhX`<ZdfCLBeqxoflj;G7IY$hE$?bMr=+}xE(?m%;g%-D}Z1$hi`
zm*FfVAWd|s?kX?$^3!IW($H9o(dEIRz+F3J$4S6*K_jB$Zv_k~wxjPz-+N%P06CK^
zqtohGmX18s3Dm;;$O&WbFyqu;%;)ade|SBHRPqvkHQ`mn$Nmo*dueeAotLD!JGN2~
z3+_BKZX8_F^(kBC+b_8Xwn5-nU4>_zbf2&((lH``J?vJY`>^5rvw?0bnSUhfrGd7F
zi$;^+)K7zhAy$C|&~v}|QAiZE*NydaP+!|#gfvbgx1t>RcdR&As150rr{(9t*~L3w
zP<I%mzNk38_GX^<%{|x)ma>*qfS}}!<Hg5ke*mE%SWo8r-hs?w$7{D~PszzyWYE7)
zu9+c)zo;KRi9)cVTzCC^$|?0W+iO&Hi^+eC1{v2CYKPv^Y3_Wt4bLkl(knp1K~*F6
zAK>llvPVZpmmEm*;UzEm@FO3~Ck7Me)mX%<DEV8429&5Mx0~%N#`9hUmXz7YSqjy^
z%*gzpta`dVc}JRXNWr5J7FmT2Nk(h1r4mLrX(KTo(K<!B!>b3OhtO4V5`f#GdERi1
zg-RMq3c|#w?jo9{HC4@P4C(w%>@@OVQ}gPC_-wQ#(kl*AZj!>UI$Ek~yB9XvrK)3-
z7>l884FUT5WR-UN9)5yQ_Kmj{TR{x8MGEm>gf#Jiox|_7HtuJm^TnleW(!&TFph}W
zp|Fk|`OUNnr>z-en|Fff!5#Dx%6ozaRTpHX+M28)PG@~h#U<A`heJ#>F9k`kaY;ij
z4s@Bx-C4QM2?Za<6Dj?kUrr*}1{ZN$8$-G+B#YG7?RJ?2eb0Dm_$hHD;BiU*{IJfm
zxNqqjOh3M;9d!Shv_4q%S5?0jQ7m(k5Jp9q5D}drMC{#<prAx@I3YBzue`Pr3*&Ow
zCNz%88>=IORa~s37njTcF^%$W3$>p1((X5U8Ul6ya~D95cj^cZC{8-;fvLaHt2!MJ
zu{Yvj^JSD%@xez5rkrns{_=8&goMp%x59ZVB&z#UnY8~rrV5ptWUzbvHPyd+-vO&J
z9;y(jEcd>~c5*ha>lf5@_B4$+Q_E~2*_T;IA$a|ASxzZTkS65Yz>PZ<*it1(S9D$*
z7u)$}UpK2vn?UU=$HllH_MD3ZmHn?;>BP#QXSmbeK7wk^<(xe$7M9djqI7g~0Pd%-
zA`wwfUs)c^wmOVUWL8toyBr6WTxtTm0P*J}pU*P)Tpv2n?7RbFoPF;NQ%nc{?2cZP
zIJ-?MCsv4{mA^K3HUM$24D-W2mX;YzpKQ#~`oTFltWUMZ<|X63U-I&XldAiRlg$T5
zsS1KA23f}5m0M5BK*-iyPVuf6M!<bVT+Dn|kCpjqlp@<)`Qr`QXi4a0!>RX+`n_z=
zE)&j`3xRMam!W`*S~q=i1Rz(<l-T#KfY^BmqVV;5+^EP%-CAF`h-%Yu*{O9cqc9uh
z`f($=ceOk>_6pOduCA*0L5B;(i=-Ih652s2vE(v!Rx3BHrB$d@*<#^MAEUzZ(jjgM
zw6yAw`PZ`PvgyNDE)&_yrVCT=eR4Hw%;x99M>Xn}^TepjT51cMFYw40PCqdJ4HSxL
zB$~9I&b>VlMj!YRlos_E*0+NmE}>|xpQbBuH#+W4so&awMPYAU_IEr-#{ZIkLfcVh
z>13bNyu+n$V->T4&nd>}zUIL@gY7{BAK)r_Ta&wXL8_5;gC?8r*qb;D{h(n5>j~7G
zd~xfItKI`}uI#k7t<SVVXPUD*OeB5x-;Gs0xCtjsK0I`C+>0sDzlA^w@<4gkVVYSt
zNZ=yX^VY7H+n#xie&x<0bk>;2FsXwn)ag|TD+wpHZ7-Kcj)e)bvu72{j|pEeejZ?`
zD!rKVsd|iztGr7(KE!;4Tb2FkGfm=mH;`037x25_u{Psd*EH6{^KdN(SHWxK5EH4%
zD|Nw#^7S8Ky%LMT$5g&l?#L_$;LMx{13Z4%>GOlzdA%YkI#++TMV-ID!UZoU;Yx#{
zK##~oVXR*zLVDK2!qy5Ea6w8jTqYLnuHyGhRzGgYqm`bP3r%-CDrO#>So~1Zxp|%l
zbJD0Wtg&cT?<KiFvV#pw3!YptrUyeMQ-z#XGKXd^4z_!M57n{$&1B0DE)2uREUwp{
z<Kv@|nH>J%<s5#yXYPFh-60_>OE_JplWVdOSOn9U(1%~II4(a%7!-_`K;~VTklNmB
z3h<XTEIvtP!oW41&;sqsifOAA2JtWEhcLB6*=&q^_F~BJPnYlq?xM*HlW}bcB8*4N
zAF3eX(x=$a1`Vj+=8G+yIkyHYQ@g5N>7A_0z5mr#j@cvAwMP9p(wGVZN$htlG-POb
z0U=ZCopUr@xMy2PzOQi=nH{HzQ}*T{LEJ-{P1C_ImXr~-fVJf{*VrntJFp6rJ#7tK
z@ViI;>{_Q#p*#M5+};CwoY<@Cr{l&>z{em)-}!zl>H4nRnKOTSr}7-y7Hm{1|JbaC
zS>X!OFOSyy%x)8AdRqJ!`PJA7*ofY#<liV6giH0u)F$DBhZ~44x{mF8BS-#zyn02C
zOP^vv&Cdh(2b;u)RAkKSqPaN3uzTxmabr^IT{xLRBUzccZPks6aZah#%6BOX7j%%M
z!bP6=?%3}BM1f>n+i}D~8$qtcl43SfPyWk_QJNMffa)^5G-rBeRC7LzVxUdd%=Fv1
z|9RmWYfrvU@4I!6n_IfRFIqbnr+W?z-#jt>Y*3@3AXm|5BJ${hSI35eZKX;x@c_8p
zc-43`?_%;N_mI$d@sg}QXVr<|XUjFgmbh#F`f>~0%-tLovoQyzvce`eJwXu-BOTn?
z33hQ4felMJ0V4JLt7P+Ys<!qI+m6oO{LgL*^Xhd(#XZm;y-cVF9N#!{412ieb0&Lw
zNB9|9&+CqP=s-SonPVRM;ZT%!-su~d;e6~}2%U&7iHJ}Nl3R=!zN)sd#ch+%5UC~Y
zy?QXL;o#532AO2oU~?!6Dna3mM@^>GO=O(&?T#;}0kitdw0bz(@=|!I18k|_#m?PN
zaa)6>_yitg^TK=F5)$=M34-$SUE<eREiu1&j7j23N|!!%H9dZORsCr4cR@H4jjZjF
zWG-DX=5B*VjhWIF`Rrqbl-VBfy72u`EZUP4OjvCQ<#NTe8qfe_Ogkv0`nHhqr?M&s
z4n0y#<9aQ6Q2xll1@DO1flv(=85M1e_pAca>~ZZ3JONQ-c%jeYo=D|uSyq5rl$+$d
zLigP{Y3?dQwe>n)I31rk>6g8bk;L*C`OzuA&Rqs{aNuyZzT-k{#A{it)^kN+u;J(>
z2B=zl^zzXxKenqCO_|+gx8Y(un*UknI(=;D%g{rKgotv!^<;Iv4nAbQGtyD9;v}v-
zzNAXv6~(AZ`>D7Co^MR1m#01=!EhqSQcunY;sva~PP#vSF(P<>mC0u`kUaOW?X>p%
zbVb7653}%L%>`1F&K9|&wX)Lo^W$sAsRuVqCh_Gct~z1k{f2`(I#u`Q1FS!+@y!<~
zcyO|rjF!i>mLe)sQO2$ku)5Vpe-sj!?&U{eCol)NYP-Lvgq6n>&v~G|VR}DmG<)E-
z-2B4c4%4g}Hzp{d5rF{ob2*D2uEBXALymZqL)(h;c;6D>XwDQ1rG2J_`#jvVXI)$8
zUfk_H+Y=}iWFPY&S?ytJfC&v*&1I3kX<Op*5^ik8nD(>T#T#{1mj{cnV`9Jr_~x0_
z(<&e!?VjsqwqA7(GI63F*a3IA#PgeQTNhUd8~_N;E*-f5lGdCnCW_Br&x?!}zRgw1
zmvvJ>`9n*`>951$vZ&#pT0XvBluVfD?veMVK)OQic^c$HO&<z=caNF03$7VbT3=;z
z_4B**^szFHJpFPh4Fwc1VRDMUz%j?gTWp0d{8ogFtgkorRW(O87ZPF+rn~zt_0uP_
zbK+2~aJI|K;)5f(rq`h}@v2|t<<>rJ(BpI3;Atd&)B@QL;UQjO+WhnaSU*r?T!@S0
zfik_GA;L-eI1?gmL1f^tFg-mU_@JMSlS#)4#j!FxCAHu_{nL8=Yc*ALpJW67Wlv$n
zahMjXU+d0MS!YKkv}d9LhG1RGj~2W+_L;JSAw?YVoX;k*#N2sy4NA>mPkZI)J5>*x
zNPx*KMeN5X3J-5JU>$i$@m|NNkjDyXx5cE^i$?wAI=vy5ctG7CG!Bh1UP6@3J`vg)
zJjF^-_apf8gWY{^``tTitH2(nnD%>HZM~OK5z)$R*elqdQ||-5{!yhbjCJ4h0XY2*
zGJ603NTf2}bQ@he=pV_M#u!9nBdyh#Afkni6=|8MOsW*`7R&e=BWvjK;pVR;5Tpd{
zdVj{DTGbP;mE4-N_S&5KY{TY=eK^oySHEZ;>sOC(NPrMLkeEP{`uE@s|8!<}Plz#b
zrQG_Cya*i1_ytzQLfC9u+tMBvNcKdGZ?$;eh>Hu5oM$(Y;6(nESO|lJ(m<D(H%7=T
zT}hjbO1qY{q1c;$`ZM$*gxZ>h_ZFu>M<4X^L+xCrQ@iaJUw<@*ErmAE(&1!oEl|0_
zR-gy=Je)_vX<GC2gcx}C$G#8p#1{w@Lk)J%*zXP}38e@Dl&F|?OBEvwZyl83M=$g*
zMoF?{+4OK9Q=)r=Joyo@3pZ0>PU!1LPDe3DZsCUT_#9OaQoj=AXp{_<`cyhPiBdk|
z!e4z3{mr$yU5!mi^zML)S`^vEI)$3H<CY?M_`F=O#)Z1$6E7sJVPqlV0<~dEgbpX5
z?)0Wa2bLa}b3|AulKg!s9LyIY6zDX|$+$SNsqxrq?15TI=Og1*p}0_q0C;0ft;oIM
zbTS;OaHgJ^?oS70QkUmS)=ZDfRd_Qx`p-kBt}b*NARi)M^w-zs00M*?QVyH${fSd1
z?M$22r*gY5H2%&Q6()j<-^ro(J}}T>v%9k2Y<+N?&MQ+#c`YB_r{=Ri1Oy_mv0b0%
z(#=d;kYFEb*p?vy_<9sZ;y&n9NlE$Iw*D`M6BF@8d3JH5Rm>=^O`J^b&U-}uJaD^M
ziMZQ2obo-ndM^gtQ#FNmFKE`pIZ`&Yc0)6&qpf6O@Lg)_O2tgoqjrz~W&xG?L837Y
z?eCkkK#~U6a?Hm!F~m@;IsMmaMz^Q{4M%$<f}_b5fuoN7@}h1iPp>$yL%2Mn`J+3P
zV3`kgw#EltMWZgP(v&<{m)>rWKqe*tNa}dO6B@u0WRH+k`d>8TuHrzshpCGN&lwnv
zu6+As$cMi1<=kJlUqB-v@0Cmx+_)(9A4JL|YWwS3&Z}w_KAsKwPDO^PUvK~PtgJTU
z;1%9i%&^3LVMVCaRk1Dh@sq~3)gBUe#o+Ozt-IjEkkr9Vug}=yOc{g*E)C<G1LE%~
z%mqWN7}Va3W#eOwKMhri*3|A7?Z|(=v{=h-BEOkD5{Zia9rXSgO+s$!c{mx!D~D#^
z>$j{&GYeu<Qbj64{R_HErtprkLcgvB39z+j#qlf)4fB|=fG6narmowSWrO`RpPFQh
zXV#$4b3LS_=u_O2y$XDR#UZKj4Jtc>Mi?C?YPX`iHcJ&32~YKtH?vr3`$lWsV{V2#
z<&)BDi?;^1`=w=|wv!A5P~R~IdzQZqu9l#zo^8E|^3SuR!#hs5^*wO}5B+fJl;o*b
zMbmqkzb&O6>3+T3Z<9M-_*9@WqGd8Qy}b6oW9fkm1DqQ3@vt1`gTm{MLtb0^0*=bI
zoGWq2m}_UpQ>*je-Zurq9<T1cd^z37YOzt9G0vYKEo$dmh6Tdr{(fHUkf44h{OEJd
zyalZ$v=+8!l62jGDQ9=Qk+7=~zD6!%GA=zl>|U!~Ht+6N=LcU`+15ZJa9;^m%F2Sg
zC~@Zhaf$Ij2S!ya*dkXW@xq-v%u*-|j`?$_+3y1hVRyC`<>0eFak6)ehF8c%xQCk<
zZI~bx>E7nnS9i$XkdE&>T}Vew5og#_A8Me=IjA-g+nZSRgxH?+s`z%6d<qZ5p5e?y
zGS+Uv@E61Ih{YxoxICpHyGIDrAf$bLU!?Xo=f|LrJF+^)wr6fr^`H98EFLm7uC%Nj
z+JyPt3*q~Bi!KZIM=djNTf3h4w;Ph!&&<UbGMKx-(&G6T_SGK&Zwn;JhuqgTw=X5=
zzxitJIP6G*8M3FO=RrEZi)(+^mL_SQ5+$XA$oe~#_k+c@;>fE&HGwx$<B_C5r{Uw5
zmQ7;t&ryY2!C7MhDy|La*=*JV5y%etj#*Z<78yd3kPoL4*`aTs*LEugWO3`C?zU#A
z64Qx2dkd7UJtgW+Lu`CEE<b0Y)$~bkg2fk&1K&gWZT1ZW@bw8IO}_+-k3d$isIna|
zG#S7SoL^qbDla`8r?~DqMZJUljBYY#B*oMwsT;8uHFZag_*RXTq>qeiC|A&9dQC9Q
z!0;?^VU|JgzQbc3H~ov4W&H-__7QJ_<No;jF;jjo6?E78jK|(nJg=KRuBg@brgrFP
zX685yDfx=!9l29lHR*%QI{N;U6f8;Vn@CB*6v_6BvG$kARFypWv|OU>n5Vh9s(WrW
zs?4f$ORH{9xj*ZO1Yq^3wJmG(-^XZN3_fK<|ElD4)8B=H4A|k(lunB+HJmH*yJp-?
z<2O?1{cg@F*XP&t3USd8GaceDNoc&RiG(*==>)GAewy-p8-&MywYr-6iT0vev!GMu
z&5(^|NzUZ{X}Z{5r5S(9?se(6AC9u)<8YD{)6(S!lJfg6cqb3572KFUhnoJ**j^b-
z_qJN{3y~N8OF2H}N6zy3H~d(YZeL&K`b1S=Jn#1s2a{wo!%P0?%-dA;-a@cXW%t3g
z!4oXs#V56)Xc8gS`LqyX@QEY{+zUtjoZMU{YfA}-<mGJ06@4G$sJkYe(6Fnow3Jj|
z6yLyTn_6{#tBZ1`=-{-gccjXD3ts;`K|&|O6-lNr4$V_bCWur@V?wt$lQ<)KU5*Aj
zy-}YDP|he)VoWlfsKil-BMVd2WhQM(clvrII6?FQ!6%q<K;Qw-pA<1b$Tm%&@d!^8
ztmL;9k#GMM%tqz6v|uch`1!0V?MlLekNg|1{q|6mn11^g({&f>q=9Hp`E->jy=Q<M
zDa98><h^|meeeyB?uB3aq6>@ZDNkc%=+ipyS}Txc2S@y}Sx1L=uZ#EN6rVmN^V4|!
z@{=NY%J%NGh92GAaHghNenG)P8eJu9C`OqHa)H>b9Zj^T$)WE#;Q+LY-Wb<E?}y!P
z4wJ6B%_n|BhZOYW*1f8yn>C!ql=ZFX<__#x=gVt?HB`&hC-$k(CQ<uKv;T%-Q$~Gn
z^k5db&3HZhs@2|FhVH^De>eg4lwa?8Yx%bxMfqP+1NvxZr&Q*0bR2S`1Ft}OI`EN2
z)bk|XnYslmxo}X4#TGHnV8uR|!r-DhU>^q2MTG)h$}#D*a@c@(Lf_kUrX*=zfBW%!
z4ff{lqBPSN5)5-nLsyBVips{~AbfK=y?1$?mxnt-B^v$xdC(`!TGF<es^`nb4a5m9
z+e_?|!eWoU%PO2e#B+@9ik|467({OcZq%Q=FYpDI=`a=U17Iq79Z--aKXN+5JG^*_
z&E_~tihg}@Aap;{A+s}PbNb7{S)AmI%34vvy`)8y9+!s$231gQ`c-mOk~W?p?x`3o
zD4`%XY*7Cei=W5wG4!g_R!M)HYsZ~5oZ$jk{a($=?P5)a005(ZoMvc&(M2^=gDxzf
zWLMpQg$xCFWo3IZ|0Pa{0Ekdwk+PW?9SOnz!0)Q2|3azB!Co}_YU?fiR~;1}`>cBo
zZea{v@AL4l6%eBRZYpCOjK?mS&eNSiU+4K>WH@B(MvZg%d)*%wkJmF7sU)E^l2^B}
zo?KkEqU=L;gS|ND&0i2CSyD`ID+uYJN6g{JJU-=KC*+hwyJv>pAcLd*oHsVkjGou{
z{^h`2Z4zI^r$&a20zrv^_Mq5rgf>YCJj7<)xCW#;U@hQl^lyC2az`=sV-29)?Iw^8
zEI(&XBB;;P;pSr}k?vod=5nn@3@JgZYcJn<w=$OqV!Y~p*JFw0jyyd32Fc68wM6h{
zxsyu^PiAiYwImWQbp!n(F#v?LX`WNd!q8I!UUg-{TK-0Hy@`DXG`^oB22NaAGBKed
zJ_a=$5{yU;r#}$@41YAyTF)H6)MxDjJcX-UAN)!WEpbsDSo*p`HXsX?0m05cJJJi7
zoPE{cT<qwP4L~f+&Jbg293BT5DqX%Evi#=T7gj|@rXD_|S>zIg&bd=5V}3eXu@6HC
z!GWqJ_%H!aeyc)^Y8%#+*Htx@0C*5`+K)?*Zop+}Y&!itwtoHa3zh%Q{B`-XOt}`F
z7&k5zM@INP@xXNaL<GuLIduB<1r7ah_if~?rd4i|rECG@&+0FY=QnXtkC<5?YIZM=
z7HSaf**Bc2Ve|<K2?-)ZpRL7$Q@!>_By87kKV~@0PX;L0WUg2s-2~*CR)N)UX_aYj
zK>F$->*zcphQrCr&hOK?0C)w0=GFb&=&Y92SYf&Dy$@4TXx?M9U`dtMIC9I<RibIR
z9{E@GFN5)wy-B@`i(z0vi3<QwJg@B;EJQueT-DCnq#0rP&%gM5an9?w`LTP7<J=dm
z_}3)v7k|d=M-?ppcMHl9(Y?P#jJhK<_D5QFDw*$nj_8OJ-bOIB`4A!z=LqbaF5JSp
z=fcIqG;sY0Dn!qeQo=(e-zTFQmTKrv&>X8oSdZ?jRkjDn>4Q~0o7*<<P;%8KY_x2l
zyqM2>V`O>?YZ+Sm^8pp{h}GIUi+D6GsHx$4!9opaH+t|=Pk1rR<f2}488Ow~YbnAm
zV8PDL)L#J)1adylkpN6a$(*iw&53=RF271_^}{|AHt|15@Cq+j;Y#QaLb0}>rNGNG
zy+nUcV$FFK{hI2cA}K#i&A5HO_<qlctE<(1F<<9AL-LdR$<#5A_3y`7;%u*puXlFT
zK;l%0W^R7EHqr0p*2@m^hHGf1aInOiESs?@z%(+b1S}grkx@&C9+ol*(CoVxZL@4{
z-m61#pH7+?9|(?&Fiv04HP#FujEkWN-of5p;x52NedKZto9t-ggL&#LjP&-#RtaAV
z@bU2>#>J4tY|6*Z*~_;oQsOfF9>fCPmXOn!R{hr*7XK6$Bd@h24e8yi_j?@W+(!8O
zz83Vuq-OySwE5%FU^zgQHFF?$bx+UxytPC#d0Op7cZDY(fka;6+FCN>x1_0axwPjP
ze~l==MlUoF!E;GVR;^v6qzayUYJGwuRrToPy~#$G&38b+0sK6!ZJ)l1=9dMJ-Zy()
zLVYXc%_@$)v}+#f_Ot7Rt_9pDcLu8J_5g9Qmx=i0cBMU2XNIZT<bH~~V7g27S|-Og
ze$lFL#z~xGcPu-w>yu${j`u|cZT!IfJ(~y2pMw7Fi?eOr?80Xe$VY+kD(!C6qQqZ}
z21F6RIh?w8uF<}nLr<Q2$rE5xvwm5(C7s``J~KG-PEq0O`Sgz+>qOh}Er9yv+@*Ol
zo2LgVW^2>rb)D8@7gw~dFamCgSL%d;9xIx|*O(DmrN)PniLH$OI}_(<yf$C=I>F*e
zr<%FV{nYdHkC;-$Dy7}u&Z-ITlJqF%G+4;r*>?|z$=M7QJ}w)?$B{ihv&+)Xom|cT
z5p>=Y9=4WZZr3KB-ozq+j3^(sYLJ4RbN_hnT?!Z2^5zY*J=L`;1r_PuMW%=R6+d5Y
zo-eiJ7ktXta5-VmqSL|;e$DP@_{yFJIxhKRD@}XvU$VLR3E%-+UyDrjzPSc}xos7<
zbF|@gU<wH})s1u=2&N<!f_Kam-Q?t=yD0?QL_yKy+tag6zmr}ZzfTebuyOZ%gjCMW
zl~~bcB!+8E>O~=b6tzkF#Tn@0_0kn}nW^K6E#FYH7%fiQ5W+n<kg4x6zx{5NT`ks^
zJp?<b`Az0I=$>*%<dE)qPS%7z#Vc(p>33c2*Nz^m=!1Q(0i-Y)p5qSd@HT$NHACoo
z9t0o@#4GFs;+O-H?!GTZArFprlCyt_xNpfqKDmNeA2Ia9h_-V!=sPR=mToHbpav%c
zmiw~ISIx*}Q47=W)0N5LQE^;`Z%yJRLfuz{qXHTqiP5)+9Y2SM=9qNYWZdonfzSH^
ztPGhg{8L`v^9^XXVus3(X%+s6Hr9q&^Ka_9k4NPU%gs7dSxg&bbDAuo_S|ol6FAe*
z<6<czd&w6bBqsjQHr}-fiab|S{vL!J^6uW1=T8h=V3@e+kgrG0b?{^Ct=!nv5aNw;
zMXjfWW4_?sV{L;Fiu;+nD*Q^%z3BbTsN`f?%bOu(WZ?UNtATs|^5YhvnnM`FtgiB3
z9`N5vl7wcj>yoIk6Ich4%Y8EUj~RTb(HGvPJ)jBvjCGwca?BzgI}_gOPrw6jy6_L*
zY~oGL=qWln+Y`Akc}b7$%saU)v-b4Xf~EZ^KyucZ5k?2AS<etW9;!7@u6OgZG7v^n
zKT}(J`O;Td$92Zu|D4H)qyS97O5R>H!XtILyY-xgN~IGff0w6CPtQckwh&MvvD@02
z;uLzXo7lO{=xUqeZx$V5I%@?OeWhs!k&e-(mraJ^oHe8!I5#MFirSc4%|w;`{c|MZ
zaDGoy5g-B+Vy`vQ21QZh;viGJ)6;kF%F&l7xM2E;@;Z-4LkJL_>}Ir8qO>kr_TEbd
z>J4A3f}+*U-SK$BT`#TiC9BgFZ?hl!Pz2ekwcTDz!%V_|5s`N|yZe2+ta4LTvD9XM
zR^;r#3LQ^{M|@)K{!`)Ut6>SF@S)pXo4vM%{ulk|z^E*bF}um(_eMIF>XPeW#!lBu
zy{&43GB$UV=S0g&zX$aLQOC30c7-2VL}^ilLbdbGqB(~e3Rbb_^p$C8banI?=wbTS
zc2p#pL4(cSM!T#xh20G2&fR^8v1CT^Boc1>FsuwBtQjVY#;oEN>KD_*K(Rwbs9up&
zF&?TSLgci=`0KAvT85hvziQ>u_Zuh?);Jc8$ryN9BoWsAQKDvVLQl=!%@Z{S2N_7D
zXyMnxTwAc}K(s8f#Dtemq)6VxTO7*EHVob=(oK_x;-sfV)Hn;-2+}HLRy>qQC!$w&
zzPvGB&8zZI)Sk=Rdy684MC5?4!<zYS_}&{gi8MShA!ACu{puF!iKKeDZxuv1#aI4-
z4g0sbZ`(S3ooslf^DsCt>t6ga_`_D(i6L8^wTfZ(^^F<FYA)Z_;n0Y+ibvwP`j?>r
zJi=a~HV0qM!^ko&4x*XKBR$oAlhOPpnGA)|+1dy27DarrrPy*TU!nSR=)TStE9VH_
z%HGKOaadf#_!B7;c~svP$7<)kF&^6~h*vOBG*b#HXBMJTG(Z8+3qJBYZ)Ss+sX~5r
z(+4~R!vZotDu0DEWu**dd%I_O_&IQg84JM`wUIDOxL!XTf?#3CRs2yQ`h)1pUtZfa
zr9Ub3l90}%l=ADChV4+L_elmCCxQtw8DqmdHTdUk-s$^>UZ?KxPK!?n({T%t{!ndj
z&au_QY1gIDd`tpHHBJfez?>JX99K;iYYx^dfrug)_`gixVM*_-EdV5@VlkP7P`s;D
zi9)X3<Y0z#gJ*}^q$B`}Nt&A4jQ;~)p1)o&T#P@O#wFOr|MuR`<%+z<ho<k={0-aD
z><<E}q3q`k6IWzb;ks5gL++RSdcqZo_CoswT^5Ip&m_%K@1}-5(#oS$P+aYQYSb%*
zDKwD#>#e%0=1xkLkBekvQ8B))Pt*LLy8xes#6qcnM&7kv2Jwm7Uh0mRI1<E)ucm7S
zc5E2o2Ewh?hv>YFy65?3+-x7ve%A0&A|7l95x%n*rJdtH76HC~eG>wq4PBM)uL%2M
z$hlK1p1En%Y`40Wyi{PNEaUeF#jOU7hmcjdqT|;<0CIyU`6iP%e?uXd(36cOY9qov
z!Xde_{1RX`c%@~dnDT>Z2Oco0@a4R^BFWo*SiGbtp7HC<%hX`U!>|Bb6{MK+-(jLU
z&JF!}x`3g({m%F5mqdcZT)U`wA~h{ThU}U8MN@eV8U|Zz1-~A~9lpAd;GQAV{@tT2
zkX`A>S}J5WFOh{N@|C0DL?XNj8-8>`M{0o^VzQMDKB+-%V8>V);-i!}t{+46DPKwz
z#KRV6)?qyqw961wcN=P5Y225RPOBd*Rxl8LNdV0fCMhKxBq(2AUYrR@iKVRe#XOfP
z5!o4Xd9{Oq#9V_={jPJ9TY=$7Uu3?BV4FLV7~&9wl6L)Fr()`K9oNkAU78pgm})$j
z*xzn7A&{O?y?BRbD$G#+c<)hEy@Vjyy;}j9f3f>HQ~b)WJ5HHt1|jgNL^0q0E*Vv>
zixxLVeF=^x7+U*k$k&+uGnSut4S304v)lZLJAi{8;T|c5&v(?4Tb+)_QJgkE+~Jmg
ztXs7>X|(Y~Z?)`E(v<V`mMI)8yQ8=5;bvU>QI~X`s{EyfF4;us0wkZGt2%P;a2U2g
zRrf0n6BOwCQd8r8motS@Agx@~g>&9?+&BmdaoXAOgPqVsKjFGl!KVw6>fzbThK#Sn
zh%*Vpi#0|P(_euVf#h)n&j%L%6k3|)2D@(XDhLO^*P-Uy27K^dT6a~PCjvG+AK02#
zZBaLHH{<MwDQP;e%dSdqJNQme2r_}~Q|c<gq4$sB;9VYB9!pY8&D{JSB&Xir%b|ts
zTw;6#&`fcHwr162EMV!SSSXkdQ%%gv8*fZ*(q5%dFUmEDS;xG_9#KwsO&@`lkS|Zy
zoW@!!yn~L^w}AgF0u2>sh;wKBJr298z0;yCzhE4uGmKQ~{A>7D&~y30I|W{19JQ|a
zWIhB8zRvv+qoR(;V8^vjirF4sWpBqm{#d8_ctw!7uyawX`H?>{B_Mj05kX5IY**&x
z+pq9wxEWx+{llbdFXDGFQfWOd35z@MCP`~JFH8J&j***-U@24kMck$qt#3290-~wv
zLWg;H`@DwK)JkslR1-X45!Sw-bnVR<QQ@8Fl<uTXQpj!NG>OBA>u}W;42W@|XPXM}
zUXk3m1RFll&8FPSP~XwivDTtoJc4wU9H#`qDw(l0XTir^%5}-&h8jZ4{aAww$-z8{
zX%$Kouv1rk#d)?B4LOU5iu**!LBfFsWZd3Tf2>F~G5CL|d#k88g0@|B1_A^R65JsK
zg1cLA2@;YJf(H+-gAX1ccnAb{2_z8Q-Q67qcNu&J8RksB{r~$v=klz5wJ&O|p6Tk6
zexIs->wTWCHh27{`KLF5&@*D(Bg}WmQeU^hnKKq#H!m8`W8h2iVqVjILF>IWy=J+K
zG)H5_t51>y{W8mTBU&yfJ&ca*KaoVLF0KRZX;OIpY>A9vm^)S@C!Tm~FSKpn^+;6<
z6_nJevB;=Q4C*xPK+!=RC<2C{^a6kpZs+E9cChHS@PUWZc8VGgo*nY_{Fdp+?qQ^O
zlQ8a^n_X~QfJ?4fA0QAYoBlQ|=_zbmC=wT6?$6-Go#&6C!WWpWpSY65GhHO!aw|t<
zT9Sl3r+!7SU0XIYP><y2m@4|5s_7a>v~|jd+Hhrkdjk}oDnW<}pxD!yPuNvjZ#gMO
z-hSS~jn5KTF0`XxL=aC^^T=x$W{nD?h~yh5{|_}4UL%>p^GLF!m1y&OWF*AV?8Z><
zUjG=r!8h{hqEx-`?n)e=>I=xb#)27u61e8p+M1@C*>#(t<T!l$mtmnw%;27DHi<_f
zfSJCs-E_xsMafS*i*279YbMv1sR~gGXB6&ip_KfsrN*2zd|0mZ#!FjeEp1OwzI6(I
z`yKIQ+gA2*kTFMAA|oMT=TC#;Z#RgmIi)0|DOkL$u{=%q7_sLwN&8+mQn5Q;%HPx~
zNUpd)d2c@FI@;~Xv{ns2O>0gc(Oz@jsKTc5yms|Y#$@SFZTb9RrTMK$p6xX%V8Zrk
z+h<qZTCupFdD+4<>_cH^9eI0|fu}Z#EMGQhJ69R(%Oyi8?0&POzi6k5%Orn^G!Sjr
z2Jd>dSCOG2>_vB!f&NbR&$y%_RHBt2841FKlpb5}Ci#<-r>_@oHuX?izs%DVRJo~8
zf{o+2a;f?O5W;0jVX_J7|7H|kSv2>>;F87jr9?(H&T-TOg^Lt4-=X{kRn5!kV{6gb
zjisa|T`L*4WZX!EVS@Pw$_<TTJA`|!R07vxSPC;UsNBV%V%qew9u}E6nELjn*7RuU
ztF~@sr$xmR-Cb$u+qc}m-Vyw$qNQ$cnYKC&8mr^Cf4I=Ra>wV){1(F_I|%o6$krnZ
z9wtMgzx{p;5!wsrXc{jk#}Kzau;=Km^auB+K*zg+PR1n=mv|q(go{p8frg>lCaw5t
zVMpFS?^4H0d4FnTb5r?Cd`Bj%4MvIR6F5$6MeDzoag7}h)lgdH#jtLZ5=2D|DoOT)
zGygVB>${$?2xk8lf+)`0T`$~^U!xd);urI8$ckjsf4rWyyWW>vi|RAq(`mgF{G>V8
zY0A5h=_7NZ_ifU%4!d>q^*e*v#jo^PcOod#Q+aapJYt;W<+lkt4;v0Ah1uBYk_E%4
zXw}=f?-i<n>c~qqKjaZ%&iqqQ%F>wdX0u6aTqJB%Zg=MO!0S+Q3zXn;mqbYPtb)si
zgM5BC>u#UvTNK8r@NF)Jjp$qa(XhmTKbH9LM;V!pZLB?Jhu5dFT~r}|vk=A4)1xEt
z^S}1qde8v?Y;CS+V^H?`1)c;I?Hc%IFwcfd!bGVcO6vD{m4yEDroUT)gk9)9x4*Rq
zE^5L2+ykqJGOk#%rDM}+<(<N3Qf}XiFZPeq<h=V~>@=vy#MueYBO&UZD4kj|Kl|||
zRm^a5E+kn1zhu!U97UmM!%BH?Jof|yzB_S5ee0d-Li2kkd?tdZ&+o6~<(ST+=#4h}
z<(2PlN;cD%CN3#h)pO#XmYfzvi;rI6U~qU?$uKRY%JK5W%Wr5j%~Vt_?=|Z(nR`5i
zBGgGWT`MKCt4C7Ij_tnmIfP*de==B_-}d3xXF6i}S-B2AM-<QJR4D)CD$s$M_TQOo
zEIfh@Kk{S&{}hqa{wdbctpt9GX%O$*S0!YYTCOD?O)<O^Bslg0N*M`#MBc`z3^$S5
zE(#FQCE)$2LVx3NudUarnAB*@irXC>hCDjc3{bnX&`7^$y0Q16!VEb}Eo*HgrJh@f
z{R#KO8_o#dU$74i@0Tw-4O2rcbz@PQA92SFF#y0NvX>j75t3lwhyU;C@($VFDnMAB
zUvh`EzDd>KPd&aLOAdYVH1sdYBDtKWwl*1toT8$l-}OtLp|Z`pyof4nw6^0spyIPd
z80~A7kHo|(uWtsk23b-Y+hy8}4%+;i@44Mx3VavK-fJ9ZS$)4cyZXLZGgI8-Oa5p1
zKl-<fac}M=0hX3OZ28cXj^VaNeuu^S6^mtSqIdWiJypFG#k4%^T-GBC(@`INx)+2s
zC@WtIklo%5>Q-l)uLNc;RVrkDCol(;l<IN@rh@&wk18oa?F0MruPXs+rfW`gZ!U|h
z$l5lsL=7J1`Z)uR%+-d~52SNm{*d~j;$WL=i%=5gG->wuo9X85GsAm*LE^os468P4
zWYVm&x7}z3w{-d<y+RJNR!dIbt9yH3q|Z56tZvTM*bko2T{GWTLFeN(!`2?{%2K-T
z3d_8AOR-A!Kd3q&#fOH5_3Pa|3R1e@x<$N9pUZkaPycZuylLIG$-2D_F)-Sg=d@Wr
zABN^PS&R7KonpNB>v;Z(irUX)dGc#)acQ|hu?Y^Z4J_e`;@$X?;(<U=2y2YJ$8p%9
zac#7OE&n)jmoaTl@S<xLxjB18pTBn|o%BArI$$wPWjwI*<#F#{|7s2<)HN2_PBgv4
z^U_VTZn>3aQcf!ur2mpotKF~iio)Mj8KXz(3k^kl=IL_g_gi*b{jTE~gp0=~IA>!+
zKP36VKxKUDv}8x<Bcg<hXRWF2p|DWhyE!)qyVcj)uv$oiRx-i_3yt{E<5aS(`Ch??
z)a(x;33%Yb^LTsi7tpXrC)NwJ(JX`?t+;nDOQZAGQ*mH^zrW6JDG22<j_*<4<;iim
zFc!l=H*B}WB^)=27s@o-R(s<Bj+NXApiB28v-@x-U{^+MRo%om%|K_d30bq)Oj5sS
z+gm5f{ydx<({jC8p<4LqqaaeBY!oak>~E`&fko?PG!}%}A1x8%xQcZ#!c1O_A#B+E
z#j!6r_(WCFlIxz{MMw*Il!w=?=61=NmX7$zx^by`EV^+?i5Zy7Oju|D+vGXokFMM8
zn7ltLCP(~a2DRPjjb&bll@2>7XZY<uQwPv&X|8ZMSh*plX8qs`(b4WZv(ITBx=DU|
z?LJa215gMu8}0hR35Jn;7%?7cQY>S_LayH3<kT?fcb3vG#xa9ESP`Jn456h4AM~<a
zF7w;w?7voW@?#<3{()cSVsNaN+Oq;u6r;QN=^urh#5k;Y#wZ?AP-dRT`1<#Lu@M8G
z6SMnfH37ZN&3;J}KWEQG*p6}7id%#FfiP7vZIGO{ZggnAD5)b>*}5-fAy<X(rIP;_
z8j|r9u-*F3XiWOYM+j4Li<FGpnF-pKCL~>T@6G7#T|Ob@_=aAl+_+h45QK_)uKJ?8
z@ISp6Hz5*(^KkLx*O}0LONb#Dk6-$vi95<|g1Cu}{+YQtG<@5o*_O+W@vy!#Z}VkL
zYs}KTUb;1PWt_gGV!0(18E}0aO4C?vz1DX87K%k@Z}Ua%@{7u5`Jx-#Ii`J98(R7*
zmVi<<O0hldi}dp|pO4Mn0`of`$BwMVJ{wUVFPOSJeDTHG_&JU23>`EXXMbu04QO_S
ztAfY{;UJBletcN;Zc?*ClR>Jq{&!m2`_pt50|O6e0)$in&-$~kMYmuNIM07H^6VWz
z-2U?ei`L)B7{-y*$z0@mY>n(4YtG!lIJWcGo*|N;Q@4D7R}hAQ6cFdoRXQDn2em10
zPI(O9p6D(Y`8#Tn_M+z$={YQU+B{#ysqT7recadZo%M2K>rpuHGAkg3Pg&#XN!%-u
zV{Gf=;aKI9zTdVLRqJ7kzx98%1k^a%IANYh2j}W~nszvL3zSnT)=RI7Jy;iC4%)eS
zgO=<#{jKGeKAqL@|M)TGl+uYOV`_~up5dGwA;eBFyKzH(qy=fYD<#G;XW3S2EfRiG
zjZQMQAY%7ST3O#iaY^LYv2lZ?Jsc=8ZM`Sg;(a7A0^SH2*n<i+$w<&v-_JR{pUoFP
zd9>7z=ISk~1JmvZwYii`0KDXH=(>+YWNNRGLaoiky_hy!sA5wdx59ZZAN4+7^|k!r
zzK=~zB)*HG?{c)Jl|>QEgtB+XqVeVxQeWe;{o@u1wX7GLvwP-D0*97fVQNtH<*4RU
zxO9v;w2kyE+=R9QtjZ00yD!Nt@SMl#n*~5)S=B;`kLesAoF@gwFP9OpLGSRk7e6*P
zZgKwspt!%G)`Z_hZ_MvF@{dx)y>!NKhog{T({fM7yEVcO6=o_9_0cwWr<84o;P&nj
zApxr@gKP*5zi2>er`>Rh+s=_w5v_!8G3_Npj)A_d;ZoCf_;~<wOoJ5$?FXW7F_XyD
z+7N-gUW&*EP4bDte;(Olk8IwQ(7&HK()#&uT_d!n3cRk;G1eJ&y!T6Y`Oa-I`C$FA
zYTbLT!azZH3ukE9uH<wsC94%=F%TiYKkLNVOHo2V?ZzUnMAy|7mt{KHKmONjl_^bF
zSo{5IdXsTJh43BQ9lqLHIWK*w-QC}Q6j)rKPJi7e%Q*GnOh+HU8q<A0?3Ws%hDya>
zl^*U-x;>HdJ&{Fr`cAj*o&BCaS#?6|&p35@^Ktc$NAu~`zF6WQ79!$b8cm;@o@oev
zlRhVF$}u~1co)i1Q2onxbS@JBXqv|#l~Bnyb0<|}+ep{t*$!^zX56tQsBdw9=`rhJ
z*nkvE+GeAl6Z*54CGt3y)eW+)@7!9h8lX+gqX66>b|-rq@Bk#z%_hc2v1LcimHmrY
z|4C-O;vc{@8AU=d_Dd5Awzlj)R?GJ1Dq@>*TYvrL@_Q!fHLimPaU&f~ulu_h(ra(n
zm=$A3#m>c5m}l@}6>E0d?PGRN?V`>*_cDw6Y68=LX*3vfE}$wgrc7j_sxkEtvij>}
zImFofZqMTPQ-0@7XKA;sTkjp!ygC!wd+^@EpX!+yj=4!x)->tbD~gr$CdSsOsW=%A
zoGq=GIGU9?n(OrAW$c}<u9WGJZ^zC(Pt=B@jzk4aH=QvxXvX^9Q-2h5(qC#m5h?|b
zDP@bQsi{%8taC?;I+Le~IOLj*5et_u$xa_Cz2)Lcnt%6pwVK*P-dAV2!kX_&G#_1{
zpe|WgIc_s{@sYT+tayCA#7ur#+JEivO8~edAOq2(E9e`w2PWg*jsQP?`_>n;(?HaH
z@SNy<yNkMjzz5+o=q>JTfB&U^Lx9v?T#QMTdq)S*&wGX2P~>v;Pk(@nIV%s3QQr#^
zPs^de$E2^@Yj<1*UWeZmS6~~GbjWQIW62G;3VH{7zVdlTOPtrxGQw0{9oNL?P`^z)
zfOGGpMfcO~yaS|*w%Ypg=)h^3;%uMFz+_yn-&$n9E*ybLuwJ0U+z39E1PIsHI77Z`
zUH*wAfp=+26i6+js%khv5W+{VDD53>%}nd5$ebbwZ0y`Q5ASPErdpTi<V#NY3QFdG
zm;APb|IDY5-Yv;97Kxpz!U>O&4mQh=v#It?`k^OavjFt&e-)9RSCtGwEVHt?DOx%h
z)8Xojq<Rx_b*_WA#s)b4;Zu-+rj>9H3d3;pdYnV`{(k0KQfkkedjV#DLtQKKekawy
zvSQ_L)I7Py-WpW8bBkWGd#T975PauUXE`Z>N6U&S%eOyQEU|j$KA!dWIm$I67bHo?
zMOjQ&q^7~n{@WYHH<oh_M|I?Hf05ElKFrM_Q<9Q-S*`9{KWiJU{TW?z(6<yr^pWYw
z35wI3EPK$v{6tf@vdBArzb}K&_g{*!lCnT^<j`+>rF}13Q;Zi6`Tja1Fdx@AD$cw0
zjLqGRXc2a$zt}mfPj*KI1%>#WPL}>)h8W(So;Fw7$TLsx`qx}946CP{FZO5UC@W$}
z-2BdOtBQ&lHTbx)FwjzaWHY!y_oBn;X7%edy>G^1+4BhxltJ75?`g~Zt;x)fjt+E<
zdJo^E|EzU=zf=bXpnv(&a1)3q;jEhEiQ>3P>lyh`R(C4>x3V!cyX~A+uU#qx<+DxJ
zH>K@Ri}1JRnw16RHT{l8u7c>L?-xiMjHSDI#p$_Fs6w7B*FCoX{+-CTHEz>SOsV7o
z-|aN9+6n)$a=(ji5Z79{?!esylX#c>p0^0f<^wuXv{l8nOPi~7KjA0)qo3&9Ti)ww
z3E++XT(w>(_8VcbGlwKxc6#~c-co5?BzmlG;-BB(3v59Upu9^pTbnw>%w#@=(R_%L
zB#eo^!l3@z3+E?le>=Ci-;9yOIa=>8-X>lo5(m^H+oH>lI-%AhD_`sZe<D#H|HiWE
zb=j}oim&uTDcJ$B<SBOvi29nEGtaKNkmi|rx62vyW&8Vf-s>MfR$TVqNh9I9E!9&g
z64Z6}8-)=n$oH0(hSkWn<0%f1o@qC46WJvsyUs%yD^RC7L*orc3LAxza!yS_5=Y#v
z^cL1>S4CDsvd5c8{**VP>8Z8bh~M)ioMk!6@0T@cK<`EXrW8a4pWcqNKnrWkw=~mM
zGz<CgbaXzw9#>oY^QZjz<VAbkktkhOyXlcVA`hS1>*Bj24RIy@T9*I)#rApsMSbIC
z0|K$wvN{njI&5P6Y3S77$L%afE`#^W6XqsssHu9OI_vQed%n_nGbQwF-~q#6i%>yF
zPk*p81k?5I=j2s|sxa?WY3b%^H{nKZ+}>q>YPFZIqP)_&e1ELe5qy(d!fom2B&9mx
z=Dv<j<#qFn5~t$8kG9!aNw1j=LzyEZ#{j5*vXJA5imv{rAv5`}XD5*)3zgQi_;23W
zdN6%q4>hAOii?Ti@Y-t3c0hntRVlY#`Zv<5Te!db@~ZS#*-c8iQsej@cr>lXj+IM-
zJ(q>cp?>JNQ<>IULp(CSpRUiLVr4W0D%sV~@g3B6VEle~d&8I4<10eU=h(~^cB1yP
z$drQd?I>4^%aH&l*lBXk934chnN903Oq1`Qx>7;!l<o6Yr(CF}E?GoNjBoF1=f#T*
zaUas+Si0V&(R6Q*MORb@3UYr%j&gCiSFja>-aj`#JfzUoOPLn-)WJJ49_E29rk53I
z?EZO<KVs0F9A3mqRWGP(^r0`%Q7HP?QRmq8wHV=q9A>!rSHi7@jqZ<aF3c6&24jhR
zN^_1&8V-tLh|;pfR;TP>s|RGj_J;RfWPVFcQbjC%f7n*v#ZZ;yh*5R&bL#Yxvfrl8
z4k9;)^Ko|_f$gC8?<WsYcQEq@DZYBG-3Q(2FCQwr;`E&$3R{?KzBX_IWpb&rf=Ykq
z+k_NXR3f`h)1!rTXH0vR{odGdlKOPk>N7XvaxS;$hDy~oqr_I6X^P$9KYp+LO{<#X
zZ_=Bcs_>=nyP_OCGnQxPSgi{hlwh&~@HR=>kqPr2K`YRf!d-f?mZYb2-oEYX89!Mw
z?iGk8P>zejkrwjOPKV_GE(lfizvunsbWvv-Hi4Qj@|SE3+CS@jc-tk7xUbeiKAsqn
zq9zMb)F!2p?yzF>alH?-m3zQO!U4SeYW@;OK*-@HXo4@45)jR;wH4(t65!=?d|UbQ
zRI%NKOmv(VubVe|OwsbaRuP>q^J-H%dA=D%7aky-NZ!_)5;bZ@daCVj*8XLSlGFFb
z|M6a`{;|DarmlbkvlH~mcrs?`G=xI*7~q)($H0BCrck2#PydAco2t8YNPz52?^nwX
z_!`JVU^I#z{`GmQ)*~AvHs^JeM{~t?n6!MTf}4bWwOSKfi;Wi{y$j`RTwHrKxSLXx
z_}#q0KY<<l7c=+=qe&HXle@4~zl~gn0K)En&H2}G(Glp-e;xlT2Y{;jf1UYvk~@$R
z@V|fI<>Q)S0{;6#yzYH8RMG#F`TyUgNy@bL_8+ynk6$b|afX}OW7XI@IzpN3b*=sw
zD*C^-^d;}+T?(5`7p?^n)v?>@jpmyjET0&mYMm%}Yot#2vk@*eG|cq%UHIfKr%|&c
zR5GE~V+?G?yC);?$%p~f_LEEjdT>?iH&co};muj=fE9=$FJ69#%iSN7FHj~5CF2F+
z|4(O<(2Rz)`gx;oOnu`8mb(Qg`sz%5Z8-iNDJg&UwbA`|Wb}36?h}s2S~vzDUcOzG
z6la={zAZ&#rBn?J78G-0^t5{+c7bj?_yDM6y@8&?cWOcTCH^H)Xt`7&+{~Rl3yT|5
zxE>_;X;8UC*0kb=JHpJ}R2oy7@V7lQxF#{CgMXdEzOlfpCK-&LGI?t~Ap`Kl^mKp*
zQz)U?1yu(&x?rodw6_ML2bDT#v!TpIpdMr$n0&*nLbQm#@T(QqjDj})x`TveMBM$g
z6598P&`2|i+e_@Urz*7|xu^l-j*=VhP&0+U*j@w!V7vcU|NqC1|6}j}G4=mtXVIcD
zjIRScFt+KR53E&0>?~!8qPJ!@FEulSn^~M0%}9gwWg+xl-r!F&#FXKa?{B3O*=6id
zcNt|PLAB*(0Bwdu5b2o*6uARI>dHd3mp++lLG?a#w3edZa^SGrlbZs3WVV*pmq>zi
zgF>nbn#uf;9BBO?eEU7^LtH5_J0?p4Vr`+pEWCKN<C7TMw5L0??`Mdgk7e!qLzf{K
zd`+Bs>qpcZYijHI>&vqBp07-l`v;R=Zzq^h^m)dh2AzBc_6qt#`#*#zIOCUQe?_6D
z>FHiR3~}<G|Fj8@2_JC0NGPV-djCxTRnEfBKw68uZajdJ^``i?w~MSVc@J-No-6j3
zWfb612*NTa(I$qY<f4K1t(OvLB6V7m|He4Yt;xF2cIwROzllOaka50W=)~w5YOWf>
zoT-~fRf`%l)l^=TqLf|(5}u^IC97%{6ycNS6hJ|*_BunHt2|H~PyL2el%}^Yxv4}E
zmMcv3$*4USCY>zs_|rwp9Lx4yGg<>X>l>5xZ;*DdRtr<B08UZ;%Lx*85*{EJlWbR?
zyFVomwFhb7d?0g+Z}jUZ#J3Loj>Ml2<hdP@NVFn!-PVWvgoH!;3VUDRSG3{4boqHW
z>0c3E^2SpFMaP!!6ZJoFA27T)lbmuu2zCfk87(DjssUvP6-PP%P59w3??VhR?tg0m
zEHctUNH4&NtuZOU{`@+AoL)dGVaqqG8!PVvg4ahAN3BTupe2X+vetV-z}R^#f^31p
z4eI0tyO%gK-Zy0bqO6>IBZ6mxxeG+z4As3Du72L7)8V+^NdGibVwPi=qhqVXi^Z)k
z*Na_X5^vuCdmiNKgmtA6)8Wbk&F?tcPshiS#yzGRAWz2HfC=M>lJyc%MsJVuuZyjF
zLZx-0(PQQLFQ{11#}%u7(|tT#<w%h>M{~yci&aX`kuc&*(ONyqcT0e&`NZ?Ji#-{-
z7NFjHCu+;)9l3JOqeHD8gj`1|HM_7y$;IoLD5f{&F%D;xstDOESWo6du9FAHnQF4{
zJ4W;F+>(<dbX;xUdyYhWooFoSuS*_;1????haWPyooT+1J2C4w;eH|6(!OsXKA?=v
z)RB=P>Q(ZhZ@{SCvp)`o3{pTFg}p2@A`j1wAVQagPikY#6Iy;LLgDB$S@}c4ed;nm
zuD$*6rRi!FC)<d|d4(CWc>q|!b<40o{#xPWHeelsmfg!ME>I}T16>R2u^Rp%4watO
zpF#|%UwTp}_p%Y+J^`+9I6G?15Gi6ny`%Px(E2c^@CY*ROF@2Cul4&eE(oJVO~U7J
z9V6N2ebz6r=e0f;fnuC;g1l$0^`6n2LYa9+Z&eZq_dMi~Z5s%gFT9WH(3Nf*-pW@+
zG#hMNzI_F_k7Kw6^$dZ1eu+oJ0s{=>{pD~6)>Dy1^?MopslqdSG~Xw&jhZ}Bm^`C{
zM0>`At`+qY3}R7sErQ@T4Ir9%UvFr%C@dayIzRBSfj!UAAdsiW@P6~BWM}sG)a;=|
z?l8=ySb8hfW=y!dM&sDk6sOz;SaU>(js^13B*wx~{WWC(c|rv_zkT0MYFu=&*_W0J
z7OBf>K1-pCEu1UqbmFOuC?q5<2Gvu%P#46bxZu;+Ex^O0*eQ9ejCL>+w13s@O_vmM
zT-{9|?TsDIj+9LNjiJRho=H1p11T4!1`wpYvPWz|s_s+HLP^*E)Z(LR(<yeYq|9Jq
zzzcphh4U9Yqsjvm&tQK}yCnl+%KO<KgeQ{kyq)o8Y<UR-Eq3!LPYO|UAq2_jO?Hfo
z559gbnEn<!<B1<3elV25nBAV^F)&!mUJhp?UuA<PT6{@2fxLs*0>K^nZ9-$}x&+-M
zGHHNAXUq4QeuGTxAefJeW;Ig$ckMt|yLcRbwA|dO$fT)1L0Vz!Q+C*zyi#y+>lHm(
zG0-}fa`C`s;`#P$NBdsB__GXKZxa36Ei1#AlW(5{)ur%91GwZ)>y;VISAiv5inZso
z2|+n@qj*TF!3ZInWM8L(1#!D;Bby0-{IrdBqS{pkRe{>uDfH35t6!J;UfLK;g(OT#
z65*c}$G5-KwG$(Sv!01O=qrfG%Mh?XXvIt4w@_07elRsU=Y!g4*pGa_JHq|2219V;
zzxJ!|Q)77Zok8ga7JR9z4#A<AJ6l1}oFK&Nfaqnwh}(PS#f4~#bA$cN?5Jp}Y$bnH
zF9wq+D_E?O|FlDi(=Ek5v^9M^@fTb#-$@dCwsVak<wC3FB7mM!2^j-1nGiVUuaKlp
z;Jen@KAFIx43~aW16;D9W_|J~C9?VOW`M&+pj0L<*Hh}rb>vG%e@pfYQfz*V+3&Ar
ztOCMXKBZ~PG|OCM;m%hK>&W1iW`kut?8r$iK#8F7_a!{BpK(g>$9&I7-c{^+@5$^)
z8L%f7%g7sxG3%_4W#?1E*lw<}3Q226WfHhainJFjRKOMwR8j6JYd+)i>qa2Zlx1^1
z)`eda?av?!6_Em5qbT>%`}pHbayRIyO89SOr69_Zc2V@f!0)YFBBW=AO04fo=m-@&
zE(;?B(RF0B<1Dtzw&(Ryd|(t&?(2H-o!okA@qQFRcgbG|kE@$~Vf)_>j}72knJkA1
zZTzH^^C|f^$=}MQsb&wpZ0BCQy7hjZoGUE(WH8=uO<fq1S&SdxUjd770y*@`&O9Dz
zuX@KkT({&xgkHs;65ZSgMyX7o=MZ5Z@fKrE(U6GGC({9xHw^mnt*~WJ&Dm#&cI?;*
z#;lAfUD{+^DK!`|gfu3;_^WpLyPgA7a)D|M-~TAYEU*um1)OGb%)rguX)#$cmZ`y3
zwy=mxE#Ez|98K0Je!*!fi@FqOS18JVMQ1oz^n6Y0fHRoH>u>^$XPOSdV&S1~y<Ef1
zY+jLgWO^Hs$Hu6;+ql?$UzOAh?(*Q63}gt~wxiesu3LQavc<9yQ;o7o>AXb09e=}S
z?y!#>E3?3!JYuptlalLFA1m_hZ%=n_uXC?GRx^~V!s_rUpeYIz8TkFR-+Qm_nM{Zu
zNdN+8m!}){+3zcS@$A)9Jr`XV4>Avp#8ZCA9*2^%%cIvDP%!bfP1I=H!O!XY&_v_g
z?Jv-Bk{bZL67(RJX!&}jQ8c4}|5e_#3~2SNE=Co_cv0@XWefcHua&IDP09t{BN9lp
zF8^q+qRsX#wRMAm{8?IGv7`X{?E~tYp)U$+ypGFb*TzlbIp>`%+K<;NtO|qkiLy=I
zI=)DTB$)+5JVngnzhB=7q^(d;>h{SE#MAApR%3Y4T}SF<MBwRe_;JMNa+J2lU>8t_
z;3eY@`0=bo4y2Egyj-9wO~^&I{;Y9g$T$Cq9CM9(x9=~ydPJJH_?&V!|8T5U;pi!Y
zRPO;LB7UP*%sr-f5+t$|m;+pgVIO3?rudM!JOwy=I!S954}sIdAlL_a&X|EOR2U;R
znfxq^q}|6T0ao!V2fLpEHmm{aEb|}NVnnSm0r?*#Lk_13bGN>qE${#GHg+?h1XOLz
zC5Bt~=APgKzNygLKWXe&cLVRk-}CiXCzJshsIy_^0uq~s698v-jmNF?olhSdK|?b&
zl0&+YNJM*b{3!*`sQA=cqwcHmp{*<>GsB>Yk0xYrqp%iJL-1<gRUB`e?;bMIIW7Pm
zwMiGWHRctMcEgb~Vi#$A`1B&!eV%}tI1^|}a*n>$ihc`=R23jbHg@@pSF~)w`nI`3
zJK-UDpPPXa@@vr%ZgS|dGXRY3$)wlUFYGz_ssx@RX^|uM%@mZ@$Tv-UBew96!$O-m
z1SYhijDGytpO+Ho9YQ6i+;V*40dY=VZ-`EMi39-;E5q#&j^z-WiQ~Jt^8vd~e9mkI
zx@Ooqk2NAxW6N16jluool1Om9Wzx6p1swgFckEgA>$}G_oouAvIy{@{0s|j#N|nt(
zyVcntr8{89Gav-t`a{YOm!g6jQL8M!JTt6d_TONIHm(%(TdfaFNJ&GDh6}w#+~bs0
z>7gu?fTHzwq!N^NbzLe%;AxBME*#qry@S?9vX0VQ9ukHZ!i~h+?6*<kc#3-QwEAAI
zEsjSvxaJ2i2M6rQxlCqI?(&j7Tt^gLHtFJ&f{x9^OSp>?kcjs(J{@T4`1-N>?0FF{
zYC(KaNdC4-Q&DXR0|FI$mr_nx*ghlC7XFZ8;$Vj^OSmq3WpC007Or=c{4%jPhZzWF
z*+%|KVQqO_!LO>%fzi);D<xC_b7&fevqKG2R_|RgBdqwX1wt?b8(d=u3n(c?rP-V%
z>E*`)g8U?2795eQ)ElhB*Uom1D;M~?>b7wnoSwnbmE1LAsUCt<4DIp0e&>?Ixcjn+
zucz9uxQj(Hm9##d^T_fKuMm|1Bp1(U6sM&NX4PNdy1if6qe0Jj=}z}vi(Oq#rvhUV
zGi3n(W55PEgLxS>X{ZZkAlasMa)?W;y|?D0MlTpV$`)@h!FFi1-Ons?LV76E1>Csl
zfh|N{Bzd6n3OeIaO{l44J4kaUiP!*~tKprZmW9S?RDvoV=$mIB^JPAb#dn#o9yxpX
zz4$anQbfZA#O+tUkA`V*m9&Q4caof$UuDpVlM4a_^B)D_r_GG$N;q6w*uKi!ROmTa
zR3-}7-RSWdZ*q5Zb?7J>`v4IFfEllOPks@5KQTHP$Y3^e`4JvqbU=mvQM!1&{p+9M
z^xv0`)SGh+A(+iMYVYN1w0T(N&oL$oSqK?cM!Yj{wS*J1d>P+%4M&1_?$~y{q*2iM
z-~+B!JQR#(@qAsa(jR|(N|Ob2d+kr=K%&}Cfv4D4L!w$o3R@8FRb~F=P;v1XzI-Fa
z=GbA}!4sdmZn>RzOIUC$Sf8iyyaUXbZ`&T~UTA~K`UQ9T2Ye?^eDA6Ba!E(~Wh5KT
zyWmq<961{H0zu6C5Tp|3O2R(kj}r94rNEulpE;j5EujT?ogFf9`Wii9Z{Qt&N^ML>
z_6b5dfMJVmMZ@<@LPGxs^i-s~rTvn4N)-LA(<XWp>j4^bOS|e_I7c@;VhhBi=uarv
z@F<puE|(hb<VON)BTHQ6B`U&!1EVezEF?>m*4%Y_8hd*xh+@ApDm`k*^Yca=$vjdY
zTxo6iwqSbW*LF*2gU@9Yc%b^<Fqb>qn8NS~vGP8OuDyT^)IIC<e|q|4_wcfD;A}Y%
z^T$S06R9^}3v|`a>EQ*znCSz}q;ZYGfZ$XL1G5Qs6vjn*gdbR0ydS3X5G$&+1ODFF
z<Ai<)&h9t4%&MW*rs1|yCRLxv@#Z@O!3yC)j#~X9A2NcXfpT=R*E?#03EpCp7Zp$N
zZ@Sm^q~GnL$CG!Tm|_OjF*z>3jK`Rm%&ZduJi%g=*!fwkEmB#q=cq)hBf~#mApW6`
zX8dc(*d%XMFU8E_m0V_@yv^!@njgk7=ZtrFO0_6?%V*5r?5v21>PCl)qTEhP^frDM
znyQO>Wrc&+OE*^Au6~qh*tB6*oiO>RZo`6TDN;}n=SnR7@{XmTT@{T<GQRSVR8M<#
z1J_;RQ*Nw*Vrh)~kP<ee&J%pO>B+lYjsz@OtpXLgII9?xSaPpLa>#;ZTBB&wAPf^x
z%&0dDQz29!dl*yAqLT|o1mso?U7rjS>)!6=&;6Evr~`HSvK&yW?uq0A!jWO5_X!Xr
zOgSW8tc0K+gDpBws0!iupg%<(pVvmS#wLm>v#Z2s8Id5P<H98y{$r~Zj7;_FJ`}vl
zJW5dRxFoWDRPwuTq@x7fC>saph+k%+j1Z6pg8?`3-_tV^X0StAGk_i5T+pECI5VDI
zHqTy>uGPf&Qzv+*^--j7#2VdqnB~J@FCVEDV4#m`TSt&m3S5Z~;1*t1FTkQDyik6i
zc&1F$O1jOpnT-^)04#LU@}kQw^9I8Eh}=7)((u)oZ2kQ*EI|(IYxmD+|I~bB!KnV#
z0mA>39zVt_&M%`70wyPAeRb%t;+az3O5VLANUhrWXVdDYJq8o$HVF_@3qR?pTk9;S
z70iph#Hm5W<D<^Nc>GTvy6-{KI5PXRnX#lz<`ZcHyjYvmfGE|!(2|$;#-|&8ZwCCU
z;xlP>b0|w+%@q6LNFgl>299GPZf%J41c^5TIki|9hYbYm<EOru_Y0~l%`?h6CBI$K
z*X_%9Lt5Iy_R+Yt>QKgDj<F#-aTSzJjS4QNjlm>BDhOC22P-vB{dbyr23(#}Jvg18
zA}tisx>X69Z0#jBJ(GV%tX15+5bGO%Re&4Ex&(-?nVHYzkPA7ozF=d9FXPr*u;&Y~
zVHiy!BbQ*NP&!zi{%vt26ug2+OUR&l{(X${S}ozLRuYiGk(`#C$L#5!OASuBVIobr
zwQ8P&rbK~@=T%ZR!iEzQEKY6D2b#@A4~8#-ds>;#+9&5g7N~Jz#&Z6FVji&jy`|mh
z+1`uzZMr)7k@H*QN2-FSHHAP^i>}5E`03PbImb%!HudfN{wIy=M`QJeWD%XCtq#yI
z)mJ>vTYKu%?b4H{J|x$SK4cEO=XQ$4K42$SNFXK5J~J#80wq*ol?vOQ6H}lDByM+h
zLe}OZ=^o^lTPt7*#ClPfL8@xz&x&b2<OXR;4`X!+=E7j4{N)*;hWKA|EYbep=h(1J
zhemr6GUN|iPg40za2k``jrk_F1J{iNc{4-X+eFEC8JNvxPKjgR`WfXuGct{Zff_)6
zM43OVm@<z@K%k!l;a*G4H)7k40Ou-yhQ!K7s_hIs@1Xro8TWwHW~oZvT`%X`c^<cx
z4~Fq07}(yyj%zMkK@I$Kn=r(lcf0))tQq=zI4St`>CK*x40-jIW6i9Mc7+SHFnXW1
zBQL_2N0qM2QPnaxD{?h~yvr>2zL9<)P)Bb0$&@=^`tHl3DG>@ys|*a~#Jwbg(yI5x
zd?@rgGfm1>skOK<6te3XT2GM+-LcJQHaz|NhK+Z;Sf>Le#%M+~6Uw7850!!wVIV15
zHwmgeZi<(Fc<2uVd}BMVH0R~Bjv}#CH5v>py`PAO6B2lS1#tJ7)VB&u3IM;dY>(gA
zqpLz0BqZqb<qkmu(S{k{B%SvXlUZxt*F0cu-!%{>9wAdQ{5UFdtdG8->9PL7A5XcT
z>~Le5Ovs7ZykscF@@0k=G{@)F0}m*abD$3|UFmy5g8hxdNfG%i$i1%bHe?9Xf(PYB
ze)=$|{+R`xB@P6A=8-@VINf!ucB)Pv>=$}?E;3j_AQOoxJzFC6DBAC*8QwFvLTuk3
z6RTi&oMpP)6uNR_59Z$WngR%jGSliM8xFyhNp+;DH){8hO6VK%lRrPd;@5t25wOQd
z+a067BBjUZorrtFC+GEI%7H4respbsMngua>T!l@MP%5@(0Nbd3*Ikob!YNGE_m`P
zg9&bd7=t^vEqS0cT!%kjJh}U<{z+8SRg=tPvZx-3(+dtc?u^^9;O3`4x$kU$^1*e$
z`8VC3%>aw#LWUG0K;nv5-1U?K_MSkCTbXS(z*=dq<HQUh+tWx_0G0C9Q%Ji%2jwkD
z?b3Nz5J;}x_%7C!yWX42s98zSMOtBP=JhvA?U^tLG?+aP5PT$^jPf;rqCKm<&e>`<
zPCL76?2aHD(~GJbQcY-lv!2qrr5<5o>;Y_(jHKf9%e;y>F@u@b<D!C`M<I7;DKe5I
zUZ2+uSNKDS`Rf%upkHtkeO=x$!?xCIHCY2V`WWE}don4`M$97RvQYl?;+*9wKE*pz
zmsgKBTJ0>p?eu+$=*S58;#FHgeH;)zIRcGou%>@#ty^Q#RcbT>IL0<+cc0YoXO28J
z;mGiN&2R(0l0f?mq9g&RwVaK#=<U49L#W1^eTb&g?-$|>o0bK`@qam8n*l5sZ)j)-
zWcUw&(JH6~Uc2Zb`O2n9xyg9AorsKv3Q5cOcE|ZTsyO9sw+4sZsK)m@+N3!XF>;U3
zL}3`v1y&qfS;`d*hCv1qRCLO5->bYC!1?l?q9?{JAlbQm!UzCilI{XO6B#6#3tQm^
z=xlK)_c^-m0w;u9!Z~;K^7jX3Z7?5bpby!DJP|!O1r%T)yHCjEQnr;vf;g`JJz>ls
zlIGLVjZ8_frXnyDa$U~%tTBNuj!GlfQILnZ*P8+dUWrDj)b`Er16cy+%F_4Z_`LUD
zF?F=In%}J{wbah-e_DwW-`I*LS{Hsd4pMZmd-@n{NJ^e7%!h|xgN(N55ibCoMjCn(
zD)&9<XD*o*#Tbl*o&D)p>!~PfS5|81j^`WEuY$=sT%s57DpNK-Mq`rPGuXkdOS%_{
zJm{M9JpY1Mh7SS_Bid#KuQceH6fK|N0EC}=L~U@X(91*XWfHN*x0;2G<J$GkcoIgu
zh)?)=Ng6LR!`o&B*a&0|&O`*O?-f~=3FQ$zl7a&Z*t3Pos%uNv^8>Q}c&@{exUJc7
z@xc;!isFxgOO;Hb-9GfCB%s{8MvBJdSPX6@0aAJ*2L^$q@UJQ`v<8yvBdxsDKf?(r
z!?|qnbH0#UIXL1`n;%OgTY1e(^sTm&>`6N|J_}6oC<4?2GBOHIe(^wL@?kZ?>Pdgz
z;^YQIXyx%H>`Z8e^(8|^vPphw_lAwO6tH%Z&FOaq6VH>EB)d$hyu=3|v6#9CYl*zS
z!+B=PS#wgSB;r?$gCJ0anK|wbkwnNhOw!eav2*pA-8%;6C2YufLj%83zo~c>y3W_T
zbVIB8t)CgrV+YUE+3auUE=x}7mHlS!{qzGpWhnyPqfKu!A%;PcA&(yle0SBH^(|J8
zeP|zDqZ*8~!V`~mwoi5UF9P)v{1#p^j#4~ieiF|k_ef#g2mTd!d#X#+-u}!;HBk~E
zt7hr!$p^m|z`-Fx1vEslJSKGJRTvA`#c*H%xcG&(b2UNdntfjVc2MjF5b)M252D3w
zR~TI`$Ig$YP@DZjCDqe+K-n7*82u!!*N{03GmS*vTP@-B5@|x4HQVYa-@HF?5Ysv=
zc1h+jh0j}r;noEsa~ORcb91fw-pYl$Zg1U}8v`tNgqT!0|Mq=Y7Y)f%hXvU8MLuO`
za2cnl-E+s_|H!gqr=Vo7?2No=STi8q^>MIp#qcR^?7_kD0s2Y1pQ^*}<NB}fUDSy|
zN<&tL5Dx{c<>sfOUzB%H8|^_<ei}*vWF2@)r5$A*mIgQeV##Lsxwm6lh;oD)!>e6%
z+D9$MCb9w{=I`!~66CrNYm$IEDc$omlMF0?4Z;^^b}&J|oKk3T7bT}+W`6tgm7r}3
z)3n43J;K26=m)V{D&+6S>`6k}&&sJ|MJ^gZ544*gL`1W)ofJUr+@py3^Th`yb1)7i
zAisfKJC=<w&=%5I#yo}*c?l3@az>nq^>aaPXDxgp$hLu|!0{+$o`>toa(<d`hMji|
zxN!8I@rU``lIon28J%VHWJayvkk)&yv(sxoHe^T-7Dd_h)X6vT(>D;0T_!sZZUf)Y
z)JQyvHQCqBXr(>*@!Gyb`b}Gykp8@NmWsrdxU1NK)-OU;f3Z>{l793mC@W!%deH=u
zX8j$m$fv=EGQ#KT?05K^=&<rBrx;aA#${i7iKX?@$5{0mM>hkicIhLRR4HA@vm=+B
z3<En)O9BY`<1+3+{PXd2q2h2k<J2r!S4&)+)Ax~hXga{Jtjw?rA{*!Xa+p1C0+AC9
zm9`}1P(4<Z?%(+R{XSKe)@t;GjZOc}kh0Tgiw-q@bP&E=)?0}@n9jEwi2&Nc@dgn7
zTey<<ymNUoiY|JFFY0;yh$OlTuSkUOgtkvRTQJx#1@yIGg6G4&M#iN{Q;Z&J$U;7-
zx4JesyxO9Oz>I759j`|loJdva3$OqFO0jPjp@X0Z#B0OV_V+@QS%{w$H#D$g6v<zT
zEJ1!!D9W0o9esEsxAq&mcA8M9J=-GmmE6Ut_BL(e>l1hJQWF=154b{uL`ULd)OJ@$
zj}urDqxPHkw(#&QA(uHSnu%;4h!D-TNaZIT45d9o&*xTzq)*!*2*^m{gFe4xu_I@^
z6^hwE!T!n+vMzdsasX1#FsJBOm$vRzolNp4wx=;`LOG&7&GgBwaX5YxWlsC0QXbT1
zY1k4Tpt4J-d~rryQr>*UEj+HOvWM?G^+);oFVW!o^cnsVBB6f1xb^5nwFyfWJHWnz
zIU@EOFma7A@9r;=H{PnOk3aqX59si~v)y1vNFbiJNS-GR-Yd|Pw6hYd^4AdF*hu5M
zPw%qZBe%bEIEfvCHI+{o8vN|>0yF|?(JZkA2(Oj*5*k<64U8#`&$2+$Qz036Pbg&x
zFUI^a*CKSj;_aI#uN4b#-pVQkL38W;`R;@@`}{+Z<y7&Ul0U8(8ea@(^FO~n-^;Co
zY_49qK4i+aX%!J|N?WWn5>T4t!(UyvXM}A>n~{d)U<I0?2<d;Ev}aLbI%*&?9V2A#
zJXB<|!q7G_T1~q|2?L!reCtM(LR87oe`9cEVt+3~Wz(jP-m4aK&h8D`+R%qBqxH|{
zQzGhBVB9`o`#WJ@H!G?^#==hdpjt-fhg|KpIUhhEEAuKI_>5eTSF;lqZl^>N;Ka<V
zisNn4#4x5q2k4Fm@(q0}1~VA_n+{wzPh{IH_h~B#X_|kGz%@+y{zoDb^?IU=^T&%5
z&g~di#y0DrkI;<e#vQrD`L1y}fd?67V<RDmf42N^@Mc|+dw;$sHf|NBH*rSjrp|Gk
zOamkkGa`;Dt~O`yNNC`@_p3G#u}z00EtgYUxD9lxzvU_=hw`QpZm`CsL?=Ft3IoRk
z?L}Qup?Q<~$zI*0!x$_2bmKwc226+mhEer_=`(A{WlWFBm^0TWVfW`3IT1^RrqUO8
zw`dm^6wywcIH$x{q!)cr7Y(06KLh-zz0prXTQ1TPuzH1T#B|@$X2d23w^6%rf9yj(
zbMWJj4(22LZ^6W~LK|DzHw3n;8c^%k{r8D&2onQsEvx7>dw2Qj<uC<Ug)FoX72$AD
z6?$bL>=ftlK2|urMC5;8&l|lt8En{SApdS8;&XLrpd@uf95NwhwC1t3<~em_Ty7ng
z?WHS<kY~dbVN^F2MXUcWDEu!#{1+^2H<JMrO6l<qCd&T@QjI7DRbTR)5FIoPfG1$6
z#XJs(uh{fBDGOQ`TJL5ua`W9#sNveV?C3(fpvQWL&I6<;uQUvwG)@Bg0+`P&uVn)J
zn2eAtP`YunZ&B`}CqX#tPf%p;0P^j+1$0eo$^|AN9MvsqD)|@9t0i;zv-_LU1cE1L
zPyZIt4u3`o34T#vjiA;|Pr$lSUU9HiyMV@s`4!`jA&^m3j9ruM9hqvI7yQvT=3rC0
z)C(JDBIxA4(dADjV>jO%I;6iAHv?Fa0V$`*nKH?D%Xl}(Qv;F{r?3XhD?bEa_z{ZI
zP$FXH1fH4fM%(RGp{m2?-B>PQmjeLkT2&R~-f^e}-3Mg`X$4{h&O#csmddof&ve&c
zudkI%3oT_+Pjap!f#mgW`Y3@HXdNnRVk&&byTnXkYUKO;6``YIwN5=?%@I}bCZj3p
z3zi-4PYlWO?f%j`%OwlqPJ|A~JD6l>e!G+v$Mz<r3^%KxLhX~#I<YQ;L8G$gHeLbr
z$qka%+kv5C$eAcvhcee4>ncj6qEx)4A_zD6YL%l`>*R7#R5p(wTi=7U@6}t&p<T(Y
z6*RTtes&j|LzBUNXs27C9c;|)5L{=gS?L=nNP*QeF^>B9rB=5%d^2}<@kDP6YsvS`
zciE=xn7?S~W9*m@GHSI07y=*0?rCvXzDb4!8)9XA=s-k29RV=(d4Z|-{X)R<4=ldK
z-TS1X-h%04B5;wMRE^$V-lkVaXIRB@v6yrUKKm8gEhPE8bD#P9ZG3OgvN}arM9`=&
zTl!ROoJ|f9VA{W8&TTThRBwVq50vJ!4B1{SmjO*F{^FJvd<zr_;=(>KvK*^t>gOY1
zKQGfU4Dt(Bxdtc!x)YSU&;-j?-xgE_aSrAOGC~l^=uX-#>z{LEqqu)=`d!goc!v{P
z*wTbUw(Q`J6Mu5iMy2tdqy?t#)9ww)zN_~^Qx6m)eL0}#M0)JNb~uuf4>aX#kDQd=
zUM369w6kNEyY^@MOFY=+mrQi^`of0ouwV}eeV%J5SE~J0=84q(Tb4NCmzF~z#4O*H
z8B)c`y+p?ClJbE=vZTi+LM$?$)ba165jxG;L0K|-;rUIov|M`WA#HAU2XWhzvMk^f
z)cX*<cdW}2*BuH_sB(w<J6Ix{+?pHP1R*67k|(+*K;D$!v;d-By*II8g<eAZzdoY}
zG(5rhL<6)(dz9b3r-_vmbDO=-qxfc_!+a**NNuV<X}_yoVOSkRc+mm^6<l5^Ui?~c
zozwXSsV_619(<#G5^2%pd=-$)=siuDTu9lwfmPz)`ZPn+3|J42UK;kdxz(x+{!ML^
zfv!UecV7Sfyks*RpH3!Dh5BJNX%7KY$W%I`q7Jf4$V(x8a`vr*M5Pla#hmf%M}*|P
z1v?l=lp{VsW}S}Zs{4Q{NQNOq)=rcTzcfE<gJ~0#^%N5*iRQuC`EV3Cd=9dH`km{k
zDdAPCo^sL&W!1PeO;D(@s1xoP4bBqgS!x98!{8f1N3n88^y$n~4zez^n^}wd3p8=j
zpbh99_N2o`Y(!1x+H-FRlD8lfv!ar$0cEQKhQJgieX937*7;*HBewcO*=Pg=1t5XI
zBj%|;N|kS3UHa|v?meT`aH-RSuyx4+WWKiP^McXu!gaQZpZt}<i69HOv0Bfz(a!EU
z=vXEiuf@QR?ejU{j#VLfJRxp4rL)nCC~>z7YPVq5(_^7{@)rj#l(^anf)Pv+=22j;
z1l|ptNjNF-MJg$7H_xb7hg!g#&+fNP6f>xUEVM{cJr1}{wUh1o&n5i4$@}NgV9WCo
zAD)YPKKu0QO!~kQ_s|uKr~>An4Ugo8X|@F|-5TURPzRN%8Vl<J{m4JkxFG8j@M1Ta
zct){Q`Vcg=JSngbSEt{X9Go{9Qy2o}gO*$OaKL-Mt(Q7@uYJsu9GkGcaKNd-mHu0I
zoo=`zYu`t1vIy(Fy`8wv9{W6pR8=U%cFv_qLtjxWB7sv_x_jtxn;Zw!t;l8*Y2fdh
zF8ZEwMYL<ohge&xHhwxwfLE^sjFIYU_4tQKiPs}%lJ#%BvA8pdP-XdcdGrHt=o+7N
zh<He|sve7p60I|%A3lDBt_|6d=1hV=MZ+V#`9%{5hT3nAOL=JbO#!%@`t!w0O2Azn
zrDCymYgF*%>cJ0zFg(0_<!ubO=6d5C0|tVXG~>h^3ZHL9eODEBI#eA$;>6Fc%?<OX
zZasoTgsyyt_eI$cWlo;MUo9?odE`p2DPNn{fdZZ%T<_v~uOMywyc^JFVd-bfceO0k
zfQ;Ao-2B?B#|R@jHt+(Q_g}rS7m(Xqi#bGO(3Obq0a@-{0LPi$)DHv}n_u%%8QOem
z-1aImfm^qoK7q#u0FQxzg7n(bRYf!(+an$p@c{YfN1d#K&MnWc^~Xe;ldgii<IB+J
zO@h#r9<lKsRzVVz>b__`P>$9uw}A)N?v@&f&EXB9lJO?G)@o}V|H>040TjEIGEuLR
zySV2&QSWi`H)!8TQu-v*B<^m_SBL&gvJL2n{Rnc!>!MGh&DL&fJwF;Q&vo-%ub)>c
zAYTb?YZcHOE#zgE<;DzzJ{hX32XUeritU4SG%0&&_O9P3+lznky3JOBdNLE(LAg1X
z<K&5cN5GAgIa~b^^3Hq5<-p48*6IHV=NB00!`I2S5N#|C8UXI}{{0b>vCpCQ`~%cJ
z-SuB1z1`jyxL!5`z^?c@Nh4~{x1jpE&O81wnRToi@<ed5>fc`3{)}Qatnki-^BLPG
z&anCE0`rf+uctc}klzddMg~Li2TRW(*Cs~^8pyj!_uYv6=i)1Qg;0)fM0f|evIRK@
zbz*Kn5M==P7SUTyRRRC)<!d2YDg0mjjw*>0kf9`MKzS^_^7+jy*NI|x{EqnVqz5D{
z$5*6NMDJAK6wekk7^n}NE5UyUamr4T0pKBgMP|3qxmq;na2;US+J7|uce{s7OLqyf
z@*fyF?q+lU6j2_>_wYOZaGe2lzGq?{0G*9sTbM>>Tlh7}ZQ*k7-17zAzbAfsc$)M&
zTY?6?uC2ux0DefcBH06Z3b_GGpNKT~k!<X9d;xjZgq7=3@0^>dIyuXAqBt7=9bZqn
zCqWH<`)mdd2;~hL09w$1tR`^20vT_df*+pQO)>yf;CqR^N#@LMA2bL{Awy-@`0=H{
zwXY#_Eo3>8^I<vXu6YIVTpK7?eZ={CY?qlRoB^O2=^;mi&QHQ0Oh?VYPeM9DUBtPG
zz$`EC9TDgM>7Dy)LiyZxeKmBv4)uvC)aMQioga#CFnloK`f=o90C0VCGrlYd8UUJ+
z4DB7rQ;yn&TOOD~1KP0O7c?$>C*t1D0MLS-Gi;nWA74gBd0@KdYanx`zXDBWq|k&=
z_}b0@(2R^Y=ab&ngI){n8G@dJVUi30wfIKWXCulo7=MD~k<htw@C}VSN8Gm(>6ASa
z%4T#t#vw!UOUNkvCNk<A8j-d)GNxaJ`nweB6R!&VvgxQhd+Gj2dcS;C!Y``d&&2@H
z9ZkqRjK*W{B7@mCNsb**4_t=i&FjcG_W~NvTtc)LmeB$D8S#SF;S|0lWX^E6)&Ot<
zzA&E{lg25GaRz{FJnrTFQN+1i4FK729p)<q<o%16cRuQH!j#}Eq0=MI2fZiaW*eL}
z{JDs8aRz{c@D=slW3F3^KPz~4=$up5Un0Ml8Mzn${_LgsLmt;PIzG4Kw}q&kIkL5d
z)*1ku+xI%+<)Irm#2EmRD8-)@`clOCTnzx(a0>MO1>}9o%lkUf%1ITzM^;#F1`PlU
zh?ZyN__K_6hR!7!0M5k!HgPVu1MvrphXjsS;=76eEhcXqxflQ*^V0lRp4aZ`I0Hab
z|KV_h@EHYM|6ng~6PX6;Qv>IsjB!=?v$Wx;*=`BJBH{;d<MAgi#>S+HBgp_zj&A@@
zp}sv>W_Nrp@k+b%@L5Bq@xtNU=ogc@oX8mfn#uHxaNOdh`H*x&<p_N5ixVUA;iZ4o
zOY`H<IcES!k?GkPrnLruuY1Rr5$~$M6aL^XsKdH<T!;)dIws#CdO3&t-A4K(;pl|4
z?w8F=^_U#45&lIj!Oms?*cX2+5cQjb>Ux;5L@&V#{(hU~89N<OZcUw$W4*tBCEnV6
zjrX@d+P<QgICq#Ah*sz!)7>{;++bi*VyfcYV>j}fbuPspMBGAju)Y-9st;fSTK5>m
zG~(S%-8<ZuXk{k~H)HiWvT{bT9$5<^-IBipery0|{VXQ#Irk@ekYRK_O7P{;Ekp-M
z%C#*NijzkV5-$&1Bad28JPe3m*IWz=m3j5}v-*EP3VxU-Gy?%rtmD@C-cGbU+k&s4
z982zfsgp;K5N~i^jQ{LGd9)wCLFa#Ryk9;zdGsl4*-;^ECes+?c-H%yEw)1xFQNKY
zN#;QH0W<?$34Asp?{R1bZ&O6soNM}hXeK=hH-lC}^z2|R^g`Zq?)NVgm%|NwR}=4b
z_!s1M9EFo}_n|fuh12^6;4d)<^DOa(87C)4k^b&aMn(*`1Sg7?z`3|s01&^du~;~n
zb3gGx9p6V@5RhJ0_g?oTIx4%-xi}N}C91psLSvzNG(+#&%IA^Cu45ru;=C7<BcK`a
zy#l{%y76;fx}f*&iJ@z_-=i71b7P#BcOdFNk4Npc7xD<4fs7gdBy(cskEm~b55@5s
zh;)Kcs6AZAwhP9(&Db7x0VqdSYVZYE6v2V{MC2M<ES$x3W<r{os6$9n6n8^22>YN4
z7<9vQ3TkVGa6jNYG_y1sS^ix;aD)B|?|81!Ifvm}mXp50TY-O1L`p!Iq<82#=@K+>
zdNPNyxn&ir&}>N@&c!$A<`W#;Jf6e7^5uRs3o{YTFx-vS*geN~C~Ue2#cT_Ol8Zdb
zWhQce6hw3{BsYRC%5GM!wen~Ll1B$1Lr7128R-V0`QBsKz%_E|6DrXRz#9>1lHTDv
z-rpWbZp_J{Y)&3+B3T}#yuU$tw3qjHH8N-xn|qOhcsTNoxCg}*cpi)NoeOjE7346^
z5LbojTR2@cYHP=!x>!%Tr=shd!)>7n&2oPQ=?=dSop&Ay52C@UqY~dEu8icm=yoG1
z)CIOW=K3wDzq^F^T{+&5IbMP9k&us^eKsOZu5xlBzRYm#_!Hoig#7M%jgC3L2`vF^
zD@yV8m=cn|v)k1qSk?zoFxKHHHqBjVko64t?N(y6KUMex`^V4#*$v!RBTtb=v`qS|
zXiz*8)r;4>bgo~T9XOT?ZYQtcm|})^oiK&&3UDKuNc#_xqrn|(9!7@LH<1zcB4h}`
z%i}!t&cUDD0O@7((EHl%*d7c3L4`4CON#X<fK^{|pFPeMw?1utLYhrz`9Yj}`{ihz
zyL*<6Xb|W+-=1iYT4;bikOlufe8WPscMmt%tiV_D^SMuOeO}Tx2%d}k21)NQcrMp(
z=+*@uPO=M~BRI%$o%aUfXGmJZD`@%2?~rH8#on(ODJp+Ku1>|=0@7$(a%~GPNK^^!
zBaapmZ;&iSF3T4Nj%`44qA8HZ4Q2}E3{=0J@olqr57*XekflCfnU~Kuh{_WrA9<9`
z08oN2Q_di__4Gk`<m!nF^jB=AA@|TLkzwXi@7IKktv8V#c+5yANpTI%kcHzqj7AD-
zFeuil(DizH`J&pwt;hhd7n%%lhN%I-QGql;dgB`vE+T$Miy%=k3UXmJ>9Lm@kuLT+
z(utCY+ZM2%-1NS6=sotPFr8z4On#?VOhAURY{b30PiWizy&hjipYQ#$5iIK*<SB9k
znw0vo_iI7=%bm!}%C-mX_#B1wOi*03s9F0T0T-Zpb2eHN-x=5gdB}nKtf>095_viN
z67{{#01(uHinSGdr(k<900iATvniwQe6d}*T^Vw{f0!fiBlQ0gxem_?rMV2bp%+R$
znqjU-?x$BFD{k=pO(1>=LlVLFne+~V=i<IWYxBqPcjWSvjiA!y?$MS(_-;pToJS*9
z;;CqD@WI~i93;4H2Cj3EPg`&Uf%cF`<-~g<or?zln~+?(gG>*FYsg$voDZXroU2Ak
z<ZtmKZ##}b?t1xBh&+l~CQyw0VchfGLi$WY9KpefyGL8fqhF(Smd7Evb1+gGkMw?j
zN3)2<uCra4+tJ{E7TQ(fVKUv`H;^8PGRVtlrfwVxp6QhK&!Kj{gyg>OYBKeWC<@(|
zeglQOxyRMBV(NXZ$^RT`FWHEb58JXGT|;i3Umt}2{~+3~_(-(uVk$CPP4RwTL~hdN
z5zw)51LP&7d&UIWfV`uR52Wu5xL7$Wh<`Tlz5LuV=Vlal>;n`V;10C=#v{ZpJ=$*A
z9t;3$&<sTta#M<<7rte)*n(;)sys<sq0|y@fp%_s_Y=KK0mKKn$(3Wh`>#N2ZyF=g
z6nc;4fqy4`gW$PkF=>+CVenk8-*7RS&00$SN{CzkR)st_+G-1|)yTE(F7N+ikte`K
z$PN1|z%Sb9-bQiBwJnSY{5!5K6v|TX`bljmsccRj{Q<duMp5YA;EvPL;C~i!eU6$1
zD^wl@-{)}RU2KEjAWoj-Dvz?wWP%3&OVL`x4=G$84ME;oZ8ht*40&eUjEq!!ph4wn
zDB$g>#IJQX@?%GQMf-H3-P!AjAN)IRMSIDgg?9O9#&5@eA#<R)0@a@i@1C7)Tdmc|
zKv_w$EbD{6-nWo8-a970Yl|Cc`!)QnVHGN4H8K(vTGkCH@TdzuItqCLT#6=+zK3?Q
zGCD3Ue$2cq>D>9KovAu1Zh2C7GM5!p;V)S%3;gYcudjU_8Mnuxao9#=Sp7FLfE6+^
z+TqzAf&jMQuSJOq@&Z~{?+9;)(^}m9_ew|;wZ)&qRo<vIsE$Jt&N;W0Bulni*YzIJ
zga2&zNMaFwK&zy0u&?(wMf^8NdWY`Xn@P6v1#vqD97X;Hujlb+?2b)J7(p)IB#v2V
z(C@b7NqVP7$6_)5tZi%CLZP&^JgOvf>%1Vj)O~l4>BPIh7AlY4#$T$C%Qsj<{Oo2f
z?{EpZ?;zuX`xUZ}vXf;sC{SNM6e^G0P6}t>yOx_gDju#KY$1MjHkWVx7c}S}jF!6X
zj=vRT*!>^WhraCnyU;zo+mmMeI2f(f`*M|&!8OmW9q&i{@}XkU8eO6V1*eAMe&@Mp
z(0{x4f0GFvA7?~dl_j0?g3V@h>_|8xU0lFlx72w#GQNj*^>_ry%ReDQUp0yg@IPp*
zF^%{gl{zikg8={(ya*)VqPF2H#oyZKJ>sLmxAy+yiQiJ|(uDlZ)g)@4RnR`GaoY=m
zuY4w1>|7-4F+>l92UFPggbw!(&LO&?RHJoApnw|7BhrA}%%YyP0zXplKgr!a=N8ln
z4oAU;vJq?(%kZ}d`+r35jU7iW-y~c6bAoz%@YLx_6ss+?_Wo`l5T=~uwvbI8eFd#A
zjw6@4pY0wKNDf$)#74BN24vZf+KRC+zP!7Sco*F>iT;Llf&96w0d}};L8p*g41l1F
zcmu!h`U&~PMrf@(O5w+5upI)5hieDrsBaEaf%=|oe1dN<J{y1b|25)+<hi=|8RXWT
zjd1LO_Qtil<A~nIuMA)Bn??LA-bAE#gek$-+g?S3hTy%|p+QodmsF6}=-SSpT<8GA
zedlAyEe=v?%)g^B9i{WI#`~MC9=Yvl+am5&TjA>AJ4lY^@(X(ey^ppv9*n%+zKxbi
zgO)`6gY9R`yj{@)3Fj1Y_YAIG=?(lJ{$7qz5nIp2-}AXp{_S03Iq5>S7DeW5L5gXL
z%z^d~@b{_@Zsk*o6wr0v&&|e!IRyXtE<?)mXz%Bg-${Wqe;|Et-ASn7tP7;c*Tr`T
zvK*$6#cbEmxkm!exNk;o38xhDPWX`Y2>gA}7LO@3a}l*InA`jF%!qUUi@)FRFYp8S
zIC>x>%Rk7pl8?iGFK<PZy+3;ACx?!I7XNuKM8+ZaO`K)*?<fG^ZlS!T$Q{(xm#;)T
zlhJV*jKBAGxGfAOdt12NJO6ydxm>6~%C6f-J2;Eg8!4|%s6C{}G+JJVzgK;5OQ;Iq
z8>kJsHZd*Y{%3pVHlYqRSohs-CZEBVHJ6h<s5}J8Vt0>1T-_(&x1Xm--)eCu6u`<o
zV|d_IA1GTR8h8iy4j$@VGlk?<*oC+vkpCbuxetHu_RGi&5Y`*Xv8Tv1;2ey<U-wgF
z4t$2AAbtmjj(;~$-p?Vq=Dvx0_s^rP*>()&twd3wU41z&;+eWKKSb~4g@iQw<JXCx
z;iel>v{PuOnc%XQp}<3^9=m<JKa+5e)4VhrkaC+sOUdFWN9%o4XdUcDWX}2xKyCOn
z`~YIP@;mR^aa)nbQAKk5aRl|gd8EtIu-<o4ME;rhZG0K&+Z=YsmxEC<5)=c)o&PiG
zONv0U?g+0OUk#nR$jcXAZy&`pFYP<XP_Ywgx54`j43uSDD1R9;G&^~BG3ojr=-Zx$
zyh4Tsj{gY-|C~bl;HShZ%PQ}>KhEJfjP~U+{5~MbVB`9>sJ`9xsfBuzjKZ&{aa*F^
z<(<DN;@oZCx$u&u3-D!MxNf(Wui%$?rz~lWc4Bw@=*Z3x@HT#hO`(8RQ53@fFa)hV
zarc^s2J23V{VB3AMHv8kqK?4jU4$&o%f0_k2d*IA08onGXv4p=0_koI9AATGlUxV7
z76lM0)BphLK-UJY@d4_zoWi;VHPk4a0pL>n!PEO*8QnK*A+sZOBpCq8(b_jxu4WY7
z_El6*ngi#el-nZ%<x3%#-#77<tQ4AQ3{rzX2n+w5f#}J=u?GAZzGZ>qk6_mI&Pcc|
z%qFuf#ChDb)&Kxf0)zE4*p^yQr`AZcayvYf_aig_a08XckWn*ENvOqFuERe!FfGMb
zN?rYb9m!zV#xA6A0|3Yfw+X+^zl%J;TJRPBr~y^b0Pr=WR5YXSHy!^QZbtD`!elc5
zbVtTNmu9n9uGi6QU+{fJd2oCl84p~Vh3MNh1dfHv)i2`O?zfAVW=`PPQuNKIBiG5`
zK*va@H3k4spXSarp``%tpgPx#24=4RNiqOblU@g!$i9VUU($7lCe(J{L<9F=J?Ur$
z0MJa`l0f<>z3+;cyiP`4iS)G;GMK(W`eew@67K&)()EXrkzO$e-)NJ<_g-}5V*uDc
z^gQktjCGP^000?8g7S6~@!vUU0Jtk~d^Iv?zfQWY{SuP-M#p9^{BIVXuyTyX@86<~
zhaJ@bFbu!1|3-mji=#K0y1UT<8HggCy1}69&>kiE!yW0RX>DMmKFDh96y+2Wvgdi{
z|Lol-YCZV?RJntLhDE@ykivM1m-mk`_pU;g`ahze6_0wqpjEpZ1qfOgxW@+MGQ1N~
z{9V36*R_p7&*=v7DYX1x8p-R9AMoyb01^`SlHTdPh`*iEgE$Dv5^4t^iE5ASVg
zmY_N&?{MTf5$r6tppO36MDO$49VvG=pk)j0-8v73!_h$M9sI$V8xXvTlmr|6cV0#l
z-xiYAOrC}6$!}YE|KTXA?S{bpUqyl3z^{{0Wf_A4J_YOLT;z^if$HX?#LxWHAqC<_
z((8V3c~1@U$O#&}R-<<|7<mCbilU+y%5F%O1m)@~^j>y}$<sYh-krT`JcO?pHKW<u
zDKYu882~^tXeT1ivGsxU8<DZ-dL-}S-0jCAnYEmBSvC_5Xrclr_C;=uH>0TV?irm2
z!%0Z#`hau;Llbg^{2U$64ZI_8CVG#*OGq;w|9wY&(=*V(KiIcCj^BT~{xMr*?#lxA
z$#vJDa%B8}iu68r19F|e8Z8mX_uGHfE63e==BvPeh6y>OA4I&~cUVF`X8`yHGLYRu
z`oMoWs`J^Hgl74JM$;`w&-yEp=RHGtj`PYF6`vuBol(2K9sk_~x8&>{I6flg8fB=i
zK0&%%Z$!q?-y!d-;7tF1Xz%zpNbg6Qk)h>M;&mpY<MAB6p(-3avm3rg&<Zl^EOcB0
z0Qep|8%Q22?2LBZatuf9Jgy!)Z{8Gs%od}AQ-?Z+w%jr)juNDR72=9gj>;XiZnc>7
zA%Ba0zVt?hjY5^iQuH2k2}a^v(Q<W9t@o~7NZGp6Hg&6)cinvVJvTZ&t!)dfp$yga
zLKL-1R40q=Ru`lM$)dInrqz$^Gone9qxYDteb(VC3{f-qQS>EqX;QBAq;Of5L_bt#
zZO#9-qX%kl?Pd5aMc=)x+hSXhkKPwF00bF8;WOIq`?ZJOnGYrCJIC!z6-OO1&UU5%
zafZ)We2=aMwC(tLXc@BeVBSLXQfcVe27qqJ3oC`Z{2m3qgJLmVgeL0T(!Z+%`J89O
za<t^-Vq}p03Np~SXSSVh45I_m1K+JTSB2X!45KX=i?8J5t6&?3v2BPm02s#h%tW+|
zBfO*}g_htQpOCjB8vsC)9KRvm!zKKiiQ=U=cEVo*6!qJJybHEFPZx9NGdepJXpP_Z
zQKRpV-1rQ`Ft#-{z_lo@%tF%F(;9}+ahQpWb>F1*%dHHfGf|3yX6}cK)a%ePkH?AM
zCLFZfr385k6tYV|6@K8_8Ti}v1{saKVV9%jxj{yH<z0aW?Q!%$+o$e=Ja(6%B|@(e
zzvb^}w5)G1@{ZYzp7TGbFE<RM1MyeV1MU2xeT!olMi=HK(gT7eMPN4!qkS<C0K+i4
zEEZtQ=*)CS3itacfX{E*w>XAjbYbeyjK;gj3*b-5$qmCW48t(CJ^vq}WJXqU$C|bP
O0000<MNUMnLSTZSD3=ld
literal 0
HcmV?d00001
diff --git a/src/doc/index.rst b/src/doc/index.rst
index e41d318a..6a9013c5 100644
--- a/src/doc/index.rst
+++ b/src/doc/index.rst
@@ -11,8 +11,10 @@ Welcome to caosdb-server's documentation!
Getting started <README_SETUP>
Concepts <concepts>
Query Language <CaosDB-Query-Language>
- administration/*
+ administration
development/*
+ specification/index.rst
+ Glossary
API documentation<_apidoc/packages>
Welcome to the CaosDB, the flexible semantic data management toolkit!
diff --git a/src/doc/roles.md b/src/doc/roles.md
new file mode 100644
index 00000000..80729fb1
--- /dev/null
+++ b/src/doc/roles.md
@@ -0,0 +1,35 @@
+# Roles #
+
+## Users and roles ##
+
+Interaction with CaosDB happens either as an authenticated *user* or without
+authentication. In CaosDB, users can have zero, one or more *roles*, several
+users may have the same role, and there may be roles without any users.
+
+## What are users and roles good for? ##
+
+The user and their roles are always returned by the server in answers to requests
+and can thus be interpreted and used by clients. The most important use though
+is [permission](manuals/general/permissions) checking in the server: Access and
+modification of
+entities can be controlled via roles, so that users of a given role are allowed
+or denied certain actions. Incidentally, the permission to edit the permissions
+of an entity is seen as defining the ownership of an object: Being able to
+change the permissions is equivalent to being the owner.
+
+## Special roles ##
+
+There are some special roles, which are automatically assigned to users:
+
+- `anonymous` :: If requests are sent to the server without authentication, so
+ that no user is defined, the request always has the role `anonymous`.
+- *User names* :: An authenticated user implicitly has a role with the same name
+ as the user name.
+- `?OWNER?` :: If a user has the permission to edit the permissions of an
+ entity, the user automatically has the `?OWNER?` roler for that entity.
+- `?OTHER?` :: The `?OTHER?` role is the contrary to the `?OWNER?` role: A user
+ is either the owner of an entity, or has the role `?OTHER?`.
+
+Except for the `anonymous` role, these special roles are not returned by the
+server, but can nevertheless be used to define
+[permissions](manuals/general/permissions).
diff --git a/src/doc/specification/AbstractProperty.md b/src/doc/specification/AbstractProperty.md
new file mode 100644
index 00000000..d594f819
--- /dev/null
+++ b/src/doc/specification/AbstractProperty.md
@@ -0,0 +1,331 @@
+# AbstractProperty Specification
+
+## Introduction
+An `AbstractProperty` is one of the basal [objects of HeartDB](./HeartDBObject).
+An `AbstractProperty` MUST have the following _qualities_ (shortcut in brackets):
+* a persistent id (`id`)
+* an unique name (`name`)
+* a description (`description`)
+* a type (`type`)
+* a generator `generator`)
+* a creator (`creator`)
+* a timestamp of it's date of creation (`created`)
+* a set of owners and owning groups (`owner`)
+* a set rules which controls the access to that `AbstractProperty` (`permission`)
+Depending on the `AbstractProperty's` type it MUST have one of the following _qualities_:
+* a unit (`unit`)
+* a RecordType which is referenced by any instantiating ConcreteProperty. (`reference`)
+This is described below.
+
+## Property Types
+An `AbstractProperty` MUST have one of the following 7 types:
+* `text`
+* `integer`
+* `double`
+* `datetime`
+* `reference`
+* `file`
+
+An `AbstractProperty` of type `text`, `datetime`, or `file` MUST NOT have any unit or referenced RecordType. A `double`, `integer` AbstractProperty MUST have a unit but MUST NOT have a referenced RecordType. A `reference` `AbstractProperty` MUST have referenced RecordType und MUST NOT have a unit.
+
+## XML Representation of AbstractProperty Objects
+
+An `AbstractProperty` is represented in xml by a `<Property/>` tag. It's _qualities_ except for `owner` and `permission` are represented by an xml attribute of the same name. E.g `<Property name="length"/> denotes an AbstractProperty which {{{name` is _length_. The `owner` and `permission` qualities are not in use, yet.
+Depending on the purpose of the xml document (shall it represent an object in the database or an object _to be posted _to the database?) the `<Property/>` tag may actually have just a few of the mentioned "quality-attributes".
+
+### GET AbstractProperty
+Any xml representation of an `AbstractProperty` that is retrieved from the HeartDB Server MUST have exactly ONE of the following forms, depending on the `AbstractProperty's` type:
+#### text
+
+ <Property id="$id" name="$name" description="$description" generator="$generator" creator="$creator" created="$created" type="text" />
+#### integer
+
+ <Property id="$id" name="$name" description="$description" generator="$generator" creator="$creator" created="$created" type="integer" unit="$unit" />
+#### double
+
+ <Property id="$id" name="$name" description="$description" generator="$generator" creator="$creator" created="$created" type="double" unit="$unit" />
+#### datetime
+
+ <Property id="$id" name="$name" description="$description" generator="$generator" creator="$creator" created="$created" type="datetime" />
+#### reference
+
+ <Property id="$id" name="$name" description="$description" generator="$generator" creator="$creator" created="$created" type="reference" reference="$reference" />
+#### file
+
+ <Property id="$id" name="$name" description="$description" generator="$generator" creator="$creator" created="$created" type="file" />
+'''General Notes:
+* If the called Property does not exist or if the Property called without permission, the HeartDB Server will return an [Error](./Errorcodes).
+
+### POST AbstractProperty
+Any xml representation of an `AbstractProperty` that is to be posted to the HeartDB server MUST have exactly ONE of the following forms, depending on the `AbstractProperty's` type:
+#### text
+
+ <Property name="$name" description="$description" generator="$generator" type="text" />
+#### integer
+
+ <Property name="$name" description="$description" generator="$generator" type="integer" unit="$unit" />
+#### double
+
+ <Property name="$name" description="$description" generator="$generator" type="double" unit="$unit" />
+#### datetime
+
+ <Property name="$name" description="$description" generator="$generator" type="datetime" />
+#### reference
+
+ <Property name="$name" description="$description" generator="$generator" type="reference" reference="$reference" />
+#### file
+
+ <Property name="$name" description="$description" generator="$generator" type="file" />
+*General Notes:*
+* The `AbstractProperty's` `id` and timestamp (`created`) will be generated by the HeartDB Server.
+* The `AbstractProperty's` creator will be determined by the HeartDB Server depending on it's policy configuration.
+* Any given attribute beyond these will be *ignored*.
+* If the `<Property/>` tag isn't compliant with these the HeartDB Server will return an [Error](./Errorcodes).
+
+----
+## Examples
+### GET Requests
+#### Single-Get
+*Request:*
+
+ GET http://localhost:8122/mpidsserver/AbstractProperty/1
+
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <Property id="1" name="explanation" type="text" description="explains the thing" generator="Timm (manually)"/>
+ </Response>
+----
+*Request:*
+
+ GET http://localhost:8122/mpidsserver/AbstractProperty/explanation
+
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <Property id="1" name="explanation" type="text" description="explains the thing" />
+ </Response>
+----
+#### Multi-Get
+*Request:*
+
+ GET http://localhost:8122/mpidsserver/AbstractProperty/explanation&2&3
+
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <Property id="1" name="explanation" type="text" description="explains the thing" />
+ <Property id="2" name="comment" type="text" description="A comment" generator="Timm (manually)"/>
+ <Property id="3" name="name" type="text" description="Name" generator="Timm (manually)" />
+ </Response>
+----
+#### Get all
+*Request:*
+
+ GET http://localhost:8122/mpidsserver/AbstractProperty/
+ GET http://localhost:8122/mpidsserver/AbstractProperty
+
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response />
+[View Ticket #2](http://dev.bmp.ds.mpg.de/heartdb/ticket/2)
+#### Erroneous Requests
+##### Non-existing
+*Request:*
+
+ GET http://localhost:8122/mpidsserver/AbstractProperty/123456
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <Property id="123456">
+ <Error code="201" description="Property does not exist. " />
+ </Property>
+ </Response>
+----
+### POST Requests
+
+*Request is to be sent to:*
+
+ POST http://localhost:8122/mpidsserver/AbstractProperty/
+ POST http://localhost:8122/mpidsserver/AbstractProperty
+----
+#### Single-Post
+*Request body:*
+
+ <Post>
+ <Property name="TimmsIntegerProperty1" type="integer" description="This is TimmsIntegerProperty1" unit="kg" generator="Timm (manually)"/>
+ </Post>
+
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <Property id="39" name="TimmsIntegerProperty1" type="integer" unit="kg" description="This is TimmsIntegerProperty1" generator="Timm (manually)"/>
+ </Response>
+----
+*Request body (with a reference to Property 12345):*
+
+ <Post>
+ <Property name="Timms reference property 1" type="reference" reference="12345" description="This is Timms reference property 1"/>
+ </Post>
+----
+#### Multi-Post
+*Request body:*
+
+ <Post>
+ <Property name="TimmsIntegerProperty7" type="integer" description="This is TimmsIntegerProperty7" unit="kg" generator="Timm (manually)"/>
+ <Property name="TimmsIntegerProperty8" type="integer" description="This is TimmsIntegerProperty8" unit="kg" generator="Timm (manually)"/>
+ <Property name="TimmsIntegerProperty9" type="integer" description="This is TimmsIntegerProperty9" unit="kg" generator="Timm (manually)"/>
+ </Post>
+
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ ...
+ <Property id="41" name="TimmsIntegerProperty9" type="integer" unit="kg" description="This is TimmsIntegerProperty9" generator="Timm (manually)"/>
+ </Response>
+
+----
+#### Erroneous Requests
+##### No Description
+*Request body:*
+
+ <Post>
+ <Property name="TimmsIntegerProperty3" type="integer" unit="kg" generator="Timm (manually)"/>
+ </Post>
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <Property name="TimmsIntegerProperty3" type="integer" unit="kg">
+ <Error code="202" description="Property has no Description. " />
+ </Property>
+ </Response>
+----
+##### No generator
+*Request body:*
+
+ <Post>
+ <Property name="TimmsIntegerProperty3" type="integer" unit="kg" description="This is TimmsIntegerProperty4" />
+ </Post>
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <Property name="TimmsIntegerProperty3" type="integer" unit="kg" >
+ <Error code="202" description="Property has no generator. " />
+ </Property>
+ </Response>
+----
+##### No Type
+*Request body:*
+
+ <Post>
+ <Property name="TimmsIntegerProperty4" description="This is TimmsIntegerProperty4" unit="kg" generator="Timm (manually)"/>
+ </Post>
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <Property name="TimmsIntegerProperty4" unit="kg" description="This is TimmsIntegerProperty4" generator="Timm (manually)" >
+ <Error code="252" description="Property has no PropertyType" />
+ </Property>
+ </Response>
+----
+##### No Unit
+*Request body:*
+
+ <Post>
+ <Property name="TimmsIntegerProperty5" type="integer" description="This is TimmsIntegerProperty5" generator="Timm (manually)"/>
+ </Post>
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <Property name="TimmsIntegerProperty5" type="integer" description="This is TimmsIntegerProperty5" generator="Timm (manually)">
+ <Error code="202" description="Property has no Unit. " />
+ </Property>
+ </Response>
+----
+##### No Name
+*Request body:*
+
+ <Post>
+ <Property type="integer" description="This is TimmsIntegerProperty6" unit="kg" generator="Timm (manually)"/>
+ </Post>
+
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <Property type="integer" unit="kg" description="This is TimmsIntegerProperty6" generator="Timm (manually)">
+ <Error code="202" description="Property has no Name. " />
+ </Property>
+ </Response>
+----
+##### Invalid Name
+*Request body:*
+
+ <Post>
+ <Property id="39" name="TimmsIntegerProperty7" type="integer" description="This is TimmsIntegerProperty7" unit="kg" generator="Timm (manually)"/>
+ </Post>
+
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <Property id="39" name="TimmsIntegerProperty7" type="integer" unit="kg" description="This is TimmsIntegerProperty7" generator="Timm (manually)">
+ <Error code="204" description="Property has an invalid Name. " />
+ </Property>
+ </Response>
+----
+##### Mixed
+*Request body:*
+
+ <Post>
+ <Property name="TimmsIntegerProperty2" type="integer" description="This is TimmsIntegerProperty2" unit="kg" generator="Timm (manually)"/>
+ <Property name="TimmsIntegerProperty3" type="integer" unit="kg" generator="Timm (manually)"/>
+ <Property name="TimmsIntegerProperty4" description="This is TimmsIntegerProperty4" unit="kg" generator="Timm (manually)"/>
+ <Property name="TimmsIntegerProperty5" type="integer" description="This is TimmsIntegerProperty5" generator="Timm (manually)"/>
+ <Property type="integer" description="This is TimmsIntegerProperty6" unit="kg" generator="Timm (manually)"/>
+ <Property id="39" name="TimmsIntegerProperty7" type="integer" description="This is TimmsIntegerProperty7" unit="kg" generator="Timm (manually)"/>
+ </Post>
+
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <Property type="integer" unit="kg" description="This is TimmsIntegerProperty6" generator="Timm (manually)">
+ <Error code="202" description="Property has no Name. " />
+ </Property>
+ <Property id="39" name="TimmsIntegerProperty7" type="integer" unit="kg" description="This is TimmsIntegerProperty7" generator="Timm (manually)">
+ <Error code="204" description="Property has an invalid Name. " />
+ </Property>
+ ...
+ </Response>
+
+= DELETE AbstractProperties =
+
+HTTP-DELETE-requests are to be send to `http://${host}:${port}/mpidsserver/AbstractProperty/...`. Default port is 8123.
+
+*Example*
+{{{
+DELETE http://${host}:${port}/mpidsserver/AbstractProperty/1&2&3&4
+}}}
+
+
+## TODO
+### UPDATE AbstractProperties
+Notes:
+* ids are persistent. They cannot be changed.
+* Maybe we should take the PropertyTypes as persistent, too or just allow a few changes: Double <-> Integer?
+Roadmap:
+1) Specify and implement changing the name, description and unit of AbstractProperties.
+2) Specify and implement changing the reference of an abstract reference property.
+3) Anything else...
diff --git a/src/doc/specification/Authentication.md b/src/doc/specification/Authentication.md
new file mode 100644
index 00000000..9ec5bcd7
--- /dev/null
+++ b/src/doc/specification/Authentication.md
@@ -0,0 +1,82 @@
+# Authentication
+ Some features of HeartDB are available to registered users only. Making any changes to the data stock via HTTP requires authentication by `username` _plus_ `password`. They are to be send as a HTTP header, while the password is to be hashed by the sha512 algorithm:
+
+| `username:` | `$username` |
+|-------------|-------------|-
+| `password:` | `$SHA512ed_password` |
+
+
+## Sessions
+
+### Login
+
+#### Request Challenge
+
+ * `GET http://host:port/mpidsserver/login?username=$username`
+ * `GET http://host:port/mpidsserver/login` with `username` header
+
+*no password required to be sent over http*
+
+The request returns an AuthToken with a login challenge as a cookie. The AuthToken is a dictionary of the following form:
+
+
+ {scope=$scope;
+ mode=LOGIN;
+ offerer=$offerer;
+ auth=$auth
+ expires=$expires;
+ date=$date;
+ hash=$hash;
+ session=$session;
+ }
+
+ $scope:: A uri pattern string. Example: ` {**/*} `
+ $mode:: `ONETIME`, `SESSION`, or `LOGIN`
+ $offerer:: A valid username
+ $auth:: A valid username
+ $expires:: A `YYYY-MM-DD HH:mm:ss[.nnnn]` date string
+ $date:: A `YYYY-MM-DD HH:mm:ss[.nnnn]` date string
+ $hash:: A string
+ $session:: A string
+
+The challenge is solved by concatenating the `$hash` string and the user's `$password` string and calculating the sha512 hash of both. Pseudo code:
+
+
+ $solution = sha512($hash + sha512($password))
+
+#### Send Solution
+
+The old $hash string in the cookie has to be replaces by $solution and the cookie is to be send with the next request:
+
+`PUT http://host:port/mpidsserver/login`
+
+The server will return the user's entity in the HTTP body, e.g.
+
+
+ <Response ...>
+ <User name="$username" ...>
+ ...
+ </User>
+ </Response>
+
+and a new AuthToken with `$mode=SESSION` and a new expiration date and so on. This AuthToken cookie is to be send with every request.
+
+### Logout
+
+Send
+
+`PUT http://host:port/mpidsserver/logout`
+
+with a valid AuthToken cookie. No new AuthToken will be returned and no AuthToken with that `$session` will be accepted anymore.
+
+### Commandline solution with `curl` ##
+
+To use curl for talking with the server, first save your password into a variable:
+`PW=$(cat)`
+
+The create a cookie in `cookie.txt` like this (note that this makes your password visible for a short time to everyone on your system:
+`curl -X POST -c cookie.txt -D head.txt -H "Content-Type: application/x-www-form-urlencoded" -d username=<USERNAME> -d password="$PW" --insecure "https://<SERVER>/login`
+
+To use the cookie, pass it on with later requests:
+`curl -X GET -b cookie.txt --insecure "https://<SERVER>/Entity/12345"`
+
diff --git a/src/doc/specification/Datatype.md b/src/doc/specification/Datatype.md
new file mode 100644
index 00000000..ffc9794e
--- /dev/null
+++ b/src/doc/specification/Datatype.md
@@ -0,0 +1,95 @@
+# Datatype
+
+## TEXT
+* Description: TEXT stores stores any text values.
+* Range: Any [utf-8](https://en.wikipedia.org/wiki/UTF-8) encodable sequence of characters with maximal 65,535 bytes. (Simply put: In most cases, any text with less than 65,535 letters and spaces will work. But if you use special characters like `à `, `€` or non-latin letters then the number of bytes, which are needed to store it, increases. Then the effective maximal length is smaller than 65,535. A bad case scenario would be a text in Chinese. Chinese characters need about three times the space of letters from the latin alphabet. Therefore, only 21845 Chinese characters can be stored within this datatype. Which is still quite a lot I guess :D)
+* Examples:
+ * `Am Faßberg 17, D-37077 Göttingen, Germany`
+ * `Experiment went well until the problem with the voltmeter occured. Don't use the results after that.`
+ * `someone@email.org`
+ * `Abstract: bla bla bla ...`
+ * `Head of Group`
+ * `http://www.bmp.ds.mpg.de`
+ *
+
+ A. Schlemmer, S. Berg, TK Shajahan, S. Luther, U. Parlitz,
+ Quantifying Spatiotemporal Complexity of Cardiac Dynamics using Ordinal Patterns,
+ 37th Annual International Conference of the IEEE Engineering in Medicine and Biology Society (EMBC), 2015, doi: 10.1109/EMBC.2015.7319283
+
+----
+
+## BOOLEAN
+* Description: BOOLEAN stores boolean `TRUE` or `FALSE`. It is therefore suitable for any variable that represents that something is the case or not.
+* Accepted Values: `TRUE` or `FALSE`, case insensitive (i.e. it doesn't matter if you use capitals or small letters).
+* Note: You could also use a TEXT datatype to represent booleans (or even INTEGER or DOUBLE). But it makes a lot of sense to use this special datatype as it ensures that only the two possible values, `TRUE` or `FALSE` are inserted into the database. Every other input would be rejected. This helps to keep the database understandable and to avoid mistakes.
+
+----
+
+## INTEGER
+* Description: INTEGER stores integer numbers. If you need floating point variables, take a look at DOUBLE.
+* Range: `-2147483648` to `2147483647`, `-0` is interpreted and stored as `0`.
+* Note: This rather limited range is just provisional. It can be extended with low effort as soon as requested.
+
+----
+
+## DOUBLE
+* Description: DOUBLE stores floating point numbers with a double precision as defined by [IEEE 754](https://en.wikipedia.org/wiki/IEEE_floating_point).
+* Range:
+ * From `2.2250738585072014E-308` to `1.7976931348623157E308` (negative and positive) with a precision of 15 decimals.
+ * Any other decimal number _might work_ but it is not guaranteed.
+ * `-0`, `0`, `NaN`, `-inf` and `inf`
+* Note: The server generates a warning when the precision of the submitted DOUBLE value is to high to be preserved.
+
+----
+
+## DATETIME
+The DateTime data type exists in (currently) three flavors which are dynamically chosen during parsing on the the serverside. The flavors have different ranges, support of time zones and intended use cases. Only the first two flavors are actually implemented for storage and queries. The third one is implemented for queries exclusively.
+
+### UTCDateTime
+* Description: This DATETIME flavor stores values which represent a single point of time according to [UTC](https://en.wikipedia.org/wiki/Coordinated_Universal_Time) with the format specified by [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) (Combined date and time). It does support [UTC Leap Seconds](https://en.wikipedia.org/wiki/Leap_second) and time zones.
+* Range: From `-9999-01-01T00:00:00.0UTC` to `9999-12-31T23:59:59.999999999UTC` with nanosecond precision.
+* Examples:
+ * `2016-01-01T13:23:00.0CEST` which means _January 1, 2016, 1:23 PM, Central European Summer Time_.
+ * `-800-01-01T13:23:00.0` which means _January 1, 800 BC, 1:23 PM, UTC_.
+* Note:
+ * It is allowed to ommit the nanosecond part of a UTCDateTime (`2016-01-01T13:23:00CEST`). This indicates a precision of seconds for a UTCDateTime value.
+
+### Date
+ Description:: This DATETIME flavor stores values which represent a single date, month or year according to the [gregorian calendar](https://en.wikipedia.org/wiki/Gregorian_Calendar). A month/year is conceived as a single date with the presion of a month/year. This concept is useful if you try to understand the query semantics which are explained [elsewhere](./QueryLanguage#POVDateTime).
+ Format:: `Y[YYY][-MM[-dd]]` (where square brackets mean that the expression is optional).
+ Range:: Any valid date according to the gregorian calendar from `-9999-01-01` to `9999-12-31` (and respective dates with lower precision. E.g. the year `-9999`). There is no year `0`.
+* Note: Date is a specialization of [#SemiCompleteDateTime].
+
+### SemiCompleteDateTime
+* Description: A generalization of the _Date_ and _UTCDateTime_ flavors. In general, there is no time zone support. Although this flavor is not yet storable in general, it is implemented for search queries yet. I.e. you might search for `FIND ... date>2015-04-03T20:15` yet.
+* Format: `Y[YYY]['-MM[-dd[Thh:[mm[:ss[.ns]]]]]]]`.
+* Special Properties: For every SemiCompleteDateTime _d_ there exists a _Inclusive Lower Bound_ (`d.ILB`) and a _Exclusive Upper Bound_ (`d.EUB`). That means, a SemiCompleteDateTime can be interpreted as an interval of time. E.g. `2015-01` is the half-open interval `[2015-01-01T00:00:00.0, 2016-01-01T00:00:00.0)`. ILB and EUB are UTCDateTimes respectively. These properties are important for the semantics of the the query language, especialy the [operators](./QueryLanguage#POVDateTime).
+
+### Future Flavors
+Please file a new feature request as soon as you need them.
+* Time:: For a time of the day (without the date). Supports time zones.
+* FragmentaryDateTime:: For any fragmentary DateTime. That is an arbitrary combination of year, month, day of week, day of month, day of year, hour of day, minute, seconds (and nanoseconds). This flavor is useful for recurrent events like a bus schedule (_Saturday, 7:30_) or the time of a standing order for money transfer (_third day of the month_).
+
+----
+
+## REFERENCE
+* Description: REFERENCE values store the [Valid ID](./Glossary#valid-id) of an existing entity. The are useful to establish links between two entities.
+* Accepted Values: Any [Valid ID](./Glossary#valid-id) or [Valid Unique Existing Name](./Glossary#valid-unique-existing-name) or [Valid Unique Temporary ID](./Glossary#valid-unique-temporary-id) or [Valid Unique Prospective Name](./Glossary#valid-unique-prospective-pame).
+* Note:
+ * After beeing processed successfully by the server the REFERENCE value is normalized to a [Valid ID](./Glossary#valid-id). I.e. it is guaranteed that a REFERENCE value of a valid property is a positive integer.
+
+### FILE
+* Description: A FILE is a special REFERENCE. It only allows entity IDS which belong to a File.
+
+### RecordType as a data type
+* Furthermore, any RecordType can be used as a data type. This is a variant of the REFERENCE data type where any entity is a valid value which is a child of the RecordType in question.
+* Example:
+ * Let `Person` be a RecordType, `Bertrand Russel` be a child of `Person`. Then `Bertrand Russel` is a valid value for a property with a `Person` data type.
+
+## LIST
+* Description: A LIST is always a list of something which has another data type. E.g. A LIST of TEXT values, a LIST of REFERENCES value, etc. Here we call TEXT resp. REFERENCE the **Element Data Type**. The LIST data type allows you to store an arbitrary empty or non-empty ordered set (with duplicates) of values of the *same* data type into one property. Each value must be a valid value of the Element Data Type.
+* Example:
+ * LIST of INTEGER: ```[0, 2, 4, 5, 8, 2, 3, 6, 7]```
+ * LIST of Person, while `Person` is a RecordType: ```['Bertrand Russel', 'Mahatma Ghandi', 'Mother Therese']```
+
+
diff --git a/src/doc/specification/Fileserver.md b/src/doc/specification/Fileserver.md
new file mode 100644
index 00000000..fda2ec18
--- /dev/null
+++ b/src/doc/specification/Fileserver.md
@@ -0,0 +1,142 @@
+# Fileserver
+
+## Info
+There are several ways to utilize the file server component of HeartDB. It is possible to upload a file or a whole folder including subfolders via HTTP and the _drop off box_. It is possible to download a file via HTTP identified by its ID or by its path in the internal file system. Furthermore, it is possible to get the files metadata via HTTP as an xml.
+
+## File upload
+### Drop off box
+
+The drop off box is a directory on the HeartDB server's local file system, specified in the `server.conf` file in the server's basepath (something like `~/HeartDB/server/server.conf`). The key in the `server.conf` is called `dropoffbox`. Since the drop off box directory is writable for all, users can push their files or complete folders via a `mv` or a `cp` (recommended!) in that folder. The server deletes files older than their maximum lifetime (24 hours by default, specified `in server.conf`). But within their lifetime a user can prompt the server to pick up the file (or folder) from the drop off box in order to transfer it to the internal file system.
+
+Now, the user may send a pick up request to `POST http://host:port/mpidsserver/FilesDropOff` with a similar body:
+
+ <Post>
+ <File pickup="$path_dropoffbox" destination="$path_filesystem" description="$description" generator="$generator"/>
+ ...
+ </Post>
+
+where
+* $path_dropoffbox is the actual relative path of the dropped file or folder in the DropOffBox,
+* $path_filesystem is the designated relative path of that object in the internal file system,
+* $description is a description of the file to be uploaded,
+* $generator is the tool or client used for pushing this file.
+
+After a successful pick up the server will return:
+
+ <Response>
+ <File description="$description" path="$path" id="$id" checksum="$checksum" size="$size" />
+ ...
+ </Response>
+
+where
+* $id is the new generated id of that file and
+* $path is the path of the submitted file or folder relative to the file system's root.
+
+### HTTP upload stream
+#### Files
+
+There is an example on file upload using cURL described in detail in [the curl section of this wiki](manuals/curl/curl-access).
+
+File upload via HTTP is implemented in a [rfc1867](http://www.ietf.org/rfc/rfc1867.txt) consistent way. This is a de-facto standard that defines a file upload as a part of an HTML form submission. This concept shall not be amplified here. But it has to be noticed that this protocol is not designed for uploads of complete structured folders. Therefore the HeartDB file components have to impose that structure on the upload protocol.
+
+HeartDB's file upload resource does exclusively accept POST requests of MIME media type `multipart/form-data`. The first part of each POST body is expected to be a form-data text field, containing information about the files to be uploaded. It has to meet the following requirements:
+* `Content-type: text/plain; charset=UTF-8`
+* `Content-disposition: form-data; name="FileRepresentation"`
+
+If the content type of the first part is not `text/plain; charset=UTF-8` the server will return error 418. If the body is not actually encoded in UTF-8 the servers behaviour is not defined. If the field name of the first part is not `FileRepresentation` the server will return error 419.
+
+The body of that first part is to be an xml document of the following form:
+
+
+ <Post>
+ <File upload="$temporary_identifier" destination="$path_filesystem" description="$description" checksum="$checksum" size="$size"/>
+ ...
+ </Post>
+
+where
+* $temporary_identifier is simply a arbitrary name, which will be used to identify this `<File>` tag with a uploaded file in the other form-data parts.
+* $path_filesystem is the designated relative path of that object in the internal file system,
+* $description is a description of the file to be uploaded,
+* $size is the files size in bytes,
+* $checksum is a SHA-512 Hash of the file.
+
+The other parts (which must be at least one) may have any appropriate media type. `application/octet-stream` is a good choice for it is the default for any upload file according to [rfc1867](http://www.ietf.org/rfc/rfc1867.txt). Their field name may be any name meeting the requirements of [rfc1867](http://www.ietf.org/rfc/rfc1867.txt) (most notably they must be unique within this POST). But in order to identify the corresponding xml file representation of each file the `filename` parameter of the content-disposition header has to be set to the proper $temporary_identifier. The Content-disposition type must be `form-data`:
+* `Content-disposition: form-data; name="$any_name"; filename="$temporary_identifier"`
+
+Finally the body of these parts have to contain the file encoded in the proper `Content-Transfer-Encoding`.
+
+
+If a file part has a `filename` parameter which doesn't occur in the xml file representation the server will return error 420. The file will not be stored anywhere. If an xml file representation has no corresponding file to be uploaded (i.e. there is no part with the same `filename`) the server will return error 421. Some other error might occur if the checksum, the size, the destination etc. are somehow corrupted.
+
+#### Folders
+
+Uploading folders works in a similar way. The first part of the `multipart/form-data` document is to be the representation of the folders:
+
+
+ <Post>
+ <File upload="$temporary_identifier" destination="$path_filesystem" description="$description" checksum="$checksum" size="$size"/>
+ ...
+ </Post>
+
+The root folder is represented by a part which has a header of the form:
+* `Content-disposition: form-data; name="$any_name"; filename="$temporary_identifier/"`
+The slash at the end of the `filename` indicates that this is a folder, not a file. Consequently, the body of this part will be ignored and should be empty.
+Any file with the name `$filename` in the root folder is represented by a part which has a header of the form:
+* `Content-disposition: form-data; name="$any_name"; filename="$temporary_identifier/$filename"`
+Any sub folder with the name `$subfolder` is represented by a part which has a header of the form:
+* `Content-disposition: form-data; name="$any_name"; filename="$temporary_identifier/$subfolder/"`
+
+Likewise, a complete directory tree can be transfered by appending the structure to the `filename` header field.
+
+**Example**:
+Given the structure
+
+ rootfolder/
+ rootfolder/file1
+ rootfolder/subfolder/
+ rootfolder/subfolder/file2
+
+an upload document would have the following form:
+
+ ... (HTTP Header)
+ Content-type: multipart/form-data, boundary=AaB03x
+
+ --AaB03x
+ content-disposition: form-data; name="FileRepresentation"
+
+ <Post>
+ <File upload="tmp1234" destination="$path_filesystem" description="$description" checksum="$checksum" size="$size"/>
+ </Post>
+
+ --AaB03x
+ content-disposition: form-data; name="random_name1"; filename="temp1234/"
+
+ --AaB03x
+ content-disposition: form-data; name="random_name1"; filename="temp1234/file1"
+
+ Hello, world! This is file1.
+
+ --AaB03x
+ content-disposition: form-data; name="random_name1"; filename="temp1234/subfolder/"
+
+ --AaB03x
+ content-disposition: form-data; name="random_name1"; filename="temp1234/subfolder/file2"
+
+ Hello, world! This is file2.
+
+ --AaB03x--
+
+
+(**Timm 2014-06-17: to be continued**)
+
+## Consistency checks
+To start a consistency check on either the complete file system or a subdirectory, add the `fileStorageConsistency` flag to a retrieve query. In a `GET` request, simply add `...?fileStorageConsistency=<OPTIONS>` to the URL. Possible options are (currently, only one of them?):
+
+- `-t <TIMEOUT>` :: The timeout for the query (in seconds?)
+- `-c <TESTCASE>` :: To trigger internal test cases.
+- `<PATH>` :: The path in the file system where searching files should start. If omitted or `\`, the full file system will be checked.
+
+One example, using curl and an existing cookie:
+`curl -X GET -G -b cookie.txt -d "fileStorageConsistency=Analysis/VideoAnalysis/masks/" --insecure "https://<SERVER>/Entity/12345"`
+
+
diff --git a/src/doc/specification/Paging.md b/src/doc/specification/Paging.md
new file mode 100644
index 00000000..fb994639
--- /dev/null
+++ b/src/doc/specification/Paging.md
@@ -0,0 +1,25 @@
+# Paging
+The Paging flag splits the retrieval of a (possibly huge) number entities into pages.
+
+## Syntax
+
+
+ flag = name, [":", value];
+ name = "P";
+ value = [ index ], ["L", length]];
+ index = ? any positive integer ?;
+ length = ? any positive integer ?;
+
+## Semantics
+
+The `index` (starting with zero) denotes the index of the first entity to be retrieved. The `length` is the number of entities on that page. If `length` is omitted, the default number of entities is returned (as configured by a server contant called ...). If only the `name` is given the paging behaves as if the `index` has been zero.
+
+## Examples
+
+`http://localhost:8123/mpidsserver/Entities/all?flags=P:24L50` returns 50 entities starting with the 25th entity which would be retrieved without paging.
+
+`http://localhost:8123/mpidsserver/Entities/all?flags=P:24` returns the default number of entities starting with the 25th entity which would be retrieved without paging.
+
+`http://localhost:8123/mpidsserver/Entities/all?flags=P:L50` returns 50 entities starting with the first entity which would be retrieved without paging.
+
+`http://localhost:8123/mpidsserver/Entities/all?flags=P` returns the default number of entities starting with the first entity which would be retrieved without paging.
diff --git a/src/doc/specification/Record.md b/src/doc/specification/Record.md
new file mode 100644
index 00000000..1e43e372
--- /dev/null
+++ b/src/doc/specification/Record.md
@@ -0,0 +1,367 @@
+# Record
+
+
+= GET records =
+
+HTTP-GET-requests are to be send to `http://${host}:${port}/mpidsserver/Record/...`. Default port is 8123.
+
+### Get single record
+
+{{{
+GET http://${host}:${port}/mpidsserver/Record/1
+}}}
+
+returns in case of success:
+
+
+ <Response id="1353783822304" generated="2012-11-23 11:10:50.507" items="1">
+ <Record id="1" generator="X23" timestamp="2012-09-22 00:56:03.0" recordtypename="Experiment" recordtypeid="1">
+ <Property id="4" name="id" type="integer" description="identifier" exponent="0" importance="recommended">100111327</Property>
+ <Property id="1" name="explanation" type="text" description="explains the thing" importance="obligatory">Here comes the explanation</Property>
+ <Property id="6" name="startDate" type="datetime" description="start" importance="obligatory">2010-01-20 20:15:00.0</Property>
+ </Record>
+ </Response>
+
+
+If a requested record didn't exist, it returns:
+
+
+ <Response id="1354256823059" generated="2012-11-23 11:17:06.754" items="1">
+ <Record id="1">
+ <Error code="101" description="Record does not exist. "/>
+ </Record>
+ </Response>
+
+### Get multiple records
+
+{{{
+GET http://${host}:${port}/mpidsserver/Record/1&2
+}}}
+
+returns in case of success:
+
+
+ <Response id="1354570488723" generated="2012-11-23 11:12:33.666" items="2">
+ <Record id="1" generator="X23" timestamp="2012-09-22 00:56:03.0" recordtypename="Experiment" recordtypeid="1">
+ <Property id="4" name="id" type="integer" description="identifier" exponent="0" importance="recommended">100111327</Property>
+ <Property id="1" name="explanation" type="text" description="explains the thing" importance="obligatory">Here comes the explanation</Property>
+ <Property id="6" name="startDate" type="datetime" description="start" importance="obligatory">2010-01-20 20:15:00.0</Property>
+ </Record>
+ <Record id="2" generator="G22" timestamp="2012-09-22 00:56:03.0" recordtypename="Heart" recordtypeid="6">
+ <Property id="9" name="weightg" type="double" unit="g" description="weight in g" exponent="0" importance="obligatory">1000.0</Property>
+ </Record>
+ </Response>
+
+Same behavior as above if one of these didn't exist.
+
+## POST records
+
+The POST-requests are to be send to `http://${host}:${port}/mpidsserver/Record`. Default port is 8123.
+
+### Post single record
+
+*HTTP body:*
+
+
+ <Post>
+ <Record generator="Timm" recordtypeid="1">
+ <Property id="6">2012-12-24 18:00:00</Property>
+ <Property id="1">We investigate if Santa Clause does fit down the chimney</Property>
+ </Record>
+ </Post>
+
+| Remarks |
+|---------|
+* The obligatory root tag is `<Post>`
+* A record has to have a `generator="..."` attribute and a _recordtype_ (i.e. a `recordtypeid="..."` or `recordtypename="..."` attribute).
+* Depending on the _recordtype_ of the posted _record_ there are several _concrete properties_ that must be definded (they are _obligatory_).
+
+In case of success the response will look like:
+
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response id="1353708657159" generated="2012-11-23 11:55:41.223" items="1">
+ <Record id="272" generator="Timm" timestamp="2012-11-23 10:55:43.0" recordtypename="Experiment" recordtypeid="1">
+ <Property id="6" name="startDate" type="datetime" description="start" importance="obligatory">2012-12-24 18:00:00.0</Property>
+ <Property id="1" name="explanation" type="text" description="explains the thing" importance="obligatory">We investigate if Santa Clause does fit down the chimney</Property>
+ </Record>
+ </Response>
+
+| Remarks |
+|---------|
+* The responces contains the whole record as it lies in the database now. That entails it's final `id`, a timestamp (`generated` attribute) and a full description of the properties with name, type, descpription and so on.
+* For further specifications of the _concrete properties_ see [wiki:ConcreteProperty].
+
+#### Erroneous properies
+
+Now, there are a couple of errors that can occur (cf. [wiki:errorcodes]). The errors that occur due to corrupt concrete properies are described in [wiki:ConcreteProperty]. If any Errors occur on the level of properties, the whole record is handled as unqualified to be posted. Suppose the post body reads
+
+
+ <Post>
+ <Record generator="Timm" recordtypeid="1">
+ <Property id="6">Christmas Eve</Property>
+ <Property id="1">Does Santa Clause fit down the chimney</Property>
+ </Record>
+ </Post>
+
+The first property cannot be parsed to a datetime format. Therefore, the response will be
+
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response id="1354575364020" generated="2012-11-23 12:37:20.045" items="1">
+ <Record generator="Timm" recordtypename="Experiment" recordtypeid="1">
+ <Error code="103" description="Record has unqualified Properties. " />
+ ...
+ </Record>
+ </Response>
+
+| Remarks |
+|---------|
+* The error "Record has unqualified Properties" occures whenever the posted concrete properties of the record are corrupt (i.e. any `<Error>` tag is child of a `<Property>` tag).
+* Erroneous records are not stored to the database.
+
+#### Erroneous record tags
+
+1) If the recordtype hasn't been indicated, the server returns
+
+
+ ...
+ <Error code="105" description="Record has no RecordType. " />
+ ...
+
+2) The indicated recordtype does not exist:
+
+
+ ...
+ <Error code="105" description="Record's RecordType does not exist. " />
+ ...
+view Tickets #16 #17
+
+3) The generator has not been indicated:
+
+
+ ...
+ <Error code="105" description="Record has no Generator. " />
+ ...
+
+4) The record's _recordtype_ demands for a property that isn't present:
+
+
+ <Post>
+ <Record generator="Timm" recordtypeid="1">
+ <Property id="6">2012-12-24 18:00:00</Property>
+ </Record>
+ </Post>
+
+returns:
+
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response id="1354701618532" generated="2012-11-23 13:25:41.59" items="1">
+ <Record generator="Timm" recordtypename="Experiment" recordtypeid="1">
+ <Error code="102" description="Obligatory Property 1 (explanation) is missing. " />
+ <Property id="6" name="startDate" type="datetime" description="start" importance="obligatory">2012-12-24 18:00:00.0</Property>
+ </Record></Response>
+
+
+5) Record does'nt entail any properties:
+
+
+ ...
+ <Error code="105" description="Record has no Properties. " />
+ ...
+
+6) The indicated ID and name of a _recordtype_ are mismatching (at least one of them exists but they don't correspond to each other).
+
+
+ ...
+ <Error code="105" description="Record has invalid RecordType (Name/ID mismatch). " />
+ ...
+
+
+### Post multiple records
+
+It is possible to post several records in one go. Here we go through a few scenarios with independent sets of records and closely intertwined ones.
+
+#### Independent records
+
+*HTTP body:*
+
+
+ <Post>
+ <Record generator="Timm" recordtypeid="1">
+ ... (properties) ...
+ </Record>
+ <Record generator="Timm" recordtypeid="1">
+ ... (properties) ...
+ </Record>
+ ... (more records) ...
+ </Post>
+
+returns:
+
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response id="1356209136586" generated="2012-11-30 11:33:39.897" items="2">
+ <Record id="274" generator="Timm" timestamp="2012-11-30 10:33:41.0" recordtypename="Experiment" recordtypeid="1">
+ ... (properties) ...
+ </Record>
+ <Record id="275" generator="Timm" timestamp="2012-11-30 10:33:41.0" recordtypename="Experiment" recordtypeid="1">
+ ... (properties) ...
+ </Record>
+ ... (more records) ...
+ </Response>
+
+#### Non-circular interdependent records:
+
+*HTTP body:*
+
+
+ <Post>
+ <Record generator="Timm" recordtypeid="1">
+ <Property id="10">-1</Property>
+ ... (more properties) ...
+ </Record>
+ <Record id="-1" generator="Timm" recordtypeid="1">
+ ... (properties) ...
+ </Record>
+ ... (more records) ...
+ </Post>
+
+returns:
+
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response id="1354608915619" generated="2012-11-30 11:40:35.369" items="2">
+ <Record id="277" generator="Timm" timestamp="2012-11-30 10:40:37.0" recordtypename="Experiment" recordtypeid="1">
+ <Property id="10" name="experiment" type="reference" reference="1" description="reference to experiment" importance="suggested">276</Property>
+ ... (more properties) ...
+ </Record>
+ <Record id="276" generator="Timm" timestamp="2012-11-30 10:40:37.0" recordtypename="Experiment" recordtypeid="1">
+ ... (properties) ...
+ </Record>
+ ... (more records) ...
+ </Response>
+
+| Remarks |
+|---------|
+* The record that is to be referenced by another gets an id less than zero (id="-1"). This id is provisional and will be replaced by the final id, which is the one the record is stored with in the database, in the response (id="276").
+
+#### Circular dependent records
+
+*HTTP body:*
+
+
+ <Post>
+ <Record id="-2" generator="Timm" recordtypeid="1">
+ <Property id="10">-1</Property>
+ ... (more properties) ...
+ </Record>
+ <Record id="-1" generator="Timm" recordtypeid="1">
+ <Property id="10">-2</Property>
+ ... (more properties) ...
+ </Record>
+ ... (more records) ...
+ </Post>
+
+returns:
+
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response id="1354698071005" generated="2012-11-30 11:52:28.789" items="2">
+ <Record id="278" generator="Timm" timestamp="2012-11-30 10:52:30.0" recordtypename="Experiment" recordtypeid="1">
+ <Property id="10" name="experiment" type="reference" reference="1" description="reference to experiment" importance="suggested">279</Property>
+ ... (more properties) ...
+ </Record><Record id="279" generator="Timm" timestamp="2012-11-30 10:52:30.0" recordtypename="Experiment" recordtypeid="1">
+ <Property id="10" name="experiment" type="reference" reference="1" description="reference to experiment" importance="suggested">278</Property>
+ ... (more properties) ...
+ </Record>
+ ... (more records) ...
+ </Response>
+
+| Remarks |
+|---------|
+* Likewise,records that are to be referenced by each other get ids less than zero (id="-1" and id="-2"). These are provisional and will be replaced by the final ids in the response (id="278" and id="279").
+
+
+#### Erroneous multi-posts
+
+1) If any error occurs in a single record, all correct records are nevertheless stored (In future this behavior should be controlled better by an _atomic flag_. See #18).
+
+2) If a referenced record is corrupt, the referencing record is marked with an error tag equally.
+
+*HTTP body:*
+
+
+ <Post>
+ <Record generator="Timm" recordtypeid="1">
+ <Property id="10">-1</Property>
+ ... (more properties) ...
+ </Record>
+ <Record id="-1" generator="Timm" recordtypeid="1">
+ <Property id="1">Explanation2</Property>
+ <!-- obligatory property 6 is missing -->
+ </Record>
+ ... (more records) ...
+ </Post>
+
+returns:
+
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response id="1356334296695" generated="2012-11-30 12:14:37.246" items="2">
+ <Record id="-2" generator="Timm" recordtypename="Experiment" recordtypeid="1">
+ <Error code="103" description="Record has unqualified Properties. " />
+ <Property id="10" name="experiment" type="reference" reference="1" description="reference to experiment" importance="suggested">
+ <Error code="204" description="Referenced Record is unqualified. " />
+ -1
+ </Property>
+ ... (more properties) ...
+ </Record>
+ <Record id="-1" generator="Timm" recordtypename="Experiment" recordtypeid="1">
+ <Error code="102" description="Obligatory Property 6 (startDate) is missing. " />
+ <Property id="1" name="explanation" type="text" description="explains the thing" importance="obligatory">Explanation2</Property>
+ </Record>
+ ... (more records) ...
+ </Response>
+
+3) Self-referencing is not allowed. A self-referencing record will return
+
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response id="1355236745833" generated="2012-11-30 12:18:45.066" items="1">
+ <Record id="-2" generator="Timm" recordtypename="Experiment" recordtypeid="1">
+ <Error code="104" description="Self-referencing is not allowed. " />
+ <Property id="10" name="experiment" type="reference" reference="1" description="reference to experiment" importance="suggested">-2</Property>
+ ... (more properties) ...
+ </Record>
+ ... (more records) ...
+ </Response>
+
+4) Referencing a non-existing provisional id will return (cf. #19):
+
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response id="1354990914009" generated="2012-11-30 13:07:00.45" items="1">
+ <Record generator="Timm" recordtypename="Experiment" recordtypeid="1">
+ <Error code="104" description="Referenced record does not exist. " />
+ <Property id="10" name="experiment" type="reference" reference="1" description="reference to experiment" importance="suggested">-2</Property>
+ ... (more properties) ...
+ </Record>
+ ... (more records) ...
+ </Response>
+
+= DELETE records =
+
+HTTP-DELETE-requests are to be send to `http://${host}:${port}/mpidsserver/Record/...`. Default port is 8123.
+
+*Example*
+{{{
+DELETE http://${host}:${port}/mpidsserver/Record/1&2&3&4
+}}}
+
+
+
+
+
+
diff --git a/src/doc/specification/RecordType.md b/src/doc/specification/RecordType.md
new file mode 100644
index 00000000..068c433d
--- /dev/null
+++ b/src/doc/specification/RecordType.md
@@ -0,0 +1,164 @@
+# RecordType
+----
+## Overview
+RecordTypes function as templates for [[Record|Records]], they provide a description for a type of Record and define which [[Property|Properties]] should be present. Properties come with an _importance_ attribute which tells the user or client program how strongly necessary the Property is. (As all other entities,) RecordTypes can be inherited from other RecordTypes (or any Entities). When RecordTypes inherit from other RecordTypes, the _inheritance_ flag tells which properties shall be inherited.
+
+### Importance
+
+Importances are more of a recommendation, Records with omitted Properties can technically still be committed.
+
+| *Importance* | *Meaning* | *Consequence when omitted* |
+|--------------|----------------------|----------------------------|
+| `OBLIGATORY` | Property must be present | *FIXME* Can be forced to be committed the server, but usually an error will be returned. |
+| `RECOMMENDED` | Property should be present (makes sense for most users) | *FIXME* Usually an error will be returned? |
+| `SUGGESTED` (*FIXME* the default?) | Property may be present (may make sense for some users) | *FIXME* No negative consequence? |
+
+*FIXME* Did I get recommended and suggested right?
+
+### Inheritance
+
+The _inheritance_ flag decides which [[Property|Properties]] are inherited from parents.
+
+| *Inheritance* | *Meaning* |
+|----------------|-----------|
+| _None_ (default) | Nothing is being inherited |
+| `OBLIGATORY` | *FIXME* Properteis of importance `OBLIGATORY` and above? |
+| `SUGGESTED` | *FIXME* Properteis of importance `SIGGESTED` and above, so the same effect as `ALL`? |
+| `ALL` | Copy everything from the parent. |
+| `FIX` | *FIXME* in `tests/test_inheritance.py` of pyint_test this is used, what does it mean???|
+
+
+## Examples
+### GET Requests
+#### Single-Get
+*Request:*
+
+ GET http://localhost:8122/mpidsserver/RecordType/1
+
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <RecordType id="1" name="Experiment" description="Description Experiment">
+ <Property id="1" name="explanation" type="text" description="explains the thing" importance="obligatory" />
+ <Property id="4" name="id" type="integer" description="identifier" exponent="0" importance="recommended" />
+ <Property id="6" name="startDate" type="datetime" description="start" importance="obligatory" />
+ <Property id="7" name="stopDate" type="datetime" description="stop" importance="recommended" />
+ <Property id="12" name="file" type="file" description="file" importance="suggested" />
+ </RecordType>
+ </Response>
+----
+#### Multi-Get
+*Request:*
+
+ GET http://localhost:8122/mpidsserver/RecordType/1&2&3
+
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <RecordType id="1" name="Experiment" description="Description Experiment">
+ <Property id="1" name="explanation" type="text" description="explains the thing" importance="obligatory" />
+ <Property id="4" name="id" type="integer" description="identifier" exponent="0" importance="recommended" />
+ <Property id="6" name="startDate" type="datetime" description="start" importance="obligatory" />
+ <Property id="7" name="stopDate" type="datetime" description="stop" importance="recommended" />
+ <Property id="12" name="file" type="file" description="file" importance="suggested" />
+ </RecordType>
+ <RecordType id="2" name="Measurement" description="Description Measurement">
+ <Property id="1" name="explanation" type="text" description="explains the thing" importance="obligatory" />
+ <Property id="4" name="id" type="integer" description="identifier" exponent="0" importance="recommended" />
+ <Property id="6" name="startDate" type="datetime" description="start" importance="obligatory" />
+ <Property id="7" name="stopDate" type="datetime" description="stop" importance="recommended" />
+ <Property id="12" name="file" type="file" description="file" importance="suggested" />
+ </RecordType>
+ <RecordType id="3" name="Video" description="Description Video">
+ <Property id="1" name="explanation" type="text" description="explains the thing" importance="recommended" />
+ <Property id="6" name="startDate" type="datetime" description="start" importance="recommended" />
+ <Property id="12" name="file" type="file" description="file" importance="obligatory" />
+ </RecordType>
+ </Response>
+----
+#### Get all
+*Request:*
+
+ GET http://localhost:8122/mpidsserver/RecordType/
+ GET http://localhost:8122/mpidsserver/RecordType
+
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response />
+[View Ticket #2](http://dev.bmp.ds.mpg.de/heartdb/ticket/2)
+
+----
+### POST Requests
+
+*Request is to be send to:*
+
+ POST http://localhost:8122/mpidsserver/RecordType/
+ POST http://localhost:8122/mpidsserver/RecordType/
+----
+#### Single-Post
+*HTTP Body:*
+
+ <Post>
+ <RecordType name="TimmsRecordType11" >
+ <Property id="3" importance="recommended"/>
+ <Property id="4" importance="obligatory"/>
+ <Property name="age" />
+ </RecordType>
+ </Post>
+
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <RecordType id="40" name="TimmsRecordType11">
+ <Property id="3" name="name" type="text" description="Name" importance="recommended" />
+ <Property id="4" name="id" type="integer" description="identifier" importance="suggested" />
+ </RecordType>
+ </Response>
+----
+#### Multi-Post
+*HTTP Body:*
+
+ <Post>
+ <RecordType name="TimmsRecordType11" >
+ <Property id="3" importance="recommended"/>
+ <Property id="4" importance="obligatory"/>
+ <Property name="age" />
+ </RecordType>
+ <RecordType name="TimmsRecordType12" >
+ <Property id="6" importance="recommended"/>
+ <Property id="7" importance="obligatory"/>
+ <Property id="15" />
+ </RecordType>
+ </Post>
+
+*Response:*
+
+ <?xml version="1.0" encoding="UTF-8"?>
+ <Response>
+ <RecordType id="40" name="TimmsRecordType11" description="null">
+ <Property id="3" name="name" type="text" description="Name" importance="recommended" />
+ <Property id="4" name="id" type="integer" description="identifier" importance="suggested" />
+ <Property id="3" name="name" type="text" description="Name" importance="recommended" />
+ <Property id="4" name="id" type="integer" description="identifier" exponent="0" importance="suggested" />
+ </RecordType>
+ <RecordType id="41" name="TimmsRecordType12">
+ <Property id="6" name="startDate" type="datetime" description="start" importance="recommended" />
+ <Property id="7" name="stopDate" type="datetime" description="stop" importance="suggested" />
+ <Property id="15" name="TimmsIntProperty" type="integer" unit="kg" description="This is TimmsIntProperty" importance="suggested" />
+ </RecordType>
+ </Response>
+
+= DELETE RecordTypes =
+
+HTTP-DELETE-requests are to be send to `http://${host}:${port}/mpidsserver/RecordType/...`. Default port is 8123.
+
+*Example*
+{{{
+DELETE http://${host}:${port}/mpidsserver/RecordType/1&2&3&4
+}}}
+
diff --git a/src/doc/specs/Server-side-scripting.md b/src/doc/specification/Server-side-scripting.md
similarity index 86%
rename from src/doc/specs/Server-side-scripting.md
rename to src/doc/specification/Server-side-scripting.md
index 49f56af6..18dfe9ea 100644
--- a/src/doc/specs/Server-side-scripting.md
+++ b/src/doc/specification/Server-side-scripting.md
@@ -1,21 +1,24 @@
# Server-Side Scripting API (v0.1)
-The CaosDB Server can execute scripts (bash/python/perl) and compiled executables. The scripts can be invoked by a remote-procedure-call (RPC) protocol. Both, the requirements for the scripts and the RPC are described in this document.
+The CaosDB Server can execute scripts (bash/python/perl) and
+compiled executables. The scripts can be invoked by a remote-procedure-call
+(RPC) protocol. Both, the requirements for the scripts and the
+RPC are described in this document.
## Configuration of the Server
-* The CaosDB Server has two relevant properties:
- 1. `SERVER_SIDE_SCRIPTING_BIN_DIR` is the directory where executable scripts are to be placed. The server will not execute scripts which are out side of this directory. This directory must be readable and executable for the server. But it should not be readable or executable for anyone else.
- 2. `SERVER_SIDE_SCRIPTING_WORKING_DIR` is the directory under which the server creates temporary working directories. The server needs writing, reading and executing permissions. The temporary working directories are deleted after the scripts have finished and the server has collected the results of the scripts.
+The CaosDB Server has two relevant properties:
-## Installing a Server-Side Script (SSS)
+### `SERVER_SIDE_SCRIPTING_BIN_DIR`
+is the directory where executable scripts are to be placed. The server will not execute scripts which are out side of this directory. This directory must be readable and executable for the server. But it should not be readable or executable for anyone else.
+Executable files in this directory or its subdirectories are called `SSS`.
-* Put your script into the `SERVER_SIDE_SCRIPTING_BIN_DIR` or in any subdirectory and make it executable. Executable files below this directory are called `SSS`.
-* All other files in that directory MUST be ignored by the server, i.e. the server will never call them directly.
+All other files in that directory MUST be ignored by the server, i.e. the server will never call them directly.
However, they MAY contain additional data, different implementations, libraries etc.
-* A symlink pointing to an executable MUST be treated as SSS, too.
-### Example SERVER\_SIDE\_SCRIPTING\_BIN\_DIR
+A symlink pointing to an executable MUST be treated as SSS, too.
+
+#### Example SERVER\_SIDE\_SCRIPTING\_BIN\_DIR
```
/
@@ -34,6 +37,10 @@ The files `scripts1.py`, `scripts2.sh`, `scripts3.pl` and `another_script.py` ar
Also the `script4` can be called which would result in calling `another_script.py`
The script5 points to an executable which is not stored in the `SSD_DIR`.
+### `SERVER_SIDE_SCRIPTING_WORKING_DIR`
+is the directory under which the server creates temporary working directories. The server needs writing, reading and executing permissions. The temporary working directories are deleted after the scripts have finished and the server has collected the results of the scripts.
+
+
## Calling a Server-Side Script Via Remote Procedure Call
* Users can invoke scripts via HTTP under the uri `https://$HOST:$HTTPS_PORT/$CONTEXT_ROOT/scripting`. The server accepts POST requests with content types `application/x-www-form-urlencoded` and `multipart/form-data`.
@@ -54,7 +61,7 @@ The script5 points to an executable which is not stored in the `SSD_DIR`.
* If a file form field has a field name which begins with either `-p` or `-O` the file name with prefix `.upload_files/` is passed as value of an option or as a positional argument to the script. Thus it is possible to distinguish several uploaded files from one another.
* If there is a "auth-token" field present, another command line options `--auth-token=...` is appended. The value is either the string which was submitted with the POST request, or, if the value was "generate", a refreshed, valid AuthToken which authenticates as the user of the request (why? see below).
-### Example HTML Form
+## Example HTML Form
```html
<form action="/scripting" method="post" enctype="multipart/form-data">
@@ -73,6 +80,7 @@ where the user uploads `my.conf` as `-Oconfig-file` and `my.input.tsv` as `-p1`,
```
$SERVER_SIDE_SCRIPTING_BIN_DIR/my/script.py --config-file=.upload_files/my.conf --algorithm=fast analyze .upload_files/my.input.tsv
```
+
## CaosDB Server Response
The CaosDB Server responds with an xml document. The root element is the usual `/Response`. If no errors occurred (which would be represented with `/Response/Error` elements) the result of the script execution is represented as a `/Response/script/` element.
diff --git a/src/doc/specification/Specification-of-the-Entity-API.md b/src/doc/specification/Specification-of-the-Entity-API.md
new file mode 100644
index 00000000..93b39f53
--- /dev/null
+++ b/src/doc/specification/Specification-of-the-Entity-API.md
@@ -0,0 +1,191 @@
+# Specification of the Entity API
+Version: 0.1.0r1
+
+Author: Timm Fitschen
+
+Email: timm.fitschen@ds.mpg.de
+
+Date: 2017-12-17
+
+## Introduction
+
+CaosDB is a database management system that stores it's data into `Entities`. An `Entity` can be thought of as the equivalent to tables, rows, columns and the tuples that fill the tables of a traditional RDBMS. Entities are not only used to store the data they also define the structure of the data.
+
+## Formal Definition
+
+An `Entity` may have
+
+* a `domain`
+* an `id`
+* a `role`
+* a `name`
+* a `data type`
+* a `Set of Values`
+* a `Set of Properties`
+* a `Set of Parents`
+
+A `domain` contains an `Entity`.
+
+An `id` is an arbitrary string.
+
+A `role` is an arbitrary string. Especially, it may be one of the following strings:
+
+* `RecordType`
+* `Record`
+* `Relation`
+* `Property`
+* `File`
+* `QueryTemplate`
+* `Domain`
+* `Unit`
+* `Rule`
+* `DataType`
+* `Remote`
+
+A `name` is an arbitrary string.
+
+A `data type` contains an `Entity`. Note: this is not necessarily a `Data Type`.
+
+### Set of Values
+
+A `Set of Values` is a mapping from a `indices` to a finite set of `Values`.
+
+An `index` is an interval of non-negative integers starting with zero.
+
+#### Value
+
+A `Value` may have a `data type` and/or a `unit`.
+
+A `data type` is an `Entity`. Note: this is not necessarily a `Data Type`.
+
+A `unit` is an arbitrary string.
+
+### Data Type
+
+A `Data Type` is an `Entity` with role `DataType`.
+
+#### Reference Data Type
+
+A `Reference Data Type` is a `Data Type`. It may have a `scope`.
+
+A `scope` contains an `Entity`.
+
+#### Collection Data Type
+
+A `Collection Data Type` is a `Data Type`. It may have an ordered set of `elements`.
+
+### Record Type
+
+A `Record Type` is an `Entity` with role `RecordType`.
+
+### Record
+
+A `Record` is an `Entity` with role `Record`.
+
+### Relation
+
+A `Relation` is an `Entity` with role `Relation`.
+
+### Property
+
+A `Property` is an `Entity` with role `Property`. It is also refered to as `Abstract Property`.
+
+### File
+
+A `File` is an `Entity` with role `File`.
+
+A `File` may have
+
+* a `path`
+* a `size`
+* a `checksum`
+
+A `path` is an arbitrary string.
+
+A `size` is a non-negative integer.
+
+A `checksum` is an ordered pair (`method`,`result`).
+
+A `method` is an arbitrary string.
+
+A `result` is an arbitrary string.
+
+### QueryTemplate
+
+A `QueryTemplate` is an `Entity` with role `QueryTemplate`.
+
+### Domain
+
+A `Domain` is an `Entity` with role `Domain`.
+
+### Unit
+
+A `Unit` is an `Entity` with role `Unit`.
+
+### Rule
+
+A `Rule` is an `Entity` with role `Rule`.
+
+### Remote
+
+A `Remote` is an `Entity` with role `Remote`.
+
+### Set of Parents
+
+A `Set of Parents` is a set of `Parents`.
+
+#### Parent
+
+A `Parent` may contain another `Entity`.
+
+A `Parent` may have an `affiliation`.
+
+An `affiliation` may contain of the following strings:
+
+* `subtyping`
+* `instantiation`
+* `membership`
+* `parthood`
+* `realization`
+
+### Set of Properties
+
+A `Set of Properties` is a tripple (`index`, set of `Implemented Properties`, `Phrases`).
+
+An `index` is a bijective mapping from an interval of non-negative integer numbers starting with zero to the set of `Implemented Properties`.
+
+#### Implemented Property
+
+An `Implemented Property` contains another `Entity`.
+
+An `Implemented Property` may have an `importance`.
+
+An `Implemented Property` may have a `maximum cardinality`.
+
+An `Implemented Property` may have a `minimum cardinality`.
+
+An `Implemented Property` may have an `import`.
+
+An `importance` is an arbitrary string. It may contain of the following strings:
+
+* `obligatory`
+* `recommended`
+* `suggested`
+* `fix`
+
+A `maximum cardinality` is a non-negative integer.
+
+A `minimum cardinality` is a non-negative integer.
+
+An `import` is an arbitrary string. It may contain of the following strings:
+
+* `fix`
+* `none`
+
+#### Phrases
+
+`Phrases` are a mapping from the cartesian product of the `index` with itself to a `predicate`.
+
+A `predicate` is an arbitrary string.
+
+
diff --git a/src/doc/specification/Specification-of-the-Message-API.md b/src/doc/specification/Specification-of-the-Message-API.md
new file mode 100644
index 00000000..fc08b343
--- /dev/null
+++ b/src/doc/specification/Specification-of-the-Message-API.md
@@ -0,0 +1,167 @@
+# Specification of the Message API
+## Introduction
+
+API Version 0.1.0
+
+A Message is a way of communication between the server and a client. The main purpose is to inform the clients about errors which occured during transactions, issue warnings when entities have a certain state or just explicitly confirm that a transaction was successful. Messages represents information that is not persistent or just the reproducible outcome of a transaction. Messages are not stored aside from logging.
+
+## Message Classes And Their Properties
+
+### Message (generic super class)
+
+A `Message` must be either a `Server Message` or a `Client Message`.
+
+A `Message` must have a `description`. A `description` is a string and a human-readable explanation of the meaning and/or purpose of the message. The description must not have leading or trailing whitespaces. The description should be kept in English. For the time being there is no mechanism to indicate that the description is written in other languages. This could be changed in later versions of this API.
+
+### Server Message
+
+A `Server Message` is a Message issued by the server. It must not be issued by clients.
+
+A `Server Message` may be either a `Standard Server Message` or a `Non-Standard Server Message`
+
+#### Standard Server Message
+
+A `Standard Server Message` is one of a set of predefined messages with a certain meaning. The set of these `Standard Server Messages` is maintained and documented in the Java code of the server. There should be a server resource for these definitions in order to have a always up-to-date documentation of the messages on every server.
+
+A `Standard Server Message` must have an `id`. An `id` is a non-empty string that uniquely identifies a standard server message. An id should consist only of ASCII compliant upper-case Latin alphabetic letters from `A` to `Z` and the underscore character `_`.
+An `id` of a `Standard Server Message` must not start with the string `NSSM_`.
+
+A `Standard Server Message` must have a `type`. A `type` is one these strings: `Info`, `Warning`, `Error`, or `Success`.
+
+##### Error Message
+
+A `Server Message` with type `Error` is also called `Error Message` and sometimes just `Error`. An `Error Message` indicates that a request has *failed*. It informs about the reasons for that failure or the nature of the problems which occurred. The description of each error message should explain the error and indicate if and how the client can remedy the problems with her request.
+
+##### Warning Message
+
+A `Server Message` with type `Error` is also called `Warning Message` and sometime just `Warning`. A `Warning Message` indicates that certain *irregularities* occurred during the processing of the request or that the client requested something that is *not recommended but not strictly forbidden*.
+
+##### Info Message
+
+A `Server Message` with type `Info` is also called `Info Message` and sometimes just `Info`. An `Info Message` is a means to inform the client about *arbitrary events* which occurred during the processing of the request and which are *not* to be considered *erroneous* or *non-recommended*. These info messages are primarily intended to make the processing of the request more understandable for the client. Info messages are not meant to be used for debugging.
+
+##### Success Message
+
+A `Server Message` with type `Success` is also called a `Success Message`. A `Success Message` indicates the successful *state change* due to portions of a request or the whole request. A success message must not be issued if the request fails.
+
+#### Non-Standard Server Message
+
+A `Non-Standard Server Message` may be issued by any non-standard server plugin or extension. It is a placeholder for extensions to the Message API.
+
+A `Non-Standard Server Message` may have an `id`. An `id` is a non-empty string. It should consist only of ASCII compliant upper-case Latin alphabetic letters from `A` to `Z` and the underscore character `_`. However, the id should not be equal to any id from the set of predefined standard server messages. Furthermore, the id of a non-standard server message should start with the string `NSSM_`.
+
+A `Non-Standard Server Message` may have a `type`. A `type` is a non-empty string. It should consist only of ASCII compliant upper-case or lower-case Latin alphabetic letters from `a` to `z`, from `A` to `Z`, and the underscore character `_`. If the type is equal to one of the above-mentioned types, it must have the same meaning and the same effects on the request as the respective type from above. Especially, a message with type `Error` must not be issued unless the request actually fails. Likewise a `Success` must not be issued unless the request actually caused a *state change* of the server.
+
+### Client Message
+
+A `Client Message` may have an `ignore` flag. The `ignore` flag can have one of these values: `no`, `yes`, `warn`, `silent`
+
+A `Client Message` is a message issued by a client. It should not be issued by the server. A `Client Message` may be completely ignored by clients. A client message must not be ignored by the server. A `Client Message` which cannot be understood by the server must result in an error, unless the `ignore` flag states otherwise.
+
+#### Ignore Flag
+
+If the `ignore` flag is set to `no` the server must not ignore the client message. If the server cannot understand the client message an error must be issued. This will cause the transaction to fail.
+
+If the `ignore` flag is set to `yes` the server must ignore the client message.
+
+If the `ignore` flag is set to `warn` the server should not ignore the message. If the server cannot understand the client message, a warning must be issued. The transaction will not fail due to this warning.
+
+### Message Parameters
+
+A `Message` may have zero or more parameters. A `Message Parameter` is a a triple of a `key`, a `value`. It is intended to facilitate the processing and representation of messages by clients and the server. For example, consider an `Error Message` which states that a certain server state cannot be reached and the reason be that there is an entity with certain features. Then it is useful to refer to the entity via the
+parameters. A client can now resolve the entity and just show it or generate a URI for this entity.
+
+A `key` is a non-empty string which should consist only of ASCII compliant lower-case Latin alphabetic letters from `a` to `z` and the minus character `-`. A `key` must be unique among the keys of the message parameters.
+
+A `value` is a possibly empty, arbitrary string which must not have leading or trailing white spaces.
+
+A `Message Parameter` may have a `type`. The `type` of a `Message Parameter` is also called a `Message Parameter Type`. A `Message Parameter Type` is a non-empty string which should consist only of ASCII compliant lower-case Latin alphabetic letters from `a` to `z` and the minus character `-`. A message parameter type may be one these string: `entity-id`, `entity-name`, `entity-cuid`, `property-index`, `parent-id`, `parent-name`.
+
+A `Message Parameter` with a type which begins with `entity-` is also called an `Entity Message Parameter`. The value of an `Entity Message Parameter` must refer to an entity—via its id, name, or cuid, respectively.
+
+A `Message Parameter` with a type which begins with `property-` is also called a `Property Message Parameter`. The value of such a parameter must refer to an entity's property. In the case of the `property-index` type the value refers to a property via a zero-based index (among the list of properties of that entity). The list of properties in question must belong to the `Message Bearer` which must in turn be an `Entity`.
+
+A `Message Parameter` with a type which begins with `parent-` is also called a `Parent Message Parameter`. The value of such a parameter must refer to an entity's parent via its id or name, respectively.
+
+### Message Bearer
+
+A `Message` must have a single `Message Bearer`, or, equivalently, a `Message` `belongs to` a single `Message Bearer`. The message is usually considered to carry information about the message bearer if not stated otherwise. The message's subject should be the message bearer itself, so to speak. Although, possibly indicated by a `Message Parameter` the message may be additionally or solely concerned with other things than the message bearer. Please note: The message bearer may also indicate the context of evaluation of the message parameters, e.g. when the type of the message parameter is `property-index`.
+
+A `Message Bearer` may be an `Entity`, a `Property`, a `Container`, a `Request`, a `Response`, or a `Transaction`.
+
+## Representation and Serialization
+
+Messages can be serialized, deserialized by the means of XML.
+
+### XML Representation
+
+A `Message` is serialized into a single XML Element Node (hereafter the *root element* with zero or more Child Nodes.
+
+##### Root Element Tag
+
+The root element's tag of a `Server Message` must be equal to its `type` if and only if the type is equal to one of the allowed types of a `Standard Server Message` (even if it is a Non-Standard Server Message). Otherwise the root tag is just 'ServerMessage'.
+
+```xml
+<Error/><!--an Error Message-->
+<Warning/><!--a Warning Message-->
+<Info/><!--an Info Message-->
+<Success/><!--a Success Message-->
+<ServerMessage/> <!--a Non-Standard Server Message with a non-standard type-->
+```
+
+The root element's tag of a `Client Message` must be 'ClientMessage'. E.g.
+```xml
+<ClientMessage/><!--a Client Message-->
+```
+
+##### Root Element Attributes
+
+The root element must have the attributes nodes `id`, and/or `ignore` if and only if the messages have corresponding properties. The root element must have a 'type' attribute only if the message has a type property and if the type is not equal to the root element's tag. The values of the attributes must equal the corresponding properties. E.g.
+
+```xml
+<Error id="ENTITY_DOES_NOT_EXIST" type="Error"/><!--this and the next element are equivalent-->
+<Error id="ENTITY_DOES_NOT_EXIST"/>
+<ServerMessage type="CustomType"/><!--has no id-->
+<ServerMessage id="NSSM_MY_ID"/><!--has no type-->
+```
+
+or
+
+```xml
+<ClientMessage id="CM_MY_ID" ignore="warn"/>
+```
+
+All other Attributes should be ignored.
+
+##### Description Element
+
+The root element must have exactly one Child Element Node with tag 'Description' if and only if the message has a `description` property. The string value of the message's description must be the first Child Text Node of the 'Description' Element. E.g.
+
+```xml
+<ServerMessage>
+ <Description>This is a description.</Description>
+</ServerMessage>
+```
+
+Please note: Any leading or trailing whitespaces of the Text Node must be stripped during the deserialization.
+
+All other Attributes and Child Nodes should be ignored.
+
+##### Parameters Element
+
+The root element must have exactly one Child Element Node with tag 'Parameters' if the message has at least one `parameter`. The 'Parameters' Element in turn must have a single Child Element Node for each parameter which are called `Parameter Elements`.
+
+A `Parameter Element` must have a tag equal to the `key` of the parameter.
+It must have a `type` attribute equal to the `type` property of the parameter if and only if the parameter has a type. And it must have a first Child Text Node which is equal to the parameter's `value`. E.g.
+
+```xml
+<ClientMessage>
+ <Parameters>
+ <param-one type="entity-name">Experiment</param-one><!--One parameter with key="param-one", value="Experiment", and type="entity-name"-->
+ </Parameters>
+</ClientMessage>
+```
+
+Please note: Any leading or trailing whitespaces of the Text Node must be stripped during the deserialization.
+
+All other Attributes and Child Nodes below the 'Parameters' Element should be ignored.
diff --git a/src/doc/specification/index.rst b/src/doc/specification/index.rst
new file mode 100644
index 00000000..e9683072
--- /dev/null
+++ b/src/doc/specification/index.rst
@@ -0,0 +1,22 @@
+
+Specification
+=============
+
+.. toctree::
+ :maxdepth: 2
+ :caption: Contents:
+ :hidden:
+
+ AbstractProperty
+ C-Client
+ Fileserver
+ Record
+ Server-side-scripting
+ Specification of the Entity API <Specification-of-the-Entity-API>
+ Authentication
+ Datatype
+ Paging
+ RecordType
+ Server side scripting <Server-side-scripting-v0.1>
+ Specification of the Message API <Specification-of-the-Message-API>
+
--
GitLab