From ca4c63e5341786f0cdc1c2da25196e66b4feda37 Mon Sep 17 00:00:00 2001
From: Eduard Gert
Date: Thu, 10 Sep 2026 15:44:25 +0200
Subject: [PATCH 01/15] Add Sign-in Domains page
Documents how an email domain is matched to an account: adding a domain,
proving ownership with a DNS TXT record, and what changes for users once it is
verified.
Two points the page is careful about, because both are easy to assume wrongly:
- Verifying a domain decides where *new* users land. It does not move users who
already have an account of their own, so domains want adding before a team is
onboarded rather than after.
- A verified sign-in domain is not an SSO domain. Routing a domain to an
identity provider is a separate step on the integration, which is what lets
one domain sign in through SSO while another uses Google or a social login.
The four screenshots it references are not in this commit and need to be added
before merge:
public/docs-static/img/manage/team/sign-in-domains/
sign-in-domains-settings.png the Sign-in Domains tab in Settings
sign-in-domains-pending.png a newly added domain, Pending
sign-in-domains-dns-verification.png the TXT record dialog
sign-in-domains-login.png the login page
Co-Authored-By: Claude Opus 5 (1M context)
---
src/components/NavigationDocs.jsx | 4 +
src/pages/manage/team/sign-in-domains.mdx | 131 ++++++++++++++++++++++
2 files changed, 135 insertions(+)
create mode 100644 src/pages/manage/team/sign-in-domains.mdx
diff --git a/src/components/NavigationDocs.jsx b/src/components/NavigationDocs.jsx
index 672c84ef4..68c4fe345 100644
--- a/src/components/NavigationDocs.jsx
+++ b/src/components/NavigationDocs.jsx
@@ -316,6 +316,10 @@ export const docsNavigation = [
},
{ title: 'User Roles', href: '/manage/team/user-roles' },
{ title: 'Approve Users', href: '/manage/team/approve-users' },
+ {
+ title: 'Sign-in Domains',
+ href: '/manage/team/sign-in-domains',
+ },
{
title: 'Enable NetBird for Entra ID',
href: '/manage/team/entra-id-app-enablement',
diff --git a/src/pages/manage/team/sign-in-domains.mdx b/src/pages/manage/team/sign-in-domains.mdx
new file mode 100644
index 000000000..adff7a09a
--- /dev/null
+++ b/src/pages/manage/team/sign-in-domains.mdx
@@ -0,0 +1,131 @@
+import {Note, Warning} from "@/components/mdx"
+
+export const description =
+ 'Match users to your account by their email domain. Add a sign-in domain, prove you own it with a DNS TXT record, and have new teammates join your network instead of creating one of their own.'
+
+# Match Users to Your Account with Sign-in Domains
+
+When someone signs in to NetBird for the first time, NetBird has to decide which account they belong to. Without a sign-in domain it cannot tell that `jane@example.com` is your colleague, so she gets an account of her own: an empty network, no peers, no policies, and no view of yours. You find out when she asks why she cannot see anything.
+
+**Sign-in domains** answer that question ahead of time. Prove you own `example.com`, and anyone signing in for the first time with an `@example.com` address joins your account.
+
+
+ **Availability**: NetBird Cloud.
+
+
+ **Permissions**: Only an Owner or Admin can manage sign-in domains. Learn more about [user roles](/manage/team/user-roles).
+
+
+One example runs through this page: an account on `example.com` that also owns `example.net`, a second brand whose staff should land in the same network.
+
+## How It Works
+
+A sign-in domain is an email domain you have proven you own. NetBird checks it at the moment someone signs in:
+
+1. It reads the domain from the email address, so `jane@example.com` gives `example.com`.
+2. If a verified sign-in domain matches, the user joins that account.
+3. If nothing matches, the user gets an account of their own, exactly as before.
+
+Your account starts with one sign-in domain already in place: the domain you signed up with. That one is your account's primary domain and cannot be removed. Every other domain you add and verify, like `example.net`, points at the same account, so both brands share one network instead of two.
+
+
+ Verifying a domain does not move users who already have their own account. It decides where **new** users land. Someone who signed up before you added the domain keeps their own account, and moving them across is a separate step. Add your domains before onboarding a team, not after.
+
+
+## Add a Sign-in Domain
+
+Go to **Settings → Sign-in Domains** and click **Add**. Enter the domain on its own, with no `@` and no address in front of it: `example.net`, not `jane@example.net`.
+
+
+
+
+
+Two shortcuts apply as soon as you add it:
+
+- **Your own domain verifies immediately.** If the domain matches your own verified email address, NetBird already has its proof and marks it Verified without a DNS record.
+- **Public providers are refused.** You cannot claim `gmail.com` or `outlook.com`, because that would pull every user on those providers into your account.
+
+Anything else starts as **Pending** and waits for the DNS check below.
+
+
+
+
+
+## Verify That You Own It
+
+Click **Verify** on the pending domain. NetBird shows a TXT record to publish:
+
+
+
+
+
+Add that record at your DNS provider, then let NetBird look for it. Three things to get right:
+
+- **Publish it at the root of the domain you entered**, so on `example.net` itself, not on `www.example.net`.
+- **Keep the value exactly as shown.** Some DNS providers add quotes around TXT values; that is fine, but do not edit the value itself.
+- **Give DNS time.** Propagation usually takes minutes but can take longer depending on your provider's TTL.
+
+NetBird re-checks on its own with a widening gap between attempts, so you do not have to sit on the page. The status becomes **Verified** once the record is found. If the record never appears, the domain ends up **Unverified**, and you can publish the record and click **Verify** again to restart the checks.
+
+
+ A domain can be verified by one account at a time. If another account has already verified it, your checks will keep failing even with the record published — contact [support@netbird.io](mailto:support@netbird.io) and we will sort out which account should hold it.
+
+
+## What Changes for Your Users
+
+Nothing changes for anyone who already has an account. From the moment the domain is Verified, a user signing in for the first time with an address on it joins your account and appears in **Team → Users**, with whatever [role](/manage/team/user-roles) you have set as the default.
+
+
+
+
+
+They still sign in the same way they would have otherwise, whether that is Google, Microsoft, a social login, or your own identity provider. The domain decides *which account* they land in, not *how* they authenticate.
+
+## Sign-in Domains and SSO
+
+These are two separate things, and the difference matters:
+
+- A **verified sign-in domain** decides which account a new user joins.
+- An **SSO integration** decides how users authenticate, and which domains are routed to it.
+
+Verifying a domain here does **not** send its users through your SSO integration. That is deliberate: it lets you keep one domain on your identity provider while another signs in with Google or a social login. If you want a domain routed to SSO, add it to the integration itself — see [Single Sign-On](/manage/team/single-sign-on).
+
+
+ A domain that an SSO integration uses cannot be deleted here while it is still attached. Remove it from the integration first, then delete the sign-in domain.
+
+
+## Remove a Sign-in Domain
+
+Click the delete icon on the domain's row. Two domains cannot be removed:
+
+- **Your account's primary domain**, the one you signed up with. Removing it would leave your own account unmatched.
+- **A domain an SSO integration still uses.** Detach it there first.
+
+Removing a domain does not remove or lock out users who already joined through it. It only stops matching new sign-ins, who will get accounts of their own again.
+
+## Things Worth Knowing
+
+- **Domains match exactly.** Verifying `example.com` does not cover `eu.example.com`. A subdomain is its own domain: add it and verify it separately.
+- **One account per domain.** Two accounts cannot both hold a verified `example.com`.
+- **Any number of domains per account.** Brands, acquisitions, and country domains can all point at the same network.
+- **The TXT record has to stay.** Removing it after verification does not undo the verification, but leave it in place so a re-check can succeed.
+
+## Recap
+
+- A sign-in domain tells NetBird that an email domain belongs to your account, so new users join your network instead of creating one of their own.
+- Your signup domain is there from the start and cannot be removed; add and verify any others yourself.
+- Verification is a TXT record at the root of the domain, re-checked automatically until it is found.
+- It changes where new users land, not where existing ones already are, and not how anyone authenticates.
+- Routing a domain to SSO is a separate step on the integration.
+
+## Related Docs
+
+- [Authenticate to NetBird with Single Sign-On](/manage/team/single-sign-on)
+- [Add users to your network](/manage/team/add-users-to-your-network)
+- [User roles](/manage/team/user-roles)
+- [Approve users](/manage/team/approve-users)
+- [Provision users and groups from your IdP](/manage/team/idp-sync)
From 4ce1722c7b82086fba4ec8442bd50df287b4fd92 Mon Sep 17 00:00:00 2001
From: Eduard Gert
Date: Thu, 10 Sep 2026 16:10:11 +0200
Subject: [PATCH 02/15] Tighten the Sign-in Domains page
Switches the examples to company.com / company.net, drops the step-by-step
walkthrough of how matching works, and trims the instructions down to what a
reader actually needs to do. The prose and the callouts carry the page now.
Co-Authored-By: Claude Opus 5 (1M context)
---
src/pages/manage/team/sign-in-domains.mdx | 66 ++++++++---------------
1 file changed, 21 insertions(+), 45 deletions(-)
diff --git a/src/pages/manage/team/sign-in-domains.mdx b/src/pages/manage/team/sign-in-domains.mdx
index adff7a09a..e9c256c46 100644
--- a/src/pages/manage/team/sign-in-domains.mdx
+++ b/src/pages/manage/team/sign-in-domains.mdx
@@ -5,9 +5,9 @@ export const description =
# Match Users to Your Account with Sign-in Domains
-When someone signs in to NetBird for the first time, NetBird has to decide which account they belong to. Without a sign-in domain it cannot tell that `jane@example.com` is your colleague, so she gets an account of her own: an empty network, no peers, no policies, and no view of yours. You find out when she asks why she cannot see anything.
+When someone signs in to NetBird for the first time, NetBird has to decide which account they belong to. Without a sign-in domain it cannot tell that `jane@company.com` is your colleague, so she gets an account of her own: an empty network, no peers, no policies, and no view of yours. You find out when she asks why she cannot see anything.
-**Sign-in domains** answer that question ahead of time. Prove you own `example.com`, and anyone signing in for the first time with an `@example.com` address joins your account.
+**Sign-in domains** answer that question ahead of time. Prove you own `company.com`, and anyone signing in for the first time with an `@company.com` address joins your account.
**Availability**: NetBird Cloud.
@@ -16,37 +16,22 @@ When someone signs in to NetBird for the first time, NetBird has to decide which
**Permissions**: Only an Owner or Admin can manage sign-in domains. Learn more about [user roles](/manage/team/user-roles).
-One example runs through this page: an account on `example.com` that also owns `example.net`, a second brand whose staff should land in the same network.
+Your account already has one sign-in domain: the one you signed up with. That is your primary domain and cannot be removed. Add and verify others — `company.net`, a second brand — and they point at the same account, so both share one network instead of two.
-## How It Works
-
-A sign-in domain is an email domain you have proven you own. NetBird checks it at the moment someone signs in:
-
-1. It reads the domain from the email address, so `jane@example.com` gives `example.com`.
-2. If a verified sign-in domain matches, the user joins that account.
-3. If nothing matches, the user gets an account of their own, exactly as before.
-
-Your account starts with one sign-in domain already in place: the domain you signed up with. That one is your account's primary domain and cannot be removed. Every other domain you add and verify, like `example.net`, points at the same account, so both brands share one network instead of two.
-
-
- Verifying a domain does not move users who already have their own account. It decides where **new** users land. Someone who signed up before you added the domain keeps their own account, and moving them across is a separate step. Add your domains before onboarding a team, not after.
-
+
+ Verifying a domain does not move users who already have an account of their own. It decides where **new** users land, so add your domains before onboarding a team rather than after.
+
## Add a Sign-in Domain
-Go to **Settings → Sign-in Domains** and click **Add**. Enter the domain on its own, with no `@` and no address in front of it: `example.net`, not `jane@example.net`.
+Go to **Settings → Sign-in Domains**, click **Add**, and enter the domain, e.g. `company.net`.
-Two shortcuts apply as soon as you add it:
-
-- **Your own domain verifies immediately.** If the domain matches your own verified email address, NetBird already has its proof and marks it Verified without a DNS record.
-- **Public providers are refused.** You cannot claim `gmail.com` or `outlook.com`, because that would pull every user on those providers into your account.
-
-Anything else starts as **Pending** and waits for the DNS check below.
+The domain starts as **Pending** until you prove you own it.
-Add that record at your DNS provider, then let NetBird look for it. Three things to get right:
-
-- **Publish it at the root of the domain you entered**, so on `example.net` itself, not on `www.example.net`.
-- **Keep the value exactly as shown.** Some DNS providers add quotes around TXT values; that is fine, but do not edit the value itself.
-- **Give DNS time.** Propagation usually takes minutes but can take longer depending on your provider's TTL.
-
-NetBird re-checks on its own with a widening gap between attempts, so you do not have to sit on the page. The status becomes **Verified** once the record is found. If the record never appears, the domain ends up **Unverified**, and you can publish the record and click **Verify** again to restart the checks.
+NetBird re-checks on its own with a widening gap between attempts, so you can leave the page. The domain becomes **Verified** once the record is found. If it never appears the domain ends up **Unverified**, and **Verify** starts the checks again.
- A domain can be verified by one account at a time. If another account has already verified it, your checks will keep failing even with the record published — contact [support@netbird.io](mailto:support@netbird.io) and we will sort out which account should hold it.
+ A domain can be verified by one account at a time. If another account has already verified it, your checks keep failing even with the record published — contact [support@netbird.io](mailto:support@netbird.io) and we will sort out which account should hold it.
## What Changes for Your Users
-Nothing changes for anyone who already has an account. From the moment the domain is Verified, a user signing in for the first time with an address on it joins your account and appears in **Team → Users**, with whatever [role](/manage/team/user-roles) you have set as the default.
+From the moment the domain is Verified, a user signing in for the first time with an address on it joins your account and appears in **Team → Users** with your default [role](/manage/team/user-roles). Anyone who already has an account keeps it.
-They still sign in the same way they would have otherwise, whether that is Google, Microsoft, a social login, or your own identity provider. The domain decides *which account* they land in, not *how* they authenticate.
+They sign in the same way they would have otherwise, whether that is Google, Microsoft, a social login, or your own identity provider. The domain decides *which account* they land in, not *how* they authenticate.
## Sign-in Domains and SSO
-These are two separate things, and the difference matters:
+These are two separate things:
- A **verified sign-in domain** decides which account a new user joins.
- An **SSO integration** decides how users authenticate, and which domains are routed to it.
-Verifying a domain here does **not** send its users through your SSO integration. That is deliberate: it lets you keep one domain on your identity provider while another signs in with Google or a social login. If you want a domain routed to SSO, add it to the integration itself — see [Single Sign-On](/manage/team/single-sign-on).
+Verifying a domain here does **not** send its users through your SSO integration. That is deliberate: it lets you keep one domain on your identity provider while another signs in with Google or a social login. To route a domain to SSO, add it to the integration itself — see [Single Sign-On](/manage/team/single-sign-on).
- A domain that an SSO integration uses cannot be deleted here while it is still attached. Remove it from the integration first, then delete the sign-in domain.
+ A domain an SSO integration uses cannot be deleted here while it is still attached. Remove it from the integration first.
## Remove a Sign-in Domain
-Click the delete icon on the domain's row. Two domains cannot be removed:
-
-- **Your account's primary domain**, the one you signed up with. Removing it would leave your own account unmatched.
-- **A domain an SSO integration still uses.** Detach it there first.
+Click the delete icon on the domain's row. Your primary domain cannot be removed, and neither can a domain an SSO integration still uses.
-Removing a domain does not remove or lock out users who already joined through it. It only stops matching new sign-ins, who will get accounts of their own again.
+Removing a domain does not remove or lock out users who already joined through it. It only stops matching new sign-ins, who get accounts of their own again.
## Things Worth Knowing
-- **Domains match exactly.** Verifying `example.com` does not cover `eu.example.com`. A subdomain is its own domain: add it and verify it separately.
-- **One account per domain.** Two accounts cannot both hold a verified `example.com`.
+- **Domains match exactly.** Verifying `company.com` does not cover `eu.company.com`. A subdomain is its own domain: add it and verify it separately.
+- **One account per domain.** Two accounts cannot both hold a verified `company.com`.
- **Any number of domains per account.** Brands, acquisitions, and country domains can all point at the same network.
-- **The TXT record has to stay.** Removing it after verification does not undo the verification, but leave it in place so a re-check can succeed.
+- **Leave the TXT record in place.** Removing it does not undo the verification, but a later re-check needs it.
## Recap
From 02bfc99f8353cb8e3bfd98fa23da02b522064fa6 Mon Sep 17 00:00:00 2001
From: Eduard Gert
Date: Thu, 10 Sep 2026 16:13:20 +0200
Subject: [PATCH 03/15] Trim the Sign-in Domains page further
Parallel section titles (Add / Verify / Remove Domain), drops the
"What Changes for Your Users" and "Things Worth Knowing" sections, and cuts
the availability note and the SSO note back to one line each.
The warning now says to add domains before onboarding a team from another
domain, which is the case it actually matters for.
Co-Authored-By: Claude Opus 5 (1M context)
---
src/pages/manage/team/sign-in-domains.mdx | 25 +++++++----------------
1 file changed, 7 insertions(+), 18 deletions(-)
diff --git a/src/pages/manage/team/sign-in-domains.mdx b/src/pages/manage/team/sign-in-domains.mdx
index e9c256c46..5c8d71ff2 100644
--- a/src/pages/manage/team/sign-in-domains.mdx
+++ b/src/pages/manage/team/sign-in-domains.mdx
@@ -10,7 +10,7 @@ When someone signs in to NetBird for the first time, NetBird has to decide which
**Sign-in domains** answer that question ahead of time. Prove you own `company.com`, and anyone signing in for the first time with an `@company.com` address joins your account.
- **Availability**: NetBird Cloud.
+ **Availability**: Sign-in Domains is only available on NetBird Cloud.
**Permissions**: Only an Owner or Admin can manage sign-in domains. Learn more about [user roles](/manage/team/user-roles).
@@ -19,10 +19,10 @@ When someone signs in to NetBird for the first time, NetBird has to decide which
Your account already has one sign-in domain: the one you signed up with. That is your primary domain and cannot be removed. Add and verify others — `company.net`, a second brand — and they point at the same account, so both share one network instead of two.
- Verifying a domain does not move users who already have an account of their own. It decides where **new** users land, so add your domains before onboarding a team rather than after.
+ Verifying a domain does not move users who already have an account of their own. It decides where **new** users land, so add your domains before onboarding a team from another domain rather than after.
-## Add a Sign-in Domain
+## Add Domain
Go to **Settings → Sign-in Domains**, click **Add**, and enter the domain, e.g. `company.net`.
@@ -38,7 +38,7 @@ The domain starts as **Pending** until you prove you own it.
alt="A newly added domain listed as Pending, with a Verify button beside it" className="imagewrapper-big"/>
-## Verify That You Own It
+## Verify Domain
Click **Verify** and publish the TXT record NetBird shows you at the root of the domain, so on `company.net` itself rather than `www.company.net`.
@@ -53,17 +53,13 @@ NetBird re-checks on its own with a widening gap between attempts, so you can le
A domain can be verified by one account at a time. If another account has already verified it, your checks keep failing even with the record published — contact [support@netbird.io](mailto:support@netbird.io) and we will sort out which account should hold it.
-## What Changes for Your Users
-
-From the moment the domain is Verified, a user signing in for the first time with an address on it joins your account and appears in **Team → Users** with your default [role](/manage/team/user-roles). Anyone who already has an account keeps it.
+Once the domain is Verified, a user signing in for the first time with an address on it joins your account.
-They sign in the same way they would have otherwise, whether that is Google, Microsoft, a social login, or your own identity provider. The domain decides *which account* they land in, not *how* they authenticate.
-
## Sign-in Domains and SSO
These are two separate things:
@@ -74,22 +70,15 @@ These are two separate things:
Verifying a domain here does **not** send its users through your SSO integration. That is deliberate: it lets you keep one domain on your identity provider while another signs in with Google or a social login. To route a domain to SSO, add it to the integration itself — see [Single Sign-On](/manage/team/single-sign-on).
- A domain an SSO integration uses cannot be deleted here while it is still attached. Remove it from the integration first.
+ A domain used by an SSO integration must be removed from the integration first.
-## Remove a Sign-in Domain
+## Remove Domain
Click the delete icon on the domain's row. Your primary domain cannot be removed, and neither can a domain an SSO integration still uses.
Removing a domain does not remove or lock out users who already joined through it. It only stops matching new sign-ins, who get accounts of their own again.
-## Things Worth Knowing
-
-- **Domains match exactly.** Verifying `company.com` does not cover `eu.company.com`. A subdomain is its own domain: add it and verify it separately.
-- **One account per domain.** Two accounts cannot both hold a verified `company.com`.
-- **Any number of domains per account.** Brands, acquisitions, and country domains can all point at the same network.
-- **Leave the TXT record in place.** Removing it does not undo the verification, but a later re-check needs it.
-
## Recap
- A sign-in domain tells NetBird that an email domain belongs to your account, so new users join your network instead of creating one of their own.
From c487a6e0437c130a321a6882ea4dbad9a252117c Mon Sep 17 00:00:00 2001
From: Eduard Gert
Date: Thu, 10 Sep 2026 16:18:17 +0200
Subject: [PATCH 04/15] Move Sign-in Domains under Settings, and lead with the
two domains
Sign-in Domains is a Settings tab in the dashboard, not part of Team, so the
page moves to /manage/settings/sign-in-domains and sits in the Settings nav
after Authentication, mirroring the dashboard's own tab order. Screenshots move
with it to img/manage/settings/sign-in-domains/.
The intro also led with jane@company.com, which would already have matched the
primary domain and so did not show the problem at all. It now establishes
company.com as the account's own domain and company.net as the second one, and
the colleague who needs it is jane@company.net.
Co-Authored-By: Claude Opus 5 (1M context)
---
src/components/NavigationDocs.jsx | 8 ++++----
.../{team => settings}/sign-in-domains.mdx | 16 +++++++++-------
2 files changed, 13 insertions(+), 11 deletions(-)
rename src/pages/manage/{team => settings}/sign-in-domains.mdx (78%)
diff --git a/src/components/NavigationDocs.jsx b/src/components/NavigationDocs.jsx
index 68c4fe345..374adaf41 100644
--- a/src/components/NavigationDocs.jsx
+++ b/src/components/NavigationDocs.jsx
@@ -316,10 +316,6 @@ export const docsNavigation = [
},
{ title: 'User Roles', href: '/manage/team/user-roles' },
{ title: 'Approve Users', href: '/manage/team/approve-users' },
- {
- title: 'Sign-in Domains',
- href: '/manage/team/sign-in-domains',
- },
{
title: 'Enable NetBird for Entra ID',
href: '/manage/team/entra-id-app-enablement',
@@ -433,6 +429,10 @@ export const docsNavigation = [
},
],
},
+ {
+ title: 'Sign-in Domains',
+ href: '/manage/settings/sign-in-domains',
+ },
{
title: 'Permissions',
href: '/manage/settings/permissions',
diff --git a/src/pages/manage/team/sign-in-domains.mdx b/src/pages/manage/settings/sign-in-domains.mdx
similarity index 78%
rename from src/pages/manage/team/sign-in-domains.mdx
rename to src/pages/manage/settings/sign-in-domains.mdx
index 5c8d71ff2..3344dd1fe 100644
--- a/src/pages/manage/team/sign-in-domains.mdx
+++ b/src/pages/manage/settings/sign-in-domains.mdx
@@ -5,9 +5,11 @@ export const description =
# Match Users to Your Account with Sign-in Domains
-When someone signs in to NetBird for the first time, NetBird has to decide which account they belong to. Without a sign-in domain it cannot tell that `jane@company.com` is your colleague, so she gets an account of her own: an empty network, no peers, no policies, and no view of yours. You find out when she asks why she cannot see anything.
+Your account has one sign-in domain from the start: the domain you signed up with, say `company.com`. Anyone signing in with an `@company.com` address joins your account, because NetBird already knows that domain is yours.
-**Sign-in domains** answer that question ahead of time. Prove you own `company.com`, and anyone signing in for the first time with an `@company.com` address joins your account.
+Your company also uses `company.net`, for a second brand or another location. When a colleague there signs in as `jane@company.net`, NetBird has no way to tell that domain is yours too, so Jane gets an account of her own: an empty network, no peers, no policies, and no view of yours. You find out when she asks why she cannot see anything.
+
+**Sign-in domains** fix that. Prove you own `company.net` as well, and everyone on it joins the same account.
**Availability**: Sign-in Domains is only available on NetBird Cloud.
@@ -16,7 +18,7 @@ When someone signs in to NetBird for the first time, NetBird has to decide which
**Permissions**: Only an Owner or Admin can manage sign-in domains. Learn more about [user roles](/manage/team/user-roles).
-Your account already has one sign-in domain: the one you signed up with. That is your primary domain and cannot be removed. Add and verify others — `company.net`, a second brand — and they point at the same account, so both share one network instead of two.
+`company.com` stays your account's primary domain and cannot be removed. You can add and verify as many others as you need, and they all point at the same account.
Verifying a domain does not move users who already have an account of their own. It decides where **new** users land, so add your domains before onboarding a team from another domain rather than after.
@@ -27,14 +29,14 @@ Your account already has one sign-in domain: the one you signed up with. That is
Go to **Settings → Sign-in Domains**, click **Add**, and enter the domain, e.g. `company.net`.
-
The domain starts as **Pending** until you prove you own it.
-
@@ -43,7 +45,7 @@ The domain starts as **Pending** until you prove you own it.
Click **Verify** and publish the TXT record NetBird shows you at the root of the domain, so on `company.net` itself rather than `www.company.net`.
-
@@ -56,7 +58,7 @@ NetBird re-checks on its own with a widening gap between attempts, so you can le
Once the domain is Verified, a user signing in for the first time with an address on it joins your account.
-
From 2a3374d59b4d15bd009b825b8d4f2e4b0612e36a Mon Sep 17 00:00:00 2001
From: Eduard Gert
Date: Thu, 10 Sep 2026 17:12:11 +0200
Subject: [PATCH 05/15] Lead with what sign-in domains are for
Retitles the page "Allow Users from Other Domains to Join Your Account", which
is the job it does, and opens with the behaviour rather than with the account's
own domain: users on one business email domain are already joined into one
account, and most businesses have more than one domain -- another location, a
country domain, a second brand -- whose users are not.
Also documents the email route the verification dialog offers for anyone
without DNS access, and matches the dialog's own wording (Verify on the row,
then Start Verification).
Co-Authored-By: Claude Opus 5 (1M context)
---
src/pages/manage/settings/sign-in-domains.mdx | 21 ++++++++-----------
1 file changed, 9 insertions(+), 12 deletions(-)
diff --git a/src/pages/manage/settings/sign-in-domains.mdx b/src/pages/manage/settings/sign-in-domains.mdx
index 3344dd1fe..d8e72a841 100644
--- a/src/pages/manage/settings/sign-in-domains.mdx
+++ b/src/pages/manage/settings/sign-in-domains.mdx
@@ -1,15 +1,15 @@
import {Note, Warning} from "@/components/mdx"
export const description =
- 'Match users to your account by their email domain. Add a sign-in domain, prove you own it with a DNS TXT record, and have new teammates join your network instead of creating one of their own.'
+ 'Users on your business email domain join your account automatically. Add and verify the other domains your business uses, so their users join the same account instead of creating one of their own.'
-# Match Users to Your Account with Sign-in Domains
+# Allow Users from Other Domains to Join Your Account
-Your account has one sign-in domain from the start: the domain you signed up with, say `company.com`. Anyone signing in with an `@company.com` address joins your account, because NetBird already knows that domain is yours.
+Users who sign in with the same business email domain are joined into one account. Everyone on `@company.com` lands in your network, with the same peers and policies, without anyone having to invite them.
-Your company also uses `company.net`, for a second brand or another location. When a colleague there signs in as `jane@company.net`, NetBird has no way to tell that domain is yours too, so Jane gets an account of her own: an empty network, no peers, no policies, and no view of yours. You find out when she asks why she cannot see anything.
+That covers one domain. Most businesses use more than one: another location on `company.net`, a country domain like `mycompany.eu`, or a second brand. A colleague signing in as `jane@company.net` is not recognised as yours, so she gets an account of her own: an empty network, no peers, no policies, and no view of yours. You find out when she asks why she cannot see anything.
-**Sign-in domains** fix that. Prove you own `company.net` as well, and everyone on it joins the same account.
+**Sign-in domains** fix that. Prove you own the other domains your business uses, and everyone on them joins the same account.
**Availability**: Sign-in Domains is only available on NetBird Cloud.
@@ -35,21 +35,18 @@ Go to **Settings → Sign-in Domains**, click **Add**, and enter the domain, e.g
The domain starts as **Pending** until you prove you own it.
-
-
-
-
## Verify Domain
-Click **Verify** and publish the TXT record NetBird shows you at the root of the domain, so on `company.net` itself rather than `www.company.net`.
+Click **Verify** on the pending domain. NetBird shows a TXT record to publish at the root of the domain, so on `company.net` itself rather than `www.company.net`.
-NetBird re-checks on its own with a widening gap between attempts, so you can leave the page. The domain becomes **Verified** once the record is found. If it never appears the domain ends up **Unverified**, and **Verify** starts the checks again.
+Add the record, then click **Start Verification**. NetBird re-checks on its own with a widening gap between attempts, so you can leave the page. The domain becomes **Verified** once the record is found. If it never appears the domain ends up **Unverified**, and **Verify** starts the checks again.
+
+If you cannot change DNS, email [support@netbird.io](mailto:support@netbird.io) from an address on the domain instead and we will verify it for you.
A domain can be verified by one account at a time. If another account has already verified it, your checks keep failing even with the record published — contact [support@netbird.io](mailto:support@netbird.io) and we will sort out which account should hold it.
From 4c9900aa7bc2af15370e1e877f7f0b188327453e Mon Sep 17 00:00:00 2001
From: Eduard Gert
Date: Thu, 10 Sep 2026 17:18:42 +0200
Subject: [PATCH 06/15] Sharpen the intro and drop the primary-domain aside
- The colleague on another domain is not recognized unless invited by hand, so
the intro says so and links to the invite page.
- "With sign-in domains you prove ownership of those domains, and everyone
across your organization joins the same account."
- Drops the paragraph about company.com staying the primary domain. Remove
Domain named that term without defining it afterwards, so it now says "the
domain your account signed up with" instead.
- Drops the detail about the retry interval widening; that it keeps checking is
the part a reader needs.
- US spelling, matching the rest of the docs.
Co-Authored-By: Claude Opus 5 (1M context)
---
src/pages/manage/settings/sign-in-domains.mdx | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/src/pages/manage/settings/sign-in-domains.mdx b/src/pages/manage/settings/sign-in-domains.mdx
index d8e72a841..cae114890 100644
--- a/src/pages/manage/settings/sign-in-domains.mdx
+++ b/src/pages/manage/settings/sign-in-domains.mdx
@@ -7,9 +7,9 @@ export const description =
Users who sign in with the same business email domain are joined into one account. Everyone on `@company.com` lands in your network, with the same peers and policies, without anyone having to invite them.
-That covers one domain. Most businesses use more than one: another location on `company.net`, a country domain like `mycompany.eu`, or a second brand. A colleague signing in as `jane@company.net` is not recognised as yours, so she gets an account of her own: an empty network, no peers, no policies, and no view of yours. You find out when she asks why she cannot see anything.
+That covers one domain. Most businesses use more than one: another location on `company.net`, a country domain like `mycompany.eu`, or a second brand. A colleague signing in as `jane@company.net` is not recognized as yours unless you [invite her manually](/manage/team/add-users-to-your-network), so she gets an account of her own: an empty network, no peers, no policies, and no view of yours. You find out when she asks why she cannot see anything.
-**Sign-in domains** fix that. Prove you own the other domains your business uses, and everyone on them joins the same account.
+With **sign-in domains** you prove ownership of those domains, and everyone across your organization joins the same account.
**Availability**: Sign-in Domains is only available on NetBird Cloud.
@@ -18,8 +18,6 @@ That covers one domain. Most businesses use more than one: another location on `
**Permissions**: Only an Owner or Admin can manage sign-in domains. Learn more about [user roles](/manage/team/user-roles).
-`company.com` stays your account's primary domain and cannot be removed. You can add and verify as many others as you need, and they all point at the same account.
-
Verifying a domain does not move users who already have an account of their own. It decides where **new** users land, so add your domains before onboarding a team from another domain rather than after.
@@ -44,7 +42,7 @@ Click **Verify** on the pending domain. NetBird shows a TXT record to publish at
alt="The verification dialog showing the TXT record name and value to publish in DNS" className="imagewrapper-big"/>
-Add the record, then click **Start Verification**. NetBird re-checks on its own with a widening gap between attempts, so you can leave the page. The domain becomes **Verified** once the record is found. If it never appears the domain ends up **Unverified**, and **Verify** starts the checks again.
+Add the record, then click **Start Verification**. NetBird keeps checking on its own, so you can leave the page. The domain becomes **Verified** once the record is found. If it never appears the domain ends up **Unverified**, and **Verify** starts the checks again.
If you cannot change DNS, email [support@netbird.io](mailto:support@netbird.io) from an address on the domain instead and we will verify it for you.
@@ -74,7 +72,7 @@ Verifying a domain here does **not** send its users through your SSO integration
## Remove Domain
-Click the delete icon on the domain's row. Your primary domain cannot be removed, and neither can a domain an SSO integration still uses.
+Click the delete icon on the domain's row. The domain your account signed up with cannot be removed, and neither can a domain an SSO integration still uses.
Removing a domain does not remove or lock out users who already joined through it. It only stops matching new sign-ins, who get accounts of their own again.
From 25e0a154c947df6964f860bc9d5980eb77a78c16 Mon Sep 17 00:00:00 2001
From: Eduard Gert
Date: Thu, 10 Sep 2026 17:19:51 +0200
Subject: [PATCH 07/15] Shorten the one-account-per-domain note
Co-Authored-By: Claude Opus 5 (1M context)
---
src/pages/manage/settings/sign-in-domains.mdx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/pages/manage/settings/sign-in-domains.mdx b/src/pages/manage/settings/sign-in-domains.mdx
index cae114890..50f4f200a 100644
--- a/src/pages/manage/settings/sign-in-domains.mdx
+++ b/src/pages/manage/settings/sign-in-domains.mdx
@@ -47,7 +47,7 @@ Add the record, then click **Start Verification**. NetBird keeps checking on its
If you cannot change DNS, email [support@netbird.io](mailto:support@netbird.io) from an address on the domain instead and we will verify it for you.
- A domain can be verified by one account at a time. If another account has already verified it, your checks keep failing even with the record published — contact [support@netbird.io](mailto:support@netbird.io) and we will sort out which account should hold it.
+ A domain can only be verified by one account. If another one already holds it, your checks keep failing — contact [support@netbird.io](mailto:support@netbird.io).
Once the domain is Verified, a user signing in for the first time with an address on it joins your account.
From ec61e05d4bf650533018d21c2d1d64b8de74482a Mon Sep 17 00:00:00 2001
From: Eduard Gert
Date: Thu, 10 Sep 2026 17:22:07 +0200
Subject: [PATCH 08/15] Drop the SSO section, and nest the page under
Authentication
The "Sign-in Domains and SSO" section read as confusing rather than
clarifying, so it goes along with its recap bullet. The constraint a reader
actually meets survives in Remove Domain: a domain an SSO integration uses
cannot be deleted until it is detached there.
The page also moves under the Authentication group in the sidebar, next to
Peer Session Expiration and Multi-Factor Authentication.
Co-Authored-By: Claude Opus 5 (1M context)
---
src/components/NavigationDocs.jsx | 8 ++++----
src/pages/manage/settings/sign-in-domains.mdx | 14 --------------
2 files changed, 4 insertions(+), 18 deletions(-)
diff --git a/src/components/NavigationDocs.jsx b/src/components/NavigationDocs.jsx
index 374adaf41..000487740 100644
--- a/src/components/NavigationDocs.jsx
+++ b/src/components/NavigationDocs.jsx
@@ -427,12 +427,12 @@ export const docsNavigation = [
title: 'Multi-Factor Authentication',
href: '/manage/settings/multi-factor-authentication',
},
+ {
+ title: 'Sign-in Domains',
+ href: '/manage/settings/sign-in-domains',
+ },
],
},
- {
- title: 'Sign-in Domains',
- href: '/manage/settings/sign-in-domains',
- },
{
title: 'Permissions',
href: '/manage/settings/permissions',
diff --git a/src/pages/manage/settings/sign-in-domains.mdx b/src/pages/manage/settings/sign-in-domains.mdx
index 50f4f200a..5117dcb17 100644
--- a/src/pages/manage/settings/sign-in-domains.mdx
+++ b/src/pages/manage/settings/sign-in-domains.mdx
@@ -57,19 +57,6 @@ Once the domain is Verified, a user signing in for the first time with an addres
alt="The NetBird login page, where a user signing in with an email address on a verified domain joins the existing account" className="imagewrapper-big"/>
-## Sign-in Domains and SSO
-
-These are two separate things:
-
-- A **verified sign-in domain** decides which account a new user joins.
-- An **SSO integration** decides how users authenticate, and which domains are routed to it.
-
-Verifying a domain here does **not** send its users through your SSO integration. That is deliberate: it lets you keep one domain on your identity provider while another signs in with Google or a social login. To route a domain to SSO, add it to the integration itself — see [Single Sign-On](/manage/team/single-sign-on).
-
-
- A domain used by an SSO integration must be removed from the integration first.
-
-
## Remove Domain
Click the delete icon on the domain's row. The domain your account signed up with cannot be removed, and neither can a domain an SSO integration still uses.
@@ -82,7 +69,6 @@ Removing a domain does not remove or lock out users who already joined through i
- Your signup domain is there from the start and cannot be removed; add and verify any others yourself.
- Verification is a TXT record at the root of the domain, re-checked automatically until it is found.
- It changes where new users land, not where existing ones already are, and not how anyone authenticates.
-- Routing a domain to SSO is a separate step on the integration.
## Related Docs
From 277dd33e7c53b1aceda2ee28f0350be486339833 Mon Sep 17 00:00:00 2001
From: Eduard Gert
Date: Thu, 10 Sep 2026 17:46:31 +0200
Subject: [PATCH 09/15] Follow the dashboard: Sign-in Domains lives under
Authentication
The dashboard no longer gives sign-in domains a tab of their own, so the
instruction now sends the reader to Settings > Authentication and the section
within it. The screenshot is renamed to authentication-tab.png to match what
it has to show.
Also spells out that joining happens automatically without direct invites,
and drops the same point from the opening paragraph where it was now said
twice.
Co-Authored-By: Claude Opus 5 (1M context)
---
src/pages/manage/settings/sign-in-domains.mdx | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/src/pages/manage/settings/sign-in-domains.mdx b/src/pages/manage/settings/sign-in-domains.mdx
index 5117dcb17..80983d507 100644
--- a/src/pages/manage/settings/sign-in-domains.mdx
+++ b/src/pages/manage/settings/sign-in-domains.mdx
@@ -5,11 +5,11 @@ export const description =
# Allow Users from Other Domains to Join Your Account
-Users who sign in with the same business email domain are joined into one account. Everyone on `@company.com` lands in your network, with the same peers and policies, without anyone having to invite them.
+Users who sign in with the same business email domain are joined into one account. Everyone on `@company.com` lands in your network, with the same peers and policies.
That covers one domain. Most businesses use more than one: another location on `company.net`, a country domain like `mycompany.eu`, or a second brand. A colleague signing in as `jane@company.net` is not recognized as yours unless you [invite her manually](/manage/team/add-users-to-your-network), so she gets an account of her own: an empty network, no peers, no policies, and no view of yours. You find out when she asks why she cannot see anything.
-With **sign-in domains** you prove ownership of those domains, and everyone across your organization joins the same account.
+With **sign-in domains** you prove ownership of those domains, and everyone across your organization joins the same account automatically, without direct invites.
**Availability**: Sign-in Domains is only available on NetBird Cloud.
@@ -24,11 +24,11 @@ With **sign-in domains** you prove ownership of those domains, and everyone acro
## Add Domain
-Go to **Settings → Sign-in Domains**, click **Add**, and enter the domain, e.g. `company.net`.
+Go to **Settings → Authentication**, find **Sign-in Domains**, then click **Add** and enter the domain, e.g. `company.net`.
-
+
The domain starts as **Pending** until you prove you own it.
From 77502eae7daed7c818c15337d3ce885247b45d09 Mon Sep 17 00:00:00 2001
From: Eduard Gert
Date: Fri, 11 Sep 2026 09:57:38 +0200
Subject: [PATCH 10/15] Move the page under Single Sign-On
/manage/team/single-sign-on/sign-in-domains, nested under Single Sign-On in
the Team section rather than sitting under Settings. Screenshots move with it
to img/manage/team/single-sign-on/sign-in-domains/.
Co-Authored-By: Claude Opus 5 (1M context)
---
src/components/NavigationDocs.jsx | 10 ++++++----
.../single-sign-on}/sign-in-domains.mdx | 6 +++---
2 files changed, 9 insertions(+), 7 deletions(-)
rename src/pages/manage/{settings => team/single-sign-on}/sign-in-domains.mdx (93%)
diff --git a/src/components/NavigationDocs.jsx b/src/components/NavigationDocs.jsx
index 000487740..a20267e17 100644
--- a/src/components/NavigationDocs.jsx
+++ b/src/components/NavigationDocs.jsx
@@ -361,6 +361,12 @@ export const docsNavigation = [
title: 'Single Sign-On',
href: '/manage/team/single-sign-on',
isOpen: false,
+ links: [
+ {
+ title: 'Sign-in Domains',
+ href: '/manage/team/single-sign-on/sign-in-domains',
+ },
+ ],
// links: [
// { title: 'Authentik', href: '/manage/team/single-sign-on/authentik' },
// { title: 'Keycloak', href: '/manage/team/single-sign-on/keycloak' },
@@ -427,10 +433,6 @@ export const docsNavigation = [
title: 'Multi-Factor Authentication',
href: '/manage/settings/multi-factor-authentication',
},
- {
- title: 'Sign-in Domains',
- href: '/manage/settings/sign-in-domains',
- },
],
},
{
diff --git a/src/pages/manage/settings/sign-in-domains.mdx b/src/pages/manage/team/single-sign-on/sign-in-domains.mdx
similarity index 93%
rename from src/pages/manage/settings/sign-in-domains.mdx
rename to src/pages/manage/team/single-sign-on/sign-in-domains.mdx
index 80983d507..529e6dd5e 100644
--- a/src/pages/manage/settings/sign-in-domains.mdx
+++ b/src/pages/manage/team/single-sign-on/sign-in-domains.mdx
@@ -27,7 +27,7 @@ With **sign-in domains** you prove ownership of those domains, and everyone acro
Go to **Settings → Authentication**, find **Sign-in Domains**, then click **Add** and enter the domain, e.g. `company.net`.
-
@@ -38,7 +38,7 @@ The domain starts as **Pending** until you prove you own it.
Click **Verify** on the pending domain. NetBird shows a TXT record to publish at the root of the domain, so on `company.net` itself rather than `www.company.net`.
-
@@ -53,7 +53,7 @@ If you cannot change DNS, email [support@netbird.io](mailto:support@netbird.io)
Once the domain is Verified, a user signing in for the first time with an address on it joins your account.
-
From f70363db35d3b32e7bd95b4844521e2aa781ddab Mon Sep 17 00:00:00 2001
From: Eduard Gert
Date: Fri, 11 Sep 2026 10:05:18 +0200
Subject: [PATCH 11/15] Put the page at manage/team/sign-in-domains
A sibling of Single Sign-On in the Team section, listed after it, rather than
nested inside it or under Settings. Screenshots follow to
img/manage/team/sign-in-domains/.
Co-Authored-By: Claude Opus 5 (1M context)
---
src/components/NavigationDocs.jsx | 10 ++++------
.../team/{single-sign-on => }/sign-in-domains.mdx | 6 +++---
2 files changed, 7 insertions(+), 9 deletions(-)
rename src/pages/manage/team/{single-sign-on => }/sign-in-domains.mdx (93%)
diff --git a/src/components/NavigationDocs.jsx b/src/components/NavigationDocs.jsx
index a20267e17..bf6948fa5 100644
--- a/src/components/NavigationDocs.jsx
+++ b/src/components/NavigationDocs.jsx
@@ -361,12 +361,6 @@ export const docsNavigation = [
title: 'Single Sign-On',
href: '/manage/team/single-sign-on',
isOpen: false,
- links: [
- {
- title: 'Sign-in Domains',
- href: '/manage/team/single-sign-on/sign-in-domains',
- },
- ],
// links: [
// { title: 'Authentik', href: '/manage/team/single-sign-on/authentik' },
// { title: 'Keycloak', href: '/manage/team/single-sign-on/keycloak' },
@@ -374,6 +368,10 @@ export const docsNavigation = [
// { title: 'JumpCloud', href: '/manage/team/single-sign-on/jumpcloud' },
// ]
},
+ {
+ title: 'Sign-in Domains',
+ href: '/manage/team/sign-in-domains',
+ },
],
},
{
diff --git a/src/pages/manage/team/single-sign-on/sign-in-domains.mdx b/src/pages/manage/team/sign-in-domains.mdx
similarity index 93%
rename from src/pages/manage/team/single-sign-on/sign-in-domains.mdx
rename to src/pages/manage/team/sign-in-domains.mdx
index 529e6dd5e..bd4d54c72 100644
--- a/src/pages/manage/team/single-sign-on/sign-in-domains.mdx
+++ b/src/pages/manage/team/sign-in-domains.mdx
@@ -27,7 +27,7 @@ With **sign-in domains** you prove ownership of those domains, and everyone acro
Go to **Settings → Authentication**, find **Sign-in Domains**, then click **Add** and enter the domain, e.g. `company.net`.
-
@@ -38,7 +38,7 @@ The domain starts as **Pending** until you prove you own it.
Click **Verify** on the pending domain. NetBird shows a TXT record to publish at the root of the domain, so on `company.net` itself rather than `www.company.net`.
-
@@ -53,7 +53,7 @@ If you cannot change DNS, email [support@netbird.io](mailto:support@netbird.io)
Once the domain is Verified, a user signing in for the first time with an address on it joins your account.
-
From 51b9dd0a7a11b2c3b07771b6f2ea360c1582b13e Mon Sep 17 00:00:00 2001
From: Eduard Gert
Date: Fri, 11 Sep 2026 11:16:23 +0200
Subject: [PATCH 12/15] Fix wording and a stale example domain
The DNS instruction still named www.company.net after the example moved to
company.co.uk, which is the one that actually misleads: that sentence is
telling people where to put the record.
Also a "usees" typo, a link with no object ("unless you invite manually"), a
missing comma after "By default", "as you" where the comparison is to your
domain, "E.g." opening a sentence, and "another one" where it means another
account.
Co-Authored-By: Claude Opus 5 (1M context)
---
src/pages/manage/team/sign-in-domains.mdx | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/src/pages/manage/team/sign-in-domains.mdx b/src/pages/manage/team/sign-in-domains.mdx
index bd4d54c72..006fc300f 100644
--- a/src/pages/manage/team/sign-in-domains.mdx
+++ b/src/pages/manage/team/sign-in-domains.mdx
@@ -5,11 +5,15 @@ export const description =
# Allow Users from Other Domains to Join Your Account
-Users who sign in with the same business email domain are joined into one account. Everyone on `@company.com` lands in your network, with the same peers and policies.
+By default, users who sign in with the same business email domain as yours join the same account.
+For example, everyone on `@company.com` lands in your network, with the same peers and policies.
-That covers one domain. Most businesses use more than one: another location on `company.net`, a country domain like `mycompany.eu`, or a second brand. A colleague signing in as `jane@company.net` is not recognized as yours unless you [invite her manually](/manage/team/add-users-to-your-network), so she gets an account of her own: an empty network, no peers, no policies, and no view of yours. You find out when she asks why she cannot see anything.
+In most cases a business uses more than one domain: a country domain like `company.co.uk`, a subsidiary like `company-berlin.de`, or a second brand.
+A colleague signing in as `jane@company.co.uk` is not recognized as yours unless you [invite them manually](/manage/team/add-users-to-your-network), so they
+get an account of their own.
-With **sign-in domains** you prove ownership of those domains, and everyone across your organization joins the same account automatically, without direct invites.
+**Sign-in domains** allow users from other domains to join your account without manually inviting them beforehand.
+You prove ownership of those domains, and everyone across your organization joins the same account automatically.
**Availability**: Sign-in Domains is only available on NetBird Cloud.
@@ -24,7 +28,7 @@ With **sign-in domains** you prove ownership of those domains, and everyone acro
## Add Domain
-Go to **Settings → Authentication**, find **Sign-in Domains**, then click **Add** and enter the domain, e.g. `company.net`.
+Go to **Settings → Authentication**, find **Sign-in Domains**, then click **Add** and enter the domain, e.g. `company.co.uk`.
- A domain can only be verified by one account. If another one already holds it, your checks keep failing — contact [support@netbird.io](mailto:support@netbird.io).
+ A domain can only be verified by one account. If another account already holds it, your checks keep failing — contact [support@netbird.io](mailto:support@netbird.io).
Once the domain is Verified, a user signing in for the first time with an address on it joins your account.
@@ -59,7 +63,7 @@ Once the domain is Verified, a user signing in for the first time with an addres
## Remove Domain
-Click the delete icon on the domain's row. The domain your account signed up with cannot be removed, and neither can a domain an SSO integration still uses.
+Click the delete icon on the domain's row. The domain you signed up with cannot be removed, and neither can a domain an SSO integration still uses.
Removing a domain does not remove or lock out users who already joined through it. It only stops matching new sign-ins, who get accounts of their own again.
From f169ca06c1099fa8769f91a178790819bfd4e8df Mon Sep 17 00:00:00 2001
From: Eduard Gert
Date: Fri, 11 Sep 2026 11:20:35 +0200
Subject: [PATCH 13/15] Drop the authentication clause from the recap
It summarised the SSO section, which is gone.
Co-Authored-By: Claude Opus 5 (1M context)
---
src/pages/manage/team/sign-in-domains.mdx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/pages/manage/team/sign-in-domains.mdx b/src/pages/manage/team/sign-in-domains.mdx
index 006fc300f..d2f18a239 100644
--- a/src/pages/manage/team/sign-in-domains.mdx
+++ b/src/pages/manage/team/sign-in-domains.mdx
@@ -72,7 +72,7 @@ Removing a domain does not remove or lock out users who already joined through i
- A sign-in domain tells NetBird that an email domain belongs to your account, so new users join your network instead of creating one of their own.
- Your signup domain is there from the start and cannot be removed; add and verify any others yourself.
- Verification is a TXT record at the root of the domain, re-checked automatically until it is found.
-- It changes where new users land, not where existing ones already are, and not how anyone authenticates.
+- It changes where new users land, not where existing ones already are.
## Related Docs
From b1e846afc93ccb462e3043c58089114759e74f25 Mon Sep 17 00:00:00 2001
From: Eduard Gert
Date: Fri, 11 Sep 2026 12:03:52 +0200
Subject: [PATCH 14/15] Add the Sign-in Domains screenshots
- authentication-tab.png: the section under Authentication, with two domains
pending and two verified, which is what the page describes
- dns-verification.png: the Verify Domain Ownership dialog
- login.png: the login page
Co-Authored-By: Claude Opus 5 (1M context)
---
.../sign-in-domains/authentication-tab.png | Bin 0 -> 118264 bytes
.../team/sign-in-domains/dns-verification.png | Bin 0 -> 145138 bytes
.../img/manage/team/sign-in-domains/login.png | Bin 0 -> 40061 bytes
3 files changed, 0 insertions(+), 0 deletions(-)
create mode 100644 public/docs-static/img/manage/team/sign-in-domains/authentication-tab.png
create mode 100644 public/docs-static/img/manage/team/sign-in-domains/dns-verification.png
create mode 100644 public/docs-static/img/manage/team/sign-in-domains/login.png
diff --git a/public/docs-static/img/manage/team/sign-in-domains/authentication-tab.png b/public/docs-static/img/manage/team/sign-in-domains/authentication-tab.png
new file mode 100644
index 0000000000000000000000000000000000000000..1c66d73323e14f661515f3c3f349a87235b44131
GIT binary patch
literal 118264
zcmeFZg5O!DDK)^*!@xJ5
z=bY!9>pi~TU+~Vg_qF%zwO8Ety4PLnH}hUwQ<)H-1|JO#jZjrZK?e;DGXM<@-2oRH
z^+e3^2=(QGyo0>FwyL~5gSMxeorAM28X9|YNK*R?4B1D~U2mRQyz{T@e_cT)t#K(&~Mbz0~%CC-6t;bONxrT!+b1XDTGg*)?-kwb82J
zC0b6T9lKc9d*x*wSUZI~I%lL{%n-#ke|wl$9klthP?U64in`&7pPF1TIn^PK0{@#j
zX?d3@w~!nEU6#4-sKKivolY8O$KU)*qCX3q9j&3f46UDPK5dFwzQ^Y5c^$~Quy)Mr
zoz@gOPO=cS&@nUZRqbT|^9~>61hddL1$PBx0a08vur*S()6hWUMBU?}J&18Y!$jRZ
zK%F$G6AcX`B^nI}btOZc3WezZD#Z*a#Q4`ey2GCrWp(9MRZ&-6YfoESSFbm2-a>M-
z#;B%d9rTR6jWpE7t=(LBUfH<4w&n46asN{V4d^e9x^=Pje#PML;_T`r?k~yok2l0o
z_kSJ(m>B-?ino&_laYotgS?xkErT!*FAp!16g~q31JKjPPFzPp>7Uh6-z1sdcze5x
z0|0)0ems5xJZ_%$06sA>F#s<=fS;cm^#-?BfUEZ_e{NSV=KpErU+pN^dRcoqxO+Re
zxib7|_tk4RA8$z}ravA1@8^HUY3uLs@19(}{z(>!K)|0803Q!8;D6gjRR#WeDz5F|
zZ|iKV;NXH{52_C-VLlPyKi>bZl7IL3A2p5sU6YSbQ0PCa{zuXOSykW5)>Gci1=Xjw
z)W4_ZpOyc!@ShcdfIp=F2P^)E&;NLeVzd-K5b(c~CWT+j`KSU7O$JR>K~~TI!9gBQ
zu)hAxfCwX&&acSGl^|G$Umch40Kczt-q+PfgD>sBJBWWs5Es9Q{`^|DUi-`CN)TQL
zIRgoLa8TZ0Kx;s2Een7V&k3&PDsdhLBWUFcg6US6IDYh!V}3x!@VA3~2J`cW^Iu~A
ze=lZuApe$$m>%=*rR)zd*-z8n<_vKpq2c}QP^6Q>cqW7XmqQyJS9^=&fk?9MUx&r;
z-~%uiTjee0UyeddlENWfbXTU*zqTxc{wUz;;onAsmn4J7Ad_5*xul>O{
z{`-K!$z4A17dlLrkGFWPA-P^cRm&l_1XWG)VG)~&`_LU
zS!4CY{|giUbe9|h{X6gR($G+xc+st~_2@55{L>v1alzk20!2S+Vm|}Up0<_rXEDxI
zcbx#+x5~QI1~!6sA$ecab|H3E))v7WP-`U#;+3$ju^eg39Y_uveCG$$%e2TKerits
zFmd~@z4o%X_bB9BHgU5hHfi8H^h3E-iObDi@?gHgeytj+NR6xb2FJ4QwuK76QRSm#
zTBlL;-zJK|4HI9|jDSvJQF#_uZH;5k0_bE|`zToQsv8;5PVj2#-6he-zg2vT8H~3z
zoLZ{ZEc!c{hRs~}wMLL@kwK$hL5f(rzz?5N75K?d&Q5Dw|AVS0b!&>Ar1=setKth|
zExcfV9IPg6X3XtS1QB&0}8pJzU
zUr_bD=oS<6)Bd8zvP*G~2nYK+Ytl^lexMUg1PcXdyl`G5EFm320HgP|z|Rg3G>^>WmUyt2Q*kW-(pkYvolWX5+{AK2&%w
zDV2%_t=2^TOJKv}(q!@#=;|8K)p--?Mk&yV$DD~{6{erFl#DD?wt{-V{<*_%-SS0D
zRzeWfPniZWE?4boLQYEVRoE+yuV<9Ety~HdCK=Mfi(-hUy%o23tn5y^R*UWzyINoP
zLvmrWpb%W$Hy9!B@H{c+g%8CRsajmE>tzPs(
zeOA3R!?8CoJF8^3WOQu8u!}He>!apxTwUh)TewYUF6S=69j>4^gMMQdG%b%C;cak}
zGK6OMV08lQvG#W{SJ1xe;iH+>$x_MdJp4-O3;DlH=Dvk`AuHmiw6Vf5W=q-VF4g(F7UU21JNj=SXSXz^^LT-pq+i{2slJ|EdYa<+Nnj7
zi|I#B?FsfrlO6vwwSU*2~G;t9El
z>Yy)3$}AoYjffseqi5X_9mM#riG4u!Efa5RGx>^9|mn(-h$y+FDx+7W`
zRIUW}hc|qecPhgf$m$4Vj4<8uZ%ssz#xL2Iq}H=Gp$A~bJIrj68tW>>;k6!JP^f$W
ze3~k5qE3|ZZ$z$PGO?aov3AO7F#zZ!yh_=$*snvJCEL%>b?SEyX98&7zpvib2iBj%
z8wsCv&-s$x*m47`eISc15!H>{_Vf^b2vYm|-g8TBM5%zJSiqj}8zXJ=I`hBu^~bm}
zO9tXfqV!COlXI>;OEro3+n*7iT240x$mQU&aaOSOZ%;&s+bPz?{?gYsc02{Mtp@`y$uCD|!l&hN
zDwv>NPLuKg`t=k|Sh{vLB=I;oqwQD*ztp14Hts`)Ci_^PEyEdubDYv&g!NgHMxo3<
z6t%suf;6-}H9j
z8Ll^+MQrTZ(jd!_ly#!>Kn^s1c8`rHiH!j=NyR~<@!0?B*&X9a7E^92uK??%b
znnLNEM79ZZt%LyUqZ^8{L@VcmT&C9LR_pe&JrR{Z3PaGe*ubT+d9X8Ny2jM6WMJ&_&UQd<|pZpHOrLkq&$T}?&oCMI4>tG
zmRtf`tmpR2+82l5my{u|fUelAcQvh_5~o^Q1xlZcV{B-&f4tA&8_+)E^Pthy#K{yI6%lyAR
zr8IVQQt|+juiGdk;LwUENi`8SnBX)P2goviLT5Wb7qsk(fyZ+k9{_@zwl1_@&y3f|
zB{pht<wfae4e97zcje0s>
zUnhk7Vq3tJ=&0;*cLtu8r+@WaAc@C8XJh{IU^D9v6aNnXrQVhU(ZiV!&)@XnbG0OD
z-!z6ufR1}*S6hg8g+L*ofcB3)E%qQ+my@S|vDHc4Q7qahmzeP0I9dMblisG=D92VI
zz90lgR>)d!ZP~W4aQ@$YibVNr=v2=$AD6=vdPzgoRAZ3~NlO$}X}zG%Wz#Oke*<5U&nec-G3
zDzi?x{F}|qodw-6WTl|vgaSW5zs+Ry$BCu@0S@!Frh}DcQ@YN3Dczmrdh6|j`9{zE
z^VyuuU%%ee@7k&7u)1~LW#^8G{+6^K&FT&9^ns1bhu)1^j`Us=Y|)1y0ZR`^&4%iLWlE^B}i^v1~s1z>7VWPnCMf
z04b!NRPcR>?v8YA7tbe7{geQ&T}RVRTV!^#PO$;^^`I9tYriZ;%OuXvX
zb+Fo{rDPtKXBO~-of@$ob9&8I@GXIqEj5K~yBV~aJXxwW`eQcmD2MwtMp}}C+oU<|
z(uc?LBRxPrHPv>Et2T2qN5nOy-&0km*-_ssKImN#hSw7>&t}Kd-ci7AW>}xn$F1L8
zNR4!WDQj5h1|Ek#=ZnG9^z|026`*mKZ}mfJzTUC>)Oz~iQfp~SkgvG!(etjr1HLRt
zudl%S+ORA>;Mu693W!e9c65jPbXkPlX5@=%>t6QVN}w)TYRcH0i0cwVUsG3R=Hu)0
zKH|{}m&Gkm*llr>>*V)%kCWage(x*yNl3YFX>aJ)Xvf83*tb4l?c`VW@
z+ue6a&wF#fERXhO5DtB)Lg3jE3lzCY&+m8PtP8nZ>}HhTg0#cZ3!0WQ2IEgGAfvl`
z>z4N~+I;tU?#F$3HA~N*h-x2o!ldd8)OMRiR)e%gz7LLK_$|BS%bFo(2>`$BL0^}A
z7T<^kM#4BXEtc5AQtc1E=RGUaJkTDe&9KkTv_%P{lJGOI+NgwRSz5{i949n;ks
zZ4+|(;<-KIIZt7z!m`X`+%&{>T-Y1L8EAEs*Y2H6nql^OVXi);9f-K>B8ZI6?+B{Q
z9Ph(b)sj9@hK-(6kC`4WT~~{_Ukjf$jQ*InRZHJ#yE)IW%=GfFk2zdyH|)$iZqAkP
z)7%p(1K4hi_(#$1B0Zi6>^+vqA?)V8%oSRN=1FjMg>JnP^FJ<>`PO>3lT-3~-~+!U
z77s3v7vwvJRp4eVeI>)MXI5!iTVoc~N4QhrW`1^=V|m+qhQqf%F$%~iD`RJNlwAw&
zxL$DbG{c%Ss5Twt1}%Sunt)0BPfyh~a(QLDAIWW!P{c84%gyyauEJ__>jXQ~I#cmv
zy3NTXo!S?L*4$1HUNiPZ=Zvm~AzW%+6YM}mc6qw?UNlCW
zX3{Rwp{VVi1Q`-jU-smj&ehVVuSm8BVbP5}eoYKnrx_`9mVMmM8ejg+wA`^=sNsJ0
z`BCHgm1|*JmW|p3ky-MsMgZ&C>iswo5?e=c$18}pi28RotTSMz_0j>VjHO7@+4^-3y
zERGPu>$SB`BeL6FQVY;B?h%MbU?&2
z0eF*|T7blPyR;-@wMnzEh4Zmp`%k-$P$`|-rjxxqC6u$mo`so92lQJGja%|Z3cb=e
zLlR3T-*=v98u`d^n`P2TVyzF$C$mjS{P29Hjrk|>GY(m~1V
zom25iX{qaY^*kwo+G*sBM0%*+#nB6RkfaV3zTDO;&3u(*+Lr%~yh$h@-~(T+zkWr=
z&Wnya$%&6n%o+<;dgPCPV9@xA?AsdV+5kp4&P8{J-%b!P`Awe-$z$g4CQngA_W(OR
z75Izu_(%Z#jzYpFeG((T{K5x9r{ug(?bM&m)fA2LJ82w!
z75?J5QVBeuux6?q%ynyIpy3I<{J^Aj(r*8h?{D-=pc~sm9)Gl7?L?A3kyzkA)r=IP
zi*FXCL6PD=D{A*QQtU7_?ehhhEjsMX`;}Z5Pu~EObpsEKn1z4JImR++F^1cT{Dm5K
zKJp<^k6!h#o!kJ@zNF&nAqQZJ$A*9ZccVyZLs4`rB_kZ!!dX&-QnfuJWo;)`0W9rzLE|ml}qyY29v+&G0
zBe4*1_&Z3odRBvY^du?0e4-Tci{ifUM4hTG%<%fdC!5)Xrr^t{mP^GnD)4JX-8YiE6acdr*%Eed)hrGJ&!06bX&n01Iu#VcoD~}do;DGg?
zh&b_3a2cjVBzUdFh5EK#9IzN
z)KTu5SuNFcDqlU{gkQJSJlG>*l~G)pd687(>U%a=wYNvP}u31@htJ+!RM-K3#`
z2@o489=)Mgqr7_8plAt3nfQapzBaez;};9lT+<~BNUATc9XCTLGr@xVMXJ17bolv@
zM>22}9u_1XLo%*yiCf8Pm@33&7&-N`kd%4*xJRBp>_Xiwps6EZGZ2Y&8k<&YBwKUf
z8F8RDzP~(cDP+4>S?GDOWISKzTMg2z%R@Ckl5n_qt|)YA<}_Ok_~o@3?bF}_-+8L>
z$$)etrBX?Cp{2Uv_3&%2YL`-o4o`V-0+n6q;|TFSK)al#z1_$j#i&=)ZqS-U#(IW%
zIr=Km_0j$bXQ!gYTx8jlj$$QLDtOh8J<4;bL|IE!{Y8r5AkgW^Ep>;a(^V7*{u(g5KnBS=TD^&G=Q7B(6OnzEcXDM7`$%S)iU(3qxwPyqKCnqD@N?w(!
z={kEiz?XH?cd5fU0v|26#e{vx_SsWen5niH=O{NzdB&Qqo0yyzI=Bt~sVqrbm1F}2
z!Ity~?v_YzoeZm!IHZH^6BW8%(n&TChS8ncFnrWOdNfTn}f^K
zcxX4D?<@nJSk4^uNmQDg(=^!c5*fnqo3MI%hXsXs3>>G+*?jherh?3Vn0bBBUD1TV
zx+`(789nin^5gt9IStD+Lro`!}ZQ66e~X3Jg`K@T|D6Q%dMfL
zf@U6&1+4Ggoe~^mvzct;%6Q*=u+jd?fk4nf-xou+pW}`^Gl?4UfX%n0KtwL
z7KPZ_;UkqT4~Xp*h2dTY4>v}1!q57tjKtL-2}4jsjHM%H*C_>Owmo{V^z|C8G05=~
zM_gTRd+1$k+B71@a*Htnvf)W79kI-6ksf^7(`MH%nYe|MRHbCi;%m
zkrKPSwy!xaMLwn*-XXO@gmZ?vix<%d4K$oRq^q#2gmGf$x?qoR;0b2Hw@Ii>70=SC5*eGalcY$H5f
zL;9(CPIEp8k|WCJ19Wiee*JMaBq4UMMr0(C7Kd{Q6Owk4<1p15MLDq*e$ksuD4+SQ
zWgrQT8p`dCefR)Z5;w%=mw{FO)xJcpd^PP-7Zj0k71@tT!ILk*Naim~7c$$y|GOP;
zXS?I&q+Nr}I`H~#zgB%ZM`%{H_Cdr}r3d}u*C~N#17IV$XTPgwUE7eZ0Y|l3fwhZy
z`AFFs-{D@E9{}?9=Qr`@R33M;DzWE-;pLU%6-b{IbGO9l}c%8JEUoDeLtuO=zP#f4M!L
z*Jf~kska^La6VTIBj#h$Rl|wc&T{*`jQuAw1WAgfql&?0CvqzW&oXCU$Z?ty*U8IX
zBNdg5-6@L*mKc(@AuO^b;pa_%bpHK%?Z>Q!(FByve-2mOmCm50W;yiu`~K-#Ej|1L
z?gbb|>3R$0aEtVkC7}^N^{gH8>T~fcqnaVAl@UCxsNDW4ag?4>fGFjFPup**-xbYT
z2CjgNz2fh27>|Rc*VT*#!}3W@=mO6!C+gMwvLw9Pq~tMJN&+=tUK34kG4M-wooGV2K-R#?RQqbg{z&%S=^46n;;iO5>#kqu1}9
zYW$J5=MPH#N$1nmG@Uwbh*Odc%{Gyab6;BhJXPYI2jZHlO{dzKCL`^Ox^t-~KXzll
z$o<#4$w}!RY35WgDjHa23jfAomg{!vo;3mOGsNxu_;kuy#c+lp_W;a$EJr_-&XWsR
z)a!3OnvpPzlV#5m3aM})Kjg_3QBHka`Yqij-+8hq)f={K*mm*Dp}*8xIq_zgi(w~2
za}?J_<~I8l2@>0Jk&n&|xjNF)mpYX2J-L{)U$aV0?dRU8D+(kLgHg*hS<&h}oG%SX
zIF=($<;bbEUpb&wQg1jcEwjSaqH$@CP+^&c;IkZ|!XGWb;_dJfV3@wTOw!s;0^xl4nx|5=c*aDSF8j=pT-WzYUUSvH_
znhN&35!hdZg(j`uop7|ip3;~oUe$(2h2-`LrG<-i?fN~!Rn=H*t5?7UTFGkV-%62I
zX`v6qqoqElYJBp2ost0k)(oplgTCw1pk|4+B^~y`qVyaKJarv;OyXOk%T{+3R;19T~v53=gjoh1@
zNg`TtD{zMMP$ul^Gh|oGbH-y)8Nz}q53#>H?m@aLBJ<%Pl<1PPD|crCwufus$2VRH
z6fUCD1uYuwdD8aL-mpo-fjlF)v8)B#m;=`ECwumoP>2{(#C}Im!@F}~
z+7zHI4MqhLNnz;5ZEe58CEK@R@4^!9bvH(yz1fnbMs}^vvTcK#tcCND;Io8+;!**v
zyGIW
zGMioUj}tlZ$e`=kvim`5O=v-H^n18Kw$Nej+xwk<2S(H8YHjCFJf>1sL$OccEh{`d
zd(Z*_UCwf&$r5|FYt=qbZ#|DBBJmT03(-{aFGwZIYtJkR
z9d~>7kWNoz#W#aAfn>(-eW0uuVQW_4*>AU-n8#aZK(F*hL{I*Hp7<(PO~;DAJmVLa
zUo08(6<7^XYzt^VVlWcf6iV4Y&GlB>fUliELo!DQm!XtOjIecm*8SL
zrE%sgs_{r?UPq_)CAqnsPmBjCeAeM4E3u3E82HcpPwbK}6ob{duR(@vmFoUHUh=Fx
zuWalwgLFo5Mbil997SDOI>uK1%&4P56ht5jyw&E(&j{i|SwN8nnP{38abXkt?
z*OOq`clMD5SB+lwjrYB={6j7iWvY`;2L?OgUza`)f2I%Fa3B}fdl5!;{VPudY`X)=
zWc6FR^t$e1yJv#lDW+cL6ALw{Ge8)g*`3_BHrU8sz+Tv6+}@!>zh-Bfeuo6zuXL~~
zj4hT!69g=YciNTu-qbZAlqj5TspX7TI09^k#=9_7-62oIVYzX2bS
zA#-A>*9%H=M@1QCN8BfehMU_E1YL^d-4Px<_q9HtYG@n!PI8vM11UX8=f7qgfva1d
zGsrw@nPV^1&sp1|r`S-GVZo@jI|dn7s6$XXuR!cYmHR@8P`>V!@MNd1p}AO1DX{VM
zvNOXUwMVUui^;yXMeF$|Gk$uf3smWvy+7!A$|4o)693HUoxq%hPoj5wez9C8j)qCg
zCtvfR?ECIx`ta)#)v)(Dg6m#lU(|{eM{bB(^$eb8)pFS$jCiGzxYcxQhGt2Jd~h~u
z>}}555Tu{QJGSY^d&ZKUdSmwnY<-R{arR#?sKka
z=<|4*WPnMh91E>HBv>RF#&Sz}62=PDB685A+pk_<#Fz7}`_e*4aME!E{0_r0%0~>X
z%Zo*_*=K69R&V|(BP
z?@S7TJVVA__-a4faYOu%>KgRep?abR<80}YAgE^_tA-$KO5+qHjbv07$Sly1%G-Qb
z5Mc!sIyK9k(T;UrIGfb(o;;4f`Gl`$eRmzdZ_hXvLg2UZ0H>G=4yTsIE$Gndxmou?
z5qV28RQc@XZ3)AztNRvj?NZhJ`Z5h}cAB32WMJ8!hn=AW%aT(4SB6rSbagplT8U3@+{~T+H
zXciOet~saU~1;Z|3@v`u`-piErwT@MYBehWF^3!31}vQMi8B
zJ7Wfqhfwn`Sak8bd;4w%>x`PAxuUXtBO`xOg|>Y+OLY1@JG&AfE2xhwFs#%1&2&wN
zac3wh8B>FTeBtC6*6nwOU`s%t_L1mXylr4j^kgQqdRDWd(klXB^5@+}&3`0Sukz!!
zJeuL7DNJTg@HQb<8-iD+gOie7v0}Bb>7ONFlY3G_hue_o;LB^H9?plnxB5O%$l*j;
z02h+LuRApE@nUBB{%*z+c%BxIUr~KIn!CN$&I*UQaD&;RrJDn}MOsuObUzDyO
zORO)YbSf>F!z=mahODlf2yPb2*KKgj!STIWTGcm%C2F;I6Bf%~#)%gs0z$WwJLLhN
zJa01Qu{BIpO6ibaI(dw9io!UgDk@)Gat{>z_8G#~9wE}y>dp8MK`SsGc)lhSxo
z^Cfjv*th^wg@G+xpDSHeUxVvsk(VL4C&&cO6@nPp6(gXSEM7t4?2XvQ*n*?a=2?El
z{nit8MhTxB8%e?&a?N?U0u>|Ljms|GYol*H)s5&V=ul>(-z5=w_V!Fb-M*{O5~L@u
z#W~p6xW&qWCu1oBaWTT?*1
z?uYEj()9Q9s|~NJzf@#KfaL~#9GYoOMMjkft9wuQ%xQc!_db37A&M+{>}r6Tz)wv-
zp8UuqPZ=349933LkB)PhoaX1OWSD4%%24=ywwW~1lGL5wHWh`34{AXl^a(z7DZp2A
zDrte($6g?|mECg8q$%|JUz8i0PE50eAksgIuYRBK`swaPt2WU3gH2Zc9k!+K#}9Z}
zG{v2o6?+vdC@*#9G2E-chkT=#>qSM&`)TzSHwyqxNIJDo7MT``>;H>#Vt?RY5nSAw
z_u}(M#M*L-C^zIirb^*YT+x9imQcFgX1OQY^#?;C^WnIfEMkiCO-g}sO-tE?zRM`6
zXX^;3a5n>ct8sdpR^PU;fj+-~LzQu-!q;GU)Y$cJoa^;U4^9#m6?yaVUK+47YkZIv
z<=BmC=iQaLF4b#%u(9*$FCi|<(LGxN7mCI_5to#)T;R)@S`(f_alaV1mf(`}U1%l~
zx%9n?WVEju4j~7DT@eK5u$$RowI=T?GOCep#V=mXfBzysa+cl8WFQxBQ;K&p^YqYv
zQ!#RD>TYMUMva(!;R40OVL4k~k6WX28F2;|UbdL
z_Bb1ww9Gvy!v35}`(&@ivRVDJ5Qnw1*_y|Kc+U<-Vu7dzzj6HweOdlD!RNn3rXDuR
zm5i*c(+R$Eq+>aI8@SA1XWDlLo(=J<`0^z?smTH(I%rXmX}Dpp+J-PJs^OK##ZwSU
zNp{D;I=Ja`?*o7B5?^tpm%;%buR&F2Ek;LOuzcV&v7Q5@%Hg!LCfkdVTQS2tU-(=(
zOUT->=;3C1j$4|Ww`~U0+yKgv_MndZKUjfcOE{36-96cUVz%J=ysoD#!kpOFPFXO3
zDKc(rYL90?tvo|hjl;4&r9b^7mJ7GYbAkHDAURbIH`uCGy|k5^aS!Zz$%pM^^lGyS
zpHZ{1Rj&?TiGjdJN*II>O#Cc}=t91;Cr-Bm`3jGcSJ)-yZ8q)ZF8=!U*z3(=-$m@s
zrpE`Ll3vaD?SpUx6~=>DF%myvhfvNrLXl<8^Cv+^%23aSVk!YK-$ks)r8
zNs^A_JxY-oKomGhI5-WLoK
zWq9f9q?>|g`^M$#vE2l0Nm2atv9k6J4L1AVn^~PlS`1N005O^!erL!vgP1p%r%~)W
z=fMBunTB`>e=lCqfqyG^04Bo<@N5mKG?&Z=7|v~lgHwa=qNuPeNy68bF-`^pmQ8sh
z^Y&|KZF@f?Nmn>db50b7hRlC+(8U#k8$3%Z(Ua$hSdr(B`6PKm_;kasyQqo$1@&Uj
z={A?QZCd^X@2v1tiyU`GB}V?gSI9qB%aA~L_Y3*_oO8V+liCP#aODQD
z6Tk~oi(ts63&{&8iQ`_m@;h_tv1&*gg_=f9K|Y4E%J!DyM3cTm;|LX*K+Nl+F`Pr0
zwer<3QG!mBvKi}DRyWkX)8`Xy)*$URKHK2kM&E5R)t~M)bjX-&{T9cm8n(XL&X?F0
z8?Pul`=0xclfU)f)anlZnQGa7PMLTKsij9&JB)}ts`A)WYLF$*lfL*>>*+0Yv`K7x
zj-P1%F!Jl*{aX2bMrncI_DiV4ag}l9diuW5$<1dhuP>&v2f2pqhV`!%WpkYLY?QJn
zMk$9S{g!__%cTR18R)~V^6~CXK!L3sB5oHCW$&KMg0*EZ?6nF2KiOMmmtgvI*-w?@QqtQ`-@%TP@^o4^wkWKql96
zn~%_-Riu=a>lmkg#j}FY(`3I;RH`zgK-#^4!>tP|r+|Bq``?z}k4cc}A!XN29`u_d
z@mBo
z(i`~ZoRTlUhFvy)p_gS--5~PLq>IA^8o*~*Sf*=
z&ms|7m*2sh>;lM*P50~FGYQ{=G){faCmy&_c92|d%i!Onm5kumPX+A81kYcB%vzth
znbzL!Dz=`bBzwL{ttjp)R-UvyUJF01Ng%)$ww4Yy+?%OpcABk8b?eM~V=&r&61~6u
zeZN+~b|nNBLca4M!lNLR2iAFCBnBIO7!rm!r<$m7d7`Se$e3EHK3$N5cX}*OJOVue
zFHiM=tl)6UEr_CWp+R07|5?hYSr?7)No+1^KPT<G4i$#-lSr)<6zt?A#h(26V&|^#!h5
zEpAhHcDQKzRWpzBlvj%Wz9elHN(2tD2sjtIe&gK29Y%!7F2)7c8
zj<$Exjp;n5tX+sc@z&c0HQTli68D$w(wY37t7{Gd{y)(K=xWu?jM|B$ihw5~`Vb1WZuNiZRc#pVwOUM#NW@Vl-u>@YkcdOcTszsr%4mi7#8
zr7Zsq|6L>Z3mN+b1#X#cD(P`ARNr
zIkzKb2iL$d`TOo)qv6W`xKJgp`ln%+zspz;;#+~nnX
z?;P8+cK`=V#h~Z8A|hXkE`BXq&eT|xcL8i8^;V2=oi+1;9Hzpq?)f}P$aI&5J^F(L
z$`_WMv#KTJ8UU4ZEjT%pV)~~<*`PT`{*Oex#>Ce{Iri3Av>;NP_9Fwf
zG%pful5C2hx_6YFr;a2#a^~hE%);BvY`30IgQZMH_CKa&M?TaOD
zF1P!QnqMxtft>=qVXP?lT3Q0_Le6Inj%nvlNi8Ie3@f**FuKchEiJ8#6U$(h*@U)*
zSY@Y~Dxp~>K4~|$B@RB!i56GV;GXDsu--`dAjEHvcE`?kdX&flvt92|Q^Auo#MLs$
z>$ZS^xFcbS@(?6zSxbt;Y&9R`6jHA^PCyw>@wH?FTp
z{0rK1RvZqCX{5X0;^2zRflc^o9Lc*E~E}pOSV%f}Eud&R{
zo>h3KeUo%+A#5M;da1Gaj;*Zg&e=H3G=6s8FeNZMA2K$=_f^KLm!7GjLS}E2I;?7J
zNR;RO`)xscyLdw@!VBsP5zYKR7}@Z+Pcq>jfK*(1kQ_`NUvyz&VodaQSfVN_iacNY
zp<`@`W+fnGGwy)xaHI<6`iLQ%`S@zkId`b>sLAbAB1k68Ao-GVI_Bq0Srogxrcvt^&>j9
zYfL&81ZU0RA{
zPYFUu5E6#`(W21vV|V-F!iei9zzwqBbIt8|;XK8FwquKh8uU5h)!;m*TS$w?NlK-%YNhaD
z{Nt#fEn0#FbJ0F@;nN^bQRGxr_0uD;G72eBV)534v&A_BWEnIN+upK#7ZIZt@%^Lz
zGYMNc^ZU!w$1sAc2Cqs6_};V`u6Qs9=)qzA#{l
zQZ0+$cDtrP`ZJe$y3l8)$nsf>V1uX@Z+jnD=xEE~)M
zuTr*|ES5gEy07@}(~1R2DPeY@NmR>4okIG851GS=F-spr#B4j_^u|*7dzz1Jz9)Pl
z^5Q-;q(py|^1Jn5HMKv^`O);GKMr!U02SJ1HEtyZaxnCGerqw6*U!#}=4@1%)>@c*
zeREd4a>@R1tAs9v$uA^$^=I?B|C1@K&G3eZhG}ypY_>E_r8X49rZJRADip@8>pP`U
zJUz-dJv9{KCC-Emw8=ix1jF*_wJed5Z
z!Ulo%{ajnqt@}O7f(}SWm>0!C+oGgkFb2?GBM0;dS2PTf$_4~MyJaWJj0wB|xrgDC
zqxW~E0j!MdChhAj5>rp?VnQibgiDnye43ZM2bWJzz3!V7J)Or_{mq|QeZqI}Hwc4Y
zrB29%b=I0Tb1JvW;CvGafBrK!aL=B~`TlN;ehfYi)^}<>ZF{m!uO)eOp8H}}kDwNK
z4{)Qplj`dX^FKCNBl<@a@wP0L_a8rPW70yqcBu2D00#sU?$-6+uytFPztF;Ss!H
z!KAOzs_S;Tn3Y2aGoL3dtxm^T3X6cdN-`i&(&9>v~3rS!uG&
zGu*Kpp+3QgUB`8>Sc)0
zmWXA*FfN7BqX$Ta1H4y8$4`xFt}keWTy_=}<^~CN#)N(Nrv>cxcQkb52Ob)cYdi$o
zZR5N7Q_Ia=l%sxYi%m@9Z|aT0RmSQczqxT-8m!Up`;GGyg)bw07)`b7)^%e>BQiSt
zYL9p|%ZXh;L(+_-6B9rdY1k9D_ba(i=}o0RNa_Q-*1fc@`U51k$G)U_E6FRRV_(@J
zgLi>4Vn0wYM{b+Lk?obAymgT{pQH(Fa~~)E=)xrCUy|5`lN_{}uJ+_NO48(0JfUJc
zl<=8}0=^j4lD=E(pmIID&Q}{JX$O4&c%FZ^1Badk)Vy9e&G$ZtN35AMA2Wan-dCKc
z>%Y{hP%$YKYc?qIOx}6NS$j!SAc3oA@AHtOjUi45;nhutKs;RB|ATNx1({o{GFtgd
z>i(#IGGIW*B#E|-qH{h>`HhNrx;KGTntt-w#1ma~gVeA`tAR!=sJLhOoqh>Qnoc)l
z*51bQ+0O_Xw>Y<21$bKKNCqW{VG(Brp6`v2Ye~7BQe35bNrbLPWo&&If)@e2rOB;Aj{j_L(c-tQ#mxez-q=cX8d7CGv|x5
z0=>uV+=k^iGV0D%0S>pJy%|bPC){_#2-pw_VRGC4Zr9IT#;nsm5V_6o-s|k*(zbGf
zTAWhaxh`lxW@$(%&glQg);B;`wk>PNwr$(o9d_(=Y}ex;?wrv|7+v->yqyOFK
zoO|EB?|)-ttg+VES$nTpRkP--s;|B^mWYezbp$&SoH{X0Xvw<ol@81
zAT^GC+unEjxg-3nEckocN2u9`=UwFsaw)k)y))`}#Bj<8fk1A(#_Z6z47wL*NU~K`
z?hT6Q3=Z~PtyfpjD8)|6F}Sv9NC~KAd>7or`|#iA_?l~I
zj(eH-w*diJKB%dYiT)H1;`}k)+RL%WM9)6)>Y(Ji4#>4YO)c)*Wv{*1%e@Y&TjOo*dqUJhL&`{yvscErc3nu-Tv^jqIv-U
ze{;Jd8tXB!nk~Z#J$(EU2pyZemOr~Ry~qVqJf
zg&`J6013o3pf3|bALhOFeG7V#-lXA1@w&?EZH4vO<~+>nMRdQ-VJf<%6nYd+?mVlQ
zS5bZx{_F2=_Q_!UTTR9#RNGSz8bT7PDxdvX&>}Ck+P-Z0Jd2TQkPuHTa&J`bYJZ(p
z<;?PndulcsBIR8x4Gms8z6)7}mn_d}w$0=XHVE`#@_sx|C}z}>?t+Sz{fPxALIL}=
zUh-j80l7hzih8@<`SR8vjw3R17&nDRZUA>o5~mjecH
zwqz1k0M&6>Y5gebIUN@SqkkRMeiM_MPN1+a_&mzB>u!B_Nut@NON;gFkneh^LDBob
zNx^(6Xp#m*p5oZU>}_VuP}hXshzte~o&7G8zvC|X)ZunA9>uO=p}WIC7g<5k9b9Y+zZ4RS~~b>1|3UPG!sUf
z<*epE8r)`62^M0Kv5{3rkfwsp(WxpTHt*;kCo@@9_^2OofPbJ07|2>k<~nliN2O
z#2@t4m1e4{es_Ne0vRK=JRg1g)VsV~O~bk|`hCv&_syRuQ!`UPRZccZ-_i2C4(K}r
z!TaoqXP^^>HF^!h9-QgJ1lzT2s40eFC10|DP6@~uo;h2%wsq~7>bb}TPfQe`@G(}clw-=A-0?v
zi#V%Umny024ii*Rh8Qh!PW~ER_oJHm{XSzB!cxhHS-^Z}hb1qlF@&I}q(Ma}6&f#L
zF=(oO2#0%G!#kqJsBiQ_R`de)I@Qc)RzQ{Tl~^DpHvSaC=%ZOgJ+tTG4eFI7Dp+{1E|n95-N^d+J_
zb5Z3B5A>*xmwXYNdDs1P;pBB~pc5c4;9$^CFr76veuInXF2JDhr!Gwy52QCr@KEQa
zMxzOYxTU{5aF@Q8gf&A^sO&|rtXy|p(9hddiDwD+f@JR`AO%e3X8+J1ESX6=xvGBz
zh^&d!8J}YAQe6itrNV9a1>wVn|W|0y&&S5Mg{=niwA
z&T)e;SL@RPYy9~#5lE=utxhEJgpLODcqup<3`@FkoXI@w83sFRJb0)MhX%I(x!LZx
z6VnBH|G|9pF7QX9@Bni>Dczh1$jVQ1SB7ma5)NCPmf>)GLl4r7^cF=n9$UC^p+4HQwROIp*O($e&)kHS3lR;`%qhi&6)a
zAm*4_2OM#@4`RZt-dK0u=jM9dr%UQxBe0W6qT%ssA0Wu_wSuTHHJIQ}Yt1=xTU
zl@~3+dVFpaH1;M@Nu>
z-7NN%Di#C5S?|Wr&M*oZoD4bxT>vx?*gPwwkVtHymP-Ng&SYjapFBY;>QbfQJJ
zbi`tU7sq8D;;CA-$fU4zk{Ej@9bVY6D
zG3I8uRG%Dbts2Kkul7`ta0Y-#GYAyddxafFzmpfdU^3~?B(K5xxdma3&ivTt!Ltry
zn$@=k@3y&`>n!-gIrLzxBr62`oLqK#*`_t?54TV_TRe)#k7mID=w+}eSUs&>Cl_yd
znoEC?j#vD4jZH0b
z+#cWaVtq-}4nNrG2QUNz10T$O$ZnVX#&uB$?0*4PP@vm0R4pP>MG2J*@6k^^B1L%_
zHvKeyN1is5VGa|YdpV|&k4XN7Y*FNZ-2p-uj?q^otb!4iBQd0ajhrDu{<~U#QIrS~
z!LsPk$L?tS2a^b})ejQ2`ViKvOESP|?cdV*ftj~nh-=UO
zh(>!hi&u6*EL300$Pg
zcF}m;FDtY7(nc>S
zlwNo`edPht;rjm^>7R2&7ob8aes1B%MExIKn7}C@LIvEjny4`Rt=_-kOaE~cO9c)o
z-`k#t?SJI*pDKb$2Yw!>R7dh(WBXIF`|A%w7Ys7NqwR03V`{B=m(Q+_W}SuJ%Du+F
ziTy}^L;Rs{05-`ToToQD+eb0}`*z^T6Q%!l+jWO}VU^HlA{clZ%v%PfM87Ks=lUIM4>{}~X8)9Hc~u+uSll0AJ;_%AE|dw`1m
z5c$UWQ&)QNm-)aiM?eEpXbqHevWf;w)p-9VRp#S6R+%<29dq9w8IKo*zFVN8{|BJb
zJ0!m2azq;u9X&6Y^?BlCvhthlOBVD0$N&Ql^sQP|I{(*W)fdz&<`Oovnw6qp1|Gj^CEhibAj_U&d^4
z022Rbb0`#KBMiPjq;&;kN9aH12o4%e0GR@9nMzZ6Djn}R7GbBy)k4a#0C~?WX*Z?7Q$OhXuiPdsodmw{0A5Vs}#*9+sM1BH${~bDlcWxue-O
z{!2P!$*3p)(ch`1e;N9}P4)?eh9w@l!ZgHqH|5c`!!1Z$xx!C$YOKJH+X^Q4#qMpy
ztVgTdoWYjgm3!m~ikV2`Sz481<(~XF-v;vEM;Z<=NFY&KQDtX!N^{*Sn1rV
zC#1aP^C$kf1KA}@SYS2dcw^PsZP^AjrOE!0$+DP8I9j`zHAnc{v1}^mMCt*}|H(WD
zd;l7YKR<`@tJimZyF#YfUaMp7v5|MHLPYjn%k{A2sz+IAq=CYwk}5GOB7$>_GDufK
zo|u~+h_*T3YSV4D)1od?6~glxa-FN!HID??)q4EjL}Eg)trghM=T2AEgq~K0&;4zl
z<=B;TONiEs1IJki9k)8D3bUjgA=#
zR02@up;KW_AV>vF-spHC;xYXJjE$2s
z?swXjvczFlqKLce#9Ar;TWkNQGC+j<56e}w&0)TOM+i3J=M*V)0d|>qYzO!1DRNnQ
ztuBW*N=YOjs%@6dbpHoTy5KbB~+cMPhh=|e;cBvk_s}bqAc?fi-?Jd-#?Ks
zabHtgt#dWj%b@?o2Q;SC!COp|*~u~9m*L2-Q)_MsiS5eUb8Yi-rIs;Zfd9{w1tH*c
z4(hh}r$12ZO{;3fh}M}~fDaHN(F+GaVXTBk26&OYEG!xZ)BghYeQU0{oY<<(ueW%Y
ztg4k~kRfU}#s?SP*4qu`*HSH)J(BE4w>S(J)}9`gIIIRk0696wEpfavr@JP7QW$fE
z14dxOUjNrxDGbEojs^kviMzR|ehO&-xheAw(EQWDYY6GDg?_Cz7-#ZA#}auwu2_Fp
zEY+-ur{%gTxjI}JLr_RoE-Gw@dpxYu~2KZ+FyU>vT
zq-~_wS>=%W(KF}2kb8ghLaDezhD-}|o;n*4Hb_8pb&vx^xByF5!>;zOqO>Gk$=-B?
zO#pPV>YINFN;RomdlSTzu}X`SbD2s}21$h1%dBX<-7^{D6(1dIo#R~7wqnE_K(|&;
zl0mZiM}1QbaRt1pOB^zDHaJd^N^I-F0sMm{e&@MByq8Ud>N|)1!U9
z9dhZ4cP>MN!_pm>?}aWdjST6)oFw6=^9ywTCVY-~D^9CS%(plW0oyyT)#lj-I)iTy
zx{y)k3LoOrRw5qOKushsWVo8d#QX*>k+kT!By#I6Nlu6K>11I@=gD$(p#k9ku{-=j
zKAUHPLK8>1AOnRr9SFQ4fgw<;Aq;0#`z1__sqzFn;%2*U^ZDD0oVN7I+^QC5rx()Y
zdVwB5vzV7c*}h_n6-D38cH8Lop2A8}C5#B1f{ST7X}!^{sKxsHYBSj^rocF#QcWz6
zpg4yEC0IHaJ4A((Z6sQ&5xucPcPJH{?pj5ziq^LMA*GZi)+4C^F&8|l$F`;03_y=H
ziFNI$wK+Uhq?d@5vGSf|quDZkK-AAWN!a{#Mm{1YBA#xs+`A%q&QW+r7)>7rfMY(A
z15Qz<0||89dR$eyq`+?agr#gRFGwbP)60J^6MvszXoIcVOANWe5%Bz>X`uoE9a+{M
z2{r2jhg?oAf0X8F{?cVZry`Z2b&sD}QxJwc-mS~O0B>FqiMLv|2!u47e$IQI{~CvY
z2{7oGZYZk_olBB=6VmW#x&^kB9#34B$C(V^LKa0|s6nrS{b>3bm%z
zz=X$h`x;7Jk8=W5lih4qX`ml2$CWU0L|yT?IAM#HnY1mcZ8vMhwcO5`U^Lh3{i4s;
zyF@b@Pf2L$PR}>nHj~OqZAio~Hk!u>$RCkAgB7twP|tsSd{XA+UG(6NF!2US{{}3x
z{ntcOWPtsVSfa7Tg_Hpi2@QI%MOz~hlNk;kFj8HMd1LYpTt^65u
zOQYUkCt6mtha%E~QXCRjvzO8_DjT)^zu1v=fKNYy39kT5*&U?%*YtubLAQBieb;=}
z6d~N_cl#AysmZsEfO)}fy}rsI7!yYwY&VobYh2xQGB|;{5TTx!lThB
zL-;@vdHWpn3N++nL0OA7_Y-=QmD23D1r-iY4-Q+{zef(u<%_BdJDGdbk+{GcA$R)u
zT%3E74n20>;q0o&ixLrYJEKSK?TzDs4p()4g0|0fDOmNS93<#a*UOyPwJ
zT0%SLf9-Mt_9RG-@nvuD1ttD;$_&D2#1i7?o5qq}r!6+RWU2>1e~DJ!EfSsin3KMn
zd&)rUtABRiISlmS*07z36oIKI*DLAPEF0Gp)N)?pL6rJNnqu&_l<=iNwC|kPCjQq-
zItboKX{O)LyatVG--Fw_X6G}isj-IjU@b#RMx0^fioyz?)f?l?JgJ=BHuR#vR8EQ%
zaW>NfJQ1GtzIX2nO7e3KizTf@{!~^&EsbpW=WqiQpZ{M0LVxvMBt?}uU{NUE!VaET
zDWq#Kmce9>K^Ii;UP!IeUGG@VwFlj7IaU`Z=kAK)2s7aw;&*%)R6e
z7zzy%Su7o@_(lLUg43|jc|=mLalCg5Vr(+q*kX}%o4DQUVr7${y=Ot9J9gyfj|}~
zF9n&Oe}Q^r|3>)?5P?Uf^7xME3GAEuEGCvY6Ge!8tKD~vu&UT6i-|IGVm|DNv`2L-
zr^(E&Em*UD#HcOpVyVDW)JzwKM3k`E;a1v`weOsImVV2WU(}QE*NplC^s`vhqQ20DCH#c{%6Y$=aQK49u
zzfcW~9f0JQT$S49)vr!1$qyHs^c`*&9AU}y>M4I(a9?H%AU_CJKHC1?UAI2L9LS0|
z-c04P1NpsZK)_Jk;IuaC2AY|39#*!oWJ1h;s*^ZlnlEII$n7{<9~Vy0Y14K&kvBstjD4i=>T(7E>(m=WyzPLMlK=7P7k>UOjD`SDH
zThMPc;&IV#wz|;r8QT-9x0}LSwidgg0FFI>M~sMDkFe+)gMPb;T8)+_#_WNotnFI!
zm)XK%*pW}=q^&TC(ZNkt^J;?7riE(RYizp{%+8#vZPw~#d4leg*t6c#a&g}EoqL&R$0{ltV$%gz!cR1I!VPJv+50@08uD@*nCYVCDE}>4b7O9
zB&mVenM$eY)IWCqOiF~ZYi>uTq&MuQ_36MbgKfxTv8d2Oul#7L$hPC5-gN@&f}G!m
zmDx6RkS}!kKniTO+HJFau2jj`a)Y(&K2?vgtl|})
z$FIT?^BTMGPIFAo;N__=h#Mtx*$D;O=r0xKMjT<<&$owNKr$>loyyPS1c`f~eMIw{ZiexUwJeI17vv4jV&_2$-S1`-Dt|y@yDEFjw0#
z*X%Y0x~Lt?irhM!J=1@EIM=+AdHcg5CDlc`)2GzoW~*7V%LWU3GgoHqUZzr(Af@QH
z(+isZ$+#U>DRP-*{5!e$XiVb;aHjxyUr57@i;K(Vd#YkNSDC&r#|2D8(c>@GBqvX#
zdWXejXz6OT*a9<41$t7~of@460qOX9KeQ`aMqXU4i-3S+w33KfRBn6%*LZYnzKY_k@<&t4CGZC;e>=54t>;)zzpwTk~B%y5Q4=Wyy%Aw+9PN
z#wVB+6GmdnnP|Ww{mJrRDk;Ebj<$8jl$#jDgisYB^gtm{XxdWE*R*Jx`jtt7WDs=r
zlXf)WyfQ{mL0dU*B^MkU9?x{3_USwRNh_vvlB$`=Jk{anO-#dhW3fj}E1L%6E21)->9sV8Bcw4_6@~-_`<@%ewS2BE-Wtk2EPh}u1tx~9k~V_
zjAS(IkFnP53w?-*@q?x#ofHXu6c)#5mx6)<4yqR=B{7x$EJ)VN`1dS&4ZJYaE&K&U
zy4m$L#&%#o87aJ6M^S!TYMEipm=5;+EFEQ%s!tOScC*+17}
z2JhrM1HzN2-^?j(ipGVtS#Ux-;%j1wha95N<9KSR)cXCi{H<~J?nva3z~V6QCk-
zX_O5V6W?A2^v6KngRXqkVInFjMapVw3T*k^6a_jsFtJj@^G!#pvlEVgsq3R9v5@d=
z{oc{erwecz(r{Pj&VIRthclo1$*49$vKiL%)V6Scw0^}lhDv&xzs0MHc$>~9T-A=?guKZw<#I=deSwiCNEI8rrM4=nVv-}uh%m8<6@;U>5e_7DI;TwOqG8E#k^~i1`k>Mozyw%Ym+xm#
z*>m>zdm+}bbN%R^2?eWl+ZZktSap_p-3~=FXVnZ=Cd;d2j&0vLkHIjc7gbdsj4FLw
z>|Hc0cAUW@Gsy&)cTQ8Xv&l_R$DuusEPCHN1fO<0r+VIhl8>QJ4&uR#8d5E2@#L`w
z@{97CPOo~VyNChpALEZsG@!twZyCS=Q{^!KnkLi`Ea02cwDT+lgd16E<18f2Ypd)f
zVrB7hX%w0BnzRWSX80b^w+8r7%KdQw#ULE+OeMGFNE1piW8RV-EqiB-i|oZF(B8VSi97PUc~1n5^GyuQ2`T!VX9ozb1*
zLq|cVmkU=(VR?ZcDKG7Ot3g6Nb?1B`nxz7-2gYistCGwW)~GPlC@L1nqi8ETz5azE
z9m&Kqc2H~x9!CcU@n7>UZtA+KyXH8(lvr*ZAXh8Kc#1FO-To|
zzMJ=pO9ofNIN8fM9UMv{+x
zPunB-9Zj$dBTb`lbH7A+nvTECo;-h0XuFyl6p7#PuxaD`5H0ZFAe+0g!Xs_Y%^RoY
zfEZMf#V+bqpi_S-aczyGGoqL2>^Z=v^9zN1Je?o!p@Q~rr%MASBP=A9Q^to7`c^unPdP*lF_9Y-37W@`=9Jf^8z`PCn+tzRNW~0
zc04n7d<-yL2V-;?6c5*J1)6FKly|{p006-%X8&WR#jcGma
z1gMJ%y_-lf${O1v)W!JEht5R@MyytE|6>i2y-ui#3Fd7uR(}6>dD$c^O@VXxt(TRd
zx@|7$Tdzmlre;-eZqDV^ehfh`golS{HPCcegNmSSlM%w!fD6
zuaxEFI3c0KB;(9}!LquiSSiMJPMbh)45G|Kmgni^V8S&gy!*c{072(C;KXjY-|C_D
zs=pdJ?>a5{wJHm{-cdcaB^yus$AR+BPMXBjsl`x!QB+~5NPC70ZRK}>4GMS)2x0GQ
zwjGi0BRbGliHe@=uM4Qc>W-P{vVM@lk9Y$g;?PJOGf@=*SF;Uy%Y4N
zY+sh8G0kYreSBm${DjiZ*BTU5SQNkc`wPeE3|@lrDmfmY$}BxSL2P!rektaYFfD#pzS$UQtC^`)F4s0A0*?<8>LcM{x@$ZhCSrd!MR+wx
z%OK(!^<_OY%DASME%zT3>9s*&?7adkgKAs)u+Ebr-1sAerg;&v$A8z8JpqzE(pk#l
zn+^@cQgdUM6jUN9(Se|uDuF6V;Q!?igMBCX;l3bN8GF14*Jwxy&a5CGC0J7|
z^T}bVKW`NRTQ6c9l?NAM4q_&%Q5i~|El!n6vcb5mVitLXPp2vP~4P1W#{C<()ch!NT^OE0Y@xQ!RB`3s!u5}e5s%y=#
z)$A!P3()_|MaZLQR0O1EbEtCv+iUz~89c%}ZM2?fyuCZcwueb+{SAy8opf?-U(YfU
zsZOZ=HJyY|Jy2mf5du>6A(*sE{`EV5o|G9LtO73)dQjfT36HX<7`|;E0Ru&VUhKhu
zD!Q^$4|G>r(geNpF5S<4$h1)rTA*3ICRn%MT+1R>3e!w&Y=4ApGyB8uRn++?qqeN&fV^I
zeKL)C+r^K!|C!NwFr8L^Nx~C6q9vBq@#fd{v>e@PXLO`Y%a1Dh<6};6JF!f+q%R^y
zaM7{Ra|0dRW!3F-IaK7_`nO_YBXb5{1$BEoLSMYv&tHW
zkR-bi^T`8i865pzc9sC05}e78l+59oy3jGoPF_$`*WfPBqJ*2>P64oGxZbN~pqH8?
zWlTQLxST-b(3H!?n`PwT1GepkO{^sb4$kLwH{!g)U$S1~^Br7^i$6BcQh8?>1a)5L
zyak`Yr82cOWM^3&=SpPszX}hWKZHCST)VBj3ci`EXgVgAUv3u-*mqJ_+s#Iq`WUfg
zf1Hz_o}A~+*>((KGLf*P@oC|mJS@Toe#fYl7xcRx`O5Uv=0puaVWSvk2|jDyPF^xbXhxKA=lzZ?YK1WwMyYt~lpd|rUBBXV*oI#%=+u+_J2qDis7
z2xsW}UXWMT?A;F>JAK9<^==sJLwYg)d)JYlfa`t{_(48|6!|0c)bvLjo+V^pxVNjOG
z0pv;jOtQ5>Bin{UvhjnJpnYFj>!O;kcu8If1kp5g!O2FYuhTfFzrMo1+$;PRR}&`4
z-gz)}Z0oi2$kQLKdLP+Jc=zB!KIGx;XeIoDp13ePC@U)hmhExHU*A*JmNUsf*CZ?M
z>fSuz7RNtis!aC89hdA4V6N;_K(cbGZu
z$9B<*-!K?>-o1&(<%;)D7}LX}c+AXSl{Ra7z^F>S$`b2b=MeD&@H0k6vT^yAY~2VC
z6&KU?Yju;6TTo=IAe)3oZFZ
z&vm4=dSh%%EPEX{_5x!g%d5TtmxCw##^2Yh(!0R7dC{-c#v^sR>3r0kmzf?O%&KAG
zl+uFD;0JIzV_#a>>Zxtt$w-&=w1iRdrU)$tbpYS^KwSj08x+`*a+P>1`0=bjfvASm
z{edJlG>pz#*5Ldb_4MlG`?l{Bastw6^niW$j8zK8sfBI+TSBzU@hPR(U?esUOq}tR
z@3*-IC!Q2VdPpcpX%I_xXAL*M_)kyHI!0*sZmtn{(4Ol&LN|jHBLD{@#Tg;X{Yjy5
z93v>uVsf&ApTA0o9bau$Y&Y5y$KB4c)SGT*QEBs=%5tW&-#({sUv0<$S=x@9p&Cw0
zQt+&ZzIeG^2KFxR8yo++nL(MiNZB5SQns6gD(`d;Ta@53UDywEUoATK4uoA0JX_5B
zA#6h{dW0huOX?v6Ru*aAMdW*tN_Krp#xh|aWS%=cM^m9pIJMebBKxy4B^m))Nko}V
zRee>ZydeT2B=|=V|MC=*
zqu9&aK<>Dgms+(?iK*F_1kuXxX-}Wsdc4T`a#)`fq$cu*+pWs|Gz?Q^xmY4pdIc-5
z{H`9$(sgUgFE@*4dC`XTb~nHZZ+}i0g?jLPNlbJLggzl=-vvvc=4DJgtss^{C1jL)
z$Y*)Ql+3vvm88nf*)>pLY5B3dI409jpOTh9x}CgXX57_D{8^E#gRaUv0s7sQ!mAds
zFcu9UBqH}``xUS#27h$XZTuJ&jaTli5PeK8;_wcZUrpe32hu>Mv#hdz
zcW=`U>&TkuCd;p)LKk#;d!uL1{9G#{^;Ix~i7j*D>Qiwz1dluiShGXb#G;uQCuSYE
zBlBD~Kc-f<=fLyN3`N<8-Y1tA_~$VK)9(=_1Zr0=&(O*W>d>EdQ$;PWzl&*}D9dzY5SD~a%0>4;)A#dW9tq%zJv6S6Ww)fyl
zdZuVEKwodK-_!pj2ir_*Y3cH~Bqx37bc3)rdFX41Y^$B{MVU5H-)gEh6Yyf7!!LqU
z@wSIpsTUKsuQFglHX0!pCB@xQ-ZItoIf$&h)&zXB(@S#$_fA8M5EGqzCNh@zlg_m)
z^dgc96i<7{15qAzEdBFg&eYJPsTIFKc*UV{ikk
z7rjlRGrb=^7aZJ6O4fG`$1+lb#Nu)x-TUnWbuEt*Qf*Yk-Lnst-7!W+dj~69ZJyaW
z*;hwe18q11#{NV|RX;X<2q|jhbr*+vz1C@;>s*{#q5y}PiKRpkwt{oadOY})cECzJ?FaosaKqeQx5w&ge^@RPw*a)vxDLn%t=)qO
zN)J|XTpjXlOVn(!RKF7O&aAD_rh_6ZbC!Sm6}9UtO?|G5(EPr9Qzd&anU!B*syyYD%$$HTT|k~
z7YEQxlVnDyC`(z29n!7YYcwb(6C9Jq8xn3Nfrv5KOc`dgL0Pj1!Hw+o=N5uNp;fN+
zJJ`bCkg`<%QDBZB{bbZNy?Ow>?qG?}%JhQj{(#;cRX`~qS(8j+#)r3Vr@OkrX
z5B1=ry6ZJW1CmKm3rB1_|CkQlO;`43Kw+I*a~OoNyaQkTn|4f;Q2-pyOf558+D}*@%wr@;uDI!qkF4
zvf4PCWj5O!S_4bI;MXGkbVv^O{45+SqlO~+ybt9UEpU%5!3P+4W(kXluO$s`Ke@yV
zK5FLR_IIl?%*z(Z#V26|8?)c{jJ;76)6ZADCBZ0{msKL@v2|)HQ_{6*K1(@^RzWby
z?}kNE#}cn4CS5P=T)eR?@jg;P3ukLTU4%^e92lJ+h6%r=4O0SDJ@4x1+mCqCMf^sZ
zY_}?AuHZL`Y*VKrkIo73WZ-V%?tb?5BUz(lQhXRc!qUn(rD#S1HW=&k7;i`8&+IO5
zCvtN*V1l2-4I>lw5qtxwLpB)OFxQ}7J}lcc9L~m7uT_Z=4t^M58S;kNhB$k+U8yi4
z@yc766Plj{5&~f+6dD)mV;{6Hz0syQCHm-+k(AyOo==M-)g>f+I9jR$
z`yQa1U>I(XI)Xe+g3sb_V?ryi#W9d~+6w|{1-=5J(5iTU9l#LQAWhB1rMG}kZ+J=0
z&Yx-eGLTQxM};E7|70QlaQiPVfarSM1JOmN%x#?kA-scw!wDyTbcCRwp!_HyVj(TD
zhTCBr3@L66%D^{US)vQUw+w`Q^E4ZlqiQ=8rh
z97)3;V7IW~aoWq(E8D~N=E@+Bj!;J!s!f%j+3ed`dnI~=>Z2U-*R{2>pbjq$?=d8^
zq11|ml7ssMwt8D`c6bt`lE+^kQx=d-+P%+04+E=9TnMu
zr6R2sghv$)opL;rg_cT86ZF6;KPD^A1*p@Nc^Y;N`OdlbS@?$SCyE{j1nP#4KYJ2h
z>jM`3@){CBV%Q_S2|5PeWi@B#&)|A^C`yQGQs;Lffrs{1mp~icbDgS+DlD>T9rnko
zt^DtOq_oQ@I2w+w(J$@!yfl2Zo2bk-LBN2^Y{K@nQ7>re!VDLE
z5@4__u>!NL&7ERP$`0lPK;kLc34}f~QB{5p5Jf|;$WHyH82}@5@X9(DK*4s_T5Q-S
zizVU68|Z}Ftt>l)$=ag4Y2%~buuMLng-28E7<#nAPQ
z4b&E5mUrR|+*8}jnE{x<7DCco@Pvinw42|?S0yXr9ZQivBp+E
zs|6glogrJkG)yu$^;Uim_15=S9diQqY5oVoJHaUm8Ld=8U~`?#xtf3&_9lxPu4;jU-z@wl=}8o$7d)t8?#><7W1g
z`#9Ivo@O`OrHXtKynff4BoPZyU|J9+aTafjj^XOJ41MlveEXr)E%kg2z6R6t%ttdO
z#MLDodgsD>d|DBl{Gj^RhCW#YNA!4PH`0XKz8Mzl=&ld9AL#vCts0z>i~a1
zw1;>G3o7WFy0{w>GJ}%|A@a$RzBCHTu(*VHnubQHicl72XO*~vyfF>*t?x>w+qHeU
z(*Dk&q_86_y+;1wGsyiOV^y7FH9qn!OA;$5C*ycpx86Dl?E2;+qB|tQS`;ELLid!L
zefQ1A+}I3-;)#L(`jGwPE*k1MPk*zvB!$7w$jC^Vs}Ot>*v7&5BjJIc+?YQeMWiZc
zl#il>{a(9J{m$x%@Q|pZYk&xhhil!QL7AD6)b2(=dT(!??3O_ZXBqe(9hPM{np;
z`V`J6oI%(f(kZw)*3f4Hs0ylL_!vZ}Y^AK3wEOlzWm^Aa!f)x+hguV9JFQy78`)Qq
z#;V5(clT`e*;4$Itr&eX>nttDblai^RKIZ)c)&6bq-2D;ae-^&3p5K7(=@E;tws&>
zmz)lJ`lYRnfl5;*HEKy)V+VzyHhZefI-)R1q##hVA)IkYP*6^7=-3-+7`tNDTankk
z&Go&0NcSNaHI~I0)So0vsNNR8n!2N8&de01{u
z1??=1%s|-ShQE>WMj7k7f3M0ywM|>lQU2W2?e*-W{V_pRd@^;L7`~Vj0@?9&lT2g8
z7#fX%!3AS9;P8o3v)k0PC;)JKbG2t^@hkWTN_!OpJ!tKGuumbTr&mhu89SRbesI;E9wLbm3bwW|_
z==`v<1dh=Q$ALT%uWQnVdX()(7bMwQ=W?fX%WW#AU)sJ
z8s5>+ldlK(p#(51YyJB{&(yeS0dLwdYF
zXT78|Tko`YcA8n|`D!Y4IE}e`=`+%F6cGRs>giS8PCtK>!M0rb8zXTPXxa9og6^)F
zzFS)ZvI6GY!lYcvD6a@@#?jhVxBgMAcHS#c{pb`7oiGk^J8P4>)_BYVmX%ZP6cyrU;ErRLKpI`_#M))*9
zQ{uB3nJg5y{TINLjFTcsnCqq--;AfZX;Kl!um+hzhBw}k^6cUOxaq3^ZAyhWcJAu?
zUmupIKkUVNNor3ikm>mDX=juVC}8fKjBoPJ*>m5a^yM#3+vbD68pmF4QM`q*f`3~r
zAt08V&V5U=*X!;S6j`A6S?1EDG`K72dGl_o+ht6=kQ-}w$K+;0|Hw|>T+>kKdAa$D
zy-XL!J#Cl&5P5`Ur^hGr6vmGQ#}sBP7PE_VJx#{Z{?&A`yKch@bPdP&5uB3>kcb
z-GH{C0s=VFpjSWzd=iY=nv+ETu&!n}eGm>Y&XXu^{1|u&0@AqW^9HW_YH(#QJQ@ms
z1RJGcrV~?K9DxLN0_+kYoIE%H!wf-eN6q;1H1rj5FRu4faW1rqMZsd;L2stTAah+t
zIs{lXlEPCJ|K4G^uVrTeVc&-!*PFvvS3TltJ_p=@8Or>zO
z+$WN-|3}+fN5!=*+rz;jxF$FRcZc8>+`VykcXtR9+${um2<{LF(l`WnC%9XH0Kd(7
z_nv#syXSrXeFMhm(cLt?*4k^;u9`J#)_Ml)Z54{!%+N=t{z;}p6e!A)`1O;(W*LwK
znpH2g$ddYE01MIwSS*3NW%=?zw2^INd`x^3s%sm@dx4~WJ8TDik$`1}CHDxrPx*%!
z;lz9t;vdA%y4?Nfajf}4H$}?=Zs^eGp~eWQLIi9`6{7)|=P?dPIi1uDOYfMFM;-lm
z*ce#yg`NVKnP-Q0Yl*)=0XecG;p|N>QIgHVw@HK^=*?M9E1yrZ8wZ!1XLMVts+4;7
zdt0`Tveq@KP9p11**qA;O{#kNM^qz?mkBhPOjylyMRoAZuY(mO+Os_bitm4A(Hgl^
zUJX$PE_w=XW^QQpalHmoUPYW8E>+}_!I0OGlMCNG28%D!s`|d(iV+p0j>e}%i+djt1_@-)S!~RKu*63CB%yF|-
zesIhJ9|+3%VrpP&;j?j>-EYT_+I<|mp=k<>;NQPH(~%@T{YI^t90%&5
zbGXapbP3>S(PM6-r++j34c8RV{@q9^1%M-sOxKaC)M_@W?2tr^ejPgj!F-gw86Z>)
z(?f#9R6`&|)ErLwB(3gN)tlTc6yfV);sA?b9kMcu<_`s{ygv5GTkCVVXzCWYAPP7C
z2>J0w+jw%Iza_T+-pg@`ix#)}I|tXacH(@h60A-tGd_AnqA>$03C$)X13O{>qWhSw
z<7ZfDn%;_q5r}fbz2JEr9JIi21hNyQC>SKDjR$OZ@-vp@b_0@m0t6x(@UYOfge*a?
z@4<1pLN#eLi~W%A)jAPeIOCgJu5B>ea@qf!HXeoU22kH+Fh
z0{h*gQgf!g^)l0Ym{jq%i#D!P@zFnxPuf|_XHRh`!8u1=>o>F4bgRkMGy^Mlc2bRd
zdAqv@znx*`zLL@?MwDA8X)1UV6OJRG`Fu(z(>s~;c1Cs9K)DGF0h+*E;T=?GR*X2C
zDW(OG_j8BV|IA`#8gjJVd-gXZ`
ze&6CgdATnp{B=<)j}p3wRJb?$N$BYB1fq`%z2AGtj_v#(eSK@?+<1J}y?Q!`sw}DD
zZejhuy^?B}KYeB7BV71V=&XNvMR1B+k9Juwd7H&zzX=$nD$v<A`0O{%8L(q?)hH6jvu9;Wod(72(
zWgDX%(3m^jHMl19>M7fXFo*+CY(lj^yZr{PM)7qH1rBT5S~plBn()CObnmp1KyR#~
zJ~y+0urOiFHv<{{vBsGs)%6kP#w+GJK75WEB3cG8t`}OY^@uE9>n9u0-Jvj#Zf^9I
zJ2^+ivPIlIvl(Ob-dc=f##xAFW@_7O-Q9V)2c<^tze!?#80(13F8mTFB2dr(kFcaw
zaC|Kuw!oi0Q#Tz@9(Hx_^j;(?xcsT(s>Zmud4hL+HP4-Lio^tFpS@0Q4$I}!SxPgU
zPxL0ek7-tz73!Jg^sGhlp{ux>NXDloDu
zZND~dwwA6%vLzKuGt{)Fc#(sdw?FP2EP-H3nggcg#C3ld%y`C3~-8-M@$
z!HIadVe)==v#LRzr~LR|S^Ga8*40GU7yB-y&)Om32j
zX+3F+oF6c
ziP`d3-+;|nf0W!R1(J%Hke;+-nQ!C=U3zbPek;yT{pe@Z3B|%7lCN|oAFmRnqNabB
zkTA(wYI4aKY4p7`zcBucM5Edf5!-H2+_SF`D>LqcLUFO>G^-r{MUd*jiA94(Vp@jq
z(hX7W$&EVEwp@ZH@zH6%9Ph1DdL|78S!S^oa;^Z82?*JCsktHRLYh+vBQ~qTH02Axqzbgz0)@=M$v{qf84fGRZ&&8kWW-f-7fo4
zkc0no2EOfW-d-ALvEej8_6;8&ANyB&dksLhOI8eDx-_>cWwNfeG^aUaQ7gl8D&-if
z`!=I-NPda^JDnld-pk6I;GSNcHBzWcf`J~iF*icMK|>QN!NRPz)pNU?F!%3YNiQrYM2x>$Ke07$
z>sb65?rUJcEC(a!tp=%K??ni{`K@lpYX1#<9e2}_v60DZXR2fSxWviYko8huRpC)r
zj)aEXqJ$yT4te~>qr6M~-~GCd^0&ySH&c}|=0^{lHgx7rG?~G|8t6eHV2Yxl&NdCE
zY7Ad-_+l6JXM-;<)UjsqfX_5E4E&$)@DGk6YMn0Nmnu2=IYvVUM6i*=^O{4T)tA_n
zq_sYxk&UUwFL>Tt)KS%0rRKiqeR~KYa~V
z9Up!M9ZWPOOv+*Pg0b@x8
zd(S(3JGrvN6@tYDjei!P9DIiy8SyD!X1CLI-z-&+{K^
zN3n)z<$v3+D9Jb3>m(a9y!{|Cg+|wWU~O#?@-0|Yq{QV?9iVBLa;W1Z2H)<|RO=X?
z4hQc|j#lhNRBtHXok5I_jWFk)O0>X)Vu7t@HSM&Wjrk3wowMvMaWy9wb-ht1jt@1C
z!7Ga}>(z!TxLbn5cNyC{eSYrX{&OFimo%id_J;)+_wTm6?kcvf$yvqSq}{5Gu2d_A
zvPGITTA=p$yu0?d`1rZ4i&}Ww&Tu~unt6H6EXrplSy{z2`{jSQVPHK3Hnd%SKY!nQ
z-oQHMc=Pd26JkzB!W+NPp@P5N#nP@KfA%M3DbB7R(U&(}K0ZcSt(p|Dg=#xJ<{y|a
zyu9fhZ8Ptc!ssdr(0?0_75@APJGA{UIlT?dF(VjHQzMsAu&pY9%DTe`H@H0T5J-GK
zH?<%|Q!#LOV6*!MBzk$m@YCZxk#*9c2Vq9*mG%pi2%#VPQZ#}UxEm@Y32LsS-5uX0
z;($Vpt;SVf0#&*^5JlVtHw*q;YbEYZuVjQ&L=F7K0*yL3c9v6iK4?rDzizct$uYM8
z8$_wEQfVta0#D@Aec#Hv-R1%&irj!eSzUe?%SB5`BP56wsDT90ENE(CzU0kt!gN%%
zRjQ2z3#vYlrlj=<_$1uH*0cTwisdal2Ab%;Gt`x0r+@bjBDw2Z)U$k#1r<@RlKAgr
zc_p7$`10pr>TQg8U$8!w_&I@!4KF5HbroYK{%r5B_YJkYX>5qGQQJ;r
zrh)@m$2;DVs#tvQS8BXb=dc-qjpC?zZ;p&vjW!&DjLkBm7yNHe*ttDnf)G{J6fpt}Sbh%Q)trEDc@72E`b~5C~Z-&6D>8`AXP?+uS8DRH#-A;GX9BP(lab6qNLi~cRX=7Rp
z?lk$i4ev(6Tk-StLr5>VQq;AJt0D#_>fI45932fqzAB{)&;0T0T~pz6SkgkFY=a3@
zC}E3m)&+yR0dv->rnbz8R$(`oWywJu&XM!^W?uaXeNk!(@(o)k4XqMx+2OgyeBc>5!`N-0pF9;L*u*#ZFr_B{=*tDC-`NH=8U8J
zRCZPCD5{F^^XvNPNR(8Ykac4tHChgH0@XXI)~{c;`pAb_cl~JRPno^fH8id4$&v}B
zz)v%%YjI3v-S~J&kdl=^3%xoqk%PwFat8w~g8Q*mNHuV;`@CsYdzsMMd~U;MNG@^?
z6)?*lV(6e>GS88axhpSs$QjXBEbhQPioq(I(+_cO?oqbS`F4o=E3G&Z0pEz2ICyk;
zZfGZHAh4U_HFV4jffQ-8k6d+TQhsza(jeu+xIIP(3t0I3e90&S#Cd?ho;P!O#$@d!
z`4ehmw<~gB@rGI63lVq>T}UT(RF>Xgg1zgYDT`YKGBT=b-uxs9=*&Ru-=hbggf)|l
z+NTTq8Vy?KjoK?zqz#-63q@BUZuIV6gab&HD3Fw50(oIUHKcK5e|tMq8c)tmKrJ+9
zkDWQUb1+|=2K+n!-F}V*xV*e9;{*~9W>{Zivi!{|nB*Wf(JufrNNg;$(mGB>z9Dn`ha8cjH|o*
z!uf##EAr0w(39WkDw|JG*S(#hUzMD+@Qkfh3|Csc`u15|Lmx@Ne5F1f`Ul|QS0!Hz
zVu_aXg`Qv0AkyN+c`5F)^Oa(oA}=@OkUN_yfDESxSh5XB8d;s4j=_V#Cgjmyyj!MW
zTp>3lr=%G4gu#ILcuiE2Gar<`jYo`+IfH7XE*uZD1ET!$sVau|LNgY3wh}g3{c`#G
z<1tAft4C(>&x7|Qg3KR&m&59bM^#w}RE3vg_pG_w>op~I@TT{={Ji;jTvOk;fUQ2u
zZg$t*(FWc0;qAbO=I~8F7|4d2PI*PBmx6#(t4nFb82{N54
z;Ue7>%!@Oi@!||rp%lA`ql4Pu1J(nE)!|Wf4B(xz;u09o9kuY=5l6ybfqxt^u7gph
z9sC2XFYxVu_pn|@zCQ_$u82pL7eIUSj`aIY(R3>>^?Oxyuy}UIOeoTt75x3th|oHc
z<5H9%A!om9_Ze){&kfx&@861xU$U|pLQrAl)oyKqX{1VCTrFnQKu7gjBvh10nW+xm
zCQxYHcNQxmM`rCM4l|5cmOI7nU;*PqAOCjX_m%84OU37QQMBV`6xt1FKPU6M>CV44@n|$@y!qqdIKI^cxA)+v
z=(7$&Q1|z{Cgg75217=j#@7Hb%sl~yDBM~o98J4^v06Oy$R#1`t#8Pr*?K905Z}Oy
zLPLN3;>;U@_(qlaA(p_{eM8Bup&aX$+#O74TSLS)#d*nqi41~_*~+^4xb5gp5Kvb$
z7=iG5eNDD`xVvI*%-}hoq)~RUuTz&$##%rFq&bzg<0tbB2l|0E9zsi>cB;|^`Qa_n
zTtY1Uf`HET%1Vu1>EXmAlCCOXe_UURoeuX5tTeC!8v8D3KHv+@3PLu{NgjUtvMBm;W0Hp_=|qAjz5ZbI?#F`cj1)o{Q@J(91LBP3y1{Qux`}Mj9tvS|-756wumi87UKJ@yj1ctJ?O9l3exFW!Dk9CHfwSvdU;5p1
z4b>eaT=E`ob7Xy#7wKGe{RT=I9-0BxhtBr%GAA|W7WX{;z~_YMOcSA)(l|o}^CF6r
z*e{;s!|nHVd`GL^taY1<^(9^H2d_4Ac`ZA?-085c#;WS-
z6q+43cPS!hJ#lUHZ!prCjHty~`bZC+*N((2U18E#uTc&wqTbsJZ-NHfJv}`szE-D6
z)sUoH5%wZ3uV*b7?aJ_uQ3(jZe@EU?ruwERl!aIFwHhT@8`B6DxrV38*e<2HD@RDZ
zszu;rY|&^176aSSOy~sKQQ!F@8@*bFpQ&Ppmk~;Z+EJ*Al$!m3v&u5YvgTx_rXFkk
zHJuE`gVA}vvS)T+0&V;_#8xYe69WT(;<&MX3r_r)pY6Oela7OX#fokiHG)SP$OKVl
zmH{y0)vM@db|ww0KPH|4SgR|N#Nnn6br+pCCNT7{j0nCvAt8QLIIOL-qow=MO9^(B
zfU%)?Zg|PvJ@otN;Z5OJ1U7@fw?Vmlz2F*H#VYeT+TLjhnqZgk
z2Nf{6q8$RP(WUx7PXL9FHqpOb87QJbv;
zNxE_ft={&+pf}-lepxX$LJXF=!u}XYI!*Zr7xpP$_AEz^dASm32TF~e4*kiHtAv$E
zC%=P)6G;u00(*1S#B^8sh!{zEfy*jJC(ZxchnD^v4~Mx~+U)MKa0L3^QV4;(I0q#H
z&T&WF%`(#=jw;dcU`P?j6R%GTM)TU2f~B7H=UHghFz<6e_b+B%fO0>
zGjz1Q6@5wY4EQLMEp-yNr%nVJzOv**2`0^YLVDj*y!0f^z^Kj+o)4AQsg`8=_Y_l}4uQe0&e|h30m%f1R>L>CZZ-~f%N?#gCeC-q
zC!pXcw|11m9B!YtxSM&j#aQm3$1S#Nx~9lCb!fo{#C3_bES5*SIzfaNh_(J7(4ch;={3eSM{j%``&eVH9s=L6ty8;3Hz7Q&?8t1$JbxM`A%vabJeA3(
zPu@9ots|W7wqgMW&DHdMidAejZ|JO9jsQ-gy)yy9xd_izzuBmX%Pi)?Qu-58uviiLF?h6Y;qiRc?&dPGTC4d63Zh
zJ~t3V-1ULG7d$QGiickgtpK_r#rQp6)gqmkf!w=lJZMy&$S^5$)THd7fb^zibUtdZ
zqZ^}!=~keXOT0m;Bov0^AFO(aU|^lhs;wH+?T?(r&Pbw{Rdmq!=1