From 8de766904d28da27ad707a920ade9510e86a2941 Mon Sep 17 00:00:00 2001
From: Andrea Del Rio <delrio.andre@gmail.com>
Date: Tue, 27 Apr 2021 09:12:17 -0700
Subject: [PATCH 01/28] [K8] Small fixes (#98099)

---
 .../sidebar/discover_field_search.tsx         |  4 +-
 .../public/lib/panel/_embeddable_panel.scss   |  5 +-
 .../public/top_nav_menu/_index.scss           | 10 +++-
 .../solution_toolbar/items/button.scss        |  5 ++
 .../solution_toolbar/items/quick_group.scss   |  6 +++
 .../home/components/filter_list_button.tsx    | 46 ++++++++++---------
 6 files changed, 49 insertions(+), 27 deletions(-)

diff --git a/src/plugins/discover/public/application/components/sidebar/discover_field_search.tsx b/src/plugins/discover/public/application/components/sidebar/discover_field_search.tsx
index 67dda6dd0e9a8..e11c1716efe6b 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_field_search.tsx
+++ b/src/plugins/discover/public/application/components/sidebar/discover_field_search.tsx
@@ -233,7 +233,7 @@ export function DiscoverFieldSearch({ onChange, value, types, useNewFieldsApi }:
 
   const footer = () => {
     return (
-      <EuiPopoverFooter>
+      <EuiPopoverFooter paddingSize="s">
         <EuiSwitch
           label={i18n.translate('discover.fieldChooser.filter.hideMissingFieldsLabel', {
             defaultMessage: 'Hide missing fields',
@@ -291,7 +291,7 @@ export function DiscoverFieldSearch({ onChange, value, types, useNewFieldsApi }:
             }}
             button={buttonContent}
           >
-            <EuiPopoverTitle>
+            <EuiPopoverTitle paddingSize="s">
               {i18n.translate('discover.fieldChooser.filter.filterByTypeLabel', {
                 defaultMessage: 'Filter by type',
               })}
diff --git a/src/plugins/embeddable/public/lib/panel/_embeddable_panel.scss b/src/plugins/embeddable/public/lib/panel/_embeddable_panel.scss
index f7ee1f3c741c4..9072c26576097 100644
--- a/src/plugins/embeddable/public/lib/panel/_embeddable_panel.scss
+++ b/src/plugins/embeddable/public/lib/panel/_embeddable_panel.scss
@@ -120,9 +120,10 @@
 // EDITING MODE
 
 .embPanel--editing {
-  border-style: dashed;
-  border-color: $euiColorMediumShade;
+  border-style: dashed !important;
+  border-color: $euiColorMediumShade !important;
   transition: all $euiAnimSpeedFast $euiAnimSlightResistance;
+  border-width: $euiBorderWidthThin;
 
   &:hover,
   &:focus {
diff --git a/src/plugins/navigation/public/top_nav_menu/_index.scss b/src/plugins/navigation/public/top_nav_menu/_index.scss
index bc27cf061eb68..9af1bb5434bb1 100644
--- a/src/plugins/navigation/public/top_nav_menu/_index.scss
+++ b/src/plugins/navigation/public/top_nav_menu/_index.scss
@@ -1,5 +1,13 @@
 .kbnTopNavMenu {
-  margin-right: $euiSizeXS;
+  @include kbnThemeStyle('v7') {
+    margin-right: $euiSizeXS;
+  }
+
+  @include kbnThemeStyle('v8') {
+    button:last-child {
+      margin-right: 0;
+    }
+  }
 }
 
 .kbnTopNavMenu__badgeWrapper {
diff --git a/src/plugins/presentation_util/public/components/solution_toolbar/items/button.scss b/src/plugins/presentation_util/public/components/solution_toolbar/items/button.scss
index b8022201acf59..4fc3651ee9f73 100644
--- a/src/plugins/presentation_util/public/components/solution_toolbar/items/button.scss
+++ b/src/plugins/presentation_util/public/components/solution_toolbar/items/button.scss
@@ -4,4 +4,9 @@
 
   // Lighten the border color for all states
   border-color: $euiBorderColor !important; // sass-lint:disable-line no-important
+
+  @include kbnThemeStyle('v8') {
+    border-width: $euiBorderWidthThin;
+    border-style: solid;
+  }
 }
diff --git a/src/plugins/presentation_util/public/components/solution_toolbar/items/quick_group.scss b/src/plugins/presentation_util/public/components/solution_toolbar/items/quick_group.scss
index 870a9a945ed5d..876ee659b71d7 100644
--- a/src/plugins/presentation_util/public/components/solution_toolbar/items/quick_group.scss
+++ b/src/plugins/presentation_util/public/components/solution_toolbar/items/quick_group.scss
@@ -1,6 +1,12 @@
 .quickButtonGroup {
   .quickButtonGroup__button {
     background-color: $euiColorEmptyShade;
+    @include kbnThemeStyle('v8') {
+      // sass-lint:disable-block no-important
+      border-width: $euiBorderWidthThin !important;
+      border-style: solid !important;
+      border-color: $euiBorderColor !important;
+    }
   }
 
   // Temporary fix for two tone icons to make them monochrome
diff --git a/x-pack/plugins/index_management/public/application/sections/home/components/filter_list_button.tsx b/x-pack/plugins/index_management/public/application/sections/home/components/filter_list_button.tsx
index 44f565f98cdb0..4bd9a01380c0e 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/components/filter_list_button.tsx
+++ b/x-pack/plugins/index_management/public/application/sections/home/components/filter_list_button.tsx
@@ -7,7 +7,7 @@
 
 import React, { useState } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { EuiFilterButton, EuiPopover, EuiFilterSelectItem } from '@elastic/eui';
+import { EuiFilterButton, EuiFilterGroup, EuiPopover, EuiFilterSelectItem } from '@elastic/eui';
 
 interface Filter {
   name: string;
@@ -65,26 +65,28 @@ export function FilterListButton<T extends string>({ onChange, filters }: Props<
   );
 
   return (
-    <EuiPopover
-      ownFocus
-      button={button}
-      isOpen={isPopoverOpen}
-      closePopover={closePopover}
-      panelPaddingSize="none"
-      data-test-subj="filterList"
-    >
-      <div className="euiFilterSelect__items">
-        {Object.entries(filters).map(([filter, item], index) => (
-          <EuiFilterSelectItem
-            checked={(item as Filter).checked}
-            key={index}
-            onClick={() => toggleFilter(filter as T)}
-            data-test-subj="filterItem"
-          >
-            {(item as Filter).name}
-          </EuiFilterSelectItem>
-        ))}
-      </div>
-    </EuiPopover>
+    <EuiFilterGroup>
+      <EuiPopover
+        ownFocus
+        button={button}
+        isOpen={isPopoverOpen}
+        closePopover={closePopover}
+        panelPaddingSize="none"
+        data-test-subj="filterList"
+      >
+        <div className="euiFilterSelect__items">
+          {Object.entries(filters).map(([filter, item], index) => (
+            <EuiFilterSelectItem
+              checked={(item as Filter).checked}
+              key={index}
+              onClick={() => toggleFilter(filter as T)}
+              data-test-subj="filterItem"
+            >
+              {(item as Filter).name}
+            </EuiFilterSelectItem>
+          ))}
+        </div>
+      </EuiPopover>
+    </EuiFilterGroup>
   );
 }

From aa281ffad7c0b1808154e00b937251f36e2ff76a Mon Sep 17 00:00:00 2001
From: Chris Cowan <chris@chriscowan.us>
Date: Tue, 27 Apr 2021 09:36:27 -0700
Subject: [PATCH 02/28] [Metrics UI] Unskip Home Page Functional Test (#98085)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../test/functional/apps/infra/home_page.ts   | 48 +------------------
 x-pack/test/functional/apps/infra/index.ts    | 20 ++++----
 x-pack/test/functional/apps/infra/link_to.ts  |  2 +-
 3 files changed, 14 insertions(+), 56 deletions(-)

diff --git a/x-pack/test/functional/apps/infra/home_page.ts b/x-pack/test/functional/apps/infra/home_page.ts
index a5b8e69833fb6..1cc7c87f3a1a8 100644
--- a/x-pack/test/functional/apps/infra/home_page.ts
+++ b/x-pack/test/functional/apps/infra/home_page.ts
@@ -5,24 +5,17 @@
  * 2.0.
  */
 
-import expect from '@kbn/expect/expect.js';
 import { FtrProviderContext } from '../../ftr_provider_context';
 import { DATES } from './constants';
 
 const DATE_WITH_DATA = DATES.metricsAndLogs.hosts.withData;
 const DATE_WITHOUT_DATA = DATES.metricsAndLogs.hosts.withoutData;
 
-const COMMON_REQUEST_HEADERS = {
-  'kbn-xsrf': 'some-xsrf-token',
-};
-
 export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const esArchiver = getService('esArchiver');
   const pageObjects = getPageObjects(['common', 'infraHome']);
-  const supertest = getService('supertest');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/75724
-  describe.skip('Home page', function () {
+  describe('Home page', function () {
     this.tags('includeFirefox');
     before(async () => {
       await esArchiver.load('empty_kibana');
@@ -54,45 +47,6 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
         await pageObjects.infraHome.goToTime(DATE_WITHOUT_DATA);
         await pageObjects.infraHome.getNoMetricsDataPrompt();
       });
-
-      it('records telemetry for hosts', async () => {
-        await pageObjects.infraHome.goToTime(DATE_WITH_DATA);
-        await pageObjects.infraHome.getWaffleMap();
-
-        const resp = await supertest
-          .post(`/api/telemetry/v2/clusters/_stats`)
-          .set(COMMON_REQUEST_HEADERS)
-          .set('Accept', 'application/json')
-          .send({
-            unencrypted: true,
-          })
-          .expect(200)
-          .then((res: any) => res.body);
-
-        expect(
-          resp[0].stack_stats.kibana.plugins.infraops.last_24_hours.hits.infraops_hosts
-        ).to.be.greaterThan(0);
-      });
-
-      it('records telemetry for docker', async () => {
-        await pageObjects.infraHome.goToTime(DATE_WITH_DATA);
-        await pageObjects.infraHome.getWaffleMap();
-        await pageObjects.infraHome.goToDocker();
-
-        const resp = await supertest
-          .post(`/api/telemetry/v2/clusters/_stats`)
-          .set(COMMON_REQUEST_HEADERS)
-          .set('Accept', 'application/json')
-          .send({
-            unencrypted: true,
-          })
-          .expect(200)
-          .then((res: any) => res.body);
-
-        expect(
-          resp[0].stack_stats.kibana.plugins.infraops.last_24_hours.hits.infraops_docker
-        ).to.be.greaterThan(0);
-      });
     });
   });
 };
diff --git a/x-pack/test/functional/apps/infra/index.ts b/x-pack/test/functional/apps/infra/index.ts
index 9c828253245d0..8cdcf6b619b26 100644
--- a/x-pack/test/functional/apps/infra/index.ts
+++ b/x-pack/test/functional/apps/infra/index.ts
@@ -8,15 +8,19 @@
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export default ({ loadTestFile }: FtrProviderContext) => {
-  describe('InfraOps app', function () {
+  describe('InfraOps App', function () {
     this.tags('ciGroup7');
-    loadTestFile(require.resolve('./metrics_anomalies'));
-    loadTestFile(require.resolve('./home_page'));
     loadTestFile(require.resolve('./feature_controls'));
-    loadTestFile(require.resolve('./log_entry_categories_tab'));
-    loadTestFile(require.resolve('./log_entry_rate_tab'));
-    loadTestFile(require.resolve('./logs_source_configuration'));
-    loadTestFile(require.resolve('./metrics_source_configuration'));
-    loadTestFile(require.resolve('./link_to'));
+    describe('Metrics UI', function () {
+      loadTestFile(require.resolve('./home_page'));
+      loadTestFile(require.resolve('./metrics_source_configuration'));
+      loadTestFile(require.resolve('./metrics_anomalies'));
+    });
+    describe('Logs UI', function () {
+      loadTestFile(require.resolve('./log_entry_categories_tab'));
+      loadTestFile(require.resolve('./log_entry_rate_tab'));
+      loadTestFile(require.resolve('./logs_source_configuration'));
+      loadTestFile(require.resolve('./link_to'));
+    });
   });
 };
diff --git a/x-pack/test/functional/apps/infra/link_to.ts b/x-pack/test/functional/apps/infra/link_to.ts
index b7a554cea311f..3e070fb9849b1 100644
--- a/x-pack/test/functional/apps/infra/link_to.ts
+++ b/x-pack/test/functional/apps/infra/link_to.ts
@@ -22,7 +22,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
   const traceId = '433b4651687e18be2c6c8e3b11f53d09';
 
-  describe('Infra link-to', function () {
+  describe('link-to Logs', function () {
     it('redirects to the logs app and parses URL search params correctly', async () => {
       const location = {
         hash: '',

From 52a90e3dc9a19e7c211d13fd5c672634b3f51526 Mon Sep 17 00:00:00 2001
From: Nicolas Chaulet <nicolas.chaulet@elastic.co>
Date: Tue, 27 Apr 2021 13:04:08 -0400
Subject: [PATCH 03/28] [Fleet] Use default port for fleet server cloud url
 (#98492)

---
 .../fleet/server/services/settings.test.ts     | 18 +++++++++++++++++-
 .../plugins/fleet/server/services/settings.ts  |  6 +++++-
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/fleet/server/services/settings.test.ts b/x-pack/plugins/fleet/server/services/settings.test.ts
index a9f9600addc39..87b3e163c1bb3 100644
--- a/x-pack/plugins/fleet/server/services/settings.test.ts
+++ b/x-pack/plugins/fleet/server/services/settings.test.ts
@@ -17,7 +17,7 @@ describe('getCloudFleetServersHosts', () => {
     expect(getCloudFleetServersHosts()).toBeUndefined();
   });
 
-  it('should return fleet server hosts if cloud is correctly setup', () => {
+  it('should return fleet server hosts if cloud is correctly setup with default port == 443', () => {
     mockedAppContextService.getCloud.mockReturnValue({
       cloudId:
         'dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRjZWM2ZjI2MWE3NGJmMjRjZTMzYmI4ODExYjg0Mjk0ZiRjNmMyY2E2ZDA0MjI0OWFmMGNjN2Q3YTllOTYyNTc0Mw==',
@@ -32,4 +32,20 @@ describe('getCloudFleetServersHosts', () => {
       ]
     `);
   });
+
+  it('should return fleet server hosts if cloud is correctly setup with a default port', () => {
+    mockedAppContextService.getCloud.mockReturnValue({
+      cloudId:
+        'test:dGVzdC5mcjo5MjQzJGRhM2I2YjNkYWY5ZDRjODE4ZjI4ZmEzNDdjMzgzODViJDgxMmY4NWMxZjNjZTQ2YTliYjgxZjFjMWIxMzRjNmRl',
+      isCloudEnabled: true,
+      deploymentId: 'deployment-id-1',
+      apm: {},
+    });
+
+    expect(getCloudFleetServersHosts()).toMatchInlineSnapshot(`
+      Array [
+        "https://deployment-id-1.fleet.test.fr:9243",
+      ]
+    `);
+  });
 });
diff --git a/x-pack/plugins/fleet/server/services/settings.ts b/x-pack/plugins/fleet/server/services/settings.ts
index 4ef9a3a95cbd0..2046e2571c926 100644
--- a/x-pack/plugins/fleet/server/services/settings.ts
+++ b/x-pack/plugins/fleet/server/services/settings.ts
@@ -84,6 +84,10 @@ export function getCloudFleetServersHosts() {
     }
 
     // Fleet Server url are formed like this `https://<deploymentId>.fleet.<host>
-    return [`https://${cloudSetup.deploymentId}.fleet.${res.host}`];
+    return [
+      `https://${cloudSetup.deploymentId}.fleet.${res.host}${
+        res.defaultPort !== '443' ? `:${res.defaultPort}` : ''
+      }`,
+    ];
   }
 }

From 808959e316082718c1c1081c362fbc6c91f2fdbc Mon Sep 17 00:00:00 2001
From: Aleh Zasypkin <aleh.zasypkin@gmail.com>
Date: Tue, 27 Apr 2021 19:09:54 +0200
Subject: [PATCH 04/28] Handle `401 Unauthorized` errors in a more
 user-friendly way (#94927)

---
 .eslintrc.js                                  |   4 +
 test/common/services/security/user.ts         |  30 +-
 test/scripts/jenkins_xpack_build_plugins.sh   |   1 +
 .../plugins/reporting/server/routes/jobs.ts   |   2 +
 x-pack/plugins/security/common/constants.ts   |  15 +
 .../capture_url/capture_url_app.test.ts       |  63 ++-
 .../capture_url/capture_url_app.ts            |  45 +-
 .../authentication/login/components/index.ts  |   2 +-
 .../login/components/login_form/index.ts      |   2 +-
 .../components/login_form/login_form.test.tsx |   6 +-
 .../components/login_form/login_form.tsx      |  14 +-
 .../authentication/login/login_page.test.tsx  |   9 +-
 .../authentication/login/login_page.tsx       |  34 +-
 .../__snapshots__/prompt_page.test.tsx.snap   |   5 +
 .../unauthenticated_page.test.tsx.snap        |   3 +
 .../authentication_service.test.mocks.ts      |   9 +
 .../authentication_service.test.ts            | 458 ++++++++++++++++--
 .../authentication/authentication_service.ts  |  72 ++-
 .../authentication/authenticator.test.ts      |  72 ++-
 .../server/authentication/authenticator.ts    |  41 +-
 .../can_redirect_request.test.ts              |  30 ++
 .../authentication/can_redirect_request.ts    |   7 +-
 .../authentication/providers/base.mock.ts     |   1 +
 .../server/authentication/providers/base.ts   |   4 +
 .../authentication/providers/oidc.test.ts     |  76 ++-
 .../server/authentication/providers/oidc.ts   |  54 ++-
 .../authentication/providers/saml.test.ts     |  63 ++-
 .../server/authentication/providers/saml.ts   |  55 ++-
 .../security/server/authentication/tokens.ts  |  10 +-
 .../unauthenticated_page.test.tsx             |  35 ++
 .../authentication/unauthenticated_page.tsx   |  55 +++
 .../reset_session_page.test.tsx.snap          |   2 +-
 .../authorization/authorization_service.tsx   |  24 +-
 .../authorization/reset_session_page.test.tsx |  10 +-
 .../authorization/reset_session_page.tsx      | 120 ++---
 x-pack/plugins/security/server/index.ts       |   1 +
 x-pack/plugins/security/server/plugin.ts      |   7 +-
 .../security/server/prompt_page.test.tsx      |  57 +++
 .../plugins/security/server/prompt_page.tsx   |  96 ++++
 .../routes/authentication/common.test.ts      |   6 +-
 .../server/routes/authentication/common.ts    |   3 +-
 .../server/routes/authentication/oidc.ts      |  17 +-
 .../server/routes/authentication/saml.test.ts |   7 +-
 .../server/routes/authentication/saml.ts      |  16 +-
 x-pack/plugins/security/server/routes/tags.ts |  27 ++
 .../server/routes/views/capture_url.test.ts   |  42 +-
 .../server/routes/views/capture_url.ts        |   6 +-
 .../translations/translations/ja-JP.json      |   1 -
 .../translations/translations/zh-CN.json      |   1 -
 .../apis/security/basic_login.js              |   4 +-
 .../test/functional/apps/security/security.ts |   2 +-
 .../tests/anonymous/login.ts                  |  20 +-
 .../tests/kerberos/kerberos_login.ts          |  14 +-
 .../login_selector/basic_functionality.ts     |  61 ++-
 .../oidc/authorization_code_flow/oidc_auth.ts | 157 +++---
 .../tests/oidc/implicit_flow/oidc_auth.ts     |  18 +-
 .../tests/pki/pki_auth.ts                     |  16 +-
 .../tests/saml/saml_login.ts                  | 161 +++---
 .../common/test_endpoints/kibana.json         |   7 +
 .../common/test_endpoints/public/index.ts     |   9 +
 .../common/test_endpoints/public/plugin.tsx   |  29 ++
 .../common/test_endpoints/server/index.ts     |  15 +
 .../test_endpoints/server/init_routes.ts      |  38 ++
 .../login_selector.config.ts                  |   3 +
 .../test/security_functional/oidc.config.ts   |   3 +
 .../test/security_functional/saml.config.ts   |   3 +
 .../login_selector/basic_functionality.ts     |  60 +++
 .../tests/oidc/url_capture.ts                 |  21 +
 .../tests/saml/url_capture.ts                 |  21 +
 69 files changed, 1837 insertions(+), 545 deletions(-)
 create mode 100644 x-pack/plugins/security/server/__snapshots__/prompt_page.test.tsx.snap
 create mode 100644 x-pack/plugins/security/server/authentication/__snapshots__/unauthenticated_page.test.tsx.snap
 create mode 100644 x-pack/plugins/security/server/authentication/authentication_service.test.mocks.ts
 create mode 100644 x-pack/plugins/security/server/authentication/unauthenticated_page.test.tsx
 create mode 100644 x-pack/plugins/security/server/authentication/unauthenticated_page.tsx
 create mode 100644 x-pack/plugins/security/server/prompt_page.test.tsx
 create mode 100644 x-pack/plugins/security/server/prompt_page.tsx
 create mode 100644 x-pack/plugins/security/server/routes/tags.ts
 create mode 100644 x-pack/test/security_functional/fixtures/common/test_endpoints/kibana.json
 create mode 100644 x-pack/test/security_functional/fixtures/common/test_endpoints/public/index.ts
 create mode 100644 x-pack/test/security_functional/fixtures/common/test_endpoints/public/plugin.tsx
 create mode 100644 x-pack/test/security_functional/fixtures/common/test_endpoints/server/index.ts
 create mode 100644 x-pack/test/security_functional/fixtures/common/test_endpoints/server/init_routes.ts

diff --git a/.eslintrc.js b/.eslintrc.js
index 19ba7cacc3c44..0f7af42fafbfd 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -1377,6 +1377,10 @@ module.exports = {
               ['parent', 'sibling', 'index'],
             ],
             pathGroups: [
+              {
+                pattern: '{**,.}/*.test.mocks',
+                group: 'unknown',
+              },
               {
                 pattern: '{@kbn/**,src/**,kibana{,/**}}',
                 group: 'internal',
diff --git a/test/common/services/security/user.ts b/test/common/services/security/user.ts
index 3bd31bb5ed186..d6813105ecbf6 100644
--- a/test/common/services/security/user.ts
+++ b/test/common/services/security/user.ts
@@ -33,7 +33,7 @@ export class User {
 
   public async delete(username: string) {
     this.log.debug(`deleting user ${username}`);
-    const { data, status, statusText } = await await this.kbnClient.request({
+    const { data, status, statusText } = await this.kbnClient.request({
       path: `/internal/security/users/${username}`,
       method: 'DELETE',
     });
@@ -44,4 +44,32 @@ export class User {
     }
     this.log.debug(`deleted user ${username}`);
   }
+
+  public async disable(username: string) {
+    this.log.debug(`disabling user ${username}`);
+    const { data, status, statusText } = await this.kbnClient.request({
+      path: `/internal/security/users/${encodeURIComponent(username)}/_disable`,
+      method: 'POST',
+    });
+    if (status !== 204) {
+      throw new Error(
+        `Expected status code of 204, received ${status} ${statusText}: ${util.inspect(data)}`
+      );
+    }
+    this.log.debug(`disabled user ${username}`);
+  }
+
+  public async enable(username: string) {
+    this.log.debug(`enabling user ${username}`);
+    const { data, status, statusText } = await this.kbnClient.request({
+      path: `/internal/security/users/${encodeURIComponent(username)}/_enable`,
+      method: 'POST',
+    });
+    if (status !== 204) {
+      throw new Error(
+        `Expected status code of 204, received ${status} ${statusText}: ${util.inspect(data)}`
+      );
+    }
+    this.log.debug(`enabled user ${username}`);
+  }
 }
diff --git a/test/scripts/jenkins_xpack_build_plugins.sh b/test/scripts/jenkins_xpack_build_plugins.sh
index 496964983cc6c..cb0b5ec1d56da 100755
--- a/test/scripts/jenkins_xpack_build_plugins.sh
+++ b/test/scripts/jenkins_xpack_build_plugins.sh
@@ -13,6 +13,7 @@ node scripts/build_kibana_platform_plugins \
   --scan-dir "$XPACK_DIR/test/plugin_api_perf/plugins" \
   --scan-dir "$XPACK_DIR/test/licensing_plugin/plugins" \
   --scan-dir "$XPACK_DIR/test/usage_collection/plugins" \
+  --scan-dir "$XPACK_DIR/test/security_functional/fixtures/common" \
   --scan-dir "$KIBANA_DIR/examples" \
   --scan-dir "$XPACK_DIR/examples" \
   --workers 12 \
diff --git a/x-pack/plugins/reporting/server/routes/jobs.ts b/x-pack/plugins/reporting/server/routes/jobs.ts
index 7141b1a141185..3f2a95a34224c 100644
--- a/x-pack/plugins/reporting/server/routes/jobs.ts
+++ b/x-pack/plugins/reporting/server/routes/jobs.ts
@@ -7,6 +7,7 @@
 
 import { schema } from '@kbn/config-schema';
 import Boom from '@hapi/boom';
+import { ROUTE_TAG_CAN_REDIRECT } from '../../../security/server';
 import { ReportingCore } from '../';
 import { API_BASE_URL } from '../../common/constants';
 import { authorizedUserPreRoutingFactory } from './lib/authorized_user_pre_routing';
@@ -198,6 +199,7 @@ export function registerJobInfoRoutes(reporting: ReportingCore) {
           docId: schema.string({ minLength: 3 }),
         }),
       },
+      options: { tags: [ROUTE_TAG_CAN_REDIRECT] },
     },
     userHandler(async (user, context, req, res) => {
       // ensure the async dependencies are loaded
diff --git a/x-pack/plugins/security/common/constants.ts b/x-pack/plugins/security/common/constants.ts
index a205109f537e7..ef83230fc2aba 100644
--- a/x-pack/plugins/security/common/constants.ts
+++ b/x-pack/plugins/security/common/constants.ts
@@ -19,7 +19,22 @@ export const GLOBAL_RESOURCE = '*';
 export const APPLICATION_PREFIX = 'kibana-';
 export const RESERVED_PRIVILEGES_APPLICATION_WILDCARD = 'kibana-*';
 
+/**
+ * This is the key of a query parameter that contains the name of the authentication provider that should be used to
+ * authenticate request. It's also used while the user is being redirected during single-sign-on authentication flows.
+ * That query parameter is discarded after the authentication flow succeeds. See the `Authenticator`,
+ * `OIDCAuthenticationProvider`, and `SAMLAuthenticationProvider` classes for more information.
+ */
 export const AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER = 'auth_provider_hint';
+
+/**
+ * This is the key of a query parameter that contains metadata about the (client-side) URL hash while the user is being
+ * redirected during single-sign-on authentication flows. That query parameter is discarded after the authentication
+ * flow succeeds. See the `Authenticator`, `OIDCAuthenticationProvider`, and `SAMLAuthenticationProvider` classes for
+ * more information.
+ */
+export const AUTH_URL_HASH_QUERY_STRING_PARAMETER = 'auth_url_hash';
+
 export const LOGOUT_PROVIDER_QUERY_STRING_PARAMETER = 'provider';
 export const LOGOUT_REASON_QUERY_STRING_PARAMETER = 'msg';
 export const NEXT_URL_QUERY_STRING_PARAMETER = 'next';
diff --git a/x-pack/plugins/security/public/authentication/capture_url/capture_url_app.test.ts b/x-pack/plugins/security/public/authentication/capture_url/capture_url_app.test.ts
index bf68d9f7a6e5e..44fd5ab195341 100644
--- a/x-pack/plugins/security/public/authentication/capture_url/capture_url_app.test.ts
+++ b/x-pack/plugins/security/public/authentication/capture_url/capture_url_app.test.ts
@@ -5,19 +5,29 @@
  * 2.0.
  */
 
-import type { AppMount, ScopedHistory } from 'src/core/public';
-import { coreMock, scopedHistoryMock } from 'src/core/public/mocks';
+import { coreMock } from 'src/core/public/mocks';
 
 import { captureURLApp } from './capture_url_app';
 
 describe('captureURLApp', () => {
+  let mockLocationReplace: jest.Mock;
   beforeAll(() => {
+    mockLocationReplace = jest.fn();
     Object.defineProperty(window, 'location', {
-      value: { href: 'https://some-host' },
+      value: {
+        href: 'https://some-host',
+        hash: '#/?_g=()',
+        origin: 'https://some-host',
+        replace: mockLocationReplace,
+      },
       writable: true,
     });
   });
 
+  beforeEach(() => {
+    mockLocationReplace.mockClear();
+  });
+
   it('properly registers application', () => {
     const coreSetupMock = coreMock.createSetup();
 
@@ -42,34 +52,37 @@ describe('captureURLApp', () => {
 
   it('properly handles captured URL', async () => {
     window.location.href = `https://host.com/mock-base-path/internal/security/capture-url?next=${encodeURIComponent(
-      '/mock-base-path/app/home'
-    )}&providerType=saml&providerName=saml1#/?_g=()`;
+      '/mock-base-path/app/home?auth_provider_hint=saml1'
+    )}#/?_g=()`;
 
     const coreSetupMock = coreMock.createSetup();
-    coreSetupMock.http.post.mockResolvedValue({ location: '/mock-base-path/app/home#/?_g=()' });
-
     captureURLApp.create(coreSetupMock);
 
     const [[{ mount }]] = coreSetupMock.application.register.mock.calls;
-    await (mount as AppMount)({
-      element: document.createElement('div'),
-      appBasePath: '',
-      onAppLeave: jest.fn(),
-      setHeaderActionMenu: jest.fn(),
-      history: (scopedHistoryMock.create() as unknown) as ScopedHistory,
-    });
+    await mount(coreMock.createAppMountParamters());
 
-    expect(coreSetupMock.http.post).toHaveBeenCalledTimes(1);
-    expect(coreSetupMock.http.post).toHaveBeenCalledWith('/internal/security/login', {
-      body: JSON.stringify({
-        providerType: 'saml',
-        providerName: 'saml1',
-        currentURL: `https://host.com/mock-base-path/internal/security/capture-url?next=${encodeURIComponent(
-          '/mock-base-path/app/home'
-        )}&providerType=saml&providerName=saml1#/?_g=()`,
-      }),
-    });
+    expect(mockLocationReplace).toHaveBeenCalledTimes(1);
+    expect(mockLocationReplace).toHaveBeenCalledWith(
+      'https://some-host/mock-base-path/app/home?auth_provider_hint=saml1&auth_url_hash=%23%2F%3F_g%3D%28%29#/?_g=()'
+    );
+    expect(coreSetupMock.fatalErrors.add).not.toHaveBeenCalled();
+  });
 
-    expect(window.location.href).toBe('/mock-base-path/app/home#/?_g=()');
+  it('properly handles open redirects', async () => {
+    window.location.href = `https://host.com/mock-base-path/internal/security/capture-url?next=${encodeURIComponent(
+      'https://evil.com/mock-base-path/app/home?auth_provider_hint=saml1'
+    )}#/?_g=()`;
+
+    const coreSetupMock = coreMock.createSetup();
+    captureURLApp.create(coreSetupMock);
+
+    const [[{ mount }]] = coreSetupMock.application.register.mock.calls;
+    await mount(coreMock.createAppMountParamters());
+
+    expect(mockLocationReplace).toHaveBeenCalledTimes(1);
+    expect(mockLocationReplace).toHaveBeenCalledWith(
+      'https://some-host/?auth_url_hash=%23%2F%3F_g%3D%28%29'
+    );
+    expect(coreSetupMock.fatalErrors.add).not.toHaveBeenCalled();
   });
 });
diff --git a/x-pack/plugins/security/public/authentication/capture_url/capture_url_app.ts b/x-pack/plugins/security/public/authentication/capture_url/capture_url_app.ts
index 7797ce4e62102..af45314c5bacb 100644
--- a/x-pack/plugins/security/public/authentication/capture_url/capture_url_app.ts
+++ b/x-pack/plugins/security/public/authentication/capture_url/capture_url_app.ts
@@ -5,10 +5,11 @@
  * 2.0.
  */
 
-import { parse } from 'url';
-
 import type { ApplicationSetup, FatalErrorsSetup, HttpSetup } from 'src/core/public';
 
+import { AUTH_URL_HASH_QUERY_STRING_PARAMETER } from '../../../common/constants';
+import { parseNext } from '../../../common/parse_next';
+
 interface CreateDeps {
   application: ApplicationSetup;
   http: HttpSetup;
@@ -22,20 +23,17 @@ interface CreateDeps {
  * path segment into the `next` query string parameter (so that it's not lost during redirect). And
  * since browsers preserve hash fragments during redirects (assuming redirect location doesn't
  * specify its own hash fragment, which is true in our case) this app can capture both path and
- * hash URL segments and send them back to the authentication provider via login endpoint.
+ * hash URL segments and re-try request sending hash fragment in a dedicated query string parameter.
  *
  * The flow can look like this:
- * 1. User visits `/app/kibana#/management/elasticsearch` that initiates authentication.
- * 2. Provider redirect user to `/internal/security/capture-url?next=%2Fapp%2Fkibana&providerType=saml&providerName=saml1`.
- * 3. Browser preserves hash segment and users ends up at `/internal/security/capture-url?next=%2Fapp%2Fkibana&providerType=saml&providerName=saml1#/management/elasticsearch`.
- * 4. The app captures full URL and sends it back as is via login endpoint:
- * {
- *   providerType: 'saml',
- *   providerName: 'saml1',
- *   currentURL: 'https://kibana.com/internal/security/capture-url?next=%2Fapp%2Fkibana&providerType=saml&providerName=saml1#/management/elasticsearch'
- * }
- * 5. Login endpoint handler parses and validates `next` parameter, joins it with the hash segment
- * and finally passes it to the provider that initiated capturing.
+ * 1. User visits `https://kibana.com/app/kibana#/management/elasticsearch` that initiates authentication.
+ * 2. Provider redirect user to `/internal/security/capture-url?next=%2Fapp%2Fkibana&auth_provider_hint=saml1`.
+ * 3. Browser preserves hash segment and users ends up at `/internal/security/capture-url?next=%2Fapp%2Fkibana&auth_provider_hint=saml1#/management/elasticsearch`.
+ * 4. The app reconstructs original URL, adds `auth_url_hash` query string parameter with the captured hash fragment and redirects user to:
+ *    https://kibana.com/app/kibana?auth_provider_hint=saml1&auth_url_hash=%23%2Fmanagement%2Felasticsearch#/management/elasticsearch
+ * 5. Once Kibana receives this request, it immediately picks exactly the same provider to handle authentication (based on `auth_provider_hint=saml1`),
+ *    and, since it has full URL now (original request path, query string and hash extracted from `auth_url_hash=%23%2Fmanagement%2Felasticsearch`),
+ *    it can proceed to a proper authentication handshake.
  */
 export const captureURLApp = Object.freeze({
   id: 'security_capture_url',
@@ -48,19 +46,14 @@ export const captureURLApp = Object.freeze({
       appRoute: '/internal/security/capture-url',
       async mount() {
         try {
-          const { providerName, providerType } = parse(window.location.href, true).query ?? {};
-          if (!providerName || !providerType) {
-            fatalErrors.add(new Error('Provider to capture URL for is not specified.'));
-            return () => {};
-          }
-
-          const { location } = await http.post<{ location: string }>('/internal/security/login', {
-            body: JSON.stringify({ providerType, providerName, currentURL: window.location.href }),
-          });
-
-          window.location.href = location;
+          const url = new URL(
+            parseNext(window.location.href, http.basePath.serverBasePath),
+            window.location.origin
+          );
+          url.searchParams.append(AUTH_URL_HASH_QUERY_STRING_PARAMETER, window.location.hash);
+          window.location.replace(url.toString());
         } catch (err) {
-          fatalErrors.add(new Error('Cannot login with captured URL.'));
+          fatalErrors.add(new Error(`Cannot parse current URL: ${err && err.message}.`));
         }
 
         return () => {};
diff --git a/x-pack/plugins/security/public/authentication/login/components/index.ts b/x-pack/plugins/security/public/authentication/login/components/index.ts
index 66e91a390784a..63928e4e82e37 100644
--- a/x-pack/plugins/security/public/authentication/login/components/index.ts
+++ b/x-pack/plugins/security/public/authentication/login/components/index.ts
@@ -5,5 +5,5 @@
  * 2.0.
  */
 
-export { LoginForm } from './login_form';
+export { LoginForm, LoginFormMessageType } from './login_form';
 export { DisabledLoginForm } from './disabled_login_form';
diff --git a/x-pack/plugins/security/public/authentication/login/components/login_form/index.ts b/x-pack/plugins/security/public/authentication/login/components/login_form/index.ts
index 6215f4e1e5b7a..d12ea30c784cb 100644
--- a/x-pack/plugins/security/public/authentication/login/components/login_form/index.ts
+++ b/x-pack/plugins/security/public/authentication/login/components/login_form/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { LoginForm } from './login_form';
+export { LoginForm, MessageType as LoginFormMessageType } from './login_form';
diff --git a/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.test.tsx b/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.test.tsx
index f58150d4580b8..e816fa032a0e5 100644
--- a/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.test.tsx
+++ b/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.test.tsx
@@ -14,7 +14,7 @@ import ReactMarkdown from 'react-markdown';
 import { findTestSubject, mountWithIntl, nextTick, shallowWithIntl } from '@kbn/test/jest';
 import { coreMock } from 'src/core/public/mocks';
 
-import { LoginForm, PageMode } from './login_form';
+import { LoginForm, MessageType, PageMode } from './login_form';
 
 function expectPageMode(wrapper: ReactWrapper, mode: PageMode) {
   const assertions: Array<[string, boolean]> =
@@ -90,7 +90,7 @@ describe('LoginForm', () => {
       <LoginForm
         http={coreStartMock.http}
         notifications={coreStartMock.notifications}
-        infoMessage={'Hey this is an info message'}
+        message={{ type: MessageType.Info, content: 'Hey this is an info message' }}
         loginAssistanceMessage=""
         selector={{
           enabled: false,
@@ -152,7 +152,7 @@ describe('LoginForm', () => {
     });
 
     expect(wrapper.find(EuiCallOut).props().title).toEqual(
-      `Invalid username or password. Please try again.`
+      `Username or password is incorrect. Please try again.`
     );
   });
 
diff --git a/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.tsx b/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.tsx
index ca573ada36d22..df131e2eac133 100644
--- a/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.tsx
+++ b/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.tsx
@@ -40,7 +40,7 @@ interface Props {
   http: HttpStart;
   notifications: NotificationsStart;
   selector: LoginSelector;
-  infoMessage?: string;
+  message?: { type: MessageType.Danger | MessageType.Info; content: string };
   loginAssistanceMessage: string;
   loginHelp?: string;
   authProviderHint?: string;
@@ -66,7 +66,7 @@ enum LoadingStateType {
   AutoLogin,
 }
 
-enum MessageType {
+export enum MessageType {
   None,
   Info,
   Danger,
@@ -106,9 +106,7 @@ export class LoginForm extends Component<Props, State> {
       loadingState: { type: LoadingStateType.None },
       username: '',
       password: '',
-      message: this.props.infoMessage
-        ? { type: MessageType.Info, content: this.props.infoMessage }
-        : { type: MessageType.None },
+      message: this.props.message || { type: MessageType.None },
       mode,
       previousMode: mode,
     };
@@ -206,7 +204,7 @@ export class LoginForm extends Component<Props, State> {
         >
           <FormattedMessage
             id="xpack.security.loginPage.loginSelectorLinkText"
-            defaultMessage="See more login options"
+            defaultMessage="More login options"
           />
         </EuiButtonEmpty>
       </EuiFlexItem>
@@ -480,8 +478,8 @@ export class LoginForm extends Component<Props, State> {
       const message =
         (error as IHttpFetchError).response?.status === 401
           ? i18n.translate(
-              'xpack.security.login.basicLoginForm.invalidUsernameOrPasswordErrorMessage',
-              { defaultMessage: 'Invalid username or password. Please try again.' }
+              'xpack.security.login.basicLoginForm.usernameOrPasswordIsIncorrectErrorMessage',
+              { defaultMessage: 'Username or password is incorrect. Please try again.' }
             )
           : i18n.translate('xpack.security.login.basicLoginForm.unknownErrorMessage', {
               defaultMessage: 'Oops! Error. Try again.',
diff --git a/x-pack/plugins/security/public/authentication/login/login_page.test.tsx b/x-pack/plugins/security/public/authentication/login/login_page.test.tsx
index a9596aff3bf0e..b3e2fac3ea2cc 100644
--- a/x-pack/plugins/security/public/authentication/login/login_page.test.tsx
+++ b/x-pack/plugins/security/public/authentication/login/login_page.test.tsx
@@ -14,7 +14,7 @@ import { coreMock } from 'src/core/public/mocks';
 
 import { AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER } from '../../../common/constants';
 import type { LoginState } from '../../../common/login_state';
-import { DisabledLoginForm, LoginForm } from './components';
+import { DisabledLoginForm, LoginForm, LoginFormMessageType } from './components';
 import { LoginPage } from './login_page';
 
 const createLoginState = (options?: Partial<LoginState>) => {
@@ -228,9 +228,12 @@ describe('LoginPage', () => {
         resetHttpMock(); // so the calls don't show in the BasicLoginForm snapshot
       });
 
-      const { authProviderHint, infoMessage } = wrapper.find(LoginForm).props();
+      const { authProviderHint, message } = wrapper.find(LoginForm).props();
       expect(authProviderHint).toBe('basic1');
-      expect(infoMessage).toBe('Your session has timed out. Please log in again.');
+      expect(message).toEqual({
+        type: LoginFormMessageType.Info,
+        content: 'Your session has timed out. Please log in again.',
+      });
     });
 
     it('renders as expected when loginAssistanceMessage is set', async () => {
diff --git a/x-pack/plugins/security/public/authentication/login/login_page.tsx b/x-pack/plugins/security/public/authentication/login/login_page.tsx
index 562adec7918d3..40438ac1c78f3 100644
--- a/x-pack/plugins/security/public/authentication/login/login_page.tsx
+++ b/x-pack/plugins/security/public/authentication/login/login_page.tsx
@@ -23,7 +23,7 @@ import {
   LOGOUT_REASON_QUERY_STRING_PARAMETER,
 } from '../../../common/constants';
 import type { LoginState } from '../../../common/login_state';
-import { DisabledLoginForm, LoginForm } from './components';
+import { DisabledLoginForm, LoginForm, LoginFormMessageType } from './components';
 
 interface Props {
   http: HttpStart;
@@ -36,18 +36,34 @@ interface State {
   loginState: LoginState | null;
 }
 
-const infoMessageMap = new Map([
+const messageMap = new Map([
   [
     'SESSION_EXPIRED',
-    i18n.translate('xpack.security.login.sessionExpiredDescription', {
-      defaultMessage: 'Your session has timed out. Please log in again.',
-    }),
+    {
+      type: LoginFormMessageType.Info,
+      content: i18n.translate('xpack.security.login.sessionExpiredDescription', {
+        defaultMessage: 'Your session has timed out. Please log in again.',
+      }),
+    },
   ],
   [
     'LOGGED_OUT',
-    i18n.translate('xpack.security.login.loggedOutDescription', {
-      defaultMessage: 'You have logged out of Elastic.',
-    }),
+    {
+      type: LoginFormMessageType.Info,
+      content: i18n.translate('xpack.security.login.loggedOutDescription', {
+        defaultMessage: 'You have logged out of Elastic.',
+      }),
+    },
+  ],
+  [
+    'UNAUTHENTICATED',
+    {
+      type: LoginFormMessageType.Danger,
+      content: i18n.translate('xpack.security.unauthenticated.errorDescription', {
+        defaultMessage:
+          "We hit an authentication error. Please check your credentials and try again. If you still can't log in, contact your system administrator.",
+      }),
+    },
   ],
 ]);
 
@@ -226,7 +242,7 @@ export class LoginPage extends Component<Props, State> {
         notifications={this.props.notifications}
         selector={selector}
         // @ts-expect-error Map.get is ok with getting `undefined`
-        infoMessage={infoMessageMap.get(query[LOGOUT_REASON_QUERY_STRING_PARAMETER]?.toString())}
+        message={messageMap.get(query[LOGOUT_REASON_QUERY_STRING_PARAMETER]?.toString())}
         loginAssistanceMessage={this.props.loginAssistanceMessage}
         loginHelp={loginHelp}
         authProviderHint={query[AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER]?.toString()}
diff --git a/x-pack/plugins/security/server/__snapshots__/prompt_page.test.tsx.snap b/x-pack/plugins/security/server/__snapshots__/prompt_page.test.tsx.snap
new file mode 100644
index 0000000000000..bcb97538b4f05
--- /dev/null
+++ b/x-pack/plugins/security/server/__snapshots__/prompt_page.test.tsx.snap
@@ -0,0 +1,5 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`PromptPage renders as expected with additional scripts 1`] = `"<html lang=\\"en\\"><head><title>Elastic</title><link href=\\"/mock-server-basepath/100500/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.css\\" rel=\\"stylesheet\\"/><link href=\\"/mock-server-basepath/100500/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.v7.light.css\\" rel=\\"stylesheet\\"/><link href=\\"/mock-server-basepath/node_modules/@kbn/ui-framework/dist/kui_light.css\\" rel=\\"stylesheet\\"/><link href=\\"/mock-server-basepath/ui/legacy_light_theme.css\\" rel=\\"stylesheet\\"/>MockedFonts<link rel=\\"alternate icon\\" type=\\"image/png\\" href=\\"/mock-server-basepath/ui/favicons/favicon.png\\"/><link rel=\\"icon\\" type=\\"image/svg+xml\\" href=\\"/mock-server-basepath/ui/favicons/favicon.svg\\"/><script src=\\"/mock-basepath/some/script1.js\\"></script><script src=\\"/mock-basepath/some/script2.js\\"></script><meta name=\\"theme-color\\" content=\\"#ffffff\\"/><meta name=\\"color-scheme\\" content=\\"light dark\\"/></head><body><div class=\\"euiPage euiPage--grow\\" style=\\"min-height:100vh\\" data-test-subj=\\"promptPage\\"><main class=\\"euiPageBody euiPageBody--borderRadiusNone\\"><div class=\\"euiPanel euiPanel--paddingLarge euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPageContent euiPageContent--verticalCenter euiPageContent--horizontalCenter\\" role=\\"main\\"><div class=\\"euiEmptyPrompt\\"><span data-euiicon-type=\\"alert\\" color=\\"danger\\"></span><div class=\\"euiSpacer euiSpacer--s\\"></div><span class=\\"euiTextColor euiTextColor--subdued\\"><h2 class=\\"euiTitle euiTitle--medium\\">Some Title</h2><div class=\\"euiSpacer euiSpacer--m\\"></div><div class=\\"euiText euiText--medium\\"><div>Some Body</div></div></span><div class=\\"euiSpacer euiSpacer--l\\"></div><div class=\\"euiSpacer euiSpacer--s\\"></div><div class=\\"euiFlexGroup euiFlexGroup--gutterMedium euiFlexGroup--alignItemsCenter euiFlexGroup--justifyContentCenter euiFlexGroup--directionColumn euiFlexGroup--responsive\\"><div class=\\"euiFlexItem euiFlexItem--flexGrowZero\\"><span>Action#1</span></div><div class=\\"euiFlexItem euiFlexItem--flexGrowZero\\"><span>Action#2</span></div></div></div></div></main></div></body></html>"`;
+
+exports[`PromptPage renders as expected without additional scripts 1`] = `"<html lang=\\"en\\"><head><title>Elastic</title><link href=\\"/mock-server-basepath/100500/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.css\\" rel=\\"stylesheet\\"/><link href=\\"/mock-server-basepath/100500/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.v7.light.css\\" rel=\\"stylesheet\\"/><link href=\\"/mock-server-basepath/node_modules/@kbn/ui-framework/dist/kui_light.css\\" rel=\\"stylesheet\\"/><link href=\\"/mock-server-basepath/ui/legacy_light_theme.css\\" rel=\\"stylesheet\\"/>MockedFonts<link rel=\\"alternate icon\\" type=\\"image/png\\" href=\\"/mock-server-basepath/ui/favicons/favicon.png\\"/><link rel=\\"icon\\" type=\\"image/svg+xml\\" href=\\"/mock-server-basepath/ui/favicons/favicon.svg\\"/><meta name=\\"theme-color\\" content=\\"#ffffff\\"/><meta name=\\"color-scheme\\" content=\\"light dark\\"/></head><body><div class=\\"euiPage euiPage--grow\\" style=\\"min-height:100vh\\" data-test-subj=\\"promptPage\\"><main class=\\"euiPageBody euiPageBody--borderRadiusNone\\"><div class=\\"euiPanel euiPanel--paddingLarge euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPageContent euiPageContent--verticalCenter euiPageContent--horizontalCenter\\" role=\\"main\\"><div class=\\"euiEmptyPrompt\\"><span data-euiicon-type=\\"alert\\" color=\\"danger\\"></span><div class=\\"euiSpacer euiSpacer--s\\"></div><span class=\\"euiTextColor euiTextColor--subdued\\"><h2 class=\\"euiTitle euiTitle--medium\\">Some Title</h2><div class=\\"euiSpacer euiSpacer--m\\"></div><div class=\\"euiText euiText--medium\\"><div>Some Body</div></div></span><div class=\\"euiSpacer euiSpacer--l\\"></div><div class=\\"euiSpacer euiSpacer--s\\"></div><div class=\\"euiFlexGroup euiFlexGroup--gutterMedium euiFlexGroup--alignItemsCenter euiFlexGroup--justifyContentCenter euiFlexGroup--directionColumn euiFlexGroup--responsive\\"><div class=\\"euiFlexItem euiFlexItem--flexGrowZero\\"><span>Action#1</span></div><div class=\\"euiFlexItem euiFlexItem--flexGrowZero\\"><span>Action#2</span></div></div></div></div></main></div></body></html>"`;
diff --git a/x-pack/plugins/security/server/authentication/__snapshots__/unauthenticated_page.test.tsx.snap b/x-pack/plugins/security/server/authentication/__snapshots__/unauthenticated_page.test.tsx.snap
new file mode 100644
index 0000000000000..55168401992f7
--- /dev/null
+++ b/x-pack/plugins/security/server/authentication/__snapshots__/unauthenticated_page.test.tsx.snap
@@ -0,0 +1,3 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`UnauthenticatedPage renders as expected 1`] = `"<html lang=\\"en\\"><head><title>Elastic</title><link href=\\"/mock-server-basepath/100500/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.css\\" rel=\\"stylesheet\\"/><link href=\\"/mock-server-basepath/100500/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.v7.light.css\\" rel=\\"stylesheet\\"/><link href=\\"/mock-server-basepath/node_modules/@kbn/ui-framework/dist/kui_light.css\\" rel=\\"stylesheet\\"/><link href=\\"/mock-server-basepath/ui/legacy_light_theme.css\\" rel=\\"stylesheet\\"/>MockedFonts<link rel=\\"alternate icon\\" type=\\"image/png\\" href=\\"/mock-server-basepath/ui/favicons/favicon.png\\"/><link rel=\\"icon\\" type=\\"image/svg+xml\\" href=\\"/mock-server-basepath/ui/favicons/favicon.svg\\"/><meta name=\\"theme-color\\" content=\\"#ffffff\\"/><meta name=\\"color-scheme\\" content=\\"light dark\\"/></head><body><div class=\\"euiPage euiPage--grow\\" style=\\"min-height:100vh\\" data-test-subj=\\"promptPage\\"><main class=\\"euiPageBody euiPageBody--borderRadiusNone\\"><div class=\\"euiPanel euiPanel--paddingLarge euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPageContent euiPageContent--verticalCenter euiPageContent--horizontalCenter\\" role=\\"main\\"><div class=\\"euiEmptyPrompt\\"><span data-euiicon-type=\\"alert\\" color=\\"danger\\"></span><div class=\\"euiSpacer euiSpacer--s\\"></div><span class=\\"euiTextColor euiTextColor--subdued\\"><h2 class=\\"euiTitle euiTitle--medium\\">We couldn&#x27;t log you in</h2><div class=\\"euiSpacer euiSpacer--m\\"></div><div class=\\"euiText euiText--medium\\"><p>We hit an authentication error. Please check your credentials and try again. If you still can&#x27;t log in, contact your system administrator.</p></div></span><div class=\\"euiSpacer euiSpacer--l\\"></div><div class=\\"euiSpacer euiSpacer--s\\"></div><div class=\\"euiFlexGroup euiFlexGroup--gutterMedium euiFlexGroup--alignItemsCenter euiFlexGroup--justifyContentCenter euiFlexGroup--directionColumn euiFlexGroup--responsive\\"><div class=\\"euiFlexItem euiFlexItem--flexGrowZero\\"><a class=\\"euiButton euiButton--primary euiButton--fill\\" href=\\"/some/url?some-query=some-value#some-hash\\" rel=\\"noreferrer\\" data-test-subj=\\"logInButton\\"><span class=\\"euiButtonContent euiButton__content\\"><span class=\\"euiButton__text\\">Log in</span></span></a></div></div></div></div></main></div></body></html>"`;
diff --git a/x-pack/plugins/security/server/authentication/authentication_service.test.mocks.ts b/x-pack/plugins/security/server/authentication/authentication_service.test.mocks.ts
new file mode 100644
index 0000000000000..12a63134f4ef2
--- /dev/null
+++ b/x-pack/plugins/security/server/authentication/authentication_service.test.mocks.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const mockCanRedirectRequest = jest.fn();
+jest.mock('./can_redirect_request', () => ({ canRedirectRequest: mockCanRedirectRequest }));
diff --git a/x-pack/plugins/security/server/authentication/authentication_service.test.ts b/x-pack/plugins/security/server/authentication/authentication_service.test.ts
index b0be9445c3fc3..d38f963a60c33 100644
--- a/x-pack/plugins/security/server/authentication/authentication_service.test.ts
+++ b/x-pack/plugins/security/server/authentication/authentication_service.test.ts
@@ -6,6 +6,9 @@
  */
 
 jest.mock('./authenticator');
+jest.mock('./unauthenticated_page');
+
+import { mockCanRedirectRequest } from './authentication_service.test.mocks';
 
 import Boom from '@hapi/boom';
 
@@ -18,6 +21,7 @@ import type {
   KibanaRequest,
   Logger,
   LoggerFactory,
+  OnPreResponseToolkit,
 } from 'src/core/server';
 import {
   coreMock,
@@ -37,6 +41,7 @@ import type { ConfigType } from '../config';
 import { ConfigSchema, createConfig } from '../config';
 import type { SecurityFeatureUsageServiceStart } from '../feature_usage';
 import { securityFeatureUsageServiceMock } from '../feature_usage/index.mock';
+import { ROUTE_TAG_AUTH_FLOW } from '../routes/tags';
 import type { Session } from '../session_management';
 import { sessionMock } from '../session_management/session.mock';
 import { AuthenticationResult } from './authentication_result';
@@ -47,15 +52,60 @@ describe('AuthenticationService', () => {
   let logger: jest.Mocked<Logger>;
   let mockSetupAuthenticationParams: {
     http: jest.Mocked<HttpServiceSetup>;
+    config: ConfigType;
     license: jest.Mocked<SecurityLicense>;
+    buildNumber: number;
+  };
+  let mockStartAuthenticationParams: {
+    legacyAuditLogger: jest.Mocked<SecurityAuditLogger>;
+    audit: jest.Mocked<AuditServiceSetup>;
+    config: ConfigType;
+    loggers: LoggerFactory;
+    http: jest.Mocked<HttpServiceStart>;
+    clusterClient: ReturnType<typeof elasticsearchServiceMock.createClusterClient>;
+    featureUsageService: jest.Mocked<SecurityFeatureUsageServiceStart>;
+    session: jest.Mocked<PublicMethodsOf<Session>>;
   };
   beforeEach(() => {
     logger = loggingSystemMock.createLogger();
 
+    const httpMock = coreMock.createSetup().http;
+    (httpMock.basePath.prepend as jest.Mock).mockImplementation(
+      (path) => `${httpMock.basePath.serverBasePath}${path}`
+    );
+    (httpMock.basePath.get as jest.Mock).mockImplementation(() => httpMock.basePath.serverBasePath);
     mockSetupAuthenticationParams = {
-      http: coreMock.createSetup().http,
+      http: httpMock,
+      config: createConfig(ConfigSchema.validate({}), loggingSystemMock.create().get(), {
+        isTLSEnabled: false,
+      }),
       license: licenseMock.create(),
+      buildNumber: 100500,
     };
+    mockCanRedirectRequest.mockReturnValue(false);
+
+    const coreStart = coreMock.createStart();
+    mockStartAuthenticationParams = {
+      legacyAuditLogger: securityAuditLoggerMock.create(),
+      audit: auditServiceMock.create(),
+      config: createConfig(
+        ConfigSchema.validate({
+          encryptionKey: 'ab'.repeat(16),
+          secureCookies: true,
+          cookieName: 'my-sid-cookie',
+        }),
+        loggingSystemMock.create().get(),
+        { isTLSEnabled: false }
+      ),
+      http: coreStart.http,
+      clusterClient: elasticsearchServiceMock.createClusterClient(),
+      loggers: loggingSystemMock.create(),
+      featureUsageService: securityFeatureUsageServiceMock.createStartContract(),
+      session: sessionMock.create(),
+    };
+    (mockStartAuthenticationParams.http.basePath.get as jest.Mock).mockImplementation(
+      () => mockStartAuthenticationParams.http.basePath.serverBasePath
+    );
 
     service = new AuthenticationService(logger);
   });
@@ -71,40 +121,19 @@ describe('AuthenticationService', () => {
         expect.any(Function)
       );
     });
+
+    it('properly registers onPreResponse handler', () => {
+      service.setup(mockSetupAuthenticationParams);
+
+      expect(mockSetupAuthenticationParams.http.registerOnPreResponse).toHaveBeenCalledTimes(1);
+      expect(mockSetupAuthenticationParams.http.registerOnPreResponse).toHaveBeenCalledWith(
+        expect.any(Function)
+      );
+    });
   });
 
   describe('#start()', () => {
-    let mockStartAuthenticationParams: {
-      legacyAuditLogger: jest.Mocked<SecurityAuditLogger>;
-      audit: jest.Mocked<AuditServiceSetup>;
-      config: ConfigType;
-      loggers: LoggerFactory;
-      http: jest.Mocked<HttpServiceStart>;
-      clusterClient: ReturnType<typeof elasticsearchServiceMock.createClusterClient>;
-      featureUsageService: jest.Mocked<SecurityFeatureUsageServiceStart>;
-      session: jest.Mocked<PublicMethodsOf<Session>>;
-    };
     beforeEach(() => {
-      const coreStart = coreMock.createStart();
-      mockStartAuthenticationParams = {
-        legacyAuditLogger: securityAuditLoggerMock.create(),
-        audit: auditServiceMock.create(),
-        config: createConfig(
-          ConfigSchema.validate({
-            encryptionKey: 'ab'.repeat(16),
-            secureCookies: true,
-            cookieName: 'my-sid-cookie',
-          }),
-          loggingSystemMock.create().get(),
-          { isTLSEnabled: false }
-        ),
-        http: coreStart.http,
-        clusterClient: elasticsearchServiceMock.createClusterClient(),
-        loggers: loggingSystemMock.create(),
-        featureUsageService: securityFeatureUsageServiceMock.createStartContract(),
-        session: sessionMock.create(),
-      };
-
       service.setup(mockSetupAuthenticationParams);
     });
 
@@ -318,4 +347,371 @@ describe('AuthenticationService', () => {
       });
     });
   });
+
+  describe('onPreResponse handler', () => {
+    function getService({ runStart = true }: { runStart?: boolean } = {}) {
+      service.setup(mockSetupAuthenticationParams);
+
+      if (runStart) {
+        service.start(mockStartAuthenticationParams);
+      }
+
+      const onPreResponseHandler =
+        mockSetupAuthenticationParams.http.registerOnPreResponse.mock.calls[0][0];
+      const [authenticator] = jest.requireMock('./authenticator').Authenticator.mock.instances;
+
+      return { authenticator, onPreResponseHandler };
+    }
+
+    it('ignores responses with non-401 status code', async () => {
+      const mockReturnedValue = { type: 'next' as any };
+      const mockOnPreResponseToolkit = httpServiceMock.createOnPreResponseToolkit();
+      mockOnPreResponseToolkit.next.mockReturnValue(mockReturnedValue);
+
+      const { onPreResponseHandler } = getService();
+      for (const statusCode of [200, 400, 403, 404]) {
+        await expect(
+          onPreResponseHandler(
+            httpServerMock.createKibanaRequest(),
+            { statusCode },
+            mockOnPreResponseToolkit
+          )
+        ).resolves.toBe(mockReturnedValue);
+      }
+    });
+
+    it('ignores responses to requests that cannot handle redirects', async () => {
+      const mockReturnedValue = { type: 'next' as any };
+      const mockOnPreResponseToolkit = httpServiceMock.createOnPreResponseToolkit();
+      mockOnPreResponseToolkit.next.mockReturnValue(mockReturnedValue);
+      mockCanRedirectRequest.mockReturnValue(false);
+
+      const { onPreResponseHandler } = getService();
+      await expect(
+        onPreResponseHandler(
+          httpServerMock.createKibanaRequest(),
+          { statusCode: 401 },
+          mockOnPreResponseToolkit
+        )
+      ).resolves.toBe(mockReturnedValue);
+    });
+
+    it('ignores responses if authenticator is not initialized', async () => {
+      // Run `setup`, but not `start` to simulate non-initialized `Authenticator`.
+      const { onPreResponseHandler } = getService({ runStart: false });
+
+      const mockReturnedValue = { type: 'next' as any };
+      const mockOnPreResponseToolkit = httpServiceMock.createOnPreResponseToolkit();
+      mockOnPreResponseToolkit.next.mockReturnValue(mockReturnedValue);
+      mockCanRedirectRequest.mockReturnValue(true);
+
+      await expect(
+        onPreResponseHandler(
+          httpServerMock.createKibanaRequest(),
+          { statusCode: 401 },
+          mockOnPreResponseToolkit
+        )
+      ).resolves.toBe(mockReturnedValue);
+    });
+
+    describe('when login form is available', () => {
+      let mockReturnedValue: { type: any; body: string };
+      let mockOnPreResponseToolkit: jest.Mocked<OnPreResponseToolkit>;
+      beforeEach(() => {
+        mockReturnedValue = { type: 'render' as any, body: 'body' };
+        mockOnPreResponseToolkit = httpServiceMock.createOnPreResponseToolkit();
+        mockOnPreResponseToolkit.render.mockReturnValue(mockReturnedValue);
+      });
+
+      it('redirects to the login page when user does not have an active session', async () => {
+        mockCanRedirectRequest.mockReturnValue(true);
+
+        const { authenticator, onPreResponseHandler } = getService();
+        authenticator.getRequestOriginalURL.mockReturnValue('/mock-server-basepath/app/some');
+
+        await expect(
+          onPreResponseHandler(
+            httpServerMock.createKibanaRequest({ path: '/app/some', query: { param: 'one two' } }),
+            { statusCode: 401 },
+            mockOnPreResponseToolkit
+          )
+        ).resolves.toBe(mockReturnedValue);
+
+        expect(mockOnPreResponseToolkit.render).toHaveBeenCalledWith({
+          body: '<div/>',
+          headers: {
+            'Content-Security-Policy': `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`,
+            Refresh:
+              '0;url=/mock-server-basepath/login?msg=UNAUTHENTICATED&next=%2Fmock-server-basepath%2Fapp%2Fsome',
+          },
+        });
+      });
+
+      it('performs logout if user has an active session', async () => {
+        mockStartAuthenticationParams.session.getSID.mockResolvedValue('some-sid');
+
+        const { authenticator, onPreResponseHandler } = getService();
+        authenticator.getRequestOriginalURL.mockReturnValue('/mock-server-basepath/app/some');
+        mockCanRedirectRequest.mockReturnValue(true);
+
+        await expect(
+          onPreResponseHandler(
+            httpServerMock.createKibanaRequest({ path: '/app/some', query: { param: 'one two' } }),
+            { statusCode: 401 },
+            mockOnPreResponseToolkit
+          )
+        ).resolves.toBe(mockReturnedValue);
+
+        expect(mockOnPreResponseToolkit.render).toHaveBeenCalledWith({
+          body: '<div/>',
+          headers: {
+            'Content-Security-Policy': `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`,
+            Refresh:
+              '0;url=/mock-server-basepath/logout?msg=UNAUTHENTICATED&next=%2Fmock-server-basepath%2Fapp%2Fsome',
+          },
+        });
+      });
+
+      it('does not preserve path for the authentication flow paths', async () => {
+        const { authenticator, onPreResponseHandler } = getService();
+        authenticator.getRequestOriginalURL.mockReturnValue('/mock-server-basepath/app/some');
+        mockCanRedirectRequest.mockReturnValue(true);
+
+        await expect(
+          onPreResponseHandler(
+            httpServerMock.createKibanaRequest({
+              path: '/api/security/saml/callback',
+              query: { param: 'one two' },
+              routeTags: [ROUTE_TAG_AUTH_FLOW],
+            }),
+            { statusCode: 401 },
+            mockOnPreResponseToolkit
+          )
+        ).resolves.toBe(mockReturnedValue);
+
+        expect(mockOnPreResponseToolkit.render).toHaveBeenCalledWith({
+          body: '<div/>',
+          headers: {
+            'Content-Security-Policy': `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`,
+            Refresh:
+              '0;url=/mock-server-basepath/login?msg=UNAUTHENTICATED&next=%2Fmock-server-basepath%2F',
+          },
+        });
+      });
+    });
+
+    describe('when login selector is available', () => {
+      let mockReturnedValue: { type: any; body: string };
+      let mockOnPreResponseToolkit: jest.Mocked<OnPreResponseToolkit>;
+      beforeEach(() => {
+        mockReturnedValue = { type: 'render' as any, body: 'body' };
+        mockOnPreResponseToolkit = httpServiceMock.createOnPreResponseToolkit();
+        mockOnPreResponseToolkit.render.mockReturnValue(mockReturnedValue);
+
+        mockSetupAuthenticationParams.config = createConfig(
+          ConfigSchema.validate({
+            authc: {
+              providers: {
+                saml: { saml1: { order: 0, realm: 'saml1' } },
+                basic: { basic1: { order: 1 } },
+              },
+            },
+          }),
+          loggingSystemMock.create().get(),
+          { isTLSEnabled: false }
+        );
+      });
+
+      it('redirects to the login page when user does not have an active session', async () => {
+        const { authenticator, onPreResponseHandler } = getService();
+        authenticator.getRequestOriginalURL.mockReturnValue('/mock-server-basepath/app/some');
+        mockCanRedirectRequest.mockReturnValue(true);
+
+        await expect(
+          onPreResponseHandler(
+            httpServerMock.createKibanaRequest({ path: '/app/some', query: { param: 'one two' } }),
+            { statusCode: 401 },
+            mockOnPreResponseToolkit
+          )
+        ).resolves.toBe(mockReturnedValue);
+
+        expect(mockOnPreResponseToolkit.render).toHaveBeenCalledWith({
+          body: '<div/>',
+          headers: {
+            'Content-Security-Policy': `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`,
+            Refresh:
+              '0;url=/mock-server-basepath/login?msg=UNAUTHENTICATED&next=%2Fmock-server-basepath%2Fapp%2Fsome',
+          },
+        });
+      });
+
+      it('performs logout if user has an active session', async () => {
+        mockStartAuthenticationParams.session.getSID.mockResolvedValue('some-sid');
+
+        const { authenticator, onPreResponseHandler } = getService();
+        authenticator.getRequestOriginalURL.mockReturnValue('/mock-server-basepath/app/some');
+        mockCanRedirectRequest.mockReturnValue(true);
+
+        await expect(
+          onPreResponseHandler(
+            httpServerMock.createKibanaRequest({ path: '/app/some', query: { param: 'one two' } }),
+            { statusCode: 401 },
+            mockOnPreResponseToolkit
+          )
+        ).resolves.toBe(mockReturnedValue);
+
+        expect(mockOnPreResponseToolkit.render).toHaveBeenCalledWith({
+          body: '<div/>',
+          headers: {
+            'Content-Security-Policy': `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`,
+            Refresh:
+              '0;url=/mock-server-basepath/logout?msg=UNAUTHENTICATED&next=%2Fmock-server-basepath%2Fapp%2Fsome',
+          },
+        });
+      });
+
+      it('does not preserve path for the authentication flow paths', async () => {
+        const { authenticator, onPreResponseHandler } = getService();
+        authenticator.getRequestOriginalURL.mockReturnValue('/mock-server-basepath/app/some');
+        mockCanRedirectRequest.mockReturnValue(true);
+
+        await expect(
+          onPreResponseHandler(
+            httpServerMock.createKibanaRequest({
+              path: '/api/security/saml/callback',
+              query: { param: 'one two' },
+              routeTags: [ROUTE_TAG_AUTH_FLOW],
+            }),
+            { statusCode: 401 },
+            mockOnPreResponseToolkit
+          )
+        ).resolves.toBe(mockReturnedValue);
+
+        expect(mockOnPreResponseToolkit.render).toHaveBeenCalledWith({
+          body: '<div/>',
+          headers: {
+            'Content-Security-Policy': `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`,
+            Refresh:
+              '0;url=/mock-server-basepath/login?msg=UNAUTHENTICATED&next=%2Fmock-server-basepath%2F',
+          },
+        });
+      });
+    });
+
+    describe('when neither login selector nor login form is available', () => {
+      let mockReturnedValue: { type: any; body: string };
+      let mockOnPreResponseToolkit: jest.Mocked<OnPreResponseToolkit>;
+      beforeEach(() => {
+        mockReturnedValue = { type: 'render' as any, body: 'body' };
+        mockOnPreResponseToolkit = httpServiceMock.createOnPreResponseToolkit();
+        mockOnPreResponseToolkit.render.mockReturnValue(mockReturnedValue);
+
+        mockSetupAuthenticationParams.config = createConfig(
+          ConfigSchema.validate({
+            authc: { providers: { saml: { saml1: { order: 0, realm: 'saml1' } } } },
+          }),
+          loggingSystemMock.create().get(),
+          { isTLSEnabled: false }
+        );
+      });
+
+      it('renders unauthenticated page if user does not have an active session', async () => {
+        const mockRenderUnauthorizedPage = jest
+          .requireMock('./unauthenticated_page')
+          .renderUnauthenticatedPage.mockReturnValue('rendered-view');
+
+        const { authenticator, onPreResponseHandler } = getService();
+        authenticator.getRequestOriginalURL.mockReturnValue('/mock-server-basepath/app/some');
+        mockCanRedirectRequest.mockReturnValue(true);
+
+        await expect(
+          onPreResponseHandler(
+            httpServerMock.createKibanaRequest({ path: '/app/some', query: { param: 'one two' } }),
+            { statusCode: 401 },
+            mockOnPreResponseToolkit
+          )
+        ).resolves.toBe(mockReturnedValue);
+
+        expect(mockOnPreResponseToolkit.render).toHaveBeenCalledWith({
+          body: 'rendered-view',
+          headers: {
+            'Content-Security-Policy': `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`,
+          },
+        });
+
+        expect(mockRenderUnauthorizedPage).toHaveBeenCalledWith({
+          basePath: mockSetupAuthenticationParams.http.basePath,
+          buildNumber: 100500,
+          originalURL: '/mock-server-basepath/app/some',
+        });
+      });
+
+      it('renders unauthenticated page if user has an active session', async () => {
+        const mockRenderUnauthorizedPage = jest
+          .requireMock('./unauthenticated_page')
+          .renderUnauthenticatedPage.mockReturnValue('rendered-view');
+        mockStartAuthenticationParams.session.getSID.mockResolvedValue('some-sid');
+
+        const { authenticator, onPreResponseHandler } = getService();
+        authenticator.getRequestOriginalURL.mockReturnValue('/mock-server-basepath/app/some');
+        mockCanRedirectRequest.mockReturnValue(true);
+
+        await expect(
+          onPreResponseHandler(
+            httpServerMock.createKibanaRequest({ path: '/app/some', query: { param: 'one two' } }),
+            { statusCode: 401 },
+            mockOnPreResponseToolkit
+          )
+        ).resolves.toBe(mockReturnedValue);
+
+        expect(mockOnPreResponseToolkit.render).toHaveBeenCalledWith({
+          body: 'rendered-view',
+          headers: {
+            'Content-Security-Policy': `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`,
+          },
+        });
+
+        expect(mockRenderUnauthorizedPage).toHaveBeenCalledWith({
+          basePath: mockSetupAuthenticationParams.http.basePath,
+          buildNumber: 100500,
+          originalURL: '/mock-server-basepath/app/some',
+        });
+      });
+
+      it('does not preserve path for the authentication flow paths', async () => {
+        const mockRenderUnauthorizedPage = jest
+          .requireMock('./unauthenticated_page')
+          .renderUnauthenticatedPage.mockReturnValue('rendered-view');
+
+        const { authenticator, onPreResponseHandler } = getService();
+        authenticator.getRequestOriginalURL.mockReturnValue('/mock-server-basepath/app/some');
+        mockCanRedirectRequest.mockReturnValue(true);
+
+        await expect(
+          onPreResponseHandler(
+            httpServerMock.createKibanaRequest({
+              path: '/api/security/saml/callback',
+              query: { param: 'one two' },
+              routeTags: [ROUTE_TAG_AUTH_FLOW],
+            }),
+            { statusCode: 401 },
+            mockOnPreResponseToolkit
+          )
+        ).resolves.toBe(mockReturnedValue);
+
+        expect(mockOnPreResponseToolkit.render).toHaveBeenCalledWith({
+          body: 'rendered-view',
+          headers: {
+            'Content-Security-Policy': `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`,
+          },
+        });
+
+        expect(mockRenderUnauthorizedPage).toHaveBeenCalledWith({
+          basePath: mockSetupAuthenticationParams.http.basePath,
+          buildNumber: 100500,
+          originalURL: '/mock-server-basepath/',
+        });
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/security/server/authentication/authentication_service.ts b/x-pack/plugins/security/server/authentication/authentication_service.ts
index 7feeff7a5d8ed..e5895422e7a74 100644
--- a/x-pack/plugins/security/server/authentication/authentication_service.ts
+++ b/x-pack/plugins/security/server/authentication/authentication_service.ts
@@ -15,22 +15,29 @@ import type {
   LoggerFactory,
 } from 'src/core/server';
 
+import { NEXT_URL_QUERY_STRING_PARAMETER } from '../../common/constants';
 import type { SecurityLicense } from '../../common/licensing';
 import type { AuthenticatedUser } from '../../common/model';
+import { shouldProviderUseLoginForm } from '../../common/model';
 import type { AuditServiceSetup, SecurityAuditLogger } from '../audit';
 import type { ConfigType } from '../config';
-import { getErrorStatusCode } from '../errors';
+import { getDetailedErrorMessage, getErrorStatusCode } from '../errors';
 import type { SecurityFeatureUsageServiceStart } from '../feature_usage';
+import { ROUTE_TAG_AUTH_FLOW } from '../routes/tags';
 import type { Session } from '../session_management';
 import { APIKeys } from './api_keys';
 import type { AuthenticationResult } from './authentication_result';
 import type { ProviderLoginAttempt } from './authenticator';
 import { Authenticator } from './authenticator';
+import { canRedirectRequest } from './can_redirect_request';
 import type { DeauthenticationResult } from './deauthentication_result';
+import { renderUnauthenticatedPage } from './unauthenticated_page';
 
 interface AuthenticationServiceSetupParams {
-  http: Pick<HttpServiceSetup, 'registerAuth'>;
+  http: Pick<HttpServiceSetup, 'basePath' | 'csp' | 'registerAuth' | 'registerOnPreResponse'>;
+  config: ConfigType;
   license: SecurityLicense;
+  buildNumber: number;
 }
 
 interface AuthenticationServiceStartParams {
@@ -62,12 +69,23 @@ export interface AuthenticationServiceStart {
 export class AuthenticationService {
   private license!: SecurityLicense;
   private authenticator?: Authenticator;
+  private session?: PublicMethodsOf<Session>;
 
   constructor(private readonly logger: Logger) {}
 
-  setup({ http, license }: AuthenticationServiceSetupParams) {
+  setup({ config, http, license, buildNumber }: AuthenticationServiceSetupParams) {
     this.license = license;
 
+    // If we cannot automatically authenticate users we should redirect them straight to the login
+    // page if possible, so that they can try other methods to log in. If not possible, we should
+    // render a dedicated `Unauthenticated` page from which users can explicitly trigger a new
+    // login attempt. There are two cases when we can redirect to the login page:
+    // 1. Login selector is enabled
+    // 2. Login selector is disabled, but the provider with the lowest `order` uses login form
+    const isLoginPageAvailable =
+      config.authc.selector.enabled ||
+      shouldProviderUseLoginForm(config.authc.sortedProviders[0].type);
+
     http.registerAuth(async (request, response, t) => {
       if (!license.isLicenseAvailable()) {
         this.logger.error('License is not available, authentication is not possible.');
@@ -118,8 +136,9 @@ export class AuthenticationService {
       }
 
       if (authenticationResult.failed()) {
-        this.logger.info(`Authentication attempt failed: ${authenticationResult.error!.message}`);
         const error = authenticationResult.error!;
+        this.logger.info(`Authentication attempt failed: ${getDetailedErrorMessage(error)}`);
+
         // proxy Elasticsearch "native" errors
         const statusCode = getErrorStatusCode(error);
         if (typeof statusCode === 'number') {
@@ -139,7 +158,49 @@ export class AuthenticationService {
       return t.notHandled();
     });
 
-    this.logger.debug('Successfully registered core authentication handler.');
+    http.registerOnPreResponse(async (request, preResponse, toolkit) => {
+      if (preResponse.statusCode !== 401 || !canRedirectRequest(request)) {
+        return toolkit.next();
+      }
+
+      if (!this.authenticator) {
+        // Core doesn't allow returning error here.
+        this.logger.error('Authentication sub-system is not fully initialized yet.');
+        return toolkit.next();
+      }
+
+      // If users can eventually re-login we want to redirect them directly to the page they tried
+      // to access initially, but we only want to do that for routes that aren't part of the various
+      // authentication flows that wouldn't make any sense after successful authentication.
+      const originalURL = !request.route.options.tags.includes(ROUTE_TAG_AUTH_FLOW)
+        ? this.authenticator.getRequestOriginalURL(request)
+        : `${http.basePath.get(request)}/`;
+      if (!isLoginPageAvailable) {
+        return toolkit.render({
+          body: renderUnauthenticatedPage({ buildNumber, basePath: http.basePath, originalURL }),
+          headers: { 'Content-Security-Policy': http.csp.header },
+        });
+      }
+
+      const needsToLogout = (await this.session?.getSID(request)) !== undefined;
+      if (needsToLogout) {
+        this.logger.warn('Could not authenticate user with the existing session. Forcing logout.');
+      }
+
+      return toolkit.render({
+        body: '<div/>',
+        headers: {
+          'Content-Security-Policy': http.csp.header,
+          Refresh: `0;url=${http.basePath.prepend(
+            `${
+              needsToLogout ? '/logout' : '/login'
+            }?msg=UNAUTHENTICATED&${NEXT_URL_QUERY_STRING_PARAMETER}=${encodeURIComponent(
+              originalURL
+            )}`
+          )}`,
+        },
+      });
+    });
   }
 
   start({
@@ -161,6 +222,7 @@ export class AuthenticationService {
     const getCurrentUser = (request: KibanaRequest) =>
       http.auth.get<AuthenticatedUser>(request).state ?? null;
 
+    this.session = session;
     this.authenticator = new Authenticator({
       legacyAuditLogger,
       audit,
diff --git a/x-pack/plugins/security/server/authentication/authenticator.test.ts b/x-pack/plugins/security/server/authentication/authenticator.test.ts
index 1bd430d0c5c98..ca33be92e9e99 100644
--- a/x-pack/plugins/security/server/authentication/authenticator.test.ts
+++ b/x-pack/plugins/security/server/authentication/authenticator.test.ts
@@ -20,6 +20,10 @@ import {
   loggingSystemMock,
 } from 'src/core/server/mocks';
 
+import {
+  AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER,
+  AUTH_URL_HASH_QUERY_STRING_PARAMETER,
+} from '../../common/constants';
 import type { SecurityLicenseFeatures } from '../../common/licensing';
 import { licenseMock } from '../../common/licensing/index.mock';
 import { mockAuthenticatedUser } from '../../common/model/authenticated_user.mock';
@@ -1780,13 +1784,13 @@ describe('Authenticator', () => {
       );
     });
 
-    it('returns `notHandled` if session does not exist.', async () => {
+    it('redirects to login form if session does not exist.', async () => {
       const request = httpServerMock.createKibanaRequest();
       mockOptions.session.get.mockResolvedValue(null);
       mockBasicAuthenticationProvider.logout.mockResolvedValue(DeauthenticationResult.notHandled());
 
       await expect(authenticator.logout(request)).resolves.toEqual(
-        DeauthenticationResult.notHandled()
+        DeauthenticationResult.redirectTo('/mock-server-basepath/login?msg=LOGGED_OUT')
       );
 
       expect(mockOptions.session.invalidate).not.toHaveBeenCalled();
@@ -1843,12 +1847,12 @@ describe('Authenticator', () => {
       expect(mockOptions.session.invalidate).not.toHaveBeenCalled();
     });
 
-    it('returns `notHandled` if session does not exist and provider name is invalid', async () => {
+    it('redirects to login form if session does not exist and provider name is invalid', async () => {
       const request = httpServerMock.createKibanaRequest({ query: { provider: 'foo' } });
       mockOptions.session.get.mockResolvedValue(null);
 
       await expect(authenticator.logout(request)).resolves.toEqual(
-        DeauthenticationResult.notHandled()
+        DeauthenticationResult.redirectTo('/mock-server-basepath/login?msg=LOGGED_OUT')
       );
 
       expect(mockBasicAuthenticationProvider.logout).not.toHaveBeenCalled();
@@ -1937,4 +1941,64 @@ describe('Authenticator', () => {
       );
     });
   });
+
+  describe('`getRequestOriginalURL` method', () => {
+    let authenticator: Authenticator;
+    let mockOptions: ReturnType<typeof getMockOptions>;
+    beforeEach(() => {
+      mockOptions = getMockOptions({ providers: { basic: { basic1: { order: 0 } } } });
+      authenticator = new Authenticator(mockOptions);
+    });
+
+    it('filters out auth specific query parameters', () => {
+      expect(authenticator.getRequestOriginalURL(httpServerMock.createKibanaRequest())).toBe(
+        '/mock-server-basepath/path'
+      );
+
+      expect(
+        authenticator.getRequestOriginalURL(
+          httpServerMock.createKibanaRequest({
+            query: {
+              [AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER]: 'saml1',
+            },
+          })
+        )
+      ).toBe('/mock-server-basepath/path');
+
+      expect(
+        authenticator.getRequestOriginalURL(
+          httpServerMock.createKibanaRequest({
+            query: {
+              [AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER]: 'saml1',
+              [AUTH_URL_HASH_QUERY_STRING_PARAMETER]: '#some-hash',
+            },
+          })
+        )
+      ).toBe('/mock-server-basepath/path');
+    });
+
+    it('allows to include additional query parameters', () => {
+      expect(
+        authenticator.getRequestOriginalURL(httpServerMock.createKibanaRequest(), [
+          ['some-param', 'some-value'],
+          ['some-param2', 'some-value2'],
+        ])
+      ).toBe('/mock-server-basepath/path?some-param=some-value&some-param2=some-value2');
+
+      expect(
+        authenticator.getRequestOriginalURL(
+          httpServerMock.createKibanaRequest({
+            query: {
+              [AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER]: 'saml1',
+              [AUTH_URL_HASH_QUERY_STRING_PARAMETER]: '#some-hash',
+            },
+          }),
+          [
+            ['some-param', 'some-value'],
+            [AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER, 'oidc1'],
+          ]
+        )
+      ).toBe('/mock-server-basepath/path?some-param=some-value&auth_provider_hint=oidc1');
+    });
+  });
 });
diff --git a/x-pack/plugins/security/server/authentication/authenticator.ts b/x-pack/plugins/security/server/authentication/authenticator.ts
index f86ff54963da9..4eeadf23c50b2 100644
--- a/x-pack/plugins/security/server/authentication/authenticator.ts
+++ b/x-pack/plugins/security/server/authentication/authenticator.ts
@@ -11,6 +11,7 @@ import type { IBasePath, IClusterClient, LoggerFactory } from 'src/core/server';
 import { KibanaRequest } from '../../../../../src/core/server';
 import {
   AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER,
+  AUTH_URL_HASH_QUERY_STRING_PARAMETER,
   LOGOUT_PROVIDER_QUERY_STRING_PARAMETER,
   LOGOUT_REASON_QUERY_STRING_PARAMETER,
   NEXT_URL_QUERY_STRING_PARAMETER,
@@ -45,6 +46,15 @@ import {
 } from './providers';
 import { Tokens } from './tokens';
 
+/**
+ * List of query string parameters used to pass various authentication related metadata that should
+ * be stripped away from URL as soon as they are no longer needed.
+ */
+const AUTH_METADATA_QUERY_STRING_PARAMETERS = [
+  AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER,
+  AUTH_URL_HASH_QUERY_STRING_PARAMETER,
+];
+
 /**
  * The shape of the login attempt.
  */
@@ -201,6 +211,7 @@ export class Authenticator {
     const providerCommonOptions = {
       client: this.options.clusterClient,
       basePath: this.options.basePath,
+      getRequestOriginalURL: this.getRequestOriginalURL.bind(this),
       tokens: new Tokens({
         client: this.options.clusterClient.asInternalUser,
         logger: this.options.loggers.get('tokens'),
@@ -419,7 +430,9 @@ export class Authenticator {
       }
     }
 
-    return DeauthenticationResult.notHandled();
+    // If none of the configured providers could perform a logout, we should redirect user to the
+    // default logout location.
+    return DeauthenticationResult.redirectTo(this.getLoggedOutURL(request));
   }
 
   /**
@@ -452,6 +465,24 @@ export class Authenticator {
     this.options.featureUsageService.recordPreAccessAgreementUsage();
   }
 
+  getRequestOriginalURL(
+    request: KibanaRequest,
+    additionalQueryStringParameters?: Array<[string, string]>
+  ) {
+    const originalURLSearchParams = [
+      ...[...request.url.searchParams.entries()].filter(
+        ([key]) => !AUTH_METADATA_QUERY_STRING_PARAMETERS.includes(key)
+      ),
+      ...(additionalQueryStringParameters ?? []),
+    ];
+
+    return `${this.options.basePath.get(request)}${request.url.pathname}${
+      originalURLSearchParams.length > 0
+        ? `?${new URLSearchParams(originalURLSearchParams).toString()}`
+        : ''
+    }`;
+  }
+
   /**
    * Initializes HTTP Authentication provider and appends it to the end of the list of enabled
    * authentication providers.
@@ -762,9 +793,13 @@ export class Authenticator {
   /**
    * Creates a logged out URL for the specified request and provider.
    * @param request Request that initiated logout.
-   * @param providerType Type of the provider that handles logout.
+   * @param providerType Type of the provider that handles logout. If not specified, then the first
+   * provider in the chain (default) is assumed.
    */
-  private getLoggedOutURL(request: KibanaRequest, providerType: string) {
+  private getLoggedOutURL(
+    request: KibanaRequest,
+    providerType: string = this.options.config.authc.sortedProviders[0].type
+  ) {
     // The app that handles logout needs to know the reason of the logout and the URL we may need to
     // redirect user to once they log in again (e.g. when session expires).
     const searchParams = new URLSearchParams();
diff --git a/x-pack/plugins/security/server/authentication/can_redirect_request.test.ts b/x-pack/plugins/security/server/authentication/can_redirect_request.test.ts
index 1507cd2d3a50a..805d647757ca5 100644
--- a/x-pack/plugins/security/server/authentication/can_redirect_request.test.ts
+++ b/x-pack/plugins/security/server/authentication/can_redirect_request.test.ts
@@ -7,6 +7,7 @@
 
 import { httpServerMock } from 'src/core/server/mocks';
 
+import { ROUTE_TAG_API, ROUTE_TAG_CAN_REDIRECT } from '../routes/tags';
 import { canRedirectRequest } from './can_redirect_request';
 
 describe('can_redirect_request', () => {
@@ -24,4 +25,33 @@ describe('can_redirect_request', () => {
 
     expect(canRedirectRequest(request)).toBe(false);
   });
+
+  it('returns false for api routes', () => {
+    expect(
+      canRedirectRequest(httpServerMock.createKibanaRequest({ path: '/api/security/some' }))
+    ).toBe(false);
+  });
+
+  it('returns false for internal routes', () => {
+    expect(
+      canRedirectRequest(httpServerMock.createKibanaRequest({ path: '/internal/security/some' }))
+    ).toBe(false);
+  });
+
+  it('returns true for the routes with the `security:canRedirect` tag', () => {
+    for (const request of [
+      httpServerMock.createKibanaRequest({ routeTags: [ROUTE_TAG_CAN_REDIRECT] }),
+      httpServerMock.createKibanaRequest({ routeTags: [ROUTE_TAG_API, ROUTE_TAG_CAN_REDIRECT] }),
+      httpServerMock.createKibanaRequest({
+        path: '/api/security/some',
+        routeTags: [ROUTE_TAG_CAN_REDIRECT],
+      }),
+      httpServerMock.createKibanaRequest({
+        path: '/internal/security/some',
+        routeTags: [ROUTE_TAG_CAN_REDIRECT],
+      }),
+    ]) {
+      expect(canRedirectRequest(request)).toBe(true);
+    }
+  });
 });
diff --git a/x-pack/plugins/security/server/authentication/can_redirect_request.ts b/x-pack/plugins/security/server/authentication/can_redirect_request.ts
index 71c6365d9aea4..5a3a09f17eb86 100644
--- a/x-pack/plugins/security/server/authentication/can_redirect_request.ts
+++ b/x-pack/plugins/security/server/authentication/can_redirect_request.ts
@@ -7,7 +7,8 @@
 
 import type { KibanaRequest } from 'src/core/server';
 
-const ROUTE_TAG_API = 'api';
+import { ROUTE_TAG_API, ROUTE_TAG_CAN_REDIRECT } from '../routes/tags';
+
 const KIBANA_XSRF_HEADER = 'kbn-xsrf';
 const KIBANA_VERSION_HEADER = 'kbn-version';
 
@@ -24,9 +25,9 @@ export function canRedirectRequest(request: KibanaRequest) {
 
   const isApiRoute =
     route.options.tags.includes(ROUTE_TAG_API) ||
-    (route.path.startsWith('/api/') && route.path !== '/api/security/logout') ||
+    route.path.startsWith('/api/') ||
     route.path.startsWith('/internal/');
   const isAjaxRequest = hasVersionHeader || hasXsrfHeader;
 
-  return !isApiRoute && !isAjaxRequest;
+  return !isAjaxRequest && (!isApiRoute || route.options.tags.includes(ROUTE_TAG_CAN_REDIRECT));
 }
diff --git a/x-pack/plugins/security/server/authentication/providers/base.mock.ts b/x-pack/plugins/security/server/authentication/providers/base.mock.ts
index bb78b6e963763..5d3417ae9db11 100644
--- a/x-pack/plugins/security/server/authentication/providers/base.mock.ts
+++ b/x-pack/plugins/security/server/authentication/providers/base.mock.ts
@@ -20,6 +20,7 @@ export function mockAuthenticationProviderOptions(options?: { name: string }) {
     client: elasticsearchServiceMock.createClusterClient(),
     logger: loggingSystemMock.create().get(),
     basePath: httpServiceMock.createBasePath(),
+    getRequestOriginalURL: jest.fn(),
     tokens: { refresh: jest.fn(), invalidate: jest.fn() },
     name: options?.name ?? 'basic1',
     urls: {
diff --git a/x-pack/plugins/security/server/authentication/providers/base.ts b/x-pack/plugins/security/server/authentication/providers/base.ts
index 18d567a143fee..c7c0edcf1e9e1 100644
--- a/x-pack/plugins/security/server/authentication/providers/base.ts
+++ b/x-pack/plugins/security/server/authentication/providers/base.ts
@@ -27,6 +27,10 @@ import type { Tokens } from '../tokens';
 export interface AuthenticationProviderOptions {
   name: string;
   basePath: HttpServiceSetup['basePath'];
+  getRequestOriginalURL: (
+    request: KibanaRequest,
+    additionalQueryStringParameters?: Array<[string, string]>
+  ) => string;
   client: IClusterClient;
   logger: Logger;
   tokens: PublicMethodsOf<Tokens>;
diff --git a/x-pack/plugins/security/server/authentication/providers/oidc.test.ts b/x-pack/plugins/security/server/authentication/providers/oidc.test.ts
index ebeca42682eb9..444a7f3e50a25 100644
--- a/x-pack/plugins/security/server/authentication/providers/oidc.test.ts
+++ b/x-pack/plugins/security/server/authentication/providers/oidc.test.ts
@@ -11,6 +11,10 @@ import Boom from '@hapi/boom';
 import type { KibanaRequest } from 'src/core/server';
 import { elasticsearchServiceMock, httpServerMock } from 'src/core/server/mocks';
 
+import {
+  AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER,
+  AUTH_URL_HASH_QUERY_STRING_PARAMETER,
+} from '../../../common/constants';
 import { mockAuthenticatedUser } from '../../../common/model/authenticated_user.mock';
 import { securityMock } from '../../mocks';
 import { AuthenticationResult } from '../authentication_result';
@@ -376,18 +380,78 @@ describe('OIDCAuthenticationProvider', () => {
     });
 
     it('redirects non-AJAX request that can not be authenticated to the "capture URL" page.', async () => {
+      mockOptions.getRequestOriginalURL.mockReturnValue(
+        '/mock-server-basepath/s/foo/some-path?auth_provider_hint=oidc'
+      );
       const request = httpServerMock.createKibanaRequest({ path: '/s/foo/some-path' });
 
       await expect(provider.authenticate(request, null)).resolves.toEqual(
         AuthenticationResult.redirectTo(
-          '/mock-server-basepath/internal/security/capture-url?next=%2Fmock-server-basepath%2Fs%2Ffoo%2Fsome-path&providerType=oidc&providerName=oidc',
+          '/mock-server-basepath/internal/security/capture-url?next=%2Fmock-server-basepath%2Fs%2Ffoo%2Fsome-path%3Fauth_provider_hint%3Doidc',
           { state: null }
         )
       );
 
+      expect(mockOptions.getRequestOriginalURL).toHaveBeenCalledTimes(1);
+      expect(mockOptions.getRequestOriginalURL).toHaveBeenCalledWith(request, [
+        [AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER, 'oidc'],
+      ]);
+
       expect(mockOptions.client.asInternalUser.transport.request).not.toHaveBeenCalled();
     });
 
+    it('initiates OIDC handshake for non-AJAX request that can not be authenticated, but includes URL hash fragment.', async () => {
+      mockOptions.getRequestOriginalURL.mockReturnValue('/mock-server-basepath/s/foo/some-path');
+      mockOptions.client.asInternalUser.transport.request.mockResolvedValue(
+        securityMock.createApiResponse({
+          body: {
+            state: 'statevalue',
+            nonce: 'noncevalue',
+            redirect:
+              'https://op-host/path/login?response_type=code' +
+              '&scope=openid%20profile%20email' +
+              '&client_id=s6BhdRkqt3' +
+              '&state=statevalue' +
+              '&redirect_uri=https%3A%2F%2Ftest-hostname:1234%2Ftest-base-path%2Fapi%2Fsecurity%2Fv1%2F/oidc' +
+              '&login_hint=loginhint',
+          },
+        })
+      );
+
+      const request = httpServerMock.createKibanaRequest({
+        path: '/s/foo/some-path',
+        query: { [AUTH_URL_HASH_QUERY_STRING_PARAMETER]: '#some-fragment' },
+      });
+      await expect(provider.authenticate(request)).resolves.toEqual(
+        AuthenticationResult.redirectTo(
+          'https://op-host/path/login?response_type=code' +
+            '&scope=openid%20profile%20email' +
+            '&client_id=s6BhdRkqt3' +
+            '&state=statevalue' +
+            '&redirect_uri=https%3A%2F%2Ftest-hostname:1234%2Ftest-base-path%2Fapi%2Fsecurity%2Fv1%2F/oidc' +
+            '&login_hint=loginhint',
+          {
+            state: {
+              state: 'statevalue',
+              nonce: 'noncevalue',
+              redirectURL: '/mock-server-basepath/s/foo/some-path#some-fragment',
+              realm: 'oidc1',
+            },
+          }
+        )
+      );
+
+      expect(mockOptions.getRequestOriginalURL).toHaveBeenCalledTimes(1);
+      expect(mockOptions.getRequestOriginalURL).toHaveBeenCalledWith(request);
+
+      expect(mockOptions.client.asInternalUser.transport.request).toHaveBeenCalledTimes(1);
+      expect(mockOptions.client.asInternalUser.transport.request).toHaveBeenCalledWith({
+        method: 'POST',
+        path: '/_security/oidc/prepare',
+        body: { realm: 'oidc1' },
+      });
+    });
+
     it('succeeds if state contains a valid token.', async () => {
       const request = httpServerMock.createKibanaRequest({ headers: {} });
       const tokenPair = {
@@ -520,6 +584,9 @@ describe('OIDCAuthenticationProvider', () => {
     });
 
     it('redirects non-AJAX requests to the "capture URL" page if refresh token is expired or already refreshed.', async () => {
+      mockOptions.getRequestOriginalURL.mockReturnValue(
+        '/mock-server-basepath/s/foo/some-path?auth_provider_hint=oidc'
+      );
       const request = httpServerMock.createKibanaRequest({ path: '/s/foo/some-path', headers: {} });
       const tokenPair = { accessToken: 'expired-token', refreshToken: 'expired-refresh-token' };
       const authorization = `Bearer ${tokenPair.accessToken}`;
@@ -534,11 +601,16 @@ describe('OIDCAuthenticationProvider', () => {
         provider.authenticate(request, { ...tokenPair, realm: 'oidc1' })
       ).resolves.toEqual(
         AuthenticationResult.redirectTo(
-          '/mock-server-basepath/internal/security/capture-url?next=%2Fmock-server-basepath%2Fs%2Ffoo%2Fsome-path&providerType=oidc&providerName=oidc',
+          '/mock-server-basepath/internal/security/capture-url?next=%2Fmock-server-basepath%2Fs%2Ffoo%2Fsome-path%3Fauth_provider_hint%3Doidc',
           { state: null }
         )
       );
 
+      expect(mockOptions.getRequestOriginalURL).toHaveBeenCalledTimes(1);
+      expect(mockOptions.getRequestOriginalURL).toHaveBeenCalledWith(request, [
+        [AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER, 'oidc'],
+      ]);
+
       expect(mockOptions.tokens.refresh).toHaveBeenCalledTimes(1);
       expect(mockOptions.tokens.refresh).toHaveBeenCalledWith(tokenPair.refreshToken);
 
diff --git a/x-pack/plugins/security/server/authentication/providers/oidc.ts b/x-pack/plugins/security/server/authentication/providers/oidc.ts
index 2afa49fe6e082..83f0ec50abb0d 100644
--- a/x-pack/plugins/security/server/authentication/providers/oidc.ts
+++ b/x-pack/plugins/security/server/authentication/providers/oidc.ts
@@ -10,8 +10,13 @@ import type from 'type-detect';
 
 import type { KibanaRequest } from 'src/core/server';
 
-import { NEXT_URL_QUERY_STRING_PARAMETER } from '../../../common/constants';
+import {
+  AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER,
+  AUTH_URL_HASH_QUERY_STRING_PARAMETER,
+  NEXT_URL_QUERY_STRING_PARAMETER,
+} from '../../../common/constants';
 import type { AuthenticationInfo } from '../../elasticsearch';
+import { getDetailedErrorMessage } from '../../errors';
 import { AuthenticationResult } from '../authentication_result';
 import { canRedirectRequest } from '../can_redirect_request';
 import { DeauthenticationResult } from '../deauthentication_result';
@@ -201,7 +206,7 @@ export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
     // We might already have a state and nonce generated by Elasticsearch (from an unfinished authentication in
     // another tab)
     return authenticationResult.notHandled() && canStartNewSession(request)
-      ? await this.captureRedirectURL(request)
+      ? await this.initiateAuthenticationHandshake(request)
       : authenticationResult;
   }
 
@@ -264,7 +269,9 @@ export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
         })
       ).body as any;
     } catch (err) {
-      this.logger.debug(`Failed to authenticate request via OpenID Connect: ${err.message}`);
+      this.logger.debug(
+        `Failed to authenticate request via OpenID Connect: ${getDetailedErrorMessage(err)}`
+      );
       return AuthenticationResult.failed(err);
     }
 
@@ -313,7 +320,9 @@ export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
         { state: { state, nonce, redirectURL, realm: this.realm } }
       );
     } catch (err) {
-      this.logger.debug(`Failed to initiate OpenID Connect authentication: ${err.message}`);
+      this.logger.debug(
+        `Failed to initiate OpenID Connect authentication: ${getDetailedErrorMessage(err)}`
+      );
       return AuthenticationResult.failed(err);
     }
   }
@@ -341,7 +350,9 @@ export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
       this.logger.debug('Request has been authenticated via state.');
       return AuthenticationResult.succeeded(user, { authHeaders });
     } catch (err) {
-      this.logger.debug(`Failed to authenticate request via state: ${err.message}`);
+      this.logger.debug(
+        `Failed to authenticate request via state: ${getDetailedErrorMessage(err)}`
+      );
       return AuthenticationResult.failed(err);
     }
   }
@@ -379,7 +390,7 @@ export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
         this.logger.debug(
           'Both elasticsearch access and refresh tokens are expired. Re-initiating OpenID Connect authentication.'
         );
-        return this.captureRedirectURL(request);
+        return this.initiateAuthenticationHandshake(request);
       }
 
       return AuthenticationResult.failed(
@@ -440,7 +451,7 @@ export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
           return DeauthenticationResult.redirectTo(redirect);
         }
       } catch (err) {
-        this.logger.debug(`Failed to deauthenticate user: ${err.message}`);
+        this.logger.debug(`Failed to deauthenticate user: ${getDetailedErrorMessage(err)}`);
         return DeauthenticationResult.failed(err);
       }
     }
@@ -457,22 +468,29 @@ export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
   }
 
   /**
-   * Tries to capture full redirect URL (both path and fragment) and initiate OIDC handshake.
+   * Tries to initiate OIDC authentication handshake. If the request already includes user URL hash fragment, we will
+   * initiate handshake right away, otherwise we'll redirect user to a dedicated page where we capture URL hash fragment
+   * first and only then initiate SAML handshake.
    * @param request Request instance.
    */
-  private captureRedirectURL(request: KibanaRequest) {
-    const searchParams = new URLSearchParams([
-      [
-        NEXT_URL_QUERY_STRING_PARAMETER,
-        `${this.options.basePath.get(request)}${request.url.pathname}${request.url.search}`,
-      ],
-      ['providerType', this.type],
-      ['providerName', this.options.name],
-    ]);
+  private initiateAuthenticationHandshake(request: KibanaRequest) {
+    const originalURLHash = request.url.searchParams.get(AUTH_URL_HASH_QUERY_STRING_PARAMETER);
+    if (originalURLHash != null) {
+      return this.initiateOIDCAuthentication(
+        request,
+        { realm: this.realm },
+        `${this.options.getRequestOriginalURL(request)}${originalURLHash}`
+      );
+    }
+
     return AuthenticationResult.redirectTo(
       `${
         this.options.basePath.serverBasePath
-      }/internal/security/capture-url?${searchParams.toString()}`,
+      }/internal/security/capture-url?${NEXT_URL_QUERY_STRING_PARAMETER}=${encodeURIComponent(
+        this.options.getRequestOriginalURL(request, [
+          [AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER, this.options.name],
+        ])
+      )}`,
       // Here we indicate that current session, if any, should be invalidated. It is a no-op for the
       // initial handshake, but is essential when both access and refresh tokens are expired.
       { state: null }
diff --git a/x-pack/plugins/security/server/authentication/providers/saml.test.ts b/x-pack/plugins/security/server/authentication/providers/saml.test.ts
index bd51a0f815329..dfcdb66e61c35 100644
--- a/x-pack/plugins/security/server/authentication/providers/saml.test.ts
+++ b/x-pack/plugins/security/server/authentication/providers/saml.test.ts
@@ -10,6 +10,10 @@ import Boom from '@hapi/boom';
 
 import { elasticsearchServiceMock, httpServerMock } from 'src/core/server/mocks';
 
+import {
+  AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER,
+  AUTH_URL_HASH_QUERY_STRING_PARAMETER,
+} from '../../../common/constants';
 import { mockAuthenticatedUser } from '../../../common/model/authenticated_user.mock';
 import { securityMock } from '../../mocks';
 import { AuthenticationResult } from '../authentication_result';
@@ -848,18 +852,63 @@ describe('SAMLAuthenticationProvider', () => {
     });
 
     it('redirects non-AJAX request that can not be authenticated to the "capture URL" page.', async () => {
+      mockOptions.getRequestOriginalURL.mockReturnValue(
+        '/mock-server-basepath/s/foo/some-path?auth_provider_hint=saml'
+      );
       const request = httpServerMock.createKibanaRequest({ path: '/s/foo/some-path' });
-
       await expect(provider.authenticate(request)).resolves.toEqual(
         AuthenticationResult.redirectTo(
-          '/mock-server-basepath/internal/security/capture-url?next=%2Fmock-server-basepath%2Fs%2Ffoo%2Fsome-path&providerType=saml&providerName=saml',
+          '/mock-server-basepath/internal/security/capture-url?next=%2Fmock-server-basepath%2Fs%2Ffoo%2Fsome-path%3Fauth_provider_hint%3Dsaml',
           { state: null }
         )
       );
 
+      expect(mockOptions.getRequestOriginalURL).toHaveBeenCalledTimes(1);
+      expect(mockOptions.getRequestOriginalURL).toHaveBeenCalledWith(request, [
+        [AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER, 'saml'],
+      ]);
+
       expect(mockOptions.client.asInternalUser.transport.request).not.toHaveBeenCalled();
     });
 
+    it('initiates SAML handshake for non-AJAX request that can not be authenticated, but includes URL hash fragment.', async () => {
+      mockOptions.getRequestOriginalURL.mockReturnValue('/mock-server-basepath/s/foo/some-path');
+      mockOptions.client.asInternalUser.transport.request.mockResolvedValue(
+        securityMock.createApiResponse({
+          body: {
+            id: 'some-request-id',
+            redirect: 'https://idp-host/path/login?SAMLRequest=some%20request%20',
+          },
+        })
+      );
+
+      const request = httpServerMock.createKibanaRequest({
+        path: '/s/foo/some-path',
+        query: { [AUTH_URL_HASH_QUERY_STRING_PARAMETER]: '#some-fragment' },
+      });
+      await expect(provider.authenticate(request)).resolves.toEqual(
+        AuthenticationResult.redirectTo(
+          'https://idp-host/path/login?SAMLRequest=some%20request%20',
+          {
+            state: {
+              requestId: 'some-request-id',
+              redirectURL: '/mock-server-basepath/s/foo/some-path#some-fragment',
+              realm: 'test-realm',
+            },
+          }
+        )
+      );
+
+      expect(mockOptions.getRequestOriginalURL).toHaveBeenCalledTimes(1);
+      expect(mockOptions.getRequestOriginalURL).toHaveBeenCalledWith(request);
+
+      expect(mockOptions.client.asInternalUser.transport.request).toHaveBeenCalledWith({
+        method: 'POST',
+        path: '/_security/saml/prepare',
+        body: { realm: 'test-realm' },
+      });
+    });
+
     it('succeeds if state contains a valid token.', async () => {
       const request = httpServerMock.createKibanaRequest({ headers: {} });
       const state = {
@@ -1024,6 +1073,9 @@ describe('SAMLAuthenticationProvider', () => {
     });
 
     it('re-capture URL for non-AJAX requests if refresh token is expired.', async () => {
+      mockOptions.getRequestOriginalURL.mockReturnValue(
+        '/mock-server-basepath/s/foo/some-path?auth_provider_hint=saml'
+      );
       const request = httpServerMock.createKibanaRequest({ path: '/s/foo/some-path', headers: {} });
       const state = {
         accessToken: 'expired-token',
@@ -1040,11 +1092,16 @@ describe('SAMLAuthenticationProvider', () => {
 
       await expect(provider.authenticate(request, state)).resolves.toEqual(
         AuthenticationResult.redirectTo(
-          '/mock-server-basepath/internal/security/capture-url?next=%2Fmock-server-basepath%2Fs%2Ffoo%2Fsome-path&providerType=saml&providerName=saml',
+          '/mock-server-basepath/internal/security/capture-url?next=%2Fmock-server-basepath%2Fs%2Ffoo%2Fsome-path%3Fauth_provider_hint%3Dsaml',
           { state: null }
         )
       );
 
+      expect(mockOptions.getRequestOriginalURL).toHaveBeenCalledTimes(1);
+      expect(mockOptions.getRequestOriginalURL).toHaveBeenCalledWith(request, [
+        [AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER, 'saml'],
+      ]);
+
       expect(mockOptions.tokens.refresh).toHaveBeenCalledTimes(1);
       expect(mockOptions.tokens.refresh).toHaveBeenCalledWith(state.refreshToken);
 
diff --git a/x-pack/plugins/security/server/authentication/providers/saml.ts b/x-pack/plugins/security/server/authentication/providers/saml.ts
index 7c27e2ebeff10..ea818e5df6e12 100644
--- a/x-pack/plugins/security/server/authentication/providers/saml.ts
+++ b/x-pack/plugins/security/server/authentication/providers/saml.ts
@@ -9,9 +9,14 @@ import Boom from '@hapi/boom';
 
 import type { KibanaRequest } from 'src/core/server';
 
-import { NEXT_URL_QUERY_STRING_PARAMETER } from '../../../common/constants';
+import {
+  AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER,
+  AUTH_URL_HASH_QUERY_STRING_PARAMETER,
+  NEXT_URL_QUERY_STRING_PARAMETER,
+} from '../../../common/constants';
 import { isInternalURL } from '../../../common/is_internal_url';
 import type { AuthenticationInfo } from '../../elasticsearch';
+import { getDetailedErrorMessage } from '../../errors';
 import { AuthenticationResult } from '../authentication_result';
 import { canRedirectRequest } from '../can_redirect_request';
 import { DeauthenticationResult } from '../deauthentication_result';
@@ -185,7 +190,7 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
     } else {
       this.logger.debug(
         `Failed to perform a login: ${
-          authenticationResult.error && authenticationResult.error.message
+          authenticationResult.error && getDetailedErrorMessage(authenticationResult.error)
         }`
       );
     }
@@ -230,7 +235,7 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
     // If we couldn't authenticate by means of all methods above, let's try to capture user URL and
     // initiate SAML handshake, otherwise just return authentication result we have.
     return authenticationResult.notHandled() && canStartNewSession(request)
-      ? this.captureRedirectURL(request)
+      ? this.initiateAuthenticationHandshake(request)
       : authenticationResult;
   }
 
@@ -283,7 +288,7 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
           return DeauthenticationResult.redirectTo(redirect);
         }
       } catch (err) {
-        this.logger.debug(`Failed to deauthenticate user: ${err.message}`);
+        this.logger.debug(`Failed to deauthenticate user: ${getDetailedErrorMessage(err)}`);
         return DeauthenticationResult.failed(err);
       }
     }
@@ -362,7 +367,7 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
         })
       ).body as any;
     } catch (err) {
-      this.logger.debug(`Failed to log in with SAML response: ${err.message}`);
+      this.logger.debug(`Failed to log in with SAML response: ${getDetailedErrorMessage(err)}`);
 
       // Since we don't know upfront what realm is targeted by the Identity Provider initiated login
       // there is a chance that it failed because of realm mismatch and hence we should return
@@ -452,7 +457,9 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
         refreshToken: existingState.refreshToken!,
       });
     } catch (err) {
-      this.logger.debug(`Failed to perform IdP initiated local logout: ${err.message}`);
+      this.logger.debug(
+        `Failed to perform IdP initiated local logout: ${getDetailedErrorMessage(err)}`
+      );
       return AuthenticationResult.failed(err);
     }
 
@@ -483,7 +490,9 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
       this.logger.debug('Request has been authenticated via state.');
       return AuthenticationResult.succeeded(user, { authHeaders });
     } catch (err) {
-      this.logger.debug(`Failed to authenticate request via state: ${err.message}`);
+      this.logger.debug(
+        `Failed to authenticate request via state: ${getDetailedErrorMessage(err)}`
+      );
       return AuthenticationResult.failed(err);
     }
   }
@@ -520,7 +529,7 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
         this.logger.debug(
           'Both access and refresh tokens are expired. Capturing redirect URL and re-initiating SAML handshake.'
         );
-        return this.captureRedirectURL(request);
+        return this.initiateAuthenticationHandshake(request);
       }
 
       return AuthenticationResult.failed(
@@ -569,7 +578,7 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
         state: { requestId, redirectURL, realm: this.realm },
       });
     } catch (err) {
-      this.logger.debug(`Failed to initiate SAML handshake: ${err.message}`);
+      this.logger.debug(`Failed to initiate SAML handshake: ${getDetailedErrorMessage(err)}`);
       return AuthenticationResult.failed(err);
     }
   }
@@ -629,22 +638,28 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
   }
 
   /**
-   * Tries to capture full redirect URL (both path and fragment) and initiate SAML handshake.
+   * Tries to initiate SAML authentication handshake. If the request already includes user URL hash fragment, we will
+   * initiate handshake right away, otherwise we'll redirect user to a dedicated page where we capture URL hash fragment
+   * first and only then initiate SAML handshake.
    * @param request Request instance.
    */
-  private captureRedirectURL(request: KibanaRequest) {
-    const searchParams = new URLSearchParams([
-      [
-        NEXT_URL_QUERY_STRING_PARAMETER,
-        `${this.options.basePath.get(request)}${request.url.pathname}${request.url.search}`,
-      ],
-      ['providerType', this.type],
-      ['providerName', this.options.name],
-    ]);
+  private initiateAuthenticationHandshake(request: KibanaRequest) {
+    const originalURLHash = request.url.searchParams.get(AUTH_URL_HASH_QUERY_STRING_PARAMETER);
+    if (originalURLHash != null) {
+      return this.authenticateViaHandshake(
+        request,
+        `${this.options.getRequestOriginalURL(request)}${originalURLHash}`
+      );
+    }
+
     return AuthenticationResult.redirectTo(
       `${
         this.options.basePath.serverBasePath
-      }/internal/security/capture-url?${searchParams.toString()}`,
+      }/internal/security/capture-url?${NEXT_URL_QUERY_STRING_PARAMETER}=${encodeURIComponent(
+        this.options.getRequestOriginalURL(request, [
+          [AUTH_PROVIDER_HINT_QUERY_STRING_PARAMETER, this.options.name],
+        ])
+      )}`,
       // Here we indicate that current session, if any, should be invalidated. It is a no-op for the
       // initial handshake, but is essential when both access and refresh tokens are expired.
       { state: null }
diff --git a/x-pack/plugins/security/server/authentication/tokens.ts b/x-pack/plugins/security/server/authentication/tokens.ts
index 8f6dd9275e59c..1adbb2dc66533 100644
--- a/x-pack/plugins/security/server/authentication/tokens.ts
+++ b/x-pack/plugins/security/server/authentication/tokens.ts
@@ -8,7 +8,7 @@
 import type { ElasticsearchClient, Logger } from 'src/core/server';
 
 import type { AuthenticationInfo } from '../elasticsearch';
-import { getErrorStatusCode } from '../errors';
+import { getDetailedErrorMessage, getErrorStatusCode } from '../errors';
 
 /**
  * Represents a pair of access and refresh tokens.
@@ -73,11 +73,11 @@ export class Tokens {
       return {
         accessToken,
         refreshToken,
-        // @ts-expect-error @elastic/elasticsearch decalred GetUserAccessTokenResponse.authentication: string
+        // @ts-expect-error @elastic/elasticsearch declared GetUserAccessTokenResponse.authentication: string
         authenticationInfo: authenticationInfo as AuthenticationInfo,
       };
     } catch (err) {
-      this.logger.debug(`Failed to refresh access token: ${err.message}`);
+      this.logger.debug(`Failed to refresh access token: ${getDetailedErrorMessage(err)}`);
 
       // There are at least two common cases when refresh token request can fail:
       // 1. Refresh token is valid only for 24 hours and if it hasn't been used it expires.
@@ -123,7 +123,7 @@ export class Tokens {
           })
         ).body.invalidated_tokens;
       } catch (err) {
-        this.logger.debug(`Failed to invalidate refresh token: ${err.message}`);
+        this.logger.debug(`Failed to invalidate refresh token: ${getDetailedErrorMessage(err)}`);
 
         // When using already deleted refresh token, Elasticsearch responds with 404 and a body that
         // shows that no tokens were invalidated.
@@ -155,7 +155,7 @@ export class Tokens {
           })
         ).body.invalidated_tokens;
       } catch (err) {
-        this.logger.debug(`Failed to invalidate access token: ${err.message}`);
+        this.logger.debug(`Failed to invalidate access token: ${getDetailedErrorMessage(err)}`);
 
         // When using already deleted access token, Elasticsearch responds with 404 and a body that
         // shows that no tokens were invalidated.
diff --git a/x-pack/plugins/security/server/authentication/unauthenticated_page.test.tsx b/x-pack/plugins/security/server/authentication/unauthenticated_page.test.tsx
new file mode 100644
index 0000000000000..5cb6c899d7560
--- /dev/null
+++ b/x-pack/plugins/security/server/authentication/unauthenticated_page.test.tsx
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+
+import { coreMock } from '../../../../../src/core/server/mocks';
+import { UnauthenticatedPage } from './unauthenticated_page';
+
+jest.mock('src/core/server/rendering/views/fonts', () => ({
+  Fonts: () => <>MockedFonts</>,
+}));
+
+describe('UnauthenticatedPage', () => {
+  it('renders as expected', async () => {
+    const mockCoreSetup = coreMock.createSetup();
+    (mockCoreSetup.http.basePath.prepend as jest.Mock).mockImplementation(
+      (path) => `/mock-basepath${path}`
+    );
+
+    const body = renderToStaticMarkup(
+      <UnauthenticatedPage
+        originalURL="/some/url?some-query=some-value#some-hash"
+        buildNumber={100500}
+        basePath={mockCoreSetup.http.basePath}
+      />
+    );
+
+    expect(body).toMatchSnapshot();
+  });
+});
diff --git a/x-pack/plugins/security/server/authentication/unauthenticated_page.tsx b/x-pack/plugins/security/server/authentication/unauthenticated_page.tsx
new file mode 100644
index 0000000000000..48d61a72e085d
--- /dev/null
+++ b/x-pack/plugins/security/server/authentication/unauthenticated_page.tsx
@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+// @ts-expect-error no definitions in component folder
+import { EuiButton } from '@elastic/eui/lib/components/button';
+import React from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import type { IBasePath } from 'src/core/server';
+
+import { PromptPage } from '../prompt_page';
+
+interface Props {
+  originalURL: string;
+  buildNumber: number;
+  basePath: IBasePath;
+}
+
+export function UnauthenticatedPage({ basePath, originalURL, buildNumber }: Props) {
+  return (
+    <PromptPage
+      buildNumber={buildNumber}
+      basePath={basePath}
+      title={i18n.translate('xpack.security.unauthenticated.pageTitle', {
+        defaultMessage: "We couldn't log you in",
+      })}
+      body={
+        <p>
+          <FormattedMessage
+            id="xpack.security.unauthenticated.errorDescription"
+            defaultMessage="We hit an authentication error. Please check your credentials and try again. If you still can't log in, contact your system administrator."
+          />
+        </p>
+      }
+      actions={[
+        <EuiButton color="primary" fill href={originalURL} data-test-subj="logInButton">
+          <FormattedMessage
+            id="xpack.security.unauthenticated.loginButtonLabel"
+            defaultMessage="Log in"
+          />
+        </EuiButton>,
+      ]}
+    />
+  );
+}
+
+export function renderUnauthenticatedPage(props: Props) {
+  return renderToStaticMarkup(<UnauthenticatedPage {...props} />);
+}
diff --git a/x-pack/plugins/security/server/authorization/__snapshots__/reset_session_page.test.tsx.snap b/x-pack/plugins/security/server/authorization/__snapshots__/reset_session_page.test.tsx.snap
index 785c57490e8ef..1011d82eb1f73 100644
--- a/x-pack/plugins/security/server/authorization/__snapshots__/reset_session_page.test.tsx.snap
+++ b/x-pack/plugins/security/server/authorization/__snapshots__/reset_session_page.test.tsx.snap
@@ -1,3 +1,3 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`ResetSessionPage renders as expected 1`] = `"<html lang=\\"en\\"><head><link href=\\"/some-css-file.css\\" rel=\\"stylesheet\\"/><link href=\\"/some-other-css-file.css\\" rel=\\"stylesheet\\"/>MockedFonts<link rel=\\"alternate icon\\" type=\\"image/png\\" href=\\"/path/to/base/ui/favicons/favicon.png\\"/><link rel=\\"icon\\" type=\\"image/svg+xml\\" href=\\"/path/to/base/ui/favicons/favicon.svg\\"/><meta name=\\"theme-color\\" content=\\"#ffffff\\"/><meta name=\\"color-scheme\\" content=\\"light dark\\"/></head><body><div class=\\"euiPage euiPage--grow\\" style=\\"min-height:100vh\\"><main class=\\"euiPageBody euiPageBody--borderRadiusNone\\"><div class=\\"euiPanel euiPanel--paddingLarge euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPageContent euiPageContent--verticalCenter euiPageContent--horizontalCenter\\" role=\\"main\\"><div class=\\"euiEmptyPrompt\\"><span data-euiicon-type=\\"alert\\" color=\\"danger\\"></span><div class=\\"euiSpacer euiSpacer--s\\"></div><span class=\\"euiTextColor euiTextColor--subdued\\"><h2 class=\\"euiTitle euiTitle--medium\\">You do not have permission to access the requested page</h2><div class=\\"euiSpacer euiSpacer--m\\"></div><div class=\\"euiText euiText--medium\\"><p>Either go back to the previous page or log in as a different user.</p></div></span><div class=\\"euiSpacer euiSpacer--l\\"></div><div class=\\"euiSpacer euiSpacer--s\\"></div><div class=\\"euiFlexGroup euiFlexGroup--gutterMedium euiFlexGroup--alignItemsCenter euiFlexGroup--justifyContentCenter euiFlexGroup--directionColumn euiFlexGroup--responsive\\"><div class=\\"euiFlexItem euiFlexItem--flexGrowZero\\"><a class=\\"euiButton euiButton--primary euiButton--fill\\" href=\\"/path/to/logout\\" rel=\\"noreferrer\\" data-test-subj=\\"ResetSessionButton\\"><span class=\\"euiButtonContent euiButton__content\\"><span class=\\"euiButton__text\\">Log in as different user</span></span></a></div><div class=\\"euiFlexItem euiFlexItem--flexGrowZero\\"><button class=\\"euiButtonEmpty euiButtonEmpty--primary\\" type=\\"button\\" id=\\"goBackButton\\"><span class=\\"euiButtonContent euiButtonEmpty__content\\"><span class=\\"euiButtonEmpty__text\\">Go back</span></span></button></div></div></div></div></main></div></body></html>"`;
+exports[`ResetSessionPage renders as expected 1`] = `"<html lang=\\"en\\"><head><title>Elastic</title><link href=\\"/mock-server-basepath/100500/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.css\\" rel=\\"stylesheet\\"/><link href=\\"/mock-server-basepath/100500/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.v7.light.css\\" rel=\\"stylesheet\\"/><link href=\\"/mock-server-basepath/node_modules/@kbn/ui-framework/dist/kui_light.css\\" rel=\\"stylesheet\\"/><link href=\\"/mock-server-basepath/ui/legacy_light_theme.css\\" rel=\\"stylesheet\\"/>MockedFonts<link rel=\\"alternate icon\\" type=\\"image/png\\" href=\\"/mock-server-basepath/ui/favicons/favicon.png\\"/><link rel=\\"icon\\" type=\\"image/svg+xml\\" href=\\"/mock-server-basepath/ui/favicons/favicon.svg\\"/><script src=\\"/mock-basepath/internal/security/reset_session_page.js\\"></script><meta name=\\"theme-color\\" content=\\"#ffffff\\"/><meta name=\\"color-scheme\\" content=\\"light dark\\"/></head><body><div class=\\"euiPage euiPage--grow\\" style=\\"min-height:100vh\\" data-test-subj=\\"promptPage\\"><main class=\\"euiPageBody euiPageBody--borderRadiusNone\\"><div class=\\"euiPanel euiPanel--paddingLarge euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPageContent euiPageContent--verticalCenter euiPageContent--horizontalCenter\\" role=\\"main\\"><div class=\\"euiEmptyPrompt\\"><span data-euiicon-type=\\"alert\\" color=\\"danger\\"></span><div class=\\"euiSpacer euiSpacer--s\\"></div><span class=\\"euiTextColor euiTextColor--subdued\\"><h2 class=\\"euiTitle euiTitle--medium\\">You do not have permission to access the requested page</h2><div class=\\"euiSpacer euiSpacer--m\\"></div><div class=\\"euiText euiText--medium\\"><p>Either go back to the previous page or log in as a different user.</p></div></span><div class=\\"euiSpacer euiSpacer--l\\"></div><div class=\\"euiSpacer euiSpacer--s\\"></div><div class=\\"euiFlexGroup euiFlexGroup--gutterMedium euiFlexGroup--alignItemsCenter euiFlexGroup--justifyContentCenter euiFlexGroup--directionColumn euiFlexGroup--responsive\\"><div class=\\"euiFlexItem euiFlexItem--flexGrowZero\\"><a class=\\"euiButton euiButton--primary euiButton--fill\\" href=\\"/path/to/logout\\" rel=\\"noreferrer\\" data-test-subj=\\"ResetSessionButton\\"><span class=\\"euiButtonContent euiButton__content\\"><span class=\\"euiButton__text\\">Log in as different user</span></span></a></div><div class=\\"euiFlexItem euiFlexItem--flexGrowZero\\"><button class=\\"euiButtonEmpty euiButtonEmpty--primary\\" type=\\"button\\" id=\\"goBackButton\\"><span class=\\"euiButtonContent euiButtonEmpty__content\\"><span class=\\"euiButtonEmpty__text\\">Go back</span></span></button></div></div></div></div></main></div></body></html>"`;
diff --git a/x-pack/plugins/security/server/authorization/authorization_service.tsx b/x-pack/plugins/security/server/authorization/authorization_service.tsx
index db3c84477ffb1..144a8bc5fd0c4 100644
--- a/x-pack/plugins/security/server/authorization/authorization_service.tsx
+++ b/x-pack/plugins/security/server/authorization/authorization_service.tsx
@@ -10,7 +10,6 @@ import React from 'react';
 import { renderToStaticMarkup } from 'react-dom/server';
 import type { Observable, Subscription } from 'rxjs';
 
-import * as UiSharedDeps from '@kbn/ui-shared-deps';
 import type {
   CapabilitiesSetup,
   HttpServiceSetup,
@@ -163,25 +162,14 @@ export class AuthorizationService {
 
     http.registerOnPreResponse((request, preResponse, toolkit) => {
       if (preResponse.statusCode === 403 && canRedirectRequest(request)) {
-        const basePath = http.basePath.get(request);
-        const next = `${basePath}${request.url.pathname}${request.url.search}`;
-        const regularBundlePath = `${basePath}/${buildNumber}/bundles`;
-
-        const logoutUrl = http.basePath.prepend(
-          `/api/security/logout?${querystring.stringify({ next })}`
-        );
-        const styleSheetPaths = [
-          `${regularBundlePath}/kbn-ui-shared-deps/${UiSharedDeps.baseCssDistFilename}`,
-          `${regularBundlePath}/kbn-ui-shared-deps/${UiSharedDeps.lightCssDistFilename}`,
-          `${basePath}/node_modules/@kbn/ui-framework/dist/kui_light.css`,
-          `${basePath}/ui/legacy_light_theme.css`,
-        ];
-
+        const next = `${http.basePath.get(request)}${request.url.pathname}${request.url.search}`;
         const body = renderToStaticMarkup(
           <ResetSessionPage
-            logoutUrl={logoutUrl}
-            styleSheetPaths={styleSheetPaths}
-            basePath={basePath}
+            buildNumber={buildNumber}
+            basePath={http.basePath}
+            logoutUrl={http.basePath.prepend(
+              `/api/security/logout?${querystring.stringify({ next })}`
+            )}
           />
         );
 
diff --git a/x-pack/plugins/security/server/authorization/reset_session_page.test.tsx b/x-pack/plugins/security/server/authorization/reset_session_page.test.tsx
index e76c8ff138fcb..d5e27c9d39ffd 100644
--- a/x-pack/plugins/security/server/authorization/reset_session_page.test.tsx
+++ b/x-pack/plugins/security/server/authorization/reset_session_page.test.tsx
@@ -8,6 +8,7 @@
 import React from 'react';
 import { renderToStaticMarkup } from 'react-dom/server';
 
+import { coreMock } from '../../../../../src/core/server/mocks';
 import { ResetSessionPage } from './reset_session_page';
 
 jest.mock('src/core/server/rendering/views/fonts', () => ({
@@ -16,11 +17,16 @@ jest.mock('src/core/server/rendering/views/fonts', () => ({
 
 describe('ResetSessionPage', () => {
   it('renders as expected', async () => {
+    const mockCoreSetup = coreMock.createSetup();
+    (mockCoreSetup.http.basePath.prepend as jest.Mock).mockImplementation(
+      (path) => `/mock-basepath${path}`
+    );
+
     const body = renderToStaticMarkup(
       <ResetSessionPage
         logoutUrl="/path/to/logout"
-        styleSheetPaths={['/some-css-file.css', '/some-other-css-file.css']}
-        basePath="/path/to/base"
+        buildNumber={100500}
+        basePath={mockCoreSetup.http.basePath}
       />
     );
 
diff --git a/x-pack/plugins/security/server/authorization/reset_session_page.tsx b/x-pack/plugins/security/server/authorization/reset_session_page.tsx
index c2d43cd3dd030..4e2e6f4631287 100644
--- a/x-pack/plugins/security/server/authorization/reset_session_page.tsx
+++ b/x-pack/plugins/security/server/authorization/reset_session_page.tsx
@@ -7,101 +7,53 @@
 
 // @ts-expect-error no definitions in component folder
 import { EuiButton, EuiButtonEmpty } from '@elastic/eui/lib/components/button';
-// @ts-expect-error no definitions in component folder
-import { EuiEmptyPrompt } from '@elastic/eui/lib/components/empty_prompt';
-// @ts-expect-error no definitions in component folder
-import { icon as EuiIconAlert } from '@elastic/eui/lib/components/icon/assets/alert';
-// @ts-expect-error no definitions in component folder
-import { appendIconComponentCache } from '@elastic/eui/lib/components/icon/icon';
-// @ts-expect-error no definitions in component folder
-import { EuiPage, EuiPageBody, EuiPageContent } from '@elastic/eui/lib/components/page';
 import React from 'react';
 
 import { i18n } from '@kbn/i18n';
-import { FormattedMessage, I18nProvider } from '@kbn/i18n/react';
-
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { Fonts } from '../../../../../src/core/server/rendering/views/fonts';
+import { FormattedMessage } from '@kbn/i18n/react';
+import type { IBasePath } from 'src/core/server';
 
-// Preload the alert icon used by `EuiEmptyPrompt` to ensure that it's loaded
-// in advance the first time this page is rendered server-side. If not, the
-// icon svg wouldn't contain any paths the first time the page was rendered.
-appendIconComponentCache({
-  alert: EuiIconAlert,
-});
+import { PromptPage } from '../prompt_page';
 
 export function ResetSessionPage({
   logoutUrl,
-  styleSheetPaths,
+  buildNumber,
   basePath,
 }: {
   logoutUrl: string;
-  styleSheetPaths: string[];
-  basePath: string;
+  buildNumber: number;
+  basePath: IBasePath;
 }) {
-  const uiPublicUrl = `${basePath}/ui`;
   return (
-    <html lang={i18n.getLocale()}>
-      <head>
-        {styleSheetPaths.map((path) => (
-          <link href={path} rel="stylesheet" key={path} />
-        ))}
-        <Fonts url={uiPublicUrl} />
-        {/* The alternate icon is a fallback for Safari which does not yet support SVG favicons */}
-        <link rel="alternate icon" type="image/png" href={`${uiPublicUrl}/favicons/favicon.png`} />
-        <link rel="icon" type="image/svg+xml" href={`${uiPublicUrl}/favicons/favicon.svg`} />
-        <meta name="theme-color" content="#ffffff" />
-        <meta name="color-scheme" content="light dark" />
-      </head>
-      <body>
-        <I18nProvider>
-          <EuiPage paddingSize="none" style={{ minHeight: '100vh' }}>
-            <EuiPageBody>
-              <EuiPageContent verticalPosition="center" horizontalPosition="center">
-                <EuiEmptyPrompt
-                  iconType="alert"
-                  iconColor="danger"
-                  title={
-                    <h2>
-                      <FormattedMessage
-                        id="xpack.security.resetSession.title"
-                        defaultMessage="You do not have permission to access the requested page"
-                      />
-                    </h2>
-                  }
-                  body={
-                    <p>
-                      <FormattedMessage
-                        id="xpack.security.resetSession.description"
-                        defaultMessage="Either go back to the previous page or log in as a different user."
-                      />
-                    </p>
-                  }
-                  actions={[
-                    <EuiButton
-                      color="primary"
-                      fill
-                      href={logoutUrl}
-                      data-test-subj="ResetSessionButton"
-                    >
-                      <FormattedMessage
-                        id="xpack.security.resetSession.logOutButtonLabel"
-                        defaultMessage="Log in as different user"
-                      />
-                    </EuiButton>,
-                    <EuiButtonEmpty id="goBackButton">
-                      <FormattedMessage
-                        id="xpack.security.resetSession.goBackButtonLabel"
-                        defaultMessage="Go back"
-                      />
-                    </EuiButtonEmpty>,
-                  ]}
-                />
-              </EuiPageContent>
-            </EuiPageBody>
-          </EuiPage>
-        </I18nProvider>
-      </body>
-    </html>
+    <PromptPage
+      buildNumber={buildNumber}
+      basePath={basePath}
+      scriptPaths={['/internal/security/reset_session_page.js']}
+      title={i18n.translate('xpack.security.resetSession.title', {
+        defaultMessage: 'You do not have permission to access the requested page',
+      })}
+      body={
+        <p>
+          <FormattedMessage
+            id="xpack.security.resetSession.description"
+            defaultMessage="Either go back to the previous page or log in as a different user."
+          />
+        </p>
+      }
+      actions={[
+        <EuiButton color="primary" fill href={logoutUrl} data-test-subj="ResetSessionButton">
+          <FormattedMessage
+            id="xpack.security.resetSession.logOutButtonLabel"
+            defaultMessage="Log in as different user"
+          />
+        </EuiButton>,
+        <EuiButtonEmpty id="goBackButton">
+          <FormattedMessage
+            id="xpack.security.resetSession.goBackButtonLabel"
+            defaultMessage="Go back"
+          />
+        </EuiButtonEmpty>,
+      ]}
+    />
   );
 }
diff --git a/x-pack/plugins/security/server/index.ts b/x-pack/plugins/security/server/index.ts
index b66ed6e9eb7ca..087cf8f4f8ee8 100644
--- a/x-pack/plugins/security/server/index.ts
+++ b/x-pack/plugins/security/server/index.ts
@@ -30,6 +30,7 @@ export type { CheckPrivilegesPayload } from './authorization';
 export { LegacyAuditLogger, AuditLogger, AuditEvent } from './audit';
 export type { SecurityPluginSetup, SecurityPluginStart };
 export type { AuthenticatedUser } from '../common/model';
+export { ROUTE_TAG_CAN_REDIRECT } from './routes/tags';
 
 export const config: PluginConfigDescriptor<TypeOf<typeof ConfigSchema>> = {
   schema: ConfigSchema,
diff --git a/x-pack/plugins/security/server/plugin.ts b/x-pack/plugins/security/server/plugin.ts
index 586707dd8c9aa..57be308525fdd 100644
--- a/x-pack/plugins/security/server/plugin.ts
+++ b/x-pack/plugins/security/server/plugin.ts
@@ -246,7 +246,12 @@ export class SecurityPlugin
     this.elasticsearchService.setup({ license, status: core.status });
     this.featureUsageService.setup({ featureUsage: licensing.featureUsage });
     this.sessionManagementService.setup({ config, http: core.http, taskManager });
-    this.authenticationService.setup({ http: core.http, license });
+    this.authenticationService.setup({
+      http: core.http,
+      config,
+      license,
+      buildNumber: this.initializerContext.env.packageInfo.buildNum,
+    });
 
     registerSecurityUsageCollector({ usageCollection, config, license });
 
diff --git a/x-pack/plugins/security/server/prompt_page.test.tsx b/x-pack/plugins/security/server/prompt_page.test.tsx
new file mode 100644
index 0000000000000..01c4488576f57
--- /dev/null
+++ b/x-pack/plugins/security/server/prompt_page.test.tsx
@@ -0,0 +1,57 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+
+import { coreMock } from '../../../../src/core/server/mocks';
+import { PromptPage } from './prompt_page';
+
+jest.mock('src/core/server/rendering/views/fonts', () => ({
+  Fonts: () => <>MockedFonts</>,
+}));
+
+describe('PromptPage', () => {
+  it('renders as expected without additional scripts', async () => {
+    const mockCoreSetup = coreMock.createSetup();
+    (mockCoreSetup.http.basePath.prepend as jest.Mock).mockImplementation(
+      (path) => `/mock-basepath${path}`
+    );
+
+    const body = renderToStaticMarkup(
+      <PromptPage
+        buildNumber={100500}
+        basePath={mockCoreSetup.http.basePath}
+        title="Some Title"
+        body={<div>Some Body</div>}
+        actions={[<span>Action#1</span>, <span>Action#2</span>]}
+      />
+    );
+
+    expect(body).toMatchSnapshot();
+  });
+
+  it('renders as expected with additional scripts', async () => {
+    const mockCoreSetup = coreMock.createSetup();
+    (mockCoreSetup.http.basePath.prepend as jest.Mock).mockImplementation(
+      (path) => `/mock-basepath${path}`
+    );
+
+    const body = renderToStaticMarkup(
+      <PromptPage
+        buildNumber={100500}
+        basePath={mockCoreSetup.http.basePath}
+        scriptPaths={['/some/script1.js', '/some/script2.js']}
+        title="Some Title"
+        body={<div>Some Body</div>}
+        actions={[<span>Action#1</span>, <span>Action#2</span>]}
+      />
+    );
+
+    expect(body).toMatchSnapshot();
+  });
+});
diff --git a/x-pack/plugins/security/server/prompt_page.tsx b/x-pack/plugins/security/server/prompt_page.tsx
new file mode 100644
index 0000000000000..338d39b29e534
--- /dev/null
+++ b/x-pack/plugins/security/server/prompt_page.tsx
@@ -0,0 +1,96 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+// @ts-expect-error no definitions in component folder
+import { EuiEmptyPrompt } from '@elastic/eui/lib/components/empty_prompt';
+// @ts-expect-error no definitions in component folder
+import { icon as EuiIconAlert } from '@elastic/eui/lib/components/icon/assets/alert';
+// @ts-expect-error no definitions in component folder
+import { appendIconComponentCache } from '@elastic/eui/lib/components/icon/icon';
+// @ts-expect-error no definitions in component folder
+import { EuiPage, EuiPageBody, EuiPageContent } from '@elastic/eui/lib/components/page';
+import type { ReactNode } from 'react';
+import React from 'react';
+
+import { i18n } from '@kbn/i18n';
+import { I18nProvider } from '@kbn/i18n/react';
+import * as UiSharedDeps from '@kbn/ui-shared-deps';
+import type { IBasePath } from 'src/core/server';
+
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { Fonts } from '../../../../src/core/server/rendering/views/fonts';
+
+// Preload the alert icon used by `EuiEmptyPrompt` to ensure that it's loaded
+// in advance the first time this page is rendered server-side. If not, the
+// icon svg wouldn't contain any paths the first time the page was rendered.
+appendIconComponentCache({
+  alert: EuiIconAlert,
+});
+
+interface Props {
+  buildNumber: number;
+  basePath: IBasePath;
+  scriptPaths?: string[];
+  title: ReactNode;
+  body: ReactNode;
+  actions: ReactNode;
+}
+
+export function PromptPage({
+  basePath,
+  buildNumber,
+  scriptPaths = [],
+  title,
+  body,
+  actions,
+}: Props) {
+  const uiPublicURL = `${basePath.serverBasePath}/ui`;
+  const regularBundlePath = `${basePath.serverBasePath}/${buildNumber}/bundles`;
+  const styleSheetPaths = [
+    `${regularBundlePath}/kbn-ui-shared-deps/${UiSharedDeps.baseCssDistFilename}`,
+    `${regularBundlePath}/kbn-ui-shared-deps/${UiSharedDeps.lightCssDistFilename}`,
+    `${basePath.serverBasePath}/node_modules/@kbn/ui-framework/dist/kui_light.css`,
+    `${basePath.serverBasePath}/ui/legacy_light_theme.css`,
+  ];
+
+  return (
+    <html lang={i18n.getLocale()}>
+      <head>
+        <title>Elastic</title>
+        {styleSheetPaths.map((path) => (
+          <link href={path} rel="stylesheet" key={path} />
+        ))}
+        <Fonts url={uiPublicURL} />
+        {/* The alternate icon is a fallback for Safari which does not yet support SVG favicons */}
+        <link rel="alternate icon" type="image/png" href={`${uiPublicURL}/favicons/favicon.png`} />
+        <link rel="icon" type="image/svg+xml" href={`${uiPublicURL}/favicons/favicon.svg`} />
+        {scriptPaths.map((path) => (
+          <script src={basePath.prepend(path)} key={path} />
+        ))}
+        <meta name="theme-color" content="#ffffff" />
+        <meta name="color-scheme" content="light dark" />
+      </head>
+      <body>
+        <I18nProvider>
+          <EuiPage paddingSize="none" style={{ minHeight: '100vh' }} data-test-subj="promptPage">
+            <EuiPageBody>
+              <EuiPageContent verticalPosition="center" horizontalPosition="center">
+                <EuiEmptyPrompt
+                  iconType="alert"
+                  iconColor="danger"
+                  title={<h2>{title}</h2>}
+                  body={body}
+                  actions={actions}
+                />
+              </EuiPageContent>
+            </EuiPageBody>
+          </EuiPage>
+        </I18nProvider>
+      </body>
+    </html>
+  );
+}
diff --git a/x-pack/plugins/security/server/routes/authentication/common.test.ts b/x-pack/plugins/security/server/routes/authentication/common.test.ts
index 6b3ce15669c27..1e0b6784a45c8 100644
--- a/x-pack/plugins/security/server/routes/authentication/common.test.ts
+++ b/x-pack/plugins/security/server/routes/authentication/common.test.ts
@@ -23,6 +23,7 @@ import {
 import { authenticationServiceMock } from '../../authentication/authentication_service.mock';
 import type { SecurityRequestHandlerContext, SecurityRouter } from '../../types';
 import { routeDefinitionParamsMock } from '../index.mock';
+import { ROUTE_TAG_AUTH_FLOW, ROUTE_TAG_CAN_REDIRECT } from '../tags';
 import { defineCommonRoutes } from './common';
 
 describe('Common authentication routes', () => {
@@ -64,7 +65,10 @@ describe('Common authentication routes', () => {
     });
 
     it('correctly defines route.', async () => {
-      expect(routeConfig.options).toEqual({ authRequired: false });
+      expect(routeConfig.options).toEqual({
+        authRequired: false,
+        tags: [ROUTE_TAG_CAN_REDIRECT, ROUTE_TAG_AUTH_FLOW],
+      });
       expect(routeConfig.validate).toEqual({
         body: undefined,
         query: expect.any(Type),
diff --git a/x-pack/plugins/security/server/routes/authentication/common.ts b/x-pack/plugins/security/server/routes/authentication/common.ts
index 28c344785da4b..b16aac9743676 100644
--- a/x-pack/plugins/security/server/routes/authentication/common.ts
+++ b/x-pack/plugins/security/server/routes/authentication/common.ts
@@ -21,6 +21,7 @@ import {
 } from '../../authentication';
 import { wrapIntoCustomErrorResponse } from '../../errors';
 import { createLicensedRouteHandler } from '../licensed_route_handler';
+import { ROUTE_TAG_AUTH_FLOW, ROUTE_TAG_CAN_REDIRECT } from '../tags';
 
 /**
  * Defines routes that are common to various authentication mechanisms.
@@ -40,7 +41,7 @@ export function defineCommonRoutes({
         // Allow unknown query parameters as this endpoint can be hit by the 3rd-party with any
         // set of query string parameters (e.g. SAML/OIDC logout request/response parameters).
         validate: { query: schema.object({}, { unknowns: 'allow' }) },
-        options: { authRequired: false },
+        options: { authRequired: false, tags: [ROUTE_TAG_CAN_REDIRECT, ROUTE_TAG_AUTH_FLOW] },
       },
       async (context, request, response) => {
         const serverBasePath = basePath.serverBasePath;
diff --git a/x-pack/plugins/security/server/routes/authentication/oidc.ts b/x-pack/plugins/security/server/routes/authentication/oidc.ts
index 854b6721278ff..0216001449d36 100644
--- a/x-pack/plugins/security/server/routes/authentication/oidc.ts
+++ b/x-pack/plugins/security/server/routes/authentication/oidc.ts
@@ -10,11 +10,11 @@ import { i18n } from '@kbn/i18n';
 import type { KibanaRequest, KibanaResponseFactory } from 'src/core/server';
 
 import type { RouteDefinitionParams } from '../';
-import { OIDCLogin } from '../../authentication';
+import { OIDCAuthenticationProvider, OIDCLogin } from '../../authentication';
 import type { ProviderLoginAttempt } from '../../authentication/providers/oidc';
-import { OIDCAuthenticationProvider } from '../../authentication/providers/oidc';
 import { wrapIntoCustomErrorResponse } from '../../errors';
 import { createLicensedRouteHandler } from '../licensed_route_handler';
+import { ROUTE_TAG_AUTH_FLOW, ROUTE_TAG_CAN_REDIRECT } from '../tags';
 
 /**
  * Defines routes required for SAML authentication.
@@ -106,7 +106,7 @@ export function defineOIDCRoutes({
             { unknowns: 'allow' }
           ),
         },
-        options: { authRequired: false },
+        options: { authRequired: false, tags: [ROUTE_TAG_CAN_REDIRECT, ROUTE_TAG_AUTH_FLOW] },
       },
       createLicensedRouteHandler(async (context, request, response) => {
         const serverBasePath = basePath.serverBasePath;
@@ -183,7 +183,11 @@ export function defineOIDCRoutes({
             { unknowns: 'allow' }
           ),
         },
-        options: { authRequired: false, xsrfRequired: false },
+        options: {
+          authRequired: false,
+          xsrfRequired: false,
+          tags: [ROUTE_TAG_CAN_REDIRECT, ROUTE_TAG_AUTH_FLOW],
+        },
       },
       createLicensedRouteHandler(async (context, request, response) => {
         const serverBasePath = basePath.serverBasePath;
@@ -222,7 +226,10 @@ export function defineOIDCRoutes({
           { unknowns: 'allow' }
         ),
       },
-      options: { authRequired: false },
+      options: {
+        authRequired: false,
+        tags: [ROUTE_TAG_CAN_REDIRECT, ROUTE_TAG_AUTH_FLOW],
+      },
     },
     createLicensedRouteHandler(async (context, request, response) => {
       return performOIDCLogin(request, response, {
diff --git a/x-pack/plugins/security/server/routes/authentication/saml.test.ts b/x-pack/plugins/security/server/routes/authentication/saml.test.ts
index 35fdcff295c1e..3b2497ed9f30b 100644
--- a/x-pack/plugins/security/server/routes/authentication/saml.test.ts
+++ b/x-pack/plugins/security/server/routes/authentication/saml.test.ts
@@ -16,6 +16,7 @@ import { AuthenticationResult, SAMLLogin } from '../../authentication';
 import { authenticationServiceMock } from '../../authentication/authentication_service.mock';
 import type { SecurityRouter } from '../../types';
 import { routeDefinitionParamsMock } from '../index.mock';
+import { ROUTE_TAG_AUTH_FLOW, ROUTE_TAG_CAN_REDIRECT } from '../tags';
 import { defineSAMLRoutes } from './saml';
 
 describe('SAML authentication routes', () => {
@@ -43,7 +44,11 @@ describe('SAML authentication routes', () => {
     });
 
     it('correctly defines route.', () => {
-      expect(routeConfig.options).toEqual({ authRequired: false, xsrfRequired: false });
+      expect(routeConfig.options).toEqual({
+        authRequired: false,
+        xsrfRequired: false,
+        tags: [ROUTE_TAG_CAN_REDIRECT, ROUTE_TAG_AUTH_FLOW],
+      });
       expect(routeConfig.validate).toEqual({
         body: expect.any(Type),
         query: undefined,
diff --git a/x-pack/plugins/security/server/routes/authentication/saml.ts b/x-pack/plugins/security/server/routes/authentication/saml.ts
index 5dac46354025a..8a343c2413779 100644
--- a/x-pack/plugins/security/server/routes/authentication/saml.ts
+++ b/x-pack/plugins/security/server/routes/authentication/saml.ts
@@ -8,17 +8,13 @@
 import { schema } from '@kbn/config-schema';
 
 import type { RouteDefinitionParams } from '../';
-import { SAMLLogin } from '../../authentication';
-import { SAMLAuthenticationProvider } from '../../authentication/providers';
+import { SAMLAuthenticationProvider, SAMLLogin } from '../../authentication';
+import { ROUTE_TAG_AUTH_FLOW, ROUTE_TAG_CAN_REDIRECT } from '../tags';
 
 /**
  * Defines routes required for SAML authentication.
  */
-export function defineSAMLRoutes({
-  router,
-  logger,
-  getAuthenticationService,
-}: RouteDefinitionParams) {
+export function defineSAMLRoutes({ router, getAuthenticationService }: RouteDefinitionParams) {
   router.post(
     {
       path: '/api/security/saml/callback',
@@ -28,7 +24,11 @@ export function defineSAMLRoutes({
           { unknowns: 'ignore' }
         ),
       },
-      options: { authRequired: false, xsrfRequired: false },
+      options: {
+        authRequired: false,
+        xsrfRequired: false,
+        tags: [ROUTE_TAG_CAN_REDIRECT, ROUTE_TAG_AUTH_FLOW],
+      },
     },
     async (context, request, response) => {
       // When authenticating using SAML we _expect_ to redirect to the Kibana target location.
diff --git a/x-pack/plugins/security/server/routes/tags.ts b/x-pack/plugins/security/server/routes/tags.ts
new file mode 100644
index 0000000000000..090c04d29757f
--- /dev/null
+++ b/x-pack/plugins/security/server/routes/tags.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/**
+ * If, for whatever reason, the API route path doesn't follow the API naming convention and doesn't
+ * start with `/api` or `/internal` prefix, it should be marked with this tag explicitly to let
+ * Security know that it should be handled as any other API route.
+ */
+export const ROUTE_TAG_API = 'api';
+
+/**
+ * If the route is marked with this tag Security can safely assume that the calling party that sends
+ * request to this route can handle redirect responses. It's particularly important if we want the
+ * specific route to be able to initiate or participate in the authentication handshake that may
+ * involve redirects and will eventually redirect authenticated user to this route.
+ */
+export const ROUTE_TAG_CAN_REDIRECT = 'security:canRedirect';
+
+/**
+ * The routes that are involved into authentication flows, especially if they are used by the 3rd
+ * parties, require special handling.
+ */
+export const ROUTE_TAG_AUTH_FLOW = 'security:authFlow';
diff --git a/x-pack/plugins/security/server/routes/views/capture_url.test.ts b/x-pack/plugins/security/server/routes/views/capture_url.test.ts
index 0393a69276ff3..6c4de7a719fe1 100644
--- a/x-pack/plugins/security/server/routes/views/capture_url.test.ts
+++ b/x-pack/plugins/security/server/routes/views/capture_url.test.ts
@@ -43,46 +43,10 @@ describe('Capture URL view routes', () => {
     });
 
     const queryValidator = (routeConfig.validate as any).query as Type<any>;
-    expect(
-      queryValidator.validate({ providerType: 'basic', providerName: 'basic1', next: '/some-url' })
-    ).toEqual({ providerType: 'basic', providerName: 'basic1', next: '/some-url' });
-
-    expect(queryValidator.validate({ providerType: 'basic', providerName: 'basic1' })).toEqual({
-      providerType: 'basic',
-      providerName: 'basic1',
+    expect(queryValidator.validate({})).toEqual({});
+    expect(queryValidator.validate({ next: '/some-url', something: 'something' })).toEqual({
+      next: '/some-url',
     });
-
-    expect(() => queryValidator.validate({ providerType: '' })).toThrowErrorMatchingInlineSnapshot(
-      `"[providerType]: value has length [0] but it must have a minimum length of [1]."`
-    );
-
-    expect(() =>
-      queryValidator.validate({ providerType: 'basic' })
-    ).toThrowErrorMatchingInlineSnapshot(
-      `"[providerName]: expected value of type [string] but got [undefined]"`
-    );
-
-    expect(() => queryValidator.validate({ providerName: '' })).toThrowErrorMatchingInlineSnapshot(
-      `"[providerType]: expected value of type [string] but got [undefined]"`
-    );
-
-    expect(() =>
-      queryValidator.validate({ providerName: 'basic1' })
-    ).toThrowErrorMatchingInlineSnapshot(
-      `"[providerType]: expected value of type [string] but got [undefined]"`
-    );
-
-    expect(() =>
-      queryValidator.validate({ providerType: 'basic', providerName: '' })
-    ).toThrowErrorMatchingInlineSnapshot(
-      `"[providerName]: value has length [0] but it must have a minimum length of [1]."`
-    );
-
-    expect(() =>
-      queryValidator.validate({ providerType: '', providerName: 'basic1' })
-    ).toThrowErrorMatchingInlineSnapshot(
-      `"[providerType]: value has length [0] but it must have a minimum length of [1]."`
-    );
   });
 
   it('renders view.', async () => {
diff --git a/x-pack/plugins/security/server/routes/views/capture_url.ts b/x-pack/plugins/security/server/routes/views/capture_url.ts
index 1ea1c8ad620e4..d345639b58cb2 100644
--- a/x-pack/plugins/security/server/routes/views/capture_url.ts
+++ b/x-pack/plugins/security/server/routes/views/capture_url.ts
@@ -17,11 +17,7 @@ export function defineCaptureURLRoutes({ httpResources }: RouteDefinitionParams)
     {
       path: '/internal/security/capture-url',
       validate: {
-        query: schema.object({
-          providerType: schema.string({ minLength: 1 }),
-          providerName: schema.string({ minLength: 1 }),
-          next: schema.maybe(schema.string()),
-        }),
+        query: schema.object({ next: schema.maybe(schema.string()) }, { unknowns: 'ignore' }),
       },
       options: { authRequired: false },
     },
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 2d900f9e5dc85..f20bc0f72ccde 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -17161,7 +17161,6 @@
     "xpack.security.loggedOut.login": "ログイン",
     "xpack.security.loggedOut.title": "ログアウト完了",
     "xpack.security.loggedOutAppTitle": "ログアウト",
-    "xpack.security.login.basicLoginForm.invalidUsernameOrPasswordErrorMessage": "無効なユーザー名またはパスワードです。再試行してください。",
     "xpack.security.login.basicLoginForm.logInButtonLabel": "ログイン",
     "xpack.security.login.basicLoginForm.passwordFormRowLabel": "パスワード",
     "xpack.security.login.basicLoginForm.unknownErrorMessage": "おっと！エラー。再試行してください。",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 69d84e7a0f56b..3b32e1c184f26 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -17400,7 +17400,6 @@
     "xpack.security.loggedOut.login": "登录",
     "xpack.security.loggedOut.title": "已成功退出",
     "xpack.security.loggedOutAppTitle": "已注销",
-    "xpack.security.login.basicLoginForm.invalidUsernameOrPasswordErrorMessage": "用户名或密码无效。请重试。",
     "xpack.security.login.basicLoginForm.logInButtonLabel": "登录",
     "xpack.security.login.basicLoginForm.passwordFormRowLabel": "密码",
     "xpack.security.login.basicLoginForm.unknownErrorMessage": "糟糕！错误。请重试。",
diff --git a/x-pack/test/api_integration/apis/security/basic_login.js b/x-pack/test/api_integration/apis/security/basic_login.js
index 04aa451b6491a..e42ba6cb8a055 100644
--- a/x-pack/test/api_integration/apis/security/basic_login.js
+++ b/x-pack/test/api_integration/apis/security/basic_login.js
@@ -303,11 +303,11 @@ export default function ({ getService }) {
         expect(loginViewResponse.headers.location).to.be('/');
       });
 
-      it('should redirect to home page if cookie is not provided', async () => {
+      it('should redirect to login page if cookie is not provided', async () => {
         const logoutResponse = await supertest.get('/api/security/logout').expect(302);
 
         expect(logoutResponse.headers['set-cookie']).to.be(undefined);
-        expect(logoutResponse.headers.location).to.be('/');
+        expect(logoutResponse.headers.location).to.be('/login?msg=LOGGED_OUT');
       });
     });
   });
diff --git a/x-pack/test/functional/apps/security/security.ts b/x-pack/test/functional/apps/security/security.ts
index d9a36233428c5..70db20d6d0c48 100644
--- a/x-pack/test/functional/apps/security/security.ts
+++ b/x-pack/test/functional/apps/security/security.ts
@@ -41,7 +41,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           expectSuccess: false,
         });
         const errorMessage = await PageObjects.security.loginPage.getErrorMessage();
-        expect(errorMessage).to.be('Invalid username or password. Please try again.');
+        expect(errorMessage).to.be('Username or password is incorrect. Please try again.');
       });
 
       it('displays message acknowledging logout', async () => {
diff --git a/x-pack/test/security_api_integration/tests/anonymous/login.ts b/x-pack/test/security_api_integration/tests/anonymous/login.ts
index 3d1a05583e904..61c8c55c86764 100644
--- a/x-pack/test/security_api_integration/tests/anonymous/login.ts
+++ b/x-pack/test/security_api_integration/tests/anonymous/login.ts
@@ -112,11 +112,16 @@ export default function ({ getService }: FtrProviderContext) {
       });
 
       it('should fail if `Authorization` header is present, but not valid', async () => {
-        const response = await supertest
+        const unauthenticatedResponse = await supertest
           .get('/security/account')
           .set('Authorization', 'Basic wow')
           .expect(401);
-        expect(response.headers['set-cookie']).to.be(undefined);
+
+        expect(unauthenticatedResponse.headers['set-cookie']).to.be(undefined);
+        expect(unauthenticatedResponse.headers['content-security-policy']).to.be(
+          `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
+        );
+        expect(unauthenticatedResponse.text).to.contain('We couldn&#x27;t log you in');
       });
     });
 
@@ -156,9 +161,14 @@ export default function ({ getService }: FtrProviderContext) {
         const apiResponse = await supertest
           .get('/internal/security/me')
           .set('kbn-xsrf', 'xxx')
-          .set('Authorization', 'Basic a3JiNTprcmI1')
+          .set('Authorization', 'Basic ZHVtbXlfaGFja2VyOnBhc3M=')
           .set('Cookie', sessionCookie.cookieString())
-          .expect(401);
+          .expect(401, {
+            statusCode: 401,
+            error: 'Unauthorized',
+            message:
+              '[security_exception]: unable to authenticate user [dummy_hacker] for REST request [/_security/_authenticate]',
+          });
 
         expect(apiResponse.headers['set-cookie']).to.be(undefined);
       });
@@ -203,7 +213,7 @@ export default function ({ getService }: FtrProviderContext) {
         const logoutResponse = await supertest.get('/api/security/logout').expect(302);
 
         expect(logoutResponse.headers['set-cookie']).to.be(undefined);
-        expect(logoutResponse.headers.location).to.be('/');
+        expect(logoutResponse.headers.location).to.be('/security/logged_out?msg=LOGGED_OUT');
       });
     });
   });
diff --git a/x-pack/test/security_api_integration/tests/kerberos/kerberos_login.ts b/x-pack/test/security_api_integration/tests/kerberos/kerberos_login.ts
index 3deb1408dc5c9..c0681b5adcac8 100644
--- a/x-pack/test/security_api_integration/tests/kerberos/kerberos_login.ts
+++ b/x-pack/test/security_api_integration/tests/kerberos/kerberos_login.ts
@@ -53,7 +53,10 @@ export default function ({ getService }: FtrProviderContext) {
     });
 
     it('should reject API requests if client is not authenticated', async () => {
-      await supertest.get('/internal/security/me').set('kbn-xsrf', 'xxx').expect(401);
+      await supertest
+        .get('/internal/security/me')
+        .set('kbn-xsrf', 'xxx')
+        .expect(401, { statusCode: 401, error: 'Unauthorized', message: 'Unauthorized' });
     });
 
     it('does not prevent basic login', async () => {
@@ -92,6 +95,13 @@ export default function ({ getService }: FtrProviderContext) {
 
         expect(spnegoResponse.headers['set-cookie']).to.be(undefined);
         expect(spnegoResponse.headers['www-authenticate']).to.be('Negotiate');
+
+        // If browser and Kibana can successfully negotiate this HTML won't rendered, but if not
+        // users will see a proper `Unauthenticated` page.
+        expect(spnegoResponse.headers['content-security-policy']).to.be(
+          `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
+        );
+        expect(spnegoResponse.text).to.contain('We couldn&#x27;t log you in');
       });
 
       it('AJAX requests should not initiate SPNEGO', async () => {
@@ -285,7 +295,7 @@ export default function ({ getService }: FtrProviderContext) {
         const logoutResponse = await supertest.get('/api/security/logout').expect(302);
 
         expect(logoutResponse.headers['set-cookie']).to.be(undefined);
-        expect(logoutResponse.headers.location).to.be('/');
+        expect(logoutResponse.headers.location).to.be('/security/logged_out?msg=LOGGED_OUT');
       });
     });
 
diff --git a/x-pack/test/security_api_integration/tests/login_selector/basic_functionality.ts b/x-pack/test/security_api_integration/tests/login_selector/basic_functionality.ts
index 0d894ce00d11f..69b3542b74bfe 100644
--- a/x-pack/test/security_api_integration/tests/login_selector/basic_functionality.ts
+++ b/x-pack/test/security_api_integration/tests/login_selector/basic_functionality.ts
@@ -394,7 +394,7 @@ export default function ({ getService }: FtrProviderContext) {
         )!;
 
         // And now try to login with `saml2`.
-        await supertest
+        const unauthenticatedResponse = await supertest
           .post('/api/security/saml/callback')
           .ca(CA_CERT)
           .set('Cookie', saml1HandshakeCookie.cookieString())
@@ -402,6 +402,30 @@ export default function ({ getService }: FtrProviderContext) {
             SAMLResponse: await createSAMLResponse({ issuer: `http://www.elastic.co/saml2` }),
           })
           .expect(401);
+
+        expect(unauthenticatedResponse.headers['content-security-policy']).to.be(
+          `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
+        );
+        expect(unauthenticatedResponse.headers.refresh).to.be(
+          `0;url=/logout?msg=UNAUTHENTICATED&next=%2F`
+        );
+      });
+
+      it('should fail if SAML response is not valid', async () => {
+        const unauthenticatedResponse = await supertest
+          .post('/api/security/saml/callback')
+          .ca(CA_CERT)
+          .send({
+            SAMLResponse: await createSAMLResponse({ inResponseTo: 'some-invalid-request-id' }),
+          })
+          .expect(401);
+
+        expect(unauthenticatedResponse.headers['content-security-policy']).to.be(
+          `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
+        );
+        expect(unauthenticatedResponse.headers.refresh).to.be(
+          `0;url=/login?msg=UNAUTHENTICATED&next=%2F`
+        );
       });
 
       it('should be able to log in via SP initiated login with any configured realm', async () => {
@@ -654,6 +678,41 @@ export default function ({ getService }: FtrProviderContext) {
         );
       });
 
+      it('should fail IdP initiated login if state is not matching', async () => {
+        const handshakeResponse = await supertest
+          .get('/api/security/oidc/initiate_login?iss=https://test-op.elastic.co')
+          .ca(CA_CERT)
+          .expect(302);
+        const handshakeCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
+
+        const unauthenticatedResponse = await supertest
+          .get('/api/security/oidc/callback?code=code2&state=someothervalue')
+          .ca(CA_CERT)
+          .set('Cookie', handshakeCookie.cookieString())
+          .expect(401);
+
+        expect(unauthenticatedResponse.headers['content-security-policy']).to.be(
+          `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
+        );
+        expect(unauthenticatedResponse.headers.refresh).to.be(
+          `0;url=/logout?msg=UNAUTHENTICATED&next=%2F`
+        );
+      });
+
+      it('should fail IdP initiated login if issuer is not known', async () => {
+        const unauthenticatedResponse = await supertest
+          .get('/api/security/oidc/initiate_login?iss=https://dummy.hacker.co')
+          .ca(CA_CERT)
+          .expect(401);
+
+        expect(unauthenticatedResponse.headers['content-security-policy']).to.be(
+          `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
+        );
+        expect(unauthenticatedResponse.headers.refresh).to.be(
+          `0;url=/login?msg=UNAUTHENTICATED&next=%2F`
+        );
+      });
+
       it('should be able to log in via SP initiated login', async () => {
         const handshakeResponse = await supertest
           .post('/internal/security/login')
diff --git a/x-pack/test/security_api_integration/tests/oidc/authorization_code_flow/oidc_auth.ts b/x-pack/test/security_api_integration/tests/oidc/authorization_code_flow/oidc_auth.ts
index c13ce902ad658..940120988b747 100644
--- a/x-pack/test/security_api_integration/tests/oidc/authorization_code_flow/oidc_auth.ts
+++ b/x-pack/test/security_api_integration/tests/oidc/authorization_code_flow/oidc_auth.ts
@@ -19,7 +19,10 @@ export default function ({ getService }: FtrProviderContext) {
 
   describe('OpenID Connect authentication', () => {
     it('should reject API requests if client is not authenticated', async () => {
-      await supertest.get('/internal/security/me').set('kbn-xsrf', 'xxx').expect(401);
+      await supertest
+        .get('/internal/security/me')
+        .set('kbn-xsrf', 'xxx')
+        .expect(401, { statusCode: 401, error: 'Unauthorized', message: 'Unauthorized' });
     });
 
     it('does not prevent basic login', async () => {
@@ -57,21 +60,16 @@ export default function ({ getService }: FtrProviderContext) {
 
         expect(handshakeResponse.headers['set-cookie']).to.be(undefined);
         expect(handshakeResponse.headers.location).to.be(
-          '/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=oidc&providerName=oidc'
+          '/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2Bthree%26auth_provider_hint%3Doidc'
         );
       });
 
       it('should properly set cookie, return all parameters and redirect user', async () => {
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
-          .send({
-            providerType: 'oidc',
-            providerName: 'oidc',
-            currentURL:
-              'https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=oidc&providerName=oidc#/workpad',
-          })
-          .expect(200);
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
+          .expect(302);
 
         const cookies = handshakeResponse.headers['set-cookie'];
         expect(cookies).to.have.length(1);
@@ -82,7 +80,10 @@ export default function ({ getService }: FtrProviderContext) {
         expect(handshakeCookie.path).to.be('/');
         expect(handshakeCookie.httpOnly).to.be(true);
 
-        const redirectURL = url.parse(handshakeResponse.body.location, true /* parseQueryString */);
+        const redirectURL = url.parse(
+          handshakeResponse.headers.location,
+          true /* parseQueryString */
+        );
         expect(
           redirectURL.href!.startsWith(`https://test-op.elastic.co/oauth2/v1/authorize`)
         ).to.be(true);
@@ -126,15 +127,10 @@ export default function ({ getService }: FtrProviderContext) {
 
       it('should not allow access to the API with the handshake cookie', async () => {
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
-          .send({
-            providerType: 'oidc',
-            providerName: 'oidc',
-            currentURL:
-              'https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=oidc&providerName=oidc#/workpad',
-          })
-          .expect(200);
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
+          .expect(302);
 
         const handshakeCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
         await supertest
@@ -160,18 +156,13 @@ export default function ({ getService }: FtrProviderContext) {
 
       beforeEach(async () => {
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
-          .send({
-            providerType: 'oidc',
-            providerName: 'oidc',
-            currentURL:
-              'https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=oidc&providerName=oidc#/workpad',
-          })
-          .expect(200);
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
+          .expect(302);
 
         handshakeCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
-        stateAndNonce = getStateAndNonce(handshakeResponse.body.location);
+        stateAndNonce = getStateAndNonce(handshakeResponse.headers.location);
         // Set the nonce in our mock OIDC Provider so that it can generate the ID Tokens
         await supertest
           .post('/api/oidc_provider/setup')
@@ -181,30 +172,37 @@ export default function ({ getService }: FtrProviderContext) {
       });
 
       it('should fail if OpenID Connect response is not complemented with handshake cookie', async () => {
-        await supertest
+        const unauthenticatedResponse = await supertest
           .get(`/api/security/oidc/callback?code=thisisthecode&state=${stateAndNonce.state}`)
-          .set('kbn-xsrf', 'xxx')
           .expect(401);
+
+        expect(unauthenticatedResponse.headers['content-security-policy']).to.be(
+          `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
+        );
+        expect(unauthenticatedResponse.text).to.contain('We couldn&#x27;t log you in');
       });
 
       it('should fail if state is not matching', async () => {
-        await supertest
+        const unauthenticatedResponse = await supertest
           .get(`/api/security/oidc/callback?code=thisisthecode&state=someothervalue`)
-          .set('kbn-xsrf', 'xxx')
           .set('Cookie', handshakeCookie.cookieString())
           .expect(401);
+
+        expect(unauthenticatedResponse.headers['content-security-policy']).to.be(
+          `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
+        );
+        expect(unauthenticatedResponse.text).to.contain('We couldn&#x27;t log you in');
       });
 
       it('should succeed if both the OpenID Connect response and the cookie are provided', async () => {
         const oidcAuthenticationResponse = await supertest
           .get(`/api/security/oidc/callback?code=code1&state=${stateAndNonce.state}`)
-          .set('kbn-xsrf', 'xxx')
           .set('Cookie', handshakeCookie.cookieString())
           .expect(302);
 
         // User should be redirected to the URL that initiated handshake.
         expect(oidcAuthenticationResponse.headers.location).to.be(
-          '/abc/xyz/handshake?one=two%20three#/workpad'
+          '/abc/xyz/handshake?one=two+three#/workpad'
         );
 
         const cookies = oidcAuthenticationResponse.headers['set-cookie'];
@@ -258,7 +256,6 @@ export default function ({ getService }: FtrProviderContext) {
 
         const oidcAuthenticationResponse = await supertest
           .get(`/api/security/oidc/callback?code=code2&state=${stateAndNonce.state}`)
-          .set('kbn-xsrf', 'xxx')
           .set('Cookie', handshakeCookie.cookieString())
           .expect(302);
         const cookies = oidcAuthenticationResponse.headers['set-cookie'];
@@ -301,18 +298,13 @@ export default function ({ getService }: FtrProviderContext) {
 
       beforeEach(async () => {
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
-          .send({
-            providerType: 'oidc',
-            providerName: 'oidc',
-            currentURL:
-              'https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=oidc&providerName=oidc#/workpad',
-          })
-          .expect(200);
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
+          .expect(302);
 
         sessionCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
-        stateAndNonce = getStateAndNonce(handshakeResponse.body.location);
+        stateAndNonce = getStateAndNonce(handshakeResponse.headers.location);
         // Set the nonce in our mock OIDC Provider so that it can generate the ID Tokens
         await supertest
           .post('/api/oidc_provider/setup')
@@ -322,7 +314,6 @@ export default function ({ getService }: FtrProviderContext) {
 
         const oidcAuthenticationResponse = await supertest
           .get(`/api/security/oidc/callback?code=code1&state=${stateAndNonce.state}`)
-          .set('kbn-xsrf', 'xxx')
           .set('Cookie', sessionCookie.cookieString())
           .expect(302);
 
@@ -383,18 +374,13 @@ export default function ({ getService }: FtrProviderContext) {
 
       beforeEach(async () => {
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
-          .send({
-            providerType: 'oidc',
-            providerName: 'oidc',
-            currentURL:
-              'https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=oidc&providerName=oidc#/workpad',
-          })
-          .expect(200);
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
+          .expect(302);
 
         const handshakeCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
-        const stateAndNonce = getStateAndNonce(handshakeResponse.body.location);
+        const stateAndNonce = getStateAndNonce(handshakeResponse.headers.location);
         // Set the nonce in our mock OIDC Provider so that it can generate the ID Tokens
         await supertest
           .post('/api/oidc_provider/setup')
@@ -404,7 +390,6 @@ export default function ({ getService }: FtrProviderContext) {
 
         const oidcAuthenticationResponse = await supertest
           .get(`/api/security/oidc/callback?code=code1&state=${stateAndNonce.state}`)
-          .set('kbn-xsrf', 'xxx')
           .set('Cookie', handshakeCookie.cookieString())
           .expect(302);
 
@@ -418,7 +403,7 @@ export default function ({ getService }: FtrProviderContext) {
         const logoutResponse = await supertest.get('/api/security/logout').expect(302);
 
         expect(logoutResponse.headers['set-cookie']).to.be(undefined);
-        expect(logoutResponse.headers.location).to.be('/');
+        expect(logoutResponse.headers.location).to.be('/security/logged_out?msg=LOGGED_OUT');
       });
 
       it('should redirect to the OPs endsession endpoint to complete logout', async () => {
@@ -472,18 +457,13 @@ export default function ({ getService }: FtrProviderContext) {
 
       beforeEach(async () => {
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
-          .send({
-            providerType: 'oidc',
-            providerName: 'oidc',
-            currentURL:
-              'https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=oidc&providerName=oidc#/workpad',
-          })
-          .expect(200);
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
+          .expect(302);
 
         const handshakeCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
-        const stateAndNonce = getStateAndNonce(handshakeResponse.body.location);
+        const stateAndNonce = getStateAndNonce(handshakeResponse.headers.location);
         // Set the nonce in our mock OIDC Provider so that it can generate the ID Tokens
         await supertest
           .post('/api/oidc_provider/setup')
@@ -493,7 +473,6 @@ export default function ({ getService }: FtrProviderContext) {
 
         const oidcAuthenticationResponse = await supertest
           .get(`/api/security/oidc/callback?code=code1&state=${stateAndNonce.state}`)
-          .set('kbn-xsrf', 'xxx')
           .set('Cookie', handshakeCookie.cookieString())
           .expect(302);
 
@@ -569,18 +548,13 @@ export default function ({ getService }: FtrProviderContext) {
 
       beforeEach(async () => {
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
-          .send({
-            providerType: 'oidc',
-            providerName: 'oidc',
-            currentURL:
-              'https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=oidc&providerName=oidc#/workpad',
-          })
-          .expect(200);
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
+          .expect(302);
 
         const handshakeCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
-        const stateAndNonce = getStateAndNonce(handshakeResponse.body.location);
+        const stateAndNonce = getStateAndNonce(handshakeResponse.headers.location);
         // Set the nonce in our mock OIDC Provider so that it can generate the ID Tokens
         await supertest
           .post('/api/oidc_provider/setup')
@@ -590,7 +564,6 @@ export default function ({ getService }: FtrProviderContext) {
 
         const oidcAuthenticationResponse = await supertest
           .get(`/api/security/oidc/callback?code=code1&state=${stateAndNonce.state}`)
-          .set('kbn-xsrf', 'xxx')
           .set('Cookie', handshakeCookie.cookieString())
           .expect(302);
 
@@ -612,16 +585,11 @@ export default function ({ getService }: FtrProviderContext) {
         expect(esResponse.body).to.have.property('deleted').greaterThan(0);
 
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
           .set('Cookie', sessionCookie.cookieString())
-          .send({
-            providerType: 'oidc',
-            providerName: 'oidc',
-            currentURL:
-              'https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=oidc&providerName=oidc#/workpad',
-          })
-          .expect(200);
+          .expect(302);
 
         const cookies = handshakeResponse.headers['set-cookie'];
         expect(cookies).to.have.length(1);
@@ -632,7 +600,10 @@ export default function ({ getService }: FtrProviderContext) {
         expect(handshakeCookie.path).to.be('/');
         expect(handshakeCookie.httpOnly).to.be(true);
 
-        const redirectURL = url.parse(handshakeResponse.body.location, true /* parseQueryString */);
+        const redirectURL = url.parse(
+          handshakeResponse.headers.location,
+          true /* parseQueryString */
+        );
         expect(
           redirectURL.href!.startsWith(`https://test-op.elastic.co/oauth2/v1/authorize`)
         ).to.be(true);
diff --git a/x-pack/test/security_api_integration/tests/oidc/implicit_flow/oidc_auth.ts b/x-pack/test/security_api_integration/tests/oidc/implicit_flow/oidc_auth.ts
index 8f5eb1edba391..b3a04747125e2 100644
--- a/x-pack/test/security_api_integration/tests/oidc/implicit_flow/oidc_auth.ts
+++ b/x-pack/test/security_api_integration/tests/oidc/implicit_flow/oidc_auth.ts
@@ -83,32 +83,39 @@ export default function ({ getService }: FtrProviderContext) {
         const { idToken, accessToken } = createTokens('1', stateAndNonce.nonce);
         const authenticationResponse = `https://kibana.com/api/security/oidc/implicit#id_token=${idToken}&state=${stateAndNonce.state}&token_type=bearer&access_token=${accessToken}`;
 
-        await supertest
+        const unauthenticatedResponse = await supertest
           .get(
             `/api/security/oidc/callback?authenticationResponseURI=${encodeURIComponent(
               authenticationResponse
             )}`
           )
-          .set('kbn-xsrf', 'xxx')
           .expect(401);
+
+        expect(unauthenticatedResponse.headers['content-security-policy']).to.be(
+          `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
+        );
+        expect(unauthenticatedResponse.text).to.contain('We couldn&#x27;t log you in');
       });
 
       it('should fail if state is not matching', async () => {
         const { idToken, accessToken } = createTokens('1', stateAndNonce.nonce);
         const authenticationResponse = `https://kibana.com/api/security/oidc/implicit#id_token=${idToken}&state=$someothervalue&token_type=bearer&access_token=${accessToken}`;
 
-        await supertest
+        const unauthenticatedResponse = await supertest
           .get(
             `/api/security/oidc/callback?authenticationResponseURI=${encodeURIComponent(
               authenticationResponse
             )}`
           )
-          .set('kbn-xsrf', 'xxx')
           .set('Cookie', handshakeCookie.cookieString())
           .expect(401);
+
+        expect(unauthenticatedResponse.headers['content-security-policy']).to.be(
+          `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
+        );
+        expect(unauthenticatedResponse.text).to.contain('We couldn&#x27;t log you in');
       });
 
-      // FLAKY: https://github.com/elastic/kibana/issues/43938
       it('should succeed if both the OpenID Connect response and the cookie are provided', async () => {
         const { idToken, accessToken } = createTokens('1', stateAndNonce.nonce);
         const authenticationResponse = `https://kibana.com/api/security/oidc/implicit#id_token=${idToken}&state=${stateAndNonce.state}&token_type=bearer&access_token=${accessToken}`;
@@ -119,7 +126,6 @@ export default function ({ getService }: FtrProviderContext) {
               authenticationResponse
             )}`
           )
-          .set('kbn-xsrf', 'xxx')
           .set('Cookie', handshakeCookie.cookieString())
           .expect(302);
 
diff --git a/x-pack/test/security_api_integration/tests/pki/pki_auth.ts b/x-pack/test/security_api_integration/tests/pki/pki_auth.ts
index 6eca9c354e248..dc2c66721f42a 100644
--- a/x-pack/test/security_api_integration/tests/pki/pki_auth.ts
+++ b/x-pack/test/security_api_integration/tests/pki/pki_auth.ts
@@ -62,7 +62,21 @@ export default function ({ getService }: FtrProviderContext) {
         .ca(CA_CERT)
         .pfx(UNTRUSTED_CLIENT_CERT)
         .set('kbn-xsrf', 'xxx')
+        .expect(401, { statusCode: 401, error: 'Unauthorized', message: 'Unauthorized' });
+    });
+
+    it('should fail and redirect if untrusted certificate is used', async () => {
+      // Unlike the call to '/internal/security/me' above, this route can be redirected (see pre-response in `AuthenticationService`).
+      const unauthenticatedResponse = await supertest
+        .get('/security/account')
+        .ca(CA_CERT)
+        .pfx(UNTRUSTED_CLIENT_CERT)
         .expect(401);
+
+      expect(unauthenticatedResponse.headers['content-security-policy']).to.be(
+        `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
+      );
+      expect(unauthenticatedResponse.text).to.contain('We couldn&#x27;t log you in');
     });
 
     it('does not prevent basic login', async () => {
@@ -319,7 +333,7 @@ export default function ({ getService }: FtrProviderContext) {
           .expect(302);
 
         expect(logoutResponse.headers['set-cookie']).to.be(undefined);
-        expect(logoutResponse.headers.location).to.be('/');
+        expect(logoutResponse.headers.location).to.be('/security/logged_out?msg=LOGGED_OUT');
       });
     });
 
diff --git a/x-pack/test/security_api_integration/tests/saml/saml_login.ts b/x-pack/test/security_api_integration/tests/saml/saml_login.ts
index 0a76628418c5e..d5fb1e79f80dc 100644
--- a/x-pack/test/security_api_integration/tests/saml/saml_login.ts
+++ b/x-pack/test/security_api_integration/tests/saml/saml_login.ts
@@ -74,7 +74,10 @@ export default function ({ getService }: FtrProviderContext) {
 
   describe('SAML authentication', () => {
     it('should reject API requests if client is not authenticated', async () => {
-      await supertest.get('/internal/security/me').set('kbn-xsrf', 'xxx').expect(401);
+      await supertest
+        .get('/internal/security/me')
+        .set('kbn-xsrf', 'xxx')
+        .expect(401, { statusCode: 401, error: 'Unauthorized', message: 'Unauthorized' });
     });
 
     it('does not prevent basic login', async () => {
@@ -112,20 +115,16 @@ export default function ({ getService }: FtrProviderContext) {
 
         expect(handshakeResponse.headers['set-cookie']).to.be(undefined);
         expect(handshakeResponse.headers.location).to.be(
-          '/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=saml&providerName=saml'
+          '/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2Bthree%26auth_provider_hint%3Dsaml'
         );
       });
 
       it('should properly set cookie and redirect user to IdP', async () => {
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
-          .send({
-            providerType: 'saml',
-            providerName: 'saml',
-            currentURL: `https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=saml&providerName=saml#/workpad`,
-          })
-          .expect(200);
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
+          .expect(302);
 
         const cookies = handshakeResponse.headers['set-cookie'];
         expect(cookies).to.have.length(1);
@@ -136,21 +135,20 @@ export default function ({ getService }: FtrProviderContext) {
         expect(handshakeCookie.path).to.be('/');
         expect(handshakeCookie.httpOnly).to.be(true);
 
-        const redirectURL = url.parse(handshakeResponse.body.location, true /* parseQueryString */);
+        const redirectURL = url.parse(
+          handshakeResponse.headers.location,
+          true /* parseQueryString */
+        );
         expect(redirectURL.href!.startsWith(`https://elastic.co/sso/saml`)).to.be(true);
         expect(redirectURL.query.SAMLRequest).to.not.be.empty();
       });
 
       it('should not allow access to the API with the handshake cookie', async () => {
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
-          .send({
-            providerType: 'saml',
-            providerName: 'saml',
-            currentURL: `https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=saml&providerName=saml#/workpad`,
-          })
-          .expect(200);
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
+          .expect(302);
 
         const handshakeCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
         await supertest
@@ -176,39 +174,37 @@ export default function ({ getService }: FtrProviderContext) {
 
       beforeEach(async () => {
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
-          .send({
-            providerType: 'saml',
-            providerName: 'saml',
-            currentURL:
-              'https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=saml&providerName=saml#/workpad',
-          })
-          .expect(200);
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
+          .expect(302);
 
         handshakeCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
-        samlRequestId = await getSAMLRequestId(handshakeResponse.body.location);
+        samlRequestId = await getSAMLRequestId(handshakeResponse.headers.location);
       });
 
       it('should fail if SAML response is not complemented with handshake cookie', async () => {
-        await supertest
+        const unauthenticatedResponse = await supertest
           .post('/api/security/saml/callback')
-          .set('kbn-xsrf', 'xxx')
           .send({ SAMLResponse: await createSAMLResponse({ inResponseTo: samlRequestId }) })
           .expect(401);
+
+        expect(unauthenticatedResponse.headers['content-security-policy']).to.be(
+          `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
+        );
+        expect(unauthenticatedResponse.text).to.contain('We couldn&#x27;t log you in');
       });
 
       it('should succeed if both SAML response and handshake cookie are provided', async () => {
         const samlAuthenticationResponse = await supertest
           .post('/api/security/saml/callback')
-          .set('kbn-xsrf', 'xxx')
           .set('Cookie', handshakeCookie.cookieString())
           .send({ SAMLResponse: await createSAMLResponse({ inResponseTo: samlRequestId }) })
           .expect(302);
 
         // User should be redirected to the URL that initiated handshake.
         expect(samlAuthenticationResponse.headers.location).to.be(
-          '/abc/xyz/handshake?one=two%20three#/workpad'
+          '/abc/xyz/handshake?one=two+three#/workpad'
         );
 
         const cookies = samlAuthenticationResponse.headers['set-cookie'];
@@ -221,7 +217,6 @@ export default function ({ getService }: FtrProviderContext) {
         // Don't pass handshake cookie and don't include `inResponseTo` into SAML response to simulate IdP initiated login.
         const samlAuthenticationResponse = await supertest
           .post('/api/security/saml/callback')
-          .set('kbn-xsrf', 'xxx')
           .send({ SAMLResponse: await createSAMLResponse() })
           .expect(302);
 
@@ -235,14 +230,18 @@ export default function ({ getService }: FtrProviderContext) {
       });
 
       it('should fail if SAML response is not valid', async () => {
-        await supertest
+        const unauthenticatedResponse = await supertest
           .post('/api/security/saml/callback')
-          .set('kbn-xsrf', 'xxx')
           .set('Cookie', handshakeCookie.cookieString())
           .send({
             SAMLResponse: await createSAMLResponse({ inResponseTo: 'some-invalid-request-id' }),
           })
           .expect(401);
+
+        expect(unauthenticatedResponse.headers['content-security-policy']).to.be(
+          `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
+        );
+        expect(unauthenticatedResponse.text).to.contain('We couldn&#x27;t log you in');
       });
     });
 
@@ -253,7 +252,6 @@ export default function ({ getService }: FtrProviderContext) {
         // Imitate IdP initiated login.
         const samlAuthenticationResponse = await supertest
           .post('/api/security/saml/callback')
-          .set('kbn-xsrf', 'xxx')
           .send({ SAMLResponse: await createSAMLResponse() })
           .expect(302);
 
@@ -315,23 +313,17 @@ export default function ({ getService }: FtrProviderContext) {
 
       beforeEach(async () => {
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
-          .send({
-            providerType: 'saml',
-            providerName: 'saml',
-            currentURL:
-              'https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=saml&providerName=saml#/workpad',
-          })
-          .expect(200);
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
+          .expect(302);
 
         const handshakeCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
-        const samlRequestId = await getSAMLRequestId(handshakeResponse.body.location);
+        const samlRequestId = await getSAMLRequestId(handshakeResponse.headers.location);
 
         idpSessionIndex = String(randomness.naturalNumber());
         const samlAuthenticationResponse = await supertest
           .post('/api/security/saml/callback')
-          .set('kbn-xsrf', 'xxx')
           .set('Cookie', handshakeCookie.cookieString())
           .send({
             SAMLResponse: await createSAMLResponse({
@@ -372,11 +364,11 @@ export default function ({ getService }: FtrProviderContext) {
           .expect(401);
       });
 
-      it('should redirect to home page if session cookie is not provided', async () => {
+      it('should redirect to `logged_out` page if session cookie is not provided', async () => {
         const logoutResponse = await supertest.get('/api/security/logout').expect(302);
 
         expect(logoutResponse.headers['set-cookie']).to.be(undefined);
-        expect(logoutResponse.headers.location).to.be('/');
+        expect(logoutResponse.headers.location).to.be('/security/logged_out?msg=LOGGED_OUT');
       });
 
       it('should reject AJAX requests', async () => {
@@ -459,22 +451,16 @@ export default function ({ getService }: FtrProviderContext) {
         this.timeout(40000);
 
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
-          .send({
-            providerType: 'saml',
-            providerName: 'saml',
-            currentURL:
-              'https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=saml&providerName=saml#/workpad',
-          })
-          .expect(200);
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
+          .expect(302);
 
         const handshakeCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
-        const samlRequestId = await getSAMLRequestId(handshakeResponse.body.location);
+        const samlRequestId = await getSAMLRequestId(handshakeResponse.headers.location);
 
         const samlAuthenticationResponse = await supertest
           .post('/api/security/saml/callback')
-          .set('kbn-xsrf', 'xxx')
           .set('Cookie', handshakeCookie.cookieString())
           .send({ SAMLResponse: await createSAMLResponse({ inResponseTo: samlRequestId }) })
           .expect(302);
@@ -559,22 +545,16 @@ export default function ({ getService }: FtrProviderContext) {
 
       beforeEach(async () => {
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
-          .send({
-            providerType: 'saml',
-            providerName: 'saml',
-            currentURL:
-              'https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=saml&providerName=saml#/workpad',
-          })
-          .expect(200);
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
+          .expect(302);
 
         const handshakeCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
-        const samlRequestId = await getSAMLRequestId(handshakeResponse.body.location);
+        const samlRequestId = await getSAMLRequestId(handshakeResponse.headers.location);
 
         const samlAuthenticationResponse = await supertest
           .post('/api/security/saml/callback')
-          .set('kbn-xsrf', 'xxx')
           .set('Cookie', handshakeCookie.cookieString())
           .send({ SAMLResponse: await createSAMLResponse({ inResponseTo: samlRequestId }) })
           .expect(302);
@@ -609,21 +589,16 @@ export default function ({ getService }: FtrProviderContext) {
         expect(handshakeCookie.maxAge).to.be(0);
 
         expect(handshakeResponse.headers.location).to.be(
-          '/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=saml&providerName=saml'
+          '/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2Bthree%26auth_provider_hint%3Dsaml'
         );
       });
 
       it('should properly set cookie and redirect user to IdP', async () => {
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
-          .set('Cookie', sessionCookie.cookieString())
-          .send({
-            providerType: 'saml',
-            providerName: 'saml',
-            currentURL: `https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=saml&providerName=saml#/workpad`,
-          })
-          .expect(200);
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
+          .expect(302);
 
         const cookies = handshakeResponse.headers['set-cookie'];
         expect(cookies).to.have.length(1);
@@ -634,7 +609,10 @@ export default function ({ getService }: FtrProviderContext) {
         expect(handshakeCookie.path).to.be('/');
         expect(handshakeCookie.httpOnly).to.be(true);
 
-        const redirectURL = url.parse(handshakeResponse.body.location, true /* parseQueryString */);
+        const redirectURL = url.parse(
+          handshakeResponse.headers.location,
+          true /* parseQueryString */
+        );
         expect(redirectURL.href!.startsWith(`https://elastic.co/sso/saml`)).to.be(true);
         expect(redirectURL.query.SAMLRequest).to.not.be.empty();
       });
@@ -680,21 +658,16 @@ export default function ({ getService }: FtrProviderContext) {
 
       beforeEach(async () => {
         const handshakeResponse = await supertest
-          .post('/internal/security/login')
-          .set('kbn-xsrf', 'xxx')
-          .send({
-            providerType: 'saml',
-            providerName: 'saml',
-            currentURL: `https://kibana.com/internal/security/capture-url?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three&providerType=saml&providerName=saml#/workpad`,
-          })
-          .expect(200);
+          .get(
+            '/abc/xyz/handshake?one=two three&auth_provider_hint=saml&auth_url_hash=%23%2Fworkpad'
+          )
+          .expect(302);
 
         const handshakeCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
-        const samlRequestId = await getSAMLRequestId(handshakeResponse.body.location);
+        const samlRequestId = await getSAMLRequestId(handshakeResponse.headers.location);
 
         const samlAuthenticationResponse = await supertest
           .post('/api/security/saml/callback')
-          .set('kbn-xsrf', 'xxx')
           .set('Cookie', handshakeCookie.cookieString())
           .send({
             SAMLResponse: await createSAMLResponse({
@@ -715,7 +688,6 @@ export default function ({ getService }: FtrProviderContext) {
 
           const samlAuthenticationResponse = await supertest
             .post('/api/security/saml/callback')
-            .set('kbn-xsrf', 'xxx')
             .set('Cookie', existingSessionCookie.cookieString())
             .send({ SAMLResponse: await createSAMLResponse({ username: existingUsername }) })
             .expect(302);
@@ -745,7 +717,6 @@ export default function ({ getService }: FtrProviderContext) {
           const newUsername = 'c@d.e';
           const samlAuthenticationResponse = await supertest
             .post('/api/security/saml/callback')
-            .set('kbn-xsrf', 'xxx')
             .set('Cookie', existingSessionCookie.cookieString())
             .send({ SAMLResponse: await createSAMLResponse({ username: newUsername }) })
             .expect(302);
diff --git a/x-pack/test/security_functional/fixtures/common/test_endpoints/kibana.json b/x-pack/test/security_functional/fixtures/common/test_endpoints/kibana.json
new file mode 100644
index 0000000000000..89b7725fe2b4e
--- /dev/null
+++ b/x-pack/test/security_functional/fixtures/common/test_endpoints/kibana.json
@@ -0,0 +1,7 @@
+{
+  "id": "securityTestEndpoints",
+  "version": "8.0.0",
+  "kibanaVersion": "kibana",
+  "server": true,
+  "ui": true
+}
diff --git a/x-pack/test/security_functional/fixtures/common/test_endpoints/public/index.ts b/x-pack/test/security_functional/fixtures/common/test_endpoints/public/index.ts
new file mode 100644
index 0000000000000..d4ed6597651fb
--- /dev/null
+++ b/x-pack/test/security_functional/fixtures/common/test_endpoints/public/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { TestEndpointsPlugin } from './plugin';
+export const plugin = () => new TestEndpointsPlugin();
diff --git a/x-pack/test/security_functional/fixtures/common/test_endpoints/public/plugin.tsx b/x-pack/test/security_functional/fixtures/common/test_endpoints/public/plugin.tsx
new file mode 100644
index 0000000000000..2796d64c01a58
--- /dev/null
+++ b/x-pack/test/security_functional/fixtures/common/test_endpoints/public/plugin.tsx
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { CoreSetup, Plugin } from 'src/core/public';
+import ReactDOM from 'react-dom';
+import React from 'react';
+
+export class TestEndpointsPlugin implements Plugin {
+  public setup(core: CoreSetup) {
+    core.application.register({
+      id: 'authentication_app',
+      title: 'Authentication app',
+      appRoute: '/authentication/app',
+      async mount({ element }) {
+        ReactDOM.render(
+          <div data-test-subj="testEndpointsAuthenticationApp">Authenticated!</div>,
+          element
+        );
+        return () => ReactDOM.unmountComponentAtNode(element);
+      },
+    });
+  }
+  public start() {}
+  public stop() {}
+}
diff --git a/x-pack/test/security_functional/fixtures/common/test_endpoints/server/index.ts b/x-pack/test/security_functional/fixtures/common/test_endpoints/server/index.ts
new file mode 100644
index 0000000000000..4ae669256d3a8
--- /dev/null
+++ b/x-pack/test/security_functional/fixtures/common/test_endpoints/server/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { PluginInitializer } from '../../../../../../../src/core/server';
+import { initRoutes } from './init_routes';
+
+export const plugin: PluginInitializer<void, void> = () => ({
+  setup: (core) => initRoutes(core),
+  start: () => {},
+  stop: () => {},
+});
diff --git a/x-pack/test/security_functional/fixtures/common/test_endpoints/server/init_routes.ts b/x-pack/test/security_functional/fixtures/common/test_endpoints/server/init_routes.ts
new file mode 100644
index 0000000000000..378ab8a90c29a
--- /dev/null
+++ b/x-pack/test/security_functional/fixtures/common/test_endpoints/server/init_routes.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { CoreSetup } from '../../../../../../../src/core/server';
+
+export function initRoutes(core: CoreSetup) {
+  const authenticationAppOptions = { simulateUnauthorized: false };
+  core.http.resources.register(
+    {
+      path: '/authentication/app',
+      validate: false,
+    },
+    async (context, request, response) => {
+      if (authenticationAppOptions.simulateUnauthorized) {
+        return response.unauthorized();
+      }
+      return response.renderCoreApp();
+    }
+  );
+
+  const router = core.http.createRouter();
+  router.post(
+    {
+      path: '/authentication/app/setup',
+      validate: { body: schema.object({ simulateUnauthorized: schema.boolean() }) },
+      options: { authRequired: false, xsrfRequired: false },
+    },
+    (context, request, response) => {
+      authenticationAppOptions.simulateUnauthorized = request.body.simulateUnauthorized;
+      return response.ok();
+    }
+  );
+}
diff --git a/x-pack/test/security_functional/login_selector.config.ts b/x-pack/test/security_functional/login_selector.config.ts
index 39f797c488e00..6f7a2a8b3de70 100644
--- a/x-pack/test/security_functional/login_selector.config.ts
+++ b/x-pack/test/security_functional/login_selector.config.ts
@@ -30,6 +30,8 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     '../security_api_integration/fixtures/saml/saml_provider'
   );
 
+  const testEndpointsPlugin = resolve(__dirname, './fixtures/common/test_endpoints');
+
   return {
     testFiles: [resolve(__dirname, './tests/login_selector')],
 
@@ -59,6 +61,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
       serverArgs: [
         ...kibanaCommonConfig.get('kbnTestServer.serverArgs'),
         `--plugin-path=${samlIdPPlugin}`,
+        `--plugin-path=${testEndpointsPlugin}`,
         '--server.uuid=5b2de169-2785-441b-ae8c-186a1936b17d',
         '--xpack.security.encryptionKey="wuGNaIhoMpk5sO4UBxgr3NyW1sFcLgIf"',
         `--xpack.security.loginHelp="Some-login-help."`,
diff --git a/x-pack/test/security_functional/oidc.config.ts b/x-pack/test/security_functional/oidc.config.ts
index dcf9177eb52b1..056d7b8197c9a 100644
--- a/x-pack/test/security_functional/oidc.config.ts
+++ b/x-pack/test/security_functional/oidc.config.ts
@@ -27,6 +27,8 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     '../security_api_integration/fixtures/oidc/oidc_provider'
   );
 
+  const testEndpointsPlugin = resolve(__dirname, './fixtures/common/test_endpoints');
+
   return {
     testFiles: [resolve(__dirname, './tests/oidc')],
 
@@ -61,6 +63,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
       serverArgs: [
         ...kibanaCommonConfig.get('kbnTestServer.serverArgs'),
         `--plugin-path=${oidcOpPPlugin}`,
+        `--plugin-path=${testEndpointsPlugin}`,
         '--server.uuid=5b2de169-2785-441b-ae8c-186a1936b17d',
         '--xpack.security.encryptionKey="wuGNaIhoMpk5sO4UBxgr3NyW1sFcLgIf"',
         '--xpack.security.authc.selector.enabled=false',
diff --git a/x-pack/test/security_functional/saml.config.ts b/x-pack/test/security_functional/saml.config.ts
index 3715b826824e1..50948ce6d411e 100644
--- a/x-pack/test/security_functional/saml.config.ts
+++ b/x-pack/test/security_functional/saml.config.ts
@@ -30,6 +30,8 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     '../security_api_integration/fixtures/saml/saml_provider'
   );
 
+  const testEndpointsPlugin = resolve(__dirname, './fixtures/common/test_endpoints');
+
   return {
     testFiles: [resolve(__dirname, './tests/saml')],
 
@@ -58,6 +60,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
       serverArgs: [
         ...kibanaCommonConfig.get('kbnTestServer.serverArgs'),
         `--plugin-path=${samlIdPPlugin}`,
+        `--plugin-path=${testEndpointsPlugin}`,
         '--server.uuid=5b2de169-2785-441b-ae8c-186a1936b17d',
         '--xpack.security.encryptionKey="wuGNaIhoMpk5sO4UBxgr3NyW1sFcLgIf"',
         '--xpack.security.authc.selector.enabled=false',
diff --git a/x-pack/test/security_functional/tests/login_selector/basic_functionality.ts b/x-pack/test/security_functional/tests/login_selector/basic_functionality.ts
index 1561aa6cb47fd..ca6b9497b194e 100644
--- a/x-pack/test/security_functional/tests/login_selector/basic_functionality.ts
+++ b/x-pack/test/security_functional/tests/login_selector/basic_functionality.ts
@@ -20,17 +20,25 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   describe('Basic functionality', function () {
     this.tags('includeFirefox');
 
+    const testCredentials = { username: 'admin_user', password: 'change_me' };
     before(async () => {
       await getService('esSupertest')
         .post('/_security/role_mapping/saml1')
         .send({ roles: ['superuser'], enabled: true, rules: { field: { 'realm.name': 'saml1' } } })
         .expect(200);
 
+      await security.user.create(testCredentials.username, {
+        password: testCredentials.password,
+        roles: ['kibana_admin'],
+        full_name: 'Admin',
+      });
+
       await esArchiver.load('../../functional/es_archives/empty_kibana');
       await PageObjects.security.forceLogout();
     });
 
     after(async () => {
+      await security.user.delete(testCredentials.username);
       await esArchiver.unload('../../functional/es_archives/empty_kibana');
     });
 
@@ -95,6 +103,58 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       expect(currentURL.pathname).to.eql('/app/management/security/users');
     });
 
+    it('can login after `Unauthorized` error after request authentication preserving original URL', async () => {
+      await getService('supertest')
+        .post('/authentication/app/setup')
+        .send({ simulateUnauthorized: true })
+        .expect(200);
+      await PageObjects.security.loginSelector.login('basic', 'basic1');
+      await browser.get(`${deployment.getHostPort()}/authentication/app?one=two`);
+
+      await PageObjects.security.loginSelector.verifyLoginSelectorIsVisible();
+      expect(await PageObjects.security.loginPage.getErrorMessage()).to.be(
+        "We hit an authentication error. Please check your credentials and try again. If you still can't log in, contact your system administrator."
+      );
+
+      await getService('supertest')
+        .post('/authentication/app/setup')
+        .send({ simulateUnauthorized: false })
+        .expect(200);
+      await PageObjects.security.loginSelector.login('basic', 'basic1');
+
+      const currentURL = parse(await browser.getCurrentUrl());
+      expect(currentURL.path).to.eql('/authentication/app?one=two');
+    });
+
+    it('can login after `Unauthorized` error during request authentication preserving original URL', async () => {
+      // 1. Navigate to Kibana to make sure user is properly authenticated.
+      await PageObjects.common.navigateToUrl('management', 'security/users', {
+        ensureCurrentUrl: false,
+        shouldLoginIfPrompted: false,
+        shouldUseHashForSubUrl: false,
+      });
+      await PageObjects.security.loginSelector.verifyLoginSelectorIsVisible();
+      await PageObjects.security.loginSelector.login('basic', 'basic1', testCredentials);
+      expect(parse(await browser.getCurrentUrl()).pathname).to.eql(
+        '/app/management/security/users'
+      );
+
+      // 2. Now disable user and try to refresh page causing authentication to fail.
+      await security.user.disable(testCredentials.username);
+      await browser.refresh();
+      await PageObjects.security.loginSelector.verifyLoginSelectorIsVisible();
+      expect(await PageObjects.security.loginPage.getErrorMessage()).to.be(
+        "We hit an authentication error. Please check your credentials and try again. If you still can't log in, contact your system administrator."
+      );
+
+      // 3. Re-enable user and try to login again.
+      await security.user.enable(testCredentials.username);
+      await PageObjects.security.loginSelector.login('basic', 'basic1', testCredentials);
+      expect(parse(await browser.getCurrentUrl()).pathname).to.eql(
+        '/app/management/security/users'
+      );
+    });
+
     it('should show toast with error if SSO fails', async () => {
       await PageObjects.security.loginSelector.selectLoginMethod('saml', 'unknown_saml');
 
diff --git a/x-pack/test/security_functional/tests/oidc/url_capture.ts b/x-pack/test/security_functional/tests/oidc/url_capture.ts
index 968e1001a5f56..b72aab33034c5 100644
--- a/x-pack/test/security_functional/tests/oidc/url_capture.ts
+++ b/x-pack/test/security_functional/tests/oidc/url_capture.ts
@@ -14,6 +14,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const find = getService('find');
   const browser = getService('browser');
   const deployment = getService('deployment');
+  const testSubjects = getService('testSubjects');
   const PageObjects = getPageObjects(['common']);
 
   describe('URL capture', function () {
@@ -52,5 +53,25 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       expect(currentURL.pathname).to.eql('/app/management/security/users');
       expect(currentURL.hash).to.eql('#some=hash-value');
     });
+
+    it('can login after `Unauthorized` error preserving original URL', async () => {
+      await getService('supertest')
+        .post('/authentication/app/setup')
+        .send({ simulateUnauthorized: true })
+        .expect(200);
+      await browser.get(`${deployment.getHostPort()}/authentication/app?one=two`);
+
+      await find.byCssSelector('[data-test-subj="promptPage"]', 20000);
+      await getService('supertest')
+        .post('/authentication/app/setup')
+        .send({ simulateUnauthorized: false })
+        .expect(200);
+
+      await testSubjects.click('logInButton');
+      await find.byCssSelector('[data-test-subj="testEndpointsAuthenticationApp"]', 20000);
+
+      const currentURL = parse(await browser.getCurrentUrl());
+      expect(currentURL.path).to.eql('/authentication/app?one=two');
+    });
   });
 }
diff --git a/x-pack/test/security_functional/tests/saml/url_capture.ts b/x-pack/test/security_functional/tests/saml/url_capture.ts
index 80f6528334cc0..09eee12813601 100644
--- a/x-pack/test/security_functional/tests/saml/url_capture.ts
+++ b/x-pack/test/security_functional/tests/saml/url_capture.ts
@@ -14,6 +14,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const find = getService('find');
   const browser = getService('browser');
   const deployment = getService('deployment');
+  const testSubjects = getService('testSubjects');
   const PageObjects = getPageObjects(['common']);
 
   describe('URL capture', function () {
@@ -52,5 +53,25 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       expect(currentURL.pathname).to.eql('/app/management/security/users');
       expect(currentURL.hash).to.eql('#some=hash-value');
     });
+
+    it('can login after `Unauthorized` error preserving original URL', async () => {
+      await getService('supertest')
+        .post('/authentication/app/setup')
+        .send({ simulateUnauthorized: true })
+        .expect(200);
+      await browser.get(`${deployment.getHostPort()}/authentication/app?one=two`);
+
+      await find.byCssSelector('[data-test-subj="promptPage"]', 20000);
+      await getService('supertest')
+        .post('/authentication/app/setup')
+        .send({ simulateUnauthorized: false })
+        .expect(200);
+
+      await testSubjects.click('logInButton');
+      await find.byCssSelector('[data-test-subj="testEndpointsAuthenticationApp"]', 20000);
+
+      const currentURL = parse(await browser.getCurrentUrl());
+      expect(currentURL.path).to.eql('/authentication/app?one=two');
+    });
   });
 }

From 35bd88e754e5b813d474eb0d97a824816fe10f02 Mon Sep 17 00:00:00 2001
From: Domenico Andreoli <domenico.andreoli@elastic.co>
Date: Tue, 27 Apr 2021 19:12:23 +0200
Subject: [PATCH 05/28] [DOCS] Fix development tests table (#98309)

* Fix visualization of consecutive inline code blocks
* Remove trailing '_' from the correct script name
---
 docs/developer/contributing/development-tests.asciidoc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/developer/contributing/development-tests.asciidoc b/docs/developer/contributing/development-tests.asciidoc
index 7aabc480cdaa2..715b1a15ab5ed 100644
--- a/docs/developer/contributing/development-tests.asciidoc
+++ b/docs/developer/contributing/development-tests.asciidoc
@@ -19,7 +19,7 @@ root)
 
 |Functional
 |`test/**/config.js` `x-pack/test/**/config.js`
-|`node scripts/functional_tests_server --config [directory]/config.js``node scripts/functional_test_runner_ --config [directory]/config.js --grep=regexp`
+|`node scripts/functional_tests_server --config [directory]/config.js` `node scripts/functional_test_runner --config [directory]/config.js --grep=regexp`
 |===
 
 Test runner arguments: - Where applicable, the optional arguments

From b0486caefdbdb0dc7a7f80082d030bded8d46ba2 Mon Sep 17 00:00:00 2001
From: Melissa Alvarez <melissa.alvarez@elastic.co>
Date: Tue, 27 Apr 2021 13:21:01 -0400
Subject: [PATCH 06/28] ensure map supports old source index metadata (#98483)

---
 .../ml/server/models/data_frame_analytics/analytics_manager.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/ml/server/models/data_frame_analytics/analytics_manager.ts b/x-pack/plugins/ml/server/models/data_frame_analytics/analytics_manager.ts
index 7deb392467df5..a9c1d95d933a9 100644
--- a/x-pack/plugins/ml/server/models/data_frame_analytics/analytics_manager.ts
+++ b/x-pack/plugins/ml/server/models/data_frame_analytics/analytics_manager.ts
@@ -445,7 +445,8 @@ export class AnalyticsManager {
             // Check meta data
             if (
               link.isWildcardIndexPattern === false &&
-              (link.meta === undefined || link.meta?.created_by === INDEX_META_DATA_CREATED_BY)
+              (link.meta === undefined ||
+                link.meta?.created_by.includes(INDEX_META_DATA_CREATED_BY))
             ) {
               rootIndexPattern = nextLinkId;
               complete = true;

From 7c043dc3dea8c92d98c9c80e7177fee9e9fe1eac Mon Sep 17 00:00:00 2001
From: Tiago Costa <tiagoffcc@hotmail.com>
Date: Tue, 27 Apr 2021 18:44:41 +0100
Subject: [PATCH 07/28] chore(NA): moving @kbn/apm-config-loader into bazel
 (#98323)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../monorepo-packages.asciidoc                |  1 +
 package.json                                  |  2 +-
 packages/BUILD.bazel                          |  1 +
 packages/kbn-apm-config-loader/BUILD.bazel    | 87 +++++++++++++++++++
 packages/kbn-apm-config-loader/package.json   |  7 +-
 packages/kbn-apm-config-loader/tsconfig.json  |  3 +-
 yarn.lock                                     |  2 +-
 7 files changed, 94 insertions(+), 9 deletions(-)
 create mode 100644 packages/kbn-apm-config-loader/BUILD.bazel

diff --git a/docs/developer/getting-started/monorepo-packages.asciidoc b/docs/developer/getting-started/monorepo-packages.asciidoc
index 6e2d41e5ed679..d2c24a9e4944f 100644
--- a/docs/developer/getting-started/monorepo-packages.asciidoc
+++ b/docs/developer/getting-started/monorepo-packages.asciidoc
@@ -63,6 +63,7 @@ yarn kbn watch-bazel
 
 - @elastic/datemath
 - @elastic/safer-lodash-set
+- @kbn/apm-config-loader
 - @kbn/apm-utils
 - @kbn/babel-code-parser
 - @kbn/babel-preset
diff --git a/package.json b/package.json
index 24355e25f6a8b..0a23be6779a7d 100644
--- a/package.json
+++ b/package.json
@@ -123,7 +123,7 @@
     "@hapi/wreck": "^17.1.0",
     "@kbn/ace": "link:packages/kbn-ace",
     "@kbn/analytics": "link:packages/kbn-analytics",
-    "@kbn/apm-config-loader": "link:packages/kbn-apm-config-loader",
+    "@kbn/apm-config-loader": "link:bazel-bin/packages/kbn-apm-config-loader/npm_module",
     "@kbn/apm-utils": "link:bazel-bin/packages/kbn-apm-utils/npm_module",
     "@kbn/config": "link:packages/kbn-config",
     "@kbn/config-schema": "link:bazel-bin/packages/kbn-config-schema/npm_module",
diff --git a/packages/BUILD.bazel b/packages/BUILD.bazel
index 902c2804ee012..a355d537f06a1 100644
--- a/packages/BUILD.bazel
+++ b/packages/BUILD.bazel
@@ -5,6 +5,7 @@ filegroup(
   srcs = [
       "//packages/elastic-datemath:build",
       "//packages/elastic-safer-lodash-set:build",
+      "//packages/kbn-apm-config-loader:build",
       "//packages/kbn-apm-utils:build",
       "//packages/kbn-babel-code-parser:build",
       "//packages/kbn-babel-preset:build",
diff --git a/packages/kbn-apm-config-loader/BUILD.bazel b/packages/kbn-apm-config-loader/BUILD.bazel
new file mode 100644
index 0000000000000..58a86ccfcf018
--- /dev/null
+++ b/packages/kbn-apm-config-loader/BUILD.bazel
@@ -0,0 +1,87 @@
+load("@npm//@bazel/typescript:index.bzl", "ts_config", "ts_project")
+load("@build_bazel_rules_nodejs//:index.bzl", "js_library", "pkg_npm")
+
+PKG_BASE_NAME = "kbn-apm-config-loader"
+PKG_REQUIRE_NAME = "@kbn/apm-config-loader"
+
+SOURCE_FILES = glob(
+  [
+    "src/**/*.ts",
+  ],
+  exclude = [
+    "**/*.test.*"
+  ],
+)
+
+SRCS = SOURCE_FILES
+
+filegroup(
+  name = "srcs",
+  srcs = SRCS,
+)
+
+NPM_MODULE_EXTRA_FILES = [
+  "package.json",
+  "README.md"
+]
+
+SRC_DEPS = [
+  "//packages/elastic-safer-lodash-set",
+  "//packages/kbn-utils",
+  "@npm//js-yaml",
+  "@npm//lodash",
+]
+
+TYPES_DEPS = [
+  "@npm//@types/jest",
+  "@npm//@types/js-yaml",
+  "@npm//@types/lodash",
+  "@npm//@types/node",
+]
+
+DEPS = SRC_DEPS + TYPES_DEPS
+
+ts_config(
+  name = "tsconfig",
+  src = "tsconfig.json",
+  deps = [
+    "//:tsconfig.base.json",
+  ],
+)
+
+ts_project(
+  name = "tsc",
+  args = ['--pretty'],
+  srcs = SRCS,
+  deps = DEPS,
+  declaration = True,
+  declaration_map = True,
+  incremental = True,
+  out_dir = "target",
+  source_map = True,
+  root_dir = "src",
+  tsconfig = ":tsconfig",
+)
+
+js_library(
+  name = PKG_BASE_NAME,
+  srcs = NPM_MODULE_EXTRA_FILES,
+  deps = [":tsc"] + DEPS,
+  package_name = PKG_REQUIRE_NAME,
+  visibility = ["//visibility:public"],
+)
+
+pkg_npm(
+  name = "npm_module",
+  deps = [
+    ":%s" % PKG_BASE_NAME,
+  ]
+)
+
+filegroup(
+  name = "build",
+  srcs = [
+    ":npm_module",
+  ],
+  visibility = ["//visibility:public"],
+)
diff --git a/packages/kbn-apm-config-loader/package.json b/packages/kbn-apm-config-loader/package.json
index b9dc324ec5e78..c096ed2efb92a 100644
--- a/packages/kbn-apm-config-loader/package.json
+++ b/packages/kbn-apm-config-loader/package.json
@@ -4,10 +4,5 @@
   "types": "./target/index.d.ts",
   "version": "1.0.0",
   "license": "SSPL-1.0 OR Elastic License 2.0",
-  "private": true,
-  "scripts": {
-    "build": "../../node_modules/.bin/tsc",
-    "kbn:bootstrap": "yarn build",
-    "kbn:watch": "yarn build --watch"
-  }
+  "private": true
 }
\ No newline at end of file
diff --git a/packages/kbn-apm-config-loader/tsconfig.json b/packages/kbn-apm-config-loader/tsconfig.json
index 250195785b931..aa34b05061600 100644
--- a/packages/kbn-apm-config-loader/tsconfig.json
+++ b/packages/kbn-apm-config-loader/tsconfig.json
@@ -1,11 +1,12 @@
 {
   "extends": "../../tsconfig.base.json",
   "compilerOptions": {
-    "incremental": false,
+    "incremental": true,
     "outDir": "./target",
     "stripInternal": false,
     "declaration": true,
     "declarationMap": true,
+    "rootDir": "./src",
     "sourceMap": true,
     "sourceRoot": "../../../../packages/kbn-apm-config-loader/src",
     "types": [
diff --git a/yarn.lock b/yarn.lock
index 133f21a200f70..9302839004a33 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2577,7 +2577,7 @@
   version "0.0.0"
   uid ""
 
-"@kbn/apm-config-loader@link:packages/kbn-apm-config-loader":
+"@kbn/apm-config-loader@link:bazel-bin/packages/kbn-apm-config-loader/npm_module":
   version "0.0.0"
   uid ""
 

From afc4aef9d59074ba2f3a491ef6e0de223505aa73 Mon Sep 17 00:00:00 2001
From: Mikhail Shustov <restrry@gmail.com>
Date: Tue, 27 Apr 2021 20:01:07 +0200
Subject: [PATCH 08/28] Cleanup UI settings client API (#98248)

* remove unused overrideLocalDefault method

* remove unused getSasved$ method

* fix dashboard unit test

* update docs

* fix Security Solution unit test
---
 ...core-public.iuisettingsclient.getsaved_.md |  17 ---
 ...na-plugin-core-public.iuisettingsclient.md |   2 -
 ....iuisettingsclient.overridelocaldefault.md |  13 --
 src/core/public/public.api.md                 |   6 -
 .../ui_settings_client.test.ts.snap           |  75 -----------
 src/core/public/ui_settings/types.ts          |  16 ---
 .../ui_settings/ui_settings_client.test.ts    | 116 ------------------
 .../public/ui_settings/ui_settings_client.ts  |  30 -----
 .../ui_settings/ui_settings_service.mock.ts   |   3 -
 .../ui_settings/ui_settings_service.test.ts   |   7 +-
 .../management_app/advanced_settings.test.tsx |   1 -
 .../dashboard_empty_screen.test.tsx.snap      |   6 -
 .../header/__snapshots__/index.test.tsx.snap  |   2 -
 13 files changed, 1 insertion(+), 293 deletions(-)
 delete mode 100644 docs/development/core/public/kibana-plugin-core-public.iuisettingsclient.getsaved_.md
 delete mode 100644 docs/development/core/public/kibana-plugin-core-public.iuisettingsclient.overridelocaldefault.md

diff --git a/docs/development/core/public/kibana-plugin-core-public.iuisettingsclient.getsaved_.md b/docs/development/core/public/kibana-plugin-core-public.iuisettingsclient.getsaved_.md
deleted file mode 100644
index 953bb75625c97..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.iuisettingsclient.getsaved_.md
+++ /dev/null
@@ -1,17 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [IUiSettingsClient](./kibana-plugin-core-public.iuisettingsclient.md) &gt; [getSaved$](./kibana-plugin-core-public.iuisettingsclient.getsaved_.md)
-
-## IUiSettingsClient.getSaved$ property
-
-Returns an Observable that notifies subscribers of each update to the uiSettings, including the key, newValue, and oldValue of the setting that changed.
-
-<b>Signature:</b>
-
-```typescript
-getSaved$: <T = any>() => Observable<{
-        key: string;
-        newValue: T;
-        oldValue: T;
-    }>;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.iuisettingsclient.md b/docs/development/core/public/kibana-plugin-core-public.iuisettingsclient.md
index 87ef5784a6c6d..d6f3b3186b542 100644
--- a/docs/development/core/public/kibana-plugin-core-public.iuisettingsclient.md
+++ b/docs/development/core/public/kibana-plugin-core-public.iuisettingsclient.md
@@ -19,14 +19,12 @@ export interface IUiSettingsClient
 |  [get](./kibana-plugin-core-public.iuisettingsclient.get.md) | <code>&lt;T = any&gt;(key: string, defaultOverride?: T) =&gt; T</code> | Gets the value for a specific uiSetting. If this setting has no user-defined value then the <code>defaultOverride</code> parameter is returned (and parsed if setting is of type "json" or "number). If the parameter is not defined and the key is not registered by any plugin then an error is thrown, otherwise reads the default value defined by a plugin. |
 |  [get$](./kibana-plugin-core-public.iuisettingsclient.get_.md) | <code>&lt;T = any&gt;(key: string, defaultOverride?: T) =&gt; Observable&lt;T&gt;</code> | Gets an observable of the current value for a config key, and all updates to that config key in the future. Providing a <code>defaultOverride</code> argument behaves the same as it does in \#get() |
 |  [getAll](./kibana-plugin-core-public.iuisettingsclient.getall.md) | <code>() =&gt; Readonly&lt;Record&lt;string, PublicUiSettingsParams &amp; UserProvidedValues&gt;&gt;</code> | Gets the metadata about all uiSettings, including the type, default value, and user value for each key. |
-|  [getSaved$](./kibana-plugin-core-public.iuisettingsclient.getsaved_.md) | <code>&lt;T = any&gt;() =&gt; Observable&lt;{</code><br/><code>        key: string;</code><br/><code>        newValue: T;</code><br/><code>        oldValue: T;</code><br/><code>    }&gt;</code> | Returns an Observable that notifies subscribers of each update to the uiSettings, including the key, newValue, and oldValue of the setting that changed. |
 |  [getUpdate$](./kibana-plugin-core-public.iuisettingsclient.getupdate_.md) | <code>&lt;T = any&gt;() =&gt; Observable&lt;{</code><br/><code>        key: string;</code><br/><code>        newValue: T;</code><br/><code>        oldValue: T;</code><br/><code>    }&gt;</code> | Returns an Observable that notifies subscribers of each update to the uiSettings, including the key, newValue, and oldValue of the setting that changed. |
 |  [getUpdateErrors$](./kibana-plugin-core-public.iuisettingsclient.getupdateerrors_.md) | <code>() =&gt; Observable&lt;Error&gt;</code> | Returns an Observable that notifies subscribers of each error while trying to update the settings, containing the actual Error class. |
 |  [isCustom](./kibana-plugin-core-public.iuisettingsclient.iscustom.md) | <code>(key: string) =&gt; boolean</code> | Returns true if the setting wasn't registered by any plugin, but was either added directly via <code>set()</code>, or is an unknown setting found in the uiSettings saved object |
 |  [isDeclared](./kibana-plugin-core-public.iuisettingsclient.isdeclared.md) | <code>(key: string) =&gt; boolean</code> | Returns true if the key is a "known" uiSetting, meaning it is either registered by any plugin or was previously added as a custom setting via the <code>set()</code> method. |
 |  [isDefault](./kibana-plugin-core-public.iuisettingsclient.isdefault.md) | <code>(key: string) =&gt; boolean</code> | Returns true if the setting has no user-defined value or is unknown |
 |  [isOverridden](./kibana-plugin-core-public.iuisettingsclient.isoverridden.md) | <code>(key: string) =&gt; boolean</code> | Shows whether the uiSettings value set by the user. |
-|  [overrideLocalDefault](./kibana-plugin-core-public.iuisettingsclient.overridelocaldefault.md) | <code>(key: string, newDefault: any) =&gt; void</code> | Overrides the default value for a setting in this specific browser tab. If the page is reloaded the default override is lost. |
 |  [remove](./kibana-plugin-core-public.iuisettingsclient.remove.md) | <code>(key: string) =&gt; Promise&lt;boolean&gt;</code> | Removes the user-defined value for a setting, causing it to revert to the default. This method behaves the same as calling <code>set(key, null)</code>, including the synchronization, custom setting, and error behavior of that method. |
 |  [set](./kibana-plugin-core-public.iuisettingsclient.set.md) | <code>(key: string, value: any) =&gt; Promise&lt;boolean&gt;</code> | Sets the value for a uiSetting. If the setting is not registered by any plugin it will be stored as a custom setting. The new value will be synchronously available via the <code>get()</code> method and sent to the server in the background. If the request to the server fails then a updateErrors$ will be notified and the setting will be reverted to its value before <code>set()</code> was called. |
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.iuisettingsclient.overridelocaldefault.md b/docs/development/core/public/kibana-plugin-core-public.iuisettingsclient.overridelocaldefault.md
deleted file mode 100644
index 0ae52e4959e10..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.iuisettingsclient.overridelocaldefault.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [IUiSettingsClient](./kibana-plugin-core-public.iuisettingsclient.md) &gt; [overrideLocalDefault](./kibana-plugin-core-public.iuisettingsclient.overridelocaldefault.md)
-
-## IUiSettingsClient.overrideLocalDefault property
-
-Overrides the default value for a setting in this specific browser tab. If the page is reloaded the default override is lost.
-
-<b>Signature:</b>
-
-```typescript
-overrideLocalDefault: (key: string, newDefault: any) => void;
-```
diff --git a/src/core/public/public.api.md b/src/core/public/public.api.md
index 26e2986abb928..1f502007f51dd 100644
--- a/src/core/public/public.api.md
+++ b/src/core/public/public.api.md
@@ -911,11 +911,6 @@ export interface IUiSettingsClient {
     get$: <T = any>(key: string, defaultOverride?: T) => Observable<T>;
     get: <T = any>(key: string, defaultOverride?: T) => T;
     getAll: () => Readonly<Record<string, PublicUiSettingsParams_2 & UserProvidedValues_2>>;
-    getSaved$: <T = any>() => Observable<{
-        key: string;
-        newValue: T;
-        oldValue: T;
-    }>;
     getUpdate$: <T = any>() => Observable<{
         key: string;
         newValue: T;
@@ -926,7 +921,6 @@ export interface IUiSettingsClient {
     isDeclared: (key: string) => boolean;
     isDefault: (key: string) => boolean;
     isOverridden: (key: string) => boolean;
-    overrideLocalDefault: (key: string, newDefault: any) => void;
     remove: (key: string) => Promise<boolean>;
     set: (key: string, value: any) => Promise<boolean>;
 }
diff --git a/src/core/public/ui_settings/__snapshots__/ui_settings_client.test.ts.snap b/src/core/public/ui_settings/__snapshots__/ui_settings_client.test.ts.snap
index cd233704d2f54..b9526f26a0c1e 100644
--- a/src/core/public/ui_settings/__snapshots__/ui_settings_client.test.ts.snap
+++ b/src/core/public/ui_settings/__snapshots__/ui_settings_client.test.ts.snap
@@ -44,81 +44,6 @@ Array [
 ]
 `;
 
-exports[`#overrideLocalDefault key has no user value calls subscriber with new and previous value: single subscriber call 1`] = `
-Array [
-  Array [
-    Object {
-      "key": "dateFormat",
-      "newValue": "bar",
-      "oldValue": "Browser",
-    },
-  ],
-]
-`;
-
-exports[`#overrideLocalDefault key has no user value synchronously modifies the default value returned by get(): get after override 1`] = `"bar"`;
-
-exports[`#overrideLocalDefault key has no user value synchronously modifies the default value returned by get(): get before override 1`] = `"Browser"`;
-
-exports[`#overrideLocalDefault key has no user value synchronously modifies the value returned by getAll(): getAll after override 1`] = `
-Object {
-  "dateFormat": Object {
-    "value": "bar",
-  },
-}
-`;
-
-exports[`#overrideLocalDefault key has no user value synchronously modifies the value returned by getAll(): getAll before override 1`] = `
-Object {
-  "dateFormat": Object {
-    "value": "Browser",
-  },
-}
-`;
-
-exports[`#overrideLocalDefault key with user value does not modify the return value of get: get after override 1`] = `"foo"`;
-
-exports[`#overrideLocalDefault key with user value does not modify the return value of get: get before override 1`] = `"foo"`;
-
-exports[`#overrideLocalDefault key with user value is included in the return value of getAll: getAll after override 1`] = `
-Object {
-  "dateFormat": Object {
-    "userValue": "foo",
-    "value": "bar",
-  },
-}
-`;
-
-exports[`#overrideLocalDefault key with user value is included in the return value of getAll: getAll before override 1`] = `
-Object {
-  "dateFormat": Object {
-    "userValue": "foo",
-    "value": "Browser",
-  },
-}
-`;
-
-exports[`#overrideLocalDefault key with user value returns default override when setting removed: get after override 1`] = `"bar"`;
-
-exports[`#overrideLocalDefault key with user value returns default override when setting removed: get before override 1`] = `"foo"`;
-
-exports[`#overrideLocalDefault key with user value returns default override when setting removed: getAll after override 1`] = `
-Object {
-  "dateFormat": Object {
-    "value": "bar",
-  },
-}
-`;
-
-exports[`#overrideLocalDefault key with user value returns default override when setting removed: getAll before override 1`] = `
-Object {
-  "dateFormat": Object {
-    "userValue": "foo",
-    "value": "bar",
-  },
-}
-`;
-
 exports[`#remove throws an error if key is overridden 1`] = `"Unable to update \\"bar\\" because its value is overridden by the Kibana server"`;
 
 exports[`#set throws an error if key is overridden 1`] = `"Unable to update \\"foo\\" because its value is overridden by the Kibana server"`;
diff --git a/src/core/public/ui_settings/types.ts b/src/core/public/ui_settings/types.ts
index 4ae09094861e4..77c1feb25b6bc 100644
--- a/src/core/public/ui_settings/types.ts
+++ b/src/core/public/ui_settings/types.ts
@@ -53,12 +53,6 @@ export interface IUiSettingsClient {
    */
   set: (key: string, value: any) => Promise<boolean>;
 
-  /**
-   * Overrides the default value for a setting in this specific browser tab. If the page
-   * is reloaded the default override is lost.
-   */
-  overrideLocalDefault: (key: string, newDefault: any) => void;
-
   /**
    * Removes the user-defined value for a setting, causing it to revert to the default. This
    * method behaves the same as calling `set(key, null)`, including the synchronization, custom
@@ -99,16 +93,6 @@ export interface IUiSettingsClient {
     oldValue: T;
   }>;
 
-  /**
-   * Returns an Observable that notifies subscribers of each update to the uiSettings,
-   * including the key, newValue, and oldValue of the setting that changed.
-   */
-  getSaved$: <T = any>() => Observable<{
-    key: string;
-    newValue: T;
-    oldValue: T;
-  }>;
-
   /**
    * Returns an Observable that notifies subscribers of each error while trying to update
    * the settings, containing the actual Error class.
diff --git a/src/core/public/ui_settings/ui_settings_client.test.ts b/src/core/public/ui_settings/ui_settings_client.test.ts
index 40e04a46c0001..f8c5dbfc347dd 100644
--- a/src/core/public/ui_settings/ui_settings_client.test.ts
+++ b/src/core/public/ui_settings/ui_settings_client.test.ts
@@ -279,119 +279,3 @@ describe('#getUpdate$', () => {
     expect(onComplete).toHaveBeenCalled();
   });
 });
-
-describe('#overrideLocalDefault', () => {
-  describe('key has no user value', () => {
-    it('synchronously modifies the default value returned by get()', () => {
-      const { client } = setup();
-
-      expect(client.get('dateFormat')).toMatchSnapshot('get before override');
-      client.overrideLocalDefault('dateFormat', 'bar');
-      expect(client.get('dateFormat')).toMatchSnapshot('get after override');
-    });
-
-    it('synchronously modifies the value returned by getAll()', () => {
-      const { client } = setup();
-
-      expect(client.getAll()).toMatchSnapshot('getAll before override');
-      client.overrideLocalDefault('dateFormat', 'bar');
-      expect(client.getAll()).toMatchSnapshot('getAll after override');
-    });
-
-    it('calls subscriber with new and previous value', () => {
-      const handler = jest.fn();
-      const { client } = setup();
-
-      client.getUpdate$().subscribe(handler);
-      client.overrideLocalDefault('dateFormat', 'bar');
-      expect(handler.mock.calls).toMatchSnapshot('single subscriber call');
-    });
-  });
-
-  describe('key with user value', () => {
-    it('does not modify the return value of get', () => {
-      const { client } = setup();
-
-      client.set('dateFormat', 'foo');
-      expect(client.get('dateFormat')).toMatchSnapshot('get before override');
-      client.overrideLocalDefault('dateFormat', 'bar');
-      expect(client.get('dateFormat')).toMatchSnapshot('get after override');
-    });
-
-    it('is included in the return value of getAll', () => {
-      const { client } = setup();
-
-      client.set('dateFormat', 'foo');
-      expect(client.getAll()).toMatchSnapshot('getAll before override');
-      client.overrideLocalDefault('dateFormat', 'bar');
-      expect(client.getAll()).toMatchSnapshot('getAll after override');
-    });
-
-    it('does not call subscriber', () => {
-      const handler = jest.fn();
-      const { client } = setup();
-
-      client.set('dateFormat', 'foo');
-      client.getUpdate$().subscribe(handler);
-      client.overrideLocalDefault('dateFormat', 'bar');
-      expect(handler).not.toHaveBeenCalled();
-    });
-
-    it('returns default override when setting removed', () => {
-      const { client } = setup();
-
-      client.set('dateFormat', 'foo');
-      client.overrideLocalDefault('dateFormat', 'bar');
-
-      expect(client.get('dateFormat')).toMatchSnapshot('get before override');
-      expect(client.getAll()).toMatchSnapshot('getAll before override');
-
-      client.remove('dateFormat');
-
-      expect(client.get('dateFormat')).toMatchSnapshot('get after override');
-      expect(client.getAll()).toMatchSnapshot('getAll after override');
-    });
-  });
-
-  describe('#isOverridden()', () => {
-    it('returns false if key is unknown', () => {
-      const { client } = setup();
-      expect(client.isOverridden('foo')).toBe(false);
-    });
-
-    it('returns false if key is no overridden', () => {
-      const { client } = setup({
-        initialSettings: {
-          foo: {
-            userValue: 1,
-          },
-          bar: {
-            isOverridden: true,
-            userValue: 2,
-          },
-        },
-      });
-      expect(client.isOverridden('foo')).toBe(false);
-    });
-
-    it('returns true when key is overridden', () => {
-      const { client } = setup({
-        initialSettings: {
-          foo: {
-            userValue: 1,
-          },
-          bar: {
-            isOverridden: true,
-            userValue: 2,
-          },
-        },
-      });
-      expect(client.isOverridden('bar')).toBe(true);
-    });
-
-    it('returns false for object prototype properties', () => {
-      const { client } = setup();
-      expect(client.isOverridden('hasOwnProperty')).toBe(false);
-    });
-  });
-});
diff --git a/src/core/public/ui_settings/ui_settings_client.ts b/src/core/public/ui_settings/ui_settings_client.ts
index ab7c91803549b..ee5d5da8d29b9 100644
--- a/src/core/public/ui_settings/ui_settings_client.ts
+++ b/src/core/public/ui_settings/ui_settings_client.ts
@@ -24,7 +24,6 @@ interface UiSettingsClientParams {
 
 export class UiSettingsClient implements IUiSettingsClient {
   private readonly update$ = new Subject<{ key: string; newValue: any; oldValue: any }>();
-  private readonly saved$ = new Subject<{ key: string; newValue: any; oldValue: any }>();
   private readonly updateErrors$ = new Subject<Error>();
 
   private readonly api: UiSettingsApi;
@@ -39,7 +38,6 @@ export class UiSettingsClient implements IUiSettingsClient {
     params.done$.subscribe({
       complete: () => {
         this.update$.complete();
-        this.saved$.complete();
         this.updateErrors$.complete();
       },
     });
@@ -116,37 +114,10 @@ You can use \`IUiSettingsClient.get("${key}", defaultValue)\`, which will just r
     return this.isDeclared(key) && Boolean(this.cache[key].isOverridden);
   }
 
-  overrideLocalDefault(key: string, newDefault: any) {
-    // capture the previous value
-    const prevDefault = this.defaults[key] ? this.defaults[key].value : undefined;
-
-    // update defaults map
-    this.defaults[key] = {
-      ...(this.defaults[key] || {}),
-      value: newDefault,
-    };
-
-    // update cached default value
-    this.cache[key] = {
-      ...(this.cache[key] || {}),
-      value: newDefault,
-    };
-
-    // don't broadcast change if userValue was already overriding the default
-    if (this.cache[key].userValue == null) {
-      this.update$.next({ key, newValue: newDefault, oldValue: prevDefault });
-      this.saved$.next({ key, newValue: newDefault, oldValue: prevDefault });
-    }
-  }
-
   getUpdate$() {
     return this.update$.asObservable();
   }
 
-  getSaved$() {
-    return this.saved$.asObservable();
-  }
-
   getUpdateErrors$() {
     return this.updateErrors$.asObservable();
   }
@@ -178,7 +149,6 @@ You can use \`IUiSettingsClient.get("${key}", defaultValue)\`, which will just r
     try {
       const { settings } = await this.api.batchSet(key, newVal);
       this.cache = defaultsDeep({}, defaults, settings);
-      this.saved$.next({ key, newValue: newVal, oldValue: initialVal });
       return true;
     } catch (error) {
       this.setLocally(key, initialVal);
diff --git a/src/core/public/ui_settings/ui_settings_service.mock.ts b/src/core/public/ui_settings/ui_settings_service.mock.ts
index 1222fc2a685de..72f03be415475 100644
--- a/src/core/public/ui_settings/ui_settings_service.mock.ts
+++ b/src/core/public/ui_settings/ui_settings_service.mock.ts
@@ -22,14 +22,11 @@ const createSetupContractMock = () => {
     isDefault: jest.fn(),
     isCustom: jest.fn(),
     isOverridden: jest.fn(),
-    overrideLocalDefault: jest.fn(),
     getUpdate$: jest.fn(),
-    getSaved$: jest.fn(),
     getUpdateErrors$: jest.fn(),
   };
   setupContract.get$.mockReturnValue(new Rx.Subject<any>());
   setupContract.getUpdate$.mockReturnValue(new Rx.Subject<any>());
-  setupContract.getSaved$.mockReturnValue(new Rx.Subject<any>());
   setupContract.getUpdateErrors$.mockReturnValue(new Rx.Subject<any>());
   setupContract.getAll.mockReturnValue({});
 
diff --git a/src/core/public/ui_settings/ui_settings_service.test.ts b/src/core/public/ui_settings/ui_settings_service.test.ts
index 4e42c960bf914..9f0c6ac5fc937 100644
--- a/src/core/public/ui_settings/ui_settings_service.test.ts
+++ b/src/core/public/ui_settings/ui_settings_service.test.ts
@@ -34,12 +34,7 @@ describe('#stop', () => {
     service.stop();
 
     await expect(
-      Rx.combineLatest(
-        client.getUpdate$(),
-        client.getSaved$(),
-        client.getUpdateErrors$(),
-        loadingCount$!
-      ).toPromise()
+      Rx.combineLatest(client.getUpdate$(), client.getUpdateErrors$(), loadingCount$!).toPromise()
     ).resolves.toBe(undefined);
   });
 });
diff --git a/src/plugins/advanced_settings/public/management_app/advanced_settings.test.tsx b/src/plugins/advanced_settings/public/management_app/advanced_settings.test.tsx
index fd11314bdbd66..b897c1c73b89b 100644
--- a/src/plugins/advanced_settings/public/management_app/advanced_settings.test.tsx
+++ b/src/plugins/advanced_settings/public/management_app/advanced_settings.test.tsx
@@ -59,7 +59,6 @@ function mockConfig() {
     isCustom: (key: string) => false,
     isOverridden: (key: string) => Boolean(config.getAll()[key].isOverridden),
     getRegistered: () => ({} as Readonly<Record<string, PublicUiSettingsParams>>),
-    overrideLocalDefault: (key: string, value: any) => {},
     getUpdate$: () =>
       new Observable<{
         key: string;
diff --git a/src/plugins/dashboard/public/application/embeddable/empty_screen/__snapshots__/dashboard_empty_screen.test.tsx.snap b/src/plugins/dashboard/public/application/embeddable/empty_screen/__snapshots__/dashboard_empty_screen.test.tsx.snap
index 138d665866af0..44beed5e4a89b 100644
--- a/src/plugins/dashboard/public/application/embeddable/empty_screen/__snapshots__/dashboard_empty_screen.test.tsx.snap
+++ b/src/plugins/dashboard/public/application/embeddable/empty_screen/__snapshots__/dashboard_empty_screen.test.tsx.snap
@@ -160,14 +160,12 @@ exports[`DashboardEmptyScreen renders correctly with edit mode 1`] = `
       },
       "get$": [MockFunction],
       "getAll": [MockFunction],
-      "getSaved$": [MockFunction],
       "getUpdate$": [MockFunction],
       "getUpdateErrors$": [MockFunction],
       "isCustom": [MockFunction],
       "isDeclared": [MockFunction],
       "isDefault": [MockFunction],
       "isOverridden": [MockFunction],
-      "overrideLocalDefault": [MockFunction],
       "remove": [MockFunction],
       "set": [MockFunction],
     }
@@ -493,14 +491,12 @@ exports[`DashboardEmptyScreen renders correctly with readonly mode 1`] = `
       },
       "get$": [MockFunction],
       "getAll": [MockFunction],
-      "getSaved$": [MockFunction],
       "getUpdate$": [MockFunction],
       "getUpdateErrors$": [MockFunction],
       "isCustom": [MockFunction],
       "isDeclared": [MockFunction],
       "isDefault": [MockFunction],
       "isOverridden": [MockFunction],
-      "overrideLocalDefault": [MockFunction],
       "remove": [MockFunction],
       "set": [MockFunction],
     }
@@ -840,14 +836,12 @@ exports[`DashboardEmptyScreen renders correctly with view mode 1`] = `
       },
       "get$": [MockFunction],
       "getAll": [MockFunction],
-      "getSaved$": [MockFunction],
       "getUpdate$": [MockFunction],
       "getUpdateErrors$": [MockFunction],
       "isCustom": [MockFunction],
       "isDeclared": [MockFunction],
       "isDefault": [MockFunction],
       "isOverridden": [MockFunction],
-      "overrideLocalDefault": [MockFunction],
       "remove": [MockFunction],
       "set": [MockFunction],
     }
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/header/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/header/__snapshots__/index.test.tsx.snap
index b6559114f6d2b..72fc4338684f3 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/header/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/header/__snapshots__/index.test.tsx.snap
@@ -21,14 +21,12 @@ exports[`Header rendering renders correctly against snapshot 1`] = `
           "get": [MockFunction],
           "get$": [MockFunction],
           "getAll": [MockFunction],
-          "getSaved$": [MockFunction],
           "getUpdate$": [MockFunction],
           "getUpdateErrors$": [MockFunction],
           "isCustom": [MockFunction],
           "isDeclared": [MockFunction],
           "isDefault": [MockFunction],
           "isOverridden": [MockFunction],
-          "overrideLocalDefault": [MockFunction],
           "remove": [MockFunction],
           "set": [MockFunction],
         },

From 0b16688a241d3c868ba54b404861f9b71adfe792 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felix=20St=C3=BCrmer?= <weltenwort@users.noreply.github.com>
Date: Tue, 27 Apr 2021 20:06:16 +0200
Subject: [PATCH 09/28] [Logs UI] Don't break log stream on syntactically
 invalid KQL (#98191)

---
 .../components/log_stream/log_stream.tsx      | 108 +++++++++----
 .../log_stream/log_stream_embeddable.tsx      |   7 +-
 .../log_stream/log_stream_error_boundary.tsx  |  62 ++++++++
 .../components/resettable_error_boundary.tsx  |  72 +++++++++
 .../logs/log_filter/log_filter_state.ts       | 149 +++++++++---------
 .../log_filter/with_log_filter_url_state.tsx  |  52 +++---
 .../containers/logs/log_stream/index.ts       |  31 +---
 .../logs/log_summary/with_summary.ts          |   5 +-
 .../pages/link_to/link_to_logs.test.tsx       |  22 +--
 .../pages/link_to/redirect_to_logs.test.tsx   |   6 +-
 .../public/pages/link_to/redirect_to_logs.tsx |   2 +-
 .../pages/link_to/redirect_to_node_logs.tsx   |   2 +-
 .../pages/logs/stream/page_providers.tsx      |  24 +--
 .../public/pages/logs/stream/page_toolbar.tsx |  21 +--
 .../components/node_details/tabs/logs.tsx     |  24 ++-
 x-pack/test/functional/apps/infra/link_to.ts  |   2 +-
 16 files changed, 381 insertions(+), 208 deletions(-)
 create mode 100644 x-pack/plugins/infra/public/components/log_stream/log_stream_error_boundary.tsx
 create mode 100644 x-pack/plugins/infra/public/components/resettable_error_boundary.tsx

diff --git a/x-pack/plugins/infra/public/components/log_stream/log_stream.tsx b/x-pack/plugins/infra/public/components/log_stream/log_stream.tsx
index a481a3897789e..5023f9d5d5fd4 100644
--- a/x-pack/plugins/infra/public/components/log_stream/log_stream.tsx
+++ b/x-pack/plugins/infra/public/components/log_stream/log_stream.tsx
@@ -7,7 +7,7 @@
 
 import React, { useMemo, useCallback, useEffect } from 'react';
 import { noop } from 'lodash';
-import type { DataPublicPluginStart } from '../../../../../../src/plugins/data/public';
+import { DataPublicPluginStart, esQuery, Filter } from '../../../../../../src/plugins/data/public';
 import { euiStyled } from '../../../../../../src/plugins/kibana_react/common';
 import { LogEntryCursor } from '../../../common/log_entry';
 
@@ -19,6 +19,7 @@ import { ScrollableLogTextStreamView } from '../logging/log_text_stream';
 import { LogColumnRenderConfiguration } from '../../utils/log_column_render_configuration';
 import { JsonValue } from '../../../../../../src/plugins/kibana_utils/common';
 import { Query } from '../../../../../../src/plugins/data/common';
+import { LogStreamErrorBoundary } from './log_stream_error_boundary';
 
 interface LogStreamPluginDeps {
   data: DataPublicPluginStart;
@@ -57,25 +58,39 @@ type LogColumnDefinition =
   | MessageColumnDefinition
   | FieldColumnDefinition;
 
-export interface LogStreamProps {
+export interface LogStreamProps extends LogStreamContentProps {
+  height?: string | number;
+}
+
+interface LogStreamContentProps {
   sourceId?: string;
   startTimestamp: number;
   endTimestamp: number;
   query?: string | Query | BuiltEsQuery;
+  filters?: Filter[];
   center?: LogEntryCursor;
   highlight?: string;
-  height?: string | number;
   columns?: LogColumnDefinition[];
 }
 
-export const LogStream: React.FC<LogStreamProps> = ({
+export const LogStream: React.FC<LogStreamProps> = ({ height = 400, ...contentProps }) => {
+  return (
+    <LogStreamContainer style={{ height }}>
+      <LogStreamErrorBoundary resetOnChange={[contentProps.query]}>
+        <LogStreamContent {...contentProps} />
+      </LogStreamErrorBoundary>
+    </LogStreamContainer>
+  );
+};
+
+export const LogStreamContent: React.FC<LogStreamContentProps> = ({
   sourceId = 'default',
   startTimestamp,
   endTimestamp,
   query,
+  filters,
   center,
   highlight,
-  height = '400px',
   columns,
 }) => {
   const customColumns = useMemo(
@@ -99,12 +114,21 @@ Read more at https://github.com/elastic/kibana/blob/master/src/plugins/kibana_re
     sourceConfiguration,
     loadSourceConfiguration,
     isLoadingSourceConfiguration,
+    derivedIndexPattern,
   } = useLogSource({
     sourceId,
     fetch: services.http.fetch,
     indexPatternsService: services.data.indexPatterns,
   });
 
+  const parsedQuery = useMemo<BuiltEsQuery | undefined>(() => {
+    if (typeof query === 'object' && 'bool' in query) {
+      return mergeBoolQueries(query, esQuery.buildEsQuery(derivedIndexPattern, [], filters ?? []));
+    } else {
+      return esQuery.buildEsQuery(derivedIndexPattern, coerceToQueries(query), filters ?? []);
+    }
+  }, [derivedIndexPattern, filters, query]);
+
   // Internal state
   const {
     entries,
@@ -119,7 +143,7 @@ Read more at https://github.com/elastic/kibana/blob/master/src/plugins/kibana_re
     sourceId,
     startTimestamp,
     endTimestamp,
-    query,
+    query: parsedQuery,
     center,
     columns: customColumns,
   });
@@ -138,8 +162,6 @@ Read more at https://github.com/elastic/kibana/blob/master/src/plugins/kibana_re
     [entries]
   );
 
-  const parsedHeight = typeof height === 'number' ? `${height}px` : height;
-
   // Component lifetime
   useEffect(() => {
     loadSourceConfiguration();
@@ -170,37 +192,34 @@ Read more at https://github.com/elastic/kibana/blob/master/src/plugins/kibana_re
   );
 
   return (
-    <LogStreamContent height={parsedHeight}>
-      <ScrollableLogTextStreamView
-        target={center ? center : entries.length ? entries[entries.length - 1].cursor : null}
-        columnConfigurations={columnConfigurations}
-        items={streamItems}
-        scale="medium"
-        wrap={true}
-        isReloading={isLoadingSourceConfiguration || isReloading}
-        isLoadingMore={isLoadingMore}
-        hasMoreBeforeStart={hasMoreBefore}
-        hasMoreAfterEnd={hasMoreAfter}
-        isStreaming={false}
-        jumpToTarget={noop}
-        reportVisibleInterval={handlePagination}
-        reloadItems={fetchEntries}
-        highlightedItem={highlight ?? null}
-        currentHighlightKey={null}
-        startDateExpression={''}
-        endDateExpression={''}
-        updateDateRange={noop}
-        startLiveStreaming={noop}
-        hideScrollbar={false}
-      />
-    </LogStreamContent>
+    <ScrollableLogTextStreamView
+      target={center ? center : entries.length ? entries[entries.length - 1].cursor : null}
+      columnConfigurations={columnConfigurations}
+      items={streamItems}
+      scale="medium"
+      wrap={true}
+      isReloading={isLoadingSourceConfiguration || isReloading}
+      isLoadingMore={isLoadingMore}
+      hasMoreBeforeStart={hasMoreBefore}
+      hasMoreAfterEnd={hasMoreAfter}
+      isStreaming={false}
+      jumpToTarget={noop}
+      reportVisibleInterval={handlePagination}
+      reloadItems={fetchEntries}
+      highlightedItem={highlight ?? null}
+      currentHighlightKey={null}
+      startDateExpression={''}
+      endDateExpression={''}
+      updateDateRange={noop}
+      startLiveStreaming={noop}
+      hideScrollbar={false}
+    />
   );
 };
 
-const LogStreamContent = euiStyled.div<{ height: string }>`
+const LogStreamContainer = euiStyled.div`
   display: flex;
   background-color: ${(props) => props.theme.eui.euiColorEmptyShade};
-  height: ${(props) => props.height};
 `;
 
 function convertLogColumnDefinitionToLogSourceColumnDefinition(
@@ -227,6 +246,27 @@ function convertLogColumnDefinitionToLogSourceColumnDefinition(
   });
 }
 
+const mergeBoolQueries = (firstQuery: BuiltEsQuery, secondQuery: BuiltEsQuery): BuiltEsQuery => ({
+  bool: {
+    must: [...firstQuery.bool.must, ...secondQuery.bool.must],
+    filter: [...firstQuery.bool.filter, ...secondQuery.bool.filter],
+    should: [...firstQuery.bool.should, ...secondQuery.bool.should],
+    must_not: [...firstQuery.bool.must_not, ...secondQuery.bool.must_not],
+  },
+});
+
+const coerceToQueries = (value: undefined | string | Query): Query[] => {
+  if (value == null) {
+    return [];
+  } else if (typeof value === 'string') {
+    return [{ language: 'kuery', query: value }];
+  } else if ('language' in value && 'query' in value) {
+    return [value];
+  }
+
+  return [];
+};
+
 // Allow for lazy loading
 // eslint-disable-next-line import/no-default-export
 export default LogStream;
diff --git a/x-pack/plugins/infra/public/components/log_stream/log_stream_embeddable.tsx b/x-pack/plugins/infra/public/components/log_stream/log_stream_embeddable.tsx
index 1d9edd7289236..e3fc4ca1de565 100644
--- a/x-pack/plugins/infra/public/components/log_stream/log_stream_embeddable.tsx
+++ b/x-pack/plugins/infra/public/components/log_stream/log_stream_embeddable.tsx
@@ -9,7 +9,7 @@ import { CoreStart } from 'kibana/public';
 import React from 'react';
 import ReactDOM from 'react-dom';
 import { Subscription } from 'rxjs';
-import { Query, TimeRange, esQuery, Filter } from '../../../../../../src/plugins/data/public';
+import { Filter, Query, TimeRange } from '../../../../../../src/plugins/data/public';
 import {
   Embeddable,
   EmbeddableInput,
@@ -69,8 +69,6 @@ export class LogStreamEmbeddable extends Embeddable<LogStreamEmbeddableInput> {
       return;
     }
 
-    const parsedQuery = esQuery.buildEsQuery(undefined, this.input.query, this.input.filters);
-
     const startTimestamp = datemathToEpochMillis(this.input.timeRange.from);
     const endTimestamp = datemathToEpochMillis(this.input.timeRange.to, 'up');
 
@@ -86,7 +84,8 @@ export class LogStreamEmbeddable extends Embeddable<LogStreamEmbeddableInput> {
               startTimestamp={startTimestamp}
               endTimestamp={endTimestamp}
               height="100%"
-              query={parsedQuery}
+              query={this.input.query}
+              filters={this.input.filters}
             />
           </div>
         </EuiThemeProvider>
diff --git a/x-pack/plugins/infra/public/components/log_stream/log_stream_error_boundary.tsx b/x-pack/plugins/infra/public/components/log_stream/log_stream_error_boundary.tsx
new file mode 100644
index 0000000000000..c55e6d299127b
--- /dev/null
+++ b/x-pack/plugins/infra/public/components/log_stream/log_stream_error_boundary.tsx
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiCodeBlock, EuiEmptyPrompt } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import React from 'react';
+import { KQLSyntaxError } from '../../../../../../src/plugins/data/common';
+import { RenderErrorFunc, ResettableErrorBoundary } from '../resettable_error_boundary';
+
+export const LogStreamErrorBoundary: React.FC<{ resetOnChange: any }> = ({
+  children,
+  resetOnChange = null,
+}) => {
+  return (
+    <ResettableErrorBoundary
+      renderError={renderLogStreamErrorContent}
+      resetOnChange={resetOnChange}
+    >
+      {children}
+    </ResettableErrorBoundary>
+  );
+};
+
+const LogStreamErrorContent: React.FC<{
+  error: any;
+}> = ({ error }) => {
+  if (error instanceof KQLSyntaxError) {
+    return (
+      <EuiEmptyPrompt
+        title={
+          <FormattedMessage
+            id="xpack.infra.logStream.kqlErrorTitle"
+            defaultMessage="Invalid KQL expression"
+            tagName="h2"
+          />
+        }
+        body={<EuiCodeBlock className="eui-textLeft">{error.message}</EuiCodeBlock>}
+      />
+    );
+  } else {
+    return (
+      <EuiEmptyPrompt
+        title={
+          <FormattedMessage
+            id="xpack.infra.logStream.unknownErrorTitle"
+            defaultMessage="An error occurred"
+            tagName="h2"
+          />
+        }
+        body={<EuiCodeBlock className="eui-textLeft">{error.message}</EuiCodeBlock>}
+      />
+    );
+  }
+};
+
+const renderLogStreamErrorContent: RenderErrorFunc = ({ latestError }) => (
+  <LogStreamErrorContent error={latestError} />
+);
diff --git a/x-pack/plugins/infra/public/components/resettable_error_boundary.tsx b/x-pack/plugins/infra/public/components/resettable_error_boundary.tsx
new file mode 100644
index 0000000000000..6e9dc178a4d84
--- /dev/null
+++ b/x-pack/plugins/infra/public/components/resettable_error_boundary.tsx
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import equal from 'fast-deep-equal';
+import React from 'react';
+
+export interface RenderErrorFuncArgs {
+  latestError: any;
+  resetError: () => void;
+}
+
+export type RenderErrorFunc = (renderErrorArgs: RenderErrorFuncArgs) => React.ReactNode;
+
+interface ResettableErrorBoundaryProps<ResetOnChange> {
+  renderError: RenderErrorFunc;
+  resetOnChange: ResetOnChange;
+}
+
+interface ResettableErrorBoundaryState {
+  latestError: any;
+}
+
+export class ResettableErrorBoundary<ResetOnChange> extends React.Component<
+  ResettableErrorBoundaryProps<ResetOnChange>,
+  ResettableErrorBoundaryState
+> {
+  state: ResettableErrorBoundaryState = {
+    latestError: undefined,
+  };
+
+  componentDidUpdate({
+    resetOnChange: prevResetOnChange,
+  }: ResettableErrorBoundaryProps<ResetOnChange>) {
+    const { resetOnChange } = this.props;
+    const { latestError } = this.state;
+
+    if (latestError != null && !equal(resetOnChange, prevResetOnChange)) {
+      this.resetError();
+    }
+  }
+
+  static getDerivedStateFromError(error: any) {
+    return {
+      latestError: error,
+    };
+  }
+
+  render() {
+    const { children, renderError } = this.props;
+    const { latestError } = this.state;
+
+    if (latestError != null) {
+      return renderError({
+        latestError,
+        resetError: this.resetError,
+      });
+    }
+
+    return children;
+  }
+
+  resetError = () => {
+    this.setState((previousState) => ({
+      ...previousState,
+      latestError: undefined,
+    }));
+  };
+}
diff --git a/x-pack/plugins/infra/public/containers/logs/log_filter/log_filter_state.ts b/x-pack/plugins/infra/public/containers/logs/log_filter/log_filter_state.ts
index 5eece62c683e1..6a78d7c6f94bc 100644
--- a/x-pack/plugins/infra/public/containers/logs/log_filter/log_filter_state.ts
+++ b/x-pack/plugins/infra/public/containers/logs/log_filter/log_filter_state.ts
@@ -5,95 +5,100 @@
  * 2.0.
  */
 
-import { useState, useMemo } from 'react';
 import createContainer from 'constate';
-import { IIndexPattern } from 'src/plugins/data/public';
-import { esKuery } from '../../../../../../../src/plugins/data/public';
-import { convertKueryToElasticSearchQuery } from '../../../utils/kuery';
+import { useCallback, useState } from 'react';
+import { useDebounce } from 'react-use';
+import { esQuery, IIndexPattern, Query } from '../../../../../../../src/plugins/data/public';
 
-export interface KueryFilterQuery {
-  kind: 'kuery';
-  expression: string;
-}
-
-export interface SerializedFilterQuery {
-  query: KueryFilterQuery;
-  serializedQuery: string;
-}
+type ParsedQuery = ReturnType<typeof esQuery.buildEsQuery>;
 
-interface LogFilterInternalStateParams {
-  filterQuery: SerializedFilterQuery | null;
-  filterQueryDraft: KueryFilterQuery | null;
+interface ILogFilterState {
+  filterQuery: {
+    parsedQuery: ParsedQuery;
+    serializedQuery: string;
+    originalQuery: Query;
+  } | null;
+  filterQueryDraft: Query;
+  validationErrors: string[];
 }
 
-export const logFilterInitialState: LogFilterInternalStateParams = {
+const initialLogFilterState: ILogFilterState = {
   filterQuery: null,
-  filterQueryDraft: null,
+  filterQueryDraft: {
+    language: 'kuery',
+    query: '',
+  },
+  validationErrors: [],
 };
 
-export type LogFilterStateParams = Omit<LogFilterInternalStateParams, 'filterQuery'> & {
-  filterQuery: SerializedFilterQuery['serializedQuery'] | null;
-  filterQueryAsKuery: SerializedFilterQuery['query'] | null;
-  isFilterQueryDraftValid: boolean;
-};
-export interface LogFilterCallbacks {
-  setLogFilterQueryDraft: (expression: string) => void;
-  applyLogFilterQuery: (expression: string) => void;
-}
+const validationDebounceTimeout = 1000; // milliseconds
 
-export const useLogFilterState: (props: {
-  indexPattern: IIndexPattern;
-}) => LogFilterStateParams & LogFilterCallbacks = ({ indexPattern }) => {
-  const [state, setState] = useState(logFilterInitialState);
-  const { filterQuery, filterQueryDraft } = state;
+export const useLogFilterState = ({ indexPattern }: { indexPattern: IIndexPattern }) => {
+  const [logFilterState, setLogFilterState] = useState<ILogFilterState>(initialLogFilterState);
 
-  const setLogFilterQueryDraft = useMemo(() => {
-    const setDraft = (payload: KueryFilterQuery) =>
-      setState((prevState) => ({ ...prevState, filterQueryDraft: payload }));
-    return (expression: string) =>
-      setDraft({
-        kind: 'kuery',
-        expression,
-      });
+  const parseQuery = useCallback(
+    (filterQuery: Query) => esQuery.buildEsQuery(indexPattern, filterQuery, []),
+    [indexPattern]
+  );
+
+  const setLogFilterQueryDraft = useCallback((filterQueryDraft: Query) => {
+    setLogFilterState((previousLogFilterState) => ({
+      ...previousLogFilterState,
+      filterQueryDraft,
+      validationErrors: [],
+    }));
   }, []);
-  const applyLogFilterQuery = useMemo(() => {
-    const applyQuery = (payload: SerializedFilterQuery) =>
-      setState((prevState) => ({
-        ...prevState,
-        filterQueryDraft: payload.query,
-        filterQuery: payload,
-      }));
-    return (expression: string) =>
-      applyQuery({
-        query: {
-          kind: 'kuery',
-          expression,
-        },
-        serializedQuery: convertKueryToElasticSearchQuery(expression, indexPattern),
+
+  const [, cancelPendingValidation] = useDebounce(
+    () => {
+      setLogFilterState((previousLogFilterState) => {
+        try {
+          parseQuery(logFilterState.filterQueryDraft);
+          return {
+            ...previousLogFilterState,
+            validationErrors: [],
+          };
+        } catch (error) {
+          return {
+            ...previousLogFilterState,
+            validationErrors: [`${error}`],
+          };
+        }
       });
-  }, [indexPattern]);
+    },
+    validationDebounceTimeout,
+    [logFilterState.filterQueryDraft, parseQuery]
+  );
 
-  const isFilterQueryDraftValid = useMemo(() => {
-    if (filterQueryDraft?.kind === 'kuery') {
+  const applyLogFilterQuery = useCallback(
+    (filterQuery: Query) => {
+      cancelPendingValidation();
       try {
-        esKuery.fromKueryExpression(filterQueryDraft.expression);
-      } catch (err) {
-        return false;
+        const parsedQuery = parseQuery(filterQuery);
+        setLogFilterState((previousLogFilterState) => ({
+          ...previousLogFilterState,
+          filterQuery: {
+            parsedQuery,
+            serializedQuery: JSON.stringify(parsedQuery),
+            originalQuery: filterQuery,
+          },
+          filterQueryDraft: filterQuery,
+          validationErrors: [],
+        }));
+      } catch (error) {
+        setLogFilterState((previousLogFilterState) => ({
+          ...previousLogFilterState,
+          validationErrors: [`${error}`],
+        }));
       }
-    }
-
-    return true;
-  }, [filterQueryDraft]);
-
-  const serializedFilterQuery = useMemo(() => (filterQuery ? filterQuery.serializedQuery : null), [
-    filterQuery,
-  ]);
+    },
+    [cancelPendingValidation, parseQuery]
+  );
 
   return {
-    ...state,
-    filterQueryAsKuery: state.filterQuery ? state.filterQuery.query : null,
-    filterQuery: serializedFilterQuery,
-    isFilterQueryDraftValid,
+    filterQuery: logFilterState.filterQuery,
+    filterQueryDraft: logFilterState.filterQueryDraft,
+    isFilterQueryDraftValid: logFilterState.validationErrors.length === 0,
     setLogFilterQueryDraft,
     applyLogFilterQuery,
   };
diff --git a/x-pack/plugins/infra/public/containers/logs/log_filter/with_log_filter_url_state.tsx b/x-pack/plugins/infra/public/containers/logs/log_filter/with_log_filter_url_state.tsx
index 6bc71fc880434..f085a2c7d275b 100644
--- a/x-pack/plugins/infra/public/containers/logs/log_filter/with_log_filter_url_state.tsx
+++ b/x-pack/plugins/infra/public/containers/logs/log_filter/with_log_filter_url_state.tsx
@@ -5,43 +5,57 @@
  * 2.0.
  */
 
+import * as rt from 'io-ts';
 import React, { useContext } from 'react';
-import { LogFilterState, LogFilterStateParams } from './log_filter_state';
+import { Query } from '../../../../../../../src/plugins/data/public';
 import { replaceStateKeyInQueryString, UrlStateContainer } from '../../../utils/url_state';
-
-type LogFilterUrlState = LogFilterStateParams['filterQueryAsKuery'];
+import { LogFilterState } from './log_filter_state';
 
 export const WithLogFilterUrlState: React.FC = () => {
-  const { filterQueryAsKuery, applyLogFilterQuery } = useContext(LogFilterState.Context);
+  const { filterQuery, applyLogFilterQuery } = useContext(LogFilterState.Context);
+
   return (
     <UrlStateContainer
-      urlState={filterQueryAsKuery}
+      urlState={filterQuery?.originalQuery}
       urlStateKey="logFilter"
       mapToUrlState={mapToFilterQuery}
       onChange={(urlState) => {
         if (urlState) {
-          applyLogFilterQuery(urlState.expression);
+          applyLogFilterQuery(urlState);
         }
       }}
       onInitialize={(urlState) => {
         if (urlState) {
-          applyLogFilterQuery(urlState.expression);
+          applyLogFilterQuery(urlState);
         }
       }}
     />
   );
 };
 
-const mapToFilterQuery = (value: any): LogFilterUrlState | undefined =>
-  value?.kind === 'kuery' && typeof value.expression === 'string'
-    ? {
-        kind: value.kind,
-        expression: value.expression,
-      }
-    : undefined;
+const mapToFilterQuery = (value: any): Query | undefined => {
+  if (legacyFilterQueryUrlStateRT.is(value)) {
+    // migrate old url state
+    return {
+      language: value.kind,
+      query: value.expression,
+    };
+  } else if (filterQueryUrlStateRT.is(value)) {
+    return value;
+  } else {
+    return undefined;
+  }
+};
+
+export const replaceLogFilterInQueryString = (query: Query) =>
+  replaceStateKeyInQueryString<Query>('logFilter', query);
+
+const filterQueryUrlStateRT = rt.type({
+  language: rt.string,
+  query: rt.string,
+});
 
-export const replaceLogFilterInQueryString = (expression: string) =>
-  replaceStateKeyInQueryString<LogFilterUrlState>('logFilter', {
-    kind: 'kuery',
-    expression,
-  });
+const legacyFilterQueryUrlStateRT = rt.type({
+  kind: rt.literal('kuery'),
+  expression: rt.string,
+});
diff --git a/x-pack/plugins/infra/public/containers/logs/log_stream/index.ts b/x-pack/plugins/infra/public/containers/logs/log_stream/index.ts
index cd68048e6c94f..021aa8f79fe59 100644
--- a/x-pack/plugins/infra/public/containers/logs/log_stream/index.ts
+++ b/x-pack/plugins/infra/public/containers/logs/log_stream/index.ts
@@ -5,11 +5,11 @@
  * 2.0.
  */
 
-import { useState, useCallback, useEffect, useMemo } from 'react';
 import createContainer from 'constate';
+import { useCallback, useEffect, useMemo, useState } from 'react';
 import usePrevious from 'react-use/lib/usePrevious';
 import useSetState from 'react-use/lib/useSetState';
-import { esKuery, esQuery, Query } from '../../../../../../../src/plugins/data/public';
+import { esQuery } from '../../../../../../../src/plugins/data/public';
 import { LogEntry, LogEntryCursor } from '../../../../common/log_entry';
 import { useSubscription } from '../../../utils/use_observable';
 import { LogSourceConfigurationProperties } from '../log_source';
@@ -23,7 +23,7 @@ interface LogStreamProps {
   sourceId: string;
   startTimestamp: number;
   endTimestamp: number;
-  query?: string | Query | BuiltEsQuery;
+  query?: BuiltEsQuery;
   center?: LogEntryCursor;
   columns?: LogSourceConfigurationProperties['logColumns'];
 }
@@ -77,27 +77,15 @@ export function useLogStream({
     }
   }, [prevEndTimestamp, endTimestamp, setState]);
 
-  const parsedQuery = useMemo(() => {
-    if (!query) {
-      return undefined;
-    } else if (typeof query === 'string') {
-      return esKuery.toElasticsearchQuery(esKuery.fromKueryExpression(query));
-    } else if ('language' in query) {
-      return getEsQueryFromQueryObject(query);
-    } else {
-      return query;
-    }
-  }, [query]);
-
   const commonFetchArguments = useMemo(
     () => ({
       sourceId,
       startTimestamp,
       endTimestamp,
-      query: parsedQuery,
+      query,
       columnOverrides: columns,
     }),
-    [columns, endTimestamp, parsedQuery, sourceId, startTimestamp]
+    [columns, endTimestamp, query, sourceId, startTimestamp]
   );
 
   const {
@@ -268,13 +256,4 @@ export function useLogStream({
   };
 }
 
-function getEsQueryFromQueryObject(query: Query) {
-  switch (query.language) {
-    case 'kuery':
-      return esKuery.toElasticsearchQuery(esKuery.fromKueryExpression(query.query as string));
-    case 'lucene':
-      return esQuery.luceneStringToDsl(query.query as string);
-  }
-}
-
 export const [LogStreamProvider, useLogStreamContext] = createContainer(useLogStream);
diff --git a/x-pack/plugins/infra/public/containers/logs/log_summary/with_summary.ts b/x-pack/plugins/infra/public/containers/logs/log_summary/with_summary.ts
index cbd664729d5c2..9204c81816e83 100644
--- a/x-pack/plugins/infra/public/containers/logs/log_summary/with_summary.ts
+++ b/x-pack/plugins/infra/public/containers/logs/log_summary/with_summary.ts
@@ -7,12 +7,11 @@
 
 import { useContext } from 'react';
 import useThrottle from 'react-use/lib/useThrottle';
-
 import { RendererFunction } from '../../../utils/typed_react';
-import { LogSummaryBuckets, useLogSummary } from './log_summary';
 import { LogFilterState } from '../log_filter';
 import { LogPositionState } from '../log_position';
 import { useLogSourceContext } from '../log_source';
+import { LogSummaryBuckets, useLogSummary } from './log_summary';
 
 const FETCH_THROTTLE_INTERVAL = 3000;
 
@@ -37,7 +36,7 @@ export const WithSummary = ({
     sourceId,
     throttledStartTimestamp,
     throttledEndTimestamp,
-    filterQuery
+    filterQuery?.serializedQuery ?? null
   );
 
   return children({ buckets, start, end });
diff --git a/x-pack/plugins/infra/public/pages/link_to/link_to_logs.test.tsx b/x-pack/plugins/infra/public/pages/link_to/link_to_logs.test.tsx
index 0d57f8dad1e72..91f42509d493a 100644
--- a/x-pack/plugins/infra/public/pages/link_to/link_to_logs.test.tsx
+++ b/x-pack/plugins/infra/public/pages/link_to/link_to_logs.test.tsx
@@ -66,7 +66,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('default');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(expression:'FILTER_FIELD:FILTER_VALUE',kind:kuery)"`
+        `"(language:kuery,query:'FILTER_FIELD:FILTER_VALUE')"`
       );
       expect(searchParams.get('logPosition')).toMatchInlineSnapshot(
         `"(end:'2019-02-20T14:58:09.404Z',position:(tiebreaker:0,time:1550671089404),start:'2019-02-20T12:58:09.404Z',streamLive:!f)"`
@@ -86,7 +86,7 @@ describe('LinkToLogsPage component', () => {
 
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('OTHER_SOURCE');
-      expect(searchParams.get('logFilter')).toMatchInlineSnapshot(`"(expression:'',kind:kuery)"`);
+      expect(searchParams.get('logFilter')).toMatchInlineSnapshot(`"(language:kuery,query:'')"`);
       expect(searchParams.get('logPosition')).toEqual(null);
     });
   });
@@ -106,7 +106,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('default');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(expression:'FILTER_FIELD:FILTER_VALUE',kind:kuery)"`
+        `"(language:kuery,query:'FILTER_FIELD:FILTER_VALUE')"`
       );
       expect(searchParams.get('logPosition')).toMatchInlineSnapshot(
         `"(end:'2019-02-20T14:58:09.404Z',position:(tiebreaker:0,time:1550671089404),start:'2019-02-20T12:58:09.404Z',streamLive:!f)"`
@@ -126,7 +126,7 @@ describe('LinkToLogsPage component', () => {
 
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('OTHER_SOURCE');
-      expect(searchParams.get('logFilter')).toMatchInlineSnapshot(`"(expression:'',kind:kuery)"`);
+      expect(searchParams.get('logFilter')).toMatchInlineSnapshot(`"(language:kuery,query:'')"`);
       expect(searchParams.get('logPosition')).toEqual(null);
     });
   });
@@ -146,7 +146,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('default');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(expression:'HOST_FIELD: HOST_NAME',kind:kuery)"`
+        `"(language:kuery,query:'HOST_FIELD: HOST_NAME')"`
       );
       expect(searchParams.get('logPosition')).toEqual(null);
     });
@@ -167,7 +167,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('default');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(expression:'(HOST_FIELD: HOST_NAME) and (FILTER_FIELD:FILTER_VALUE)',kind:kuery)"`
+        `"(language:kuery,query:'(HOST_FIELD: HOST_NAME) and (FILTER_FIELD:FILTER_VALUE)')"`
       );
       expect(searchParams.get('logPosition')).toMatchInlineSnapshot(
         `"(end:'2019-02-20T14:58:09.404Z',position:(tiebreaker:0,time:1550671089404),start:'2019-02-20T12:58:09.404Z',streamLive:!f)"`
@@ -188,7 +188,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('OTHER_SOURCE');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(expression:'HOST_FIELD: HOST_NAME',kind:kuery)"`
+        `"(language:kuery,query:'HOST_FIELD: HOST_NAME')"`
       );
       expect(searchParams.get('logPosition')).toEqual(null);
     });
@@ -223,7 +223,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('default');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(expression:'CONTAINER_FIELD: CONTAINER_ID',kind:kuery)"`
+        `"(language:kuery,query:'CONTAINER_FIELD: CONTAINER_ID')"`
       );
       expect(searchParams.get('logPosition')).toEqual(null);
     });
@@ -244,7 +244,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('default');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(expression:'(CONTAINER_FIELD: CONTAINER_ID) and (FILTER_FIELD:FILTER_VALUE)',kind:kuery)"`
+        `"(language:kuery,query:'(CONTAINER_FIELD: CONTAINER_ID) and (FILTER_FIELD:FILTER_VALUE)')"`
       );
       expect(searchParams.get('logPosition')).toMatchInlineSnapshot(
         `"(end:'2019-02-20T14:58:09.404Z',position:(tiebreaker:0,time:1550671089404),start:'2019-02-20T12:58:09.404Z',streamLive:!f)"`
@@ -281,7 +281,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('default');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(expression:'POD_FIELD: POD_UID',kind:kuery)"`
+        `"(language:kuery,query:'POD_FIELD: POD_UID')"`
       );
       expect(searchParams.get('logPosition')).toEqual(null);
     });
@@ -300,7 +300,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('default');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(expression:'(POD_FIELD: POD_UID) and (FILTER_FIELD:FILTER_VALUE)',kind:kuery)"`
+        `"(language:kuery,query:'(POD_FIELD: POD_UID) and (FILTER_FIELD:FILTER_VALUE)')"`
       );
       expect(searchParams.get('logPosition')).toMatchInlineSnapshot(
         `"(end:'2019-02-20T14:58:09.404Z',position:(tiebreaker:0,time:1550671089404),start:'2019-02-20T12:58:09.404Z',streamLive:!f)"`
diff --git a/x-pack/plugins/infra/public/pages/link_to/redirect_to_logs.test.tsx b/x-pack/plugins/infra/public/pages/link_to/redirect_to_logs.test.tsx
index a3e261a6bc280..39f276b982d76 100644
--- a/x-pack/plugins/infra/public/pages/link_to/redirect_to_logs.test.tsx
+++ b/x-pack/plugins/infra/public/pages/link_to/redirect_to_logs.test.tsx
@@ -20,7 +20,7 @@ describe('RedirectToLogs component', () => {
 
     expect(component).toMatchInlineSnapshot(`
       <Redirect
-        to="/stream?sourceId=default&logPosition=(end:'2019-02-20T14:58:09.404Z',position:(tiebreaker:0,time:1550671089404),start:'2019-02-20T12:58:09.404Z',streamLive:!f)&logFilter=(expression:'',kind:kuery)"
+        to="/stream?sourceId=default&logPosition=(end:'2019-02-20T14:58:09.404Z',position:(tiebreaker:0,time:1550671089404),start:'2019-02-20T12:58:09.404Z',streamLive:!f)&logFilter=(language:kuery,query:'')"
       />
     `);
   });
@@ -34,7 +34,7 @@ describe('RedirectToLogs component', () => {
 
     expect(component).toMatchInlineSnapshot(`
       <Redirect
-        to="/stream?sourceId=default&logPosition=(end:'2019-02-20T14:58:09.404Z',position:(tiebreaker:0,time:1550671089404),start:'2019-02-20T12:58:09.404Z',streamLive:!f)&logFilter=(expression:'FILTER_FIELD:FILTER_VALUE',kind:kuery)"
+        to="/stream?sourceId=default&logPosition=(end:'2019-02-20T14:58:09.404Z',position:(tiebreaker:0,time:1550671089404),start:'2019-02-20T12:58:09.404Z',streamLive:!f)&logFilter=(language:kuery,query:'FILTER_FIELD:FILTER_VALUE')"
       />
     `);
   });
@@ -46,7 +46,7 @@ describe('RedirectToLogs component', () => {
 
     expect(component).toMatchInlineSnapshot(`
       <Redirect
-        to="/stream?sourceId=SOME-OTHER-SOURCE&logFilter=(expression:'',kind:kuery)"
+        to="/stream?sourceId=SOME-OTHER-SOURCE&logFilter=(language:kuery,query:'')"
       />
     `);
   });
diff --git a/x-pack/plugins/infra/public/pages/link_to/redirect_to_logs.tsx b/x-pack/plugins/infra/public/pages/link_to/redirect_to_logs.tsx
index 9606f343dbfdf..4d77077c19a99 100644
--- a/x-pack/plugins/infra/public/pages/link_to/redirect_to_logs.tsx
+++ b/x-pack/plugins/infra/public/pages/link_to/redirect_to_logs.tsx
@@ -26,7 +26,7 @@ export const RedirectToLogs = ({ location, match }: RedirectToLogsProps) => {
   const sourceId = match.params.sourceId || 'default';
   const filter = getFilterFromLocation(location);
   const searchString = flowRight(
-    replaceLogFilterInQueryString(filter),
+    replaceLogFilterInQueryString({ language: 'kuery', query: filter }),
     replaceLogPositionInQueryString(getTimeFromLocation(location)),
     replaceSourceIdInQueryString(sourceId)
   )('');
diff --git a/x-pack/plugins/infra/public/pages/link_to/redirect_to_node_logs.tsx b/x-pack/plugins/infra/public/pages/link_to/redirect_to_node_logs.tsx
index 741fad5a5310e..0df8e639b149b 100644
--- a/x-pack/plugins/infra/public/pages/link_to/redirect_to_node_logs.tsx
+++ b/x-pack/plugins/infra/public/pages/link_to/redirect_to_node_logs.tsx
@@ -68,7 +68,7 @@ export const RedirectToNodeLogs = ({
   const filter = userFilter ? `(${nodeFilter}) and (${userFilter})` : nodeFilter;
 
   const searchString = flowRight(
-    replaceLogFilterInQueryString(filter),
+    replaceLogFilterInQueryString({ language: 'kuery', query: filter }),
     replaceLogPositionInQueryString(getTimeFromLocation(location)),
     replaceSourceIdInQueryString(sourceId)
   )('');
diff --git a/x-pack/plugins/infra/public/pages/logs/stream/page_providers.tsx b/x-pack/plugins/infra/public/pages/logs/stream/page_providers.tsx
index d987cbeb439cc..27235295013e3 100644
--- a/x-pack/plugins/infra/public/pages/logs/stream/page_providers.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/stream/page_providers.tsx
@@ -50,28 +50,30 @@ const LogEntriesStateProvider: React.FC = ({ children }) => {
   const { startTimestamp, endTimestamp, targetPosition, isInitialized } = useContext(
     LogPositionState.Context
   );
-  const { filterQueryAsKuery } = useContext(LogFilterState.Context);
+  const { filterQuery } = useContext(LogFilterState.Context);
 
   // Don't render anything if the date range is incorrect.
   if (!startTimestamp || !endTimestamp) {
     return null;
   }
 
-  const logStreamProps = {
-    sourceId,
-    startTimestamp,
-    endTimestamp,
-    query: filterQueryAsKuery?.expression ?? undefined,
-    center: targetPosition ?? undefined,
-  };
-
   // Don't initialize the entries until the position has been fully intialized.
   // See `<WithLogPositionUrlState />`
   if (!isInitialized) {
     return null;
   }
 
-  return <LogStreamProvider {...logStreamProps}>{children}</LogStreamProvider>;
+  return (
+    <LogStreamProvider
+      sourceId={sourceId}
+      startTimestamp={startTimestamp}
+      endTimestamp={endTimestamp}
+      query={filterQuery?.parsedQuery}
+      center={targetPosition ?? undefined}
+    >
+      {children}
+    </LogStreamProvider>
+  );
 };
 
 const LogHighlightsStateProvider: React.FC = ({ children }) => {
@@ -86,7 +88,7 @@ const LogHighlightsStateProvider: React.FC = ({ children }) => {
     entriesEnd: bottomCursor,
     centerCursor: entries.length > 0 ? entries[Math.floor(entries.length / 2)].cursor : null,
     size: entries.length,
-    filterQuery,
+    filterQuery: filterQuery?.serializedQuery ?? null,
   };
   return <LogHighlightsState.Provider {...highlightsProps}>{children}</LogHighlightsState.Provider>;
 };
diff --git a/x-pack/plugins/infra/public/pages/logs/stream/page_toolbar.tsx b/x-pack/plugins/infra/public/pages/logs/stream/page_toolbar.tsx
index 971eb1b3e486f..fc37cd2e11c1b 100644
--- a/x-pack/plugins/infra/public/pages/logs/stream/page_toolbar.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/stream/page_toolbar.tsx
@@ -62,25 +62,18 @@ export const LogsToolbar = () => {
             iconType="search"
             indexPatterns={[derivedIndexPattern]}
             isInvalid={!isFilterQueryDraftValid}
-            onChange={(expression: Query) => {
-              if (typeof expression.query === 'string') {
-                setSurroundingLogsId(null);
-                setLogFilterQueryDraft(expression.query);
-              }
+            onChange={(query: Query) => {
+              setSurroundingLogsId(null);
+              setLogFilterQueryDraft(query);
             }}
-            onSubmit={(expression: Query) => {
-              if (typeof expression.query === 'string') {
-                setSurroundingLogsId(null);
-                applyLogFilterQuery(expression.query);
-              }
+            onSubmit={(query: Query) => {
+              setSurroundingLogsId(null);
+              applyLogFilterQuery(query);
             }}
             placeholder={i18n.translate('xpack.infra.logsPage.toolbar.kqlSearchFieldPlaceholder', {
               defaultMessage: 'Search for log entries… (e.g. host.name:host-1)',
             })}
-            query={{
-              query: filterQueryDraft?.expression ?? '',
-              language: filterQueryDraft?.kind ?? 'kuery',
-            }}
+            query={filterQueryDraft}
           />
         </EuiFlexItem>
         <EuiFlexItem grow={false}>
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/logs.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/logs.tsx
index 71bf9e50c4bb6..4fa9fdf8cdd4a 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/logs.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/logs.tsx
@@ -6,6 +6,7 @@
  */
 
 import React, { useCallback, useMemo, useState } from 'react';
+import { useThrottle } from 'react-use';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 import { EuiFieldSearch } from '@elastic/eui';
@@ -26,16 +27,21 @@ const TabComponent = (props: TabProps) => {
   const { nodeType } = useWaffleOptionsContext();
   const { options, node } = props;
 
+  const throttledTextQuery = useThrottle(textQuery, textQueryThrottleInterval);
+
   const filter = useMemo(() => {
-    let query = options.fields
-      ? `${findInventoryFields(nodeType, options.fields).id}: "${node.id}"`
-      : ``;
+    const query = [
+      ...(options.fields != null
+        ? [`${findInventoryFields(nodeType, options.fields).id}: "${node.id}"`]
+        : []),
+      ...(throttledTextQuery !== '' ? [throttledTextQuery] : []),
+    ].join(' and ');
 
-    if (textQuery) {
-      query += ` and message: ${textQuery}`;
-    }
-    return query;
-  }, [options, nodeType, node.id, textQuery]);
+    return {
+      language: 'kuery',
+      query,
+    };
+  }, [options.fields, nodeType, node.id, throttledTextQuery]);
 
   const onQueryChange = useCallback((e: React.ChangeEvent<HTMLInputElement>) => {
     setTextQuery(e.target.value);
@@ -89,3 +95,5 @@ export const LogsTab = {
   }),
   content: TabComponent,
 };
+
+const textQueryThrottleInterval = 1000; // milliseconds
diff --git a/x-pack/test/functional/apps/infra/link_to.ts b/x-pack/test/functional/apps/infra/link_to.ts
index 3e070fb9849b1..ebfcb740961b1 100644
--- a/x-pack/test/functional/apps/infra/link_to.ts
+++ b/x-pack/test/functional/apps/infra/link_to.ts
@@ -45,7 +45,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
         expect(parsedUrl.pathname).to.be('/app/logs/stream');
         expect(parsedUrl.searchParams.get('logFilter')).to.be(
-          `(expression:'trace.id:${traceId}',kind:kuery)`
+          `(language:kuery,query:'trace.id:${traceId}')`
         );
         expect(parsedUrl.searchParams.get('logPosition')).to.be(
           `(end:'${endDate}',position:(tiebreaker:0,time:${timestamp}),start:'${startDate}',streamLive:!f)`

From 31660419eafdd8c74c68123745fc699e7ee8cf2e Mon Sep 17 00:00:00 2001
From: Spencer <email@spalger.com>
Date: Tue, 27 Apr 2021 11:31:07 -0700
Subject: [PATCH 10/28] [kbn/es] disable geoip downloader at the root (#98372)

Co-authored-by: spalger <spalger@users.noreply.github.com>
---
 packages/kbn-es/src/cluster.js                        | 7 +++++--
 packages/kbn-es/src/integration_tests/cluster.test.js | 2 ++
 test/common/config.js                                 | 2 +-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/packages/kbn-es/src/cluster.js b/packages/kbn-es/src/cluster.js
index 236d5cf252136..c55e5d3513c44 100644
--- a/packages/kbn-es/src/cluster.js
+++ b/packages/kbn-es/src/cluster.js
@@ -246,7 +246,10 @@ exports.Cluster = class Cluster {
     this._log.info(chalk.bold('Starting'));
     this._log.indent(4);
 
-    const esArgs = ['action.destructive_requires_name=true'].concat(options.esArgs || []);
+    const esArgs = [
+      'action.destructive_requires_name=true',
+      'ingest.geoip.downloader.enabled=false',
+    ].concat(options.esArgs || []);
 
     // Add to esArgs if ssl is enabled
     if (this._ssl) {
@@ -272,7 +275,7 @@ exports.Cluster = class Cluster {
     // especially because we currently run many instances of ES on the same machine during CI
     options.esEnvVars.ES_JAVA_OPTS =
       (options.esEnvVars.ES_JAVA_OPTS ? `${options.esEnvVars.ES_JAVA_OPTS} ` : '') +
-      '-Xms2g -Xmx2g';
+      '-Xms1g -Xmx1g';
 
     this._process = execa(ES_BIN, args, {
       cwd: installPath,
diff --git a/packages/kbn-es/src/integration_tests/cluster.test.js b/packages/kbn-es/src/integration_tests/cluster.test.js
index 9a9ffb2afc331..6b4025840283f 100644
--- a/packages/kbn-es/src/integration_tests/cluster.test.js
+++ b/packages/kbn-es/src/integration_tests/cluster.test.js
@@ -266,6 +266,7 @@ describe('#start(installPath)', () => {
         Array [
           Array [
             "action.destructive_requires_name=true",
+            "ingest.geoip.downloader.enabled=false",
           ],
           undefined,
           Object {
@@ -344,6 +345,7 @@ describe('#run()', () => {
         Array [
           Array [
             "action.destructive_requires_name=true",
+            "ingest.geoip.downloader.enabled=false",
           ],
           undefined,
           Object {
diff --git a/test/common/config.js b/test/common/config.js
index b44f2de5042eb..84848347f94cd 100644
--- a/test/common/config.js
+++ b/test/common/config.js
@@ -21,7 +21,7 @@ export default function () {
     servers,
 
     esTestCluster: {
-      serverArgs: ['xpack.security.enabled=false', 'geoip.downloader.enabled=false'],
+      serverArgs: ['xpack.security.enabled=false'],
     },
 
     kbnTestServer: {

From a386fd86f0b0210e967b031e1d33d9ab3cf11c58 Mon Sep 17 00:00:00 2001
From: Mikhail Shustov <restrry@gmail.com>
Date: Tue, 27 Apr 2021 21:00:44 +0200
Subject: [PATCH 11/28] Fix SO migration integration tests (#98478)

* do not restart Kibana server on integration tests writing logs

* unskip tests

* do not write to ended stream to avoid a race condition

* revert changes to the File appender

* fix race condition on the logging_system level

enforce buffer usage for all the logs created during  disposal phase
---
 .../src/get_server_watch_paths.test.ts        |  4 ++
 .../src/get_server_watch_paths.ts             |  1 +
 .../server/logging/logging_system.test.ts     | 56 +++++++++++++++++++
 src/core/server/logging/logging_system.ts     | 32 +++++++----
 .../integration_tests/cleanup.test.ts         |  3 +-
 .../integration_tests/rewriting_id.test.ts    |  3 +-
 6 files changed, 84 insertions(+), 15 deletions(-)

diff --git a/packages/kbn-cli-dev-mode/src/get_server_watch_paths.test.ts b/packages/kbn-cli-dev-mode/src/get_server_watch_paths.test.ts
index ff25f2a7bf55e..2fd53dd83a1bd 100644
--- a/packages/kbn-cli-dev-mode/src/get_server_watch_paths.test.ts
+++ b/packages/kbn-cli-dev-mode/src/get_server_watch_paths.test.ts
@@ -42,21 +42,25 @@ it('produces the right watch and ignore list', () => {
       /\\\\\\.\\(md\\|sh\\|txt\\)\\$/,
       /debug\\\\\\.log\\$/,
       <absolute path>/src/plugins/*/test/**,
+      <absolute path>/src/plugins/*/integration_tests/**,
       <absolute path>/src/plugins/*/build/**,
       <absolute path>/src/plugins/*/target/**,
       <absolute path>/src/plugins/*/scripts/**,
       <absolute path>/src/plugins/*/docs/**,
       <absolute path>/test/plugin_functional/plugins/*/test/**,
+      <absolute path>/test/plugin_functional/plugins/*/integration_tests/**,
       <absolute path>/test/plugin_functional/plugins/*/build/**,
       <absolute path>/test/plugin_functional/plugins/*/target/**,
       <absolute path>/test/plugin_functional/plugins/*/scripts/**,
       <absolute path>/test/plugin_functional/plugins/*/docs/**,
       <absolute path>/x-pack/plugins/*/test/**,
+      <absolute path>/x-pack/plugins/*/integration_tests/**,
       <absolute path>/x-pack/plugins/*/build/**,
       <absolute path>/x-pack/plugins/*/target/**,
       <absolute path>/x-pack/plugins/*/scripts/**,
       <absolute path>/x-pack/plugins/*/docs/**,
       <absolute path>/x-pack/test/plugin_functional/plugins/resolver_test/test/**,
+      <absolute path>/x-pack/test/plugin_functional/plugins/resolver_test/integration_tests/**,
       <absolute path>/x-pack/test/plugin_functional/plugins/resolver_test/build/**,
       <absolute path>/x-pack/test/plugin_functional/plugins/resolver_test/target/**,
       <absolute path>/x-pack/test/plugin_functional/plugins/resolver_test/scripts/**,
diff --git a/packages/kbn-cli-dev-mode/src/get_server_watch_paths.ts b/packages/kbn-cli-dev-mode/src/get_server_watch_paths.ts
index 53aa53b5aa63a..4a9dae5c6fee2 100644
--- a/packages/kbn-cli-dev-mode/src/get_server_watch_paths.ts
+++ b/packages/kbn-cli-dev-mode/src/get_server_watch_paths.ts
@@ -28,6 +28,7 @@ export function getServerWatchPaths({ pluginPaths, pluginScanDirs }: Options) {
       (acc: string[], path) => [
         ...acc,
         Path.resolve(path, 'test/**'),
+        Path.resolve(path, 'integration_tests/**'),
         Path.resolve(path, 'build/**'),
         Path.resolve(path, 'target/**'),
         Path.resolve(path, 'scripts/**'),
diff --git a/src/core/server/logging/logging_system.test.ts b/src/core/server/logging/logging_system.test.ts
index 9c4313bc0c49d..8eed2aecb21d6 100644
--- a/src/core/server/logging/logging_system.test.ts
+++ b/src/core/server/logging/logging_system.test.ts
@@ -470,3 +470,59 @@ test('subsequent calls to setContextConfig() for the same context name can disab
     },
   });
 });
+
+test('buffers log records for already created appenders', async () => {
+  // a default config
+  await system.upgrade(
+    config.schema.validate({
+      appenders: { default: { type: 'console', layout: { type: 'json' } } },
+      root: { level: 'info' },
+    })
+  );
+
+  const logger = system.get('test', 'context');
+
+  const bufferAppendSpy = jest.spyOn((system as any).bufferAppender, 'append');
+
+  const upgradePromise = system.upgrade(
+    config.schema.validate({
+      appenders: { default: { type: 'console', layout: { type: 'json' } } },
+      root: { level: 'all' },
+    })
+  );
+
+  logger.trace('message to the known context');
+  expect(bufferAppendSpy).toHaveBeenCalledTimes(1);
+  expect(mockConsoleLog).toHaveBeenCalledTimes(0);
+
+  await upgradePromise;
+  expect(JSON.parse(mockConsoleLog.mock.calls[0][0]).message).toBe('message to the known context');
+});
+
+test('buffers log records for appenders created during config upgrade', async () => {
+  // a default config
+  await system.upgrade(
+    config.schema.validate({
+      appenders: { default: { type: 'console', layout: { type: 'json' } } },
+      root: { level: 'info' },
+    })
+  );
+
+  const bufferAppendSpy = jest.spyOn((system as any).bufferAppender, 'append');
+
+  const upgradePromise = system.upgrade(
+    config.schema.validate({
+      appenders: { default: { type: 'console', layout: { type: 'json' } } },
+      root: { level: 'all' },
+    })
+  );
+
+  const logger = system.get('test', 'context');
+  logger.trace('message to a new context');
+
+  expect(bufferAppendSpy).toHaveBeenCalledTimes(1);
+  expect(mockConsoleLog).toHaveBeenCalledTimes(0);
+
+  await upgradePromise;
+  expect(JSON.parse(mockConsoleLog.mock.calls[0][0]).message).toBe('message to a new context');
+});
diff --git a/src/core/server/logging/logging_system.ts b/src/core/server/logging/logging_system.ts
index d7c34b48c4101..45a687493c163 100644
--- a/src/core/server/logging/logging_system.ts
+++ b/src/core/server/logging/logging_system.ts
@@ -167,17 +167,13 @@ export class LoggingSystem implements LoggerFactory {
   }
 
   private async applyBaseConfig(newBaseConfig: LoggingConfig) {
+    this.enforceBufferAppendersUsage();
+
     const computedConfig = [...this.contextConfigs.values()].reduce(
       (baseConfig, contextConfig) => baseConfig.extend(contextConfig),
       newBaseConfig
     );
 
-    // reconfigure all the loggers without configuration to have them use the buffer
-    // appender while we are awaiting for the appenders to be disposed.
-    for (const [loggerKey, loggerAdapter] of this.loggers) {
-      loggerAdapter.updateLogger(this.createLogger(loggerKey, undefined));
-    }
-
     // Appenders must be reset, so we first dispose of the current ones, then
     // build up a new set of appenders.
     await Promise.all([...this.appenders.values()].map((a) => a.dispose()));
@@ -204,18 +200,32 @@ export class LoggingSystem implements LoggerFactory {
       }
     }
 
-    for (const [loggerKey, loggerAdapter] of this.loggers) {
-      loggerAdapter.updateLogger(this.createLogger(loggerKey, computedConfig));
-    }
-
+    this.enforceConfiguredAppendersUsage(computedConfig);
     // We keep a reference to the base config so we can properly extend it
     // on each config change.
     this.baseConfig = newBaseConfig;
-    this.computedConfig = computedConfig;
 
     // Re-log all buffered log records with newly configured appenders.
     for (const logRecord of this.bufferAppender.flush()) {
       this.get(logRecord.context).log(logRecord);
     }
   }
+
+  // reconfigure all the loggers to have them use the buffer appender
+  // while we are awaiting for the appenders to be disposed.
+  private enforceBufferAppendersUsage() {
+    for (const [loggerKey, loggerAdapter] of this.loggers) {
+      loggerAdapter.updateLogger(this.createLogger(loggerKey, undefined));
+    }
+
+    // new loggers created during applyBaseConfig execution should use the buffer appender as well
+    this.computedConfig = undefined;
+  }
+
+  private enforceConfiguredAppendersUsage(config: LoggingConfig) {
+    for (const [loggerKey, loggerAdapter] of this.loggers) {
+      loggerAdapter.updateLogger(this.createLogger(loggerKey, config));
+    }
+    this.computedConfig = config;
+  }
 }
diff --git a/src/core/server/saved_objects/migrationsv2/integration_tests/cleanup.test.ts b/src/core/server/saved_objects/migrationsv2/integration_tests/cleanup.test.ts
index 997105587da68..48bb282da18f6 100644
--- a/src/core/server/saved_objects/migrationsv2/integration_tests/cleanup.test.ts
+++ b/src/core/server/saved_objects/migrationsv2/integration_tests/cleanup.test.ts
@@ -53,8 +53,7 @@ function createRoot() {
   );
 }
 
-// CI FAILURE: https://github.com/elastic/kibana/issues/98352
-describe.skip('migration v2', () => {
+describe('migration v2', () => {
   let esServer: kbnTestServer.TestElasticsearchUtils;
   let root: Root;
 
diff --git a/src/core/server/saved_objects/migrationsv2/integration_tests/rewriting_id.test.ts b/src/core/server/saved_objects/migrationsv2/integration_tests/rewriting_id.test.ts
index ed6a448b115d0..9f7e32c49ef15 100644
--- a/src/core/server/saved_objects/migrationsv2/integration_tests/rewriting_id.test.ts
+++ b/src/core/server/saved_objects/migrationsv2/integration_tests/rewriting_id.test.ts
@@ -88,8 +88,7 @@ function createRoot() {
   );
 }
 
-// CI FAILURE: https://github.com/elastic/kibana/issues/98351
-describe.skip('migration v2', () => {
+describe('migration v2', () => {
   let esServer: kbnTestServer.TestElasticsearchUtils;
   let root: Root;
 

From 6ed93c3571b4a655d8545397497f8603573910e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20Fern=C3=A1ndez=20Haro?=
 <alejandro.haro@elastic.co>
Date: Tue, 27 Apr 2021 21:45:19 +0200
Subject: [PATCH 12/28] [Telemetry] Remove all usages of `any` (#98338)

---
 .eslintrc.js                                  |  18 +
 api_docs/telemetry.json                       | 890 +++++++++++++++---
 api_docs/telemetry.mdx                        |   9 +-
 ...na-plugin-plugins-data-public.searchbar.md |   4 +-
 packages/kbn-analytics/src/reporter.ts        |   2 +-
 packages/kbn-analytics/src/storage.ts         |   6 +-
 packages/kbn-analytics/src/util.ts            |   2 +-
 .../public/management_app/types.ts            |   3 +-
 src/plugins/data/server/server.api.md         |   1 -
 ...emetry_application_usage_collector.test.ts |  19 +-
 .../register_config_usage_collector.test.ts   |   2 +-
 .../core/core_usage_collector.test.ts         |   2 +-
 .../kibana/get_saved_object_counts.test.ts    |   6 +-
 .../server/collectors/kibana/index.test.ts    |   3 +-
 .../telemetry_management_collector.test.ts    |   7 +-
 .../telemetry_management_collector.ts         |   5 +-
 .../server/collectors/ui_metric/index.test.ts |  56 +-
 .../get_telemetry_failure_details.test.ts     |  12 +-
 .../get_telemetry_opt_in.test.ts              |   3 +-
 .../components/opted_in_notice_banner.tsx     |   2 +-
 src/plugins/telemetry/public/index.ts         |   3 +-
 .../render_opt_in_banner.tsx                  |   2 +-
 .../public/services/telemetry_sender.ts       |   4 +-
 .../collectors/usage/ensure_deep_object.ts    |   5 +-
 .../usage/telemetry_usage_collector.test.ts   |  12 +-
 src/plugins/telemetry/server/fetcher.ts       |  19 +-
 src/plugins/telemetry/server/index.ts         |   3 +-
 .../get_cluster_info.test.ts                  |  10 +-
 .../get_cluster_stats.test.ts                 |  12 +-
 .../get_data_telemetry.test.ts                |   2 +-
 .../server/telemetry_collection/get_kibana.ts |   6 +-
 .../get_local_stats.test.ts                   |  19 +-
 .../telemetry_collection/get_local_stats.ts   |   4 +-
 .../telemetry_collection/get_nodes_usage.ts   |  12 +-
 .../server/telemetry_collection/index.ts      |   1 +
 .../get_telemetry_saved_object.test.ts        |  31 +-
 .../server/encryption/encrypt.ts              |   8 +-
 .../server/plugin.ts                          |  10 +-
 ...telemetry_management_section.test.tsx.snap |  20 +-
 .../components/opt_in_example_flyout.tsx      |   4 +-
 .../telemetry_management_section.test.tsx     |  17 +-
 .../telemetry_management_section.tsx          |  41 +-
 .../telemetry_management_section_wrapper.tsx  |  12 +-
 .../public/plugin.tsx                         |  15 +-
 .../server/collector/collector.ts             |  14 +-
 .../server/collector/collector_set.test.ts    |  20 +-
 .../server/collector/collector_set.ts         |   9 +-
 .../server/collector/usage_collector.ts       |   2 +
 .../server/report/store_report.test.ts        |   2 +-
 .../server/routes/stats/stats.ts              |  15 +-
 .../telemetry_collection/get_license.test.ts  |   6 +-
 .../get_stats_with_xpack.test.ts              |  31 +-
 .../get_stats_with_xpack.ts                   |   4 +-
 .../is_cluster_opted_in.test.ts               |   6 +-
 .../is_cluster_opted_in.ts                    |   4 +-
 55 files changed, 1089 insertions(+), 348 deletions(-)

diff --git a/.eslintrc.js b/.eslintrc.js
index 0f7af42fafbfd..8a6ea7957927a 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -1406,6 +1406,24 @@ module.exports = {
       },
     },
 
+    /**
+     * Do not allow `any`
+     */
+    {
+      files: [
+        'packages/kbn-analytics/**',
+        // 'packages/kbn-telemetry-tools/**',
+        'src/plugins/kibana_usage_collection/**',
+        'src/plugins/usage_collection/**',
+        'src/plugins/telemetry/**',
+        'src/plugins/telemetry_collection_manager/**',
+        'src/plugins/telemetry_management_section/**',
+        'x-pack/plugins/telemetry_collection_xpack/**',
+      ],
+      rules: {
+        '@typescript-eslint/no-explicit-any': 'error',
+      },
+    },
     {
       files: [
         // core-team owned code
diff --git a/api_docs/telemetry.json b/api_docs/telemetry.json
index bff65ce9c68dd..bfb19a79bdb1e 100644
--- a/api_docs/telemetry.json
+++ b/api_docs/telemetry.json
@@ -1,9 +1,611 @@
 {
   "id": "telemetry",
   "client": {
-    "classes": [],
+    "classes": [
+      {
+        "id": "def-public.TelemetryNotifications",
+        "type": "Class",
+        "tags": [],
+        "label": "TelemetryNotifications",
+        "description": [],
+        "children": [
+          {
+            "id": "def-public.TelemetryNotifications.Unnamed",
+            "type": "Function",
+            "label": "Constructor",
+            "signature": [
+              "any"
+            ],
+            "description": [],
+            "children": [
+              {
+                "id": "def-public.TelemetryNotifications.Unnamed.$1",
+                "type": "Object",
+                "label": "{ http, overlays, telemetryService }",
+                "isRequired": true,
+                "signature": [
+                  "TelemetryNotificationsConstructor"
+                ],
+                "description": [],
+                "source": {
+                  "path": "src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.ts",
+                  "lineNumber": 27
+                }
+              }
+            ],
+            "tags": [],
+            "returnComment": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.ts",
+              "lineNumber": 27
+            }
+          },
+          {
+            "id": "def-public.TelemetryNotifications.shouldShowOptedInNoticeBanner",
+            "type": "Function",
+            "children": [],
+            "signature": [
+              "() => boolean"
+            ],
+            "description": [],
+            "label": "shouldShowOptedInNoticeBanner",
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.ts",
+              "lineNumber": 33
+            },
+            "tags": [],
+            "returnComment": []
+          },
+          {
+            "id": "def-public.TelemetryNotifications.renderOptedInNoticeBanner",
+            "type": "Function",
+            "children": [],
+            "signature": [
+              "() => void"
+            ],
+            "description": [],
+            "label": "renderOptedInNoticeBanner",
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.ts",
+              "lineNumber": 39
+            },
+            "tags": [],
+            "returnComment": []
+          },
+          {
+            "id": "def-public.TelemetryNotifications.shouldShowOptInBanner",
+            "type": "Function",
+            "children": [],
+            "signature": [
+              "() => boolean"
+            ],
+            "description": [],
+            "label": "shouldShowOptInBanner",
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.ts",
+              "lineNumber": 49
+            },
+            "tags": [],
+            "returnComment": []
+          },
+          {
+            "id": "def-public.TelemetryNotifications.renderOptInBanner",
+            "type": "Function",
+            "children": [],
+            "signature": [
+              "() => void"
+            ],
+            "description": [],
+            "label": "renderOptInBanner",
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.ts",
+              "lineNumber": 55
+            },
+            "tags": [],
+            "returnComment": []
+          },
+          {
+            "id": "def-public.TelemetryNotifications.setOptedInNoticeSeen",
+            "type": "Function",
+            "children": [],
+            "signature": [
+              "() => Promise<void>"
+            ],
+            "description": [],
+            "label": "setOptedInNoticeSeen",
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.ts",
+              "lineNumber": 73
+            },
+            "tags": [],
+            "returnComment": []
+          }
+        ],
+        "source": {
+          "path": "src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.ts",
+          "lineNumber": 20
+        },
+        "initialIsOpen": false
+      },
+      {
+        "id": "def-public.TelemetryService",
+        "type": "Class",
+        "tags": [],
+        "label": "TelemetryService",
+        "description": [],
+        "children": [
+          {
+            "tags": [],
+            "id": "def-public.TelemetryService.currentKibanaVersion",
+            "type": "string",
+            "label": "currentKibanaVersion",
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 28
+            }
+          },
+          {
+            "id": "def-public.TelemetryService.Unnamed",
+            "type": "Function",
+            "label": "Constructor",
+            "signature": [
+              "any"
+            ],
+            "description": [],
+            "children": [
+              {
+                "id": "def-public.TelemetryService.Unnamed.$1",
+                "type": "Object",
+                "label": "{\n    config,\n    http,\n    notifications,\n    currentKibanaVersion,\n    reportOptInStatusChange = true,\n  }",
+                "isRequired": true,
+                "signature": [
+                  "TelemetryServiceConstructor"
+                ],
+                "description": [],
+                "source": {
+                  "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+                  "lineNumber": 30
+                }
+              }
+            ],
+            "tags": [],
+            "returnComment": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 30
+            }
+          },
+          {
+            "id": "def-public.TelemetryService.config",
+            "type": "Object",
+            "label": "config",
+            "tags": [],
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 44
+            },
+            "signature": [
+              {
+                "pluginId": "telemetry",
+                "scope": "public",
+                "docId": "kibTelemetryPluginApi",
+                "section": "def-public.TelemetryPluginConfig",
+                "text": "TelemetryPluginConfig"
+              }
+            ]
+          },
+          {
+            "id": "def-public.TelemetryService.config",
+            "type": "Object",
+            "label": "config",
+            "tags": [],
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 48
+            },
+            "signature": [
+              {
+                "pluginId": "telemetry",
+                "scope": "public",
+                "docId": "kibTelemetryPluginApi",
+                "section": "def-public.TelemetryPluginConfig",
+                "text": "TelemetryPluginConfig"
+              }
+            ]
+          },
+          {
+            "id": "def-public.TelemetryService.isOptedIn",
+            "type": "CompoundType",
+            "label": "isOptedIn",
+            "tags": [],
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 52
+            },
+            "signature": [
+              "boolean | null"
+            ]
+          },
+          {
+            "id": "def-public.TelemetryService.isOptedIn",
+            "type": "CompoundType",
+            "label": "isOptedIn",
+            "tags": [],
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 56
+            },
+            "signature": [
+              "boolean | null"
+            ]
+          },
+          {
+            "id": "def-public.TelemetryService.userHasSeenOptedInNotice",
+            "type": "CompoundType",
+            "label": "userHasSeenOptedInNotice",
+            "tags": [],
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 60
+            },
+            "signature": [
+              "boolean | undefined"
+            ]
+          },
+          {
+            "id": "def-public.TelemetryService.userHasSeenOptedInNotice",
+            "type": "CompoundType",
+            "label": "userHasSeenOptedInNotice",
+            "tags": [],
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 64
+            },
+            "signature": [
+              "boolean | undefined"
+            ]
+          },
+          {
+            "id": "def-public.TelemetryService.getCanChangeOptInStatus",
+            "type": "Function",
+            "children": [],
+            "signature": [
+              "() => boolean"
+            ],
+            "description": [],
+            "label": "getCanChangeOptInStatus",
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 68
+            },
+            "tags": [],
+            "returnComment": []
+          },
+          {
+            "id": "def-public.TelemetryService.getOptInStatusUrl",
+            "type": "Function",
+            "children": [],
+            "signature": [
+              "() => string"
+            ],
+            "description": [],
+            "label": "getOptInStatusUrl",
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 73
+            },
+            "tags": [],
+            "returnComment": []
+          },
+          {
+            "id": "def-public.TelemetryService.getTelemetryUrl",
+            "type": "Function",
+            "children": [],
+            "signature": [
+              "() => string"
+            ],
+            "description": [],
+            "label": "getTelemetryUrl",
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 78
+            },
+            "tags": [],
+            "returnComment": []
+          },
+          {
+            "id": "def-public.TelemetryService.getUserShouldSeeOptInNotice",
+            "type": "Function",
+            "label": "getUserShouldSeeOptInNotice",
+            "signature": [
+              "() => boolean"
+            ],
+            "description": [
+              "\nReturns if an user should be shown the notice about Opt-In/Out telemetry.\nThe decision is made based on whether any user has already dismissed the message or\nthe user can't actually change the settings (in which case, there's no point on bothering them)"
+            ],
+            "children": [],
+            "tags": [],
+            "returnComment": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 88
+            }
+          },
+          {
+            "id": "def-public.TelemetryService.userCanChangeSettings",
+            "type": "boolean",
+            "label": "userCanChangeSettings",
+            "tags": [],
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 95
+            }
+          },
+          {
+            "id": "def-public.TelemetryService.userCanChangeSettings",
+            "type": "boolean",
+            "label": "userCanChangeSettings",
+            "tags": [],
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 99
+            }
+          },
+          {
+            "id": "def-public.TelemetryService.getIsOptedIn",
+            "type": "Function",
+            "children": [],
+            "signature": [
+              "() => boolean | null"
+            ],
+            "description": [],
+            "label": "getIsOptedIn",
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 103
+            },
+            "tags": [],
+            "returnComment": []
+          },
+          {
+            "id": "def-public.TelemetryService.fetchExample",
+            "type": "Function",
+            "children": [],
+            "signature": [
+              "() => Promise<any>"
+            ],
+            "description": [],
+            "label": "fetchExample",
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 107
+            },
+            "tags": [],
+            "returnComment": []
+          },
+          {
+            "id": "def-public.TelemetryService.fetchTelemetry",
+            "type": "Function",
+            "children": [
+              {
+                "id": "def-public.TelemetryService.fetchTelemetry.$1",
+                "type": "Object",
+                "label": "{ unencrypted = false }",
+                "isRequired": true,
+                "signature": [
+                  "{ unencrypted?: boolean | undefined; }"
+                ],
+                "description": [],
+                "source": {
+                  "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+                  "lineNumber": 111
+                }
+              }
+            ],
+            "signature": [
+              "({ unencrypted }?: { unencrypted?: boolean | undefined; }) => Promise<any>"
+            ],
+            "description": [],
+            "label": "fetchTelemetry",
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 111
+            },
+            "tags": [],
+            "returnComment": []
+          },
+          {
+            "id": "def-public.TelemetryService.setOptIn",
+            "type": "Function",
+            "children": [
+              {
+                "id": "def-public.TelemetryService.setOptIn.$1",
+                "type": "boolean",
+                "label": "optedIn",
+                "isRequired": true,
+                "signature": [
+                  "boolean"
+                ],
+                "description": [],
+                "source": {
+                  "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+                  "lineNumber": 119
+                }
+              }
+            ],
+            "signature": [
+              "(optedIn: boolean) => Promise<boolean>"
+            ],
+            "description": [],
+            "label": "setOptIn",
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 119
+            },
+            "tags": [],
+            "returnComment": []
+          },
+          {
+            "id": "def-public.TelemetryService.setUserHasSeenNotice",
+            "type": "Function",
+            "children": [],
+            "signature": [
+              "() => Promise<void>"
+            ],
+            "description": [],
+            "label": "setUserHasSeenNotice",
+            "source": {
+              "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+              "lineNumber": 153
+            },
+            "tags": [],
+            "returnComment": []
+          }
+        ],
+        "source": {
+          "path": "src/plugins/telemetry/public/services/telemetry_service.ts",
+          "lineNumber": 21
+        },
+        "initialIsOpen": false
+      }
+    ],
     "functions": [],
-    "interfaces": [],
+    "interfaces": [
+      {
+        "id": "def-public.TelemetryPluginConfig",
+        "type": "Interface",
+        "label": "TelemetryPluginConfig",
+        "description": [],
+        "tags": [],
+        "children": [
+          {
+            "tags": [],
+            "id": "def-public.TelemetryPluginConfig.enabled",
+            "type": "boolean",
+            "label": "enabled",
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/plugin.ts",
+              "lineNumber": 46
+            }
+          },
+          {
+            "tags": [],
+            "id": "def-public.TelemetryPluginConfig.url",
+            "type": "string",
+            "label": "url",
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/plugin.ts",
+              "lineNumber": 47
+            }
+          },
+          {
+            "tags": [],
+            "id": "def-public.TelemetryPluginConfig.banner",
+            "type": "boolean",
+            "label": "banner",
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/plugin.ts",
+              "lineNumber": 48
+            }
+          },
+          {
+            "tags": [],
+            "id": "def-public.TelemetryPluginConfig.allowChangingOptInStatus",
+            "type": "boolean",
+            "label": "allowChangingOptInStatus",
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/plugin.ts",
+              "lineNumber": 49
+            }
+          },
+          {
+            "tags": [],
+            "id": "def-public.TelemetryPluginConfig.optIn",
+            "type": "CompoundType",
+            "label": "optIn",
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/plugin.ts",
+              "lineNumber": 50
+            },
+            "signature": [
+              "boolean | null"
+            ]
+          },
+          {
+            "tags": [],
+            "id": "def-public.TelemetryPluginConfig.optInStatusUrl",
+            "type": "string",
+            "label": "optInStatusUrl",
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/plugin.ts",
+              "lineNumber": 51
+            }
+          },
+          {
+            "tags": [],
+            "id": "def-public.TelemetryPluginConfig.sendUsageFrom",
+            "type": "CompoundType",
+            "label": "sendUsageFrom",
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/plugin.ts",
+              "lineNumber": 52
+            },
+            "signature": [
+              "\"browser\" | \"server\""
+            ]
+          },
+          {
+            "tags": [],
+            "id": "def-public.TelemetryPluginConfig.telemetryNotifyUserAboutOptInDefault",
+            "type": "CompoundType",
+            "label": "telemetryNotifyUserAboutOptInDefault",
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/plugin.ts",
+              "lineNumber": 53
+            },
+            "signature": [
+              "boolean | undefined"
+            ]
+          },
+          {
+            "tags": [],
+            "id": "def-public.TelemetryPluginConfig.userCanChangeSettings",
+            "type": "CompoundType",
+            "label": "userCanChangeSettings",
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/public/plugin.ts",
+              "lineNumber": 54
+            },
+            "signature": [
+              "boolean | undefined"
+            ]
+          }
+        ],
+        "source": {
+          "path": "src/plugins/telemetry/public/plugin.ts",
+          "lineNumber": 45
+        },
+        "initialIsOpen": false
+      }
+    ],
     "enums": [],
     "misc": [],
     "objects": [],
@@ -25,7 +627,13 @@
             "lineNumber": 38
           },
           "signature": [
-            "TelemetryService"
+            {
+              "pluginId": "telemetry",
+              "scope": "public",
+              "docId": "kibTelemetryPluginApi",
+              "section": "def-public.TelemetryService",
+              "text": "TelemetryService"
+            }
           ]
         },
         {
@@ -39,7 +647,13 @@
             "lineNumber": 39
           },
           "signature": [
-            "TelemetryNotifications"
+            {
+              "pluginId": "telemetry",
+              "scope": "public",
+              "docId": "kibTelemetryPluginApi",
+              "section": "def-public.TelemetryNotifications",
+              "text": "TelemetryNotifications"
+            }
           ]
         },
         {
@@ -82,7 +696,13 @@
             "lineNumber": 34
           },
           "signature": [
-            "TelemetryService"
+            {
+              "pluginId": "telemetry",
+              "scope": "public",
+              "docId": "kibTelemetryPluginApi",
+              "section": "def-public.TelemetryService",
+              "text": "TelemetryService"
+            }
           ]
         }
       ],
@@ -95,137 +715,7 @@
     }
   },
   "server": {
-    "classes": [
-      {
-        "id": "def-server.FetcherTask",
-        "type": "Class",
-        "tags": [],
-        "label": "FetcherTask",
-        "description": [],
-        "children": [
-          {
-            "id": "def-server.FetcherTask.Unnamed",
-            "type": "Function",
-            "label": "Constructor",
-            "signature": [
-              "any"
-            ],
-            "description": [],
-            "children": [
-              {
-                "id": "def-server.FetcherTask.Unnamed.$1",
-                "type": "Object",
-                "label": "initializerContext",
-                "isRequired": true,
-                "signature": [
-                  {
-                    "pluginId": "core",
-                    "scope": "server",
-                    "docId": "kibCorePluginApi",
-                    "section": "def-server.PluginInitializerContext",
-                    "text": "PluginInitializerContext"
-                  },
-                  "<Readonly<{ optIn?: boolean | undefined; } & { enabled: boolean; url: string; allowChangingOptInStatus: boolean; config: string; banner: boolean; optInStatusUrl: string; sendUsageFrom: \"browser\" | \"server\"; }>>"
-                ],
-                "description": [],
-                "source": {
-                  "path": "src/plugins/telemetry/server/fetcher.ts",
-                  "lineNumber": 58
-                }
-              }
-            ],
-            "tags": [],
-            "returnComment": [],
-            "source": {
-              "path": "src/plugins/telemetry/server/fetcher.ts",
-              "lineNumber": 58
-            }
-          },
-          {
-            "id": "def-server.FetcherTask.start",
-            "type": "Function",
-            "label": "start",
-            "signature": [
-              "({ savedObjects, elasticsearch }: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.CoreStart",
-                "text": "CoreStart"
-              },
-              ", { telemetryCollectionManager }: ",
-              "FetcherTaskDepsStart",
-              ") => void"
-            ],
-            "description": [],
-            "children": [
-              {
-                "id": "def-server.FetcherTask.start.$1",
-                "type": "Object",
-                "label": "{ savedObjects, elasticsearch }",
-                "isRequired": true,
-                "signature": [
-                  {
-                    "pluginId": "core",
-                    "scope": "server",
-                    "docId": "kibCorePluginApi",
-                    "section": "def-server.CoreStart",
-                    "text": "CoreStart"
-                  }
-                ],
-                "description": [],
-                "source": {
-                  "path": "src/plugins/telemetry/server/fetcher.ts",
-                  "lineNumber": 65
-                }
-              },
-              {
-                "id": "def-server.FetcherTask.start.$2",
-                "type": "Object",
-                "label": "{ telemetryCollectionManager }",
-                "isRequired": true,
-                "signature": [
-                  "FetcherTaskDepsStart"
-                ],
-                "description": [],
-                "source": {
-                  "path": "src/plugins/telemetry/server/fetcher.ts",
-                  "lineNumber": 66
-                }
-              }
-            ],
-            "tags": [],
-            "returnComment": [],
-            "source": {
-              "path": "src/plugins/telemetry/server/fetcher.ts",
-              "lineNumber": 64
-            }
-          },
-          {
-            "id": "def-server.FetcherTask.stop",
-            "type": "Function",
-            "label": "stop",
-            "signature": [
-              "() => void"
-            ],
-            "description": [],
-            "children": [],
-            "tags": [],
-            "returnComment": [],
-            "source": {
-              "path": "src/plugins/telemetry/server/fetcher.ts",
-              "lineNumber": 77
-            }
-          }
-        ],
-        "source": {
-          "path": "src/plugins/telemetry/server/fetcher.ts",
-          "lineNumber": 45
-        },
-        "initialIsOpen": false
-      }
-    ],
+    "classes": [],
     "functions": [
       {
         "id": "def-server.buildDataTelemetryPayload",
@@ -420,15 +910,16 @@
             "section": "def-server.StatsCollectionContext",
             "text": "StatsCollectionContext"
           },
-          ") => Promise<{ timestamp: string; cluster_uuid: string; cluster_name: string; version: string; cluster_stats: any; collection: string; stack_stats: { data: ",
+          ") => Promise<{ timestamp: string; cluster_uuid: string; cluster_name: string; version: string; cluster_stats: Pick<{ nodes: { usage: { nodes: ",
           {
             "pluginId": "telemetry",
             "scope": "server",
             "docId": "kibTelemetryPluginApi",
-            "section": "def-server.DataTelemetryPayload",
-            "text": "DataTelemetryPayload"
+            "section": "def-server.NodeUsage",
+            "text": "NodeUsage"
           },
-          " | undefined; kibana: { count: number; indices: number; os: {}; versions: { version: string; count: number; }[]; plugins: { [plugin: string]: any; }; } | undefined; }; }[]>"
+          "[] | {}[]; }; count: ",
+          "ClusterNodeCount"
         ],
         "description": [
           "\nGet statistics for all products joined by Elasticsearch cluster."
@@ -656,6 +1147,123 @@
           "lineNumber": 38
         },
         "initialIsOpen": false
+      },
+      {
+        "id": "def-server.NodeUsage",
+        "type": "Interface",
+        "label": "NodeUsage",
+        "description": [],
+        "tags": [],
+        "children": [
+          {
+            "tags": [],
+            "id": "def-server.NodeUsage.node_id",
+            "type": "string",
+            "label": "node_id",
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/server/telemetry_collection/get_nodes_usage.ts",
+              "lineNumber": 18
+            },
+            "signature": [
+              "string | undefined"
+            ]
+          },
+          {
+            "tags": [],
+            "id": "def-server.NodeUsage.timestamp",
+            "type": "CompoundType",
+            "label": "timestamp",
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/server/telemetry_collection/get_nodes_usage.ts",
+              "lineNumber": 19
+            },
+            "signature": [
+              "React.ReactText"
+            ]
+          },
+          {
+            "tags": [],
+            "id": "def-server.NodeUsage.since",
+            "type": "number",
+            "label": "since",
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/server/telemetry_collection/get_nodes_usage.ts",
+              "lineNumber": 20
+            }
+          },
+          {
+            "tags": [],
+            "id": "def-server.NodeUsage.rest_actions",
+            "type": "Object",
+            "label": "rest_actions",
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/server/telemetry_collection/get_nodes_usage.ts",
+              "lineNumber": 21
+            },
+            "signature": [
+              "{ [key: string]: number; }"
+            ]
+          },
+          {
+            "tags": [],
+            "id": "def-server.NodeUsage.aggregations",
+            "type": "Object",
+            "label": "aggregations",
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/server/telemetry_collection/get_nodes_usage.ts",
+              "lineNumber": 24
+            },
+            "signature": [
+              "{ [key: string]: ",
+              {
+                "pluginId": "telemetry",
+                "scope": "server",
+                "docId": "kibTelemetryPluginApi",
+                "section": "def-server.NodeUsageAggregation",
+                "text": "NodeUsageAggregation"
+              },
+              "; } | undefined"
+            ]
+          }
+        ],
+        "source": {
+          "path": "src/plugins/telemetry/server/telemetry_collection/get_nodes_usage.ts",
+          "lineNumber": 17
+        },
+        "initialIsOpen": false
+      },
+      {
+        "id": "def-server.NodeUsageAggregation",
+        "type": "Interface",
+        "label": "NodeUsageAggregation",
+        "description": [],
+        "tags": [],
+        "children": [
+          {
+            "id": "def-server.NodeUsageAggregation.Unnamed",
+            "type": "Any",
+            "label": "Unnamed",
+            "tags": [],
+            "description": [],
+            "source": {
+              "path": "src/plugins/telemetry/server/telemetry_collection/get_nodes_usage.ts",
+              "lineNumber": 13
+            },
+            "signature": [
+              "any"
+            ]
+          }
+        ],
+        "source": {
+          "path": "src/plugins/telemetry/server/telemetry_collection/get_nodes_usage.ts",
+          "lineNumber": 12
+        },
+        "initialIsOpen": false
       }
     ],
     "enums": [],
@@ -701,7 +1309,7 @@
           "lineNumber": 51
         },
         "signature": [
-          "{ timestamp: string; cluster_uuid: string; cluster_name: string; version: string; cluster_stats: any; collection: string; stack_stats: { data: DataTelemetryPayload | undefined; kibana: { count: number; indices: number; os: {}; versions: { version: string; count: number; }[]; plugins: { [plugin: string]: any; }; } | undefined; }; }"
+          "{ timestamp: string; cluster_uuid: string; cluster_name: string; version: string; cluster_stats: Pick<estypes.ClusterStatsResponse, \"status\" | \"indices\" | \"nodes\" | \"cluster_uuid\" | \"timestamp\">; collection: string; stack_stats: { data: DataTelemetryPayload | undefined; kibana: { count: number; indices: number; os: {}; versions: { version: string; count: number; }[]; plugins: { [plugin: string]: Record<string, unknown>; }; } | undefined; }; }"
         ],
         "initialIsOpen": false
       }
diff --git a/api_docs/telemetry.mdx b/api_docs/telemetry.mdx
index bf91eb198f08e..f9a58d29ebd86 100644
--- a/api_docs/telemetry.mdx
+++ b/api_docs/telemetry.mdx
@@ -19,6 +19,12 @@ import telemetryObj from './telemetry.json';
 ### Start
 <DocDefinitionList data={[telemetryObj.client.start]}/>
 
+### Classes
+<DocDefinitionList data={telemetryObj.client.classes}/>
+
+### Interfaces
+<DocDefinitionList data={telemetryObj.client.interfaces}/>
+
 ## Server
 
 ### Setup
@@ -30,9 +36,6 @@ import telemetryObj from './telemetry.json';
 ### Functions
 <DocDefinitionList data={telemetryObj.server.functions}/>
 
-### Classes
-<DocDefinitionList data={telemetryObj.server.classes}/>
-
 ### Interfaces
 <DocDefinitionList data={telemetryObj.server.interfaces}/>
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchbar.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchbar.md
index 193a2e5a24f3f..5fffc5436e9c6 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchbar.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchbar.md
@@ -7,7 +7,7 @@
 <b>Signature:</b>
 
 ```typescript
-SearchBar: React.ComponentClass<Pick<Pick<SearchBarProps, "query" | "placeholder" | "isLoading" | "iconType" | "indexPatterns" | "filters" | "dataTestSubj" | "isClearable" | "intl" | "refreshInterval" | "nonKqlMode" | "nonKqlModeHelpText" | "screenTitle" | "onRefresh" | "onRefreshChange" | "showQueryInput" | "showDatePicker" | "showAutoRefreshOnly" | "dateRangeFrom" | "dateRangeTo" | "isRefreshPaused" | "customSubmitButton" | "timeHistory" | "indicateNoData" | "onFiltersUpdated" | "savedQuery" | "showSaveQuery" | "onClearSavedQuery" | "showQueryBar" | "showFilterBar" | "onQueryChange" | "onQuerySubmit" | "onSaved" | "onSavedQueryUpdated">, "query" | "placeholder" | "isLoading" | "iconType" | "indexPatterns" | "filters" | "dataTestSubj" | "isClearable" | "refreshInterval" | "nonKqlMode" | "nonKqlModeHelpText" | "screenTitle" | "onRefresh" | "onRefreshChange" | "showQueryInput" | "showDatePicker" | "showAutoRefreshOnly" | "dateRangeFrom" | "dateRangeTo" | "isRefreshPaused" | "customSubmitButton" | "timeHistory" | "indicateNoData" | "onFiltersUpdated" | "savedQuery" | "showSaveQuery" | "onClearSavedQuery" | "showQueryBar" | "showFilterBar" | "onQueryChange" | "onQuerySubmit" | "onSaved" | "onSavedQueryUpdated">, any> & {
-    WrappedComponent: React.ComponentType<Pick<SearchBarProps, "query" | "placeholder" | "isLoading" | "iconType" | "indexPatterns" | "filters" | "dataTestSubj" | "isClearable" | "intl" | "refreshInterval" | "nonKqlMode" | "nonKqlModeHelpText" | "screenTitle" | "onRefresh" | "onRefreshChange" | "showQueryInput" | "showDatePicker" | "showAutoRefreshOnly" | "dateRangeFrom" | "dateRangeTo" | "isRefreshPaused" | "customSubmitButton" | "timeHistory" | "indicateNoData" | "onFiltersUpdated" | "savedQuery" | "showSaveQuery" | "onClearSavedQuery" | "showQueryBar" | "showFilterBar" | "onQueryChange" | "onQuerySubmit" | "onSaved" | "onSavedQueryUpdated"> & ReactIntl.InjectedIntlProps>;
+SearchBar: React.ComponentClass<Pick<Pick<SearchBarProps, "query" | "placeholder" | "isLoading" | "iconType" | "indexPatterns" | "filters" | "dataTestSubj" | "refreshInterval" | "isClearable" | "intl" | "nonKqlMode" | "nonKqlModeHelpText" | "screenTitle" | "onRefresh" | "onRefreshChange" | "showQueryInput" | "showDatePicker" | "showAutoRefreshOnly" | "dateRangeFrom" | "dateRangeTo" | "isRefreshPaused" | "customSubmitButton" | "timeHistory" | "indicateNoData" | "onFiltersUpdated" | "savedQuery" | "showSaveQuery" | "onClearSavedQuery" | "showQueryBar" | "showFilterBar" | "onQueryChange" | "onQuerySubmit" | "onSaved" | "onSavedQueryUpdated">, "query" | "placeholder" | "isLoading" | "iconType" | "indexPatterns" | "filters" | "dataTestSubj" | "refreshInterval" | "isClearable" | "nonKqlMode" | "nonKqlModeHelpText" | "screenTitle" | "onRefresh" | "onRefreshChange" | "showQueryInput" | "showDatePicker" | "showAutoRefreshOnly" | "dateRangeFrom" | "dateRangeTo" | "isRefreshPaused" | "customSubmitButton" | "timeHistory" | "indicateNoData" | "onFiltersUpdated" | "savedQuery" | "showSaveQuery" | "onClearSavedQuery" | "showQueryBar" | "showFilterBar" | "onQueryChange" | "onQuerySubmit" | "onSaved" | "onSavedQueryUpdated">, any> & {
+    WrappedComponent: React.ComponentType<Pick<SearchBarProps, "query" | "placeholder" | "isLoading" | "iconType" | "indexPatterns" | "filters" | "dataTestSubj" | "refreshInterval" | "isClearable" | "intl" | "nonKqlMode" | "nonKqlModeHelpText" | "screenTitle" | "onRefresh" | "onRefreshChange" | "showQueryInput" | "showDatePicker" | "showAutoRefreshOnly" | "dateRangeFrom" | "dateRangeTo" | "isRefreshPaused" | "customSubmitButton" | "timeHistory" | "indicateNoData" | "onFiltersUpdated" | "savedQuery" | "showSaveQuery" | "onClearSavedQuery" | "showQueryBar" | "showFilterBar" | "onQueryChange" | "onQuerySubmit" | "onSaved" | "onSavedQueryUpdated"> & ReactIntl.InjectedIntlProps>;
 }
 ```
diff --git a/packages/kbn-analytics/src/reporter.ts b/packages/kbn-analytics/src/reporter.ts
index 44e6758eb4643..c7c9cf1541d21 100644
--- a/packages/kbn-analytics/src/reporter.ts
+++ b/packages/kbn-analytics/src/reporter.ts
@@ -68,7 +68,7 @@ export class Reporter {
     }
   };
 
-  private log(message: any) {
+  private log(message: unknown) {
     if (this.debug) {
       // eslint-disable-next-line
       console.debug(message);
diff --git a/packages/kbn-analytics/src/storage.ts b/packages/kbn-analytics/src/storage.ts
index b080a53029724..ac1084e807fc7 100644
--- a/packages/kbn-analytics/src/storage.ts
+++ b/packages/kbn-analytics/src/storage.ts
@@ -8,10 +8,10 @@
 
 import { Report } from './report';
 
-export interface Storage<T = any, S = void> {
-  get: (key: string) => T | null;
+export interface Storage<T = Report, S = void> {
+  get: (key: string) => T | undefined;
   set: (key: string, value: T) => S;
-  remove: (key: string) => T | null;
+  remove: (key: string) => T | undefined;
   clear: () => void;
 }
 
diff --git a/packages/kbn-analytics/src/util.ts b/packages/kbn-analytics/src/util.ts
index 96e18c43e104f..b3768b4df94b8 100644
--- a/packages/kbn-analytics/src/util.ts
+++ b/packages/kbn-analytics/src/util.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-export function wrapArray<T extends any>(subj: T | T[]): T[] {
+export function wrapArray<T>(subj: T | T[]): T[] {
   return Array.isArray(subj) ? subj : [subj];
 }
 
diff --git a/src/plugins/advanced_settings/public/management_app/types.ts b/src/plugins/advanced_settings/public/management_app/types.ts
index 50b39114d2143..854a70ae48a97 100644
--- a/src/plugins/advanced_settings/public/management_app/types.ts
+++ b/src/plugins/advanced_settings/public/management_app/types.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
+import type { ReactElement } from 'react';
 import { UiCounterMetricType } from '@kbn/analytics';
 import { UiSettingsType, StringValidation, ImageValidation } from '../../../../core/public';
 
@@ -13,7 +14,7 @@ export interface FieldSetting {
   displayName: string;
   name: string;
   value: unknown;
-  description?: string;
+  description?: string | ReactElement;
   options?: string[];
   optionLabels?: Record<string, string>;
   requiresPageReload: boolean;
diff --git a/src/plugins/data/server/server.api.md b/src/plugins/data/server/server.api.md
index 15d3f5c403b1f..a69df282cd568 100644
--- a/src/plugins/data/server/server.api.md
+++ b/src/plugins/data/server/server.api.md
@@ -32,7 +32,6 @@ import { ExpressionsServerSetup } from 'src/plugins/expressions/server';
 import { ExpressionValueBoxed } from 'src/plugins/expressions/common';
 import { FormatFactory as FormatFactory_2 } from 'src/plugins/data/common/field_formats/utils';
 import { IAggConfigs as IAggConfigs_2 } from 'src/plugins/data/public';
-import { ISavedObjectsRepository } from 'src/core/server';
 import { IScopedClusterClient } from 'src/core/server';
 import { ISearchOptions as ISearchOptions_2 } from 'src/plugins/data/public';
 import { ISearchSource } from 'src/plugins/data/public';
diff --git a/src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.test.ts b/src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.test.ts
index da4e1b101914f..38864945a17d0 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.test.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/application_usage/telemetry_application_usage_collector.test.ts
@@ -116,10 +116,15 @@ describe('telemetry_application_usage', () => {
                   minutesOnScreen: 10,
                   numberOfClicks: 10,
                 },
+                type: opts.type,
+                references: [],
+                score: 0,
               },
             ],
             total: 1,
-          } as any;
+            per_page: 10,
+            page: 1,
+          };
         case SAVED_OBJECTS_DAILY_TYPE:
           return {
             saved_objects: [
@@ -131,9 +136,21 @@ describe('telemetry_application_usage', () => {
                   minutesOnScreen: 0.5,
                   numberOfClicks: 1,
                 },
+                type: opts.type,
+                references: [],
+                score: 0,
               },
             ],
             total: 1,
+            per_page: 10,
+            page: 1,
+          };
+        default:
+          return {
+            saved_objects: [],
+            total: 0,
+            per_page: 10,
+            page: 1,
           };
       }
     });
diff --git a/src/plugins/kibana_usage_collection/server/collectors/config_usage/register_config_usage_collector.test.ts b/src/plugins/kibana_usage_collection/server/collectors/config_usage/register_config_usage_collector.test.ts
index 7d4f03fd30edf..bc6f8c956b669 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/config_usage/register_config_usage_collector.test.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/config_usage/register_config_usage_collector.test.ts
@@ -28,7 +28,7 @@ describe('kibana_config_usage', () => {
 
   const collectorFetchContext = createCollectorFetchContextMock();
   const coreUsageDataStart = coreUsageDataServiceMock.createStartContract();
-  const mockConfigUsage = (Symbol('config usage telemetry') as any) as ConfigUsageData;
+  const mockConfigUsage = (Symbol('config usage telemetry') as unknown) as ConfigUsageData;
   coreUsageDataStart.getConfigsUsageData.mockResolvedValue(mockConfigUsage);
 
   beforeAll(() => registerConfigUsageCollector(usageCollectionMock, () => coreUsageDataStart));
diff --git a/src/plugins/kibana_usage_collection/server/collectors/core/core_usage_collector.test.ts b/src/plugins/kibana_usage_collection/server/collectors/core/core_usage_collector.test.ts
index b671a9f93d369..5410e491a85fd 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/core/core_usage_collector.test.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/core/core_usage_collector.test.ts
@@ -28,7 +28,7 @@ describe('telemetry_core', () => {
 
   const collectorFetchContext = createCollectorFetchContextMock();
   const coreUsageDataStart = coreUsageDataServiceMock.createStartContract();
-  const getCoreUsageDataReturnValue = (Symbol('core telemetry') as any) as CoreUsageData;
+  const getCoreUsageDataReturnValue = (Symbol('core telemetry') as unknown) as CoreUsageData;
   coreUsageDataStart.getCoreUsageData.mockResolvedValue(getCoreUsageDataReturnValue);
 
   beforeAll(() => registerCoreUsageCollector(usageCollectionMock, () => coreUsageDataStart));
diff --git a/src/plugins/kibana_usage_collection/server/collectors/kibana/get_saved_object_counts.test.ts b/src/plugins/kibana_usage_collection/server/collectors/kibana/get_saved_object_counts.test.ts
index 15cbecde386f7..3d5d7854d6f9e 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/kibana/get_saved_object_counts.test.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/kibana/get_saved_object_counts.test.ts
@@ -9,13 +9,11 @@
 import { elasticsearchServiceMock } from '../../../../../../src/core/server/mocks';
 import { getSavedObjectsCounts } from './get_saved_object_counts';
 
-export function mockGetSavedObjectsCounts(params: any) {
+export function mockGetSavedObjectsCounts<TBody>(params: TBody) {
   const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
   esClient.search.mockResolvedValue(
     // @ts-expect-error we only care about the response body
-    {
-      body: { ...params },
-    }
+    { body: { ...params } }
   );
   return esClient;
 }
diff --git a/src/plugins/kibana_usage_collection/server/collectors/kibana/index.test.ts b/src/plugins/kibana_usage_collection/server/collectors/kibana/index.test.ts
index e1afbfbcecc4e..2c75d3edc3a84 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/kibana/index.test.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/kibana/index.test.ts
@@ -34,7 +34,8 @@ describe('telemetry_kibana', () => {
   const getMockFetchClients = (hits?: unknown[]) => {
     const fetchParamsMock = createCollectorFetchContextMock();
     const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
-    esClient.search.mockResolvedValue({ body: { hits: { hits } } } as any);
+    // @ts-expect-error for the sake of the tests, we only require `hits`
+    esClient.search.mockResolvedValue({ body: { hits: { hits } } });
     fetchParamsMock.esClient = esClient;
     return fetchParamsMock;
   };
diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/telemetry_management_collector.test.ts b/src/plugins/kibana_usage_collection/server/collectors/management/telemetry_management_collector.test.ts
index cb0b1c045397d..8295342c527ab 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/management/telemetry_management_collector.test.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/management/telemetry_management_collector.test.ts
@@ -17,6 +17,7 @@ import {
   registerManagementUsageCollector,
   createCollectorFetch,
 } from './telemetry_management_collector';
+import { IUiSettingsClient } from 'kibana/server';
 
 const logger = loggingSystemMock.createLogger();
 
@@ -30,7 +31,7 @@ describe('telemetry_application_usage_collector', () => {
   });
 
   const uiSettingsClient = uiSettingsServiceMock.createClient();
-  const getUiSettingsClient = jest.fn(() => uiSettingsClient);
+  const getUiSettingsClient = jest.fn((): IUiSettingsClient | undefined => uiSettingsClient);
   const mockedFetchContext = createCollectorFetchContextMock();
 
   beforeAll(() => {
@@ -42,7 +43,7 @@ describe('telemetry_application_usage_collector', () => {
   });
 
   test('isReady() => false if no client', () => {
-    getUiSettingsClient.mockImplementationOnce(() => undefined as any);
+    getUiSettingsClient.mockImplementationOnce(() => undefined);
     expect(collector.isReady()).toBe(false);
   });
 
@@ -60,7 +61,7 @@ describe('telemetry_application_usage_collector', () => {
   });
 
   test('fetch() should not fail if invoked when not ready', async () => {
-    getUiSettingsClient.mockImplementationOnce(() => undefined as any);
+    getUiSettingsClient.mockImplementationOnce(() => undefined);
     await expect(collector.fetch(mockedFetchContext)).resolves.toBe(undefined);
   });
 });
diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/telemetry_management_collector.ts b/src/plugins/kibana_usage_collection/server/collectors/management/telemetry_management_collector.ts
index cba5140997f3f..7dd1a4dc4410e 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/management/telemetry_management_collector.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/management/telemetry_management_collector.ts
@@ -22,12 +22,13 @@ export function createCollectorFetch(getUiSettingsClient: () => IUiSettingsClien
     const userProvided = await uiSettingsClient.getUserProvided();
     const modifiedEntries = Object.entries(userProvided)
       .filter(([key]) => key !== 'buildNum')
-      .reduce((obj: any, [key, { userValue }]) => {
+      .reduce((obj: Record<string, unknown>, [key, { userValue }]) => {
         const sensitive = uiSettingsClient.isSensitive(key);
         obj[key] = sensitive ? REDACTED_KEYWORD : userValue;
         return obj;
       }, {});
-    return modifiedEntries;
+    // TODO: It would be Partial<UsageStats>, but the telemetry-tools for the schema extraction still does not support it. We need to fix it before setting the right Partial<UsageStats> type
+    return (modifiedEntries as unknown) as UsageStats;
   };
 }
 
diff --git a/src/plugins/kibana_usage_collection/server/collectors/ui_metric/index.test.ts b/src/plugins/kibana_usage_collection/server/collectors/ui_metric/index.test.ts
index 51ecbf736bfc1..31cb869d14e57 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/ui_metric/index.test.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/ui_metric/index.test.ts
@@ -30,6 +30,8 @@ describe('telemetry_ui_metric', () => {
   const registerType = jest.fn();
   const mockedFetchContext = createCollectorFetchContextMock();
 
+  const commonSavedObjectsAttributes = { score: 0, references: [], type: 'ui-metric' };
+
   beforeAll(() =>
     registerUiMetricUsageCollector(usageCollectionMock, registerType, getUsageCollector)
   );
@@ -44,13 +46,12 @@ describe('telemetry_ui_metric', () => {
 
   test('when savedObjectClient is initialised, return something', async () => {
     const savedObjectClient = savedObjectsRepositoryMock.create();
-    savedObjectClient.find.mockImplementation(
-      async () =>
-        ({
-          saved_objects: [],
-          total: 0,
-        } as any)
-    );
+    savedObjectClient.find.mockImplementation(async () => ({
+      saved_objects: [],
+      total: 0,
+      per_page: 10,
+      page: 1,
+    }));
     getUsageCollector.mockImplementation(() => savedObjectClient);
 
     expect(await collector.fetch(mockedFetchContext)).toStrictEqual({});
@@ -59,20 +60,33 @@ describe('telemetry_ui_metric', () => {
 
   test('results grouped by appName', async () => {
     const savedObjectClient = savedObjectsRepositoryMock.create();
-    savedObjectClient.find.mockImplementation(async () => {
-      return {
-        saved_objects: [
-          { id: 'testAppName:testKeyName1', attributes: { count: 3 } },
-          { id: 'testAppName:testKeyName2', attributes: { count: 5 } },
-          { id: 'testAppName2:testKeyName3', attributes: { count: 1 } },
-          {
-            id:
-              'kibana-user_agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0',
-            attributes: { count: 1 },
-          },
-        ],
-        total: 3,
-      } as any;
+    savedObjectClient.find.mockResolvedValue({
+      saved_objects: [
+        {
+          ...commonSavedObjectsAttributes,
+          id: 'testAppName:testKeyName1',
+          attributes: { count: 3 },
+        },
+        {
+          ...commonSavedObjectsAttributes,
+          id: 'testAppName:testKeyName2',
+          attributes: { count: 5 },
+        },
+        {
+          ...commonSavedObjectsAttributes,
+          id: 'testAppName2:testKeyName3',
+          attributes: { count: 1 },
+        },
+        {
+          ...commonSavedObjectsAttributes,
+          id:
+            'kibana-user_agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0',
+          attributes: { count: 1 },
+        },
+      ],
+      total: 3,
+      per_page: 3,
+      page: 1,
     });
 
     getUsageCollector.mockImplementation(() => savedObjectClient);
diff --git a/src/plugins/telemetry/common/telemetry_config/get_telemetry_failure_details.test.ts b/src/plugins/telemetry/common/telemetry_config/get_telemetry_failure_details.test.ts
index 617b5189de4a8..c93ba53230954 100644
--- a/src/plugins/telemetry/common/telemetry_config/get_telemetry_failure_details.test.ts
+++ b/src/plugins/telemetry/common/telemetry_config/get_telemetry_failure_details.test.ts
@@ -35,9 +35,10 @@ describe('getTelemetryFailureDetails: get details about server usage fetcher fai
     expect(
       getTelemetryFailureDetails({
         telemetrySavedObject: {
+          // @ts-expect-error the test is intentionally testing malformed SOs
           reportFailureCount: null,
           reportFailureVersion: failureVersion,
-        } as any,
+        },
       })
     ).toStrictEqual({ failureVersion, failureCount: 0 });
     expect(
@@ -51,9 +52,10 @@ describe('getTelemetryFailureDetails: get details about server usage fetcher fai
     expect(
       getTelemetryFailureDetails({
         telemetrySavedObject: {
+          // @ts-expect-error the test is intentionally testing malformed SOs
           reportFailureCount: 'not_a_number',
           reportFailureVersion: failureVersion,
-        } as any,
+        },
       })
     ).toStrictEqual({ failureVersion, failureCount: 0 });
   });
@@ -63,9 +65,10 @@ describe('getTelemetryFailureDetails: get details about server usage fetcher fai
     expect(
       getTelemetryFailureDetails({
         telemetrySavedObject: {
+          // @ts-expect-error the test is intentionally testing malformed SOs
           reportFailureVersion: null,
           reportFailureCount: failureCount,
-        } as any,
+        },
       })
     ).toStrictEqual({ failureCount, failureVersion: undefined });
     expect(
@@ -76,9 +79,10 @@ describe('getTelemetryFailureDetails: get details about server usage fetcher fai
     expect(
       getTelemetryFailureDetails({
         telemetrySavedObject: {
+          // @ts-expect-error the test is intentionally testing malformed SOs
           reportFailureVersion: 123,
           reportFailureCount: failureCount,
-        } as any,
+        },
       })
     ).toStrictEqual({ failureCount, failureVersion: undefined });
   });
diff --git a/src/plugins/telemetry/common/telemetry_config/get_telemetry_opt_in.test.ts b/src/plugins/telemetry/common/telemetry_config/get_telemetry_opt_in.test.ts
index 65e4a2d43eef7..ede56688e0449 100644
--- a/src/plugins/telemetry/common/telemetry_config/get_telemetry_opt_in.test.ts
+++ b/src/plugins/telemetry/common/telemetry_config/get_telemetry_opt_in.test.ts
@@ -55,6 +55,7 @@ describe('getTelemetryOptIn', () => {
   // build a table of tests with version checks, with results for enabled false
   type VersionCheckTable = Array<Partial<CallGetTelemetryOptInParams>>;
 
+  // @ts-expect-error the test is intentionally testing malformed objects
   const EnabledFalseVersionChecks: VersionCheckTable = [
     { lastVersionChecked: '8.0.0', currentKibanaVersion: '8.0.0', result: false },
     { lastVersionChecked: '8.0.0', currentKibanaVersion: '8.0.1', result: false },
@@ -112,7 +113,7 @@ describe('getTelemetryOptIn', () => {
 interface CallGetTelemetryOptInParams {
   savedObjectNotFound: boolean;
   savedObjectForbidden: boolean;
-  lastVersionChecked?: any; // should be a string, but test with non-strings
+  lastVersionChecked?: string; // should be a string, but test with non-strings
   currentKibanaVersion: string;
   result?: boolean | null;
   enabled: boolean | null | undefined;
diff --git a/src/plugins/telemetry/public/components/opted_in_notice_banner.tsx b/src/plugins/telemetry/public/components/opted_in_notice_banner.tsx
index b91f6ee9e4b51..a10c26c22e3fa 100644
--- a/src/plugins/telemetry/public/components/opted_in_notice_banner.tsx
+++ b/src/plugins/telemetry/public/components/opted_in_notice_banner.tsx
@@ -17,7 +17,7 @@ import { HttpSetup } from '../../../../core/public';
 
 interface Props {
   http: HttpSetup;
-  onSeenBanner: () => any;
+  onSeenBanner: () => unknown;
 }
 
 export class OptedInNoticeBanner extends React.PureComponent<Props> {
diff --git a/src/plugins/telemetry/public/index.ts b/src/plugins/telemetry/public/index.ts
index 47ba7828eaec2..aef955e228dd3 100644
--- a/src/plugins/telemetry/public/index.ts
+++ b/src/plugins/telemetry/public/index.ts
@@ -8,7 +8,8 @@
 
 import { PluginInitializerContext } from 'kibana/public';
 import { TelemetryPlugin, TelemetryPluginConfig } from './plugin';
-export type { TelemetryPluginStart, TelemetryPluginSetup } from './plugin';
+export type { TelemetryPluginStart, TelemetryPluginSetup, TelemetryPluginConfig } from './plugin';
+export type { TelemetryNotifications, TelemetryService } from './services';
 
 export function plugin(initializerContext: PluginInitializerContext<TelemetryPluginConfig>) {
   return new TelemetryPlugin(initializerContext);
diff --git a/src/plugins/telemetry/public/services/telemetry_notifications/render_opt_in_banner.tsx b/src/plugins/telemetry/public/services/telemetry_notifications/render_opt_in_banner.tsx
index 4180f577e3037..f880aef3e3235 100644
--- a/src/plugins/telemetry/public/services/telemetry_notifications/render_opt_in_banner.tsx
+++ b/src/plugins/telemetry/public/services/telemetry_notifications/render_opt_in_banner.tsx
@@ -13,7 +13,7 @@ import { toMountPoint } from '../../../../kibana_react/public';
 
 interface RenderBannerConfig {
   overlays: CoreStart['overlays'];
-  setOptIn: (isOptIn: boolean) => Promise<any>;
+  setOptIn: (isOptIn: boolean) => Promise<unknown>;
 }
 
 export function renderOptInBanner({ setOptIn, overlays }: RenderBannerConfig) {
diff --git a/src/plugins/telemetry/public/services/telemetry_sender.ts b/src/plugins/telemetry/public/services/telemetry_sender.ts
index 05588f4c9e704..937416d283872 100644
--- a/src/plugins/telemetry/public/services/telemetry_sender.ts
+++ b/src/plugins/telemetry/public/services/telemetry_sender.ts
@@ -58,8 +58,8 @@ export class TelemetrySender {
     this.isSending = true;
     try {
       const telemetryUrl = this.telemetryService.getTelemetryUrl();
-      const telemetryData: any | any[] = await this.telemetryService.fetchTelemetry();
-      const clusters: string[] = [].concat(telemetryData);
+      const telemetryData: string | string[] = await this.telemetryService.fetchTelemetry();
+      const clusters: string[] = ([] as string[]).concat(telemetryData);
       await Promise.all(
         clusters.map(
           async (cluster) =>
diff --git a/src/plugins/telemetry/server/collectors/usage/ensure_deep_object.ts b/src/plugins/telemetry/server/collectors/usage/ensure_deep_object.ts
index 6b79cc6c7410a..c5624d1f62bf7 100644
--- a/src/plugins/telemetry/server/collectors/usage/ensure_deep_object.ts
+++ b/src/plugins/telemetry/server/collectors/usage/ensure_deep_object.ts
@@ -8,12 +8,15 @@
 
 //
 // THIS IS A DIRECT COPY OF
-// '../../../../../../../../src/core/server/config/ensure_deep_object'
+// 'packages/kbn-config/src/raw/ensure_deep_object.ts'
 // BECAUSE THAT IS BLOCKED FOR IMPORTING BY OUR LINTER.
 //
 // IF THAT IS EXPOSED, WE SHOULD USE IT RATHER THAN CLONE IT.
 //
 
+/* eslint-disable @typescript-eslint/no-explicit-any */
+// ^ Disabling the rule for the entire file because of the complexity to type this
+
 const separator = '.';
 
 /**
diff --git a/src/plugins/telemetry/server/collectors/usage/telemetry_usage_collector.test.ts b/src/plugins/telemetry/server/collectors/usage/telemetry_usage_collector.test.ts
index ac439f0753a2b..2acc6676d13db 100644
--- a/src/plugins/telemetry/server/collectors/usage/telemetry_usage_collector.test.ts
+++ b/src/plugins/telemetry/server/collectors/usage/telemetry_usage_collector.test.ts
@@ -15,10 +15,11 @@ import {
   readTelemetryFile,
   MAX_FILE_SIZE,
 } from './telemetry_usage_collector';
+import { usageCollectionPluginMock } from '../../../../usage_collection/server/mocks';
 
-const mockUsageCollector = () => ({
-  makeUsageCollector: jest.fn().mockImplementationOnce((arg: object) => arg),
-});
+const mockUsageCollector = () => {
+  return usageCollectionPluginMock.createSetupContract();
+};
 
 describe('telemetry_usage_collector', () => {
   const tempDir = tmpdir();
@@ -105,14 +106,15 @@ describe('telemetry_usage_collector', () => {
       // dir
 
       // the `makeUsageCollector` is mocked above to return the argument passed to it
-      const usageCollector = mockUsageCollector() as any;
+      const usageCollector = mockUsageCollector();
       const collectorOptions = createTelemetryUsageCollector(
         usageCollector,
         async () => tempFiles.unreadable
       );
 
       expect(collectorOptions.type).toBe('static_telemetry');
-      expect(await collectorOptions.fetch({} as any)).toEqual(expectedObject); // Sending any as the callCluster client because it's not needed in this collector but TS requires it when calling it.
+      // @ts-expect-error this collector does not require any arguments in the fetch method, but TS complains
+      expect(await collectorOptions.fetch()).toEqual(expectedObject);
     });
   });
 });
diff --git a/src/plugins/telemetry/server/fetcher.ts b/src/plugins/telemetry/server/fetcher.ts
index 5db1b62cb3e26..fb188a2414b98 100644
--- a/src/plugins/telemetry/server/fetcher.ts
+++ b/src/plugins/telemetry/server/fetcher.ts
@@ -9,10 +9,7 @@
 import { Observable, Subscription, timer } from 'rxjs';
 import { take } from 'rxjs/operators';
 import fetch from 'node-fetch';
-import {
-  TelemetryCollectionManagerPluginStart,
-  UsageStatsPayload,
-} from 'src/plugins/telemetry_collection_manager/server';
+import type { TelemetryCollectionManagerPluginStart } from 'src/plugins/telemetry_collection_manager/server';
 import {
   PluginInitializerContext,
   Logger,
@@ -40,6 +37,7 @@ interface TelemetryConfig {
   telemetryUrl: string;
   failureCount: number;
   failureVersion: string | undefined;
+  currentVersion: string;
 }
 
 export class FetcherTask {
@@ -104,7 +102,7 @@ export class FetcherTask {
       return;
     }
 
-    let clusters: Array<UsageStatsPayload | string> = [];
+    let clusters: string[] = [];
     this.isSending = true;
 
     try {
@@ -160,6 +158,7 @@ export class FetcherTask {
       telemetryUrl,
       failureCount,
       failureVersion,
+      currentVersion: currentKibanaVersion,
     };
   }
 
@@ -187,11 +186,11 @@ export class FetcherTask {
   private shouldSendReport({
     telemetryOptIn,
     telemetrySendUsageFrom,
-    reportFailureCount,
+    failureCount,
+    failureVersion,
     currentVersion,
-    reportFailureVersion,
-  }: any) {
-    if (reportFailureCount > 2 && reportFailureVersion === currentVersion) {
+  }: TelemetryConfig) {
+    if (failureCount > 2 && failureVersion === currentVersion) {
       return false;
     }
 
@@ -209,7 +208,7 @@ export class FetcherTask {
     });
   }
 
-  private async sendTelemetry(url: string, cluster: any): Promise<void> {
+  private async sendTelemetry(url: string, cluster: string): Promise<void> {
     this.logger.debug(`Sending usage stats.`);
     /**
      * send OPTIONS before sending usage data.
diff --git a/src/plugins/telemetry/server/index.ts b/src/plugins/telemetry/server/index.ts
index 1c335426ffd03..005f50721e778 100644
--- a/src/plugins/telemetry/server/index.ts
+++ b/src/plugins/telemetry/server/index.ts
@@ -11,7 +11,6 @@ import { TelemetryPlugin } from './plugin';
 import * as constants from '../common/constants';
 import { configSchema, TelemetryConfigType } from './config';
 
-export { FetcherTask } from './fetcher';
 export { handleOldSettings } from './handle_old_settings';
 export type { TelemetryPluginSetup, TelemetryPluginStart } from './plugin';
 
@@ -42,4 +41,6 @@ export type {
   TelemetryLocalStats,
   DataTelemetryIndex,
   DataTelemetryPayload,
+  NodeUsage,
+  NodeUsageAggregation,
 } from './telemetry_collection';
diff --git a/src/plugins/telemetry/server/telemetry_collection/get_cluster_info.test.ts b/src/plugins/telemetry/server/telemetry_collection/get_cluster_info.test.ts
index 9e70e31925226..cd414beb42182 100644
--- a/src/plugins/telemetry/server/telemetry_collection/get_cluster_info.test.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/get_cluster_info.test.ts
@@ -9,14 +9,10 @@
 import { elasticsearchServiceMock } from '../../../../../src/core/server/mocks';
 import { getClusterInfo } from './get_cluster_info';
 
-export function mockGetClusterInfo(clusterInfo: any) {
+export function mockGetClusterInfo<ClusterInfo>(clusterInfo: ClusterInfo) {
   const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
-  esClient.info.mockResolvedValue(
-    // @ts-expect-error we only care about the response body
-    {
-      body: { ...clusterInfo },
-    }
-  );
+  // @ts-expect-error we only care about the response body
+  esClient.info.mockResolvedValue({ body: { ...clusterInfo } });
   return esClient;
 }
 
diff --git a/src/plugins/telemetry/server/telemetry_collection/get_cluster_stats.test.ts b/src/plugins/telemetry/server/telemetry_collection/get_cluster_stats.test.ts
index a2c22fbbb0a78..06d3ebeb7ea0e 100644
--- a/src/plugins/telemetry/server/telemetry_collection/get_cluster_stats.test.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/get_cluster_stats.test.ts
@@ -10,15 +10,9 @@ import { elasticsearchServiceMock } from '../../../../../src/core/server/mocks';
 import { getClusterStats } from './get_cluster_stats';
 import { TIMEOUT } from './constants';
 
-export function mockGetClusterStats(clusterStats: any) {
-  const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
-  esClient.cluster.stats.mockResolvedValue(clusterStats);
-  return esClient;
-}
-
 describe('get_cluster_stats', () => {
   it('uses the esClient to get the response from the `cluster.stats` API', async () => {
-    const response = Promise.resolve({ body: { cluster_uuid: '1234' } });
+    const response = { body: { cluster_uuid: '1234' } };
     const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
     esClient.cluster.stats.mockImplementationOnce(
       // @ts-expect-error the method only cares about the response body
@@ -26,8 +20,8 @@ describe('get_cluster_stats', () => {
         return response;
       }
     );
-    const result = getClusterStats(esClient);
+    const result = await getClusterStats(esClient);
     expect(esClient.cluster.stats).toHaveBeenCalledWith({ timeout: TIMEOUT });
-    expect(result).toStrictEqual(response);
+    expect(result).toStrictEqual(response.body);
   });
 });
diff --git a/src/plugins/telemetry/server/telemetry_collection/get_data_telemetry/get_data_telemetry.test.ts b/src/plugins/telemetry/server/telemetry_collection/get_data_telemetry/get_data_telemetry.test.ts
index d2113dce9548f..dab1eaeed27ce 100644
--- a/src/plugins/telemetry/server/telemetry_collection/get_data_telemetry/get_data_telemetry.test.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/get_data_telemetry/get_data_telemetry.test.ts
@@ -271,7 +271,7 @@ describe('get_data_telemetry', () => {
 function mockEsClient(
   indicesMappings: string[] = [], // an array of `indices` to get mappings from.
   { isECS = false, dataStreamDataset = '', dataStreamType = '', shipper = '' } = {},
-  indexStats: any = {}
+  indexStats = {}
 ) {
   const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
   // @ts-expect-error
diff --git a/src/plugins/telemetry/server/telemetry_collection/get_kibana.ts b/src/plugins/telemetry/server/telemetry_collection/get_kibana.ts
index 566c942890150..3f1966901544a 100644
--- a/src/plugins/telemetry/server/telemetry_collection/get_kibana.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/get_kibana.ts
@@ -8,7 +8,7 @@
 
 import { omit } from 'lodash';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { ISavedObjectsRepository, KibanaRequest, SavedObjectsClientContract } from 'kibana/server';
+import { KibanaRequest, SavedObjectsClientContract } from 'kibana/server';
 import { StatsCollectionContext } from 'src/plugins/telemetry_collection_manager/server';
 import { ElasticsearchClient } from 'src/core/server';
 
@@ -27,7 +27,7 @@ export interface KibanaUsageStats {
     };
   };
 
-  [plugin: string]: any;
+  [plugin: string]: Record<string, unknown>;
 }
 
 export function handleKibanaStats(
@@ -73,7 +73,7 @@ export function handleKibanaStats(
 export async function getKibana(
   usageCollection: UsageCollectionSetup,
   asInternalUser: ElasticsearchClient,
-  soClient: SavedObjectsClientContract | ISavedObjectsRepository,
+  soClient: SavedObjectsClientContract,
   kibanaRequest: KibanaRequest | undefined // intentionally `| undefined` to enforce providing the parameter
 ): Promise<KibanaUsageStats> {
   const usage = await usageCollection.bulkFetch(asInternalUser, soClient, kibanaRequest);
diff --git a/src/plugins/telemetry/server/telemetry_collection/get_local_stats.test.ts b/src/plugins/telemetry/server/telemetry_collection/get_local_stats.test.ts
index edf8dbb30809b..7fd6ca4080d6a 100644
--- a/src/plugins/telemetry/server/telemetry_collection/get_local_stats.test.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/get_local_stats.test.ts
@@ -20,17 +20,18 @@ import { StatsCollectionConfig } from '../../../telemetry_collection_manager/ser
 function mockUsageCollection(kibanaUsage = {}) {
   const usageCollection = usageCollectionPluginMock.createSetupContract();
   usageCollection.bulkFetch = jest.fn().mockResolvedValue(kibanaUsage);
-  usageCollection.toObject = jest.fn().mockImplementation((data: any) => data);
+  usageCollection.toObject = jest.fn().mockImplementation((data) => data);
   return usageCollection;
 }
 // set up successful call mocks for info, cluster stats, nodes usage and data telemetry
-function mockGetLocalStats(clusterInfo: any, clusterStats: any) {
+function mockGetLocalStats<ClusterInfo, ClusterStats>(
+  clusterInfo: ClusterInfo,
+  clusterStats: ClusterStats
+) {
   const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
   esClient.info.mockResolvedValue(
     // @ts-expect-error we only care about the response body
-    {
-      body: { ...clusterInfo },
-    }
+    { body: { ...clusterInfo } }
   );
   esClient.cluster.stats
     // @ts-expect-error we only care about the response body
@@ -70,8 +71,8 @@ function mockGetLocalStats(clusterInfo: any, clusterStats: any) {
 }
 
 function mockStatsCollectionConfig(
-  clusterInfo: any,
-  clusterStats: any,
+  clusterInfo: unknown,
+  clusterStats: unknown,
   kibana: {}
 ): StatsCollectionConfig {
   return {
@@ -113,13 +114,13 @@ describe('get_local_stats', () => {
       },
     },
   ];
-  const clusterStats = {
+  const clusterStats = ({
     _nodes: { failed: 123 },
     cluster_name: 'real-cool',
     indices: { totally: 456 },
     nodes: { yup: 'abc' },
     random: 123,
-  };
+  } as unknown) as estypes.ClusterStatsResponse;
 
   const kibana = {
     kibana: {
diff --git a/src/plugins/telemetry/server/telemetry_collection/get_local_stats.ts b/src/plugins/telemetry/server/telemetry_collection/get_local_stats.ts
index 67f9ebb8ff3e4..72f6ba855096c 100644
--- a/src/plugins/telemetry/server/telemetry_collection/get_local_stats.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/get_local_stats.ts
@@ -26,10 +26,10 @@ import { getDataTelemetry, DATA_TELEMETRY_ID, DataTelemetryPayload } from './get
  * @param {Object} clusterStats Cluster stats (GET /_cluster/stats)
  * @param {Object} kibana The Kibana Usage stats
  */
-export function handleLocalStats(
+export function handleLocalStats<ClusterStats extends estypes.ClusterStatsResponse>(
   // eslint-disable-next-line @typescript-eslint/naming-convention
   { cluster_name, cluster_uuid, version }: estypes.RootNodeInfoResponse,
-  { _nodes, cluster_name: clusterName, ...clusterStats }: any,
+  { _nodes, cluster_name: clusterName, ...clusterStats }: ClusterStats,
   kibana: KibanaUsageStats | undefined,
   dataTelemetry: DataTelemetryPayload | undefined,
   context: StatsCollectionContext
diff --git a/src/plugins/telemetry/server/telemetry_collection/get_nodes_usage.ts b/src/plugins/telemetry/server/telemetry_collection/get_nodes_usage.ts
index e46d4be540734..544142c8d742f 100644
--- a/src/plugins/telemetry/server/telemetry_collection/get_nodes_usage.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/get_nodes_usage.ts
@@ -9,12 +9,12 @@
 import { ElasticsearchClient } from 'src/core/server';
 import { TIMEOUT } from './constants';
 
-export interface NodeAggregation {
+export interface NodeUsageAggregation {
   [key: string]: number;
 }
 
 // we set aggregations as an optional type because it was only added in v7.8.0
-export interface NodeObj {
+export interface NodeUsage {
   node_id?: string;
   timestamp: number | string;
   since: number;
@@ -22,20 +22,20 @@ export interface NodeObj {
     [key: string]: number;
   };
   aggregations?: {
-    [key: string]: NodeAggregation;
+    [key: string]: NodeUsageAggregation;
   };
 }
 
 export interface NodesFeatureUsageResponse {
   cluster_name: string;
   nodes: {
-    [key: string]: NodeObj;
+    [key: string]: NodeUsage;
   };
 }
 
 export type NodesUsageGetter = (
   esClient: ElasticsearchClient
-) => Promise<{ nodes: NodeObj[] | Array<{}> }>;
+) => Promise<{ nodes: NodeUsage[] | Array<{}> }>;
 /**
  * Get the nodes usage data from the connected cluster.
  *
@@ -61,7 +61,7 @@ export async function fetchNodesUsage(
 export const getNodesUsage: NodesUsageGetter = async (esClient) => {
   const result = await fetchNodesUsage(esClient);
   const transformedNodes = Object.entries(result?.nodes || {}).map(([key, value]) => ({
-    ...(value as NodeObj),
+    ...(value as NodeUsage),
     node_id: key,
   }));
   return { nodes: transformedNodes };
diff --git a/src/plugins/telemetry/server/telemetry_collection/index.ts b/src/plugins/telemetry/server/telemetry_collection/index.ts
index 151e89a11a192..f55147a0a083f 100644
--- a/src/plugins/telemetry/server/telemetry_collection/index.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/index.ts
@@ -10,5 +10,6 @@ export { DATA_TELEMETRY_ID, buildDataTelemetryPayload } from './get_data_telemet
 export type { DataTelemetryIndex, DataTelemetryPayload } from './get_data_telemetry';
 export { getLocalStats } from './get_local_stats';
 export type { TelemetryLocalStats } from './get_local_stats';
+export type { NodeUsage, NodeUsageAggregation } from './get_nodes_usage';
 export { getClusterUuids } from './get_cluster_stats';
 export { registerCollection } from './register_collection';
diff --git a/src/plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.test.ts b/src/plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.test.ts
index fbead0125fe09..5ea8211739a13 100644
--- a/src/plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.test.ts
+++ b/src/plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.test.ts
@@ -8,6 +8,7 @@
 
 import { getTelemetrySavedObject } from './get_telemetry_saved_object';
 import { SavedObjectsErrorHelpers } from '../../../../core/server';
+import { savedObjectsClientMock } from '../../../../core/server/mocks';
 
 describe('getTelemetrySavedObject', () => {
   it('returns null when saved object not found', async () => {
@@ -51,7 +52,7 @@ interface CallGetTelemetrySavedObjectParams {
   savedObjectNotFound: boolean;
   savedObjectForbidden: boolean;
   savedObjectOtherError: boolean;
-  result?: any;
+  result?: unknown;
 }
 
 const DefaultParams = {
@@ -68,26 +69,22 @@ function getCallGetTelemetrySavedObjectParams(
 
 async function callGetTelemetrySavedObject(params: CallGetTelemetrySavedObjectParams) {
   const savedObjectsClient = getMockSavedObjectsClient(params);
-  return await getTelemetrySavedObject(savedObjectsClient as any);
+  return await getTelemetrySavedObject(savedObjectsClient);
 }
 
 const SavedObjectForbiddenMessage = 'savedObjectForbidden';
 const SavedObjectOtherErrorMessage = 'savedObjectOtherError';
 
 function getMockSavedObjectsClient(params: CallGetTelemetrySavedObjectParams) {
-  return {
-    async get(type: string, id: string) {
-      if (params.savedObjectNotFound) throw SavedObjectsErrorHelpers.createGenericNotFoundError();
-      if (params.savedObjectForbidden)
-        throw SavedObjectsErrorHelpers.decorateForbiddenError(
-          new Error(SavedObjectForbiddenMessage)
-        );
-      if (params.savedObjectOtherError)
-        throw SavedObjectsErrorHelpers.decorateGeneralError(
-          new Error(SavedObjectOtherErrorMessage)
-        );
-
-      return { attributes: { enabled: null } };
-    },
-  };
+  const savedObjectsClient = savedObjectsClientMock.create();
+  savedObjectsClient.get.mockImplementation(async (type, id) => {
+    if (params.savedObjectNotFound) throw SavedObjectsErrorHelpers.createGenericNotFoundError();
+    if (params.savedObjectForbidden)
+      throw SavedObjectsErrorHelpers.decorateForbiddenError(new Error(SavedObjectForbiddenMessage));
+    if (params.savedObjectOtherError)
+      throw SavedObjectsErrorHelpers.decorateGeneralError(new Error(SavedObjectOtherErrorMessage));
+
+    return { id, type, attributes: { enabled: null }, references: [] };
+  });
+  return savedObjectsClient;
 }
diff --git a/src/plugins/telemetry_collection_manager/server/encryption/encrypt.ts b/src/plugins/telemetry_collection_manager/server/encryption/encrypt.ts
index a2c24627f6fd7..1b80a2c29b362 100644
--- a/src/plugins/telemetry_collection_manager/server/encryption/encrypt.ts
+++ b/src/plugins/telemetry_collection_manager/server/encryption/encrypt.ts
@@ -13,12 +13,12 @@ export function getKID(useProdKey = false): string {
   return useProdKey ? 'kibana1' : 'kibana_dev1';
 }
 
-export async function encryptTelemetry(
-  payload: any,
+export async function encryptTelemetry<Payload = unknown>(
+  payload: Payload | Payload[],
   { useProdKey = false } = {}
 ): Promise<string[]> {
   const kid = getKID(useProdKey);
   const encryptor = await createRequestEncryptor(telemetryJWKS);
-  const clusters = [].concat(payload);
-  return Promise.all(clusters.map((cluster: any) => encryptor.encrypt(kid, cluster)));
+  const clusters = ([] as Payload[]).concat(payload);
+  return Promise.all(clusters.map((cluster) => encryptor.encrypt(kid, cluster)));
 }
diff --git a/src/plugins/telemetry_collection_manager/server/plugin.ts b/src/plugins/telemetry_collection_manager/server/plugin.ts
index 692d91b963d9d..0efdde5eeafd6 100644
--- a/src/plugins/telemetry_collection_manager/server/plugin.ts
+++ b/src/plugins/telemetry_collection_manager/server/plugin.ts
@@ -7,7 +7,7 @@
  */
 
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import {
+import type {
   PluginInitializerContext,
   CoreSetup,
   CoreStart,
@@ -19,7 +19,7 @@ import {
   SavedObjectsClientContract,
 } from 'src/core/server';
 
-import {
+import type {
   TelemetryCollectionManagerPluginSetup,
   TelemetryCollectionManagerPluginStart,
   BasicStatsPayload,
@@ -29,6 +29,8 @@ import {
   StatsCollectionConfig,
   UsageStatsPayload,
   StatsCollectionContext,
+  UnencryptedStatsGetterConfig,
+  EncryptedStatsGetterConfig,
 } from './types';
 import { encryptTelemetry } from './encryption';
 import { TelemetrySavedObjectsClient } from './telemetry_saved_objects_client';
@@ -40,7 +42,7 @@ interface TelemetryCollectionPluginsDepsSetup {
 export class TelemetryCollectionManagerPlugin
   implements Plugin<TelemetryCollectionManagerPluginSetup, TelemetryCollectionManagerPluginStart> {
   private readonly logger: Logger;
-  private collectionStrategy: CollectionStrategy<any> | undefined;
+  private collectionStrategy: CollectionStrategy | undefined;
   private usageGetterMethodPriority = -1;
   private usageCollection?: UsageCollectionSetup;
   private elasticsearchClient?: IClusterClient;
@@ -215,6 +217,8 @@ export class TelemetryCollectionManagerPlugin
     }));
   };
 
+  private async getStats(config: UnencryptedStatsGetterConfig): Promise<UsageStatsPayload[]>;
+  private async getStats(config: EncryptedStatsGetterConfig): Promise<string[]>;
   private async getStats(config: StatsGetterConfig) {
     if (!this.usageCollection) {
       return [];
diff --git a/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap b/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap
index 896b1671328a9..e0ba7e7527af7 100644
--- a/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap
+++ b/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap
@@ -95,13 +95,14 @@ exports[`TelemetryManagementSectionComponent renders as expected 1`] = `
         size="s"
       />
       <lazy
-        dockLinks={null}
+        dockLinks={Object {}}
         enableSaving={true}
         handleChange={[Function]}
         loading={false}
         setting={
           Object {
             "ariaName": "Provide usage statistics",
+            "category": Array [],
             "defVal": true,
             "description": <React.Fragment>
               <p>
@@ -156,12 +157,26 @@ exports[`TelemetryManagementSectionComponent renders as expected 1`] = `
               </p>
             </React.Fragment>,
             "displayName": "Provide usage statistics",
+            "isCustom": true,
+            "isOverridden": false,
             "name": "telemetry:enabled",
+            "requiresPageReload": false,
             "type": "boolean",
             "value": true,
           }
         }
-        toasts={null}
+        toasts={
+          Object {
+            "add": [MockFunction],
+            "addDanger": [MockFunction],
+            "addError": [MockFunction],
+            "addInfo": [MockFunction],
+            "addSuccess": [MockFunction],
+            "addWarning": [MockFunction],
+            "get$": [MockFunction],
+            "remove": [MockFunction],
+          }
+        }
       />
     </EuiForm>
   </EuiPanel>
@@ -170,6 +185,7 @@ exports[`TelemetryManagementSectionComponent renders as expected 1`] = `
 
 exports[`TelemetryManagementSectionComponent renders null because allowChangingOptInStatus is false 1`] = `
 <TelemetryManagementSection
+  docLinks={Object {}}
   enableSaving={true}
   intl={
     Object {
diff --git a/src/plugins/telemetry_management_section/public/components/opt_in_example_flyout.tsx b/src/plugins/telemetry_management_section/public/components/opt_in_example_flyout.tsx
index 584c6c1e39d40..e38378bdd6154 100644
--- a/src/plugins/telemetry_management_section/public/components/opt_in_example_flyout.tsx
+++ b/src/plugins/telemetry_management_section/public/components/opt_in_example_flyout.tsx
@@ -24,14 +24,14 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import { loadingSpinner } from './loading_spinner';
 
 interface Props {
-  fetchExample: () => Promise<any[]>;
+  fetchExample: () => Promise<unknown[]>;
   onClose: () => void;
 }
 
 interface State {
   isLoading: boolean;
   hasPrivilegeToRead: boolean;
-  data: any[] | null;
+  data: unknown[] | null;
 }
 
 /**
diff --git a/src/plugins/telemetry_management_section/public/components/telemetry_management_section.test.tsx b/src/plugins/telemetry_management_section/public/components/telemetry_management_section.test.tsx
index 7e7e255edea8c..019dedd793fa2 100644
--- a/src/plugins/telemetry_management_section/public/components/telemetry_management_section.test.tsx
+++ b/src/plugins/telemetry_management_section/public/components/telemetry_management_section.test.tsx
@@ -12,9 +12,11 @@ import TelemetryManagementSection from './telemetry_management_section';
 import { TelemetryService } from '../../../telemetry/public/services';
 import { coreMock } from '../../../../core/public/mocks';
 import { render } from '@testing-library/react';
+import type { DocLinksStart } from 'src/core/public';
 
 describe('TelemetryManagementSectionComponent', () => {
   const coreStart = coreMock.createStart();
+  const docLinks = {} as DocLinksStart['links'];
   const coreSetup = coreMock.createSetup();
 
   it('renders as expected', () => {
@@ -45,6 +47,7 @@ describe('TelemetryManagementSectionComponent', () => {
           enableSaving={true}
           isSecurityExampleEnabled={isSecurityExampleEnabled}
           toasts={coreStart.notifications.toasts}
+          docLinks={docLinks}
         />
       )
     ).toMatchSnapshot();
@@ -78,6 +81,7 @@ describe('TelemetryManagementSectionComponent', () => {
           enableSaving={true}
           isSecurityExampleEnabled={isSecurityExampleEnabled}
           toasts={coreStart.notifications.toasts}
+          docLinks={docLinks}
         />
       </React.Suspense>
     );
@@ -93,6 +97,7 @@ describe('TelemetryManagementSectionComponent', () => {
             enableSaving={true}
             toasts={coreStart.notifications.toasts}
             isSecurityExampleEnabled={isSecurityExampleEnabled}
+            docLinks={docLinks}
           />
         </React.Suspense>
       );
@@ -130,6 +135,7 @@ describe('TelemetryManagementSectionComponent', () => {
         isSecurityExampleEnabled={isSecurityExampleEnabled}
         enableSaving={true}
         toasts={coreStart.notifications.toasts}
+        docLinks={docLinks}
       />
     );
     try {
@@ -177,6 +183,7 @@ describe('TelemetryManagementSectionComponent', () => {
         enableSaving={true}
         isSecurityExampleEnabled={isSecurityExampleEnabled}
         toasts={coreStart.notifications.toasts}
+        docLinks={docLinks}
       />
     );
     try {
@@ -215,6 +222,7 @@ describe('TelemetryManagementSectionComponent', () => {
         enableSaving={true}
         isSecurityExampleEnabled={isSecurityExampleEnabled}
         toasts={coreStart.notifications.toasts}
+        docLinks={docLinks}
       />
     );
     try {
@@ -254,6 +262,7 @@ describe('TelemetryManagementSectionComponent', () => {
         isSecurityExampleEnabled={isSecurityExampleEnabled}
         enableSaving={true}
         toasts={coreStart.notifications.toasts}
+        docLinks={docLinks}
       />
     );
     try {
@@ -293,6 +302,7 @@ describe('TelemetryManagementSectionComponent', () => {
         isSecurityExampleEnabled={isSecurityExampleEnabled}
         enableSaving={true}
         toasts={coreStart.notifications.toasts}
+        docLinks={docLinks}
       />
     );
 
@@ -332,6 +342,7 @@ describe('TelemetryManagementSectionComponent', () => {
         enableSaving={true}
         isSecurityExampleEnabled={isSecurityExampleEnabled}
         toasts={coreStart.notifications.toasts}
+        docLinks={docLinks}
       />
     );
     try {
@@ -339,11 +350,12 @@ describe('TelemetryManagementSectionComponent', () => {
       await expect(
         toggleOptInComponent.prop<TelemetryManagementSection['toggleOptIn']>('handleChange')()
       ).resolves.toBe(true);
-      expect((component.state() as any).enabled).toBe(true);
+      // TODO: Fix `mountWithIntl` types in @kbn/test/jest to make testing easier
+      expect((component.state() as { enabled: boolean }).enabled).toBe(true);
       await expect(
         toggleOptInComponent.prop<TelemetryManagementSection['toggleOptIn']>('handleChange')()
       ).resolves.toBe(true);
-      expect((component.state() as any).enabled).toBe(false);
+      expect((component.state() as { enabled: boolean }).enabled).toBe(false);
       telemetryService.setOptIn = jest.fn().mockRejectedValue(Error('test-error'));
       await expect(
         toggleOptInComponent.prop<TelemetryManagementSection['toggleOptIn']>('handleChange')()
@@ -381,6 +393,7 @@ describe('TelemetryManagementSectionComponent', () => {
           enableSaving={true}
           toasts={coreStart.notifications.toasts}
           isSecurityExampleEnabled={isSecurityExampleEnabled}
+          docLinks={docLinks}
         />
       ).html()
     ).toMatchSnapshot();
diff --git a/src/plugins/telemetry_management_section/public/components/telemetry_management_section.tsx b/src/plugins/telemetry_management_section/public/components/telemetry_management_section.tsx
index 5a9f3922c6caf..e9ddc4cf82dfc 100644
--- a/src/plugins/telemetry_management_section/public/components/telemetry_management_section.tsx
+++ b/src/plugins/telemetry_management_section/public/components/telemetry_management_section.tsx
@@ -20,12 +20,12 @@ import {
 
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
-import { TelemetryPluginSetup } from 'src/plugins/telemetry/public';
+import type { TelemetryPluginSetup } from 'src/plugins/telemetry/public';
+import type { DocLinksStart, ToastsStart } from 'src/core/public';
 import { PRIVACY_STATEMENT_URL } from '../../../telemetry/common/constants';
 import { OptInExampleFlyout } from './opt_in_example_flyout';
 import { OptInSecurityExampleFlyout } from './opt_in_security_example_flyout';
 import { LazyField } from '../../../advanced_settings/public';
-import { ToastsStart } from '../../../../core/public';
 import { TrackApplicationView } from '../../../usage_collection/public';
 
 type TelemetryService = TelemetryPluginSetup['telemetryService'];
@@ -40,6 +40,7 @@ interface Props {
   enableSaving: boolean;
   query?: { text: string };
   toasts: ToastsStart;
+  docLinks: DocLinksStart['links'];
 }
 
 interface State {
@@ -130,24 +131,26 @@ export class TelemetryManagementSection extends Component<Props, State> {
             {this.maybeGetAppliesSettingMessage()}
             <EuiSpacer size="s" />
             <LazyField
-              setting={
-                {
-                  type: 'boolean',
-                  name: 'telemetry:enabled',
-                  displayName: i18n.translate('telemetry.provideUsageStatisticsTitle', {
-                    defaultMessage: 'Provide usage statistics',
-                  }),
-                  value: enabled,
-                  description: this.renderDescription(),
-                  defVal: true,
-                  ariaName: i18n.translate('telemetry.provideUsageStatisticsAriaName', {
-                    defaultMessage: 'Provide usage statistics',
-                  }),
-                } as any
-              }
+              setting={{
+                type: 'boolean',
+                name: 'telemetry:enabled',
+                displayName: i18n.translate('telemetry.provideUsageStatisticsTitle', {
+                  defaultMessage: 'Provide usage statistics',
+                }),
+                value: enabled,
+                description: this.renderDescription(),
+                defVal: true,
+                ariaName: i18n.translate('telemetry.provideUsageStatisticsAriaName', {
+                  defaultMessage: 'Provide usage statistics',
+                }),
+                requiresPageReload: false,
+                category: [],
+                isOverridden: false,
+                isCustom: true,
+              }}
               loading={processing}
-              dockLinks={null as any}
-              toasts={null as any}
+              dockLinks={this.props.docLinks}
+              toasts={this.props.toasts}
               handleChange={this.toggleOptIn}
               enableSaving={this.props.enableSaving}
             />
diff --git a/src/plugins/telemetry_management_section/public/components/telemetry_management_section_wrapper.tsx b/src/plugins/telemetry_management_section/public/components/telemetry_management_section_wrapper.tsx
index cc38b1ec74b37..91881dffa52d7 100644
--- a/src/plugins/telemetry_management_section/public/components/telemetry_management_section_wrapper.tsx
+++ b/src/plugins/telemetry_management_section/public/components/telemetry_management_section_wrapper.tsx
@@ -8,10 +8,12 @@
 
 import React, { lazy, Suspense } from 'react';
 import { EuiLoadingSpinner } from '@elastic/eui';
-import { TelemetryPluginSetup } from 'src/plugins/telemetry/public';
-// It should be this but the types are way too vague in the AdvancedSettings plugin `Record<string, any>`
-// type Props = Omit<TelemetryManagementSection['props'], 'telemetryService'>;
-type Props = any;
+import type { TelemetryPluginSetup } from 'src/plugins/telemetry/public';
+import type TelemetryManagementSection from './telemetry_management_section';
+export type TelemetryManagementSectionWrapperProps = Omit<
+  TelemetryManagementSection['props'],
+  'telemetryService' | 'showAppliesSettingMessage' | 'isSecurityExampleEnabled'
+>;
 
 const TelemetryManagementSectionComponent = lazy(() => import('./telemetry_management_section'));
 
@@ -19,7 +21,7 @@ export function telemetryManagementSectionWrapper(
   telemetryService: TelemetryPluginSetup['telemetryService'],
   shouldShowSecuritySolutionUsageExample: () => boolean
 ) {
-  const TelemetryManagementSectionWrapper = (props: Props) => (
+  const TelemetryManagementSectionWrapper = (props: TelemetryManagementSectionWrapperProps) => (
     <Suspense fallback={<EuiLoadingSpinner />}>
       <TelemetryManagementSectionComponent
         showAppliesSettingMessage={true}
diff --git a/src/plugins/telemetry_management_section/public/plugin.tsx b/src/plugins/telemetry_management_section/public/plugin.tsx
index df837f0bf9a57..24583260329a6 100644
--- a/src/plugins/telemetry_management_section/public/plugin.tsx
+++ b/src/plugins/telemetry_management_section/public/plugin.tsx
@@ -7,12 +7,15 @@
  */
 
 import React from 'react';
-import { AdvancedSettingsSetup } from 'src/plugins/advanced_settings/public';
-import { TelemetryPluginSetup } from 'src/plugins/telemetry/public';
-import { UsageCollectionSetup } from 'src/plugins/usage_collection/public';
-import { Plugin, CoreStart, CoreSetup } from '../../../core/public';
+import type { AdvancedSettingsSetup } from 'src/plugins/advanced_settings/public';
+import type { TelemetryPluginSetup } from 'src/plugins/telemetry/public';
+import type { UsageCollectionSetup } from 'src/plugins/usage_collection/public';
+import type { Plugin, CoreStart, CoreSetup } from 'src/core/public';
 
-import { telemetryManagementSectionWrapper } from './components/telemetry_management_section_wrapper';
+import {
+  telemetryManagementSectionWrapper,
+  TelemetryManagementSectionWrapperProps,
+} from './components/telemetry_management_section_wrapper';
 
 export interface TelemetryPluginConfig {
   enabled: boolean;
@@ -60,7 +63,7 @@ export class TelemetryManagementSectionPlugin
             {telemetryManagementSectionWrapper(
               telemetryService,
               this.shouldShowSecuritySolutionExample
-            )(props)}
+            )(props as TelemetryManagementSectionWrapperProps)}
           </ApplicationUsageTrackingProvider>
         );
       },
diff --git a/src/plugins/usage_collection/server/collector/collector.ts b/src/plugins/usage_collection/server/collector/collector.ts
index 90e873388d22e..22c91ac0c038d 100644
--- a/src/plugins/usage_collection/server/collector/collector.ts
+++ b/src/plugins/usage_collection/server/collector/collector.ts
@@ -141,11 +141,11 @@ export type CollectorOptions<
       });
 
 export class Collector<TFetchReturn, ExtraOptions extends object = {}> {
-  public readonly extendFetchContext: CollectorOptionsFetchExtendedContext<any>;
-  public readonly type: CollectorOptions<TFetchReturn, any>['type'];
-  public readonly init?: CollectorOptions<TFetchReturn, any>['init'];
-  public readonly fetch: CollectorFetchMethod<any, TFetchReturn, ExtraOptions>;
-  public readonly isReady: CollectorOptions<TFetchReturn, any>['isReady'];
+  public readonly extendFetchContext: CollectorOptionsFetchExtendedContext<boolean>;
+  public readonly type: CollectorOptions<TFetchReturn, boolean>['type'];
+  public readonly init?: CollectorOptions<TFetchReturn, boolean>['init'];
+  public readonly fetch: CollectorFetchMethod<boolean, TFetchReturn, ExtraOptions>;
+  public readonly isReady: CollectorOptions<TFetchReturn, boolean>['isReady'];
   /**
    * @private Constructor of a Collector. It should be called via the CollectorSet factory methods: `makeStatsCollector` and `makeUsageCollector`
    * @param log {@link Logger}
@@ -160,7 +160,9 @@ export class Collector<TFetchReturn, ExtraOptions extends object = {}> {
       isReady,
       extendFetchContext = {},
       ...options
-    }: CollectorOptions<TFetchReturn, any, ExtraOptions>
+    }: // Any does not affect here, but needs to be set so it doesn't affect anything else down the line
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    CollectorOptions<TFetchReturn, any, ExtraOptions>
   ) {
     if (type === undefined) {
       throw new Error('Collector must be instantiated with a options.type string property');
diff --git a/src/plugins/usage_collection/server/collector/collector_set.test.ts b/src/plugins/usage_collection/server/collector/collector_set.test.ts
index 0ef9a27cf094c..5a617e2316dda 100644
--- a/src/plugins/usage_collection/server/collector/collector_set.test.ts
+++ b/src/plugins/usage_collection/server/collector/collector_set.test.ts
@@ -13,7 +13,7 @@ import { UsageCollector } from './usage_collector';
 import {
   elasticsearchServiceMock,
   loggingSystemMock,
-  savedObjectsRepositoryMock,
+  savedObjectsClientMock,
 } from '../../../../core/server/mocks';
 
 const logger = loggingSystemMock.createLogger();
@@ -34,7 +34,7 @@ describe('CollectorSet', () => {
       loggerSpies.warn.mockRestore();
     });
     const mockEsClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
-    const mockSoClient = savedObjectsRepositoryMock.create();
+    const mockSoClient = savedObjectsClientMock.create();
     const req = void 0; // No need to instantiate any KibanaRequest in these tests
 
     it('should throw an error if non-Collector type of object is registered', () => {
@@ -43,8 +43,9 @@ describe('CollectorSet', () => {
         collectors.registerCollector({
           type: 'type_collector_test',
           init,
+          // @ts-expect-error we are intentionally sending it wrong.
           fetch,
-        } as any); // We are intentionally sending it wrong.
+        });
       };
 
       expect(registerPojo).toThrowError(
@@ -71,13 +72,14 @@ describe('CollectorSet', () => {
     });
 
     it('should log debug status of fetching from the collector', async () => {
-      mockEsClient.get.mockResolvedValue({ passTest: 1000 } as any);
+      // @ts-expect-error we are just mocking the output of any call
+      mockEsClient.ping.mockResolvedValue({ passTest: 1000 });
       const collectors = new CollectorSet({ logger });
       collectors.registerCollector(
         new Collector(logger, {
           type: 'MY_TEST_COLLECTOR',
-          fetch: (collectorFetchContext: any) => {
-            return collectorFetchContext.esClient.get();
+          fetch: (collectorFetchContext) => {
+            return collectorFetchContext.esClient.ping();
           },
           isReady: () => true,
         })
@@ -122,7 +124,8 @@ describe('CollectorSet', () => {
         new Collector(logger, {
           type: 'MY_TEST_COLLECTOR',
           fetch: () => ({ test: 1 }),
-          isReady: true as any,
+          // @ts-expect-error we are intentionally sending it wrong
+          isReady: true,
         })
       );
 
@@ -138,10 +141,11 @@ describe('CollectorSet', () => {
     it('should not break if isReady is not provided', async () => {
       const collectors = new CollectorSet({ logger });
       collectors.registerCollector(
+        // @ts-expect-error we are intentionally sending it wrong.
         new Collector(logger, {
           type: 'MY_TEST_COLLECTOR',
           fetch: () => ({ test: 1 }),
-        } as any)
+        })
       );
 
       const result = await collectors.bulkFetch(mockEsClient, mockSoClient, req);
diff --git a/src/plugins/usage_collection/server/collector/collector_set.ts b/src/plugins/usage_collection/server/collector/collector_set.ts
index 4de5691eaaa70..d42eb6644bbbe 100644
--- a/src/plugins/usage_collection/server/collector/collector_set.ts
+++ b/src/plugins/usage_collection/server/collector/collector_set.ts
@@ -7,16 +7,17 @@
  */
 
 import { snakeCase } from 'lodash';
-import {
+import type {
   Logger,
   ElasticsearchClient,
-  ISavedObjectsRepository,
   SavedObjectsClientContract,
   KibanaRequest,
 } from 'src/core/server';
 import { Collector, CollectorOptions } from './collector';
 import { UsageCollector, UsageCollectorOptions } from './usage_collector';
 
+// Needed for the general array containing all the collectors. We don't really care about their types here
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
 type AnyCollector = Collector<any, any>;
 
 interface CollectorSetConfig {
@@ -144,7 +145,7 @@ export class CollectorSet {
 
   public bulkFetch = async (
     esClient: ElasticsearchClient,
-    soClient: SavedObjectsClientContract | ISavedObjectsRepository,
+    soClient: SavedObjectsClientContract,
     kibanaRequest: KibanaRequest | undefined, // intentionally `| undefined` to enforce providing the parameter
     collectors: Map<string, AnyCollector> = this.collectors
   ) => {
@@ -183,7 +184,7 @@ export class CollectorSet {
 
   public bulkFetchUsage = async (
     esClient: ElasticsearchClient,
-    savedObjectsClient: SavedObjectsClientContract | ISavedObjectsRepository,
+    savedObjectsClient: SavedObjectsClientContract,
     kibanaRequest: KibanaRequest | undefined // intentionally `| undefined` to enforce providing the parameter
   ) => {
     const usageCollectors = this.getFilteredCollectorSet((c) => c instanceof UsageCollector);
diff --git a/src/plugins/usage_collection/server/collector/usage_collector.ts b/src/plugins/usage_collection/server/collector/usage_collector.ts
index 1509b10654f49..3af3a7bb65f84 100644
--- a/src/plugins/usage_collection/server/collector/usage_collector.ts
+++ b/src/plugins/usage_collection/server/collector/usage_collector.ts
@@ -23,6 +23,8 @@ export class UsageCollector<TFetchReturn, ExtraOptions extends object = {}> exte
 > {
   constructor(
     log: Logger,
+    // Needed because it doesn't affect on anything here but being explicit creates a lot of pain down the line
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     collectorOptions: UsageCollectorOptions<TFetchReturn, any, ExtraOptions>
   ) {
     super(log, collectorOptions);
diff --git a/src/plugins/usage_collection/server/report/store_report.test.ts b/src/plugins/usage_collection/server/report/store_report.test.ts
index 08fdec4ae804f..789e01020bb2e 100644
--- a/src/plugins/usage_collection/server/report/store_report.test.ts
+++ b/src/plugins/usage_collection/server/report/store_report.test.ts
@@ -118,7 +118,7 @@ describe('store_report', () => {
     expect(storeApplicationUsageMock).toHaveBeenCalledTimes(1);
     expect(storeApplicationUsageMock).toHaveBeenCalledWith(
       repository,
-      Object.values(report.application_usage as Record<string, any>),
+      Object.values(report.application_usage!),
       expect.any(Date)
     );
   });
diff --git a/src/plugins/usage_collection/server/routes/stats/stats.ts b/src/plugins/usage_collection/server/routes/stats/stats.ts
index 416a69dd9a8f9..6cae56afa281b 100644
--- a/src/plugins/usage_collection/server/routes/stats/stats.ts
+++ b/src/plugins/usage_collection/server/routes/stats/stats.ts
@@ -15,7 +15,6 @@ import { first } from 'rxjs/operators';
 import {
   ElasticsearchClient,
   IRouter,
-  ISavedObjectsRepository,
   KibanaRequest,
   MetricsServiceSetup,
   SavedObjectsClientContract,
@@ -30,6 +29,12 @@ const STATS_NOT_READY_MESSAGE = i18n.translate('usageCollection.stats.notReadyMe
 
 const SNAPSHOT_REGEX = /-snapshot/i;
 
+interface UsageObject {
+  kibana?: UsageObject;
+  xpack?: UsageObject;
+  [key: string]: unknown | UsageObject;
+}
+
 export function registerStatsRoute({
   router,
   config,
@@ -55,9 +60,9 @@ export function registerStatsRoute({
 }) {
   const getUsage = async (
     esClient: ElasticsearchClient,
-    savedObjectsClient: SavedObjectsClientContract | ISavedObjectsRepository,
+    savedObjectsClient: SavedObjectsClientContract,
     kibanaRequest: KibanaRequest
-  ): Promise<any> => {
+  ): Promise<UsageObject> => {
     const usage = await collectorSet.bulkFetchUsage(esClient, savedObjectsClient, kibanaRequest);
     return collectorSet.toObject(usage);
   };
@@ -104,7 +109,7 @@ export function registerStatsRoute({
 
         const usagePromise = shouldGetUsage
           ? getUsage(asCurrentUser, savedObjectsClient, req)
-          : Promise.resolve({});
+          : Promise.resolve<UsageObject>({});
         const [usage, clusterUuid] = await Promise.all([
           usagePromise,
           getClusterUuid(asCurrentUser),
@@ -138,7 +143,7 @@ export function registerStatsRoute({
             }
 
             return accum;
-          }, {} as any);
+          }, {} as UsageObject);
 
           extended = {
             usage: modifiedUsage,
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_license.test.ts b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_license.test.ts
index 694b155632d04..bee6db57bee42 100644
--- a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_license.test.ts
+++ b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_license.test.ts
@@ -24,7 +24,8 @@ describe('getLicenseFromLocalOrMaster', () => {
   test('returns the license it fetches from Elasticsearch', async () => {
     const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
     // The local fetch succeeds
-    esClient.license.get.mockResolvedValue({ body: { license: { type: 'basic' } } } as any);
+    // @ts-expect-error it's enough to test with minimal payload
+    esClient.license.get.mockResolvedValue({ body: { license: { type: 'basic' } } });
 
     const license = await getLicenseFromLocalOrMaster(esClient);
 
@@ -51,7 +52,8 @@ describe('getLicenseFromLocalOrMaster', () => {
     // The local fetch fails
     esClient.license.get.mockRejectedValueOnce(new Error('Something went terribly wrong'));
     // The master fetch succeeds
-    esClient.license.get.mockResolvedValue({ body: { license: { type: 'basic' } } } as any);
+    // @ts-expect-error it's enough to test with minimal payload
+    esClient.license.get.mockResolvedValue({ body: { license: { type: 'basic' } } });
 
     const license = await getLicenseFromLocalOrMaster(esClient);
 
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.test.ts b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.test.ts
index 6ddb10e825684..86d1554a4fd57 100644
--- a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.test.ts
+++ b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.test.ts
@@ -8,6 +8,8 @@
 import type { estypes } from '@elastic/elasticsearch';
 import { coreMock, elasticsearchServiceMock } from '../../../../../src/core/server/mocks';
 import { getStatsWithXpack } from './get_stats_with_xpack';
+import { SavedObjectsClient } from '../../../../../src/core/server';
+import { usageCollectionPluginMock } from '../../../../../src/plugins/usage_collection/server/mocks';
 
 const kibana = {
   kibana: {
@@ -50,10 +52,16 @@ const getContext = () => ({
   logger: coreMock.createPluginInitializerContext().logger.get('test'),
 });
 
-const mockUsageCollection = (kibanaUsage: Record<string, unknown> = kibana) => ({
-  bulkFetch: () => kibanaUsage,
-  toObject: (data: any) => data,
-});
+const mockUsageCollection = (kibanaUsage: Record<string, unknown> = kibana) => {
+  const usageCollectionMock = usageCollectionPluginMock.createSetupContract();
+  usageCollectionMock.bulkFetch.mockImplementation(async () =>
+    Object.entries(kibanaUsage).map(([type, result]) => ({ type, result }))
+  );
+  usageCollectionMock.toObject.mockImplementation((data) =>
+    Object.fromEntries((data || []).map(({ type, result }) => [type, result]))
+  );
+  return usageCollectionMock;
+};
 
 /**
  * Instantiate the esClient mock with the common requests
@@ -91,6 +99,9 @@ function mockEsClient() {
 }
 
 describe('Telemetry Collection: Get Aggregated Stats', () => {
+  const soClient = new SavedObjectsClient(
+    coreMock.createStart().savedObjects.createInternalRepository()
+  );
   test('OSS-like telemetry (no license nor X-Pack telemetry)', async () => {
     const esClient = mockEsClient();
     // mock for xpack.usage should throw a 404 for this test
@@ -106,7 +117,9 @@ describe('Telemetry Collection: Get Aggregated Stats', () => {
       {
         esClient,
         usageCollection,
-      } as any,
+        soClient,
+        kibanaRequest: undefined,
+      },
       context
     );
     stats.forEach((entry) => {
@@ -126,7 +139,9 @@ describe('Telemetry Collection: Get Aggregated Stats', () => {
       {
         esClient,
         usageCollection,
-      } as any,
+        soClient,
+        kibanaRequest: undefined,
+      },
       context
     );
     stats.forEach((entry) => {
@@ -151,7 +166,9 @@ describe('Telemetry Collection: Get Aggregated Stats', () => {
       {
         esClient,
         usageCollection,
-      } as any,
+        soClient,
+        kibanaRequest: undefined,
+      },
       context
     );
     stats.forEach((entry, index) => {
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.ts b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.ts
index 30bcd19007c0d..3adc5bc9f2eac 100644
--- a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.ts
+++ b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.ts
@@ -45,7 +45,9 @@ export const getStatsWithXpack: StatsGetter<TelemetryAggregatedStats> = async fu
     })
     .reduce((acc, stats) => {
       // Concatenate the telemetry reported via monitoring as additional payloads instead of reporting it inside of stack_stats.kibana.plugins.monitoringTelemetry
-      const monitoringTelemetry = stats.stack_stats.kibana?.plugins?.monitoringTelemetry?.stats;
+      const monitoringTelemetry = stats.stack_stats.kibana?.plugins?.monitoringTelemetry?.stats as
+        | TelemetryAggregatedStats[]
+        | undefined;
       if (monitoringTelemetry) {
         delete stats.stack_stats.kibana!.plugins.monitoringTelemetry;
       }
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/is_cluster_opted_in.test.ts b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/is_cluster_opted_in.test.ts
index 5fa7584879f07..481bf70a5f5a7 100644
--- a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/is_cluster_opted_in.test.ts
+++ b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/is_cluster_opted_in.test.ts
@@ -6,13 +6,14 @@
  */
 
 import { isClusterOptedIn } from './is_cluster_opted_in';
+import type { TelemetryAggregatedStats } from './get_stats_with_xpack';
 
-const createMockClusterUsage = (plugins: any) => {
+const createMockClusterUsage = (plugins: unknown) => {
   return {
     stack_stats: {
       kibana: { plugins },
     },
-  };
+  } as TelemetryAggregatedStats;
 };
 
 describe('isClusterOptedIn', () => {
@@ -33,6 +34,7 @@ describe('isClusterOptedIn', () => {
   });
   it('returns true if kibana.plugins.telemetry does not exist', () => {
     expect(isClusterOptedIn(createMockClusterUsage({}))).toBe(true);
+    // @ts-expect-error we want to test the logic anyway because this object may come from very dynamic requests that any-fy the code
     expect(isClusterOptedIn({})).toBe(true);
     expect(isClusterOptedIn(undefined)).toBe(true);
   });
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/is_cluster_opted_in.ts b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/is_cluster_opted_in.ts
index 4bc35a238152b..49876f3d5a981 100644
--- a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/is_cluster_opted_in.ts
+++ b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/is_cluster_opted_in.ts
@@ -5,7 +5,9 @@
  * 2.0.
  */
 
-export const isClusterOptedIn = (clusterUsage: any): boolean => {
+import type { TelemetryAggregatedStats } from './get_stats_with_xpack';
+
+export const isClusterOptedIn = (clusterUsage?: TelemetryAggregatedStats): boolean => {
   return (
     clusterUsage?.stack_stats?.kibana?.plugins?.telemetry?.opt_in_status === true ||
     // If stack_stats.kibana.plugins.telemetry does not exist, assume opted-in for BWC

From cbd6f844cb02814ad345b1e7e5f52e53a873367f Mon Sep 17 00:00:00 2001
From: Nick Peihl <nick.peihl@elastic.co>
Date: Tue, 27 Apr 2021 13:25:29 -0700
Subject: [PATCH 13/28] Fetch geojson using ems-client (#97908)

* Fetch geojson using ems-client

* Review feedback
---
 package.json                                  |  2 +-
 .../ems_file_source/ems_file_source.tsx       | 43 +++++++++----------
 .../ems_autosuggest/ems_autosuggest.test.ts   | 41 ++++++++----------
 .../public/ems_autosuggest/ems_autosuggest.ts | 11 ++---
 yarn.lock                                     |  9 +---
 5 files changed, 42 insertions(+), 64 deletions(-)

diff --git a/package.json b/package.json
index 0a23be6779a7d..9d42daa63ede8 100644
--- a/package.json
+++ b/package.json
@@ -380,7 +380,7 @@
     "tar": "4.4.13",
     "tinycolor2": "1.4.1",
     "tinygradient": "0.4.3",
-    "topojson-client": "3.0.0",
+    "topojson-client": "3.1.0",
     "tree-kill": "^1.2.2",
     "ts-easing": "^0.2.0",
     "tslib": "^2.0.0",
diff --git a/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_file_source.tsx b/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_file_source.tsx
index c19ded6c2593e..22b873a94d1f7 100644
--- a/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_file_source.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_file_source.tsx
@@ -12,13 +12,8 @@ import { Adapters } from 'src/plugins/inspector/public';
 import { FileLayer } from '@elastic/ems-client';
 import { Attribution, ImmutableSourceProperty, SourceEditorArgs } from '../source';
 import { AbstractVectorSource, GeoJsonWithMeta, IVectorSource } from '../vector_source';
-import {
-  SOURCE_TYPES,
-  FIELD_ORIGIN,
-  VECTOR_SHAPE_TYPE,
-  FORMAT_TYPE,
-} from '../../../../common/constants';
-import { fetchGeoJson, getEmsFileLayers } from '../../../util';
+import { SOURCE_TYPES, FIELD_ORIGIN, VECTOR_SHAPE_TYPE } from '../../../../common/constants';
+import { getEmsFileLayers } from '../../../util';
 import { getDataSourceLabel } from '../../../../common/i18n_getters';
 import { UpdateSourceEditor } from './update_source_editor';
 import { EMSFileField } from '../../fields/ems_file_field';
@@ -122,24 +117,26 @@ export class EMSFileSource extends AbstractVectorSource implements IEmsFileSourc
   }
 
   async getGeoJsonWithMeta(): Promise<GeoJsonWithMeta> {
-    const emsFileLayer = await this.getEMSFileLayer();
-    const featureCollection = await fetchGeoJson(
-      emsFileLayer.getDefaultFormatUrl(),
-      emsFileLayer.getDefaultFormatType() as FORMAT_TYPE,
-      'data'
-    );
+    try {
+      const emsFileLayer = await this.getEMSFileLayer();
+      const featureCollection = await emsFileLayer.getGeoJson();
 
-    const emsIdField = emsFileLayer.getFields().find((field) => {
-      return field.type === 'id';
-    });
-    featureCollection.features.forEach((feature: Feature, index: number) => {
-      feature.id = emsIdField ? feature!.properties![emsIdField.id] : index;
-    });
+      if (!featureCollection) throw new Error('No features found');
 
-    return {
-      data: featureCollection,
-      meta: {},
-    };
+      const emsIdField = emsFileLayer.getFields().find((field) => {
+        return field.type === 'id';
+      });
+      featureCollection.features.forEach((feature: Feature, index: number) => {
+        feature.id = emsIdField ? feature!.properties![emsIdField.id] : index;
+      });
+
+      return {
+        data: featureCollection,
+        meta: {},
+      };
+    } catch (error) {
+      throw new Error(`${getErrorInfo(this._descriptor.id)} - ${error.message}`);
+    }
   }
 
   async getImmutableProperties(): Promise<ImmutableSourceProperty[]> {
diff --git a/x-pack/plugins/maps/public/ems_autosuggest/ems_autosuggest.test.ts b/x-pack/plugins/maps/public/ems_autosuggest/ems_autosuggest.test.ts
index 34a53be48a5cd..eff49c1b1242e 100644
--- a/x-pack/plugins/maps/public/ems_autosuggest/ems_autosuggest.test.ts
+++ b/x-pack/plugins/maps/public/ems_autosuggest/ems_autosuggest.test.ts
@@ -6,7 +6,6 @@
  */
 
 import { suggestEMSTermJoinConfig } from './ems_autosuggest';
-import { FORMAT_TYPE } from '../../common';
 import { FeatureCollection } from 'geojson';
 
 class MockFileLayer {
@@ -19,16 +18,28 @@ class MockFileLayer {
     this._id = url;
     this._fields = fields;
   }
-  getDefaultFormatUrl() {
-    return this._url;
-  }
 
   getFields() {
     return this._fields;
   }
 
-  getDefaultFormatType() {
-    return FORMAT_TYPE.GEOJSON;
+  getGeoJson() {
+    if (this._url === 'world_countries') {
+      return ({
+        type: 'FeatureCollection',
+        features: [
+          { properties: { iso2: 'CA', iso3: 'CAN' } },
+          { properties: { iso2: 'US', iso3: 'USA' } },
+        ],
+      } as unknown) as FeatureCollection;
+    } else if (this._url === 'zips') {
+      return ({
+        type: 'FeatureCollection',
+        features: [{ properties: { zip: '40204' } }, { properties: { zip: '40205' } }],
+      } as unknown) as FeatureCollection;
+    } else {
+      throw new Error(`unrecognized mock url ${this._url}`);
+    }
   }
 
   hasId(id: string) {
@@ -44,24 +55,6 @@ jest.mock('../util', () => {
         new MockFileLayer('zips', [{ id: 'zip' }]),
       ];
     },
-    async fetchGeoJson(url: string): Promise<FeatureCollection> {
-      if (url === 'world_countries') {
-        return ({
-          type: 'FeatureCollection',
-          features: [
-            { properties: { iso2: 'CA', iso3: 'CAN' } },
-            { properties: { iso2: 'US', iso3: 'USA' } },
-          ],
-        } as unknown) as FeatureCollection;
-      } else if (url === 'zips') {
-        return ({
-          type: 'FeatureCollection',
-          features: [{ properties: { zip: '40204' } }, { properties: { zip: '40205' } }],
-        } as unknown) as FeatureCollection;
-      } else {
-        throw new Error(`unrecognized mock url ${url}`);
-      }
-    },
   };
 });
 
diff --git a/x-pack/plugins/maps/public/ems_autosuggest/ems_autosuggest.ts b/x-pack/plugins/maps/public/ems_autosuggest/ems_autosuggest.ts
index 1d5c1529a004e..952e48a71a9dc 100644
--- a/x-pack/plugins/maps/public/ems_autosuggest/ems_autosuggest.ts
+++ b/x-pack/plugins/maps/public/ems_autosuggest/ems_autosuggest.ts
@@ -6,8 +6,8 @@
  */
 
 import type { FileLayer } from '@elastic/ems-client';
-import { getEmsFileLayers, fetchGeoJson } from '../util';
-import { FORMAT_TYPE, emsWorldLayerId, emsRegionLayerId, emsUsaZipLayerId } from '../../common';
+import { getEmsFileLayers } from '../util';
+import { emsWorldLayerId, emsRegionLayerId, emsUsaZipLayerId } from '../../common';
 
 export interface SampleValuesConfig {
   emsLayerIds?: string[];
@@ -165,14 +165,9 @@ async function getMatchesForEMSLayer(
   }
 
   const emsFields = emsFileLayer.getFields();
-  const url = emsFileLayer.getDefaultFormatUrl();
 
   try {
-    const emsJson = await fetchGeoJson(
-      url,
-      emsFileLayer.getDefaultFormatType() as FORMAT_TYPE,
-      'data'
-    );
+    const emsJson = await emsFileLayer.getGeoJson();
     const matches: EMSTermJoinConfig[] = [];
     for (let f = 0; f < emsFields.length; f++) {
       if (matchesEmsField(emsJson, emsFields[f].id, sampleValues)) {
diff --git a/yarn.lock b/yarn.lock
index 9302839004a33..4ba48bdeb8b6f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -26843,14 +26843,7 @@ topo@3.x.x:
   dependencies:
     hoek "5.x.x"
 
-topojson-client@3.0.0:
-  version "3.0.0"
-  resolved "https://registry.yarnpkg.com/topojson-client/-/topojson-client-3.0.0.tgz#1f99293a77ef42a448d032a81aa982b73f360d2f"
-  integrity sha1-H5kpOnfvQqRI0DKoGqmCtz82DS8=
-  dependencies:
-    commander "2"
-
-topojson-client@^3.1.0:
+topojson-client@3.1.0, topojson-client@^3.1.0:
   version "3.1.0"
   resolved "https://registry.yarnpkg.com/topojson-client/-/topojson-client-3.1.0.tgz#22e8b1ed08a2b922feeb4af6f53b6ef09a467b99"
   integrity sha512-605uxS6bcYxGXw9qi62XyrV6Q3xwbndjachmNxu8HWTtVPxZfEJN9fd/SZS1Q54Sn2y0TMyMxFj/cJINqGHrKw==

From 41b930c97c9aa6b4e1fdfd7946df2e5f11867202 Mon Sep 17 00:00:00 2001
From: Zacqary Adam Xeper <Zacqary@users.noreply.github.com>
Date: Tue, 27 Apr 2021 15:39:13 -0500
Subject: [PATCH 14/28] [Fleet] Add troubleshooting link to setup instructions
 (#98531)

* [Fleet] Add troubleshooting link to setup instructions

* Add troubleshooting link to Fleet Server instructions
---
 .../enrollment_instructions/manual/index.tsx  | 21 +++++++++++++++++++
 .../fleet_server_requirement_page.tsx         | 21 +++++++++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/x-pack/plugins/fleet/public/applications/fleet/components/enrollment_instructions/manual/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/components/enrollment_instructions/manual/index.tsx
index 0d4f067771be0..7a7e42b9d634f 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/components/enrollment_instructions/manual/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/components/enrollment_instructions/manual/index.tsx
@@ -91,6 +91,27 @@ export const ManualInstructions: React.FunctionComponent<Props> = ({
           }}
         />
       </EuiText>
+      <EuiSpacer size="s" />
+      <EuiText>
+        <FormattedMessage
+          id="xpack.fleet.enrollmentInstructions.troubleshootingText"
+          defaultMessage="If you are having trouble connecting, see our {link}."
+          values={{
+            link: (
+              <EuiLink
+                target="_blank"
+                external
+                href="https://www.elastic.co/guide/en/fleet/current/fleet-troubleshooting.html"
+              >
+                <FormattedMessage
+                  id="xpack.fleet.enrollmentInstructions.troubleshootingLink"
+                  defaultMessage="troubleshooting guide"
+                />
+              </EuiLink>
+            ),
+          }}
+        />
+      </EuiText>
     </>
   );
 };
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/fleet_server_requirement_page.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/fleet_server_requirement_page.tsx
index a068426ecd23a..3be5d864e80c8 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/fleet_server_requirement_page.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_requirements_page/fleet_server_requirement_page.tsx
@@ -184,6 +184,27 @@ export const FleetServerCommandStep = ({
         >
           <CommandCode>{installCommand}</CommandCode>
         </EuiCodeBlock>
+        <EuiSpacer size="s" />
+        <EuiText>
+          <FormattedMessage
+            id="xpack.fleet.enrollmentInstructions.troubleshootingText"
+            defaultMessage="If you are having trouble connecting, see our {link}."
+            values={{
+              link: (
+                <EuiLink
+                  target="_blank"
+                  external
+                  href="https://www.elastic.co/guide/en/fleet/current/fleet-troubleshooting.html"
+                >
+                  <FormattedMessage
+                    id="xpack.fleet.enrollmentInstructions.troubleshootingLink"
+                    defaultMessage="troubleshooting guide"
+                  />
+                </EuiLink>
+              ),
+            }}
+          />
+        </EuiText>
       </>
     ) : null,
   };

From 942243158d70afe4e9664ec1b5d8d84670ac282f Mon Sep 17 00:00:00 2001
From: Nathan Reese <reese.nathan@gmail.com>
Date: Tue, 27 Apr 2021 14:42:39 -0600
Subject: [PATCH 15/28] [Maps] convert FeaturesTooltip to TS (#97920)

* [Maps] convert FeaturesTooltip to TS

* tslint

* pass addFilters to method to keep not null check closer to check for undefined

* FeaturesTooltip

* convert test to ts

* fix snapshot

* clean up cast

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 x-pack/plugins/maps/common/constants.ts       |   2 +-
 .../elasticsearch_geo_utils.ts                |   2 +-
 .../vector/properties/style_property.ts       |   2 +
 ....snap => feature_properties.test.tsx.snap} |   0
 ...oter.test.js.snap => footer.test.tsx.snap} |   0
 ...rm.js => feature_geometry_filter_form.tsx} |  51 +++++--
 ...es.test.js => feature_properties.test.tsx} |  36 +++--
 ...e_properties.js => feature_properties.tsx} | 137 +++++++++++++-----
 ...atures_tooltip.js => features_tooltip.tsx} | 101 ++++++++++---
 .../{footer.test.js => footer.test.tsx}       |  30 ++--
 .../{footer.js => footer.tsx}                 |  39 +++--
 11 files changed, 294 insertions(+), 106 deletions(-)
 rename x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/__snapshots__/{feature_properties.test.js.snap => feature_properties.test.tsx.snap} (100%)
 rename x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/__snapshots__/{footer.test.js.snap => footer.test.tsx.snap} (100%)
 rename x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/{feature_geometry_filter_form.js => feature_geometry_filter_form.tsx} (68%)
 rename x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/{feature_properties.test.js => feature_properties.test.tsx} (72%)
 rename x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/{feature_properties.js => feature_properties.tsx} (65%)
 rename x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/{features_tooltip.js => features_tooltip.tsx} (66%)
 rename x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/{footer.test.js => footer.test.tsx} (89%)
 rename x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/{footer.js => footer.tsx} (83%)

diff --git a/x-pack/plugins/maps/common/constants.ts b/x-pack/plugins/maps/common/constants.ts
index 007368f0997df..0d8930bdb75b8 100644
--- a/x-pack/plugins/maps/common/constants.ts
+++ b/x-pack/plugins/maps/common/constants.ts
@@ -295,7 +295,7 @@ export enum DATA_MAPPING_FUNCTION {
 }
 export const DEFAULT_PERCENTILES = [50, 75, 90, 95, 99];
 
-export type RawValue = string | number | boolean | undefined | null;
+export type RawValue = string | string[] | number | boolean | undefined | null;
 
 export type FieldFormatter = (value: RawValue) => string | number;
 
diff --git a/x-pack/plugins/maps/common/elasticsearch_util/elasticsearch_geo_utils.ts b/x-pack/plugins/maps/common/elasticsearch_util/elasticsearch_geo_utils.ts
index 197b7f49eda0a..c18a79fa9dcbc 100644
--- a/x-pack/plugins/maps/common/elasticsearch_util/elasticsearch_geo_utils.ts
+++ b/x-pack/plugins/maps/common/elasticsearch_util/elasticsearch_geo_utils.ts
@@ -371,7 +371,7 @@ export function createSpatialFilterWithGeometry({
   geoFieldName,
   relation = ES_SPATIAL_RELATIONS.INTERSECTS,
 }: {
-  preIndexedShape?: PreIndexedShape;
+  preIndexedShape?: PreIndexedShape | null;
   geometry: Polygon;
   geometryLabel: string;
   indexPatternId: string;
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/style_property.ts b/x-pack/plugins/maps/public/classes/styles/vector/properties/style_property.ts
index f77a73e531029..41877406f7489 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/style_property.ts
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/style_property.ts
@@ -59,6 +59,8 @@ export class AbstractStyleProperty<T> implements IStyleProperty<T> {
       return '';
     } else if (typeof value === 'boolean') {
       return value.toString();
+    } else if (Array.isArray(value)) {
+      return value.join(', ');
     } else {
       return value;
     }
diff --git a/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/__snapshots__/feature_properties.test.js.snap b/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/__snapshots__/feature_properties.test.tsx.snap
similarity index 100%
rename from x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/__snapshots__/feature_properties.test.js.snap
rename to x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/__snapshots__/feature_properties.test.tsx.snap
diff --git a/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/__snapshots__/footer.test.js.snap b/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/__snapshots__/footer.test.tsx.snap
similarity index 100%
rename from x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/__snapshots__/footer.test.js.snap
rename to x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/__snapshots__/footer.test.tsx.snap
diff --git a/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_geometry_filter_form.js b/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_geometry_filter_form.tsx
similarity index 68%
rename from x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_geometry_filter_form.js
rename to x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_geometry_filter_form.tsx
index 9d4cf78c98754..61732d1c268c2 100644
--- a/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_geometry_filter_form.js
+++ b/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_geometry_filter_form.tsx
@@ -8,19 +8,42 @@
 import React, { Component } from 'react';
 import { i18n } from '@kbn/i18n';
 
+import { Filter } from 'src/plugins/data/public';
+import { ActionExecutionContext, Action } from 'src/plugins/ui_actions/public';
+import { Geometry, Polygon } from 'geojson';
+import rison, { RisonObject } from 'rison-node';
 import { URL_MAX_LENGTH } from '../../../../../../../src/core/public';
 import { ACTION_GLOBAL_APPLY_FILTER } from '../../../../../../../src/plugins/data/public';
-import { createSpatialFilterWithGeometry } from '../../../../common/elasticsearch_util';
-import { GEO_JSON_TYPE } from '../../../../common/constants';
+import {
+  createSpatialFilterWithGeometry,
+  PreIndexedShape,
+} from '../../../../common/elasticsearch_util';
+import { ES_SPATIAL_RELATIONS, GEO_JSON_TYPE } from '../../../../common/constants';
+// @ts-expect-error
 import { GeometryFilterForm } from '../../../components/geometry_filter_form';
-
-import rison from 'rison-node';
+import { GeoFieldWithIndex } from '../../../components/geo_field_with_index';
 
 // over estimated and imprecise value to ensure filter has additional room for any meta keys added when filter is mapped.
 const META_OVERHEAD = 100;
 
-export class FeatureGeometryFilterForm extends Component {
-  state = {
+interface Props {
+  onClose: () => void;
+  geometry: Geometry;
+  geoFields: GeoFieldWithIndex[];
+  addFilters: (filters: Filter[], actionId: string) => Promise<void>;
+  getFilterActions?: () => Promise<Action[]>;
+  getActionContext?: () => ActionExecutionContext;
+  loadPreIndexedShape: () => Promise<PreIndexedShape | null>;
+}
+
+interface State {
+  isLoading: boolean;
+  errorMsg: string | undefined;
+}
+
+export class FeatureGeometryFilterForm extends Component<Props, State> {
+  private _isMounted = false;
+  state: State = {
     isLoading: false,
     errorMsg: undefined,
   };
@@ -52,7 +75,17 @@ export class FeatureGeometryFilterForm extends Component {
     return preIndexedShape;
   };
 
-  _createFilter = async ({ geometryLabel, indexPatternId, geoFieldName, relation }) => {
+  _createFilter = async ({
+    geometryLabel,
+    indexPatternId,
+    geoFieldName,
+    relation,
+  }: {
+    geometryLabel: string;
+    indexPatternId: string;
+    geoFieldName: string;
+    relation: ES_SPATIAL_RELATIONS;
+  }) => {
     this.setState({ errorMsg: undefined });
     const preIndexedShape = await this._loadPreIndexedShape();
     if (!this._isMounted) {
@@ -62,7 +95,7 @@ export class FeatureGeometryFilterForm extends Component {
 
     const filter = createSpatialFilterWithGeometry({
       preIndexedShape,
-      geometry: this.props.geometry,
+      geometry: this.props.geometry as Polygon,
       geometryLabel,
       indexPatternId,
       geoFieldName,
@@ -72,7 +105,7 @@ export class FeatureGeometryFilterForm extends Component {
     // Ensure filter will not overflow URL. Filters that contain geometry can be extremely large.
     // No elasticsearch support for pre-indexed shapes and geo_point spatial queries.
     if (
-      window.location.href.length + rison.encode(filter).length + META_OVERHEAD >
+      window.location.href.length + rison.encode(filter as RisonObject).length + META_OVERHEAD >
       URL_MAX_LENGTH
     ) {
       this.setState({
diff --git a/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_properties.test.js b/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_properties.test.tsx
similarity index 72%
rename from x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_properties.test.js
rename to x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_properties.test.tsx
index e7a2024afb98a..c999e9e6705cc 100644
--- a/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_properties.test.js
+++ b/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_properties.test.tsx
@@ -9,9 +9,15 @@ import React from 'react';
 import { shallow } from 'enzyme';
 import { FeatureProperties } from './feature_properties';
 import { ACTION_GLOBAL_APPLY_FILTER } from '../../../../../../../src/plugins/data/public';
+import { ITooltipProperty } from '../../../classes/tooltips/tooltip_property';
+import { ActionExecutionContext, Action } from 'src/plugins/ui_actions/public';
 
 class MockTooltipProperty {
-  constructor(key, value, isFilterable) {
+  private _key: string;
+  private _value: string;
+  private _isFilterable: boolean;
+
+  constructor(key: string, value: string, isFilterable: boolean) {
     this._key = key;
     this._value = value;
     this._isFilterable = isFilterable;
@@ -31,21 +37,27 @@ class MockTooltipProperty {
 }
 
 const defaultProps = {
-  loadFeatureProperties: () => {
+  loadFeatureProperties: async () => {
     return [];
   },
   featureId: `feature`,
   layerId: `layer`,
+  mbProperties: {},
   onCloseTooltip: () => {},
   showFilterButtons: false,
-  getFilterActions: () => {
-    return [{ id: ACTION_GLOBAL_APPLY_FILTER }];
+  addFilters: async () => {},
+  getActionContext: () => {
+    return ({} as unknown) as ActionExecutionContext;
+  },
+  getFilterActions: async () => {
+    return [({ id: ACTION_GLOBAL_APPLY_FILTER } as unknown) as Action];
   },
+  showFilterActions: () => {},
 };
 
 const mockTooltipProperties = [
-  new MockTooltipProperty('prop1', 'foobar1', true),
-  new MockTooltipProperty('prop2', 'foobar2', false),
+  (new MockTooltipProperty('prop1', 'foobar1', true) as unknown) as ITooltipProperty,
+  (new MockTooltipProperty('prop2', 'foobar2', false) as unknown) as ITooltipProperty,
 ];
 
 describe('FeatureProperties', () => {
@@ -53,7 +65,7 @@ describe('FeatureProperties', () => {
     const component = shallow(
       <FeatureProperties
         {...defaultProps}
-        loadFeatureProperties={() => {
+        loadFeatureProperties={async () => {
           return mockTooltipProperties;
         }}
       />
@@ -72,7 +84,7 @@ describe('FeatureProperties', () => {
       <FeatureProperties
         {...defaultProps}
         showFilterButtons={true}
-        loadFeatureProperties={() => {
+        loadFeatureProperties={async () => {
           return mockTooltipProperties;
         }}
       />
@@ -91,11 +103,11 @@ describe('FeatureProperties', () => {
       <FeatureProperties
         {...defaultProps}
         showFilterButtons={true}
-        loadFeatureProperties={() => {
+        loadFeatureProperties={async () => {
           return mockTooltipProperties;
         }}
-        getFilterActions={() => {
-          return [{ id: 'drilldown1' }];
+        getFilterActions={async () => {
+          return [({ id: 'drilldown1' } as unknown) as Action];
         }}
       />
     );
@@ -113,7 +125,7 @@ describe('FeatureProperties', () => {
       <FeatureProperties
         {...defaultProps}
         showFilterButtons={true}
-        loadFeatureProperties={() => {
+        loadFeatureProperties={async () => {
           throw new Error('Simulated load properties error');
         }}
       />
diff --git a/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_properties.js b/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_properties.tsx
similarity index 65%
rename from x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_properties.js
rename to x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_properties.tsx
index 2bd1d5c9cacf5..d221d4d5b1ca5 100644
--- a/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_properties.js
+++ b/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/feature_properties.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React from 'react';
+import React, { Component, CSSProperties, RefObject, ReactNode } from 'react';
 import {
   EuiCallOut,
   EuiLoadingSpinner,
@@ -15,11 +15,51 @@ import {
   EuiContextMenu,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
+import { ActionExecutionContext, Action } from 'src/plugins/ui_actions/public';
+import { GeoJsonProperties } from 'geojson';
+import { Filter } from 'src/plugins/data/public';
 import { ACTION_GLOBAL_APPLY_FILTER } from '../../../../../../../src/plugins/data/public';
 import { isUrlDrilldown } from '../../../trigger_actions/trigger_utils';
+import { RawValue } from '../../../../common/constants';
+import { ITooltipProperty } from '../../../classes/tooltips/tooltip_property';
 
-export class FeatureProperties extends React.Component {
-  state = {
+interface Props {
+  featureId?: string | number;
+  layerId: string;
+  mbProperties: GeoJsonProperties;
+  loadFeatureProperties: ({
+    layerId,
+    featureId,
+    mbProperties,
+  }: {
+    layerId: string;
+    featureId?: string | number;
+    mbProperties: GeoJsonProperties;
+  }) => Promise<ITooltipProperty[]>;
+  showFilterButtons: boolean;
+  onCloseTooltip: () => void;
+  addFilters: ((filters: Filter[], actionId: string) => Promise<void>) | null;
+  getFilterActions?: () => Promise<Action[]>;
+  getActionContext?: () => ActionExecutionContext;
+  onSingleValueTrigger?: (actionId: string, key: string, value: RawValue) => void;
+  showFilterActions: (view: ReactNode) => void;
+}
+
+interface State {
+  properties: ITooltipProperty[] | null;
+  actions: Action[];
+  loadPropertiesErrorMsg: string | null;
+  prevWidth: number | null;
+  prevHeight: number | null;
+}
+
+export class FeatureProperties extends Component<Props, State> {
+  private _isMounted = false;
+  private _prevLayerId: string = '';
+  private _prevFeatureId?: string | number = '';
+  private readonly _tableRef: RefObject<HTMLTableElement> = React.createRef();
+
+  state: State = {
     properties: null,
     actions: [],
     loadPropertiesErrorMsg: null,
@@ -29,8 +69,6 @@ export class FeatureProperties extends React.Component {
 
   componentDidMount() {
     this._isMounted = true;
-    this.prevLayerId = undefined;
-    this.prevFeatureId = undefined;
     this._loadProperties();
     this._loadActions();
   }
@@ -61,28 +99,42 @@ export class FeatureProperties extends React.Component {
     });
   };
 
-  _showFilterActions = (tooltipProperty) => {
-    this.props.showFilterActions(this._renderFilterActions(tooltipProperty));
+  _showFilterActions = (
+    tooltipProperty: ITooltipProperty,
+    getActionContext: () => ActionExecutionContext,
+    addFilters: (filters: Filter[], actionId: string) => Promise<void>
+  ) => {
+    this.props.showFilterActions(
+      this._renderFilterActions(tooltipProperty, getActionContext, addFilters)
+    );
   };
 
-  _fetchProperties = async ({ nextLayerId, nextFeatureId, mbProperties }) => {
-    if (this.prevLayerId === nextLayerId && this.prevFeatureId === nextFeatureId) {
+  _fetchProperties = async ({
+    nextLayerId,
+    nextFeatureId,
+    mbProperties,
+  }: {
+    nextLayerId: string;
+    nextFeatureId?: string | number;
+    mbProperties: GeoJsonProperties;
+  }) => {
+    if (this._prevLayerId === nextLayerId && this._prevFeatureId === nextFeatureId) {
       // do not reload same feature properties
       return;
     }
 
-    this.prevLayerId = nextLayerId;
-    this.prevFeatureId = nextFeatureId;
+    this._prevLayerId = nextLayerId;
+    this._prevFeatureId = nextFeatureId;
     this.setState({
-      properties: undefined,
-      loadPropertiesErrorMsg: undefined,
+      properties: null,
+      loadPropertiesErrorMsg: null,
     });
 
     // Preserve current properties width/height so they can be used while rendering loading indicator.
-    if (this.state.properties && this._node) {
+    if (this.state.properties && this._tableRef.current) {
       this.setState({
-        prevWidth: this._node.clientWidth,
-        prevHeight: this._node.clientHeight,
+        prevWidth: this._tableRef.current.clientWidth,
+        prevHeight: this._tableRef.current.clientHeight,
       });
     }
 
@@ -91,7 +143,7 @@ export class FeatureProperties extends React.Component {
       properties = await this.props.loadFeatureProperties({
         layerId: nextLayerId,
         featureId: nextFeatureId,
-        mbProperties: mbProperties,
+        mbProperties,
       });
     } catch (error) {
       if (this._isMounted) {
@@ -103,7 +155,7 @@ export class FeatureProperties extends React.Component {
       return;
     }
 
-    if (this.prevLayerId !== nextLayerId && this.prevFeatureId !== nextFeatureId) {
+    if (this._prevLayerId !== nextLayerId && this._prevFeatureId !== nextFeatureId) {
       // ignore results for old request
       return;
     }
@@ -113,7 +165,11 @@ export class FeatureProperties extends React.Component {
     }
   };
 
-  _renderFilterActions(tooltipProperty) {
+  _renderFilterActions(
+    tooltipProperty: ITooltipProperty,
+    getActionContext: () => ActionExecutionContext,
+    addFilters: (filters: Filter[], actionId: string) => Promise<void>
+  ) {
     const panel = {
       id: 0,
       items: this.state.actions
@@ -124,24 +180,24 @@ export class FeatureProperties extends React.Component {
           return true;
         })
         .map((action) => {
-          const actionContext = this.props.getActionContext();
+          const actionContext = getActionContext();
           const iconType = action.getIconType(actionContext);
           const name = action.getDisplayName(actionContext);
           return {
             name: name ? name : action.id,
-            icon: iconType ? <EuiIcon type={iconType} /> : null,
+            icon: iconType ? <EuiIcon type={iconType} /> : undefined,
             onClick: async () => {
               this.props.onCloseTooltip();
 
               if (isUrlDrilldown(action)) {
-                this.props.onSingleValueTrigger(
+                this.props.onSingleValueTrigger!(
                   action.id,
                   tooltipProperty.getPropertyKey(),
                   tooltipProperty.getRawValue()
                 );
               } else {
                 const filters = await tooltipProperty.getESFilters();
-                this.props.addFilters(filters, action.id);
+                addFilters(filters, action.id);
               }
             },
             ['data-test-subj']: `mapFilterActionButton__${name}`,
@@ -151,10 +207,7 @@ export class FeatureProperties extends React.Component {
 
     return (
       <div>
-        <table
-          className="eui-yScrollWithShadows mapFeatureTooltip_table"
-          ref={(node) => (this._node = node)}
-        >
+        <table className="eui-yScrollWithShadows mapFeatureTooltip_table" ref={this._tableRef}>
           <tbody>
             <tr>
               <td className="eui-textOverflowWrap mapFeatureTooltip__propertyLabel">
@@ -168,7 +221,7 @@ export class FeatureProperties extends React.Component {
                  * Since these formatters produce raw HTML, this component needs to be able to render them as-is, relying
                  * on the field formatter to only produce safe HTML.
                  */
-                dangerouslySetInnerHTML={{ __html: tooltipProperty.getHtmlDisplayValue() }} //eslint-disable-line react/no-danger
+                dangerouslySetInnerHTML={{ __html: tooltipProperty.getHtmlDisplayValue() }} // eslint-disable-line react/no-danger
               />
             </tr>
           </tbody>
@@ -178,8 +231,12 @@ export class FeatureProperties extends React.Component {
     );
   }
 
-  _renderFilterCell(tooltipProperty) {
-    if (!this.props.showFilterButtons || !tooltipProperty.isFilterable()) {
+  _renderFilterCell(tooltipProperty: ITooltipProperty) {
+    if (
+      !this.props.showFilterButtons ||
+      !tooltipProperty.isFilterable() ||
+      this.props.addFilters === undefined
+    ) {
       return <td />;
     }
 
@@ -192,7 +249,7 @@ export class FeatureProperties extends React.Component {
         onClick={async () => {
           this.props.onCloseTooltip();
           const filters = await tooltipProperty.getESFilters();
-          this.props.addFilters(filters, ACTION_GLOBAL_APPLY_FILTER);
+          this.props.addFilters!(filters, ACTION_GLOBAL_APPLY_FILTER);
         }}
         aria-label={i18n.translate('xpack.maps.tooltip.filterOnPropertyAriaLabel', {
           defaultMessage: 'Filter on property',
@@ -203,7 +260,8 @@ export class FeatureProperties extends React.Component {
       </EuiButtonEmpty>
     );
 
-    return this.state.actions.length === 0 ||
+    return this.props.getActionContext === undefined ||
+      this.state.actions.length === 0 ||
       (this.state.actions.length === 1 &&
         this.state.actions[0].id === ACTION_GLOBAL_APPLY_FILTER) ? (
       <td>{applyFilterButton}</td>
@@ -217,7 +275,11 @@ export class FeatureProperties extends React.Component {
               defaultMessage: 'View filter actions',
             })}
             onClick={() => {
-              this._showFilterActions(tooltipProperty);
+              this._showFilterActions(
+                tooltipProperty,
+                this.props.getActionContext!,
+                this.props.addFilters!
+              );
             }}
             aria-label={i18n.translate('xpack.maps.tooltip.viewActionsTitle', {
               defaultMessage: 'View filter actions',
@@ -253,7 +315,7 @@ export class FeatureProperties extends React.Component {
       });
       // Use width/height of last viewed properties while displaying loading status
       // to avoid resizing component during loading phase and bouncing tooltip container around
-      const style = {};
+      const style: CSSProperties = {};
       if (this.state.prevWidth && this.state.prevHeight) {
         style.width = this.state.prevWidth;
         style.height = this.state.prevHeight;
@@ -279,7 +341,7 @@ export class FeatureProperties extends React.Component {
              * Since these formatters produce raw HTML, this component needs to be able to render them as-is, relying
              * on the field formatter to only produce safe HTML.
              */
-            dangerouslySetInnerHTML={{ __html: tooltipProperty.getHtmlDisplayValue() }} //eslint-disable-line react/no-danger
+            dangerouslySetInnerHTML={{ __html: tooltipProperty.getHtmlDisplayValue() }} // eslint-disable-line react/no-danger
           />
           {this._renderFilterCell(tooltipProperty)}
         </tr>
@@ -287,10 +349,7 @@ export class FeatureProperties extends React.Component {
     });
 
     return (
-      <table
-        className="eui-yScrollWithShadows mapFeatureTooltip_table"
-        ref={(node) => (this._node = node)}
-      >
+      <table className="eui-yScrollWithShadows mapFeatureTooltip_table" ref={this._tableRef}>
         <tbody>{rows}</tbody>
       </table>
     );
diff --git a/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/features_tooltip.js b/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/features_tooltip.tsx
similarity index 66%
rename from x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/features_tooltip.js
rename to x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/features_tooltip.tsx
index be8e960471efa..41a2b98ab4b28 100644
--- a/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/features_tooltip.js
+++ b/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/features_tooltip.tsx
@@ -5,26 +5,82 @@
  * 2.0.
  */
 
-import React, { Component, Fragment } from 'react';
+import React, { Component, Fragment, ReactNode } from 'react';
 import { EuiIcon, EuiLink } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { ActionExecutionContext, Action } from 'src/plugins/ui_actions/public';
+import { GeoJsonProperties, Geometry } from 'geojson';
+import { Filter } from 'src/plugins/data/public';
 import { FeatureProperties } from './feature_properties';
-import { GEO_JSON_TYPE, ES_GEO_FIELD_TYPE } from '../../../../common/constants';
+import { GEO_JSON_TYPE, ES_GEO_FIELD_TYPE, RawValue } from '../../../../common/constants';
 import { FeatureGeometryFilterForm } from './feature_geometry_filter_form';
 import { Footer } from './footer';
 import { Header } from './header';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
+import { PreIndexedShape } from '../../../../common/elasticsearch_util';
+import { GeoFieldWithIndex } from '../../../components/geo_field_with_index';
+import { TooltipFeature } from '../../../../common/descriptor_types';
+import { ITooltipProperty } from '../../../classes/tooltips/tooltip_property';
+import { ILayer } from '../../../classes/layers/layer';
 
-const VIEWS = {
-  PROPERTIES_VIEW: 'PROPERTIES_VIEW',
-  GEOMETRY_FILTER_VIEW: 'GEOMETRY_FILTER_VIEW',
-  FILTER_ACTIONS_VIEW: 'FILTER_ACTIONS_VIEW',
-};
+enum VIEWS {
+  PROPERTIES_VIEW = 'PROPERTIES_VIEW',
+  GEOMETRY_FILTER_VIEW = 'GEOMETRY_FILTER_VIEW',
+  FILTER_ACTIONS_VIEW = 'FILTER_ACTIONS_VIEW',
+}
 
-export class FeaturesTooltip extends Component {
-  state = {};
+interface Props {
+  addFilters: ((filters: Filter[], actionId: string) => Promise<void>) | null;
+  getFilterActions?: () => Promise<Action[]>;
+  getActionContext?: () => ActionExecutionContext;
+  onSingleValueTrigger?: (actionId: string, key: string, value: RawValue) => void;
+  closeTooltip: () => void;
+  features: TooltipFeature[];
+  isLocked: boolean;
+  loadFeatureProperties: ({
+    layerId,
+    featureId,
+    mbProperties,
+  }: {
+    layerId: string;
+    featureId?: string | number;
+    mbProperties: GeoJsonProperties;
+  }) => Promise<ITooltipProperty[]>;
+  loadFeatureGeometry: ({
+    layerId,
+    featureId,
+  }: {
+    layerId: string;
+    featureId?: string | number;
+  }) => Geometry | null;
+  getLayerName: (layerId: string) => Promise<string | null>;
+  findLayerById: (layerId: string) => ILayer | undefined;
+  geoFields: GeoFieldWithIndex[];
+  loadPreIndexedShape: ({
+    layerId,
+    featureId,
+  }: {
+    layerId: string;
+    featureId?: string | number;
+  }) => Promise<PreIndexedShape | null>;
+}
 
-  static getDerivedStateFromProps(nextProps, prevState) {
+interface State {
+  currentFeature: TooltipFeature | null;
+  filterView: ReactNode | null;
+  prevFeatures: TooltipFeature[];
+  view: VIEWS;
+}
+
+export class FeaturesTooltip extends Component<Props, State> {
+  state: State = {
+    currentFeature: null,
+    filterView: null,
+    prevFeatures: [],
+    view: VIEWS.PROPERTIES_VIEW,
+  };
+
+  static getDerivedStateFromProps(nextProps: Props, prevState: State) {
     if (nextProps.features !== prevState.prevFeatures) {
       return {
         currentFeature: nextProps.features ? nextProps.features[0] : null,
@@ -36,7 +92,7 @@ export class FeaturesTooltip extends Component {
     return null;
   }
 
-  _setCurrentFeature = (feature) => {
+  _setCurrentFeature = (feature: TooltipFeature) => {
     this.setState({ currentFeature: feature });
   };
 
@@ -48,11 +104,11 @@ export class FeaturesTooltip extends Component {
     this.setState({ view: VIEWS.PROPERTIES_VIEW, filterView: null });
   };
 
-  _showFilterActionsView = (filterView) => {
+  _showFilterActionsView = (filterView: ReactNode) => {
     this.setState({ view: VIEWS.FILTER_ACTIONS_VIEW, filterView });
   };
 
-  _renderActions(geoFields) {
+  _renderActions(geoFields: GeoFieldWithIndex[]) {
     if (!this.props.isLocked || geoFields.length === 0) {
       return null;
     }
@@ -67,7 +123,7 @@ export class FeaturesTooltip extends Component {
     );
   }
 
-  _filterGeoFields(featureGeometry) {
+  _filterGeoFields(featureGeometry: Geometry | null) {
     if (!featureGeometry) {
       return [];
     }
@@ -93,9 +149,9 @@ export class FeaturesTooltip extends Component {
     return this.props.geoFields;
   }
 
-  _loadCurrentFeaturePreIndexedShape = () => {
+  _loadCurrentFeaturePreIndexedShape = async () => {
     if (!this.state.currentFeature) {
-      return;
+      return null;
     }
 
     return this.props.loadPreIndexedShape({
@@ -104,7 +160,7 @@ export class FeaturesTooltip extends Component {
     });
   };
 
-  _renderBackButton(label) {
+  _renderBackButton(label: string) {
     return (
       <button
         className="euiContextMenuPanelTitle mapFeatureTooltip_backButton"
@@ -131,7 +187,11 @@ export class FeaturesTooltip extends Component {
     });
     const geoFields = this._filterGeoFields(currentFeatureGeometry);
 
-    if (this.state.view === VIEWS.GEOMETRY_FILTER_VIEW && currentFeatureGeometry) {
+    if (
+      this.state.view === VIEWS.GEOMETRY_FILTER_VIEW &&
+      currentFeatureGeometry &&
+      this.props.addFilters
+    ) {
       return (
         <Fragment>
           {this._renderBackButton(
@@ -141,7 +201,6 @@ export class FeaturesTooltip extends Component {
           )}
           <FeatureGeometryFilterForm
             onClose={this.props.closeTooltip}
-            showPropertiesView={this._showPropertiesView}
             geometry={currentFeatureGeometry}
             geoFields={geoFields}
             addFilters={this.props.addFilters}
diff --git a/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/footer.test.js b/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/footer.test.tsx
similarity index 89%
rename from x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/footer.test.js
rename to x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/footer.test.tsx
index e794588cff435..f8e60c7e6cf97 100644
--- a/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/footer.test.js
+++ b/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/footer.test.tsx
@@ -8,23 +8,19 @@
 import React from 'react';
 import { shallow } from 'enzyme';
 import { Footer } from './footer';
-
-class MockLayer {
-  constructor(id) {
-    this._id = id;
-  }
-  async getDisplayName() {
-    return `display + ${this._id}`;
-  }
-  getId() {
-    return this._id;
-  }
-}
+import { ILayer } from '../../../classes/layers/layer';
 
 const defaultProps = {
   isLocked: false,
-  findLayerById: (id) => {
-    return new MockLayer(id);
+  findLayerById: (id: string) => {
+    return ({
+      async getDisplayName() {
+        return `display + ${id}`;
+      },
+      getId() {
+        return id;
+      },
+    } as unknown) as ILayer;
   },
   setCurrentFeature: () => {},
 };
@@ -35,6 +31,7 @@ describe('Footer', () => {
       {
         id: 'feature1',
         layerId: 'layer1',
+        mbProperties: {},
       },
     ];
     describe('mouseover (unlocked)', () => {
@@ -56,10 +53,12 @@ describe('Footer', () => {
       {
         id: 'feature1',
         layerId: 'layer1',
+        mbProperties: {},
       },
       {
         id: 'feature2',
         layerId: 'layer1',
+        mbProperties: {},
       },
     ];
     describe('mouseover (unlocked)', () => {
@@ -97,14 +96,17 @@ describe('Footer', () => {
       {
         id: 'feature1',
         layerId: 'layer1',
+        mbProperties: {},
       },
       {
         id: 'feature2',
         layerId: 'layer1',
+        mbProperties: {},
       },
       {
         id: 'feature1',
         layerId: 'layer2',
+        mbProperties: {},
       },
     ];
     describe('mouseover (unlocked)', () => {
diff --git a/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/footer.js b/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/footer.tsx
similarity index 83%
rename from x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/footer.js
rename to x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/footer.tsx
index 559e3fb18c182..3ad19a7901b09 100644
--- a/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/footer.js
+++ b/x-pack/plugins/maps/public/connected_components/mb_map/features_tooltip/footer.tsx
@@ -5,10 +5,11 @@
  * 2.0.
  */
 
-import React, { Component, Fragment } from 'react';
+import React, { ChangeEvent, Component, Fragment } from 'react';
 import {
   EuiPagination,
   EuiSelect,
+  EuiSelectOption,
   EuiHorizontalRule,
   EuiFlexGroup,
   EuiFlexItem,
@@ -17,12 +18,30 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
+import { TooltipFeature } from '../../../../common/descriptor_types';
+import { ILayer } from '../../../classes/layers/layer';
 
 const ALL_LAYERS = '_ALL_LAYERS_';
 const DEFAULT_PAGE_NUMBER = 0;
 
-export class Footer extends Component {
-  state = {
+interface Props {
+  features: TooltipFeature[];
+  isLocked: boolean;
+  findLayerById: (layerId: string) => ILayer | undefined;
+  setCurrentFeature: (feature: TooltipFeature) => void;
+}
+
+interface State {
+  filteredFeatures: TooltipFeature[];
+  pageNumber: number;
+  selectedLayerId: string;
+  layerOptions: EuiSelectOption[];
+}
+
+export class Footer extends Component<Props, State> {
+  private _isMounted = false;
+  private _prevFeatures: TooltipFeature[] | null = null;
+  state: State = {
     filteredFeatures: this.props.features,
     pageNumber: DEFAULT_PAGE_NUMBER,
     selectedLayerId: ALL_LAYERS,
@@ -31,7 +50,6 @@ export class Footer extends Component {
 
   componentDidMount() {
     this._isMounted = true;
-    this._prevFeatures = null;
     this._loadUniqueLayers();
   }
 
@@ -50,7 +68,7 @@ export class Footer extends Component {
 
     this._prevFeatures = this.props.features;
 
-    const countByLayerId = new Map();
+    const countByLayerId = new Map<string, number>();
     for (let i = 0; i < this.props.features.length; i++) {
       let count = countByLayerId.get(this.props.features[i].layerId);
       if (!count) {
@@ -60,9 +78,12 @@ export class Footer extends Component {
       countByLayerId.set(this.props.features[i].layerId, count);
     }
 
-    const layers = [];
+    const layers: ILayer[] = [];
     countByLayerId.forEach((count, layerId) => {
-      layers.push(this.props.findLayerById(layerId));
+      const layer = this.props.findLayerById(layerId);
+      if (layer) {
+        layers.push(layer);
+      }
     });
     const layerNamePromises = layers.map((layer) => {
       return layer.getDisplayName();
@@ -88,12 +109,12 @@ export class Footer extends Component {
     }
   };
 
-  _onPageChange = (pageNumber) => {
+  _onPageChange = (pageNumber: number) => {
     this.setState({ pageNumber });
     this.props.setCurrentFeature(this.state.filteredFeatures[pageNumber]);
   };
 
-  _onLayerChange = (e) => {
+  _onLayerChange = (e: ChangeEvent<HTMLSelectElement>) => {
     const newLayerId = e.target.value;
     if (this.state.selectedLayerId === newLayerId) {
       return;

From 1a1c36a99bb395efeacdd1d1374f4bde1d2a018a Mon Sep 17 00:00:00 2001
From: Stacey Gammon <gammon@elastic.co>
Date: Tue, 27 Apr 2021 16:50:39 -0400
Subject: [PATCH 16/28] Update best_practices.mdx (#98032)

---
 dev_docs/best_practices.mdx | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dev_docs/best_practices.mdx b/dev_docs/best_practices.mdx
index 4d51263f93372..54aaaa6b9497a 100644
--- a/dev_docs/best_practices.mdx
+++ b/dev_docs/best_practices.mdx
@@ -65,6 +65,7 @@ Every publicly exposed function, class, interface, type, parameter and property
 - Use `@returns` tags for return types.
 - Use `@throws` when appropriate.
 - Use `@beta` or `@deprecated` when appropriate.
+- Use `@removeBy {version}` on `@deprecated` APIs. The version should be the last version the API will work in. For example, `@removeBy 7.15` means the API will be removed in 7.16. This lets us avoid mid-release cycle coordination. The API can be removed as soon as the 7.15 branch is cut.
 - Use `@internal` to indicate this API item is intended for internal use only, which will also remove it from the docs.
 
 #### Interfaces vs inlined types

From 33f47ba59049dda7cb35c256ac33722219563928 Mon Sep 17 00:00:00 2001
From: Yuliia Naumenko <jo.naumenko@gmail.com>
Date: Tue, 27 Apr 2021 14:14:01 -0700
Subject: [PATCH 17/28] [Connectors][API] Updated connectors with
 isMissingSecrets flag (#98223)

* [Connectors][API] Updated connectors with enabledAfterImport flag

* fixed functional tests

* added new field to connectors API docs

* added update unit test

* fixed test

* renamed enableAfterImport to isMissingSecrets

* removed onExport

* revert the logic of true/false for isMissingSecrets

* fixed test

* fixed tests

* added unit test

* fixed docs

* fixed import text and button labels

* fixed import text

* fixed text
---
 .../actions-and-connectors/create.asciidoc    |  3 +-
 docs/api/actions-and-connectors/get.asciidoc  |  3 +-
 .../actions-and-connectors/get_all.asciidoc   |  1 +
 .../legacy/create.asciidoc                    |  3 +-
 .../legacy/get.asciidoc                       |  3 +-
 .../legacy/get_all.asciidoc                   |  3 +-
 .../legacy/update.asciidoc                    |  3 +-
 .../actions-and-connectors/update.asciidoc    |  3 +-
 .../actions/server/actions_client.test.ts     | 97 +++++++++++++++++++
 .../plugins/actions/server/actions_client.ts  |  5 +
 .../actions/server/routes/create.test.ts      |  6 +-
 .../plugins/actions/server/routes/create.ts   |  2 +
 .../plugins/actions/server/routes/get.test.ts |  3 +
 x-pack/plugins/actions/server/routes/get.ts   |  2 +
 .../plugins/actions/server/routes/get_all.ts  | 15 +--
 .../plugins/actions/server/routes/update.ts   |  2 +
 .../get_import_result_message.test.ts         | 53 ++++++++++
 .../get_import_result_message.ts              | 25 +++++
 .../actions/server/saved_objects/index.ts     | 23 ++++-
 .../server/saved_objects/mappings.json        |  3 +
 .../server/saved_objects/migrations.test.ts   | 48 ++++++++-
 .../server/saved_objects/migrations.ts        | 18 ++++
 x-pack/plugins/actions/server/types.ts        |  2 +
 .../actions/builtin_action_types/email.ts     |  2 +
 .../actions/builtin_action_types/es_index.ts  |  4 +
 .../actions/builtin_action_types/jira.ts      |  2 +
 .../actions/builtin_action_types/pagerduty.ts |  2 +
 .../actions/builtin_action_types/resilient.ts |  2 +
 .../builtin_action_types/server_log.ts        |  2 +
 .../builtin_action_types/servicenow.ts        |  2 +
 .../actions/builtin_action_types/slack.ts     |  2 +
 .../actions/builtin_action_types/webhook.ts   |  4 +
 .../tests/actions/create.ts                   |  1 +
 .../security_and_spaces/tests/actions/get.ts  |  1 +
 .../tests/actions/get_all.ts                  |  2 +
 .../tests/actions/update.ts                   |  1 +
 .../actions/builtin_action_types/es_index.ts  |  4 +
 .../spaces_only/tests/actions/create.ts       |  2 +
 .../spaces_only/tests/actions/get.ts          |  2 +
 .../spaces_only/tests/actions/get_all.ts      |  2 +
 .../spaces_only/tests/actions/migrations.ts   |  9 ++
 .../tests/actions/type_not_enabled.ts         |  2 +
 .../spaces_only/tests/actions/update.ts       |  2 +
 .../basic/tests/configure/get_connectors.ts   |  3 +
 .../es_archives/actions/mappings.json         |  3 +
 45 files changed, 362 insertions(+), 20 deletions(-)
 create mode 100644 x-pack/plugins/actions/server/saved_objects/get_import_result_message.test.ts
 create mode 100644 x-pack/plugins/actions/server/saved_objects/get_import_result_message.ts

diff --git a/docs/api/actions-and-connectors/create.asciidoc b/docs/api/actions-and-connectors/create.asciidoc
index 554e84615d568..c9ea31c98cf19 100644
--- a/docs/api/actions-and-connectors/create.asciidoc
+++ b/docs/api/actions-and-connectors/create.asciidoc
@@ -73,6 +73,7 @@ The API returns the following:
     "refresh": false,
     "executionTimeField": null
   },
-  "is_preconfigured": false
+  "is_preconfigured": false,
+  "is_missing_secrets": false
 }
 --------------------------------------------------
diff --git a/docs/api/actions-and-connectors/get.asciidoc b/docs/api/actions-and-connectors/get.asciidoc
index 0d9af45c4ef0c..95336e7f55d30 100644
--- a/docs/api/actions-and-connectors/get.asciidoc
+++ b/docs/api/actions-and-connectors/get.asciidoc
@@ -50,6 +50,7 @@ The API returns the following:
     "refresh": false,
     "executionTimeField": null
   },
-  "is_preconfigured": false
+  "is_preconfigured": false,
+  "is_missing_secrets": false
 }
 --------------------------------------------------
diff --git a/docs/api/actions-and-connectors/get_all.asciidoc b/docs/api/actions-and-connectors/get_all.asciidoc
index e4e67a9bbde73..8036b9fea7f95 100644
--- a/docs/api/actions-and-connectors/get_all.asciidoc
+++ b/docs/api/actions-and-connectors/get_all.asciidoc
@@ -56,6 +56,7 @@ The API returns the following:
       "executionTimeField": null
     },
     "is_preconfigured": false,
+    "is_missing_secrets": false,
     "referenced_by_count": 3
   }
 ]
diff --git a/docs/api/actions-and-connectors/legacy/create.asciidoc b/docs/api/actions-and-connectors/legacy/create.asciidoc
index 0361c4222986b..e0d531a2befb9 100644
--- a/docs/api/actions-and-connectors/legacy/create.asciidoc
+++ b/docs/api/actions-and-connectors/legacy/create.asciidoc
@@ -75,6 +75,7 @@ The API returns the following:
     "refresh": false,
     "executionTimeField": null
   },
-  "isPreconfigured": false
+  "isPreconfigured": false,
+  "isMissingSecrets": false
 }
 --------------------------------------------------
diff --git a/docs/api/actions-and-connectors/legacy/get.asciidoc b/docs/api/actions-and-connectors/legacy/get.asciidoc
index 6413fce558f5b..dab462e3ae4fb 100644
--- a/docs/api/actions-and-connectors/legacy/get.asciidoc
+++ b/docs/api/actions-and-connectors/legacy/get.asciidoc
@@ -52,6 +52,7 @@ The API returns the following:
     "refresh": false,
     "executionTimeField": null
   },
-  "isPreconfigured": false
+  "isPreconfigured": false,
+  "isMissingSecrets": false
 }
 --------------------------------------------------
diff --git a/docs/api/actions-and-connectors/legacy/get_all.asciidoc b/docs/api/actions-and-connectors/legacy/get_all.asciidoc
index 191eccb6f8d39..2180720ce6542 100644
--- a/docs/api/actions-and-connectors/legacy/get_all.asciidoc
+++ b/docs/api/actions-and-connectors/legacy/get_all.asciidoc
@@ -56,7 +56,8 @@ The API returns the following:
       "refresh": false,
       "executionTimeField": null
     },
-    "isPreconfigured": false
+    "isPreconfigured": false,
+    "isMissingSecrets": false
   }
 ]
 --------------------------------------------------
diff --git a/docs/api/actions-and-connectors/legacy/update.asciidoc b/docs/api/actions-and-connectors/legacy/update.asciidoc
index 6a33e765cf063..5202f8124e6a8 100644
--- a/docs/api/actions-and-connectors/legacy/update.asciidoc
+++ b/docs/api/actions-and-connectors/legacy/update.asciidoc
@@ -70,6 +70,7 @@ The API returns the following:
     "refresh": false,
     "executionTimeField": null
   },
-  "isPreconfigured": false
+  "isPreconfigured": false,
+  "isMissingSecrets": false
 }
 --------------------------------------------------
diff --git a/docs/api/actions-and-connectors/update.asciidoc b/docs/api/actions-and-connectors/update.asciidoc
index f522cb8d048e0..0b7dcc898a122 100644
--- a/docs/api/actions-and-connectors/update.asciidoc
+++ b/docs/api/actions-and-connectors/update.asciidoc
@@ -68,6 +68,7 @@ The API returns the following:
     "refresh": false,
     "executionTimeField": null
   },
-  "is_preconfigured": false
+  "is_preconfigured": false,
+  "is_missing_secrets": false
 }
 --------------------------------------------------
diff --git a/x-pack/plugins/actions/server/actions_client.test.ts b/x-pack/plugins/actions/server/actions_client.test.ts
index 9b22e31c05e8a..30108a0777819 100644
--- a/x-pack/plugins/actions/server/actions_client.test.ts
+++ b/x-pack/plugins/actions/server/actions_client.test.ts
@@ -92,6 +92,7 @@ describe('create()', () => {
         attributes: {
           name: 'my name',
           actionTypeId: 'my-action-type',
+          isMissingSecrets: false,
           config: {},
         },
         references: [],
@@ -123,6 +124,7 @@ describe('create()', () => {
         attributes: {
           name: 'my name',
           actionTypeId: 'my-action-type',
+          isMissingSecrets: false,
           config: {},
         },
         references: [],
@@ -162,6 +164,7 @@ describe('create()', () => {
         attributes: {
           name: 'my name',
           actionTypeId: 'my-action-type',
+          isMissingSecrets: false,
           config: {},
         },
         references: [],
@@ -199,6 +202,7 @@ describe('create()', () => {
         attributes: {
           name: 'my name',
           actionTypeId: 'my-action-type',
+          isMissingSecrets: false,
           config: {},
         },
         references: [],
@@ -250,6 +254,7 @@ describe('create()', () => {
       attributes: {
         name: 'my name',
         actionTypeId: 'my-action-type',
+        isMissingSecrets: false,
         config: {},
       },
       references: [],
@@ -274,6 +279,7 @@ describe('create()', () => {
       isPreconfigured: false,
       name: 'my name',
       actionTypeId: 'my-action-type',
+      isMissingSecrets: false,
       config: {},
     });
     expect(unsecuredSavedObjectsClient.create).toHaveBeenCalledTimes(1);
@@ -283,6 +289,7 @@ describe('create()', () => {
         Object {
           "actionTypeId": "my-action-type",
           "config": Object {},
+          "isMissingSecrets": false,
           "name": "my name",
           "secrets": Object {},
         },
@@ -347,6 +354,7 @@ describe('create()', () => {
       attributes: {
         name: 'my name',
         actionTypeId: 'my-action-type',
+        isMissingSecrets: false,
         config: {
           a: true,
           b: true,
@@ -373,6 +381,7 @@ describe('create()', () => {
       isPreconfigured: false,
       name: 'my name',
       actionTypeId: 'my-action-type',
+      isMissingSecrets: false,
       config: {
         a: true,
         b: true,
@@ -390,6 +399,7 @@ describe('create()', () => {
             "b": true,
             "c": true,
           },
+          "isMissingSecrets": false,
           "name": "my name",
           "secrets": Object {},
         },
@@ -449,6 +459,7 @@ describe('create()', () => {
       attributes: {
         name: 'my name',
         actionTypeId: 'my-action-type',
+        isMissingSecrets: false,
         config: {},
       },
       references: [],
@@ -482,6 +493,7 @@ describe('create()', () => {
       attributes: {
         name: 'my name',
         actionTypeId: 'my-action-type',
+        isMissingSecrets: false,
         config: {},
       },
       references: [],
@@ -518,6 +530,7 @@ describe('get()', () => {
         attributes: {
           name: 'my name',
           actionTypeId: 'my-action-type',
+          isMissingSecrets: false,
           config: {},
         },
         references: [],
@@ -566,6 +579,7 @@ describe('get()', () => {
         attributes: {
           name: 'my name',
           actionTypeId: 'my-action-type',
+          isMissingSecrets: false,
           config: {},
         },
         references: [],
@@ -628,6 +642,7 @@ describe('get()', () => {
         attributes: {
           name: 'my name',
           actionTypeId: 'my-action-type',
+          isMissingSecrets: false,
           config: {},
         },
         references: [],
@@ -653,6 +668,7 @@ describe('get()', () => {
         attributes: {
           name: 'my name',
           actionTypeId: 'my-action-type',
+          isMissingSecrets: false,
           config: {},
         },
         references: [],
@@ -821,6 +837,7 @@ describe('getAll()', () => {
             type: 'type',
             attributes: {
               name: 'test',
+              isMissingSecrets: false,
               config: {
                 foo: 'bar',
               },
@@ -881,6 +898,7 @@ describe('getAll()', () => {
           type: 'type',
           attributes: {
             name: 'test',
+            isMissingSecrets: false,
             config: {
               foo: 'bar',
             },
@@ -932,6 +950,7 @@ describe('getAll()', () => {
         config: {
           foo: 'bar',
         },
+        isMissingSecrets: false,
         referencedByCount: 6,
       },
       {
@@ -959,6 +978,7 @@ describe('getBulk()', () => {
               config: {
                 foo: 'bar',
               },
+              isMissingSecrets: false,
             },
             references: [],
           },
@@ -1030,6 +1050,7 @@ describe('getBulk()', () => {
               config: {
                 foo: 'bar',
               },
+              isMissingSecrets: false,
             },
             references: [],
           },
@@ -1088,6 +1109,7 @@ describe('getBulk()', () => {
             config: {
               foo: 'bar',
             },
+            isMissingSecrets: false,
           },
           references: [],
         },
@@ -1143,6 +1165,7 @@ describe('getBulk()', () => {
           foo: 'bar',
         },
         id: '1',
+        isMissingSecrets: false,
         isPreconfigured: false,
         name: 'test',
       },
@@ -1231,6 +1254,7 @@ describe('update()', () => {
       type: 'action',
       attributes: {
         actionTypeId: 'my-action-type',
+        isMissingSecrets: false,
       },
       references: [],
     });
@@ -1239,6 +1263,7 @@ describe('update()', () => {
       type: 'action',
       attributes: {
         actionTypeId: 'my-action-type',
+        isMissingSecrets: false,
         name: 'my name',
         config: {},
         secrets: {},
@@ -1319,6 +1344,7 @@ describe('update()', () => {
       type: 'action',
       attributes: {
         actionTypeId: 'my-action-type',
+        isMissingSecrets: false,
       },
       references: [],
     });
@@ -1327,6 +1353,7 @@ describe('update()', () => {
       type: 'action',
       attributes: {
         actionTypeId: 'my-action-type',
+        isMissingSecrets: false,
         name: 'my name',
         config: {},
         secrets: {},
@@ -1345,6 +1372,7 @@ describe('update()', () => {
       id: 'my-action',
       isPreconfigured: false,
       actionTypeId: 'my-action-type',
+      isMissingSecrets: false,
       name: 'my name',
       config: {},
     });
@@ -1355,6 +1383,7 @@ describe('update()', () => {
         Object {
           "actionTypeId": "my-action-type",
           "config": Object {},
+          "isMissingSecrets": false,
           "name": "my name",
           "secrets": Object {},
         },
@@ -1374,6 +1403,70 @@ describe('update()', () => {
     `);
   });
 
+  test('updates an action with isMissingSecrets "true" (set true as the import result), to isMissingSecrets', async () => {
+    actionTypeRegistry.register({
+      id: 'my-action-type',
+      name: 'My action type',
+      minimumLicenseRequired: 'basic',
+      executor,
+    });
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
+      id: '1',
+      type: 'action',
+      attributes: {
+        actionTypeId: 'my-action-type',
+        isMissingSecrets: true,
+      },
+      references: [],
+    });
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
+      id: 'my-action',
+      type: 'action',
+      attributes: {
+        actionTypeId: 'my-action-type',
+        isMissingSecrets: true,
+        name: 'my name',
+        config: {},
+        secrets: {},
+      },
+      references: [],
+    });
+    const result = await actionsClient.update({
+      id: 'my-action',
+      action: {
+        name: 'my name',
+        config: {},
+        secrets: {},
+      },
+    });
+    expect(result).toEqual({
+      id: 'my-action',
+      isPreconfigured: false,
+      actionTypeId: 'my-action-type',
+      isMissingSecrets: true,
+      name: 'my name',
+      config: {},
+    });
+    expect(unsecuredSavedObjectsClient.create).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "action",
+        Object {
+          "actionTypeId": "my-action-type",
+          "config": Object {},
+          "isMissingSecrets": false,
+          "name": "my name",
+          "secrets": Object {},
+        },
+        Object {
+          "id": "my-action",
+          "overwrite": true,
+          "references": Array [],
+        },
+      ]
+    `);
+  });
+
   test('validates config', async () => {
     actionTypeRegistry.register({
       id: 'my-action-type',
@@ -1428,6 +1521,7 @@ describe('update()', () => {
       type: 'action',
       attributes: {
         actionTypeId: 'my-action-type',
+        isMissingSecrets: true,
         name: 'my name',
         config: {
           a: true,
@@ -1454,6 +1548,7 @@ describe('update()', () => {
       id: 'my-action',
       isPreconfigured: false,
       actionTypeId: 'my-action-type',
+      isMissingSecrets: true,
       name: 'my name',
       config: {
         a: true,
@@ -1472,6 +1567,7 @@ describe('update()', () => {
             "b": true,
             "c": true,
           },
+          "isMissingSecrets": false,
           "name": "my name",
           "secrets": Object {},
         },
@@ -1507,6 +1603,7 @@ describe('update()', () => {
       type: 'action',
       attributes: {
         actionTypeId: 'my-action-type',
+        isMissingSecrets: false,
         name: 'my name',
         config: {},
         secrets: {},
diff --git a/x-pack/plugins/actions/server/actions_client.ts b/x-pack/plugins/actions/server/actions_client.ts
index 9f87de5f686cc..c655141415b54 100644
--- a/x-pack/plugins/actions/server/actions_client.ts
+++ b/x-pack/plugins/actions/server/actions_client.ts
@@ -155,6 +155,7 @@ export class ActionsClient {
       {
         actionTypeId,
         name,
+        isMissingSecrets: false,
         config: validatedActionTypeConfig as SavedObjectAttributes,
         secrets: validatedActionTypeSecrets as SavedObjectAttributes,
       },
@@ -164,6 +165,7 @@ export class ActionsClient {
     return {
       id: result.id,
       actionTypeId: result.attributes.actionTypeId,
+      isMissingSecrets: result.attributes.isMissingSecrets,
       name: result.attributes.name,
       config: result.attributes.config,
       isPreconfigured: false,
@@ -228,6 +230,7 @@ export class ActionsClient {
         ...attributes,
         actionTypeId,
         name,
+        isMissingSecrets: false,
         config: validatedActionTypeConfig as SavedObjectAttributes,
         secrets: validatedActionTypeSecrets as SavedObjectAttributes,
       },
@@ -245,6 +248,7 @@ export class ActionsClient {
     return {
       id,
       actionTypeId: result.attributes.actionTypeId as string,
+      isMissingSecrets: result.attributes.isMissingSecrets as boolean,
       name: result.attributes.name as string,
       config: result.attributes.config as Record<string, unknown>,
       isPreconfigured: false,
@@ -299,6 +303,7 @@ export class ActionsClient {
     return {
       id,
       actionTypeId: result.attributes.actionTypeId,
+      isMissingSecrets: result.attributes.isMissingSecrets,
       name: result.attributes.name,
       config: result.attributes.config,
       isPreconfigured: false,
diff --git a/x-pack/plugins/actions/server/routes/create.test.ts b/x-pack/plugins/actions/server/routes/create.test.ts
index e5d8e6f5861f3..51a55309b52ae 100644
--- a/x-pack/plugins/actions/server/routes/create.test.ts
+++ b/x-pack/plugins/actions/server/routes/create.test.ts
@@ -39,12 +39,14 @@ describe('createActionRoute', () => {
       actionTypeId: 'abc',
       config: { foo: true },
       isPreconfigured: false,
+      isMissingSecrets: false,
     };
 
     const createApiResult = {
-      ...omit(createResult, ['actionTypeId', 'isPreconfigured']),
+      ...omit(createResult, ['actionTypeId', 'isPreconfigured', 'isMissingSecrets']),
       connector_type_id: createResult.actionTypeId,
       is_preconfigured: createResult.isPreconfigured,
+      is_missing_secrets: createResult.isMissingSecrets,
     };
 
     const actionsClient = actionsClientMock.create();
@@ -99,6 +101,7 @@ describe('createActionRoute', () => {
       id: '1',
       name: 'My name',
       actionTypeId: 'abc',
+      isMissingSecrets: false,
       config: { foo: true },
       isPreconfigured: false,
     });
@@ -138,6 +141,7 @@ describe('createActionRoute', () => {
       name: 'My name',
       actionTypeId: 'abc',
       config: { foo: true },
+      isMissingSecrets: false,
       isPreconfigured: false,
     });
 
diff --git a/x-pack/plugins/actions/server/routes/create.ts b/x-pack/plugins/actions/server/routes/create.ts
index c05f2180bd62b..0c243b6a4eaa9 100644
--- a/x-pack/plugins/actions/server/routes/create.ts
+++ b/x-pack/plugins/actions/server/routes/create.ts
@@ -29,11 +29,13 @@ const rewriteBodyReq: RewriteRequestCase<CreateOptions['action']> = ({
 const rewriteBodyRes: RewriteResponseCase<ActionResult> = ({
   actionTypeId,
   isPreconfigured,
+  isMissingSecrets,
   ...res
 }) => ({
   ...res,
   connector_type_id: actionTypeId,
   is_preconfigured: isPreconfigured,
+  is_missing_secrets: isMissingSecrets,
 });
 
 export const createActionRoute = (
diff --git a/x-pack/plugins/actions/server/routes/get.test.ts b/x-pack/plugins/actions/server/routes/get.test.ts
index 6a42f3b27370e..1107ec243bc01 100644
--- a/x-pack/plugins/actions/server/routes/get.test.ts
+++ b/x-pack/plugins/actions/server/routes/get.test.ts
@@ -38,6 +38,7 @@ describe('getActionRoute', () => {
       name: 'action name',
       config: {},
       isPreconfigured: false,
+      isMissingSecrets: false,
     };
 
     const actionsClient = actionsClientMock.create();
@@ -57,6 +58,7 @@ describe('getActionRoute', () => {
           "config": Object {},
           "connector_type_id": "2",
           "id": "1",
+          "is_missing_secrets": false,
           "is_preconfigured": false,
           "name": "action name",
         },
@@ -73,6 +75,7 @@ describe('getActionRoute', () => {
         name: 'action name',
         config: {},
         is_preconfigured: false,
+        is_missing_secrets: false,
       },
     });
   });
diff --git a/x-pack/plugins/actions/server/routes/get.ts b/x-pack/plugins/actions/server/routes/get.ts
index 59766fc133ba6..3f4a67c3bfbcd 100644
--- a/x-pack/plugins/actions/server/routes/get.ts
+++ b/x-pack/plugins/actions/server/routes/get.ts
@@ -19,11 +19,13 @@ const paramSchema = schema.object({
 const rewriteBodyRes: RewriteResponseCase<ActionResult> = ({
   actionTypeId,
   isPreconfigured,
+  isMissingSecrets,
   ...res
 }) => ({
   ...res,
   connector_type_id: actionTypeId,
   is_preconfigured: isPreconfigured,
+  is_missing_secrets: isMissingSecrets,
 });
 
 export const getActionRoute = (
diff --git a/x-pack/plugins/actions/server/routes/get_all.ts b/x-pack/plugins/actions/server/routes/get_all.ts
index 831722fd36eed..2d3a2727e9663 100644
--- a/x-pack/plugins/actions/server/routes/get_all.ts
+++ b/x-pack/plugins/actions/server/routes/get_all.ts
@@ -12,12 +12,15 @@ import { ActionsRequestHandlerContext, FindActionResult } from '../types';
 import { verifyAccessAndContext } from './verify_access_and_context';
 
 const rewriteBodyRes: RewriteResponseCase<FindActionResult[]> = (results) => {
-  return results.map(({ actionTypeId, isPreconfigured, referencedByCount, ...res }) => ({
-    ...res,
-    connector_type_id: actionTypeId,
-    is_preconfigured: isPreconfigured,
-    referenced_by_count: referencedByCount,
-  }));
+  return results.map(
+    ({ actionTypeId, isPreconfigured, referencedByCount, isMissingSecrets, ...res }) => ({
+      ...res,
+      connector_type_id: actionTypeId,
+      is_preconfigured: isPreconfigured,
+      referenced_by_count: referencedByCount,
+      is_missing_secrets: isMissingSecrets,
+    })
+  );
 };
 
 export const getAllActionRoute = (
diff --git a/x-pack/plugins/actions/server/routes/update.ts b/x-pack/plugins/actions/server/routes/update.ts
index d1758717e80f9..276ce80751726 100644
--- a/x-pack/plugins/actions/server/routes/update.ts
+++ b/x-pack/plugins/actions/server/routes/update.ts
@@ -25,11 +25,13 @@ const bodySchema = schema.object({
 const rewriteBodyRes: RewriteResponseCase<ActionResult> = ({
   actionTypeId,
   isPreconfigured,
+  isMissingSecrets,
   ...res
 }) => ({
   ...res,
   connector_type_id: actionTypeId,
   is_preconfigured: isPreconfigured,
+  is_missing_secrets: isMissingSecrets,
 });
 
 export const updateActionRoute = (
diff --git a/x-pack/plugins/actions/server/saved_objects/get_import_result_message.test.ts b/x-pack/plugins/actions/server/saved_objects/get_import_result_message.test.ts
new file mode 100644
index 0000000000000..b5a5ab75b9248
--- /dev/null
+++ b/x-pack/plugins/actions/server/saved_objects/get_import_result_message.test.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { SavedObject } from 'kibana/server';
+import { RawAction } from '../types';
+import { getImportResultMessage } from './get_import_result_message';
+
+describe('getImportResultMessage', () => {
+  it('Return message with total imported connectors and the proper secrets need to update ', async () => {
+    const savedObjectConnectors = [
+      {
+        type: 'action',
+        id: 'ed02cb70-a6ef-11eb-bd58-6b2eae02c6ef',
+        attributes: {
+          actionTypeId: '.server-log',
+          config: {},
+          isMissingSecrets: false,
+          name: 'test',
+        },
+        references: [],
+        migrationVersion: { action: '7.14.0' },
+        coreMigrationVersion: '8.0.0',
+        updated_at: '2021-04-27T04:10:33.043Z',
+        version: 'WzcxLDFd',
+        namespaces: ['default'],
+      },
+      {
+        type: 'action',
+        id: 'e8aa94e0-a6ef-11eb-bd58-6b2eae02c6ef',
+        attributes: {
+          actionTypeId: '.email',
+          config: [Object],
+          isMissingSecrets: true,
+          name: 'test',
+        },
+        references: [],
+        migrationVersion: { action: '7.14.0' },
+        coreMigrationVersion: '8.0.0',
+        updated_at: '2021-04-27T04:10:33.043Z',
+        version: 'WzcyLDFd',
+        namespaces: ['default'],
+      },
+    ];
+    const message = getImportResultMessage(
+      (savedObjectConnectors as unknown) as Array<SavedObject<RawAction>>
+    );
+    expect(message).toBe('1 connector has secrets that require updates.');
+  });
+});
diff --git a/x-pack/plugins/actions/server/saved_objects/get_import_result_message.ts b/x-pack/plugins/actions/server/saved_objects/get_import_result_message.ts
new file mode 100644
index 0000000000000..3b88a750c7430
--- /dev/null
+++ b/x-pack/plugins/actions/server/saved_objects/get_import_result_message.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { SavedObject } from 'kibana/server';
+import { RawAction } from '../types';
+
+export function getImportResultMessage(connectors: Array<SavedObject<RawAction>>) {
+  const connectorsWithSecrets = connectors.filter(
+    (connector) => connector.attributes.isMissingSecrets
+  );
+  return i18n.translate('xpack.actions.savedObjects.onImportText', {
+    defaultMessage:
+      '{connectorsWithSecretsLength} {connectorsWithSecretsLength, plural, one {connector has} other {connectors have}} secrets that require updates.',
+    values: {
+      connectorsWithSecretsLength: connectorsWithSecrets.length,
+    },
+  });
+}
+
+export const GO_TO_CONNECTORS_BUTTON_LABLE = 'Go to connectors';
diff --git a/x-pack/plugins/actions/server/saved_objects/index.ts b/x-pack/plugins/actions/server/saved_objects/index.ts
index c8626660de2d9..3c6a78a6f0866 100644
--- a/x-pack/plugins/actions/server/saved_objects/index.ts
+++ b/x-pack/plugins/actions/server/saved_objects/index.ts
@@ -5,10 +5,12 @@
  * 2.0.
  */
 
-import { SavedObjectsServiceSetup } from 'kibana/server';
+import { SavedObject, SavedObjectsServiceSetup } from 'kibana/server';
 import { EncryptedSavedObjectsPluginSetup } from '../../../encrypted_saved_objects/server';
 import mappings from './mappings.json';
 import { getMigrations } from './migrations';
+import { RawAction } from '../types';
+import { getImportResultMessage, GO_TO_CONNECTORS_BUTTON_LABLE } from './get_import_result_message';
 
 export const ACTION_SAVED_OBJECT_TYPE = 'action';
 export const ALERT_SAVED_OBJECT_TYPE = 'alert';
@@ -24,6 +26,25 @@ export function setupSavedObjects(
     namespaceType: 'single',
     mappings: mappings.action,
     migrations: getMigrations(encryptedSavedObjects),
+    management: {
+      defaultSearchField: 'name',
+      importableAndExportable: true,
+      getTitle(obj) {
+        return `Connector: [${obj.attributes.name}]`;
+      },
+      onImport(connectors) {
+        return {
+          warnings: [
+            {
+              type: 'action_required',
+              message: getImportResultMessage(connectors as Array<SavedObject<RawAction>>),
+              actionPath: '/app/management/insightsAndAlerting/triggersActions/connectors',
+              buttonLabel: GO_TO_CONNECTORS_BUTTON_LABLE,
+            },
+          ],
+        };
+      },
+    },
   });
 
   // Encrypted attributes
diff --git a/x-pack/plugins/actions/server/saved_objects/mappings.json b/x-pack/plugins/actions/server/saved_objects/mappings.json
index ef6a0c9919920..c598b96ba2451 100644
--- a/x-pack/plugins/actions/server/saved_objects/mappings.json
+++ b/x-pack/plugins/actions/server/saved_objects/mappings.json
@@ -12,6 +12,9 @@
       "actionTypeId": {
         "type": "keyword"
       },
+      "isMissingSecrets": {
+        "type": "boolean"
+      },
       "config": {
         "enabled": false,
         "type": "object"
diff --git a/x-pack/plugins/actions/server/saved_objects/migrations.test.ts b/x-pack/plugins/actions/server/saved_objects/migrations.test.ts
index a75735e514c10..4c30925e61894 100644
--- a/x-pack/plugins/actions/server/saved_objects/migrations.test.ts
+++ b/x-pack/plugins/actions/server/saved_objects/migrations.test.ts
@@ -43,7 +43,7 @@ describe('7.10.0', () => {
 
   test('rename cases configuration object', () => {
     const migration710 = getMigrations(encryptedSavedObjectsSetup)['7.10.0'];
-    const action = getMockData({});
+    const action = getCasesMockData({});
     const migratedAction = migration710(action, context);
     expect(migratedAction.attributes.config).toEqual({
       incidentConfiguration: { mapping: [] },
@@ -112,10 +112,32 @@ describe('7.11.0', () => {
   });
 });
 
+describe('7.14.0', () => {
+  beforeEach(() => {
+    jest.resetAllMocks();
+    encryptedSavedObjectsSetup.createMigration.mockImplementation(
+      (shouldMigrateWhenPredicate, migration) => migration
+    );
+  });
+
+  test('add isMissingSecrets property for actions', () => {
+    const migration714 = getMigrations(encryptedSavedObjectsSetup)['7.14.0'];
+    const action = getMockData({ isMissingSecrets: undefined });
+    const migratedAction = migration714(action, context);
+    expect(migratedAction).toEqual({
+      ...action,
+      attributes: {
+        ...action.attributes,
+        isMissingSecrets: false,
+      },
+    });
+  });
+});
+
 function getMockDataForWebhook(
   overwrites: Record<string, unknown> = {},
   hasUserAndPassword: boolean
-): SavedObjectUnsanitizedDoc<RawAction> {
+): SavedObjectUnsanitizedDoc<Omit<RawAction, 'isMissingSecrets'>> {
   const secrets = hasUserAndPassword
     ? { user: 'test', password: '123' }
     : { user: '', password: '' };
@@ -134,7 +156,7 @@ function getMockDataForWebhook(
 
 function getMockDataForEmail(
   overwrites: Record<string, unknown> = {}
-): SavedObjectUnsanitizedDoc<RawAction> {
+): SavedObjectUnsanitizedDoc<Omit<RawAction, 'isMissingSecrets'>> {
   return {
     attributes: {
       name: 'abc',
@@ -148,9 +170,9 @@ function getMockDataForEmail(
   };
 }
 
-function getMockData(
+function getCasesMockData(
   overwrites: Record<string, unknown> = {}
-): SavedObjectUnsanitizedDoc<RawAction> {
+): SavedObjectUnsanitizedDoc<Omit<RawAction, 'isMissingSecrets'>> {
   return {
     attributes: {
       name: 'abc',
@@ -163,3 +185,19 @@ function getMockData(
     type: 'action',
   };
 }
+
+function getMockData(
+  overwrites: Record<string, unknown> = {}
+): SavedObjectUnsanitizedDoc<Omit<RawAction, 'isMissingSecrets'>> {
+  return {
+    attributes: {
+      name: 'abc',
+      actionTypeId: '123',
+      config: {},
+      secrets: {},
+      ...overwrites,
+    },
+    id: uuid.v4(),
+    type: 'action',
+  };
+}
diff --git a/x-pack/plugins/actions/server/saved_objects/migrations.ts b/x-pack/plugins/actions/server/saved_objects/migrations.ts
index 9bd54330f5d05..17932b6b90f97 100644
--- a/x-pack/plugins/actions/server/saved_objects/migrations.ts
+++ b/x-pack/plugins/actions/server/saved_objects/migrations.ts
@@ -41,9 +41,15 @@ export function getMigrations(
     pipeMigrations(removeCasesFieldMappings, addHasAuthConfigurationObject)
   );
 
+  const migrationActionsFourteen = encryptedSavedObjects.createMigration<RawAction, RawAction>(
+    (doc): doc is SavedObjectUnsanitizedDoc<RawAction> => true,
+    pipeMigrations(addisMissingSecretsField)
+  );
+
   return {
     '7.10.0': executeMigrationWithErrorHandling(migrationActionsTen, '7.10.0'),
     '7.11.0': executeMigrationWithErrorHandling(migrationActionsEleven, '7.11.0'),
+    '7.14.0': executeMigrationWithErrorHandling(migrationActionsFourteen, '7.14.0'),
   };
 }
 
@@ -127,6 +133,18 @@ const addHasAuthConfigurationObject = (
   };
 };
 
+const addisMissingSecretsField = (
+  doc: SavedObjectUnsanitizedDoc<RawAction>
+): SavedObjectUnsanitizedDoc<RawAction> => {
+  return {
+    ...doc,
+    attributes: {
+      ...doc.attributes,
+      isMissingSecrets: false,
+    },
+  };
+};
+
 function pipeMigrations(...migrations: ActionMigration[]): ActionMigration {
   return (doc: SavedObjectUnsanitizedDoc<RawAction>) =>
     migrations.reduce((migratedDoc, nextMigration) => nextMigration(migratedDoc), doc);
diff --git a/x-pack/plugins/actions/server/types.ts b/x-pack/plugins/actions/server/types.ts
index d6f99a766ed34..ea22e90dfed40 100644
--- a/x-pack/plugins/actions/server/types.ts
+++ b/x-pack/plugins/actions/server/types.ts
@@ -63,6 +63,7 @@ export interface ActionResult<Config extends ActionTypeConfig = ActionTypeConfig
   id: string;
   actionTypeId: string;
   name: string;
+  isMissingSecrets?: boolean;
   config?: Config;
   isPreconfigured: boolean;
 }
@@ -118,6 +119,7 @@ export interface ActionType<
 export interface RawAction extends SavedObjectAttributes {
   actionTypeId: string;
   name: string;
+  isMissingSecrets: boolean;
   config: SavedObjectAttributes;
   secrets: SavedObjectAttributes;
 }
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts
index 518bfcef9e0d3..917246f09a99e 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts
@@ -41,6 +41,7 @@ export default function emailTest({ getService }: FtrProviderContext) {
         is_preconfigured: false,
         name: 'An email action',
         connector_type_id: '.email',
+        is_missing_secrets: false,
         config: {
           service: '__json',
           hasAuth: true,
@@ -62,6 +63,7 @@ export default function emailTest({ getService }: FtrProviderContext) {
         is_preconfigured: false,
         name: 'An email action',
         connector_type_id: '.email',
+        is_missing_secrets: false,
         config: {
           from: 'bob@example.com',
           service: '__json',
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index.ts
index 432598e66bcc4..cd60f0cef1710 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index.ts
@@ -43,6 +43,7 @@ export default function indexTest({ getService }: FtrProviderContext) {
         is_preconfigured: false,
         name: 'An index action',
         connector_type_id: '.index',
+        is_missing_secrets: false,
         config: {
           index: ES_TEST_INDEX_NAME,
           refresh: false,
@@ -59,6 +60,7 @@ export default function indexTest({ getService }: FtrProviderContext) {
       expect(fetchedAction).to.eql({
         id: fetchedAction.id,
         is_preconfigured: false,
+        is_missing_secrets: false,
         name: 'An index action',
         connector_type_id: '.index',
         config: { index: ES_TEST_INDEX_NAME, refresh: false, executionTimeField: null },
@@ -84,6 +86,7 @@ export default function indexTest({ getService }: FtrProviderContext) {
         is_preconfigured: false,
         name: 'An index action with index config',
         connector_type_id: '.index',
+        is_missing_secrets: false,
         config: {
           index: ES_TEST_INDEX_NAME,
           refresh: true,
@@ -102,6 +105,7 @@ export default function indexTest({ getService }: FtrProviderContext) {
         is_preconfigured: false,
         name: 'An index action with index config',
         connector_type_id: '.index',
+        is_missing_secrets: false,
         config: {
           index: ES_TEST_INDEX_NAME,
           refresh: true,
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts
index d2e2b4be9b94c..7d69e80dae584 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts
@@ -78,6 +78,7 @@ export default function jiraTest({ getService }: FtrProviderContext) {
           is_preconfigured: false,
           name: 'A jira action',
           connector_type_id: '.jira',
+          is_missing_secrets: false,
           config: {
             apiUrl: jiraSimulatorURL,
             projectKey: mockJira.config.projectKey,
@@ -93,6 +94,7 @@ export default function jiraTest({ getService }: FtrProviderContext) {
           is_preconfigured: false,
           name: 'A jira action',
           connector_type_id: '.jira',
+          is_missing_secrets: false,
           config: {
             apiUrl: jiraSimulatorURL,
             projectKey: mockJira.config.projectKey,
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/pagerduty.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/pagerduty.ts
index dcdd8e86ec177..26b59d93e0073 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/pagerduty.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/pagerduty.ts
@@ -64,6 +64,7 @@ export default function pagerdutyTest({ getService }: FtrProviderContext) {
         is_preconfigured: false,
         name: 'A pagerduty action',
         connector_type_id: '.pagerduty',
+        is_missing_secrets: false,
         config: {
           apiUrl: pagerdutySimulatorURL,
         },
@@ -80,6 +81,7 @@ export default function pagerdutyTest({ getService }: FtrProviderContext) {
         is_preconfigured: false,
         name: 'A pagerduty action',
         connector_type_id: '.pagerduty',
+        is_missing_secrets: false,
         config: {
           apiUrl: pagerdutySimulatorURL,
         },
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts
index 18f082c688907..00989b35fd4e2 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts
@@ -81,6 +81,7 @@ export default function resilientTest({ getService }: FtrProviderContext) {
           is_preconfigured: false,
           name: 'An IBM Resilient action',
           connector_type_id: '.resilient',
+          is_missing_secrets: false,
           config: {
             apiUrl: resilientSimulatorURL,
             orgId: mockResilient.config.orgId,
@@ -96,6 +97,7 @@ export default function resilientTest({ getService }: FtrProviderContext) {
           is_preconfigured: false,
           name: 'An IBM Resilient action',
           connector_type_id: '.resilient',
+          is_missing_secrets: false,
           config: {
             apiUrl: resilientSimulatorURL,
             orgId: mockResilient.config.orgId,
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/server_log.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/server_log.ts
index 3e8b11ee62162..6dacd19460295 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/server_log.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/server_log.ts
@@ -30,6 +30,7 @@ export default function serverLogTest({ getService }: FtrProviderContext) {
       expect(createdAction).to.eql({
         id: createdAction.id,
         is_preconfigured: false,
+        is_missing_secrets: false,
         name: 'A server.log action',
         connector_type_id: '.server-log',
         config: {},
@@ -46,6 +47,7 @@ export default function serverLogTest({ getService }: FtrProviderContext) {
         is_preconfigured: false,
         name: 'A server.log action',
         connector_type_id: '.server-log',
+        is_missing_secrets: false,
         config: {},
       });
     });
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow.ts
index 264e9cf42d97e..d6196ee6ce312 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow.ts
@@ -82,6 +82,7 @@ export default function servicenowTest({ getService }: FtrProviderContext) {
           is_preconfigured: false,
           name: 'A servicenow action',
           connector_type_id: '.servicenow',
+          is_missing_secrets: false,
           config: {
             apiUrl: servicenowSimulatorURL,
           },
@@ -96,6 +97,7 @@ export default function servicenowTest({ getService }: FtrProviderContext) {
           is_preconfigured: false,
           name: 'A servicenow action',
           connector_type_id: '.servicenow',
+          is_missing_secrets: false,
           config: {
             apiUrl: servicenowSimulatorURL,
           },
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/slack.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/slack.ts
index 85c46ff98acd1..8945c54c843b9 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/slack.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/slack.ts
@@ -59,6 +59,7 @@ export default function slackTest({ getService }: FtrProviderContext) {
       expect(createdAction).to.eql({
         id: createdAction.id,
         is_preconfigured: false,
+        is_missing_secrets: false,
         name: 'A slack action',
         connector_type_id: '.slack',
         config: {},
@@ -73,6 +74,7 @@ export default function slackTest({ getService }: FtrProviderContext) {
       expect(fetchedAction).to.eql({
         id: fetchedAction.id,
         is_preconfigured: false,
+        is_missing_secrets: false,
         name: 'A slack action',
         connector_type_id: '.slack',
         config: {},
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts
index d48fb99088d61..8d879633be2ec 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts
@@ -119,6 +119,7 @@ export default function webhookTest({ getService }: FtrProviderContext) {
         is_preconfigured: false,
         name: 'A generic Webhook action',
         connector_type_id: '.webhook',
+        is_missing_secrets: false,
         config: {
           ...defaultValues,
           url: webhookSimulatorURL,
@@ -136,6 +137,7 @@ export default function webhookTest({ getService }: FtrProviderContext) {
         is_preconfigured: false,
         name: 'A generic Webhook action',
         connector_type_id: '.webhook',
+        is_missing_secrets: false,
         config: {
           ...defaultValues,
           url: webhookSimulatorURL,
@@ -168,6 +170,7 @@ export default function webhookTest({ getService }: FtrProviderContext) {
         is_preconfigured: false,
         name: 'A generic Webhook action',
         connector_type_id: '.webhook',
+        is_missing_secrets: false,
         config: {
           ...defaultValues,
           url: webhookSimulatorURL,
@@ -204,6 +207,7 @@ export default function webhookTest({ getService }: FtrProviderContext) {
         is_preconfigured: false,
         name: 'A generic Webhook action',
         connector_type_id: '.webhook',
+        is_missing_secrets: false,
         config: {
           ...defaultValues,
           url: webhookSimulatorURL,
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/create.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/create.ts
index 5e83ce7821d74..87804395fc2b7 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/create.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/create.ts
@@ -59,6 +59,7 @@ export default function createActionTests({ getService }: FtrProviderContext) {
               expect(response.body).to.eql({
                 id: response.body.id,
                 is_preconfigured: false,
+                is_missing_secrets: false,
                 name: 'My action',
                 connector_type_id: 'test.index-record',
                 config: {
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get.ts
index 0a2b2c7520e36..5a445a4f5f112 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get.ts
@@ -64,6 +64,7 @@ export default function getActionTests({ getService }: FtrProviderContext) {
                 id: createdAction.id,
                 is_preconfigured: false,
                 connector_type_id: 'test.index-record',
+                is_missing_secrets: false,
                 name: 'My action',
                 config: {
                   unencrypted: `This value shouldn't get encrypted`,
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get_all.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get_all.ts
index 1c227bc87d93f..059ef59fc614a 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get_all.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get_all.ts
@@ -66,6 +66,7 @@ export default function getAllActionTests({ getService }: FtrProviderContext) {
                   is_preconfigured: false,
                   name: 'My action',
                   connector_type_id: 'test.index-record',
+                  is_missing_secrets: false,
                   config: {
                     unencrypted: `This value shouldn't get encrypted`,
                   },
@@ -173,6 +174,7 @@ export default function getAllActionTests({ getService }: FtrProviderContext) {
                   is_preconfigured: false,
                   name: 'My action',
                   connector_type_id: 'test.index-record',
+                  is_missing_secrets: false,
                   config: {
                     unencrypted: `This value shouldn't get encrypted`,
                   },
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/update.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/update.ts
index 15cf409970184..31cb9ac03b91b 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/update.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/update.ts
@@ -74,6 +74,7 @@ export default function updateActionTests({ getService }: FtrProviderContext) {
                 id: createdAction.id,
                 is_preconfigured: false,
                 connector_type_id: 'test.index-record',
+                is_missing_secrets: false,
                 name: 'My action updated',
                 config: {
                   unencrypted: `This value shouldn't get encrypted`,
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/es_index.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/es_index.ts
index 009de2f5baeb9..2496800b8071c 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/es_index.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/es_index.ts
@@ -41,6 +41,7 @@ export default function indexTest({ getService }: FtrProviderContext) {
         isPreconfigured: false,
         name: 'An index action',
         actionTypeId: '.index',
+        isMissingSecrets: false,
         config: {
           index: ES_TEST_INDEX_NAME,
           refresh: false,
@@ -57,6 +58,7 @@ export default function indexTest({ getService }: FtrProviderContext) {
       expect(fetchedAction).to.eql({
         id: fetchedAction.id,
         isPreconfigured: false,
+        isMissingSecrets: false,
         name: 'An index action',
         actionTypeId: '.index',
         config: { index: ES_TEST_INDEX_NAME, refresh: false, executionTimeField: null },
@@ -82,6 +84,7 @@ export default function indexTest({ getService }: FtrProviderContext) {
         isPreconfigured: false,
         name: 'An index action with index config',
         actionTypeId: '.index',
+        isMissingSecrets: false,
         config: {
           index: ES_TEST_INDEX_NAME,
           refresh: true,
@@ -100,6 +103,7 @@ export default function indexTest({ getService }: FtrProviderContext) {
         isPreconfigured: false,
         name: 'An index action with index config',
         actionTypeId: '.index',
+        isMissingSecrets: false,
         config: {
           index: ES_TEST_INDEX_NAME,
           refresh: true,
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/create.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/create.ts
index c91c05bda606e..95b465e08647f 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/create.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/create.ts
@@ -41,6 +41,7 @@ export default function createActionTests({ getService }: FtrProviderContext) {
         is_preconfigured: false,
         name: 'My action',
         connector_type_id: 'test.index-record',
+        is_missing_secrets: false,
         config: {
           unencrypted: `This value shouldn't get encrypted`,
         },
@@ -79,6 +80,7 @@ export default function createActionTests({ getService }: FtrProviderContext) {
           isPreconfigured: false,
           name: 'My action',
           actionTypeId: 'test.index-record',
+          isMissingSecrets: false,
           config: {
             unencrypted: `This value shouldn't get encrypted`,
           },
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/get.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/get.ts
index 2219e9dda17d6..e08d99a694399 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/get.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/get.ts
@@ -40,6 +40,7 @@ export default function getActionTests({ getService }: FtrProviderContext) {
         .expect(200, {
           id: createdAction.id,
           is_preconfigured: false,
+          is_missing_secrets: false,
           connector_type_id: 'test.index-record',
           name: 'My action',
           config: {
@@ -109,6 +110,7 @@ export default function getActionTests({ getService }: FtrProviderContext) {
             id: createdAction.id,
             isPreconfigured: false,
             actionTypeId: 'test.index-record',
+            isMissingSecrets: false,
             name: 'My action',
             config: {
               unencrypted: `This value shouldn't get encrypted`,
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/get_all.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/get_all.ts
index 08241f2ad8e22..28abd0b79c57c 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/get_all.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/get_all.ts
@@ -48,6 +48,7 @@ export default function getAllActionTests({ getService }: FtrProviderContext) {
           is_preconfigured: false,
           name: 'My action',
           connector_type_id: 'test.index-record',
+          is_missing_secrets: false,
           config: {
             unencrypted: `This value shouldn't get encrypted`,
           },
@@ -171,6 +172,7 @@ export default function getAllActionTests({ getService }: FtrProviderContext) {
             isPreconfigured: false,
             name: 'My action',
             actionTypeId: 'test.index-record',
+            isMissingSecrets: false,
             config: {
               unencrypted: `This value shouldn't get encrypted`,
             },
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/migrations.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/migrations.ts
index 1fac547cda86d..13426d14960f3 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/migrations.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/migrations.ts
@@ -55,5 +55,14 @@ export default function createGetTests({ getService }: FtrProviderContext) {
       expect(responseNoAuth.body.config).key('hasAuth');
       expect(responseNoAuth.body.config.hasAuth).to.eql(false);
     });
+
+    it('7.14.0 migrates connectors to have `isMissingSecrets` property', async () => {
+      const responseWithisMissingSecrets = await supertest.get(
+        `${getUrlPrefix(``)}/api/actions/action/7434121e-045a-47d6-a0a6-0b6da752397a`
+      );
+
+      expect(responseWithisMissingSecrets.status).to.eql(200);
+      expect(responseWithisMissingSecrets.body.isMissingSecrets).to.eql(false);
+    });
   });
 }
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/type_not_enabled.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/type_not_enabled.ts
index 1461ddfaa83af..6969a7fb181e2 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/type_not_enabled.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/type_not_enabled.ts
@@ -62,6 +62,7 @@ export default function typeNotEnabledTests({ getService }: FtrProviderContext)
         config: {},
         id: 'uuid-actionId',
         isPreconfigured: false,
+        isMissingSecrets: false,
         name: 'an action created before test.not-enabled was disabled',
       });
     });
@@ -89,6 +90,7 @@ export default function typeNotEnabledTests({ getService }: FtrProviderContext)
         config: {},
         id: 'uuid-actionId',
         isPreconfigured: false,
+        isMissingSecrets: false,
         name: 'an action created before test.not-enabled was disabled',
       });
     });
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/update.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/update.ts
index 4e0b4eac8da32..f779a97eafe2e 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/update.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/update.ts
@@ -52,6 +52,7 @@ export default function updateActionTests({ getService }: FtrProviderContext) {
           id: createdAction.id,
           is_preconfigured: false,
           connector_type_id: 'test.index-record',
+          is_missing_secrets: false,
           name: 'My action updated',
           config: {
             unencrypted: `This value shouldn't get encrypted`,
@@ -193,6 +194,7 @@ export default function updateActionTests({ getService }: FtrProviderContext) {
             id: createdAction.id,
             isPreconfigured: false,
             actionTypeId: 'test.index-record',
+            isMissingSecrets: false,
             name: 'My action updated',
             config: {
               unencrypted: `This value shouldn't get encrypted`,
diff --git a/x-pack/test/case_api_integration/basic/tests/configure/get_connectors.ts b/x-pack/test/case_api_integration/basic/tests/configure/get_connectors.ts
index 1789fa719ec9f..7eaa5ca609cf8 100644
--- a/x-pack/test/case_api_integration/basic/tests/configure/get_connectors.ts
+++ b/x-pack/test/case_api_integration/basic/tests/configure/get_connectors.ts
@@ -92,6 +92,7 @@ export default ({ getService }: FtrProviderContext): void => {
             projectKey: 'pkey',
           },
           isPreconfigured: false,
+          isMissingSecrets: false,
           referencedByCount: 0,
         },
         {
@@ -103,6 +104,7 @@ export default ({ getService }: FtrProviderContext): void => {
             orgId: 'pkey',
           },
           isPreconfigured: false,
+          isMissingSecrets: false,
           referencedByCount: 0,
         },
         {
@@ -113,6 +115,7 @@ export default ({ getService }: FtrProviderContext): void => {
             apiUrl: 'http://some.non.existent.com',
           },
           isPreconfigured: false,
+          isMissingSecrets: false,
           referencedByCount: 0,
         },
       ]);
diff --git a/x-pack/test/functional/es_archives/actions/mappings.json b/x-pack/test/functional/es_archives/actions/mappings.json
index 7101af08400a2..737e0df57552e 100644
--- a/x-pack/test/functional/es_archives/actions/mappings.json
+++ b/x-pack/test/functional/es_archives/actions/mappings.json
@@ -87,6 +87,9 @@
             "actionTypeId": {
               "type": "keyword"
             },
+            "isMissingSecrets": {
+              "type": "boolean"
+            },
             "config": {
               "enabled": false,
               "type": "object"

From 6c635b3b98dc6a36f12e6f915205d4d4a945b487 Mon Sep 17 00:00:00 2001
From: Frank Hassanabad <frank.hassanabad@elastic.co>
Date: Tue, 27 Apr 2021 15:34:28 -0600
Subject: [PATCH 18/28] Adds documentation about a painless script (#98509)

## Summary

Adds dev documentation about a painless script in our code and when we could remove it. See:
https://github.com/elastic/elasticsearch/issues/72276
https://github.com/elastic/kibana/pull/78912
---
 .../security_solution/factory/hosts/details/helpers.ts       | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts
index 00ed5c0c0dc01..a581370cb5720 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts
@@ -55,6 +55,11 @@ const getTermsAggregationTypeFromField = (field: string): AggregationRequest =>
       host_ip: {
         terms: {
           script: {
+            // We might be able to remove this when PR is fixed in Elasticsearch: https://github.com/elastic/elasticsearch/issues/72276
+            // Currently we cannot use "value_type" with an aggregation when we have a mapping conflict which is why this painless script exists
+            // See public ticket: https://github.com/elastic/kibana/pull/78912
+            // See private ticket: https://github.com/elastic/security-team/issues/333
+            // for more details on the use cases and causes of the conflicts and why this is here.
             source: "doc['host.ip']",
             lang: 'painless',
           },

From 9dae1ef5b1ec29389de9ac46fee827e25be8fc40 Mon Sep 17 00:00:00 2001
From: Pierre Gayvallet <pierre.gayvallet@gmail.com>
Date: Wed, 28 Apr 2021 07:58:45 +0200
Subject: [PATCH 19/28] SOM: hide actions for hidden types (#98290)

* SOM: hide actions for hidden types

* fix FTR tests

* add and fix tests

* fix unit tests

* fix test types

* fix FTR test assertions

* add more FTR tests

* delete old file
---
 .../saved_objects_management/common/index.ts  |   2 +-
 .../saved_objects_management/common/types.ts  |   1 +
 .../object_view/saved_object_view.tsx         |   2 +-
 .../saved_objects_table.test.tsx.snap         |   2 +
 .../components/delete_confirm_modal.tsx       |  36 +-
 .../saved_objects_table.test.tsx              |  48 +-
 .../objects_table/saved_objects_table.tsx     |   7 +-
 .../public/services/types/record.ts           |   1 +
 .../server/lib/find_relationships.test.ts     |   1 +
 .../server/lib/inject_meta_attributes.test.ts |   1 +
 .../server/lib/inject_meta_attributes.ts      |   1 +
 .../server/services/management.mock.ts        |   1 +
 .../server/services/management.ts             |   4 +
 .../apis/saved_objects_management/find.ts     |   5 +
 .../saved_objects_management/relationships.ts |  16 +
 .../hidden_types/data.json                    |  88 +++
 .../hidden_types/mappings.json                | 504 ++++++++++++++++++
 .../management/saved_objects_page.ts          |   8 +-
 .../server/plugin.ts                          |  23 +-
 .../saved_objects_hidden_type/index.ts        |   1 -
 .../interface/saved_objects_management.ts     |  55 --
 .../exports/_import_hidden_importable.ndjson  |   0
 .../_import_hidden_non_importable.ndjson      |   0
 .../saved_objects_management/hidden_types.ts  | 127 +++++
 .../saved_objects_management/index.ts         |   1 +
 .../copy_saved_objects_to_space_action.tsx    |   2 +-
 .../lib/summarize_copy_result.test.ts         |  37 +-
 .../share_saved_objects_to_space_action.tsx   |   3 +-
 28 files changed, 895 insertions(+), 82 deletions(-)
 create mode 100644 test/functional/fixtures/es_archiver/saved_objects_management/hidden_types/data.json
 create mode 100644 test/functional/fixtures/es_archiver/saved_objects_management/hidden_types/mappings.json
 delete mode 100644 test/plugin_functional/test_suites/saved_objects_hidden_type/interface/saved_objects_management.ts
 rename test/plugin_functional/test_suites/{saved_objects_hidden_type/interface => saved_objects_management}/exports/_import_hidden_importable.ndjson (100%)
 rename test/plugin_functional/test_suites/{saved_objects_hidden_type/interface => saved_objects_management}/exports/_import_hidden_non_importable.ndjson (100%)
 create mode 100644 test/plugin_functional/test_suites/saved_objects_management/hidden_types.ts

diff --git a/src/plugins/saved_objects_management/common/index.ts b/src/plugins/saved_objects_management/common/index.ts
index 06db1eaa25de8..efabdace329c3 100644
--- a/src/plugins/saved_objects_management/common/index.ts
+++ b/src/plugins/saved_objects_management/common/index.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-export {
+export type {
   SavedObjectWithMetadata,
   SavedObjectMetadata,
   SavedObjectRelation,
diff --git a/src/plugins/saved_objects_management/common/types.ts b/src/plugins/saved_objects_management/common/types.ts
index a6c25a6785e1a..7899cd0938ad3 100644
--- a/src/plugins/saved_objects_management/common/types.ts
+++ b/src/plugins/saved_objects_management/common/types.ts
@@ -19,6 +19,7 @@ export interface SavedObjectMetadata {
   editUrl?: string;
   inAppUrl?: { path: string; uiCapabilitiesPath: string };
   namespaceType?: SavedObjectsNamespaceType;
+  hiddenType?: boolean;
 }
 
 /**
diff --git a/src/plugins/saved_objects_management/public/management_section/object_view/saved_object_view.tsx b/src/plugins/saved_objects_management/public/management_section/object_view/saved_object_view.tsx
index cf4dcb7c6efda..2a7c56faa8507 100644
--- a/src/plugins/saved_objects_management/public/management_section/object_view/saved_object_view.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/object_view/saved_object_view.tsx
@@ -89,7 +89,7 @@ export class SavedObjectEdition extends Component<
       <EuiPageContent horizontalPosition="center" data-test-subj="savedObjectsEdit">
         <Header
           canEdit={canEdit}
-          canDelete={canDelete}
+          canDelete={canDelete && !object?.meta.hiddenType}
           canViewInApp={canView}
           type={type}
           onDeleteClick={() => this.delete()}
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/__snapshots__/saved_objects_table.test.tsx.snap b/src/plugins/saved_objects_management/public/management_section/objects_table/__snapshots__/saved_objects_table.test.tsx.snap
index fdd423e10a117..809cd7a96a0ed 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/__snapshots__/saved_objects_table.test.tsx.snap
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/__snapshots__/saved_objects_table.test.tsx.snap
@@ -9,10 +9,12 @@ exports[`SavedObjectsTable delete should show a confirm modal 1`] = `
     Array [
       Object {
         "id": "1",
+        "meta": Object {},
         "type": "index-pattern",
       },
       Object {
         "id": "3",
+        "meta": Object {},
         "type": "dashboard",
       },
     ]
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/components/delete_confirm_modal.tsx b/src/plugins/saved_objects_management/public/management_section/objects_table/components/delete_confirm_modal.tsx
index f6f00c95d9bf1..d589d5a700801 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/components/delete_confirm_modal.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/components/delete_confirm_modal.tsx
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import React, { FC } from 'react';
+import React, { FC, useMemo } from 'react';
 import {
   EuiInMemoryTable,
   EuiLoadingElastic,
@@ -23,6 +23,7 @@ import {
   EuiButtonEmpty,
   EuiButton,
   EuiSpacer,
+  EuiCallOut,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -42,6 +43,13 @@ export const DeleteConfirmModal: FC<DeleteConfirmModalProps> = ({
   onCancel,
   selectedObjects,
 }) => {
+  const undeletableObjects = useMemo(() => {
+    return selectedObjects.filter((obj) => obj.meta.hiddenType);
+  }, [selectedObjects]);
+  const deletableObjects = useMemo(() => {
+    return selectedObjects.filter((obj) => !obj.meta.hiddenType);
+  }, [selectedObjects]);
+
   if (isDeleting) {
     return (
       <EuiOverlayMask>
@@ -49,7 +57,6 @@ export const DeleteConfirmModal: FC<DeleteConfirmModalProps> = ({
       </EuiOverlayMask>
     );
   }
-
   // can't use `EuiConfirmModal` here as the confirm modal body is wrapped
   // inside a `<p>` element, causing UI glitches with the table.
   return (
@@ -63,6 +70,29 @@ export const DeleteConfirmModal: FC<DeleteConfirmModalProps> = ({
         </EuiModalHeaderTitle>
       </EuiModalHeader>
       <EuiModalBody>
+        {undeletableObjects.length > 0 && (
+          <>
+            <EuiCallOut
+              data-test-subj="cannotDeleteObjectsConfirmWarning"
+              title={
+                <FormattedMessage
+                  id="savedObjectsManagement.objectsTable.deleteConfirmModal.cannotDeleteCallout.title"
+                  defaultMessage="Some objects cannot deleted"
+                />
+              }
+              iconType="alert"
+              color="warning"
+            >
+              <p>
+                <FormattedMessage
+                  id="savedObjectsManagement.objectsTable.deleteConfirmModal.cannotDeleteCallout.content"
+                  defaultMessage="Some of the selected objects cannot be deleted, and are not listed in the table summary"
+                />
+              </p>
+            </EuiCallOut>
+            <EuiSpacer size="s" />
+          </>
+        )}
         <p>
           <FormattedMessage
             id="savedObjectsManagement.deleteSavedObjectsConfirmModalDescription"
@@ -71,7 +101,7 @@ export const DeleteConfirmModal: FC<DeleteConfirmModalProps> = ({
         </p>
         <EuiSpacer size="m" />
         <EuiInMemoryTable
-          items={selectedObjects}
+          items={deletableObjects}
           columns={[
             {
               field: 'type',
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.test.tsx b/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.test.tsx
index 3080a64578c83..364b3ab0d9eb6 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.test.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.test.tsx
@@ -479,8 +479,8 @@ describe('SavedObjectsTable', () => {
       const component = shallowRender();
 
       const mockSelectedSavedObjects = [
-        { id: '1', type: 'index-pattern' },
-        { id: '3', type: 'dashboard' },
+        { id: '1', type: 'index-pattern', meta: {} },
+        { id: '3', type: 'dashboard', meta: {} },
       ] as SavedObjectWithMetadata[];
 
       // Ensure all promises resolve
@@ -498,8 +498,8 @@ describe('SavedObjectsTable', () => {
 
     it('should delete selected objects', async () => {
       const mockSelectedSavedObjects = [
-        { id: '1', type: 'index-pattern' },
-        { id: '3', type: 'dashboard' },
+        { id: '1', type: 'index-pattern', meta: {} },
+        { id: '3', type: 'dashboard', meta: {} },
       ] as SavedObjectWithMetadata[];
 
       const mockSavedObjects = mockSelectedSavedObjects.map((obj) => ({
@@ -529,7 +529,6 @@ describe('SavedObjectsTable', () => {
       await component.instance().delete();
 
       expect(defaultProps.indexPatterns.clearCache).toHaveBeenCalled();
-      expect(mockSavedObjectsClient.bulkGet).toHaveBeenCalledWith(mockSelectedSavedObjects);
       expect(mockSavedObjectsClient.delete).toHaveBeenCalledWith(
         mockSavedObjects[0].type,
         mockSavedObjects[0].id,
@@ -542,5 +541,44 @@ describe('SavedObjectsTable', () => {
       );
       expect(component.state('selectedSavedObjects').length).toBe(0);
     });
+
+    it('should not delete hidden selected objects', async () => {
+      const mockSelectedSavedObjects = [
+        { id: '1', type: 'index-pattern', meta: {} },
+        { id: '3', type: 'hidden-type', meta: { hiddenType: true } },
+      ] as SavedObjectWithMetadata[];
+
+      const mockSavedObjects = mockSelectedSavedObjects.map((obj) => ({
+        id: obj.id,
+        type: obj.type,
+        source: {},
+      }));
+
+      const mockSavedObjectsClient = {
+        ...defaultProps.savedObjectsClient,
+        bulkGet: jest.fn().mockImplementation(() => ({
+          savedObjects: mockSavedObjects,
+        })),
+        delete: jest.fn(),
+      };
+
+      const component = shallowRender({ savedObjectsClient: mockSavedObjectsClient });
+
+      // Ensure all promises resolve
+      await new Promise((resolve) => process.nextTick(resolve));
+      // Ensure the state changes are reflected
+      component.update();
+
+      // Set some as selected
+      component.instance().onSelectionChanged(mockSelectedSavedObjects);
+
+      await component.instance().delete();
+
+      expect(defaultProps.indexPatterns.clearCache).toHaveBeenCalled();
+      expect(mockSavedObjectsClient.delete).toHaveBeenCalledTimes(1);
+      expect(mockSavedObjectsClient.delete).toHaveBeenCalledWith('index-pattern', '1', {
+        force: true,
+      });
+    });
   });
 });
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx b/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx
index 1d272e818ea1e..c207766918a70 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx
@@ -455,10 +455,9 @@ export class SavedObjectsTable extends Component<SavedObjectsTableProps, SavedOb
       await this.props.indexPatterns.clearCache();
     }
 
-    const objects = await savedObjectsClient.bulkGet(selectedSavedObjects);
-    const deletes = objects.savedObjects.map((object) =>
-      savedObjectsClient.delete(object.type, object.id, { force: true })
-    );
+    const deletes = selectedSavedObjects
+      .filter((object) => !object.meta.hiddenType)
+      .map((object) => savedObjectsClient.delete(object.type, object.id, { force: true }));
     await Promise.all(deletes);
 
     // Unset this
diff --git a/src/plugins/saved_objects_management/public/services/types/record.ts b/src/plugins/saved_objects_management/public/services/types/record.ts
index 17bdbc3a075f5..fc92c83cfc790 100644
--- a/src/plugins/saved_objects_management/public/services/types/record.ts
+++ b/src/plugins/saved_objects_management/public/services/types/record.ts
@@ -15,6 +15,7 @@ export interface SavedObjectsManagementRecord {
     icon: string;
     title: string;
     namespaceType: SavedObjectsNamespaceType;
+    hiddenType: boolean;
   };
   references: SavedObjectReference[];
   namespaces?: string[];
diff --git a/src/plugins/saved_objects_management/server/lib/find_relationships.test.ts b/src/plugins/saved_objects_management/server/lib/find_relationships.test.ts
index 686715aba7f17..0da14cbee4fd5 100644
--- a/src/plugins/saved_objects_management/server/lib/find_relationships.test.ts
+++ b/src/plugins/saved_objects_management/server/lib/find_relationships.test.ts
@@ -317,6 +317,7 @@ describe('findRelationships', () => {
           title: 'title',
           icon: 'icon',
           editUrl: 'editUrl',
+          hiddenType: false,
           inAppUrl: {
             path: 'path',
             uiCapabilitiesPath: 'uiCapabilitiesPath',
diff --git a/src/plugins/saved_objects_management/server/lib/inject_meta_attributes.test.ts b/src/plugins/saved_objects_management/server/lib/inject_meta_attributes.test.ts
index bc775a03e276d..7b5f52d6bf968 100644
--- a/src/plugins/saved_objects_management/server/lib/inject_meta_attributes.test.ts
+++ b/src/plugins/saved_objects_management/server/lib/inject_meta_attributes.test.ts
@@ -49,6 +49,7 @@ describe('injectMetaAttributes', () => {
           uiCapabilitiesPath: 'uiCapabilitiesPath',
         },
         namespaceType: 'single',
+        hiddenType: false,
       },
     });
   });
diff --git a/src/plugins/saved_objects_management/server/lib/inject_meta_attributes.ts b/src/plugins/saved_objects_management/server/lib/inject_meta_attributes.ts
index ee64010994109..d5b585371cbdf 100644
--- a/src/plugins/saved_objects_management/server/lib/inject_meta_attributes.ts
+++ b/src/plugins/saved_objects_management/server/lib/inject_meta_attributes.ts
@@ -25,6 +25,7 @@ export function injectMetaAttributes<T = unknown>(
   result.meta.editUrl = savedObjectsManagement.getEditUrl(savedObject);
   result.meta.inAppUrl = savedObjectsManagement.getInAppUrl(savedObject);
   result.meta.namespaceType = savedObjectsManagement.getNamespaceType(savedObject);
+  result.meta.hiddenType = savedObjectsManagement.isHidden(savedObject);
 
   return result;
 }
diff --git a/src/plugins/saved_objects_management/server/services/management.mock.ts b/src/plugins/saved_objects_management/server/services/management.mock.ts
index 6541c0d2847f5..2ab5bea4f8440 100644
--- a/src/plugins/saved_objects_management/server/services/management.mock.ts
+++ b/src/plugins/saved_objects_management/server/services/management.mock.ts
@@ -19,6 +19,7 @@ const createManagementMock = () => {
     getEditUrl: jest.fn(),
     getInAppUrl: jest.fn(),
     getNamespaceType: jest.fn(),
+    isHidden: jest.fn().mockReturnValue(false),
   };
   return mocked;
 };
diff --git a/src/plugins/saved_objects_management/server/services/management.ts b/src/plugins/saved_objects_management/server/services/management.ts
index 395ba639846a8..176c52c5a21bc 100644
--- a/src/plugins/saved_objects_management/server/services/management.ts
+++ b/src/plugins/saved_objects_management/server/services/management.ts
@@ -44,4 +44,8 @@ export class SavedObjectsManagement {
   public getNamespaceType(savedObject: SavedObject) {
     return this.registry.getType(savedObject.type)?.namespaceType;
   }
+
+  public isHidden(savedObject: SavedObject) {
+    return this.registry.getType(savedObject.type)?.hidden ?? false;
+  }
 }
diff --git a/test/api_integration/apis/saved_objects_management/find.ts b/test/api_integration/apis/saved_objects_management/find.ts
index 8fb3884a5b37b..9bf3045bd0138 100644
--- a/test/api_integration/apis/saved_objects_management/find.ts
+++ b/test/api_integration/apis/saved_objects_management/find.ts
@@ -240,6 +240,7 @@ export default function ({ getService }: FtrProviderContext) {
             expect(resp.body.saved_objects[0].meta).to.eql({
               icon: 'discoverApp',
               title: 'OneRecord',
+              hiddenType: false,
               editUrl:
                 '/management/kibana/objects/savedSearches/960372e0-3224-11e8-a572-ffca06da1357',
               inAppUrl: {
@@ -259,6 +260,7 @@ export default function ({ getService }: FtrProviderContext) {
             expect(resp.body.saved_objects[0].meta).to.eql({
               icon: 'dashboardApp',
               title: 'Dashboard',
+              hiddenType: false,
               editUrl:
                 '/management/kibana/objects/savedDashboards/b70c7ae0-3224-11e8-a572-ffca06da1357',
               inAppUrl: {
@@ -278,6 +280,7 @@ export default function ({ getService }: FtrProviderContext) {
             expect(resp.body.saved_objects[0].meta).to.eql({
               icon: 'visualizeApp',
               title: 'VisualizationFromSavedSearch',
+              hiddenType: false,
               editUrl:
                 '/management/kibana/objects/savedVisualizations/a42c0580-3224-11e8-a572-ffca06da1357',
               inAppUrl: {
@@ -289,6 +292,7 @@ export default function ({ getService }: FtrProviderContext) {
             expect(resp.body.saved_objects[1].meta).to.eql({
               icon: 'visualizeApp',
               title: 'Visualization',
+              hiddenType: false,
               editUrl:
                 '/management/kibana/objects/savedVisualizations/add810b0-3224-11e8-a572-ffca06da1357',
               inAppUrl: {
@@ -308,6 +312,7 @@ export default function ({ getService }: FtrProviderContext) {
             expect(resp.body.saved_objects[0].meta).to.eql({
               icon: 'indexPatternApp',
               title: 'saved_objects*',
+              hiddenType: false,
               editUrl:
                 '/management/kibana/indexPatterns/patterns/8963ca30-3224-11e8-a572-ffca06da1357',
               inAppUrl: {
diff --git a/test/api_integration/apis/saved_objects_management/relationships.ts b/test/api_integration/apis/saved_objects_management/relationships.ts
index fee525067719f..17e562d221d72 100644
--- a/test/api_integration/apis/saved_objects_management/relationships.ts
+++ b/test/api_integration/apis/saved_objects_management/relationships.ts
@@ -27,6 +27,7 @@ export default function ({ getService }: FtrProviderContext) {
         uiCapabilitiesPath: schema.string(),
       }),
       namespaceType: schema.string(),
+      hiddenType: schema.boolean(),
     }),
   });
   const invalidRelationSchema = schema.object({
@@ -89,6 +90,7 @@ export default function ({ getService }: FtrProviderContext) {
                 uiCapabilitiesPath: 'management.kibana.indexPatterns',
               },
               namespaceType: 'single',
+              hiddenType: false,
             },
           },
           {
@@ -105,6 +107,7 @@ export default function ({ getService }: FtrProviderContext) {
                 uiCapabilitiesPath: 'visualize.show',
               },
               namespaceType: 'single',
+              hiddenType: false,
             },
           },
         ]);
@@ -132,6 +135,7 @@ export default function ({ getService }: FtrProviderContext) {
                 uiCapabilitiesPath: 'management.kibana.indexPatterns',
               },
               namespaceType: 'single',
+              hiddenType: false,
             },
             relationship: 'child',
           },
@@ -148,6 +152,7 @@ export default function ({ getService }: FtrProviderContext) {
                 uiCapabilitiesPath: 'visualize.show',
               },
               namespaceType: 'single',
+              hiddenType: false,
             },
             relationship: 'parent',
           },
@@ -192,6 +197,7 @@ export default function ({ getService }: FtrProviderContext) {
                 uiCapabilitiesPath: 'visualize.show',
               },
               namespaceType: 'single',
+              hiddenType: false,
             },
           },
           {
@@ -208,6 +214,7 @@ export default function ({ getService }: FtrProviderContext) {
                 uiCapabilitiesPath: 'visualize.show',
               },
               namespaceType: 'single',
+              hiddenType: false,
             },
           },
         ]);
@@ -232,6 +239,7 @@ export default function ({ getService }: FtrProviderContext) {
                 uiCapabilitiesPath: 'visualize.show',
               },
               namespaceType: 'single',
+              hiddenType: false,
             },
             relationship: 'child',
           },
@@ -248,6 +256,7 @@ export default function ({ getService }: FtrProviderContext) {
                 uiCapabilitiesPath: 'visualize.show',
               },
               namespaceType: 'single',
+              hiddenType: false,
             },
             relationship: 'child',
           },
@@ -292,6 +301,7 @@ export default function ({ getService }: FtrProviderContext) {
                 uiCapabilitiesPath: 'discover.show',
               },
               namespaceType: 'single',
+              hiddenType: false,
             },
           },
           {
@@ -308,6 +318,7 @@ export default function ({ getService }: FtrProviderContext) {
                 uiCapabilitiesPath: 'dashboard.show',
               },
               namespaceType: 'single',
+              hiddenType: false,
             },
           },
         ]);
@@ -334,6 +345,7 @@ export default function ({ getService }: FtrProviderContext) {
                 uiCapabilitiesPath: 'discover.show',
               },
               namespaceType: 'single',
+              hiddenType: false,
             },
             relationship: 'child',
           },
@@ -378,6 +390,7 @@ export default function ({ getService }: FtrProviderContext) {
                 uiCapabilitiesPath: 'discover.show',
               },
               namespaceType: 'single',
+              hiddenType: false,
             },
           },
           {
@@ -394,6 +407,7 @@ export default function ({ getService }: FtrProviderContext) {
                 uiCapabilitiesPath: 'visualize.show',
               },
               namespaceType: 'single',
+              hiddenType: false,
             },
           },
         ]);
@@ -420,6 +434,7 @@ export default function ({ getService }: FtrProviderContext) {
                 uiCapabilitiesPath: 'discover.show',
               },
               namespaceType: 'single',
+              hiddenType: false,
             },
             relationship: 'parent',
           },
@@ -466,6 +481,7 @@ export default function ({ getService }: FtrProviderContext) {
                   uiCapabilitiesPath: 'visualize.show',
                 },
                 namespaceType: 'single',
+                hiddenType: false,
                 title: 'Visualization',
               },
               relationship: 'child',
diff --git a/test/functional/fixtures/es_archiver/saved_objects_management/hidden_types/data.json b/test/functional/fixtures/es_archiver/saved_objects_management/hidden_types/data.json
new file mode 100644
index 0000000000000..057373579c100
--- /dev/null
+++ b/test/functional/fixtures/es_archiver/saved_objects_management/hidden_types/data.json
@@ -0,0 +1,88 @@
+{
+  "type": "doc",
+  "value": {
+    "index": ".kibana",
+    "type": "doc",
+    "id": "test-actions-export-hidden:obj_1",
+    "source": {
+      "test-actions-export-hidden": {
+        "title": "hidden object 1"
+      },
+      "type": "test-actions-export-hidden",
+      "migrationVersion": {},
+      "updated_at": "2018-12-21T00:43:07.096Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": ".kibana",
+    "type": "doc",
+    "id": "test-actions-export-hidden:obj_2",
+    "source": {
+      "test-actions-export-hidden": {
+        "title": "hidden object 2"
+      },
+      "type": "test-actions-export-hidden",
+      "migrationVersion": {},
+      "updated_at": "2018-12-21T00:43:07.096Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": ".kibana",
+    "type": "doc",
+    "id": "visualization:75c3e060-1e7c-11e9-8488-65449e65d0ed",
+    "source": {
+      "visualization": {
+        "title": "A Pie",
+        "visState": "{\"title\":\"A Pie\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"geo.src\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}",
+        "uiStateJSON": "{}",
+        "description": "",
+        "version": 1,
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"index\":\"logstash-*\",\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"
+        }
+      },
+      "type": "visualization",
+      "updated_at": "2019-01-22T19:32:31.206Z"
+    },
+    "references" : [
+      {
+        "name" : "kibanaSavedObjectMeta.searchSourceJSON.index",
+        "type" : "index-pattern",
+        "id" : "logstash-*"
+      }
+    ]
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": ".kibana",
+    "type": "doc",
+    "id": "dashboard:i-exist",
+    "source": {
+      "dashboard": {
+        "title": "A Dashboard",
+        "hits": 0,
+        "description": "",
+        "panelsJSON": "[{\"gridData\":{\"w\":24,\"h\":15,\"x\":0,\"y\":0,\"i\":\"1\"},\"version\":\"7.0.0\",\"panelIndex\":\"1\",\"type\":\"visualization\",\"id\":\"75c3e060-1e7c-11e9-8488-65449e65d0ed\",\"embeddableConfig\":{}}]",
+        "optionsJSON": "{\"darkTheme\":false,\"useMargins\":true,\"hidePanelTitles\":false}",
+        "version": 1,
+        "timeRestore": false,
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"
+        }
+      },
+      "type": "dashboard",
+      "updated_at": "2019-01-22T19:32:47.232Z"
+    }
+  }
+}
diff --git a/test/functional/fixtures/es_archiver/saved_objects_management/hidden_types/mappings.json b/test/functional/fixtures/es_archiver/saved_objects_management/hidden_types/mappings.json
new file mode 100644
index 0000000000000..a862731c13f7a
--- /dev/null
+++ b/test/functional/fixtures/es_archiver/saved_objects_management/hidden_types/mappings.json
@@ -0,0 +1,504 @@
+{
+  "type": "index",
+  "value": {
+    "index": ".kibana",
+    "settings": {
+      "index": {
+        "number_of_shards": "1",
+        "auto_expand_replicas": "0-1",
+        "number_of_replicas": "0"
+      }
+    },
+    "mappings": {
+      "dynamic": true,
+      "properties": {
+        "test-actions-export-hidden": {
+          "properties": {
+            "title": { "type": "text" }
+          }
+        },
+        "test-export-transform": {
+          "properties": {
+            "title": { "type": "text" },
+            "enabled": { "type": "boolean" }
+          }
+        },
+        "test-export-add": {
+          "properties": {
+            "title": { "type": "text" }
+          }
+        },
+        "test-export-add-dep": {
+          "properties": {
+            "title": { "type": "text" }
+          }
+        },
+        "test-export-transform-error": {
+          "properties": {
+            "title": { "type": "text" }
+          }
+        },
+        "test-export-invalid-transform": {
+          "properties": {
+            "title": { "type": "text" }
+          }
+        },
+        "apm-telemetry": {
+          "properties": {
+            "has_any_services": {
+              "type": "boolean"
+            },
+            "services_per_agent": {
+              "properties": {
+                "go": {
+                  "type": "long",
+                  "null_value": 0
+                },
+                "java": {
+                  "type": "long",
+                  "null_value": 0
+                },
+                "js-base": {
+                  "type": "long",
+                  "null_value": 0
+                },
+                "nodejs": {
+                  "type": "long",
+                  "null_value": 0
+                },
+                "python": {
+                  "type": "long",
+                  "null_value": 0
+                },
+                "ruby": {
+                  "type": "long",
+                  "null_value": 0
+                }
+              }
+            }
+          }
+        },
+        "canvas-workpad": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "id": {
+              "type": "text",
+              "index": false
+            },
+            "name": {
+              "type": "text",
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "config": {
+          "dynamic": "true",
+          "properties": {
+            "accessibility:disableAnimations": {
+              "type": "boolean"
+            },
+            "buildNum": {
+              "type": "keyword"
+            },
+            "dateFormat:tz": {
+              "type": "text",
+              "fields": {
+                "keyword": {
+                  "type": "keyword",
+                  "ignore_above": 256
+                }
+              }
+            },
+            "defaultIndex": {
+              "type": "text",
+              "fields": {
+                "keyword": {
+                  "type": "keyword",
+                  "ignore_above": 256
+                }
+              }
+            },
+            "telemetry:optIn": {
+              "type": "boolean"
+            }
+          }
+        },
+        "dashboard": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "optionsJSON": {
+              "type": "text"
+            },
+            "panelsJSON": {
+              "type": "text"
+            },
+            "refreshInterval": {
+              "properties": {
+                "display": {
+                  "type": "keyword"
+                },
+                "pause": {
+                  "type": "boolean"
+                },
+                "section": {
+                  "type": "integer"
+                },
+                "value": {
+                  "type": "integer"
+                }
+              }
+            },
+            "timeFrom": {
+              "type": "keyword"
+            },
+            "timeRestore": {
+              "type": "boolean"
+            },
+            "timeTo": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "map": {
+          "properties": {
+            "bounds": {
+              "type": "geo_shape",
+              "tree": "quadtree"
+            },
+            "description": {
+              "type": "text"
+            },
+            "layerListJSON": {
+              "type": "text"
+            },
+            "mapStateJSON": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "graph-workspace": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "numLinks": {
+              "type": "integer"
+            },
+            "numVertices": {
+              "type": "integer"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "wsState": {
+              "type": "text"
+            }
+          }
+        },
+        "index-pattern": {
+          "properties": {
+            "fieldFormatMap": {
+              "type": "text"
+            },
+            "fields": {
+              "type": "text"
+            },
+            "intervalName": {
+              "type": "keyword"
+            },
+            "notExpandable": {
+              "type": "boolean"
+            },
+            "sourceFilters": {
+              "type": "text"
+            },
+            "timeFieldName": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "typeMeta": {
+              "type": "keyword"
+            }
+          }
+        },
+        "kql-telemetry": {
+          "properties": {
+            "optInCount": {
+              "type": "long"
+            },
+            "optOutCount": {
+              "type": "long"
+            }
+          }
+        },
+        "migrationVersion": {
+          "dynamic": "true",
+          "properties": {
+            "index-pattern": {
+              "type": "text",
+              "fields": {
+                "keyword": {
+                  "type": "keyword",
+                  "ignore_above": 256
+                }
+              }
+            },
+            "space": {
+              "type": "text",
+              "fields": {
+                "keyword": {
+                  "type": "keyword",
+                  "ignore_above": 256
+                }
+              }
+            }
+          }
+        },
+        "namespace": {
+          "type": "keyword"
+        },
+        "search": {
+          "properties": {
+            "columns": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "sort": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "uuid": {
+              "type": "keyword"
+            }
+          }
+        },
+        "space": {
+          "properties": {
+            "_reserved": {
+              "type": "boolean"
+            },
+            "color": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "disabledFeatures": {
+              "type": "keyword"
+            },
+            "initials": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "text",
+              "fields": {
+                "keyword": {
+                  "type": "keyword",
+                  "ignore_above": 2048
+                }
+              }
+            }
+          }
+        },
+        "spaceId": {
+          "type": "keyword"
+        },
+        "telemetry": {
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            }
+          }
+        },
+        "timelion-sheet": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "timelion_chart_height": {
+              "type": "integer"
+            },
+            "timelion_columns": {
+              "type": "integer"
+            },
+            "timelion_interval": {
+              "type": "keyword"
+            },
+            "timelion_other_interval": {
+              "type": "keyword"
+            },
+            "timelion_rows": {
+              "type": "integer"
+            },
+            "timelion_sheet": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "type": {
+          "type": "keyword"
+        },
+        "updated_at": {
+          "type": "date"
+        },
+        "url": {
+          "properties": {
+            "accessCount": {
+              "type": "long"
+            },
+            "accessDate": {
+              "type": "date"
+            },
+            "createDate": {
+              "type": "date"
+            },
+            "url": {
+              "type": "text",
+              "fields": {
+                "keyword": {
+                  "type": "keyword",
+                  "ignore_above": 2048
+                }
+              }
+            }
+          }
+        },
+        "visualization": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "savedSearchId": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "visState": {
+              "type": "text"
+            }
+          }
+        },
+        "references": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          },
+          "type": "nested"
+        }
+      }
+    }
+  }
+}
diff --git a/test/functional/page_objects/management/saved_objects_page.ts b/test/functional/page_objects/management/saved_objects_page.ts
index c28d351aa77fb..fc4de6ed7f82f 100644
--- a/test/functional/page_objects/management/saved_objects_page.ts
+++ b/test/functional/page_objects/management/saved_objects_page.ts
@@ -294,10 +294,12 @@ export function SavedObjectsPageProvider({ getService, getPageObjects }: FtrProv
       return await testSubjects.isEnabled('savedObjectsManagementDelete');
     }
 
-    async clickDelete() {
+    async clickDelete({ confirmDelete = true }: { confirmDelete?: boolean } = {}) {
       await testSubjects.click('savedObjectsManagementDelete');
-      await testSubjects.click('confirmModalConfirmButton');
-      await this.waitTableIsLoaded();
+      if (confirmDelete) {
+        await testSubjects.click('confirmModalConfirmButton');
+        await this.waitTableIsLoaded();
+      }
     }
 
     async getImportWarnings() {
diff --git a/test/plugin_functional/plugins/saved_object_export_transforms/server/plugin.ts b/test/plugin_functional/plugins/saved_object_export_transforms/server/plugin.ts
index daaf6426bdddc..408ac03dd946b 100644
--- a/test/plugin_functional/plugins/saved_object_export_transforms/server/plugin.ts
+++ b/test/plugin_functional/plugins/saved_object_export_transforms/server/plugin.ts
@@ -90,8 +90,6 @@ export class SavedObjectExportTransformsPlugin implements Plugin {
       },
     });
 
-    /////////////
-    /////////////
     // example of a SO type that will throw an object-transform-error
     savedObjects.registerType({
       name: 'test-export-transform-error',
@@ -134,8 +132,29 @@ export class SavedObjectExportTransformsPlugin implements Plugin {
         },
       },
     });
+
+    // example of a SO type that is exportable while being hidden
+    savedObjects.registerType({
+      name: 'test-actions-export-hidden',
+      hidden: true,
+      namespaceType: 'single',
+      mappings: {
+        properties: {
+          title: { type: 'text' },
+          enabled: {
+            type: 'boolean',
+          },
+        },
+      },
+      management: {
+        defaultSearchField: 'title',
+        importableAndExportable: true,
+        getTitle: (obj) => obj.attributes.title,
+      },
+    });
   }
 
   public start() {}
+
   public stop() {}
 }
diff --git a/test/plugin_functional/test_suites/saved_objects_hidden_type/index.ts b/test/plugin_functional/test_suites/saved_objects_hidden_type/index.ts
index 00ba74a988cf4..ba4835cdab089 100644
--- a/test/plugin_functional/test_suites/saved_objects_hidden_type/index.ts
+++ b/test/plugin_functional/test_suites/saved_objects_hidden_type/index.ts
@@ -15,6 +15,5 @@ export default function ({ loadTestFile }: PluginFunctionalProviderContext) {
     loadTestFile(require.resolve('./resolve_import_errors'));
     loadTestFile(require.resolve('./find'));
     loadTestFile(require.resolve('./delete'));
-    loadTestFile(require.resolve('./interface/saved_objects_management'));
   });
 }
diff --git a/test/plugin_functional/test_suites/saved_objects_hidden_type/interface/saved_objects_management.ts b/test/plugin_functional/test_suites/saved_objects_hidden_type/interface/saved_objects_management.ts
deleted file mode 100644
index dfd0b9dd07476..0000000000000
--- a/test/plugin_functional/test_suites/saved_objects_hidden_type/interface/saved_objects_management.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import path from 'path';
-import expect from '@kbn/expect';
-import { PluginFunctionalProviderContext } from '../../../services';
-
-export default function ({ getPageObjects, getService }: PluginFunctionalProviderContext) {
-  const PageObjects = getPageObjects(['common', 'settings', 'header', 'savedObjects']);
-  const esArchiver = getService('esArchiver');
-  const fixturePaths = {
-    hiddenImportable: path.join(__dirname, 'exports', '_import_hidden_importable.ndjson'),
-    hiddenNonImportable: path.join(__dirname, 'exports', '_import_hidden_non_importable.ndjson'),
-  };
-
-  describe('Saved objects management Interface', () => {
-    before(() => esArchiver.emptyKibanaIndex());
-    beforeEach(async () => {
-      await PageObjects.settings.navigateTo();
-      await PageObjects.settings.clickKibanaSavedObjects();
-    });
-    describe('importable/exportable hidden type', () => {
-      it('imports objects successfully', async () => {
-        await PageObjects.savedObjects.importFile(fixturePaths.hiddenImportable);
-        await PageObjects.savedObjects.checkImportSucceeded();
-      });
-
-      it('shows test-hidden-importable-exportable in table', async () => {
-        await PageObjects.savedObjects.searchForObject('type:(test-hidden-importable-exportable)');
-        const results = await PageObjects.savedObjects.getTableSummary();
-        expect(results.length).to.be(1);
-
-        const { title } = results[0];
-        expect(title).to.be(
-          'test-hidden-importable-exportable [id=ff3733a0-9fty-11e7-ahb3-3dcb94193fab]'
-        );
-      });
-    });
-
-    describe('non-importable/exportable hidden type', () => {
-      it('fails to import object', async () => {
-        await PageObjects.savedObjects.importFile(fixturePaths.hiddenNonImportable);
-        await PageObjects.savedObjects.checkImportSucceeded();
-
-        const errorsCount = await PageObjects.savedObjects.getImportErrorsCount();
-        expect(errorsCount).to.be(1);
-      });
-    });
-  });
-}
diff --git a/test/plugin_functional/test_suites/saved_objects_hidden_type/interface/exports/_import_hidden_importable.ndjson b/test/plugin_functional/test_suites/saved_objects_management/exports/_import_hidden_importable.ndjson
similarity index 100%
rename from test/plugin_functional/test_suites/saved_objects_hidden_type/interface/exports/_import_hidden_importable.ndjson
rename to test/plugin_functional/test_suites/saved_objects_management/exports/_import_hidden_importable.ndjson
diff --git a/test/plugin_functional/test_suites/saved_objects_hidden_type/interface/exports/_import_hidden_non_importable.ndjson b/test/plugin_functional/test_suites/saved_objects_management/exports/_import_hidden_non_importable.ndjson
similarity index 100%
rename from test/plugin_functional/test_suites/saved_objects_hidden_type/interface/exports/_import_hidden_non_importable.ndjson
rename to test/plugin_functional/test_suites/saved_objects_management/exports/_import_hidden_non_importable.ndjson
diff --git a/test/plugin_functional/test_suites/saved_objects_management/hidden_types.ts b/test/plugin_functional/test_suites/saved_objects_management/hidden_types.ts
new file mode 100644
index 0000000000000..464b7c6e7ced7
--- /dev/null
+++ b/test/plugin_functional/test_suites/saved_objects_management/hidden_types.ts
@@ -0,0 +1,127 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import path from 'path';
+import expect from '@kbn/expect';
+import { PluginFunctionalProviderContext } from '../../services';
+
+const fixturePaths = {
+  hiddenImportable: path.join(__dirname, 'exports', '_import_hidden_importable.ndjson'),
+  hiddenNonImportable: path.join(__dirname, 'exports', '_import_hidden_non_importable.ndjson'),
+};
+
+export default function ({ getService, getPageObjects }: PluginFunctionalProviderContext) {
+  const PageObjects = getPageObjects(['common', 'settings', 'header', 'savedObjects']);
+  const supertest = getService('supertest');
+  const esArchiver = getService('esArchiver');
+  const testSubjects = getService('testSubjects');
+
+  describe('saved objects management with hidden types', () => {
+    before(async () => {
+      await esArchiver.load(
+        '../functional/fixtures/es_archiver/saved_objects_management/hidden_types'
+      );
+    });
+
+    after(async () => {
+      await esArchiver.unload(
+        '../functional/fixtures/es_archiver/saved_objects_management/hidden_types'
+      );
+    });
+
+    beforeEach(async () => {
+      await PageObjects.settings.navigateTo();
+      await PageObjects.settings.clickKibanaSavedObjects();
+    });
+
+    describe('API calls', () => {
+      it('should flag the object as hidden in its meta', async () => {
+        await supertest
+          .get('/api/kibana/management/saved_objects/_find?type=test-actions-export-hidden')
+          .set('kbn-xsrf', 'true')
+          .expect(200)
+          .then((resp) => {
+            expect(
+              resp.body.saved_objects.map((obj: any) => ({
+                id: obj.id,
+                type: obj.type,
+                hidden: obj.meta.hiddenType,
+              }))
+            ).to.eql([
+              {
+                id: 'obj_1',
+                type: 'test-actions-export-hidden',
+                hidden: true,
+              },
+              {
+                id: 'obj_2',
+                type: 'test-actions-export-hidden',
+                hidden: true,
+              },
+            ]);
+          });
+      });
+    });
+
+    describe('Delete modal', () => {
+      it('should display a warning then trying to delete hidden saved objects', async () => {
+        await PageObjects.savedObjects.clickCheckboxByTitle('A Pie');
+        await PageObjects.savedObjects.clickCheckboxByTitle('A Dashboard');
+        await PageObjects.savedObjects.clickCheckboxByTitle('hidden object 1');
+
+        await PageObjects.savedObjects.clickDelete({ confirmDelete: false });
+        expect(await testSubjects.exists('cannotDeleteObjectsConfirmWarning')).to.eql(true);
+      });
+
+      it('should not delete the hidden objects when performing the operation', async () => {
+        await PageObjects.savedObjects.clickCheckboxByTitle('A Pie');
+        await PageObjects.savedObjects.clickCheckboxByTitle('hidden object 1');
+
+        await PageObjects.savedObjects.clickDelete({ confirmDelete: true });
+
+        const objectNames = (await PageObjects.savedObjects.getTableSummary()).map(
+          (obj) => obj.title
+        );
+        expect(objectNames.includes('hidden object 1')).to.eql(true);
+        expect(objectNames.includes('A Pie')).to.eql(false);
+      });
+    });
+
+    describe('importing hidden types', () => {
+      describe('importable/exportable hidden type', () => {
+        it('imports objects successfully', async () => {
+          await PageObjects.savedObjects.importFile(fixturePaths.hiddenImportable);
+          await PageObjects.savedObjects.checkImportSucceeded();
+        });
+
+        it('shows test-hidden-importable-exportable in table', async () => {
+          await PageObjects.savedObjects.searchForObject(
+            'type:(test-hidden-importable-exportable)'
+          );
+          const results = await PageObjects.savedObjects.getTableSummary();
+          expect(results.length).to.be(1);
+
+          const { title } = results[0];
+          expect(title).to.be(
+            'test-hidden-importable-exportable [id=ff3733a0-9fty-11e7-ahb3-3dcb94193fab]'
+          );
+        });
+      });
+
+      describe('non-importable/exportable hidden type', () => {
+        it('fails to import object', async () => {
+          await PageObjects.savedObjects.importFile(fixturePaths.hiddenNonImportable);
+          await PageObjects.savedObjects.checkImportSucceeded();
+
+          const errorsCount = await PageObjects.savedObjects.getImportErrorsCount();
+          expect(errorsCount).to.be(1);
+        });
+      });
+    });
+  });
+}
diff --git a/test/plugin_functional/test_suites/saved_objects_management/index.ts b/test/plugin_functional/test_suites/saved_objects_management/index.ts
index 9f2d28b582f78..edaa819e5ea58 100644
--- a/test/plugin_functional/test_suites/saved_objects_management/index.ts
+++ b/test/plugin_functional/test_suites/saved_objects_management/index.ts
@@ -15,5 +15,6 @@ export default function ({ loadTestFile }: PluginFunctionalProviderContext) {
     loadTestFile(require.resolve('./get'));
     loadTestFile(require.resolve('./export_transform'));
     loadTestFile(require.resolve('./import_warnings'));
+    loadTestFile(require.resolve('./hidden_types'));
   });
 }
diff --git a/x-pack/plugins/spaces/public/copy_saved_objects_to_space/copy_saved_objects_to_space_action.tsx b/x-pack/plugins/spaces/public/copy_saved_objects_to_space/copy_saved_objects_to_space_action.tsx
index 57ea66f35ba0c..7818e648dd1cf 100644
--- a/x-pack/plugins/spaces/public/copy_saved_objects_to_space/copy_saved_objects_to_space_action.tsx
+++ b/x-pack/plugins/spaces/public/copy_saved_objects_to_space/copy_saved_objects_to_space_action.tsx
@@ -55,7 +55,7 @@ export class CopyToSpaceSavedObjectsManagementAction extends SavedObjectsManagem
     icon: 'copy',
     type: 'icon',
     available: (object: SavedObjectsManagementRecord) => {
-      return object.meta.namespaceType !== 'agnostic';
+      return object.meta.namespaceType !== 'agnostic' && !object.meta.hiddenType;
     },
     onClick: (object: SavedObjectsManagementRecord) => {
       this.start(object);
diff --git a/x-pack/plugins/spaces/public/copy_saved_objects_to_space/lib/summarize_copy_result.test.ts b/x-pack/plugins/spaces/public/copy_saved_objects_to_space/lib/summarize_copy_result.test.ts
index 5a0ad95b6bead..6a3d82aaef59c 100644
--- a/x-pack/plugins/spaces/public/copy_saved_objects_to_space/lib/summarize_copy_result.test.ts
+++ b/x-pack/plugins/spaces/public/copy_saved_objects_to_space/lib/summarize_copy_result.test.ts
@@ -33,7 +33,12 @@ const OBJECTS = {
   MY_DASHBOARD: {
     type: 'dashboard',
     id: 'foo',
-    meta: { title: 'my-dashboard-title', icon: 'dashboardApp', namespaceType: 'single' },
+    meta: {
+      title: 'my-dashboard-title',
+      icon: 'dashboardApp',
+      namespaceType: 'single',
+      hiddenType: false,
+    },
     references: [
       { type: 'visualization', id: 'foo', name: 'Visualization foo' },
       { type: 'visualization', id: 'bar', name: 'Visualization bar' },
@@ -42,25 +47,45 @@ const OBJECTS = {
   VISUALIZATION_FOO: {
     type: 'visualization',
     id: 'bar',
-    meta: { title: 'visualization-foo-title', icon: 'visualizeApp', namespaceType: 'single' },
+    meta: {
+      title: 'visualization-foo-title',
+      icon: 'visualizeApp',
+      namespaceType: 'single',
+      hiddenType: false,
+    },
     references: [{ type: 'index-pattern', id: 'foo', name: 'Index pattern foo' }],
   } as SavedObjectsManagementRecord,
   VISUALIZATION_BAR: {
     type: 'visualization',
     id: 'baz',
-    meta: { title: 'visualization-bar-title', icon: 'visualizeApp', namespaceType: 'single' },
+    meta: {
+      title: 'visualization-bar-title',
+      icon: 'visualizeApp',
+      namespaceType: 'single',
+      hiddenType: false,
+    },
     references: [{ type: 'index-pattern', id: 'bar', name: 'Index pattern bar' }],
   } as SavedObjectsManagementRecord,
   INDEX_PATTERN_FOO: {
     type: 'index-pattern',
     id: 'foo',
-    meta: { title: 'index-pattern-foo-title', icon: 'indexPatternApp', namespaceType: 'single' },
+    meta: {
+      title: 'index-pattern-foo-title',
+      icon: 'indexPatternApp',
+      namespaceType: 'single',
+      hiddenType: false,
+    },
     references: [],
   } as SavedObjectsManagementRecord,
   INDEX_PATTERN_BAR: {
     type: 'index-pattern',
     id: 'bar',
-    meta: { title: 'index-pattern-bar-title', icon: 'indexPatternApp', namespaceType: 'single' },
+    meta: {
+      title: 'index-pattern-bar-title',
+      icon: 'indexPatternApp',
+      namespaceType: 'single',
+      hiddenType: false,
+    },
     references: [],
   } as SavedObjectsManagementRecord,
 };
@@ -70,6 +95,7 @@ interface ObjectProperties {
   id: string;
   meta: { title?: string; icon?: string };
 }
+
 const createSuccessResult = ({ type, id, meta }: ObjectProperties) => {
   return { type, id, meta };
 };
@@ -190,6 +216,7 @@ describe('summarizeCopyResult', () => {
               "obj": Object {
                 "id": "bar",
                 "meta": Object {
+                  "hiddenType": false,
                   "icon": "visualizeApp",
                   "namespaceType": "single",
                   "title": "visualization-foo-title",
diff --git a/x-pack/plugins/spaces/public/share_saved_objects_to_space/share_saved_objects_to_space_action.tsx b/x-pack/plugins/spaces/public/share_saved_objects_to_space/share_saved_objects_to_space_action.tsx
index 657ff8ac0bc70..9a0d171342a80 100644
--- a/x-pack/plugins/spaces/public/share_saved_objects_to_space/share_saved_objects_to_space_action.tsx
+++ b/x-pack/plugins/spaces/public/share_saved_objects_to_space/share_saved_objects_to_space_action.tsx
@@ -40,7 +40,8 @@ export class ShareToSpaceSavedObjectsManagementAction extends SavedObjectsManage
       const hasCapability =
         !this.actionContext ||
         !!this.actionContext.capabilities.savedObjectsManagement.shareIntoSpace;
-      return object.meta.namespaceType === 'multiple' && hasCapability;
+      const { namespaceType, hiddenType } = object.meta;
+      return namespaceType === 'multiple' && !hiddenType && hasCapability;
     },
     onClick: (object: SavedObjectsManagementRecord) => {
       this.isDataChanged = false;

From c24c0d38f8ba40c61a29bb87f6c40da432869ae8 Mon Sep 17 00:00:00 2001
From: Yara Tercero <yctercero@users.noreply.github.com>
Date: Tue, 27 Apr 2021 23:06:53 -0700
Subject: [PATCH 20/28] [Security Solution][Tech Debt] - Fix flakey notes tab
 cypress test (#98439)

Fix flakey cypress test related to notes_tab before/after hooks.
---
 .../cypress/integration/timelines/notes_tab.spec.ts         | 2 +-
 .../plugins/security_solution/cypress/screens/timeline.ts   | 2 +-
 x-pack/plugins/security_solution/cypress/tasks/timeline.ts  | 6 ++++--
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/x-pack/plugins/security_solution/cypress/integration/timelines/notes_tab.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timelines/notes_tab.spec.ts
index 6653290fc2ebb..ebf40677112e8 100644
--- a/x-pack/plugins/security_solution/cypress/integration/timelines/notes_tab.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/timelines/notes_tab.spec.ts
@@ -41,8 +41,8 @@ describe('Timeline notes tab', () => {
           .click({ force: true })
           .then(() => {
             waitForEventsPanelToBeLoaded();
-            goToNotesTab();
             addNotesToTimeline(timeline.notes);
+            goToNotesTab();
           });
       });
   });
diff --git a/x-pack/plugins/security_solution/cypress/screens/timeline.ts b/x-pack/plugins/security_solution/cypress/screens/timeline.ts
index 4c80f266e687c..0352320e25194 100644
--- a/x-pack/plugins/security_solution/cypress/screens/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/timeline.ts
@@ -63,7 +63,7 @@ export const NOTE_CONTENT = (noteId: string) => `${NOTE_BY_NOTE_ID(noteId)} p`;
 
 export const NOTES_TEXT_AREA = '[data-test-subj="add-a-note"] textarea';
 
-export const NOTES_TAB_BUTTON = '[data-test-subj="timelineTabs-notes"]';
+export const NOTES_TAB_BUTTON = 'button[data-test-subj="timelineTabs-notes"]';
 
 export const NOTES_TEXT = '.euiMarkdownFormat';
 
diff --git a/x-pack/plugins/security_solution/cypress/tasks/timeline.ts b/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
index 2078744393d94..89ced4b64cc2c 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
@@ -90,7 +90,9 @@ export const addNameAndDescriptionToTimeline = (timeline: Timeline) => {
 };
 
 export const goToNotesTab = () => {
-  return cy.get(NOTES_TAB_BUTTON).click({ force: true });
+  cy.get(NOTES_TAB_BUTTON)
+    .pipe(($el) => $el.trigger('click'))
+    .should('be.visible');
 };
 
 export const getNotePreviewByNoteId = (noteId: string) => {
@@ -205,7 +207,7 @@ export const openTimelineTemplateFromSettings = (id: string) => {
 };
 
 export const openTimelineById = (timelineId: string) => {
-  return cy.get(TIMELINE_TITLE_BY_ID(timelineId)).click({ force: true });
+  return cy.get(TIMELINE_TITLE_BY_ID(timelineId)).pipe(($el) => $el.trigger('click'));
 };
 
 export const pinFirstEvent = () => {

From bfb363f050200fa29c78f0999adc3d40d77927f2 Mon Sep 17 00:00:00 2001
From: Walter Rafelsberger <walter@elastic.co>
Date: Wed, 28 Apr 2021 08:23:07 +0200
Subject: [PATCH 21/28] [ML] Transforms/Data Frame Analytics: Fix freezing
 wizard for indices with massive amounts of fields. (#98259)

The transform wizard can become very slow when used with indices with e.g. 1000+ fields.

This PR fixes it by prefetching 500 random documents to create a list of populated/used fields and passes those on to the data grid component instead of all available fields from the list derived via Kibana index patterns.

For example, for an out of the box metricbeat index, this reduces the list of passed on fields from 3000+ to ~120 fields. Previously, the page would freeze on load for tens of seconds and would freeze again on every rerender. With the applied update, the page loads almost instantly again and remains responsive.

Note this fix of reducing available fields is only applied to the data grid preview component. All fields are still available to create the configuration in the UI for groups and aggregations. These UI components, e.g. the virtualized dropdowns, can handle large lists of fields.
---
 .../hooks/use_index_data.ts                   | 83 +++++++++++++++----
 .../public/app/hooks/use_index_data.ts        | 61 +++++++++++++-
 .../public/app/hooks/use_pivot_data.ts        | 35 ++++++--
 .../apps/transform/creation_index_pattern.ts  | 28 ++++---
 .../transform/creation_runtime_mappings.ts    | 28 ++++++-
 .../functional/services/transform/wizard.ts   |  9 ++
 6 files changed, 206 insertions(+), 38 deletions(-)

diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts
index 2ae75083bff43..87dd6709e82f4 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts
@@ -50,19 +50,21 @@ function getRuntimeFieldColumns(runtimeMappings: RuntimeMappings) {
   });
 }
 
-function getInitialColumns(indexPattern: IndexPattern) {
+function getInitialColumns(indexPattern: IndexPattern, fieldsFilter: string[]) {
   const { fields } = newJobCapsServiceAnalytics;
-  const columns = fields.map((field: any) => {
-    const schema =
-      getDataGridSchemaFromESFieldType(field.type) || getDataGridSchemaFromKibanaFieldType(field);
-
-    return {
-      id: field.name,
-      schema,
-      isExpandable: schema !== 'boolean',
-      isRuntimeFieldColumn: false,
-    };
-  });
+  const columns = fields
+    .filter((field) => fieldsFilter.includes(field.name))
+    .map((field) => {
+      const schema =
+        getDataGridSchemaFromESFieldType(field.type) || getDataGridSchemaFromKibanaFieldType(field);
+
+      return {
+        id: field.name,
+        schema,
+        isExpandable: schema !== 'boolean',
+        isRuntimeFieldColumn: false,
+      };
+    });
 
   // Add runtime fields defined in index pattern to columns
   if (indexPattern) {
@@ -91,10 +93,57 @@ export const useIndexData = (
   toastNotifications: CoreSetup['notifications']['toasts'],
   runtimeMappings?: RuntimeMappings
 ): UseIndexDataReturnType => {
-  const indexPatternFields = useMemo(() => getFieldsFromKibanaIndexPattern(indexPattern), [
-    indexPattern,
-  ]);
-  const [columns, setColumns] = useState<MLEuiDataGridColumn[]>(getInitialColumns(indexPattern));
+  const [indexPatternFields, setIndexPatternFields] = useState<string[]>();
+
+  // Fetch 500 random documents to determine populated fields.
+  // This is a workaround to avoid passing potentially thousands of unpopulated fields
+  // (for example, as part of filebeat/metricbeat/ECS based indices)
+  // to the data grid component which would significantly slow down the page.
+  const fetchDataGridSampleDocuments = async function () {
+    setErrorMessage('');
+    setStatus(INDEX_STATUS.LOADING);
+
+    const esSearchRequest = {
+      index: indexPattern.title,
+      body: {
+        fields: ['*'],
+        _source: false,
+        query: {
+          function_score: {
+            query: { match_all: {} },
+            random_score: {},
+          },
+        },
+        size: 500,
+      },
+    };
+
+    try {
+      const resp: IndexSearchResponse = await ml.esSearch(esSearchRequest);
+      const docs = resp.hits.hits.map((d) => getProcessedFields(d.fields ?? {}));
+
+      // Get all field names for each returned doc and flatten it
+      // to a list of unique field names used across all docs.
+      const allKibanaIndexPatternFields = getFieldsFromKibanaIndexPattern(indexPattern);
+      const populatedFields = [...new Set(docs.map(Object.keys).flat(1))].filter((d) =>
+        allKibanaIndexPatternFields.includes(d)
+      );
+
+      setStatus(INDEX_STATUS.LOADED);
+      setIndexPatternFields(populatedFields);
+    } catch (e) {
+      setErrorMessage(extractErrorMessage(e));
+      setStatus(INDEX_STATUS.ERROR);
+    }
+  };
+
+  useEffect(() => {
+    fetchDataGridSampleDocuments();
+  }, []);
+
+  const [columns, setColumns] = useState<MLEuiDataGridColumn[]>(
+    getInitialColumns(indexPattern, indexPatternFields ?? [])
+  );
   const dataGrid = useDataGrid(columns);
 
   const {
@@ -151,7 +200,7 @@ export const useIndexData = (
           ...(combinedRuntimeMappings ? getRuntimeFieldColumns(combinedRuntimeMappings) : []),
         ]);
       } else {
-        setColumns(getInitialColumns(indexPattern));
+        setColumns(getInitialColumns(indexPattern, indexPatternFields ?? []));
       }
       setRowCount(typeof resp.hits.total === 'number' ? resp.hits.total : resp.hits.total.value);
       setRowCountRelation(
diff --git a/x-pack/plugins/transform/public/app/hooks/use_index_data.ts b/x-pack/plugins/transform/public/app/hooks/use_index_data.ts
index f97693b8c038a..fe56537450c2b 100644
--- a/x-pack/plugins/transform/public/app/hooks/use_index_data.ts
+++ b/x-pack/plugins/transform/public/app/hooks/use_index_data.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { useEffect, useMemo } from 'react';
+import { useEffect, useMemo, useState } from 'react';
 
 import type { estypes } from '@elastic/elasticsearch';
 import type { EuiDataGridColumn } from '@elastic/eui';
@@ -46,9 +46,66 @@ export const useIndexData = (
     },
   } = useAppDependencies();
 
-  const indexPatternFields = getFieldsFromKibanaIndexPattern(indexPattern);
+  const [indexPatternFields, setIndexPatternFields] = useState<string[]>();
+
+  // Fetch 500 random documents to determine populated fields.
+  // This is a workaround to avoid passing potentially thousands of unpopulated fields
+  // (for example, as part of filebeat/metricbeat/ECS based indices)
+  // to the data grid component which would significantly slow down the page.
+  const fetchDataGridSampleDocuments = async function () {
+    setErrorMessage('');
+    setStatus(INDEX_STATUS.LOADING);
+
+    const esSearchRequest = {
+      index: indexPattern.title,
+      body: {
+        fields: ['*'],
+        _source: false,
+        query: {
+          function_score: {
+            query: { match_all: {} },
+            random_score: {},
+          },
+        },
+        size: 500,
+      },
+    };
+
+    const resp = await api.esSearch(esSearchRequest);
+
+    if (!isEsSearchResponse(resp)) {
+      setErrorMessage(getErrorMessage(resp));
+      setStatus(INDEX_STATUS.ERROR);
+      return;
+    }
+
+    const isCrossClusterSearch = indexPattern.title.includes(':');
+    const isMissingFields = resp.hits.hits.every((d) => typeof d.fields === 'undefined');
+
+    const docs = resp.hits.hits.map((d) => getProcessedFields(d.fields ?? {}));
+
+    // Get all field names for each returned doc and flatten it
+    // to a list of unique field names used across all docs.
+    const allKibanaIndexPatternFields = getFieldsFromKibanaIndexPattern(indexPattern);
+    const populatedFields = [...new Set(docs.map(Object.keys).flat(1))].filter((d) =>
+      allKibanaIndexPatternFields.includes(d)
+    );
+
+    setCcsWarning(isCrossClusterSearch && isMissingFields);
+    setStatus(INDEX_STATUS.LOADED);
+    setIndexPatternFields(populatedFields);
+  };
+
+  useEffect(() => {
+    fetchDataGridSampleDocuments();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
 
   const columns: EuiDataGridColumn[] = useMemo(() => {
+    if (typeof indexPatternFields === 'undefined') {
+      return [];
+    }
+
     let result: Array<{ id: string; schema: string | undefined }> = [];
 
     // Get the the runtime fields that are defined from API field and index patterns
diff --git a/x-pack/plugins/transform/public/app/hooks/use_pivot_data.ts b/x-pack/plugins/transform/public/app/hooks/use_pivot_data.ts
index 24c28effd12bc..9a49ed9480359 100644
--- a/x-pack/plugins/transform/public/app/hooks/use_pivot_data.ts
+++ b/x-pack/plugins/transform/public/app/hooks/use_pivot_data.ts
@@ -11,12 +11,12 @@ import { useEffect, useMemo, useState } from 'react';
 import { EuiDataGridColumn } from '@elastic/eui';
 
 import { i18n } from '@kbn/i18n';
+import { getFlattenedObject } from '@kbn/std';
 
 import { ES_FIELD_TYPES } from '../../../../../../src/plugins/data/common';
 
 import type { PreviewMappingsProperties } from '../../../common/api_schemas/transforms';
 import { isPostTransformsPreviewResponseSchema } from '../../../common/api_schemas/type_guards';
-import { getNestedProperty } from '../../../common/utils/object_utils';
 
 import {
   RenderCellValue,
@@ -159,13 +159,36 @@ export const usePivotData = (
       return;
     }
 
-    setTableItems(resp.preview);
-    setRowCount(resp.preview.length);
+    // To improve UI performance with a latest configuration for indices with a large number
+    // of fields, we reduce the number of available columns to those populated with values.
+
+    // 1. Flatten the returned object structure object documents to match mapping properties
+    const docs = resp.preview.map(getFlattenedObject);
+
+    // 2. Get all field names for each returned doc and flatten it
+    //    to a list of unique field names used across all docs.
+    const populatedFields = [...new Set(docs.map(Object.keys).flat(1))];
+
+    // 3. Filter mapping properties by populated fields
+    const populatedProperties: PreviewMappingsProperties = Object.entries(
+      resp.generated_dest_index.mappings.properties
+    )
+      .filter(([key]) => populatedFields.includes(key))
+      .reduce(
+        (p, [key, value]) => ({
+          ...p,
+          [key]: value,
+        }),
+        {}
+      );
+
+    setTableItems(docs);
+    setRowCount(docs.length);
     setRowCountRelation(ES_CLIENT_TOTAL_HITS_RELATION.EQ);
-    setPreviewMappingsProperties(resp.generated_dest_index.mappings.properties);
+    setPreviewMappingsProperties(populatedProperties);
     setStatus(INDEX_STATUS.LOADED);
 
-    if (resp.preview.length === 0) {
+    if (docs.length === 0) {
       setNoDataMessage(
         i18n.translate('xpack.transform.pivotPreview.PivotPreviewNoDataCalloutBody', {
           defaultMessage:
@@ -201,7 +224,7 @@ export const usePivotData = (
       const adjustedRowIndex = rowIndex - pagination.pageIndex * pagination.pageSize;
 
       const cellValue = pageData.hasOwnProperty(adjustedRowIndex)
-        ? getNestedProperty(pageData[adjustedRowIndex], columnId, null)
+        ? pageData[adjustedRowIndex][columnId] ?? null
         : null;
 
       if (typeof cellValue === 'object' && cellValue !== null) {
diff --git a/x-pack/test/functional/apps/transform/creation_index_pattern.ts b/x-pack/test/functional/apps/transform/creation_index_pattern.ts
index 61579ac68ae53..2c26a340a2a26 100644
--- a/x-pack/test/functional/apps/transform/creation_index_pattern.ts
+++ b/x-pack/test/functional/apps/transform/creation_index_pattern.ts
@@ -166,11 +166,6 @@ export default function ({ getService }: FtrProviderContext) {
                 { color: '#54B399', percentage: 90 },
               ],
             },
-            {
-              chartAvailable: false,
-              id: 'customer_birth_date',
-              legend: '0 documents contain field.',
-            },
             { chartAvailable: false, id: 'customer_first_name', legend: 'Chart not supported.' },
             { chartAvailable: false, id: 'customer_full_name', legend: 'Chart not supported.' },
             {
@@ -210,6 +205,15 @@ export default function ({ getService }: FtrProviderContext) {
                 { color: '#54B399', percentage: 75 },
               ],
             },
+            {
+              chartAvailable: true,
+              id: 'day_of_week_i',
+              legend: '0 - 6',
+              colorStats: [
+                { color: '#000000', percentage: 20 },
+                { color: '#54B399', percentage: 75 },
+              ],
+            },
           ],
           discoverQueryHits: '7,270',
         },
@@ -296,7 +300,6 @@ export default function ({ getService }: FtrProviderContext) {
             columns: 10,
             rows: 5,
           },
-          histogramCharts: [],
           discoverQueryHits: '10',
         },
       } as PivotTransformTestData,
@@ -336,7 +339,6 @@ export default function ({ getService }: FtrProviderContext) {
             columns: 10,
             rows: 5,
           },
-          histogramCharts: [],
           transformPreview: {
             column: 0,
             values: [
@@ -404,10 +406,14 @@ export default function ({ getService }: FtrProviderContext) {
           await transform.testExecution.logTestStep('enables the index preview histogram charts');
           await transform.wizard.enableIndexPreviewHistogramCharts(true);
 
-          await transform.testExecution.logTestStep('displays the index preview histogram charts');
-          await transform.wizard.assertIndexPreviewHistogramCharts(
-            testData.expected.histogramCharts
-          );
+          if (Array.isArray(testData.expected.histogramCharts)) {
+            await transform.testExecution.logTestStep(
+              'displays the index preview histogram charts'
+            );
+            await transform.wizard.assertIndexPreviewHistogramCharts(
+              testData.expected.histogramCharts
+            );
+          }
 
           if (isPivotTransformTestData(testData)) {
             await transform.testExecution.logTestStep('adds the group by entries');
diff --git a/x-pack/test/functional/apps/transform/creation_runtime_mappings.ts b/x-pack/test/functional/apps/transform/creation_runtime_mappings.ts
index 1ecbdd41c219d..030748026af91 100644
--- a/x-pack/test/functional/apps/transform/creation_runtime_mappings.ts
+++ b/x-pack/test/functional/apps/transform/creation_runtime_mappings.ts
@@ -46,14 +46,37 @@ export default function ({ getService }: FtrProviderContext) {
       await transform.api.cleanTransformIndices();
     });
 
-    // Only testing that histogram charts are available for runtime fields here
     const histogramCharts: HistogramCharts = [
+      {
+        // Skipping colorStats assertion for this chart,
+        // results can be quite different on each run because of sampling.
+        chartAvailable: true,
+        id: '@timestamp',
+      },
+      { chartAvailable: false, id: '@version', legend: 'Chart not supported.' },
+      {
+        chartAvailable: true,
+        id: 'airline',
+        legend: '19 categories',
+        colorStats: [
+          { color: '#000000', percentage: 49 },
+          { color: '#54B399', percentage: 41 },
+        ],
+      },
+      {
+        chartAvailable: true,
+        id: 'responsetime',
+        colorStats: [
+          { color: '#54B399', percentage: 5 },
+          { color: '#000000', percentage: 95 },
+        ],
+      },
       {
         chartAvailable: true,
         id: 'rt_airline_lower',
         legend: '19 categories',
         colorStats: [
-          { color: '#000000', percentage: 48 },
+          { color: '#000000', percentage: 49 },
           { color: '#54B399', percentage: 41 },
         ],
       },
@@ -65,6 +88,7 @@ export default function ({ getService }: FtrProviderContext) {
           { color: '#000000', percentage: 95 },
         ],
       },
+      { chartAvailable: false, id: 'type', legend: 'Chart not supported.' },
     ];
 
     const testDataList: Array<PivotTransformTestData | LatestTransformTestData> = [
diff --git a/x-pack/test/functional/services/transform/wizard.ts b/x-pack/test/functional/services/transform/wizard.ts
index f82af4f3a6d37..cef6c2724033e 100644
--- a/x-pack/test/functional/services/transform/wizard.ts
+++ b/x-pack/test/functional/services/transform/wizard.ts
@@ -237,6 +237,15 @@ export function TransformWizardProvider({ getService, getPageObjects }: FtrProvi
       // For each chart, get the content of each header cell and assert
       // the legend text and column id and if the chart should be present or not.
       await retry.tryForTime(5000, async () => {
+        const table = await testSubjects.find(`~transformIndexPreview`);
+        const $ = await table.parseDomContent();
+        const actualColumnLength = $('.euiDataGridHeaderCell__content').toArray().length;
+
+        expect(actualColumnLength).to.eql(
+          expectedHistogramCharts.length,
+          `Number of index preview column charts should be '${expectedHistogramCharts.length}' (got '${actualColumnLength}')`
+        );
+
         for (const expected of expectedHistogramCharts.values()) {
           const id = expected.id;
           await testSubjects.existOrFail(`mlDataGridChart-${id}`);

From c408e3ae09e2959a05f3ee5d6a9e9c08d7d34365 Mon Sep 17 00:00:00 2001
From: Pierre Gayvallet <pierre.gayvallet@gmail.com>
Date: Wed, 28 Apr 2021 09:56:24 +0200
Subject: [PATCH 22/28] SO MigV2: fix logStateTransition (#98445)

* SO MigV2: fix logStateTransition

* extract func

* use info directly

* improve tests & impl
---
 .../migrations_state_action_machine.test.ts   | 36 +++++++++++++++++--
 .../migrations_state_action_machine.ts        | 17 ++++-----
 .../saved_objects/migrationsv2/types.ts       |  9 ++++-
 3 files changed, 51 insertions(+), 11 deletions(-)

diff --git a/src/core/server/saved_objects/migrationsv2/migrations_state_action_machine.test.ts b/src/core/server/saved_objects/migrationsv2/migrations_state_action_machine.test.ts
index 161d4a7219c8d..bffe590a39432 100644
--- a/src/core/server/saved_objects/migrationsv2/migrations_state_action_machine.test.ts
+++ b/src/core/server/saved_objects/migrationsv2/migrations_state_action_machine.test.ts
@@ -10,10 +10,11 @@ import { migrationStateActionMachine } from './migrations_state_action_machine';
 import { loggingSystemMock, elasticsearchServiceMock } from '../../mocks';
 import * as Either from 'fp-ts/lib/Either';
 import * as Option from 'fp-ts/lib/Option';
-import { AllControlStates, State } from './types';
-import { createInitialState } from './model';
 import { ResponseError } from '@elastic/elasticsearch/lib/errors';
 import { elasticsearchClientMock } from '../../elasticsearch/client/mocks';
+import { LoggerAdapter } from '../../logging/logger_adapter';
+import { AllControlStates, State } from './types';
+import { createInitialState } from './model';
 
 const esClient = elasticsearchServiceMock.createElasticsearchClient();
 describe('migrationsStateActionMachine', () => {
@@ -146,6 +147,37 @@ describe('migrationsStateActionMachine', () => {
       }
     `);
   });
+
+  // see https://github.com/elastic/kibana/issues/98406
+  it('correctly logs state transition when using a logger adapter', async () => {
+    const underlyingLogger = mockLogger.get();
+    const logger = new LoggerAdapter(underlyingLogger);
+
+    await expect(
+      migrationStateActionMachine({
+        initialState,
+        logger,
+        model: transitionModel(['LEGACY_REINDEX', 'LEGACY_DELETE', 'LEGACY_DELETE', 'DONE']),
+        next,
+        client: esClient,
+      })
+    ).resolves.toEqual(expect.anything());
+
+    const allLogs = loggingSystemMock.collect(mockLogger);
+    const stateTransitionLogs = allLogs.info
+      .map((call) => call[0])
+      .filter((log) => log.match('control state'));
+
+    expect(stateTransitionLogs).toMatchInlineSnapshot(`
+      Array [
+        "[.my-so-index] Log from LEGACY_REINDEX control state",
+        "[.my-so-index] Log from LEGACY_DELETE control state",
+        "[.my-so-index] Log from LEGACY_DELETE control state",
+        "[.my-so-index] Log from DONE control state",
+      ]
+    `);
+  });
+
   it('resolves when reaching the DONE state', async () => {
     await expect(
       migrationStateActionMachine({
diff --git a/src/core/server/saved_objects/migrationsv2/migrations_state_action_machine.ts b/src/core/server/saved_objects/migrationsv2/migrations_state_action_machine.ts
index dede52f9758e9..85cc86fe0a468 100644
--- a/src/core/server/saved_objects/migrationsv2/migrations_state_action_machine.ts
+++ b/src/core/server/saved_objects/migrationsv2/migrations_state_action_machine.ts
@@ -49,14 +49,15 @@ const logStateTransition = (
   tookMs: number
 ) => {
   if (newState.logs.length > oldState.logs.length) {
-    newState.logs.slice(oldState.logs.length).forEach((log) => {
-      const getLogger = (level: keyof Logger) => {
-        if (level === 'error') {
-          return logger[level] as Logger['error'];
-        }
-        return logger[level] as Logger['info'];
-      };
-      getLogger(log.level)(logMessagePrefix + log.message);
+    newState.logs.slice(oldState.logs.length).forEach(({ message, level }) => {
+      switch (level) {
+        case 'error':
+          return logger.error(logMessagePrefix + message);
+        case 'info':
+          return logger.info(logMessagePrefix + message);
+        default:
+          throw new Error(`unexpected log level ${level}`);
+      }
     });
   }
 
diff --git a/src/core/server/saved_objects/migrationsv2/types.ts b/src/core/server/saved_objects/migrationsv2/types.ts
index b84d483cf6203..50664bc9398fb 100644
--- a/src/core/server/saved_objects/migrationsv2/types.ts
+++ b/src/core/server/saved_objects/migrationsv2/types.ts
@@ -13,6 +13,13 @@ import { AliasAction } from './actions';
 import { IndexMapping } from '../mappings';
 import { SavedObjectsRawDoc } from '..';
 
+export type MigrationLogLevel = 'error' | 'info';
+
+export interface MigrationLog {
+  level: MigrationLogLevel;
+  message: string;
+}
+
 export interface BaseState extends ControlState {
   /** The first part of the index name such as `.kibana` or `.kibana_task_manager` */
   readonly indexPrefix: string;
@@ -70,7 +77,7 @@ export interface BaseState extends ControlState {
    * In this case, you should set a smaller batchSize value and restart the migration process again.
    */
   readonly batchSize: number;
-  readonly logs: Array<{ level: 'error' | 'info'; message: string }>;
+  readonly logs: MigrationLog[];
   /**
    * The current alias e.g. `.kibana` which always points to the latest
    * version index

From 10a93366e0ab00e6f5bdc3057830cfa97462294c Mon Sep 17 00:00:00 2001
From: Pierre Gayvallet <pierre.gayvallet@gmail.com>
Date: Wed, 28 Apr 2021 10:03:02 +0200
Subject: [PATCH 23/28] change config reload message (#98455)

* change config reload message

* change function name
---
 src/core/server/bootstrap.ts | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/core/server/bootstrap.ts b/src/core/server/bootstrap.ts
index a2267635e86f2..18a5eceb1b2d3 100644
--- a/src/core/server/bootstrap.ts
+++ b/src/core/server/bootstrap.ts
@@ -46,22 +46,22 @@ export async function bootstrap({ configs, cliArgs, applyConfigOverrides }: Boot
 
   const root = new Root(rawConfigService, env, onRootShutdown);
 
-  process.on('SIGHUP', () => reloadLoggingConfig());
+  process.on('SIGHUP', () => reloadConfiguration());
 
   // This is only used by the LogRotator service
   // in order to be able to reload the log configuration
   // under the cluster mode
   process.on('message', (msg) => {
-    if (!msg || msg.reloadLoggingConfig !== true) {
+    if (!msg || msg.reloadConfiguration !== true) {
       return;
     }
 
-    reloadLoggingConfig();
+    reloadConfiguration();
   });
 
-  function reloadLoggingConfig() {
+  function reloadConfiguration() {
     const cliLogger = root.logger.get('cli');
-    cliLogger.info('Reloading logging configuration due to SIGHUP.', { tags: ['config'] });
+    cliLogger.info('Reloading Kibana configuration due to SIGHUP.', { tags: ['config'] });
 
     try {
       rawConfigService.reloadConfig();
@@ -69,7 +69,7 @@ export async function bootstrap({ configs, cliArgs, applyConfigOverrides }: Boot
       return shutdown(err);
     }
 
-    cliLogger.info('Reloaded logging configuration due to SIGHUP.', { tags: ['config'] });
+    cliLogger.info('Reloaded Kibana configuration due to SIGHUP.', { tags: ['config'] });
   }
 
   process.on('SIGINT', () => shutdown());

From 0cf12567840665ef555818ddf556766788440323 Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Wed, 28 Apr 2021 10:12:29 +0200
Subject: [PATCH 24/28] always load test fixtures (#98464)

---
 x-pack/test/functional/apps/lens/index.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/x-pack/test/functional/apps/lens/index.ts b/x-pack/test/functional/apps/lens/index.ts
index 38ba1f698ecce..bfb0aad7177f4 100644
--- a/x-pack/test/functional/apps/lens/index.ts
+++ b/x-pack/test/functional/apps/lens/index.ts
@@ -16,8 +16,8 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
     before(async () => {
       log.debug('Starting lens before method');
       await browser.setWindowSize(1280, 800);
-      await esArchiver.loadIfNeeded('logstash_functional');
-      await esArchiver.loadIfNeeded('lens/basic');
+      await esArchiver.load('logstash_functional');
+      await esArchiver.load('lens/basic');
     });
 
     after(async () => {

From 3cc6989e5fffc8c458b09ed30fec95b5781d96fe Mon Sep 17 00:00:00 2001
From: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
Date: Wed, 28 Apr 2021 13:59:19 +0300
Subject: [PATCH 25/28] [Visualize] Fixes V8 theme issues (#97090)

* [Visualize] Fixes K8 theme issues

* Fix ci

* Make it work for v7 too

* Fix

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../vis_default_editor/public/components/agg_add.tsx       | 4 ++--
 .../wizard/agg_based_selection/agg_based_selection.scss    | 3 +++
 .../wizard/agg_based_selection/agg_based_selection.tsx     | 2 ++
 .../public/application/components/visualize_listing.scss   | 7 ++++++-
 4 files changed, 13 insertions(+), 3 deletions(-)
 create mode 100644 src/plugins/visualizations/public/wizard/agg_based_selection/agg_based_selection.scss

diff --git a/src/plugins/vis_default_editor/public/components/agg_add.tsx b/src/plugins/vis_default_editor/public/components/agg_add.tsx
index 37ef08ec640f0..bbe235082e13e 100644
--- a/src/plugins/vis_default_editor/public/components/agg_add.tsx
+++ b/src/plugins/vis_default_editor/public/components/agg_add.tsx
@@ -52,7 +52,7 @@ function DefaultEditorAggAdd({
 
   const addButton = (
     <EuiButtonEmpty
-      size="xs"
+      size="s"
       iconType="plusInCircleFilled"
       data-test-subj={`visEditorAdd_${groupName}`}
       onClick={() => setIsPopoverOpen(!isPopoverOpen)}
@@ -88,7 +88,7 @@ function DefaultEditorAggAdd({
           repositionOnScroll={true}
           closePopover={() => setIsPopoverOpen(false)}
         >
-          <EuiPopoverTitle>
+          <EuiPopoverTitle paddingSize="s">
             {(groupName !== AggGroupNames.Buckets || !stats.count) && (
               <FormattedMessage
                 id="visDefaultEditor.aggAdd.addGroupButtonLabel"
diff --git a/src/plugins/visualizations/public/wizard/agg_based_selection/agg_based_selection.scss b/src/plugins/visualizations/public/wizard/agg_based_selection/agg_based_selection.scss
new file mode 100644
index 0000000000000..bd27116735dbe
--- /dev/null
+++ b/src/plugins/visualizations/public/wizard/agg_based_selection/agg_based_selection.scss
@@ -0,0 +1,3 @@
+.aggBasedDialog__card {
+  background-color: $euiColorEmptyShade;
+}
diff --git a/src/plugins/visualizations/public/wizard/agg_based_selection/agg_based_selection.tsx b/src/plugins/visualizations/public/wizard/agg_based_selection/agg_based_selection.tsx
index 56973cc05db2f..c0f55ce21cefd 100644
--- a/src/plugins/visualizations/public/wizard/agg_based_selection/agg_based_selection.tsx
+++ b/src/plugins/visualizations/public/wizard/agg_based_selection/agg_based_selection.tsx
@@ -28,6 +28,7 @@ import { memoizeLast } from '../../legacy/memoize';
 import type { BaseVisType, TypesStart } from '../../vis_types';
 import { VisGroups } from '../../vis_types';
 import { DialogNavigation } from '../dialog_navigation';
+import './agg_based_selection.scss';
 
 interface VisTypeListEntry {
   type: BaseVisType;
@@ -137,6 +138,7 @@ class AggBasedSelection extends React.Component<AggBasedSelectionProps, AggBased
           layout="horizontal"
           isDisabled={isDisabled}
           icon={<EuiIcon type={visType.type.icon || 'empty'} size="l" color="secondary" />}
+          className="aggBasedDialog__card"
         />
       </EuiFlexItem>
     );
diff --git a/src/plugins/visualize/public/application/components/visualize_listing.scss b/src/plugins/visualize/public/application/components/visualize_listing.scss
index c3b0df67e317d..840ebf89c129f 100644
--- a/src/plugins/visualize/public/application/components/visualize_listing.scss
+++ b/src/plugins/visualize/public/application/components/visualize_listing.scss
@@ -21,7 +21,12 @@
 }
 
 .visListingCallout {
-  max-width: 1000px;
+  @include kbnThemeStyle('v7') {
+    max-width: 1000px;
+  }
+  @include kbnThemeStyle('v8') {
+    max-width: 1200px;
+  }
   width: 100%;
 
   margin-left: auto;

From 66a1aff924295502b24cfb244944a0d97a2125aa Mon Sep 17 00:00:00 2001
From: Jorge Sanz <jorge.sanz@elastic.co>
Date: Wed, 28 Apr 2021 14:02:35 +0200
Subject: [PATCH 26/28] [Maps] Updated documentation for Elastic Maps Server
 7.13 (#98310)

Co-authored-by: Nick Peihl <nickpeihl@gmail.com>
Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>
---
 docs/maps/connect-to-ems.asciidoc             |  17 +++++++++++------
 .../images/elastic-maps-server-basemaps.png   | Bin 0 -> 42518 bytes
 .../elastic-maps-server-instructions.png      | Bin 104953 -> 48671 bytes
 3 files changed, 11 insertions(+), 6 deletions(-)
 create mode 100644 docs/maps/images/elastic-maps-server-basemaps.png

diff --git a/docs/maps/connect-to-ems.asciidoc b/docs/maps/connect-to-ems.asciidoc
index 8e4695bfc6662..88301123bae3f 100644
--- a/docs/maps/connect-to-ems.asciidoc
+++ b/docs/maps/connect-to-ems.asciidoc
@@ -40,11 +40,9 @@ To disable EMS, change your <<settings, kibana.yml>> file.
 [id=elastic-maps-server]
 === Host Elastic Maps Service locally
 
-beta::[]
-
 If you cannot connect to Elastic Maps Service from the {kib} server or browser clients, and your cluster has the appropriate license level, you can opt to host the service on your own infrastructure.
 
-{hosted-ems} is a self-managed version of Elastic Maps Service offered as a Docker image that provides both the EMS basemaps and EMS boundaries. You must first download and run the image. After connecting it to your {es} cluster for license validation, you're guided to download and configure the basemaps database, which must be retrieved separately.
+{hosted-ems} is a self-managed version of Elastic Maps Service offered as a Docker image that provides both the EMS basemaps and EMS boundaries. The image is bundled with basemaps up to zoom level 8. After connecting it to your {es} cluster for license validation, you have the option to download and configure a more detailed basemaps database.
 
 IMPORTANT: {hosted-ems} does not serve raster tiles, needed by Vega, coordinate, and region map visualizations.
 
@@ -69,7 +67,7 @@ docker run --rm --init --publish 8080:8080 \
   {ems-docker-image}
 ----------------------------------
 
-Once {hosted-ems} is running, follow instructions from the webpage at `localhost:8080` to define a configuration file and download the basemaps database.
+Once {hosted-ems} is running, follow instructions from the webpage at `localhost:8080` to define a configuration file and optionally download a more detailed basemaps database.
 
 [role="screenshot"]
 image::images/elastic-maps-server-instructions.png[Set-up instructions]
@@ -92,6 +90,9 @@ endif::[]
 | `port`
  | Specifies the port used by the backend server. Default: *`8080`*. <<server-port,Equivalent {kib} setting>>. 
 
+| `basePath`
+ | Specify a path at which to mount the server if you are running behind a proxy. This setting cannot end in a slash (`/`). <<server-basePath,Equivalent {kib} setting>>. 
+
 | `ui`
  | Controls the display of the status page and the layer preview. *Default: `true`*
 
@@ -190,9 +191,13 @@ services:
 [[elastic-maps-server-data]]
 ==== Data
 
-{hosted-ems} hosts vector layer boundaries and vector tile basemaps for the entire planet. Boundaries include world countries, global administrative regions, and specific country regions. A minimal basemap is provided with {hosted-ems}. This can be used for testing environments but won't be functional for normal operations. The full basemap (around 90GB file) needs to be mounted on the Docker container for {hosted-ems} to run normally.
+{hosted-ems} hosts vector layer boundaries and vector tile basemaps for the entire planet. Boundaries include world countries, global administrative regions, and specific country regions. Basemaps up to zoom level 8 are bundled in the Docker image. These basemaps are sufficient for maps and dashboards at the country level. To present maps with higher detail, follow the instructions of the front page to download and configure the appropriate basemaps database. The most detailed basemaps at zoom level 14 are good for street level maps, but require ~90GB of disk space.
+
+
+[role="screenshot"]
+image::images/elastic-maps-server-basemaps.png[Basemaps download options]
 
-TIP: The available basemaps and boundaries can be explored from the `/maps` endpoint in a web page that is your self-managed equivalent to https://maps.elastic.co
+TIP: The available basemaps and boundaries can be explored from the `/maps` endpoint in a web page that is your self-managed equivalent to https://maps.elastic.co.
 
 
 [float]
diff --git a/docs/maps/images/elastic-maps-server-basemaps.png b/docs/maps/images/elastic-maps-server-basemaps.png
new file mode 100644
index 0000000000000000000000000000000000000000..3f51153d2394b9a93e42ea6cda419b0ef8342ae4
GIT binary patch
literal 42518
zcmYg$18`@*_x7i@Z5vzLwvDavsokw@+qP}n*4EsbTX&0pzrUGx=AF68+~g)F&&`>W
zJSRC3N(zz)u(+@Q002Q+N=yX+0LlMO=Fp(uHN}6{%K!k1YELyS7ZoFSVh1OCbD)hG
zv5SX;8L`<fpg92WYojI`n7YXoU-M;x(E~m`<iwP_#QSUN=0-$CL&0rbdyY{T7(qH9
zG)w?$nDO!T`JDc>uSr*unJzQKU@=wq+xR|*sM6=%>e=4n@Z;a-d0pPt*fT=eulG|A
zgznHWs1m`S`X?U`b67vu91aivl?n*nJ$e+LK-Hl^>aX7qc?wGHJjXrjd*_y4jUjcc
z{Pis#68w2`-_M(TLiEL@QsfCA=$G|uKP-~0aUe4Ak3g^f`Q{B<c%BH0r!Jw-hZ_Gx
z<iG+evg5}qH!A4g{imOGtG!6`VZ?pDEO|wJ$M=Vd1J55GVlU`Z@6ib}yMB9%&jWoV
zzV7?C9Hd`&L99OSPP}u1C)J*_zFYcn8R5qk6598Xv-}g<!Th2BTBdIX^M>dCeA>O&
znjV=>rscTZdUYQ2H918`*>zmUZa%wqP9PWU=5pWdC{oJYs2`WV;;<<y_if)%G}num
zeU|Q0g6}-pn>apqUj4N1oJ>hORJ!5HIHc=)xAlGA-+kvevFy!JWy<h;PB*OUHpkB7
z{+Lmg3*epekmc;J+nqaWyFraoGlN`0aQ*|?MG&VNee^j|<8Z?5pm*@dJT{yB$Ol4l
zun{rP-Vgs<?y2k2=B}4Z5}yuj8K(nj0m;0-<OnP1fjRh6{%+-B!@I2At6EXOs|SID
z8HMIZDLo65CkexZ)K8}RNJ)`oBw0m)LOn_6ockzUb+*GaK<`JvaH0$&u>r7TP02)_
zeNDyMwuN&S6gyqVu4H9Z=Vr%+ahY55<Ykt3D30ksiY$)h+_Fe<(PA{iJlAY>-Q2)8
z1VXO5d$O{srZ;DucqEqhs(Y%o>&kb$1x<nP>_}CC|LUPl+iUhbZP$<4`kLGNb2d4a
z&c121t2B9yCVP(@IGfH)M8Nu!4UD{bEqndk_#u;fCc`$jP%2lLawbMwfprvp^vav(
z+V=W0qeC#0GwGaYChMy$gEh1Bi-^@Cy|eEAX{MUtZmXO1sa#}a8M5*wS>93(lY4kb
z=)g3xJ+J9e-1=E6w+T_9UDwHa^lFXrf$=zd%f@;cA%T#HL<TLk-;%<|)ka|jYoYV&
zoac`Ajr(zj%CCeY?4qD$MC=+?YJ^9>Qm)UIw{x44-rYvgqXadM#Uh98&Aj#avUNCv
z+r;$e2|dB;3XN;T8bkUJLHnp+E2!hOmd16<Wy@c=WC2xCDOI?ni(w|Ko!XhsAym}U
zbF=D!hZ}H2v;b(?uyZeCm;LD+9EUgDwzeuKVSP<a`RMW=W0&m<=hR)MqYa{#Xq5s$
zLMEy)_4lpX;}$Z*pSI*#lJa)wL}WPQn@#Dtilk2gKg9cFS``^zf^MPG&9eFQuNgCV
z6v$9S>RDOqMnd~DqIlJYXiZj+6_Ln}T-|b8N->_{gAU&Uq6dF2kP;@odX~JgGtwld
zNSW`#Qe{oesC0<wCcBsrm(Vv2(GQpCRmyH@YO5h#YPW$(da#IZNj!!)9q#SFt25ZX
z;5m%=LvNw*2RT4Vm|I!~8?tRf6nBXN<vg?<SNGa;SiP)$-4h4dkI*3mX2`Jy0X&#y
zy@xPMxtMf1f$IjmAL}(~rr7XHJXTk|iE=B>+FcjTJ%w!H%=a1H+YRt|sN6%#elx{W
z&0kw5_Z;reeLU}Ll39Jc|K(o-sbdSreQ|#dA8vAG@vfWCGO8MyWUV`qsd)rIEQ09`
z6d^yxV#u2YE;CT<nOl{T8GK^E?SAa#bpr;IcuQm+ozDiD(r)_Ar=X#Sag?r)31<`6
z$r(>G7*f1UkpZ~<mzMOcYI%4#M@xxf`UpxnMeWRPk^W6}IS&W2wk9MRR?80jj9bF0
zEq90p856p$%)aENf?Z<^-hsYw>@2I-&KwD;IU%~T(K|D2#z7jWKTC`l02xZ|KtzBP
z2*=^S+o@}_2Un45f{+cGZn5y=-|X0G=zG|sG)%~j`UIf7xXR7Wue|P<ot-0qx?V*8
z&>h72F+(?hXNwZkIV}Z18&y)$A^bdIS}t?HeK2z=bHz$3U_spQ`M4<>HRP?d!i!$Y
zmZW7roegARH38NmND~^s23KwHDsc%`lc%<ewcL&Y`4U<CD$srX_<AvPA}L2pblpMy
zrP}_|KS}G+pgldH?0DjHYg;2+K*Rjc`M2j-O!A&Y`(rq%L)N9Et9kLL0Cb?TiU4tQ
zz_Ll0aHS2zh=a|8!$Nxg8YNfw4S~=YVTWhM6(qs_5`<K%+)ldx6!V;-pwFo7UmCuo
zyl22nGA|U6{Z|rJL~*LHDY@*$D)Nt$lr=7C!O~4)`pRN;-@)#r-@Vlhnv93OabNM|
zV{6n;oACPfS5|>s2k&-zeO)CQ64bgT9GtgZ@o|LxBS4ZgH;ol1hEt-5&{|T6ar#=l
z7fZ)prcH#Lp%RO{37h78%kpcq!{AS&6JZ8<cM+ZVCk3!4je!ro-@#PK;EelEP9-_)
z6dxR?M<4SHV=Bn>O193F8!|_p;!w4?3-TO+P)8|U!#JAc!5C!V`pWM@gjl5lw-Gg%
zicTqqEX*QYBa0|1tIWE6M4vaM!`azHk5*H<%S%06L-ylR4TP3h&Ow60{3p<O?eLah
zu|fvq+fSx%aFs=Kd1U}B5@_r`{Uu%cwacxK{oUU-$q6N;{;#x(HA`Ga!xy5DiG)O|
zle1f7FMJinSqi$oE;{#j-E~W$5V8M|5=3)X+)-Y<la6;!M3<Na&6mmwteB3o7T%vU
zeA(6RiOesClxF;LYSw(xZ^kyD;N>X{XPNYoLEb~^9N#o~*Targ=x%^3@7OO4VKH!-
z9<zos^cpcC*j4u+wbFXOLFr7@q=HX4spKsnCjaD%&v7_Ww%1DxE1@E5wR}7f{41$V
z02nQtrMARaBXAevJ2?EZY+yYN^CpqVrq3^N@C_RzKO{9;m(tua1|To2A<)J&wlFFF
zM5~{pi`y|dzZHm`pW8=RLp(K#?r1?i(^(V&xh9w?g?T(i^Y@0qhNCZ%*}H&G6!8Hu
z=~CAHZSkvyOj}8NVl}eFqF>;ZsY$#c$S9tl80Ep%)f_E0*g7D4IQ#Z0M4kjph9exE
zO<kvGCfbt@gfoJkY}yc%1-XfeJ*D62_#4dxiYsxuYp+T;Gs~zKtHY>6a@q>{A6ySj
zRqzbu!1>9$J+^C$y6xL4Vw`L5eCYkX=(pR=J0e!gN*yIJ78yMR`tviwKz!o2y>VKT
z%^V7}NUFSvt5BiAFOPhx&iUl8R>_A2nJDd}*dQDF+G-?~DkE_cWf!dx1h9&izF<0S
z%+-5%^tZ#)j?v(dd&nlv^`M|hE*nFfn<i$`oTwsRl99yoa*#(D1(V<ON1XLC9qYf*
zhJCF%pgW2&z&IC~dBF=cIkVy6YuPPMcsx;BG7~J~1-K`1CI*9s6|_9%Eb!zc*sEA`
zoQETB$zkryvh&!S)uKWwYqeU}l@Y0>x={;?3TZbY@FGlQqiG%uv1tb<t2$&V9p<L-
zy8Vhp$Db+%B-D~9>Zr|~T>B%0KN2=2FCFM;9g9fnGDU_Dg{$Z@E^j&w%F<c$ge(yA
zga*zJ2u&xC;2Uj(N7YExmy(3rj1W+qLL$s6UkYVY45<4nnD$3GHR3tvG%lEb#2tsh
z7JR92ex<{mS+|o}#d?C0gMdWl?B(%*E(uHQr(V&5SSOAv&PU&u?&(amx`hT_-}z{?
z3zF&Zi9ojXG!GvnOvz~s!rc;)XF}#Sw-I+CBp2K`Pyi>rO}y|I6HR|C_&YHO-)pC4
z>IKc^m`LEB9hOe6=13)y@^<Qi<D*|kNT0>rQN?Q_{DoewY(Y^9ONuAkm({`u8U^0(
z?Xnvi_#+WxcBO`pRT1p(fv`DTQ2!A@KyY?Wn7A&+P=WpvaHx&*l1@k%N3PeLk8)2S
z-BP)8n~{)3oZ}h$i+eJk7mT`A=-SJH8p6e-d<~1glFozy4C1GxlgV9|xkv(k34A;$
z@8MN-!5jj-P|mAR#Bn&}Y$G;+jFzE{`6Y0yG*FV}P<eiJ^Pg!&CcdIjwySw_S5Jbk
zSXgue48dUh3fxRO1Up=pam~gV4h+1pApzZL>hc^yljI&5jF4|^2zCvZwvg3+FFuX%
zsC$hE7mAn>ZmLe{lsyQDp*{pteUinVj?HFc86)m6uUf+ZdpRhfu{kLkQmVsFbYx4t
z*Z2kINxq$b7$toxp-_zUl<|AY^hMZiH;;dy%wxkZ^Oz26=3*KrK#&mnX9}M9g?r6`
z0%(Pu;`u!+1j?|m8K;clEGzZZ(3Q@3l`H&yOOe`@927`Q5V<zkuMAj1oGLUFrjW?<
z6tXXFM1hfdh#G7rsoniU-?b{nBi5Wy;XRB(q56cjeCjokYBE2NK=v%pYC9zlz^Hy0
z;3>0en5Pmnuro`oc3rdzON#P_X$t2^;3_`Z<gJs0Qw<{mxqFGtS#iL%eu@Dfn<G)J
z#X&>rl*}p}U(7QBr--MpIi1Wq^pc|p@&&i8HVR3h-Eg60Vkp@2`K)>Q)~#O3G=8wT
zrfZyoLL$K3SS<W4pM{vYP+p#OvA<&pn_38^c!?N}GO*(!6nhpvT$LuM13cJ%3Sb#y
zHe1;0Hg@ZOpU9(&9(Ey95Z@WXEZ0(ZC9+C<c04muJTgz=D*j&6$Uw@s;#R`bC=Q|^
zM+i~N5z)p)PkQyI_$824dg|8zD^hWcyBX24=sa#gVwjw00k>)V<r_%EQV+{tWTZgU
zfn0m4Fl%o-8O3bmww~pg>e^8W0aCwZNHvR}?KTVLG6<+y?QN2D4SEC+EFMD*#WCgB
zs14%~%laXhJgQHptml-l0Wu(ndI*cv;Y7e^;X+m+t0f6@1R%I#K`k+m0SHyM8N^V0
zfXQ65wK<Lh6~@sZ{$VZeyo9Tu?2N6t1@DV%j^o{lTdtFAJVLv@M}{qK1#Qo*LRN++
z5}pwr><gr5YuCypVdD(FV+d{AC^!Y6!K$%7iW}(%L|Pdx&pHdndbvHz%r6AfBqgXT
zK!7QlRWM)KQ;C<^TD7D^<Uvn2QRiW=WMm=%XgU?6)DV-w?k+f#K7>frl$@}5dBJf}
zh|1S%W7&v-%IZPnj;ZieVMS{ytIHlC81YQ=KM@S)@4$n_Tt;74{>+t2g+i~=!LbA)
zyY)jTi(B(F2Zxl6!;=#>`P~sIUf_iz?fA1q%Y{aEkgcb#3O4DZ@EOwMu8A=QTI)@(
zg64u@P$h*aHQq5XuUd;X|Jxh$Mx0&{QAjA&X?oKn_wA01-4I`U{+&4nvFnMMxpHvG
zq8EA0Co7NHc&TI%JocC>ajwI_oLy|~2+>mDOP`$Da?20nBe_w_8UR~d+*4}Smx1}N
zH%!@~x;)g!i07WdNdY=g<w~mP=0o}hVhcy8(xt%B?>U~BNaj$)`QCq7yn++tpvj8o
ziJ?wwen_AIL17;LbWM#M>p5{Sb4Fd;$XP<@&lyLaaHeDr8NolD3`uUi;IJ_-LKrp<
z^EVm?hr4wWYFl-vlMY?J$MPuWsVuqr*l4~nd?V}y+y+0I$a}-kRhSpSMqy@r2D_!N
zzoG--Bimup-$J&G7BT<wU@teKTd}k#kjE743AI|rRvBcz^8G$Tz6#Zht+Gsg1wJuI
zNyYZaq7XIQheTG1Y(_V5(dCT2`IwqNy6Pvga^oc55ufAwImAFtdw4*jFf7@DS-erQ
zO219)p>Owv)X5$;E{8RfuQzQv5QY(PS4C+$(%wO^5{#PoJe)K!NcIe}^GvxA=^ksP
zFPH?Z1wJGmqd-T*og+ZIAsJ;pAA+(19=~gojIcXp7{Va|a$jQzzn&qT*j6casOYbm
zix!wYHrV`cX}iBU-9}dD%Zc>O2|@T~si_=I9N@GR*~qqyX<V~l!A|wdA(Fa=?-^<0
zkWARS-FT)#NaZ8ol>QIDLo0H>_VD9(C|y+76Vj0aLkEWvwP<dW5(7I^4M)j_?y-Gq
zAQjrhY!)WWkuwVv_rAEKk1^P6!28|6>{rC~t<pSeBAHLa*ON<>3k@~>$)zSpNdr3<
zGfbCsuDlVUuVN~vgJ8*MGE?dMHJhd2&tE*Q2C&7T25pM8nuEoH83fq7=_Ck@2g+AT
z3wp-jPa~myIm}y_EsLWxB1>Yj(`cgfr+_N=$B#pO-Ls#FvHdKQBG$XVk^lNq1ZxD*
zd=!@RutmKrM1CK<BpFca0<pSzLp`F~>st9t38QCq)pDPZ`Nc{q{9m5aOJ>j&mpy~%
z(YabJ3%a>r4^ge0Is%h3_+Zr%pVk4~`8-Y)EV`H|xXroZ<jm*BQSl`Qcq+-z2b7K;
zj~kkPg;orXZ@j1ZsbHVM`{5Z5j<Rr_(Orh;5`QcI#n^}?A4Jzg=OfJ>&oE`<I+wZ$
zUdKC1*?ZO-$=@=Kn~&nd`b*BDd+nPXI%B~%$D3}Xhb_3Wj4`+j?~`f{+4i{)6B;{>
zn+zH`R6%Lxvop<$QlBqbvbbpJPNUZ@sgf3s1Sj5dsV>$AS0fPlOG=;%uLGzA<f|mm
z7?V|_8kwb|1evOY@L*y>xQvPl`olK0`-|;H5#^n`5JINV;qoZB;u8@4Y+p<9bOzN0
zrz*qHMOZgPP$sO8H5lQ1P0*p8GKeX~7y?PDBD}!fre<~NsJ2KPNdidiz^3U3<mgwH
zXJK4=Dg(rf<(5f^#s=MKY>iLSrRG^w*j7ounzsT@D5nANuR!@7=$A_i$?<qrE3!lh
zY615fE?_lO!*3yGl?XiJ*1dfUfJ0lgh5{xj2AmNV?p9K~m8XAy)_wCCNv!KA<2l0%
z9h_rp&kNar+J?$M%t?qu=JJ_Lm1Rn5h^W9dr8wa%Lw{y-2aZ!N6@>(w*uCq;ov{Sc
zjOb7^mge*^55*ZsS+?dJkx^^1k>yO`8|W)I-=7}bNu54MMg9H^xAF`!?VxaE=L0X4
zc+oP5*W~7(`EgOLe?Z36xL7S)Byg{vq9jpYO1J5ivs8qft3uUfQw||p%v;8hy7Ciy
z#AR9Z5xK{)CDP(nY*hIz<BXw@P3jJ--f%;4eXS4^EFfQLFl2?>hV)HVX%1J@{R&0d
z(`LLFScOeF&%8_DdSRX?=%v|?r7JZ|WVOJdT2|*t&MnQjES57{mw45<#z7(q;~Ua6
zvNEfWUV3>AZt7}sTv335(PvnyUoY&xssX4<-AI5R%TjupqgAZ$zeuc2UaZy&wDHyi
zi0KFqgOSr}W_r0D?;8(3==MBAkP`AxdEEEHnm7)Y+iOWFL&QJP1(gznrS#~6xJc}!
zm8)_<<wJ{|=LR*V-Gh{nMEyCMWiNh}AYqBK+5L@<G9+nMrJ4H3*;r60VuLpoC5b(_
zGX1P>#qAKT(IgK=CdBC*Ns?7Y)VT>oh4(8^?!sr<U$f!}MLPe3U7KPkWYxFz$GD~v
z{$WR-huq2egiO6-f5)<#heeoEW2GVEw{2K0sqOsx<}Rki6<YNwzqxJ95CUdpf&*{_
zh5b~NW;B6iBR^$@@#gP4KZY2c91ED)N=YhBwyMP?G)>fDNLuL=i?Tq9`*IRdyG=Jk
z(t@6w<q!&uX7;gCFI#t8NG6;?e>VA8nmTLp@&d<MO^2|wQ4y|7aK?ysX{QsYaPuO)
zD`vABm^A@o)Ui}}eNC=I3Qk#TASNYcNX%!$Uu)f6<zRKJV5`dg<@)SgFKZpu`X!@f
z<Oxgh`Uk^v9kQQ#=pqtkB0<b}rJUUF)aOJ!e8Z;boh!4<jEt=E3N_<1Nq5CI#5l?~
z4W{iuh7l|CvlIO!s`_{3pHgJ9@p;1NEO$wwkk!tDxxt7Kputaw1yb#Qa5#UWi$Da{
zxB<&inC(xC>Z7Ws7cHs5ZcSw+=&w4Fe;qy=tvA~h`&;Fx$#RO4!Jgh4&5aZC`eo^C
z$fuye!@mt!!aRc&AvpMWL9mvau-=FaSa#COs4wN+Mp*d(k?h>0jOhJ_Z$b_dp|Q~0
zYq78gn=l`CJ|PXJZ$Kog#O>pg=A{;aPYw2TmL=r9=mj3!%hfZq$!KAA-G2>XsXcZ`
z+HRkqs|8?34^5VC*WsIea1)hynbTuy*_j)!==VS-(wprAUBV7nhpT-2n*t~_$b%EZ
zH(CS9>~eMWDJKs|%4IRQP*GkbXaBURs}e@^KkqGRQKxLR%&L|4Jr!)tJ_whPD#wWU
zn*!pS?~y|fCxy3>Lqm<J3)Bn=3do{Xo7Ef8BVzMsE^l*Ji>?V722~K_@gszFhy!$y
zk@5qA?l-)$Zk0)1BmIR-{2^2UE&alQ#Dq^?iIEcBH?*%&uqthQ*3u4bq-T^gfkF(_
z&|5I1ah)09H6$9vOcQH7KXAkX5rkyo4$9xPgoMPfO8>Bc{A_0x8CDOVSh-Q}!?wMu
zUDh!1N1BUtz23BOwZh_x`O&PiQ=H6y=FVbes{0oyD@gCu{f1&WE(Kg5oldRL_-aLC
zNn{%t9>gfw9if~qMFL!;9E#Bce0>?@Jdv;dUCzw9f%QV;?{S~0a?)%wct08c{7GeK
zQjZq5rMq?o@wL(>s+K*D^M&SEAEfK(l`x@@psUf-U4%KA8MPL9#mZ;&fD{*OiaiW)
zuXq~518c&7t-W*Kg1J`xb{b)qU0iWQBS=niyB$`^wgOAH*kd6}jv2RoN4*GRG5oi*
zk>}DmY^1m1R-aqCXJCBb*$E>_X>N0nR(=A>06ZD7*<Ke~%R~){Ic}ts1}O9-wv``R
zV!0Ki4?C!-&@aRqeI9n0bdO^^)M2hSM3<4u9zXRNmEN-Hxx&NT0LNn|j7cgSx&Sc(
z;vW)Tm;Ey;-KwOMtSE$rq1DGeN1=HM8QzBu2NZfFBpJ<m^0xewAfPcD0TMogda)uk
zz)1-@sCJXK6gV^zC*9op_<3Qx;)#)H1rm~$k5-|!WYSDNj;mxIC*utgdVN8=rUVjY
zWjcu~1#x?xx)F`aN;zBHXbHtsbX#L^|Ap3r-kNPo;$IH^$xjF!g(qQ#w}B(Nj!cC1
zO+3JLU<Y_SE#yUv8%~^LQ#ozB{$8ltZ$Api8BO*V#7sf3`z&=o;wIeaA2u9699FXo
z_FnNEeD#P(ib_oCelF-AB?pNK$gY*AiBh~P^X_M9-fJ4XloH)_O5eu@sKELSno)P!
z>mVL$@<ZXzFG4bm>&BFmJ<fk0U|H#cRAO*4jcg{3gYz?JFx(hA8a@1K&e7ndX`Z4}
zS7g+r`Qf{0x9$jdt4Jwrxmi6XT@NT7D8|DgG>bV9JweC8c(?Ufeu!tO-55n%g&ubn
zsz!+(_GaKaw%ia?R6h_e&Z)Tgg_YEB$}cbj=DsF;e`-X+aG)?8&y!jf9W=IeUh=D0
zVR~<dI8MlhzmJ`H0=dTRt9DAU9#LG6hOXTf$c+<Cn%3OB&{A&u&k9+;eBPtHw4-Y=
zDs9L$&i{N&$08rHuZ$uoU~EwW9j6Wu;jEF>OeB)4Mt9RqxWf?-e!E=0Uzzi!^D2tg
zRUE^?MW7ICw^6SE`N#z|-?LJ0txYGQl)PssfO{C}y?Tsca0ki^lqMnqcg$ZO=c)~}
zuz9&b+;AqiMT987(zeR)ml5^)AhjFd?#uU5v8mYny)6Hu)mihEFZVqVj}t`zh(Axm
z4MOisVIQFkssx|AXIDHLY#QYipqkDC;xOpLNK;0>{*zoH`&R8@yvAA@**)<gJvmHA
zE@K`&DOQL$Yfd7@a;Z!LE}jKU8zBFCoa`5|v%)1eeSS|F@vZ*Jd2LoX@3_v+JR;dG
z8U-B7>{&gN>B!_f**o*?*tn*@I3*m&Rc7We1^yzQwORd}Hr@3t_F<fk)Xv7TM%60W
zihE-?v=h8!JY6G%E*OZK*wfEqQ;<MO)lH~InjGcfn5TAxoL^QU8R&kIP{vqo7ZCwE
z4y3>TtPHWsl{=Y&f&b)WI(Vp$<!F?VgP8t|pAhjFYSdVSTu_nz{VzL6hcSF6-mJmf
zUvD`XK`A+aZEu>Rc?nmaCSjq4RsnVsyG66CM5`*(#VX&XG3l=#UwJ?@OszHR`EVUc
zz+*dtP?+hUW70!1re3iHf4i;?++N^kxeS@hAsMvrrZLH4{CU5%b`u&?aK)H0FexL*
z4Jq(XCGXLFzmI}#B?v>$Qw%$QTzOeBw9Ohzkq%f}$=&-tRvq`B9}EV@2C*FHJ1tpb
zZb9a~96y#d_^#C$655L}_TG%P&pT{Z{^3PnNKNx;!H27rq2KIvYrru_uF5h%7dO{n
z;g1+O<xAj<vzPtxdFLua!h~n(HxJt2G*8Lrb`nYTHZj6FM+ZSbs5mJt+eFlYa3b`b
z2gWCpVF3MYlZ3CVikyW)wD@&-n*Ursg%hjj4t2`Yi5P*LR8ZkGJ45Hhi)fh0NXv~-
z1tlrXMZ>IUz-*O2@c{kOTYorJE}&vVs92YEs4G_%M@iCHLx}q<1rIG$e|S!Qe)}mA
z#)+Qt4vF!~gb>#ki88HE8-izX2~I>x1^_a&T+9X788LhXeN3r~io*J`R;-PSAaVgh
zJX60i&1up4aQKCAYz9PELnTNEz!qOUnABx_>54=TqJH6Vc}+mB^))6_h<B$Wxgit<
z+;4*BoJiILMpNOWFW?5{a<yBc7fJmSgsZUds*sUDTG~^kE!n`2U9dbbknOAL8k<A(
ztC_><GRqlNU8P9q{D@u7qSE@ZCjU*6Zl#!kF<?R_T0)Uke8-UOK=Ky2L{oJ8^7!zA
zzXj9h{-q~&sCT=ray_V?83LHnQ?WdF)ew~qa4D9Nk6vjw|KYuO+9?2@43hV#*7sS-
zV)NVx*|u+TFS+5)?aC%ZSD6s}-ICW9lvZyyn$}&aZbamDpZWMfEW}y`bPJC&Dt$qv
zq2MJuJY*QcDgi791;syrIUR!&bf2-twveSkc*7MA#!6PGbNgTICm8O4P&RrcSB;gj
zpL4AI%l>f<hhm6Nk-mf9kgh!Y{ew-c`q&(ds}tyWL`T5>auNAZJ^m@(jB%GWjq+U3
z`56bpdz?!eoDuI;IpYQj0!<k|>2P(-6y!qwNg4h+_t+H&xX&EaC`xuT!v4d$^}Qb?
zAqbm|>!o_!>mbM^B>#-D%rG*FeS^!Q4A^o)nrXKNMT;1`_F%9$$wCmfPVZl>#LNBV
zlxIfABHg{uSWFbN_?PSPoK1TA+!W@$si52{cdLC${)_yYT`js#%R`H)jq%7!K9x@^
zea~o&0}*Q!2#iBUktd^;w3uw04ULeo18`xk=+%*ZlVml=0NsI?8P?mp`k~V0LnT>b
z!j_~QBtyrZ)h6qIF@iwFmxnuKil*MQR-{S;lPn{6lykJ<;|wLGaVhehM0iR;8V`P+
zRwW8)UYMK6DHW`yYYizp{-*@)9m|duC;o}Z3Lnblm`;W&YD`gm)B-SE5#31TMm5S(
zw;@TI9||)<<w>r2v-4nmt?uWOK`5e%u?fc0Jz$t{edT{^Y^k$BFEs@5Q3g7S&g~1c
zV}~LOU51cH6A>+>zVfG&C!YkuuO8#$$>4J<7Z2c5rVOKcuP~PZ<-~L|`I*oZk&Bw_
zPzBQbqMhVx!xf$zM-EUz;E7PoWt0+l?q<7Itg&`nkP0qRDgK;9JJw4<ZkE?uEhKYj
zM&0-GX#T{2q_PiX21|<MNzs28SFl%W8|gc6()1>EWqNx)HDgtMp&3W!*(*P53c~c8
zlQLmc!T3*sy+x2RhgaWMgN%5f`;8kYyvt~(LY|9HEr&@QI#!2he{*bZ>RH<gmXycJ
zxsp*>tc|#AIOE%%2s`#oS66C?;0DGX3i29sofN<{OL}24FL(e7BXX&QK0R{sOB?YE
zsu9KX6{*eATvjk7vV{E;h<l5qOfC5_e{|Qy^y2As|IIwU6EEc7zSB|$VrMda2;z9p
ztMvBB8;9=Q<aw@<=Ws-=?6zCnpCMdTQDuFA<}G(CjrrK0Jeabk0!6HGhKy;ty1u@B
zx4{e&oT`(8N)ApFnsn^P78)weCfG(&CL>5$<%=%&oAc)y!}}7fYNLR(Rc4}7+I*Z-
zh+8ha>p(UTIH?KMEP|x;s+gnP7;5rC{n`;wkA&K%74BPV%eI6kP!(Ui2=o>qPF7~H
z0sg`xf2FnszRZF7osS5$E%}xL&*L2-i;pj)c_#qev%`~5Ey*qem6LSSLv?F)YuKQ6
zX<lYls+JF?N4OKe7!liurv?f|R9@`i8}5q0;MLt_Q_TnpDb9*|nl`m^+qj9py7iJ}
zAv^4H(#pX-d0l6s=;n#cz#r6)((5(MO~-sIgxW?4DHu%TzlCKjbSKg0x2F8%ew+m}
zT~NFM&D3!v|3*VmvFy$}QfhpYBn5p4D7UB>QaM^GI0akQNtOLKgn<c3p1vcPG-Het
zcn@s8E2<R!`TnM|TMlIsvTx7Q_g=>DKdc}QwVKh;bd;^_Prt~)0`_>0=br>>PEMJ9
z(g1kN`OTGQQcCi}$Q=^WL}8A+&mc7XhB}C(Z=3ED@}==S!|xj2f|afnkS+v&8?tN4
z7+O4?>ughGcY6&UeS8RvC08UE_`LWPi+m2s&h7}ni`~lK-mbdTa(Z$8U5L5kA9qdp
z2!<<)zOaE7SyY~w{M#-w@_s$~SHLG~?2DT;N5U)^GjURtkvDpDACvW8Uh`k>EH$lY
z@|T<ZxQzJ~AN77I-5W9D^)UUx&#t#1J4+mqv}m8B_h*r|Zhp~8refwe{Mw(-035AS
znas4V*MEDBnXiIw<?AdMT>|glL0rK=QBfsnQPKYwxAh&ZmF<(jFEu2DKVl$QOv*s&
zhU_}7ltUjL$z_ERsYJ32Tf>vC_XZ)4n~07jInc7VH)gytFruvqr74X34sdjKR&hx{
z{YpdE8UE$473cm;=zat6D;iW|<w7jaG%HSmA<5Fk5UGPUhDLcHA!b(1LmNTo8(ZV|
z_U?(gr@wLbiw#fY#Mwg&x5%*58pa!5%1WK}$m5!nNfhx`;4`0xh#=}<?0O&VIIYjK
zkcg4<%;l1yN9WbLHq>BIJD@p8FSJU&nd_`}*g2@yu&Q=d{2X-nsjGd=Gh;;F5Ka+}
zOk5PoLR*hqrcO2@midH6_$fU0BT<%86DJxUu3RMK=w;w*&%Mpu$Z1d>mdd{tYx5Hu
zM5Ifo$!>FZtaY0Y1az)HW%WrDuYa2A?6DP-7u2&YAnKx(@&+W0x4%D$5hsxh!txCc
zV(%lmmj>!#7nI-H&c4PcTL6G_PU{MWj}KZTKKb+cm%F=#{Z}sV@fi&M)5&*OgkAMJ
zoDR}hR#FV`0(b!2#=1w`f7ie`NNGC*07ypvC6IE#GT?V5l#8^yIMg3-JOmWvUgxJ%
z0Du@EEhen?YvVG<LQhp1D@+kp3RwgSqL@Y=*`}EoI*^n)kQ%ezXlSP%>pLIa(0A4E
z`mHn&m|sq<E)-8mtfJ;A3rYe*{`}!U5(*t&TUT|>*XKQ+Go6#+<#dwge5_y&jU5UC
z8X)u@i<|(13=NLT1^!(E4HF_pmfHI+gTml{mx%*JiIJg6hIwAAn*#&jgN2BFVbr>&
zymR_pT@e54t>$tRQ-F-|{nq-wwqN`KqJDcK#K?Wfzt=n*P6aEW!4EW5xT>o_!<rGk
zn?Wk*{R5R0Lj0EgvVzYgqRGz%FKYK+X@vZmwXZs<tQ_2w2^{q9Vm{Wi07&}Xy$#}j
zSpI)(TZ%BO-nli;30wBO9WTcsbshsFeZ3fwa|+IxSSm{cWm^x#_MCm?v@UJLzFq;c
zNDoY9+|526cH#d7+d6q%a%<K;w}{Ls?Dl)|J(BclfQYL_-D!~GDa~mW<m9*LV<tUi
z$5`ZShohAZ3dc?MF2u->X9FOtlH3_f*_UH)*PWWvuV>ddjT3_{ZXS~ElB@ZjK`#?1
z|H4i#e(-r(yit*i^WXF_?^rh9-Ix_etIC3@)_^J!G^zwFme;_6Y0{nl%-qo!PyZ2{
z&DgYYUAhgF4k58l`?-f}O%tDSWl`RVRsZ1fVfj_W8(mS7AdCn0Uh+80u=+ItFT$M3
zE4g;{JH=&8oU$B=#McBVmb9j@bmOl|H6kyn^b_nY0X+hspC)>vWqxXBb;7fKESWtm
zNw>>IeXF7*iLcr=r&`kE2mc%BbLe7F_vMEO8K}=#++#h_pQa0KM+K?=Y2eS<p`K#`
zc{8^b?niDC5Z19yolTx~#lPD`+S4H47dnl(KB9Zhjt8JQVRbQvpbnAWBDO<$wKqFE
zXAt41{<xhwWAxN$G-F$oh=Amm^F$MhF-{}9R;S+?IiiO-28|my>{1`|&O*%)h}mYn
z8wb@aElM#0l36N5vEFK%m(*3&m>(b9)EH#v%0Z~RST=z`hvkGn0(M1uS5&WIe=sG%
zUlf21D;BxvC$?Jsq;2~O$81z5($;aqE6s1ApQ;kyn$p|GgcMIc(4NYLe2pc#HdSzL
z%sbl5RBbPRsv)<%uo{VmjW{f141O`!+wK{>4t0M3{@!-bbg%Q%fm$W>7RVbrOiNyB
zs2%#%JL2=OMJLV>b~){XCi&~q_cI~JD7t%UN&-p$BOi6BK2Vl5^jB@4?(is++d$Cc
zHJP~{%^=g|42WWr5gZZ~D|7Vy@wiKq(P3)#l!*y8@2mes{2$KBja7A5i)-XLAMQf=
z^5|P<r)RhsBV+6`mZ$zBqa~yhL#<hqI7JGFM7KD+&NpVTL-MO97afN)SBy}jmAW|w
z{PSMkh;JlN&S7$b^eRphIUPf#H{Lpv-!LW)8LkgCB-Gkw1|rruJWpG}-PYvP9qeZJ
zwAbhaDbV@3-Or4Kc`5Y;ZMIUi5JOXb=9&rqI=H4%#|}-|(PA>b9S`}Jn86?}&qw2Q
zK1K%zrO5xc6LyHnd_Z4tEuqWgx0cy(W&zoU-4WAzbYU1CKa^sRn!iyBXBraW8J14}
z@ON|&-BcLjz1LtrQ}yXh1=;aV^(apxYN!!5tIIm{8dwH4=v@t;$J^Gdk&ET;pgBQU
z1TVuArZ;(opIA|}G-da{zLoGJ@w11JB{}33YUGSzg9JNZ(i>ab>ZoU4A_kPW=7N1Y
z6!nWd7A9l?$+<-jtIJXaK)o^R99DI-W9@h_uJd#VsSGj>8RSx-CqLHEi4Kt2{d`l>
z(Ar4hSRUS%QNzDDtW<;`rqh1?g`39T^NjhBQ?1sNJ95}7tuf46TTv9kMs;USzGk;?
ziY5+FV#+w;PkueHlYxS$>b$z;lzGat5p}M|!AqCD*FPyIR&iA((bQE;3M5MD{oS`U
zW?Q|M{3pQTrX-cAV|sBoyuC42x0c)G?FglCz*hc}Nb>NZr>DlDPDyWN)ufyhP>y{;
z<6qb^MobH^#JiBuOpAzyVX3+Zp#LEc0jO-16*~QB38G<lY*WF|@8*A~KnKpC^nUV|
z;w6A2>w#YDJ-V-yf+`{4Up;n=;0%^tPs^zJFoc{J8dLriMc$oM;>{9_gStZEp*<K2
z*+$qUa(S3L6o!23{Q8TnH#M)~&>uh=MR1an0`61Y99>af!N4#NO`twbOA9fwg*(5f
zW+Sh$tQp{SBMVXv$S<EyR3K3uhh1D`xS8m`(jit$)!j(;vI%`<F1T~B!ttN6)D3w}
zh>*jwIE$uo+ybGqR4b=ptf`C1K13#U`OMFJlAPi0C`*OtZGr9fo{)i%F~HYCYrpKC
zEIAu2t*fhr0-mMzC#mY!akyQ<_&5P2jE8&jwF7Q4)P@#5LC8AoloTAb`ZtP75dVF?
zu$5EQNI?WhgSV0<1?c`TCIVB;Ls<Yp(;I|DXsmZ~!M(C91~=;{$v-Vzv~n*hh<zys
zIvx>~*_EQNIRpHsj%b^4R4?XbU;)H6G9l5Pl>Thz72)<HLI%&@lXQ>y0_uNZd2&-_
zw=22Fg(In%Q%m$AIW@oe9Qe*a6@jGV{AbP)wot;QS-BenZOla@M$U8*Q(GErIVqre
z-{-CA?%xxBVzlml$Y|88R)rEkXvMtYME>L+$+`3b*M*G{co`jsUtVFA$rEev)q*uJ
z&C|6dD7Nr#kC_u}l5<^Q!Tf%ODK8ppj?{!S(0dNTE02o<u*RA|G8OLMLRGbmn1jfo
z3~m_u!?lC-jiT9_0{q~s$PsW$uyV!AX9_ru+Wy>MbOzPHZBr%(GGL6HABY6}Og>Hv
zjO?W?KdTZ_c67CNlD5MsKQH$s60JD37FIqk+xIhfm7ntRDJzJqP&`y6JLu4e#Y6`v
zDJfH=VPLMnb$Y71`h-C^Z(4$df%Rh~z*drCq))%yIG|*=X|BHQt~~QMo#?J00Jt9I
z5VdE14@|9n-N5xydKkIit2L_^u(h$v)hZzH5~U2$D9jyZM&Ez`17PpSEK0!gY*}V{
z(KEi3^cmr<hwb|4%$Z6t?_ccs(;P%C{j}h1Mc}3}uah(|V^4kLD6ruIdZpTV47G|2
zFkRhLX5e2_mBMDp%X5YmLJ&cJ3}Av2Rot#(c56`nSK4_IVnt6=v+p065(ROxUZG0E
z4%n(po~oi`;E4}(*VdQR4N2Zpb({t%0-6E<ks)D4B3oywin1LqO=}fNpkzGQii<=7
zLOh?76Un%UfHJnbtr~jqOjq4J31Qh3z4YflG`-X3nU&{_=T?kDwm?^Tbyt2UK>o|w
z>l8`|0KlyY7N^Eroo5HW!mj>uQ6<@NPWIkY`Vw}+1mdrolBEv{yAcWN#t4@FtdKKP
zZp0Er77KA5OJAgfzKl-H$=CwxuZ`_W%oQb5TUU#T+A&+LW}v24R9+GRj`%%SjF(R-
z^_!Z#MV%jq$SE0~oV^8vwbMkKl+6X5m%az~`}boy=0fw}W4Mgk!g<F{?lm!Nfb!T~
zJgu&)IB`S}y?iSj56DaGvcC-K&QmwFIo{7pj$f|NfqeLDgvO8r(6_COe-hPQ!`>jP
zEpyt8_AEtv97=XZHk(HnNV6D`^qwW>1Aw(v9r@*E`yXQ)D2rEN<%=4<P-}$z$a_~x
zGZ2k|4MjHvf50|8HBHfY$+(_a2<Ulouu^{+E_QY?2+XHwGin0hHMe-qOLXuZ-}HLU
zUr;vKY3BZRh`-*C?YyJg#quNfK2^zy5j3m{a^9Y@r17ulIaa1FSbnt-RstA5|5bt^
zRp0UGfK>)%bKYcBBjlf65S$P(jiy#xUe^DT_s3XwFY1dsAOfjb(&DK{1voV39;?Vx
zofYOrykw9VUNLM(8DWPCdtjhlMQuDP`3w~oEpE=$5Q%*%>e&_dZ8C?5ws|jz84S+}
z0U?UQ64?R(;Gp|mu>&MJTYOm^OBlHX2n?@3^ysNBj?U<pLUyFKkp;P>_ImL)a;<%+
zIom!F{aU{UPletZ@+~~01hU}6h4TL+)5J>Qk>5m|T1=c6Is6Ib-%ki5OEUFuQml^>
z!RZ&=PeSrd%LPMYmrE}Osh$)og}<BmX}<7a@ixrL3NMC!({$g43#p1>p2Ze>C640I
zZx-!!*8=7M`hg;#e7T7Z3&i<m+(wS4niYh;q`9iq7nv(SNYFO{Wa!~9(Ni9kg4q$o
zA*OGJZ^?;2vNU|MJ4$U@@V5c+k6b%=vFm^0fI7UiPZ`K4{{8zLISya%dGN*r|IDxr
zg$$j=wwr5#I4a!VfaAJbepC^zYB<%;g@pB=+;2W!|KjugX+)E;h=4=z?GGF|aL0IV
zRFb1AF9-e8+W`2-8G(bcIpW4Vu*F|}qfu1Qkzfn}ys!FzLa<1pD|6z5BDZf*nzDZj
zpW<@dq69^*Z(Z67C+*E5wzECBi=X)JR40NKH+FIlG33ymj}n5!1P?}h`-_h-FU-7?
z1UcLQ8h+@PH(}fu8ol#+W0TK?aMVrcegQ4fe{RN$D|l>NSSj}P*ghey@^96{`&R~4
z;g|lyqW^h0EVnOw@Oh{rfPo|A28|oUZ_%LN`ivVpH1RfN`Novwz{w|b>)YHkbb|AO
z{mmdzBEX~l_x+3j#LawaBP$5E>rU9AC`|qHdivkZ;YP~8KP!R)?+$O7xdQh9Own^E
zhurh5kl!Ea&hS<b^6p;WQ~k0~{h?p{8g+a)0iei$Ie)qTbW9L1q+=0*4DO5H;A(zD
zC4P8+C&-%5{O!rzP5H}W_PM@6F<K9=`px^PaEeSFs<A<SyLY|>(BJ}jik4N5Vg-B6
zW|`20Wv&0HyoWU%--iv3*}}3&3U-g}z2@|Un%wApzxLf5rHzdnxo3=mc3Wdvviq=Y
z6r8#INU*mB!|U$%1d@IvMD${RjzM}mT#voj{|kyuU&0srY2-e%54GyMzqms5F7N%K
z)aVqmdy8`2`c%|y!5AJP|H7vzW~!#)Hv21%ITQCh2Yu!D_)gPJ{`WYiOlz@!msb`z
z?YH@jkJ<|mi%w<@auYH>Sa(Zv(fHNWJhQpIA_fc#6{22Xp%8V5QbD23Ur=H4^dOPT
z@vhH404}bcn;VFu2BJ3Ax9ouAWOTn9d*c<IuhUa4Ufqj{pJ+Q6=ruZr1}Zv~i6<M6
zn*b)qK(7;#Gj_A5q44tAs?BcO=MN~9?Ua-^T)bWxpPp%Vf}DXDV2mhbR99Dwm8B)L
z-wU*>&aftoUKJYEi?zn49}D#H+h;wH)MQKIYPX5N?~!?ah-rGpwHRXtAMm{&UhzJ2
z^Tf3@;xI2bn_K<{8_-@@Xi)7rK_EOh+B<FaJ#76ODZ}S8$wuUyDXOD0DmItF;YRj7
z2l5t7sjsz74R~j)_S)*|u4{N28XCP;F?~5fQ8gdsk9chhXVH+D*0;!1yijSSrKzqO
z8Z~#EW!&B25m5f|x<=Q8s=(FQLrS@*@Jl&IE_^#*-+=7w>b~9cS7(b2M4YXyt?aCS
z8eEDV;(sn4<iNmsX1Ci03ys0Rwyg&&B8EAt2GKDwvzG8F6(0v?(vy-b4D;QuZw@7q
zu38E+Sh1%$?VT<z@TP%?OBU08U&M>R<glP3-P@J;?zY$5B#U+KcAL%KurV}(B5DQ(
zgC@Is2P${Gu7svzdIf3ep`|KoE6x{NJf7(l-}Z}1c3;p2U;M{u=SdqpUW;#EELLRJ
z?dtf{5($tHm;0a2GnI2z7g`m4x5@-J;ecCx%rJ~3%x4c7aBrSG)*1{$s_z`OeQ2J3
zd;Y%nC$px`zd?AP1fpU={2!vLQ>@=7r|6ESGtDimKThwKQmQ^~<FiBx0R8(#RAcQi
ziShYce#i}$ceG?f0;8j$6~HsUysoXsyE^s@j<FFcMja-LJCQt#1?H^Q%jCr5V(rWZ
zt(ZEMB@q89TNx?2Qk4>V2DzfVv1?d(m79uIvVKK%b+e+cr|+?2Vat@peg5IHU{7N)
z-+9>IH|-utNl87hpOa-%vECy9(y{SimY<w%W2)9f1iYySR5P=(xbb64LV$a<HIcA?
zbM&H`+1THAVxmqy$rGdiN~*e005#ea5fU&VX`uGYkmTW(e#Z1$P?+N7y4SetgA@)<
zMt#?Qd&}mpKwbBdQ3|=d;|}B3!OHXVl3r_T>kEM4_8Y_ZwDKSl@eB-oyxzB$Os)R?
z)t$Z7hW8Gd*)ET_R(HN2`g*&Nv@mBP4tqIn_ie0=jV$Z-PQNUr@rE_6@S*uxMwk*H
ze!%$O=^n?uk9#=$!AQaTXp@zZfxO;`bnl+7=4^0`;Nj_cy4-;UP*O^K6Y1POWE%@>
zpSNiUfL5PdNYDo|fSQ3$Q9;2cBiR^e6w1qjHX7%M%UoSr`t&|xsIH#k;cRhqbR_?n
z`+O{KhqalMnVS1Sxi+xl7M%qL=$4W9dw2ngo2}d$xy>02j|@|4r6bA6$QU)P+Z9Ph
zMnxIG^uhpS)25dem**FkZ!>wQ*e(Nvas@05_FBbdHU8CZ0RU>1%RBwHlan&G#&dB*
zAVQ)=RK8rcqwk$OJb+7HhhTGHY0(m$015Cpc4lKE^D4EjqJj_uM}|Ct@#%T20F9g5
z0~52<C+2N$L%59fowN4aP$Q!hr>8wxrw3-87r8(|0uc%Q?kTa_>iyeZZ;FeHL)SN-
zE-TD|z}5Nw#Kc6Ixp5hJS<Y+gcE=AHKzw{YIyz=bYHCze)T^ylN!8|NeVjmmkd*9{
zlt+p=uW7wQK+bP@S=B>VPjhkclu9e4WqTC;2U(%p@#e=Jte{rjGE~3|HuNgqD+n7W
zr~U8t7zGRP>y66V+EA+FJ~{v(z+h=ihzI}+8wDU1>;nMao-n+N)3UR5l$30~)lhc&
za18-yH$6Rn!0fiSv^+IVij3R=6IxC>EvH(@JLnB0-6UBxHa2E%xa*z56zdB|16LIv
zxw!*q$9LrCmnYQ?*e^W|79LPU9n;d%;(y&wzs2azeY(oYUMw9<AUq-fh~-NT!ko?J
z@y;%#%2)}5B?Y3xW#p%rIPuE2^ec*J!^H}l+0?m8Dk^}RPyG8xM0igNyEuD4q|y=+
zMq`$Y8TGeZCa*H5)`7nt@!YrgORcQRvoa8}xps2oFvt4P`S}U>=BhJP?>ObmeI~1#
z5B+irmd<`PZ;o4`w>Xcv4Q<XDvLy7A^h)eOgE|hmub^5J<PJGJUyX5I?Cqn~EwNI0
z$y*-&Fa+e;!buE&anm)Q?UxmZ70zqa85;+pGc%*^?Dx@LkHWPzwLIlsQ%Ef@F86~i
zrvDC(Ba;2u9iEhu!pw;WT|;*XakWcBM;ByqO-Zt#ynlwHJwXFJHU}$Hya)H+*y#K=
z+u&_DgYNmVZF4|>am1kmbLIuBN$p&8T?<p%X0ug{f!_NRO6=1oo~A5x3qo5;e1|{=
z;y)X(_!YXe%q)aRU&4RqD;M8OKGGoBk6gitle^8w=Qw<RkLR7CJ3^DuIOnJ+Kabnn
z2sg<P-bOsgt1SSu*xE>}5V`+&VA}kX_Bj&qxwOmo%I!<(lg5}!mt9-51c#({C+cku
zc5QHa`UL4ez1o48p}h{Oc;!`4Q4t$vPdO^_{ruv*Sd|9_gmV7|=})O5`CbBsE^Y4u
z806&<yus&(e@n@#28|d?%SgLfdI~@S@DZ^DZA_a4f$nt68ef01`t&iY5{7{5D7H7B
zqK<bzw)G_Kc8{qR8vgn&EX+<!T$I$btovPE#mmZK&e+<R_IYOnhD~^Qy#8txRLsp`
zbq7kAyP3No0@}M`78lOc)%6jsY}1z`w#B@)zzgAGBTmV{;fFSC@Lmr67~3E&K>(l$
z#C-Qnett<4xre}1^E()6ybmyV_=nn`2q6CJO{HM{)i|ogCTO6~gx+8KCceJH-<xtj
z$Ok0C`PYmsG?HI(P7WCtK3jd?7#Am)&-QZjgAY_JHT8Jj=S6p@=iC&QB3S?TX$wKu
zQ`i<P+He_Qj~l3`^0%s=-%l=kkMNP4hnvDy(!VdWQl@L=@vNw<aPixYk7M=!rKF$-
z)rBBK2a||a2j7=JtAY6+9Q=^Go0*sx3bGW)oBQJwm-hk(pj6CN(pBXga1PC_o&6J4
z_IDR!r`H(?P+4icYWq7dk85$=F+65PQ#)d4f7+lqQ6?pmd0SRQgp@-7<(ngUJ+q!!
zn_9+aJer?egGIu^e(!Y4MO}@#wXxrr6clzIv)mtCyvD}*!2Q?iSQ~>cw>q{XBX?D)
zkFK{<l-tC;lU99jgV16XVMMMs<Knv@G2sA<i!8xtj%}8b{$B&4RJr_d5uShbbaj{9
zUq$!`FL&pD+3&Tgmdz0eI!ef>ESfEc|B=OdPvST_{&UjGLktk2Od9iwUPo)U-TfSL
z7r99aA0E)atkPtlNC<!V9sj)*+UOMq2EOM9FjQJuSoe6YEXt<ULi`_dZy6O=w5@G!
z+yVp(!3mHMf(3Vo;qER87Th7YB@o<Q6Wrb1-QC@SyTi9~PM_2F-tXT2#_0aj8TF%z
z6r0+6uQk`4&->0*B)o;Wv%2@Sc$8`thc>TqdshTtG0FI@&t}jteA5atxJ)(`!l<!@
zgj^wVKEBfcdI6h@aGgkWcY)asRZeNU-St?NUpwtSu1^}3mO)s?K-}kc+B*wN%Zhj8
zrI$SSC?LAMWI=@Hl`ttuPp_wSXak}e1772v{6?_p?d>J|F8qv;aBr^c{wl?gRG7~h
z<S(Q13Ni-5_P0mB(hGz6Q=3q7_HD4?SJ6r@jJ%LxLgY{+B?q4S95aF2*>%<2byaUb
z8Z*^zU}IvueIIllHuHdIa7*Wyl<dfNWhxvZ=B_K1!u7b-Q<kU95XbqMt`_GhXA<ML
zxahDsNinex9}*?7DZ@nIVZ+|Rf7#vUQ6t#N(j9Ftfh^B&3La;F*wjc?9nQyuhg;hd
z2AjjR3w(c#UE$_0{aEs6W4*D1dW^CWrfcOw$Oo~?eCdAR!Sqqkt7w6au_$(jPgO{W
zZ~^gWQK}u6cuOG1)7gj>9v&;M8Vluu<E1KUDDIxf7YF&fjXT*Rrq<P2PV!im({Cc^
zm=70oX*-#Gugw*y1SdPevyq{c8Pr!{zh4nYKBQ$SL}cBpm*2;5%5i{t<@BAY^mQ%w
zuKQ_bMc(8UnhEhge$04dLE$x7h%_}pU<n}Q?FBqCD@G0xI82q%?c?Ckl($LOuU)Us
zg@((g|M>A`J;z=|yI(%irSwCEhsk_O)*yx5-(oq6@zV7HRX4SW$o>|XN!<s7<}Rg^
z&=Eb#&-U2d>O$Xx3fgPBN!@ic?@V0T0%`x^@rT4Sk_gUNgEvAH_u3{SI|XbO7m;MD
zYmXs@jM&Max+X>l#Qagygr1PFHa~|}vE>;Mm!1t)>bF_zzeIq(opaNkY3WHyYF-|Q
zk?JPiZtp_PlbT2-#((V1G%0CjBrU~G^3GWB3wbcB>`2%WTk^G=9Hqr|K2Y_F$lntF
z39+#O>1e83F#JIo=f#%K&{lxyrz72E>x9CkS_>ogcPi!&WI?~gMCF`~>=o7+^+wYp
zr>YKxzDW}l<rH4Lp<g=;;80Mk&C9j5Fx9&p9gSV%6AhIY@<D|JJIELjm*RO_3Sufd
z`_`v8%mq}ctYO^tv9Tl5m3Jy9pLxk+M~tP<7D`kM8yZV1;*q9kD``1i&yrAtEpsj6
zou5A9wu%$@-zQ4uTj*%kkj6(`1`lmrPEMZ1FK1?xcNy3ynNKq<n9L6hTW+n`W7sQ=
zF!_ba4ygv2n#2>t^qHA&N}k(xY5E9DYmIXh*V59~1QAY7$=LRIG^gSiz)6<coCrim
zii(O3Ci64>QPq%I<ax3t9k(7__oT)G&3qAsu_!w-BC4d4nTUTpzH1GP#g47hDKm_-
z=Paf5ze`KP#+tuuG||qMxw^{Bj};XEEDtor@XgC9WFOHj7jwwCL7Y^3TwuurID$}J
z*zjz-kk$2s(*^%W{aq_qLHl}X_0w~do_PyBA)=^n)Kzo3$jGa5FjuA5NDGQm{UG<J
zO?YI2&5n6g4#R%(qLLLtMsb~P{vs+WW}vsh%3ey}e-mP7cf%f0X;N!Hw7;r6(`;-@
zw87cj{uJ^-uW-XA(Uv*WQq17V3!|s}7!?tL)kAhpH#yijYMY7zaiUk*5t`Fpbq~Me
zSkcdYxBO?9=w$I3;dYfOYN%LLYoCHbDADlHwyr3_pQA^8w^4z)rE0sB4&(WHx0&F9
zyw`fic^rqZP~*43zR0P(=o^(W2{ivj?FPrGHrMfk0+Tws2oceNW)?kzEgxb2)3}ui
z_pQ#6K@93gjKcg}tOiq9rdRxq@l(?z3Cf~k_GsKEF*Qa_W^Rqqn{XCC_~9V~*EYW<
z2Ci9kvgr*Di^+AvAslS2On*PW0<}MIP+e7FMF}${mZ+-5$(fz=ZGom&UVmNdC2dUq
zOo?NZlXR4~@DM8-TiDM}&`)ufjXJ%H!UB_ZJ^ewAY7EHEwlfT8E8i&78Fq5uIQi_%
z@h)Qf%AR<yl1)iLDW!>+xwFISaS(ls+WGr;AACG_c!(nG=ncKRdf8T{ojCqb!o!u(
zo^MFTlFn$b#MD8JX8T|#w({qBB7HXY-o74KC}5&nXOistbl!*F8IzblDdG}i==4G}
zEHZt4Q9z18o2YmzL?B?%9T!($FZ;5jyuSXo*xSaDu6M#38ubfKpk^&wTt8=F|CDss
z#9%4#B6&@7YapIZGV0H(7oQDgo2oY$s3DIT@`!_8e_T{9J{DnhaaRw&U)9yIr<Uq2
z9h&p5WhKmG<1&=key?27&+IC2BIE>$TBp0;DG9}kP+d$;hDOCMtE>FW3lKFjwT}SR
zHdGujkUXA5`P9bGq`G~gkX6j6E2t2h?^FIQ_|)SQ#mwBOUV6@RpN^NAoIJBM-F>p%
zdid17h)TLrS}@5Y@djcqB2eJHz^{BB@%2Ge`XZ+W!qX%x3lkI5d2%jmfG4B6!^$rF
zOTp_Tb)`!VCR`kxv9XbZ5zQPhyyy`exm-;1vf};o^UL2MH1?*G#1(qmG%;H?7t>CC
ztYCFo#b6E-S+}faSK18NlAPKpuv;HGeVMWG+y_L<5|o}~91RCE)dh9+wX2)}uZa*E
zy%Pwh?faw!3lq&itEor#&}mDWd(nJxn}cR^=KlMJayB1~l21v*K`r;T<KvS*_`cnh
zq$dt-aj<cKe`x%2<_phi3xj{9XAe`b!Fvhq`mjYQvc=6fUQ#BbN@2}-A_z-W>X)Ee
zF)^tU<Sz47<)A=sXiXM3@fp-gL_@XTYh9dvIC^gd>Ac-dh>v%ET~!|R;f1(-2FRjp
zos3YcRHdYzIV^!!2yw^OTJ0}gN9f>TU##dGkLKBer1c%doz|F>bA7t$7bfC$R>W*1
zoVmNMk@!6(2j5Fw$$qxUgc2+yJ;USUE)QZNl4c95HDkvjF7>w}Em^u6#HS}{x;S#3
zHC!+r1r<Mpq!l4c2Rr{D=^j^gozW?1$jFF)d31uOkkVICX+lA1>N(L4b(0u=;n&S_
z6ysbzsCbsU6GS562i_*VMvmDz7?k-TR-vDtyQDPtOwt8RX5p=@j;9DL1~nULa4RYT
zD^8gLhbvFf7QY1&?C4x};F+M1)FVOUPf_jzZ~GJ2uF*DeaCY_5<%g;GCrka98{JLB
z6<&_-)>b14X{_dTN$Wnlkr*4@LxJip$PU-B8(Y%%;|ou1tZoP{XNrwqJS5+#_D^>k
zknuUb7mBZSS?Ld^5Q{qKwMC2&p%RmM4Qr?o_$fR(`pcyI>{4DxBL>;pRwI2kI9u-K
zt5YOKW@ZH!7a7_2T4sN)Cfw>kPP+s42PzEyFrM;*n>(#CnBOIvZIOT*^(PqTY<9LS
zE4Pz6lB%M=(#tivZGO48k?USo{#eFPqrL|5Td(w+qkcuII7=Kl?4#6M<e!IibhMNO
z`T69;f*_Irqp;LBWf{}2sR4OJ2?IH%1qaS?<(gx58}sH1RO1TH%ZykKeqC!M0(K=}
z&<{P4{%q&`^q7@}N7_<FP0JH4BGX6h^9WK)EZ~E<ZmEF7(;=QqyCy|Np3IJ#zEdtt
z>e@>CyMk+<O{LamN*(<ki&LNxWnwCsuR?h4laXm?xU~tAGgEfq^>+Rn?n6}nGMf`e
z-bHXry`F$|ShQ#q1R8*Vs}B9`_xMf<Q?E?a^*^(FwB(0;yQ|O1sj1C8*zQ3KN$x~W
zEGqREWA~-R=2aW(C*^liQtr~R;dD3<>g^TT-L2qVb|$?o&5Ry2upt!)VqzW6km-&#
zfP0gd3kG1kV}0u?rj=jO*Jp5ZW`34IC)Uh|0+Gcti9U#v*R(H6OGj-H(`aMH1plsQ
z49Rm?vLjYc3>wCYU)XY&6$Z;HcYQV0gM$*<P#Uq~9}BY!gRw}j_u72rz;X{w&!}|1
zqRMI<%+1r)XtL8*5>l(GinjCwYl&87{i~<QV4Cw66*e})6lG*zt^HV5x3*@!I)s7!
zk^P7vDJhvyN%oXDH`n%3y=>a%ZhP1{#QX>Up5drrOJa^YF<+V8REy+p3`)w^abbtZ
zi2Lh44o8=V;TNoF{7%(}!&5TufdOk#yT6_YHF$Z=e=kY1oxKPxB$tee7jPC6*=}=Q
zkqr-DpzFWkK_`NR7NYP#t_DxSwYExETM)RL{dwx+fyI)|_jgohqoXQ~U!$M<jl)Yq
zZ>Oz?kH_%ya!pv-oSdXDn)w=QSQ<WjAk%7aRDQ2zpS~tTL|b;@D*B7i7vt9kKCZ=d
zsj`-o!F+6(o$XD~9Hw4+Q~gOnb@ex8iP^B7Sw0S(vED+70ddiR?EKtgOipsTv<P0I
zx*)>AEnWAdrcMJJFe2$x-@-Y3Lpoz2?6a(OyLF=sC@9Ei{CZ$3H>U=YJz83t*z$ur
z`qmP8e0A2OHxugWx;=LU*to1CmrZD%eP*k=F3oTG$<|JpNITa~i!(PjJB94cNKUDj
zY<>F7C?eE<Cx7f3`m=jsZC`$yqc%O=tyN*Q)j1I`K8&%C+%B*jkT57>yE|DxB&Z<~
zC_)kH@rfM!C&exLqgrINV!le#y<KNQX6EKue<Dbv8hxC$`GJxpAp7%XAUoGKh1aTo
zfCux>wuB%;jggiv0*fH<nypSf<Ak1@a(yk{NKL8vu}~{Y%vX%QV2Iq_1Ut(`{4X0C
zl_jvHdBS6W*AGoUU*G`IYssT|BCjt#A->ybZL08S8z6|U-S0{N>Nq4%$*MNm{nnh5
zb{SIqTOZRkpIM>)L*XG&F$MWK-xDX%3AcO%2x5*3{Gb485T2*ypZUB+Ua^jtpm-nS
zB6Lmsb;7kDzH923>)es)IDJfZ6$yP6^3OM?X3}BE;9qj4J=2aNs-7|Yr~j=9&XC>o
z1d~&nL+_8J^{QtoKHIxVD`KyI{*I;PVP*72xReUGY7n{claK%Sq-O8`TH8XKU;IDY
z@cxr6@7Cf!$TgM>KA#s^@Q3qB0+!sbl1#&6V}VFBy*#y|<iEv;2+;kYHnPwq=4uRn
z_5FKcK<X)q02dZ0y+Dg8d|1va%+0-+D{lkbK4?K?DT)Xna{eJ4EP|-0B$h?pz)T+}
zYC$&k(#t)buTnP8x%(?3OnZ8AbUUTkv$!-c8jmBE!v2#m^Wb+?fgq)vRaLOBbH~=+
z3A9YeBRqW7!qn<Xn^Muj+1u5U_*{RhC4R;)tICBJZEq#0<|=lpV02dDFQxo%j()Y9
z^zQj$$tF#GTU}o|#V`2!Rp%c2;zdNq!h#SRE9-Xwm+v>!VAxbMnWtSG&IC8zJm3EO
zd~=g~)ZYLDk}$ZxNV+9X>Qb8tjNRs90jPI5e|vj6XYmvf)5_Y?R=vqe-BIvmGQWO&
z2-m<1dV1a8TM|H$NT@o<WO?4_GBq<DbQV{YpPO5|i%v^Rt6kB#G}zKH={64L?Y6BD
zTmaj*pAkvk;y8`dxXrn24?s5qOdon`P20bq`(|L)YW}+sR#+0v;4LN@3v(G8+xSo-
zzxAq0XxvUSfa?TtGp&xjv~RSt3<;la+Z{CGJ;Nh<zO9AEFHTi?O^SvVFkplM>f>eK
znHjFRDzmebv!{dd+Dkf8HnIG=5BEr6Qfa)z#0y?UKI;twmx;W6gDv_1kMfdgr`L{-
zo&d1|)4{r`gow*za5XZLmA9cb(;nz|zuGkRed`J})|BPce6j?Boi@4jD}$2C^6Hd@
zUl`We+t`*Pd2|a)%RYX(n}ww&|No+^T)FT=GOuwVPM5Rw=T)+xvb@Elct)?KuQ%N_
zJ^hxA{{GM=rtUzmK(&gCf!}Jxiz@*ChBqL1rd&TOGM#E*G_b?iB`O{R(lD3*@P#?*
zjlR)m!h2qOWt~tb=?W4Ux7^$}KxW7?)U#9grb$8qDJUvhIw)#u<3puO>!@2j{Vs42
zAd|2a4a6>Me=0&T$;6H#H#ZG1e09N*s!j5Kd%0}Ilvzl7jQ#vf;fIS#0Evn9wUY4@
zZXNXMO_K4td>LB&SePc<+ui+r0llk$zJIfz?#mi>ru3;siOXk2yK}jvii!$5sM!2I
z8eBCJU(BTCm4`dW`B8lnM_w(dgE@3J7|Hp}pk3wj?O!fe+dbP`B@_tudK{AIcB-mz
zdmLQ6q?mTH?E))VDwu`!zpc|A?L|d<nl;srgJa^(U$HaD3TI6vFQ~&bx3_;?gauQ<
zYu~g$I;94JcBcw0i^*W24E+r-85tww=;-?`g$-J-n4~CuCdS8;o1TO5%WQEFn3z}(
zM*d<sUYL}Kr1+3q#IBA7Pv-yvq?M5=;B;61yVUsVZQT~*>X$D#bp1##UuG1~m{yHY
zc64+U!7sskWQcDX85w^yGX5r+ghP1oj$E4Jt8sRONc+?dL5<^eDf1}6|IoXlv?@P7
z0XKLEJt+BVrJUf@N_F008F^q-LO4s=<-_O!NkT;h+g#BHdA>Kyks`*|=h*o87F#hv
zBJdD*(n^z6MQN#=hRYX&$%M}s_Q?^QSjbOpkFF9pYN~%A)DO5*zkJEozgTG~%_c5h
z=7Sg=8L8kTq-3mCYo*-=t}v{}cleCd;_UKr4GoQci?%nK3yVIkXDIL=)YOD}^H}Fz
zc>h4#Yd2SmCj?NR_D!yWqI0U2|J4tK!kQY#woWr!Zc583B|AGdUZzJ)7zpTc-eea{
z!$=-ptrSrA5F_N#=!!tL^O8F287{86TI>o9cY`yGM`<ZGe<$^~rQzY>j#qei4M-k9
z8j+R$EzseLAXxb^zoWhV%a=9R82X=XSk%aw0HChHl#<)Le=jTiqpzn&>LSr{WmJ(D
za9~s@RD^1U_y4Sle5^_oiHy#)-w@N+OSf7pj}^z~NV2Zm1aQy(zLUfuBnPN;1_p4{
z!4A|B9mkA<($YvnEP#RDp+~5uoV?iwm~z{en{=POlu&SgzGUI(f+bdh%JQeS`Z5M7
z|1me8P3hEk_6Jx*$OFkL<%Zt#CsJrD*-F~!r`4=PAou*0J;IySuT6=YJ|4A#5!sOC
zjDlUk%68<z`igyJtt%X#aaB)WzkdJ`7SeJUen<kE;kQk5Z0w}SCfgofmN6I$>!m*z
z2T>817wb7?V!i$(Y+$xZ68i>>XrvI>xEi<&6=_T4E8?I~WVXE<*8<p+je`jHp7&xR
zZ|X%=D-epbc-_N?*4ExPh-^{{OD{HDTGn^P9<R->u4<F=y8KQ;+nY9jUTy;iyy(-<
zHGpKbocH2h;)X$!SD8~&I18UNd)4>qIq$!94cY7dd{fV?i-zHGg|0RZ99>HAs86ul
zeFX!x5${3Ey%V7){=J_sDyz4E9OW4T#Xlzk6Qfv#PL!r67<KFT3NTjZ+d`emK$^)(
zR+sF&CchF(QscbG6SMuUw;-OaTXHT<{lC*Q=!f$w?GJ{{DfsDNkHwuV=U^{@d?)fW
z`Ff_QsYh?<m{q*&>U(<70}LXflX8&{)V!xU2J`o$l$4-&I%76I9x(|tk%OfU=;Gdp
z=Z~B0-+cvo2M4i;F$kxZbQ1xfH8)nfX@nET#a)+vwA1?7umwZ~7@h2-0U%0zH2;CJ
zDi0kcvNF(ID=sGsyppmEal%eY3<n}NSqPti?<b1IhR3(`^pxxjVFQ~$teu%rGchtk
z-jY4cL4-Owv}0EjA|iZ|Mu4ZcZ-Z3e7$1^I=KWQfY3{Z4gikXGC?+t?9pY255(dU<
zh){d`tKr@4o15B?`=*V(V#FAR55J>;L>suHg^i6}a_k4C=FQcmh-y=Q^ac_$j{}*E
zg3Q(Jd<N-4)VZzQxPqd!^-1AUeOlHW5C6kUsNO9p?4{n;;J%W=UGj$)4u^$-wXaw4
zpH=@~vc;?zgaX;aUy<?JuFjmsW>XJ=XyqEi*uK{Ca36SyXwGAIGk=U@m`?RlQz%HK
z(Y8gv=%cxon|U4_ETqTm2nHXY=iJ4<fD82*zn=)PseXymgdDct&k%G~wb;(imv3Ho
zV-imP&b6<c1cF9`?T*@T%UW(O-(-<G({IJw*_S$fok?|<Sq+2aVIn}aE>tNIq4Exs
zC4)qyhwi@g4J9^wZ?Z5pZe0qow|drN56FILsr8-fmoL`9pi?$hT!hC-LzCnEzAl)Q
z$8~)>$ADB?T%J#7w-bDR7^rHZ?Pr$@Kl^m=myAOS)F1U<TM|o4Pmor^e)u5XUYH6z
zY{hlS4gvY1jFkf~awcp6co1^((lECzK2ZE}pCy05f@i4m3ps{qyK)H}>iYIPWT-7Z
zK7oj6royiOq4TC&=n=KdHM(AEsGiiNGEF$6i79I+@$qzh2FQ~ViEp1RpdcsKt)yhe
z1l!v`y=JASRQ|1A6|Gqz0*@Vv{0X*1f1338l*wpSW&Zl6NRu;W&h~cDm4=4KFl%L-
z{oUQi(B}JePK+uJX4Y!E+XIUW!&^pdmwf|A#}0|Z9%kmzf4ph9b4Xx!8phKSI8+{6
z&{Fs(Y;F{!ZQ;m6k^bG=@;~*u+`doGFf2NrLx6&U_5^9!qavdz6F~SNemvo=23*`-
zyPAJ~(J4PK!qTbv;G;gCqVJ^{mTI7SZ2z8y{>zSo-p3_$Vjv5Z{$Rnw+i+J2dK7s3
zr0(&k=X5&86r-xDvQt6Y0l~56PyDRpocH%K$z;yXcmw~>D(!1qOvgR8i1H0t{!`zS
z0f~bwH=MQus?&e)11-SqhKMYwWxm=@n~^>!N_^`dLIUj@^=Ch`#6&MfC!epaX6KHQ
zoO86hi!UExgvLg)cXr68>USK9$7)W$c*)D`)L#6e)!Ms4^Uc9+b@iv;jpjwc#&_<(
zk;fBu?%o=)T^&PHv^9A0TTFBTEu<FzK`(wvMTs)u9Xb3}5qWw35F)6Mq2-;^?_EP*
z45dhlMn7K91bk1UW;C6tPW<p{O<VP@PvNttxR_&5%FE`N5%Zr>T!<<pNmx#YBRgd+
z54+L7AAGKcP!heoh!X}JBN8meg)yZ?C8XGfcay?rOWQ@{<xfFrC@05q^*pm+#%8s8
z1XSXfq_?-4pO1HJl#wnDd9vM?LWeC);%63)vM2gn#+`G8x~TYFNwt-`WR&Ed^I6A=
zYQsU(jaxr|7(LEc9g6k7p?V#OqAN^5xDESGlKx(;d%*#r1FT>^uC`ruA-GzFKqzQ1
zUK<R`!`B30LS`+Hh7_nH7V~aExQnD?SX^qiT;;?Ez$P$%-sHulhA{W1PYu~c7Q^E*
z30!tw-{A$@gKBL!n3=c=JSV2p>cYF88^Sd#Ld7PJR;TapSFywE9F*fZOspl%G>?Lc
zK}`%+L09y1zD~}y4JxV(eivL#O?hfc`VAdJGYj!upmA-B_OljQHB_*{=m5y)g%%l_
z+TGXVzb-8~R9aElEXms0!Ss@il8>d!6etB}Ov50lGd9&*Gg*gu_dzb+Q|qvn+h_R<
z{2f41AaX`(6OQlpH>O9A($!c$F-Ria8xUMbmux+(fQsPxc*6YBRi{ash;Sa=T|-T&
z#Oi!iQ+@KQ(HXDP32(}fcBN(JcX<8a%X9*HUJ)ueSH8T`T!TIz{WotGv@`U57TsC(
z!*7#Gc9Tf<A9!tQu3S+L0{C1>1$x@-wl*g&DwU`o8%LXs+u!b8?F1;$<e0h9P8Mj$
zC~7)CSc}x{;}&AIfxRJ%&JHrLs?8P%mmGn-lguv-0iyrT@NK|ijHyb6WuMQ+%M82{
z6dH<+_E+ic4K5Y7ErG5)lL-kIJgx`EEFnk`6*dqoj7Gmr871q&ET7fnfzjh&p<eg-
z{5LoE{cM3VBqOWp`e5Dt9KY+HheIM|4-1=6OX030z`iiIFoOkn^lreUR4QDuIyt26
zzd?j_N(e=%Mt{&&-Bs={)f`TbZ5>xr_M2?_RTW-}lRpJw1-}bj2WCc&Ts$FPgu1&Y
zC?9rgeL#Dl{jQl_Sw#4l#0??2-N!q81Pr+1w?v`QVFLy>5IN6QK_IK5q@>`o18<1q
z&gvdHEiF9*!{+K<v(99b>y$wk94rjsjH#ipx+9k=6E+R|i<wbV4=F}TCTt^}$Hv+C
zKL86JC%)=*jf}#Dbc#2~pR`#oJ;TLwr=y`K+vWc7!Ha@Y(vH+TAvvz?VN|Ue9`^IS
zKLTLLVLhwBNG9ZZ=D%2lENNqNDk97SOuoND?VL@bl$HDvO+L>qx$k2~k@l{xu6olW
z0(YC@L<RH?`e0!u>AIi=qJY1@fZLVI=E0v&FCuc}!WpD67$dY#uU-Co$)JEyPS_B5
z86w96LEyS7(3~G`uC?5F_7L#l8NU2sPU)~=u6Myil5-g2YB<#VuE{~d#oA7iBxOii
zbl~-a%;+%rv;s^SE78-(6UDsSXk+&5l%H-u2B^1g3y#`#$e%4P%Zxq%nxq|jyF1e-
z1P`FN{4vg@F(UA$m&6Gl{kjPUPsS8`PRww*T+;O8bZUIum0vCsObbiJz@R7aWMG9+
zP@XDRNKf}@dJ!fvs*qF5jaXEpDkdhEYnNgAQV`)u8$aWt%_3f-``Nmn87MVX=qekv
z`Z$xStE*F4K`N|+qX;vfnOTe!a=Q4;vWA|Ft!h)&+)PVfku9W4z0xV~$gjfg34-Gc
zPzAuPQ_UBGh1m|g0ho+EI;Q}Kmr3QVq5siaf{?DZx2AysY59SyP<04t$>A^!hA+=o
zkK<GrdbG^EoQv%2TsN#+>u#M>tTrD71tp7_Yb3u<tnA}cQ~NLL@6vamwcV-%pcK5O
z>1~p5<a3|I^=w~zLc~2CZ-5BVJ=@h6bJ7|1t7tscAAx=G^D(s<1{!dAch@)m9xjlj
z)S9=GlcSUiRvQJHEYk20Xx%+xZWo~-jXqk&DJMO-PGLt}K4r49V*0vpv!3_5D4W}k
z{o5ZZ2eh&WV0_<9LaN61sf$RmS)07~&;6s1W(df0*-T;-kv+0zM^>oJ2d`3~G7h!P
z{aZ%x!<_Te3ylg}EH?h7V<~?{sbP=M7I2kHRMrTylqLHv<UkB8jL^Fm5r)z!)8pg)
zTc<R*C&>a2d-UaJATVX5lzeXOQ+BFtsFi&kPiRa5OFdJN@Y{<Rdi|!`C_AsAXCTB+
znw0I!>p#{%AC-R2u3|l5rEz;a7BrQ!FhgHiawIT%^W($AYgY7v8}Wmv((n(C9a+uA
zzf0AoSz4EXLdmpCw7#JSCfY8M3VH#i8SR@qWcXJ6Dmeza2arzd8}UQRaxQ^I0qgj<
zn3b#@MY5l8zcaiCDe!oud35i}UvDh5togp=mnTD^xhZ>AsofhN2-`0`a~95BRA!cU
zUS_9|j)6gIx_0QJpdy>+yU>UTQPF{)PS2>jm6Wt{(#b<Y@;4gkpW@@E$#g$4a6P`o
z4wGdUFM}!4GJKg)U-_2kXu}iv$;UcQ%7;4Gse**>C1LNc(hQ?h&ZA#=542IHL@6sA
zf2-e)ZP&aFS<%(gvpVk0{nIH_DdI*%d-^?n-0Sz{0IybS-}oh&IK6~AyL5N|V4u74
z`20NaHI)w?Lt)VzsJXM8q$hYTDY%HuHA&Xo+Q&TaZ~ZyhVBy(-qRJeHo}rI7Ffj1z
zlFW)zgF7vcN2jN+uW^8}{cV1E{_64AbBeI5>l$#2)Cl>CmTH%p!ID*0v{>)F*=h%c
z#zZ(i{`x+!$;w(hsEra96$Ln)X1=n9hACjeK#pH>e@&B@T}$%p^XFOZz)!zrx`ET7
zUP3C3CAMgkIi*3QnCJ@%L?+%Ror2Er+C^JkxXJdsGTJ~osS?)kYiipUw#-aJ_1KEC
zHEGHOP35laJY9gR=g~vn&=&0(&LjOzomf91K=Iej`Fr&buYMD?hS=Nd*i_$QCatow
z<>lqjCG(J6O6C{ze>fEA?PDZnp4Q-W7g*z$YBK{q5_40%yfYasUW;0_-OZLs*0Ceu
zp_7vU+zowK1E*E>#-Zb6TaeJrO4emiy_CEm{3*fpOh{&}UNxe?DDxI037pVJv#;`e
z3z#GV&S3pvS2ED9@3$(H+A8{<uhI1Jqo!T%*7Q-gp&^5Y_BM+o)tu>}pR&c``CMfP
zP>V-)`E>t$gPwDLkJgr{|J(;QQH-<F6`CB`0oIPtuxL_tTT5j+-oXLCp)E3A`)Co0
z_%pWHxAwRIbBtdS3*3O)DL!@Zy0<UL#-`I9vmfc4mWE#7c<LoaRnPD{!^Qlb-*e;G
zew&&1;7(k-_@h9;sfiZif(T*b`sa#WUYBKol;P7o`my&lrWtpc%@UJId`?o(%bQ88
zpV}DZJ5RteQx5YF{%-d79h9*GfaCu&Dev|M4xOLw3Ff#Z=D5evzE9w>vH0}<)c}M1
zAGrU2h2;PB_5aqp{-2;Z_$&Xz!9dT{IkCWT4A;PlfylN49ZuWZ!#K3BlffN_0(VcQ
zI1LZvfGz*?=i?@=ky5-}KxYBM-R}H&M+aLau>F&3;QczDJ;$B!KRX`WSN<a&e<6~e
zpMRoR(*g)`%ZS-!vOs)%Jih=F1@jwP9>e;s=aT5>QoW2c^a)L0e}Mjn4Z^12li_?{
zv;^0?PZqp<Z1fAxo3KGXSsMTH0+^_0jp*_gEmYHYyYF6TURucmtbGDJ%`ac>8`ed|
zFeYI_NSI0Q8VFx3YcI0P{DZ_VKU?}9((u!->#c;S=<y}{jbDWOqur)geqf-;O)a`Q
zV9{zL{U*EH93MYqq*KMv#nb-Z%@Nca!U7@ZbLB~NQU_F+z&x>b92FI%p_zDu%jL)g
zrH&EwxlY+6#QV&uHn}C$I4r%eW1DF4rpLjKus`5W&Cb>l7~fR24Lr<6uQJzAkO_Ts
z%%2rk@0&MW?n_s`zD5A{aG52cyIazEz>04#O}n&RpPapYVq-&MB*=mUy()79wP5g|
zZh@(g#91N%;l;8%QgCq6A3h7v_kbi^1==7$kXzl6&%6fxC%}dH%4x8?gs8@G*PPqC
zq~9S4C>tq`eYv^0b&JKI>{T?m+b7mA-4`xc`fG}2EmraN<piAy$i#Wzzrg(k$^;Dg
zx>9UimqL8SS~bcT1w|S+BQFn+;caD*Rx)X;-yte0xMl#JJPwn2W=Y+R6eP4K4c|WZ
zLD`}y%63UgHquF*s=19$4%^t^a+?|)px6PI791M%$Usn8BkA8h75Z2KB6mm06UgId
zH#IulB%m8SRTikzl~~Zh_XQ*m^{PXd=3p~79@sm>Z_)-Ogk*efZ{*yXFB&NLX{5x&
zW=&IGf~Fdv1%RdxMq1jgF_yB$tA2F@v)y&xUfm^6N@5J8kQV7Aeh#O=EP(o_#<>6x
zO3@|<j$$x!$6klDd`tvZ!yaHR9V79bgL}7bi2jk>^EO6QM1tFO)2lIgFkZ3m2)9Xc
z?(q8}8E5L!T@A|&v3+xJ!_aTtqs2PwAZ<{BC#sI^nHGRgS8H8CmNJ9{q5gn{d_$6n
z*Vx5Acv(NbZ~xtq7x?7%IT2B2X2zrIf%Q~Z&1C)@F@8!lAQ2sCuE~O3rn9B;VshaI
zMx9^S8pR~LZdLvd<X`Tgkq-v&Za=Ec%}qEDEA5ZKH6Oa2Q6QMb0#vN;r+NmBFc6Mz
z+GN|F%~sKT!)558&N9t8FrL442)^`kENk!Ju^HNpJBMTx6<L5B1X^mY(Oi#L3g+vp
zybPXSj39Y%Se)=@5UuSXLPwd3O7MROoGx3yD2?FjLd)VPR_RkNEXpa+1VHG?Vb5Pd
zt7z^CWQ(YKJURi|Bn%`{OpUphf&RdEiviONR4%Dx{;Z;`vd;_tv+=WRyHz0h{K@(N
zno(MmKMHZqT3l$$t14EEJ7~fMAV2_Et~wz9nf{qV@d=Of)xY~Hz&`KCOBd7CpGcCl
zob4?TARL@DM>LlqZRE<b3Vzp3SSVk+uC>Jt8H$XKqNdJjln^T^e+$e;(A&><&$F=F
zjE#+lw4W#`D#md*2m!ON!l9$Z;<|kaA82_2ADd*)tgE^PYR(%!6AnoMRta=6gUdT0
z`I>tDxK2$^$7N60XLm}kuD*&|PJoI5)1{Y02alp0n-6WI$a>p0?HwHg(&=M65c$iO
zeq?eva*&L&u(IsVi|*5vHDPFYcpC+}K14O_*ZQ6%|5^{pS>4EJCsNr+nIYM{$_28t
zA>nEr@sxOmFY<YD&P9F<<`19qtE_Z-?UDzzBUSDs7)VY|u6i(Bq@A0a1XEL#isAw1
zLzJ;mLhAYyLEJ3{F#&7wV=Y^spfH@c7=Tp9xo;?mNwO7a;xo8ZHHabeg<5s(rDeW_
zKEq%Kd3hWy=9Hnsg}SL%O>EK82B7x~s3S{_HjE%f{|t&sZ3Y8um&2U)bvL8dHr%^Z
zmRRRY5~l~=!5O32=x9W!{*jBc35d8A^F>7L=4oRDo^_SEd3h^-;2fdUB3ZJ#;t)@M
z2sCuSymNB{^1?ptl?WpjS4C>-^l0l7>5-iUG$=AE>WGQI<<`f?hk-pOdz%mX#OD|6
zgiS9(NB6pv<O}_)SI=;W4(m+cp9OG2mVec{->aA3Jm|VLWMs}N?3dR@UVD-sQNVZ%
zJ58^mPjEmUtWl^C$oGJx1YGVQWPNNS{UqFFnGoMu8*-42YGq~Rd13VRY`(#!EHOVn
zX9wa>0pFl=2SiGsl2~d#M}{?ghWxHMLpapm^DAgp;hUbHmq?5A^YdGjZE!Z)-T6b+
zC_!+*nhDM>$l!p>iumt2!g(Z{ThxC}xSL$Q##`SQOm1>H8b(plr3~qU^XTjpT7eZ8
z?*n!#Fbd7~gis0Up90?7PDMraJkV*p1WO>GnS|G671-hRicqSBCud8RPY)!io~qv@
z4hvV)J@remUUhvUjfF!A10Bp%kPQBLQg6wlZgRMz<@E`SLSFJ9&|-L1vfdHEsj5m~
zQ|1ZFhCJIOuT;5F^PU66uc*S?t3I(9l?9~c?;0CqUFsbP3Hhv)2dj&I0W}GISII@w
z4)p|3f3+v#R6wEyCh3C0!j=>wke@;x0OX%upP*VpspO2>8jqfBD?sRcRYnS}Z*0J4
zoF7_*$Hcf_%<FSZ$@-hkNl=76aNAuyc>e@^UOA`ek=tg)YP>8jX6Wd;-o7akgall?
zrpu-3+4lDB^&Fd&kh7JTr8MD7O&)d>>?mA31c4`JhlKEi-nW-Oov=w<*wRx(moft8
zcp2JLyz~tkS}>1$Bx`FMpm)Mm9Q=3V%otHo^he{3`0??7zR4JTG1dEG`u#E+IGP{`
z{|Bw|N1#0W&di02P(i?z)+`K31_pt~G8MXLJ(KhqyPGo*^YZhFHB?biQStEbfTsjy
z>z9~3j7N)}+nn9;H{NG?SneX&*V{XhM*N0Dnw<@0dwUv?%wf*tXy6_PY#9*&p^LGW
zeXt1k;2%8k&Hm)UFKnbdZffbHU|=WC^CCIVHF(aEE;ezscjgusgCOEv8U5<-)mzIg
zx2{MTs@G?$umgQWAXf&RAOLXQT$OxU?njl8-C+QglCpAE-q;*yDp69(%*hdz%O!I2
zB*qX{i}&YdU(GsNuDma5xD7U0eRzZ(8pUB@T2U#SE%cB}HOOC^V{w?9R45fp^0j!X
zb;#yT)M8atD=(mh($JQ|e~R{g;Y_`LaM|_#Q~r4Hp>+D;R*Y~{4|SDwPlJp50fPfk
zB`owFJJ01_JsJ+jMW~LG=aXPp;l-SefdMwL3kuYj#E$@FN+&$W!Xha)Q+~*sQU$#-
z?@Kk6iJYD1ni`%|Su9D5i^uR*RF#pijrR4AbIOL6-*54`G@h(bcG;CzNTu*Tfn4XE
z%x3G?MmKiDA84SfKq3O7n5V_(F(tb7Wc;W>0r;k~%UL<U9&)&ndF_CE<Be?S6KDl%
z1aAW`Gqcl`Z@$)Umyjr?_*;&J>~WnB;>wv(!4Sg8<S4vHeZ8{##gLGSlatW<&rHy|
z-q!w{`=?-P4*l?<sJteNnVW#2>aYO(2XIP>2{BENIyyiVn)7Py$5*XnSBj3_<mR4r
zcIUyh-Lo|}=eH@H+m>yE(HZ~w+2N4yOuejUaBy>E?X937!e(ejdp1^^mp7wkla=${
zR|^&v98qVdn*ddtXR~uN7$nT^sIVKlooE<`<dqNi_W91H{a9MI7<;;{PfxXdeFV=g
z&j8g`P>{*a&gaE(IaYiy$qaQN#x^(6ohbc4#y7evanymAH)-c!#cgx(LDb0TC@u~3
zv2fK~18peHn~2>QACK7PNSs{6?dr9}3FvD>g%a4W9MMT|NpPwx+*7@Nw{A+B#6F}J
z1Wi;z?s$zSjrX1_D<dBfFAXt1-I)=@sa_rkMBly4O2>jPVQX%3C^}FsTHtlNlL$GG
zs&hanR-uBr`%V*+YW+S@@N3U37Sbp#XgD)yGHX*|@6T5hWnV4y;sx9|*H$rgEuY4~
zc}sOrBSYk`UNOAg9$yQkhKhTZrYamlwqvKOEYMy_6LZ-0epjMYQ;UatCnqO1cler>
zju*UjK-~d`obgdnXE>*<B}Pp-hkKUC!L+jcZAhS#nw;DpHq+r?Ga?i(8JW<f3Y!2=
zPhb*x0W`DwSv-49GpKoSadOCkribEC0GWxIb^2cXUET-3jxPgAED@PIBs`aurd3r{
z=jsjRzkgHc%rQ0{@MWhJobMJEXfP=MD5}4W`I|&Fr)9NL{_YASJ*YEAdH>X{QG8-z
z!fnnWy*BfrxiQHH@#fd(mHrn7el<1*fdqWKZ1k=}7D(4F8`=(L6Qko0w3*OG{6`QO
zLjEQ5X#{teRd57XFu;iEWu{<Ike%JR{)S?uQf77VY?OuJpmTJj^@C|>V<SUhkdncW
zCNWWr<;6G_??}~Jjn(b_PR2(hr*bF7(8OQ)RE(5u8^tqJ0XkT8;Z)t33m4nFOy+yY
znTYL*BVv<%iPP2J3o9pM&9fV9Wk<9(W`-6<TlY?)h#bFFPWjp&azW7P)<CPGC)IQ{
zYGbJ@D!kR+HopcY+1&Z5fd&dPE$8>Ah{PX|KR3VlFHc+xU>sI@2R^<xJpT9r`JPYv
zftNErlgw98u#*Y|b=|TVwfH~xH)rJsUl1Yl1`R?YqPUh1ZMsg?wz_31kCygaHATV6
zyhY@UP2U~@qxXAq2rx-~w;G(rUK=YYC=^$)lQB1Y_eCLk0ALekQpJAn{Vp8!q@Lkf
zCS?QS+aikZZ<qOLw%30|ZpD2>{1!{N8$d{elafKo>tt{j`<XAXF2{bAr49MV@6#9y
zZXVlvUzkfO=8M7mr=Y7TJ|461*VSv*KdTe!g?vefPPIL!>x;O!3-zb3DOsFnT2=Em
zxd!97M8!X9O2{Jo=*Sw<d@0&$c=q-V_QiLYOHsgBOHf47Hl;Y2Mh(?~haGgTp`k7@
zX^xkk^jf?M(%P(w`<;zv0$0mphZf?GexyC9AWaeWHEt=IK;E@hCDujBH<2oaF`nev
zF)Q2t{XIM|qZVm2t+7>WKQ>A#&ySDGu&^-IJ8sD;Dh7qijj_==@^WpKplavj1#Rqd
zAYARg&rZ5+y<J{Kpb<i>4Y$>;KDQ>_VOw@ZESnME9D?_t-;D{mAbm|ui^KS}R!gS$
z6dz=b&kTf8xavp;FX}@W1mhCpK@w58pw8ZVy51Q?_(rrU8i0Jc6vNqNHpi!}sD)-g
zM`9i4dHliqN;J#7QhE)ZFL57+TsCx7$8bO+?9Kw9lC{&Q*+wKhXm8dzk{reV_xBHB
zWx7-R4N1py-cJ!V)K#cNWzVz;J34v}9@dUdPQ;SyHROzM?q<f+(2MQI2E#|Kq3x-x
ztjpqul(HxEjQ*~-ZrefXn6X_A&YZzS6ShP#7Oz4^#%17AL1)V0Jm!MU@>Ts|7WTJ$
z_rGI6umVTma3UdOj>i8+K{K;36MTItK|*NyufkmNAz<J)W^0~5%zWFW6~}XUf6bho
z8yOir#ldQskpYt$BhHb)U;rK6?)yqs#lk`m0zxt>K)?!Dz3~x3jOPo9=gd=AZG&td
zvNf;4#ont^+t_FVy_^;^&k0G(T&G^#j5)MeTa}7`i^gUYv9jL2InGN`RAglv2M=8S
z!%fP`Xai!5+sTEletA;qU;@pXp+Q)zs-FVipDI}v#Kk?Y<(whmvvM2u;D2V&xhiDk
zMZWR*>w39gn%c!fY@H*JHuCHa+M}ZFi_03no!h^Ef1I0P^Dw&i=1uO`_`;$h{D6*)
zjVKAt&JD2;GQPd(9q|vpx@Ugn<>yNnsXDrRvDR=IjYOe*xu&E%^)?NF^MyvT-|6Y8
zS$RLS$-(uTWj0Ez@+`cF$gWOsAT3d$gX7!3UXnJOIN#0B{bFuhZX>-M>UofS&;VR5
z`E-(bxw(oD+m*k}jxeV+wU?TCwf37xAoc=PaM0!H0VP$@<Ha=UTa1+aJPR3xWpIWC
zD!g?YFriBrNs*D?d~Uc;8&f)Mjj%rKPfj_F#SQRW)LhzIS(UbhJpJ|P)#NZ1S9BP@
z0b*jv2TIVWPrO%fEH8{)vCHsBdz2ivPz9%Xi*_J!v&~=){pHgSB(Im#Gt%wN)C0(f
zK5W}8pD#cC@Z1s^Oj6(f=1Hr^N8}ezKur7JpZxbx?r+?C3l514hw-l`g&*gt9)G3<
zbOFQ0LjlStE8ls-3<Kz`Jkhr6=D4adw7pwb6~+%)qaIwX!l+2|m@BafNed9pYXU{o
zqx;}}d(QIXBL^vd45v#wJb2@nA!GT%^yq>!ru^8ba0p>xUfM!u`|h7VpdoQ%dvzr1
zuvi*hUQ4UQ{yzG_Tj=8W`OU&5TDbgZtbI)Ky_(yzv@R+ASsVmW`KGvqF}vpB75*&-
z4I_&s-IS8F@remoZz)A3r4^+hs>Y+Bl%Sv|nwrk6QPjBiRJ{I~J5oss+!ta??nm2U
z%{U;1aG#y-tvOYOboQPfvimrm{~5qMjZsomu4;H<a$oi7)2D<uLfSVpo$c-S)s`I@
zXw;mh!736tx%PzYdJs!&cqujn!Z(9TwcKm$bF1C!J=NaI{kjS^Hm5U7bAdbsG5@uF
zwr`IuX}~c=#$y0)KAo+pVA<AycsN}fcFn@U^2=z}WIFYLA^0zsXgJQ=Plgk=J)CgQ
zAL5uQTnZ1wBP3)p`jb!Efb{K~Q-Q|5wu(Z3xpX4$*ht4mauL$qQ%T0E_a;*oIobJl
zRxAEm=H3Q_H^&Qg;X~TRUS6#)`|jp>eX46QwQ6RYe*Z4btgIA1gfS=m_=y6Gr9WKX
zEtr8+x-|`21}W%b+N+wgGh!}-6L53plE0~`-3UESthox^8|jMw5bPKVm+SABm}OY9
zwm$9e4;)HDr|7}tpHEEW1-BI?!hm^~osVy<zkhvt#MRlsV)tNGMOF3u&JhtOpi>C3
ztm!fOnn=JL7Xol5JG0V$Hu6}&OrxyDoek1xa4VZ|u~@9#-CixxizAa9qn}%9q}QnY
zV%7w+*f5VMnF3nV>phGBJXPP=UCKIqd+FBpjPca<w9>=K{pfAG;c69l8^$T=V-CX>
zS)rM<v;$P_@W^C7k=+2F_{mmcZ>1S0^OaCv^j&xPRpHFHb3o_|*_YfeC0#$>`$*1x
z_|OJJPQzt)%)Hdv`kP>kx~}G;{&D$uHKP$%5XPgtoE5sOy<D~|YSAb>14-J}Lvj0P
z>wIr7g>0zp+4RoP(nN)6$82|YY)zTr-CIKgk*`<rb^<*;y|tV?<CBvwsb0Z&$h`Is
z_FFq%2WjLFA3;-$>70U$8YAx_AD<iJrXbOt95V^`+evh|o6Gye&S*KgWH^tCs0=DE
z>6C`2E(fD|$`-NFonW^TA4J0}bC`swyrZbO*vNX`!;3?FDN>&1FC|cFc|I}pjaSP~
zkqxSMR_3-kkx;&DSsGFW`?(-N1aXW|b1uM5DzOQ$&8J&&^whD*$=74iDUy<b?D^V~
zPur0)R&NHd!bap@-O{PO-O?28x%<)A*V_xD)6r`OlH`lMDZ~EPhsDL+*8&V69Pbb?
zDqWjDMG*wfJz07Ad%MGy;o_f4XpcD+1$k)&+1a5Nyqa{+)_j6y1@RT-67nzRUenSN
z6+1SRm*Ya|>HHx-1DTkar)%~3AQg4>!T5%wE59=HLOx8SWXL0`58tu+649dy;fIx#
zpS12;QW9}&yng@o3b;u0^z=M#C;8y&<sW8dWEo1ubMIcC1`cT?e|j%Bd-?>^VQNL|
zBlOqZ{NUXM%FLT{J2Yo(0#dB~^{-?^MB3WghitY_ecQNfE-0Y>6b^A|WnpP$!@G2X
zzjKdjq>Gby(2(72_|oN`5VEx`kIjn6a@E$-f`R7T7uQzzboBI|;*r$pkEyx3E(j2V
zuin00X)vJ*FvZ(w+FMLXPTpA`F9^t}c?YVtIL1;?tmPJD;Ndf>6o1{QDSMBH7X^`1
zQzJnd3^5%PeY9_=aB{M<HEO@0OG_PW?I-BzRTpgDQtW0VCTeIqDAUtR8XEe>$E$I1
z)ugYFe|jITh#xRPiw_6I&?Y5C++LWy@NK)$tZ1K}9&VkFBuDln=i-0AJX<H+hf-Nm
z3A}R2FEeoQ8peiY+RTV50z6DiO*Jb1h6QGwQztVs$xNnQeRjyUgw-%PJ|PbFoxKzT
z1eQU#cQFj%F%qk**kxs)0wRumM)?sAgsc7by|oD5LeLY}FW5UUfaKvD@&Qz>u1g(#
zgLeB15d#Lk!k_5xtn9Zz2Wr)84#t!na&g4L!NL0}Wd%t)bg29ETmKlCYM6xEs<N_<
zyB7_>-1iDKoP=agfyd!SuRtpN<fJ~Do+7N<eQk2iffS6|hw_#X(II+)0!2B6y~zSv
zL0S1s*OcVrRaH4=d2+ZHeuCu7u5r(v+m`-%zrDAfnmKvBc8x(ie0ldH4+J>SW5&Zd
z9YnHE|FYvVzZeb<r9te@lEfEMU@GsTM!q0H&d<(%8bAYO=M|XT@3=Ubu~-zB=Ay!3
zRK$49o$o#viqe1`Yd*gz-84gnQWXt-K^ZcT*CF1IK^E>JK$S2MU0ysxXD}E2<eDqi
z4+N1!ZvFanS!re8olqa)Pfc$3n>`UCplTLI;_2~evgwlc_m}iV)~lX>9QhMoe{7{I
z4C?_lK5$^ka^<j@)lLeQd97C3&%yl1$X(i@X+pe4g8@3a?gh0!mFHIjgYe{IkcvbO
zDI<D-kpX2F6r{Ztiz}jvQ=rDf<Jacme#K5fakEB=37TacY>P3`14Kl=+3%d31HmDQ
z*DVxVUgCb*c$v=`bMfka5R~}BA!q)9PPMyJ_wL1r{0)^xSKdYFt*(~Z{cXa(480j=
zR2<?S+Z^cUf&!n!2ERFt<nn8oo`#^nKy(=LjO%ir$Z=NDj0=mAi3tNItx2V5@aRWu
zvu%vsf0Q`N0DHtV9u)TT(`jmw7+|J?@RnRCWoA~8pSai5Som#Vqi2aIDRT#GlLDgL
z=1wI^9c5aw6FO1($WqK4@lz0hk~tj>hD*kvcd`m<z&`rb#0YGk1pCf-)~3hsv(e{Q
zaVP7dYf1$wpPsf4)w!8eJm!^@FoA{Xowh~6(g|&h)Ih?mrl#ioSk|$G05=Ou0Kr~!
zODe(AfV7mTxTrW1WKq;2B!qY<CPo!^zLIs?Q?ZcSEx3)QZ29nSD)cg_vU2kOw_M0#
z>6zR7>zu6ER2YDP1h_gl`1m4rRONAB;-X&e3&27+uL5ak>B-hu2HK~$&w4(pGTIbs
z+>=0yQIUlz6~P2n!|$Y7Sk~t2@9vS{K$-?DM+S}Er4=Qm<*ZX9Ba63lzfyIxfU793
zEj3LT-GWPASGVnj_w5oGLN#d0v2aC!0016tF>D^MXG#))eM~5Se~I-p%db;Wi_J*q
ze>CbFdgJmiqMJ3&o%h#VZJeEzWtiObZK8ep?VCR|5U+D|;_T{}k+a#>=7zYqxZOd%
z|6j@jqb#qE2K6_Zp=8p{mbX|;9o)b84E758v9r6&pz+ps2Xl5-#SHC8!1ihy5FYE&
zQb2gL-@0E2sQLu<=Lc@e!Ga|xT_}XGk*(SNHdwnztFDKlhjbw+njvoJOIW`aDOg#t
z!kAndOB*!hb8BlZG-~x8a^$z{4`#D|{i?L?`28?2bLs0fq|Na9wH|3#JJ^G&9i4cX
zLpJozO1ICWteh3e158K(S02yzSyaw5v0Wd1pO|t<h@KL#U}24f3!&MR@tZf;A57O<
zJce~=XPunz7Jc^Ke0&=~j*NhCt;tgbZ#rl9`2MGw;l#O#^0Zxr5!=$Cp=6W8<H)bJ
zE=0_;NL$j4^>zFG`TEPMHs=dcW88pq+X{|+Z8H;H1gM{|(dH6HaD=axhhB?QSxwFO
zV2=O+;RndC`%2!<HQKE;!g*qn`tW{x-fB=n#d0$~>vsM}($P^+S>5CrntO_Oyu(-I
z9~AzX9+@=$nXlC(0%(}%jZO3O@)&80N-LN<?8e<(cx)ES(j!j|z4`63&zklumyh9)
zyrUVCeW`EkML5ix1R89&--Rd@p@y?WMy>1XRTHx(=wZ=$35LVZl+Tg6zU&MlX~FfV
zexrtkDyUqz7#R^k#F<J~h)(4RbIEqRw`Feh+5WmW$o@q4_F`?XCg8^p!6k{L)Ku~i
z6FAXgD?ArT9$e&AkZM+w^0Nb`87azNO$w^a|Ec2nTLazWyRMurZ!)NzS^;Ha1r+5E
zDKS*+FLo{(LRTF!c$4$XK2Cl1zG244`t|ycm5Qyc>6gzVJmKUDJja@ed$(uy23mYJ
z53>>7Dh8+;h2^#Jf12IQCpG(z0)7B+l&@al;aF^Q7?wP^kVsq$>oK09Id`EQ6P4t!
zdX|B*=954`)JXFhmDft@eezUR6`JIja4<raz8?C)p}AgmpFtUm_WFGF|0?XPgQ9%f
zJ^mmd(g+9&h?Gbpu%v{<N`r`slpx(9A+f}dRF;wumRLF@R2mjo5CoL2m68^a?yhrt
z&U?<xJLk-tnH~OkcIV-VyROgmy}tK(CV+{xI*NB)BPAR5A&6Q0?;ZitmS-wpcrOO)
z7vHTvC~_<k_#JN5hxP}^%z(>75%I<S-u}&@t=MYL91c%R(kt?uqr5#lf<fx{{~(n{
zui0#Vg<KBhM{(1ej@u>zeepTAJ^;|5h7fVOB6fE63l^5~x<eokOJ{OWCS%;Hv;U_p
z1?C@;(?||+adW>&zSZQf3qgHx8TUBz_)&6TKn=h3L|I)?*^r(8oDi<l?ExEe5TmhH
zQzHS$E=2mBfB<(}pkg7|kMnefnt*%6X(~ga*LO8P5npDKf&dMaN9J~B$%*M5WU;8k
zoKN{F`@-~pEz00*@3XKJs?@|mw0_2=qP(DQ*mnkZT>t#C>AYKVW!X+>`O(l`S6V}4
zchU#Cd?@ya4>zh}66Zul!|wO_>$$;XMZ|J<m~tC8Pv@$biPvq`y^K#Y7mt<P(<&78
z*zt{_FBR+ApNns&#ts+M?4ou@7(x^%Qqxl}ePXRM=mp*C$6sK*Q1%v?9Y*<SpGz#J
zaU@VB3<sp%q{t~-dt1Z>qBUo(H?4`YZ8ma;*~Z$O7`mHh3G6K=n0fin+vc97LYZ0e
zTz&DUo+}cISV_<*Yvr~+<#u=Ooco_>r5}OXD}?1;%e$e!8b*w4ZE;!%5t?8cYZ|<n
zwk{)pYF86?6K@zENWrt)Kg37*r+Cdd426byI=tlP$4P~)IoAJKwp&<i#Q4lJhqt<}
zSgFTxz#E%v4$$}=XzK<GX6+2=Fk)SE#YR<GcIY7&Ew=l|11c|{lixysyBtk|2!A8S
z&t;k_<!TTFiO{r`tVwfIbbNoPt=Q<Ms;aLTyw%o~hINXY=&bUnxeml*&(s(1$6Rhn
zghi6+89p*L)NQP;zUXbF0-OvGpqGu@v1IrCyImI1SA8kdGgF+CTV`FJrffE6XH6YD
z$`4Euy#k!#Rr9$JPV1~C`%PQ{95`2S0`0Ax*-aW=(+d5`^flt3e%wH$x&|EyTxvW6
zN16D3)*msV)ei7jClAlPQ<yRF2M%J+Cm?6tk~8;YP#BQKD}fx}$7>&RY2r_L-2_ir
zdj&VSeS}h{IQS_wp5nT#di;4>YiHYvrxvN_qyv+&O%sQ1uB^(Ey}K_ecC=LUPDFV4
zbiH3y(eJjpTYUChTsZ6d=t&2td3ZEa?@c&+N8jJhY3rm>{sK&^VQ}di5lZ7JnuiIt
z4i3OJi2%|uH}`b%w{SoE^3`t}8QR~pI^UHLP>N@5ZYi6Yv6_`x0pJeMsmgVyWPi-M
z3X$wcOG@fz+JZmO{r-{j^IrB5wALje8oZeJj+ok0mbJ5m)Yq@e!5zd^N%}`7p+9+g
zJzXoUk7-M&jVGCI??jv=lr=0G;_|GqMt^bCDBp*Oh@F0UW<Q_$nUU*R2avN=FxAP*
ztfn=U!lmS2K=gl8puc0{|7P8PkMx^R){cz0uCs(l*))HggZBXTBs!D(^j}B74@S(7
zr@kxvh#$0GI;W3jo(lyCYUNtQo!e*o{^StUAYFy%xuCZjs#ynPz%>s7nFr!njXu1<
zumXB*>un-_1K8*jBEXr3uXA+;J?0_^Y$-{?J+bPgd(!XZd=^Qi5b*BlZt%(z)@!ZL
zDarox9588FO0Ra_1FZ^9VsJx`!?Ud{nm_k)6W*4QX>epwC^UcXxyRs`5Wr*FcRsA}
z_a{W=5<<-Z7@waPc_KnH7vZ36XYS9O>-Jz(fNKg&Q~TViT3x%Z;Y@FRR;KsJ2@A*-
z&`8i{48$OxOJTe?3UX)ZH=At#9MI6yjf=|6PDJWg?6z!<U|pKmN9#HU+H!EyK$3JR
zx8y(fbnEhxF$Ss5Bx@D~fZ1{dJx3HsELAKCc<$aD4Cw!k^Jk1ePWwsE{X6{Hn{MDg
z^50+s6s4^TG4Z{Vl>RdYL+R<ht<vZ96$Sz#13#wJnzQZ(_v23T&G$6Ed(8L!2P2QX
z<b6;51(Ppj0F7?EBksYm9ZD&DlkpY?b6_(*#dV_UMXNcKF7?rUEfIS;Gr<1OJ=z<z
z24X*fy4K`NLvHSH+gMg*<=RH0G8m3d1184oegW+a)I2IQ<)|SC<7;`-^N2h8DP!x~
zwmEM(0VI<C`}gma4xfvPu0o8f0u+-NVSZyieuzbi^PqrVuDEb(@^p`cnB1h+0=GbV
z59EUmDxQ<??K9n8L$`B+NRsi^t(oem8RR9MNA1YWZ9{S4fJG}#n5Hi|<M3qL`>{c>
zi%P(|-)=OX#Oxn0j_(_8iqG`FRn@iL|0C1fI%L0KcL@w@^Zn+2qX4+NBERz@!`Y{f
z+@RiH9d5Z0L#ns;ni1yqGiGxt5pfZ8gO*l6e{pG1=o`*&s}pwt;%(8YDj6S2m))Ce
z)bEmCec;=5bKmx&W+sG^1WXQ@MStWKEPWS>-<<LtJ@_^>I4FMdnR!#B$TH_)tj5ru
z%4Sy6#yA7*QEFO=1EK}groQTWMS_gTxSN-Z0(K(UyLSts4{tRd7gUvw3%<lG0-9yM
z#0=TkP<=?!yGnRrW&7&HwYlzKL+JF>86~%9lG&x_PZX$mfd$!0%~YwZ>go+ZDoXR4
zUd>lO7v*M`eYv&X?fq#ZSVp=LTr4k_&B+f_wUu2|h5y>Jl<CZj4ge8D{r%0uiQyD?
z7^Qv{BuzAL$6En#8E|$rRAC@G-S;XPGcM;a5M<gwOSc%8IjzHQZj7NLd)4gsYCxzg
z9A7&*<tD%34*Sqtz12L<UVI%hj<}o@-zVQ^6mujcCbzDh0__sissoAB+T!>wxI$#o
z$rD;aU;;P@ZLLlP1D@$tHwZk8(@$He)k)oWd67!;gJ5|t7a%uMe#4$U$850|z1^CI
zV$GVh|9Q@Fk9T!$?XjU@Qf%@!2lD|TS7~%wg>DT1M?H8Cs;Xe(j$63?$0qAFLfn#7
zQOnNLm{$)kv84>YdoEbF-8qnHg)%XiM_klDzPpUAQL3#aBrHLuj+SF*u=UYx5pn+}
zT^;=&l|XR?HNO$b??sEIx7rp<FTKvwW}0w*<uqQ@h`}&Gpk6oJCu(&f;0QFeWLql>
zECliLl0skZi{l3_^^~!x_SuU&ksmThf3@BtO0;!c4{GC8@9L!M&X93j3As0`qpnv%
z7#IPZ0T%@|ebKUxogqMObTy;C(&N+#l6Z5m^R=}@Lo*VDqfeh3R68tS;^GFMlLFo3
zEXeMHZ1LxP!{=uklV_p4U<HP1i9ZgT`4=cl{x?vz>+Gv!5&8c8*Pr~Wc+KPEuYazE
zc4()0xUG9jY!N^uM%eGIjp9%PKUXAD9l^l3x%T^E90vrFvk36u^71S@w9(*+X6#Q^
z?(KDh4kZ(S-bQuBbE&BLqGx9}q<-07gE%-iCj+)>3y+MOuuiYE*;?7N)0x)I&F5EF
zR~y49=3FGKdtVX+9`9N$FR%PrUWv?r&4ULQck|?Cc&n}X2IyQsBS-U2Nd%kTV&=Cc
z*k3&I8SkO8GAUI4a#7>dQ(#DdpMPO?gGW&CP6msF+s;-&{-&tI;{a_+Zf*+b{_2Xk
zMjA1JYBa?Gz=}>&7+yLg=z^aL3oXi27Bi^OX-rT;lAcPt&xf>fAf`C*tmgf|Z__Bg
z)dTh;@&WqV3p6umO2~>F+Hioy1g8r>eL_iDo^{{Sg#+Mi8Ies!PX6;qz|GV1Psunp
z0E3;lX%OK09<B(WOu?NVlj<EI7Va!|6R_~`6jwV=-=?FJba`k3+-0Hf&UeC1K#p(d
z&;w_884=ML*s}^sM^Wu1Nn=od+hCfvos$&_G$vUG#U>__L&g}Dm%{Im>fOD)Zl14A
z4I;_Np@+|^Xewf~cWOaNhzLEmxcD8286dMGuBU^^@#(AM_4iVHC}Q3k9L=xw-+K@0
z@RlhcP<pRHq%Z8^>A5j&$k^7l>2FjkybJ#@@<o0qKhinf4<`z-^v&Z1(uUIjtct8?
z?OIC%DS^<iFj9E-^(n=PWC`$o9sqNJp3)>VIvR^bzt8elRb9Tnxeb7dL5-CpTnAFp
z4JCy^R0OQI>{qLeqoSe&1Sm??w4nR2esLkO2ycdI=Vli-5nXzE<%}|RJeCLdC?SnV
zaulKAe0}6C^yd;<_p`lElc)BpE8on7AdrfwN}HLe31xc^O7%;UCNk-GrHP<X2eG6s
z;LFrb&iKEG+Do>|@enA`LQ6egZWLp~00nYPQ~q!;*C0*piF?Z19h(u1s!g@;`^eAs
z=>G(2Hd7mKHjY$v%9d;YAxk<He-4+IpY7hH2e#%t8RGUk-&`F9(b3U#x}EwSWnWgz
z%Iw;*0~Y4*3lED64_h;X3GBg}=YHoWAQ&bz(U<&u@=Q@N7@+@(3@v?qRpAe%r5;vR
z&jEaT*?P4Y;r08UHnZE3d#fNFkdtjrL!EJ(SbBTrmCDxg!wBlj+3<420_Il(0zkXc
zQhrKise^5_?BaUyM~|rn+o;?!V6kj**b+X?5OO+$O#|?>@2W|8*@p0C_@?Y=_kYv1
zx*z|dYp6+W&C{$WLmY|YO>jLuMhF-!mzMH@4~k#yQ5Y!%kRUYkKZuPFn6$ckcqGdN
z0s!ZOkpc!5<*&;FJo3rOTL_VQU~c?mSaGJi+#bJ#_t5egZrazxtgN=WTI+S}Z_0C!
z>Ht$KK)$Hg<zK$M?OG@*-0JDk#A6ZVH{Njt6i2n)0An*1>0AJE8|T%VE~`Zq`J6KB
zL#>k@hJlyqsq~;rq2uF|k`C2OwCN#Xk&5J}1`We+7E3_wMyK2E4hT0J!^nmEM|{su
z$an3!h>MEfEV@W6EG)D?3ImrM5kbQCUgfz~n0GKaIXQqNzrN_y7tWlCI}k!a9M6wW
zYWRpak0L!?J>Nz|8?V=V?e6A~IHHCS5Bx|VjSMj%Ha02KiBD&GpDW7C34<&^w&&oW
zI>7gq(=;~Y!v_IxJ7?<$cDYHYkFMD)wx@l*px?JDN3Yu0r^|ZZgidPr$1A-%^14Ru
zo`Y)mTjIiE0<5O1g617watK-mdco1kuiCnb=elmv-YZ7Wo;}NExdj2y3~wi|hGvwy
zT32~_d7Y7yij9Pu1R=E8iyGSr{P<tux5kr-0I`<AArTPj;<4O&;5>c7{#v?@J01Zb
zoL|>Z6GVHIQNvbvQPE0#K@i>yZdDv|xoEj@1N%Bdwh?4BV=^S_5erh*)<plXd@L(-
z1?`$ZK9WHQtmMM|?Zw8%#-x3i@(T-_naUGxikiJ}*~$aS*qGbvj#gG|w%XbOLiW81
zz7Hm{6t4o;ZF+sdg#~XA_BS?$Ge2<UJUY93OW(==VinBBU^wkm18;)lMq;9MkRY}*
zz*tw86pB%7ada#(c>X6x*(aSCTWf~HYzSz9$$^WTpIp}Msg6ABJutGld$_x_K3Zp+
zNe(u-BLBKriyQ)awi^4xi`Xw);V~_H`yTWH$*p@t;AGW=M|Y$U4$~J8CH2PuN)$|%
zJI&xzd}Q_fk=2La9}^OW0h_M5dgMI4y$aSS`W$09^+SVqcTwl(pl$sB&<?%f*e!H)
zX8GeIwU7|-2z13K+Oxb;hQ(gY=G^}g8_yXXOlMe}mnR8v+|8>zk5*`H325?8@=i;-
z<hlPRp~$WPydMJ!-Dk$PZ@R1P?5$M&4e_%!WDqJI9-3Qq>a1DXQg5E8i<}x-Df#*u
z%1!5m$1s6i621+8vpFs&EG4;1hZKF&+r7X$vN2kBICEh#bs7B1d9}u8d0Au$zxo^m
z%)r?Nh$z1<ysk6a*f6=`xjuErYcHXsq&s<_b*U#EP8E`|Ik+yjdF(iS9VEB#Pd$6n
zYhW-wM1P<^{}MQR<RjPl#?zSjIT|4K{8?(8mG==30yQfAh(dZ+h$TefI$ZbR5G`Dn
zmOsBOA(>88>?aPFl&CjmfSQxC)5E4qZt6ejJg$%jb_}&*1}K>~t`0^mW4g*)O4FAN
z@~^|n;~FB#l3K0e0m=KK633$2kn(-R>euLX4f40e*@-1dl4Y*M#*U>zld%L>f9bVX
zWYp({jxF$t?`%1Ird*!_TVgKurG^$?c}0JNHN^O72-OM0(e21?=Zj@ekCnuXMGeM3
zl7Hm~!`D^X&Z-g43Zl?&V`B^#7u>IVu~i<#vRTolKgF3B9~+Ux`pg>?rA?eID6Z`d
zZ{>@CuQJ{GoPX}kzs_8H^jzqs;hXnYn{x`m@w|KtLvHTx<YF~b5Zy{qOEOc2v@i^0
z5T^a<5?Bo76{jRjCxk%OP<XnB{|-yYV_wTyB6<NS9x5J2#*Zz?+=Q!vVgblbyuwQp
z!J%Jp`!hfKYD{zQPZNqi%QoJ%`!)^^4)<0CcsOT&<xNi-8;6lQo#<GA6$QX;a%At4
z56_>v>E;~nyK1hlpRxw!E&=CsBU^5u&hp=A#Jqr=ADwj{+iSC#qdNW#EKa=Zm#bW|
zd6Cu1!_NKq<^paXWcMGG-pGI8KO0O2&<mS6br{87Y$Xt5FD*8r@3*U0(KMx()S4Fv
z&?O}l6*g$kf@F$`|AV5>#kiFS4<NXm@VreB$cjH%1se`w(=k%m!M5Hj&}KHDu3GlF
zX~h|)+a3dq>M@vm@5_i{&|@?8Dyph@O_|ruX%q@jcopkjP^K7SsP8v=T8kguuuDp0
zq)i_ldrwF4YOQ)48xN<vp0ci?`g}`bs^vnWNWt;h?Ato;&w@sEKwe=8Fw@U*v$gN6
z-5vsfRc^?T6_*xoF3+*hk}xv1#UmO(HIC}uxw3YVz1@Ri&mD$eHOMxTqtLMG5ADCV
z*$<c`1Z+P#Q&Iexs83DzP;y6fu{uxsJ=L53;)IKdBYnxRvRYL9ktB5U^wdEt^_|Gw
zyP;Y5G74xV`lJN2X4XAQ$D`h7`Nxl5ORH}_Yl=GBX|ix}T{F<pPv2%s^;Xk)3Yagr
zo$8Kk+Y{6NTZ;JU(B+LTy53H&_vaFP3{bh-Zm{6g%>@~+u9F2};a^AJEEXA*fkLik
zGqgKR%)djsIGkcn!fVfAyMD0G<U7{SrxFv4XQE%0n!ewm$SJMvu|7Mx@)`^DUO)}y
zCw(8TGppkY01l>y-cI@2c|F#Juw(wmn7a@%G8*jcOaPp#>G#RW0S|JFfm40!gjduV
z*@~r>w&+#E#DDYzkVC56%O^hL#-;p_sj1vZVRHTs&u>-t&l?mNsT8pFM_c#s3pq|P
zR~4lHc2iJxAyB1>isGt?)YSvZyl|X<<5M7s!=_6`*Y!~-6y^{zL3?W(E-YK_#(s@t
zNsPB{PnQ;p>KUA9cle+{G1)+T`3}k7RHL}45EQtx)2YRSP`$PS(|gpmsir$9>^$Yi
zcdHTC#sFse5eElM+s@i8n#(6d)s}121oFBGxeFb6t8G2n0R}Zs<<Ue?dzeo=;t>So
z5eQWL8<wrTy&vX$-I3e%ZyytpNx12<dov3Pu#WXst3OdY3A&Sixy%&`-=rW+PlxqR
z{P_BT<t<XrxsjI}ABxC-M@gf+V>-Mg&+IfQCn^soJO<<v<{@{i7O)vbMKGWWKi*GO
z=y1~H=cVh*x5X4;tPZg(KTLtFJkOgB5L}S!n)IUz!wc`fY)O(ENMd=*EHH^~ms6+8
zEi5X!`RDwYaNlj`C8&9oeBf!x#wU15KJ<yDkJr()qW4TsbG<12$a#vcx^RTYV6r2m
z%?#wWgaR^j<@_UZ8Z}>h8|o~wQ}qW2RU<m(l!lsrF;TJ(<Ka_4m<MB)OTXpbMV=3}
zl9B<Fk)ooM8bY9#jRM@<*@g;~<_NXTbgea1?(vnqKrH#&`1#?BG}vnwjDo`6B@`{Z
z(F;{?JAqCb^UkPq0BgC1hH~&JD=Wjwzj*mlU;o);KZ^we9<V2^2FI(bDWH?X^~sMk
zmrEv;a!~=#U+it*QiHy{E%2pa8XCgIF?oYQ&7z&(Uyp(2-rLCNnu_%x6QvL-EBYHy
z0__dHo~R*olgsO)l2mgP1LL0ia<$(ftF7%v*+wJIW3SCAdUueg*u>tF^9no#{+VsG
zxPlrWh9K6R^C-K2TlU*781NDkaR}^S^7Y^-vVB>%u_-!Q$EmUy@3h49LkYg3_=s{t
z!6fi<g`$+T(})6rl9Q&x+f5>^ZP)6TAC=GQ#yrqdiXrnpW-V@vH-@W=iy_;{GSJ7b
zt1dku(~1{7Je`U}-h0dcdEpoLZhxcjgqvhN=D3S<-#wT-4bq4r2Wr^aj>yLy2N|{5
zn-f9Va9(j)b$<bBQO>+vYpVqnfA&zS7J-!!O~uCDkg`_6myOR}>g2WPrAYgSP@ol&
zARr7MXdT0bSIGE(y2jeP`t`r0bAO6;K_jACDJ&8Kin`lhzYlapV;!~|SS|9F-gsI2
zhV<)c$EM*iJulEg)X^<{eP@R@C;W?06BaBCjo)Y(pp_Mn#ZF)<QVzNSG|7J@dDw%%
z)(swoKgB<VzkLb%OI5eW>Oyg&aQHP3CA?LC$)qVv*>cB0Wo~7TD;)e@_G^b{=XXTE
zdY*i^L*q~>_l(W2Tj5kE5uhg|nCxY^>)7(mQz@9F|J?p5Jd+%!xnoiSuGU14aD?Yu
z3O)s?82I-})t@$H`KAl$4sDgMWqGPl>)!E{Sw6%Y`K1<+?D1ItS#U9E!)Rbe5UUY1
za3{f@K>o{JJY^aJNE4EW@L-zwtZi0}-lv~Ht$k?)iJk$;2s==if<c^)E^&BxxI&+U
zoS?sln3H=+Df>}MzHKIV#1)2bW<@%`Mn}0m+1nI;E)^8u7UV9qp(5cXc{9u!GEN`I
z0fdlGk0OeA)Qt2$MOMO6d(0|E`RIrVVmW?TX?f?Q?jWt6#BivB7GYMAK<oXw+(-!i
zj$24`h=3e6IXs_dn`y%k$P&nX6nHVSM=gB~Np(^@Wqob89zTdBIbQDj;-o!?DmB5-
z7{?0^Bs`8u%dP0W#jcYCLm-4{bHpbOGNq2-P)*4m;{y(LK;sTp4`yO**O73|>yIjI
zg6w*gGHqF=?qr!77$o{C?Z&>i$`+EcyPEUZcUnuFP+6C}twD*JKvPXBlaDT(#g^{J
zoSGZRO@n(-rQ$gL>PjdkPX(Jyb0UzBdx#{?$IQEoJ{;nZhdqJ8hhS}4|K!_}KwJ@5
zgJRRJYcvTiaFt8}*#9Mr{aT#UhOSy1rA-P4%I%lRm1{v9DnX|41gWjFE~6Z(SMUhH
z>HP(bkR%k>7;LN}K%i)o`A@#21D$F)cSJTS-CeVOH4sX<deZtQ@te`A5BV+y>z;Mv
z6V(q@(bbEAW*9U9crK89?BB<O<UpZ$kR1AaA94daLzrk>V7gzg6UYz1<RM}X_!B-B
zTWYQ#mTv@bU6|@1f&36mbEx}LUYC=)6qC`do}nhTR>&5TKBS%di>QuM(k}|i=FWd>
zrSarC$5%GhAdB}LU(aG7hCqi4A$-P^18miqAHL>LGn+ot4E7F)r&S$*JvI}f>i#D*
z|5DhJ#VsT&YRhimZ55NkpJ0vC)&}2c74dLt2zHO2#vHswD$Ncil{gDFB=^R(?2ke0
zK&F3Jlpe0*t}95(74bpZFT;tJpSWZZpQ1ANr9I01#YfhV3x7-H8m{SUS7a~Vb05pj
zCrhxa#*LkFdXqe?kr=4)j(};3&~T{6<=dv@az~iOGo@s|u-KJkQ*zr8rMK!48kq~^
z{$PJCtLe$0pO;OdldN(sch1|zrS7aJK^(T3Dsc`QwO5AZ{7kUd30UcnhEFXB;5rW>
zxDEjfXHN?sdN|a*3e&vbis*L?i;3F^HfpB???ZADcewvk*)p9&StTwP#b?ney7+|~
mQl*B)`@!M^Ve(X$MECSa2H0*!q=TL3Ayv4R(kBJep#K25@CK*=

literal 0
HcmV?d00001

diff --git a/docs/maps/images/elastic-maps-server-instructions.png b/docs/maps/images/elastic-maps-server-instructions.png
index 17e9163a845c292cd63ec77135a3ebb62bb5a539..5c0b47ce8f49f34278e6f5515b940585ee74cb52 100644
GIT binary patch
literal 48671
zcmcG$1yEew(>E9=2|8%-Fj(;5!9y6_f;$A4!C`QT0fP(#cX)7z;10nZg2UiCxD2kd
zlPCZ0+uf@7`)X_V-CIN5Q<ro5Sf4)K{p-HLAC;uBUy{9i@ZbTqtPDu?!GkBO4<0-s
zdj1Ig<Rq&n1butqD5K-@-~q1jpTCFsVtLjN9=v`a3ldlNNZDKP)>pf@6FcHB8Cq$K
zGR^Cp#n+P054Ym~;2-;2=L7h~0$qcg8L*n!kg3`xbd2~oP+dh&CC@`V2L4&?x9qR7
z?+y4nJQK3ojK=#|mAvYRw$ikj!*>O-OVle$?+L$GwWQ&qK1YuTAY6uNj+>D66cK@e
z&;IldeL3P@oVh>!TYjMXI`{A6&*b6?|9Qy&HQ~?D(3kxaPNKi1`R69ge@k_MPW8Vf
zM_OpX-_o)ap4!8Ii@#u4Th|*7JE)u50i%TjDUA+ucU|iLyqUKE%+)l!-l=aUt!*4l
zF5+Lb_WcimG`G-%ozq1Jh9_8O+e&@Do7{(5_tlmf|LL5!R;`K6uaD`!dm1JqYEO+2
z-kSfD=oykwE+gWK4HtWN!OpF(3OF;(=<2KC;Bet_%i(jIxzsu~Hy1!9bTJ}-XYgl;
zpYOlV(Oi!1o+U8rUFmz2*%sb!VJ#WAh^F41go@4#kdB?JSWHQiko!lziOFETdb{by
zZ{o=~F>RSpcDP;~%5KyeMY4w2<sRg>Ey-boG@G80zz)k&@~|n_4*xu!cArT2*>|G3
z$4?XS7~SB!5G$%)0JV1g`F8i=)ilCi-{ERxXin!QT4O|vpQgnBz`{W%sG;LnIe;$y
z+%w>yv(}&Sp3wK^!Vs>%0bdd&Ik}G)S^6QA(qRv|w%cdgaH(zV54SrMxib5;U%El3
z0#d*-GiYAraH+oxH{i6_tJM)?KA$xPfs}_A^OAiL<OG9P(jz@BJJWtwU8^bM?Wqnm
zK|3r{%4s!OAC7Raw3L(gSd5>vX&UI-^!hZeTRDZ?e@igF)8zfLK3lY&sD?;w!=+oW
z>^>|CPHrup2Jf*KBCDfu`gDo}l>rRm3WS<2b3(S(z}=@Rse;${x)NuutEjO{mK!iG
z%C^D(Q|n~jzQFddK-1j8x&!CO<08h#{*$RuMg|S~u7i#kjaCdVjOv(MIH(-d9GJ@R
zW#Ht=ChHHgY-2HSbqsyw7te`yk0oNWkK*+Ty-mex2izR(G@l*{-E6IBltiJ5&ZaIb
zmAwY)?o&+^r7rEHQC`3i!xH*G-Jch!aUh>kpK#Z2$;~trSQp>^M&)aiv)F}2T|~MF
z0rVg=5H~p+Ti0_>m$VF!DQ8u^?xe?gx`xZBv5z7Prl;xGS*l8Q!?OItD+cb2oM(N%
zjD}LVvxMkJ(n|J>6`B=&CfkM%{XXUYoO1pOjqUx~VcAlyEmXK28VuHGxL6zzu&;4W
z`9>$2MObKE#sMRfl(vL<b}hfolu&62>h(S!RsMQ$Yob|hvR^PCAA|=OC0aXxBwxhq
z+6tGedLFF@IE<)b@3N+s_dDj8+ldbsbb-_C4K{u5#Y5kC#6{Jr*ZS~H=tUgPrg-+M
zn-{Ig(#0~R`C4!5jS~(t8_kNzUe!R_?{V`|m38WSw9PBIRhO2J0vuWkj$Q1pLaZ-x
zhcM*XG>4VKw3)S9-g<BEu5f8-RO%GtL@_f~fm6?8nw#80EuX?vdEA|9Qv2s`7immm
ztCc=A<v2_3+EGQIx{6IE)6}?GR*mKy8u)y&d-6!u!OE2O!YWE6l~p691s}5$aJsN)
zR(y^(-MP>5*s7ae$Mvqa5p1@Ox}KL(glV=I!vsCvRef3vk(fMHRl1ThpPqj8XY~%W
z?^|0c{ShYhcS8NBX?INNP_G)#9!tr&MQ_x4J;(hTp2+3a7GjefriDxLg2<Y{r~qqV
z(AU&et!=~|Y$ST$nLAI^=9*!4;hpF&>b)&SN5&_}dR-#Pfn^EpHP$ZFkqqS*E;PF9
zIr+lWb(r6v@eREdTV<)MGFa(j@=Jl13w(F8{`WV6B9}*N52IH}MxJNiYE|trL$`+V
zL@C_5V-_mcnz28$Ewz?4fIt`6fZD!%rCXz|xz_P-%C4sJ@yd2{H6{7T_Gz5a4!?}?
zRikt|l3I?n>koJU1HmhM_(7BlNtvPluOg?jj6h9<+4aq=+HiG>MCL$FGT&WBHZru#
z`e@BGm(@_1*70Kyvj97xo!-rT`iSpJ@!0A#<5lpS=C>w4z7GYSkmCtP4EJ5vGvv&~
zJw((c@Eq1ml$~<7d98Rz*Mq@L<Q-?T27z^eMl6Ry<Q5%bn~vm=4PwPc0`gtDNMh-s
z8Q(N)Ki>g(pC~BvH@~~jPydc8x1n0CQzrt;Qr1mrMZ-GhuJ&NA7S{!Zee!Fi9+#Jk
zZ7Xt97VoTVPIwh3X_^C6l(5e1s|VfQ`i&Jsy1`jIWv!Kd;~@bfa>W=+;eOV7YGU4j
zG!<IS{H9I?W^lM~Q22odON>CXrSTwnAQ+_X;AaV+h<%!}^gUpA(V+EUDB(SqL$b(r
zY*tE<jchhPa9Ce|a%CXPxG+DsP(>o4n|UaS$1^qZk!7iu`$;YlcRGX1=H4-fx$aIf
z7<7BAF%Vw4b4e6xajVq!Jnri%pLdhCt~L$yD`Qd6kB_mWC5fpTU4?5}wu|=%W7b)h
zV-RlMW6$Bxc036>eSsLHQow0Im;9=Pca8}8AD-0bzPq^*@+e6D9%3i2datlXP>Hin
zF{BWVm#QC|a7PLt$baE|x<oG-J5-yI9-DHzx>6qfRT9!&b=B7s@S{t|e{i&98mhR9
z$V;gr00e_T;T%X@eJ{7GbGx!<i+*-{{)V+YH)Bu%y~PoMYd?4qExRR$;;0cNVPp-<
zy%X}K&Uq{SoR>#at@*Dl=>zJsw}6EUf}&mgrL^5{3ku6|VvgIjjnU9?9Lm{d^Yal@
zT3Uj-YrR3nF#D6yjd^pXfbjBxS_Fkih4<QChQG41A(*gQl+gw5dfx2EXLlThFAZAF
zl{n1ninw&X$XuVt+}~B#isBO6CpZr6)4{08Q6hJByIa+uHzH6mP(j|tptl79L>h^c
zqfC82vNuh<;i^4Xy}13kltb9>3fW5S=draGF(4Jb^%hteF;iGP_-13`a*%gKa1NNo
z<JZnz`SP5qB*YU!Xu!%=yxg3{<zD*IZIg3<fZ!2vv!PX`vqbykNIyS!r~ISIk!J*e
zYOm68M;kS{FGH5_wvOGeI>1b8_^(TZ5tDYSU7UpmqeBACikigq5Qm6a6LF!vZGQ<r
zC2PL9M0}vUZDaC)L1h|=SzC0Ty}$CVZCF@Rv6&%s@b=ST!6mjbe{6+ghy+G-Dt4vv
zv;OVd69=NhcOEJtK`g@dG*`)bT&v{XB+`oEuZYr};TH8$g*d)*<|<|1_x-EQ<~k8Y
zhDoGErC6H1L9SMiX3Z32_!nGXgv3Hscjr4!IkseBzm43pE`oDKiVs+vbTRQ$W&C@i
zI5e3oQD0Ay<4*%w#!ZsoYIf8_>Mw0&)a$;p?`RemnKAD5&gI(sKr+vD`aFit&ko~k
z#w17sX@K6=Pa6?iftELw{Gw>y{3Rm3vvDlza`WL10t70TZN_`mIay4k6w{6;24MsT
zLj#8|eczw2_J_#xAdNlOJ!Zc=zOD>?lx6|l@{yh0kWQZ#7LRvXLiJMBz2WsM<_Cxr
z8<cN35Jb6Pa=>7I2{Is8>yMz^^KBfvfCcA*>-ID8wzYI`lXn1YUpmhH(PJarb70`H
z2?zw_a46Tpji|i|pZ04-gkt2hdarEPUljNwEo;^!gbzu^e;F-#Nt}yWlH7TB?p4*c
z`ze7U!i;XG>XkQJ%TTtrDUl^|5I>rh+uP7XDo=siZGc4ZR^)N89+lYPtGzDhTnd5r
zz=4tli7#cH)g0F3Yam$*&vD@o@3S!o+2Zwt0lUBviFmzjR}7~KkSy(TGpDM(DE?`K
zp~rHVM17UhRR>2?{gy)>2?CLpd_85=kdxLuF(N9~O2>IMmgCRQL3&)r>J`Fg;&V87
z0oEbetQ_ugzDlO2-|s1wV=Ns?ow0ba%NWn~wC03O(f9U>S<lx|Eq%rqekuXi(`eKG
zs4rcS82v5zreCgoY2JN{o@}fuVfIU5{>Q_wt0`mPo#4m8(4C>H9=p|}>YXn!lMOR-
z)K&W}%S@E?^juCgV31<DA{o_e;mOa_Sw~XSij>l2#3caWL_9zg#UJ=y`6@-E-bJur
z;zzI^QkcKYLs_fAQgNFKh%dVlvb_A0gaK^yYC~A?-t|kQDd9@SU@Xg!CCpb)e>g#*
zXQ;i?G4K@-|EaV!*~L2$uL?agFL9h<aIiCbgVme21msktf<H<L*R`InI##EYIu5}`
zqCUpj-YkxHS-iB{TVi<;4wCw#P;Whsj1Y0WG~z#KR6Y5mv-!Bj1$3I~dRj|U>40+#
z^V$27W}oWhqf)VtD=m6;J60RsE!pwp3)Je;L-Et*!H4m)JPkwFm8|i2KPt|}i0{#s
zDA^8644w-<!U#W`@1}FJBb1}Kp-?E*-6T|KARlzPRrZZ~NGzpk=Gdf8PGGYS@J%ZG
zU`DT+L;oh+0wwtxxN1+;@ct0yY0pJV-!`SX>UX@<gyM1OIs3R2n#^M`Y;!%bGeRk*
z_Vm7K+kMn3N8h#6`G6T_yO3Bjj!C1%<gc5McnP2EeLk76{3~6ID|5k2kkXz1jV);0
z({!DCD!Yn<Hbv}4nT%>`{&;40`!XgkSmyGio<o;|(c-j>DrXfl-CuE`4o?JD@IpR%
z|9qExOf#sk+wc79YD7$|m4(||Lr&Lt^cdTkGJNG+HU>Z-Ei1?#-;i=&yXfpXzIoTR
z$*f1YG*+pxe(N;z{fa;|!QX1qL*vWN?9q?kpEMl*Ih|VB3ON&24x4X<ke4Igc8%92
z5XHYpD~_Y;7t$V742!}$&Y^x~s|tyUqR~rsJ|n?SOg^U)v8#bouxVJpPX{O&z~e-k
zz({-z7rt<YVIPeWBmJN18nFaqWaqZ|T-pU&uAQs^05_|TwdUm*7@?TQGMEQ5&to18
zI**}-R~qus2&^q6sHD}LASmf#TF+d6>rrZMvO7<_>x*%Xsq%bXMCbE0iZ>xV&RInT
z-)8Ta1t<L<G8xx?6M|mDBO4j<o<jYVB#bSb=!-5^oj)h*KNQX=7k<`Q0S7(~&tGl_
z87Yzv%SzR7wzmgsjVNXO>~5wD*Q>Bc2AWATL#jv&t;q)XF6(7BYN{pEXEa6(*lyO_
z*H(5`K<B$S7``pO-D-1lwv0zRkW6v3JQ_{KjWd6=ICCEaI7Cp1R%{=gAA-K!(ykI1
zQKL@g{8r5(Qd`Exl67w%+|BQ9-eig?<%#j@!)3q1{J3@;zTt{A=A9>BqtHg|;VEPD
zW2&okrCNG@lC7m6OELGlp)q4OA(f&8_*KBsOM^=9o|V0M+WMmVx&@kRouklW2X?9(
z8LdVFPJ>!Op;94=Qudg&h6Qm$!xBy6;7(wJYxDN1TY)s^<m`0ql_xi?^d*d9B`?^6
z2JwC|_jI3=V<ZuI)0<|S4yDUjNZ+1r@P=o{GB7wI+aW9)sxNkBU5|f*E6;g0+G%!9
zvjRr^eww0a*4iNSH^HxhQQy13n!H0=>trLCp!K~}FCpP?c}g)GW`6&)z9JIZOFI5k
zV8G|OGrrHY9^0hFz|KbO!`M`@x&M9^FOFtaOjiI>QV*d44Ajil=P?3QL^$yJGS3P7
za1MHf&E70jW_-d0tWgSkZWj{4RSc9`g?=kveN9IO<i7(pXyz={aGC3gJEwr`wPh)k
zJD)Vi3W)vec*s4Ldx)99muLFP%IvM4rtYUE{2a<vG@k@RRm(wi&xIr1FGH{^r6KuG
zST5*n$PVEb)FglS<RT5_H+Pio-+FVy8Lb>~bG;Y5*(FBKeXy_;VSQQHy_P4Ih4MU7
zs=YtkuCP&M_XYcyK2CBx+l@QOTF)U9bF-5>-Y)VpiuDoj>UW92i|iec2hsYW40kU1
z>bt;>17#vf<JLd*E8j_0ChWyC%X8P3$jcInz-`F#TDW#Hy01QW;(oOG4XeZSFKHSs
zJN5C|aJ=gbj6j)rTO6ms9d^jG_5x7P4Z76JNhHKD73Guft#)%V+dA}6@Uwtdr|a2W
z%1XKl=N!sJ`+g4Ia$_Bh7fRdfJluv@0^fHHsM31n=`xEbJMwyqeBU%L($u+?N^_o#
z<qUu(juZ3M@~qOauo6gWJ=Ct<w00LL^DZosD575IiFzn6PzWWC)tEo)XY6)Je5HJ*
z#hNFNd2!e$c<RQ}<C7n{<FiR+DMjdUUz6Shj7Zu`uV+GRUCrc&+>U=etm+GKqaUV*
zs|*HzSQ;9F+Sqe$4%aM&OW?tIN~fmLoWtZKCDa$K(x)s%Kh8U+6J7oZ6@Ev}3R}@x
z<Ad;fkK$0|cnYb#L#>akj(uQ}l+y-=ljfq$=sUx@#~LabtE;Q+V_^83#gCsDw$}^V
z(m)`r4*VCz={wuY_72#8*7o3QV402mo}N7FPLrZG*F$ftcp@Wx2Ld{kR~$^s*1<NK
zobT0^LY*vsCUx)>UiFstc6|2)$WfNtc~YIxyJ|&b@G3`&O^IFjhyR)CuhSpstsk~T
z5FzGxJ$4opguzp-tB=~j_gr$4Uef$7ADhSF@f72R6SNxim`6S@oiEqtz6-K*k|4Mz
z9-$L~`_6Y`^OljK(niVGW$hWjARl!Y=C6)(LBX})XXGM9pZQtZZ)~y#eKuK*9v4kF
z2jV&imY)w8jsC7-EIz?BMj>O+2DR}+G?QH-l$B+hY(n(i59Bk^T8r1b|92T9rvrJi
z{XGlY*^B<%k)FIJZa*t|((c2)o^4#BxQ2ND14YpKyK3uWd+F0SP%9&Kj+nak9tWz4
zlg<CWmSfA3%>ddsk(KBt9d<;UIU;)a?n#1F_|aTq`F0z|;pITWoZEgTj25X@V^6lh
ztTd-jd`<!M=d-b%y64RZTXX$VJ}%%LYy};Rpl{P%*nG`FhI=sW>so|hyHbQ=Whbqg
zs9ArJ{UI#{u~KQWss_k@)4Q-~u@GG_-YGkY<C8Y7oPB~X8&nOOdYq#i*i(G{X-V(p
zs@#dPy9e1+>{ys&Wu{gPlAXE#=kVsBSJc&2u*}btnktbhuX|lBjQ&8SkFrn3k5%tY
ztc?SfPuk6LxW{h#%&}&R3R&$2PNwyRi!uM@inwHIlKGjcgnO5Ooz~{a^1aPO0`Dk`
zlKYPEN&lI0M(e2|Zbo}E)~suXZ80r-TV0<M(>pePt5zEU$aS<Piq+_agmlDZVipi}
zR6hWTXT7dkk7_fe$|)PsFsKo7U`zZgJAy0NXoQMY&9WKPkmxX^8i=uz7d+|<kT>#&
ztVG|MyD*Hv)ol(<MhvDiCI?7Drs)|NDKFP6<>Ol$T<<5S&xpb^l!Xr@>5wK{*ChS|
z8_Zqv^hJc328Dr}VQ|%+Yn14LaxySb5tpLaYjC%hXZ9%FZPt&Kid@9+_pBY0|JyXw
z&dxN+Fs0E=|7pVd8pQ4;TL0aP>#z<k%b^hSUU6Q?;Sl4tpca+RdVHsw9$mI)=f+RJ
zXPIu9+pK4DwRa-t3(s9ZfRw|?<Uk}ij3Ykg7iilk!&og1Khdqs54FA|Cg#862=|t5
zA&iI%-9{L5pmfdp4Iy>Nq9XJ#4=x){qd$BybG>L`*wR!ODiyBWp_SNfg(LD9A3vt@
zIcl4K?8!b&CeZG%f$X%O%;bOjSSN5Rq{O@-n?*W)zveAkZa<3L|8&d!kYGxy8b@ZB
z!!BV{wEF8WcZIZ&7b}Zq<A)BO{g|lHT>8+ZMV0=g!lIqGiZQC{8bAG76CW{x1^uMk
zDp&#jY2ZaB)M&#{-cum{j-E!RX3B|*yh0TPM?Q@dp!icESJt<$Sxc=mn>_C#p!>g(
z0~HXWK;#`uJZ1CD!K<r65g|Fxs3(D8Kn9PmavvblwcC1jlWuSCNhOcKJwg$MX@$^_
z!E06G{!PDty%PjU4DYG%sQ|q{Hoj4oOc4!R4u1^y^OKZp6;>xjbKtV!`tdl;`s{>)
z7Ha<jqjrAgV%Wil`Wkj9!GGR-a@WSDj<Q=TN)tQ2EC?+yhSwX`_^zz->)p+n-6o}Z
z&~y5oZWvVNDW$|(_;?H>*SAN%WR6=Og9peOVd3g9QUx*WRG!=`KDb_N9j#~anvCvX
zC_I=WZ^Mwf(!|@u>Oxn|U@C)@pvl8!_0>&e)eK3Vk`JdJ<V8SEcC+AD=(DFN(c4k^
zp7^Gy`I3dxD9kg|G<%jHw%_ut@;w5j=mQjWNIGg%!CkQ7&SWIuw|jL65oGg2de{wS
z&STQ9x@R{nFVuX@BgwSc3po`~*6&sF@Z51QOyL$=KpqV+6+{Qth%(OFQH8FZosLya
z9A}Ov6Stl^uhzIoAhPp7xQsyjmUsRK^YOznyOePiw4Py(bawXxF45;kRON4mW<%$M
zSUshYuWqQL86&2Z3}fylw=UVN;YvMiH5;S9fB)_p$U#+z*7A2;ogjbzj2#IO%ki-v
zE{;bGC$8w%IiEFTng)u+6G9CXw|vfRH*PPdlQGH`<F2!~*URF{L!iOzmhwO;GEsk}
zpAgBT2?dLm4A<>^aA2J!g5>#qG|7m+czZhk=3&{75?uv{mL%oEt0D_&VL$V`3I2W=
z0DzaKH^O}9YG*tM`LcMgYA_R$u~)t7**{C44fXN;iu$qq%HpQXf{0}*t>4!ZdQxA2
ziTN)5cb}SsxtUO^%kPf^N;AbvQ#^Bam;*u?fW$p6Q}JS#kQ}hI<r^cmwZwlE^PI^U
z+eOj==k3puG_;X%O)VygUMAs+#OK#6fR0|bhSvyMixuY9p~@PUFO^fB%9>9#n{$1#
z^mDP6J-4gk+XKsex-y1tV34u+bF!&I;UX>`74pKF&o2moX>sLrjv8G8H?WkwSp7S_
z5FGJXu|~V@Vn{5-8fCufvujy;*5j0tovP!iE~SdzeGLAlx8GAn6b)?iqYHC~)9`q{
z+vef!i&(8D*Lv=h7%7U<8F)5XDJ9Ra`J7&Ja}Z(Tx3MRpyRCT=X8b|JqRLGp=QU=c
z2#X0Ji$2e$8C4;1%)n`o$z4*Z^HF1L!<%@m*#H+*6VLT=P@~QtXYO(j0>>e!rN!CQ
z$fhF)(}3{U!{hQZsVq-^hob$Vqfd>sQn9t|6!o02$Oe^)XR6k1b@7_>z!sR%#*ik{
zsb%i2+4Q=}(0+&5R84|9dO^RrJoJ$ZV(^Wi#cvYIbis`{Ww&~Ql=`>hd)GPd`z8cR
zq=j+R%Leqji|19E?2R9;i7=}-9xRVp>I@LYT9+_^pL!yEe{wr4qrKAD()>hl4--03
zu6nQi{u~aBN)XS->La#l^AZ&lm1WvH1#-BTvIGw)#;i&*A2sV@QyildGp;Z9)xOTo
zL6a{=pfYxBOe{07!yxt?OJUec%fqE{rI}yuRj|YI_nZcPUOx)OH%d(RuQv>&a-#u}
zRx|Q?t5;{>3)Z5aaMA*YEf%mQo2DoJXnq|oj@+U*2O>*i7xNuPxk-Tn=l%j)nKWcD
zAJi#I>OX^*5?{}V%3@v<&q^hMMtTgG^;;h*q>AWF@<{&Vu^BP8-rTec!a8hD?TAME
z^cB3_w|7;L>_MAcZP6NI5?6fP?&s@MmAc$n7Koi7J3oFkf5!z?B|O<|<g%7qQ@Qqn
zk@EB()4om`n~ZDuY-ovksL68-lD>G;ZF7+R?&e@`PQ`s?fP=Y0i?W_7g~AipLLK<>
z$VB5Y25Fh^f>(yk^6QoEc+e^Ia=Jx~a!FakMY`5XaX;Sx%nY#hBM~wAzPE4&79>89
z1vBG~#(o>^=O4`Qzto!o4F=3TFZly3I!5fS?0@VK7>9}3=U$`0I_p=_4_l44ICW<+
zV_o*q;90BnKgMm91X>D_7u`=}#blP|FAv=P#l}<A(fzpF4$h+@`@PmPdH?F{wEizt
zdGvUdQ}^l@Z43WPH-2^B4<M?nZmfj2h*HQYgsgJ4L#(VWS?E&S!|K=LoRB=0vJ;XW
z)M3U$-0z}1ms7j*MF(`bh7GreAt9{-{-Sy+o@m!*x(3Y7a14$>2o37~tEoJ=1ONW<
zkUQ$S5&t6p0SDi&qQ>!x`AYPw#Kc4-#6-1*Q8zue^J1G9s<G%{qOave$egJf8ck|i
z@C|#lf^eq#^jYY0`QJ(C*vGrwT5tn1Gf4ag4Q)iU+?W1+^TB(}|2-W0--Pc9-``(p
z-5Fr~ZS}L%V=5&6f^FTbV`at{GHCBN;S@2vNa@xotiKfw0N9Gw6W@fN315n(@fUna
zVLB5<L(uo7lz;y}A1y2lCA0dRhj<L4nwWrw5dQ~L-Xa;c7=L)N<nO<Bh)wnUKlt+R
zbaY*`<__TH;qiE#^>-THqmchRgo(Y*{vQDLFPHxbLjO07`u{|={~HOe`{Hc=k63^|
zv+)b|UlYH6Y&Iukp1pL`vyO@Nf%;%Fg>Ts5($vpXEB<0d>EU%Wr#R;=XKQ5Zg7N-g
z(jQ9mYR^vHpB{L|@ve0r?rtjnwCUKkEm=R9$_pN<({eD@D35f`ovt;AJ5skbqyzxS
zBmJDgPv*=eUDYOJH*kO^U!#;L5}5YSc21dxRr5z!c#?`r_`-`^o`b?>^q6D&3B_&f
zs-$T4@5ZmbePSDYJ7czUWuxO?jPs{;u{Y3yWqiv)8AWc4a=47ADSMoCd>+dalkEHE
zI`YLI;ALP#$l_GHaAg+Bg$K!tsiyCBlL5RwC-{+2nxIc*m73E!MJ(6?-rPV{H@mQy
z1#gu}o0+JZ#oWjt^`+6a3&%4dh6saJc{aS=!%d^`KW*OjzRqpH+!*@`OJYwZ3f7jT
z=FN%vXlK9FKG3fYXoknon=}WPu}p8<!Dp1zKGPrmoE0zD?wnf?E=G1|Cwy-g1V*yj
zZf4HN$^|I2;{jeY4cV}dn%j=X&XoiNyXf?lPyFy^%|{YfmY_6SUGO~<bQi~A^A|cB
zzTH_=sDmI0t5@$XEiPk{X&+zvP5<eV$d~ehgRhY?*|qKGI(6kbthXidXFpU)JMj}w
zoY_)i@%kaxWI*bG%rfK^W#xwD)-F_rtp2LEl%CAoREi!L7~8MGt%kdv69^6NO{x{2
z7E3Im)<|X(xr)mOD!Qn=3Bf&;N7su0YaMb^?Z+FSBMjzA_2MknP5n9y?rzLK=#cD^
zj+>-;4LYocdJEm=v1p(5aomqNT=phj>n$w3tcePH3U^ZOlMas&<5g;Woi#WWuh#aS
z#Y*vRbh#ujrML-qh`0z=c|vDGuUZcTkqar$v9CF8HWmANndWqLAG=`$cc~WWmnIRC
zlNbEJa}pTuVdv)y{EE!x^pgdJ`L~ywihHgxSWf(K%{^F0{-a4gFw!q*%cECZ?S>zk
zQ}H0y&7znuTS($9smAxQ%kqqdw<EW3=YUY6Cu-ptalQN?dKPZCTYY@n?xs}FYv;<z
z?n!|skutzo7WFk#le|J*H;z}tZ#Ibq6Mj^2&qjW=cJS&p&YJC?r3|Z$&?hA(xJZ&(
zYydQF@aPIOE(^nu531eLG}(3w%ja~ho$w-S<;bUGIdv3P@k6t9nQ^V=L>Xrku5=nY
z7%C@q!6YE`ft&kLDI^%CULzRX{iN&EM~EQK%|Z)GPb;9PWl_*9pzX89A|wl}RI+!S
z6b8@Ttk$Vlek1Jbk~T31ftn=C<`OOQtF*xaLgkC1T%MnGg*bB0n5^^%7)yKWpiKIy
zRc)V2H?mK{Q?*wcbX0yOBHeaUw7$6G1#1@!UIpbvR)VI&mICuMghB;RPo%bkWeBT|
zvxjHLlWPfgDv;QlHbo`j?s#kaw9y#(RVS-tMH90-Ito!H;=$iu$Ot-RcQ~4N+(w>=
z5`rEMD6jKYk1ws5+X?UAzvu}ca@dpmeKyxagytZjr4EB>qZerNW_kE$$kxmi?|wYI
z9}+N$A3U?c{I%K<@}Xjwx$aUdwRS6tIEM({dsb+t<FcuwV^8R#o|LG|G^-HcxobMK
zS@pOP$a$N0NRxa2Zsruz1pg)YDG(Uh*(1&DsBZ@=sOeTuC{v!=53x&mF8kIYfy*~<
zRteMzZKfBcJAzE@ID;YehVjV>C85!>W-tBIDigtbAYef&dRLB*@yw7p3`3I}TT*Bd
zQy{vTl2~dz7O~-h(8UH8Nk|d#$1g9&-be;U={A=NtBi759d|czh0Elo(UHi(TYF>a
z6piwW-0%RwovPGv9*df4*7*fI>y+VhIr8d)Vg;`PjiD5Dj&V(iFXTmQBB5s%uiDzC
zCzD=YBx0H88h92k*W6hX2GikF2VQoMYpdpmYNt2zW}e_O<(3C=aNt3rMmN;d_-pjc
zxam3>)~An#vyRTppA2gn6qJ=tAofFN^W`<<lWK<XW@Yh;J>?Ols02o!*Qb2ca+zp-
zKk13$2WVl3s9j(OF-GK@_eF64fWu<>rvs@hmrZ7B>iX~RN~iQS!R##k{qp^byp_kw
z->n7lN`>vtfCfP*2Ke%TrgCEXqz@4tKK{GXT)4KH-2?)`HoYHWOox2%bhdaBA`IBw
z<uDC?WfVsPY>Ofi63IC}3_3fH<9akQsoQVEW-jR^0sm4Gsk-BOHg{!F$rxV^(`)tB
z_nrH5xGwZC=Q1$E*(x`Nh7i8p4q;%_BLKjtZn;a6LFcrTRy>e|WP7eOKe@=jPNVZc
zKHgkW<}IYzQYpQrt@oyz>Nh`MdgstMoptWItqgylo%(`_71gPr>-8Py&uwCQ!l{>Z
zn!_W4SGWU-(cRIOtm%F!L?m<!73Aaim1G!6x|LCGN&B78K!?{qS1Xkj8I_ZUeZ1}!
zRJ;^EL-%60W%XEXXONGtABR3dqghO=6=%}nTe!Ba$CUV%+Jf%B0@A>%i7MK3b>H)X
zjmi<`aJyhlXmHt}qD()+-oQyS2Rj<iDUd><NA#6`@URsla?(bKZ|(ScQXVpigMZa+
z%XELrebN`58=bB@OrfNDgEw2m9mSWB?5toaTD!?mQW`U?Aa=|@kY_oV?x*Qwg22j2
z=vB#**EL-ahI(`)O$Jmy@+^vmSc+Ds2v`eyj@{0R$>Gw8(Gm$12lN%4rBX)=%g`_Y
z8)<xD<>b-_#W4bGZsLB}%8P|LI*ekx>B7eEoW^dqdvt<n7R|~=={tE1>bmh1d~`IW
z1jxB)A(m5L=2L^YHB^CxEaS<7xqL;2Mr?ST{Z`d6P!@%R#!+qQVpMjCBvE=A50#Ly
z@QHO-Id=3qaJ63*!4S)9^w3ga16i}~)RMGbwWq)EWkR;}Ysx1%<>5lNAMWqxTgFC2
zxzk<mSA3n{@Q%ehO^|9aZq8=IVV=@%L(!p7nQXa1A!m^P`umV1`U+cF85RVTj^+i1
zXu<Vq*!H^YNnSefVbabB{_M->Xym)hVXea&Dubz-ywfR%^tpVrL;qKEUv4sxT2!?N
ze6dt!cNi1tN1M0qdTW$8UM9;z16i$5vVZVOQlYz?mZ?-w=0(_Q^`2=1NQ1v6a&rI~
z<|ZXjHW@!$%w->_s&3iKB0aLy5|nUF`-yvp?GfNgSy9n;+ipNc0-wJn7Y`s%c=n71
z0MN3p!jF_8sx3Yf(g8-uEF@*Vc>b{;x@+HAVV2|D3n-@<s8FLNf|ZmM>ql4ca(<>+
zm2<OLSWR0H2Ng4`?n{_)3~*O1l@I*@R}c^omTbSPXEDm<hX>0PD(aM43*ZNvSnOn4
zY6A<IM)?mH>fH?3%H(FNg)<9ySkyS?8g5DBpf;EgsWd2Sw_G^%I6d+e`NWvdpiFGJ
z5MTE*CW%Md87Gyr!P-@CKGWkDy5vP@D9X<K!<|s#6Q6Efb6ZtR_C-ci%v4K18Iz<I
z>>Gv~*~~?ol?|CEW;K`Ui`v^W=iI@|;iB6Lu&Txd%)+j5($h2%q<95Y#`yRO+h8mR
zXmKRZqRe5kBR&>9eW**-i9dTvj!cQH<HVbTJxlfiFHX(K#B#|LxXyA<S@2EbN2*uS
zm22>Wr81$j32CqJ|53ksuAgW5E0d#K5DF3x<r~(j!CH?kP}2hY2KO3|#k*cal*@}W
z6qlTB&LK3}(_hSZ<|4`G9ws}sx!QV+=9GpSUGA0}!a31Au)v@JCJO7wbnrg3<R(s}
z1m^G+`#K1>u!`(U&}>z2Bq?2Qmm50;8>e=DOyqNFsYvEd(e7u%iDG&TCyamgCc9Iw
z|5(v=Ng~h4-B=%A*hg0DDV-X`QuUjDGY}^5DH!0P^a<XIo#PzveX!cBatgm%VSK=e
zLS?SDlE-;BvUe`ObmM16AQV)X0Cf|JwTa6{5`Qsor0Adh{$jMy*VP-W*zh5_=IpgZ
zk)amT51Aa;5BzFsgC429Yo2z`&V67p2tY^VYwL8xN3I+)#d|c>S>yk{2t-++dsn`A
z@RpS2sUp-R<JYv~qiR@p7?+CsvZgdJVyNFDjv>d_s(d;L>5l&4qlI<Z4~#b&G|U>%
zCOdPx?hXs|!SIH!MnX%4fsU_RtF|SOn>gwF&p4cB94Siv>Per0m#}U|u(Vx|U#n(^
zanUy!icF1ix|j{p9jHuU;`A|rVPUXlPVDafq*oTN=9JAGa!Ybycd6ZlLV2PlUzksb
zqh_FbJveX#-!m->$G_S+M?Xem4bPUBLd9Vy6_OV}8DQvfGe7oGa@+NKGsU<EW|@22
z>J*y_p+(z-mk*=z8JHwD7<^xla93}Oc_phDF+tNu3+GTH4x@IxMQ5-D!87{^oDI8b
z;m8m0`)*BU8m>9pN5*E#)DqyGh^HNL`U+22?QO|ja5kc!6l?&2LDrDL`LGX_`@@VU
z8?2LjK>WUS%8obW*|20%0)m3Q#hzdwgDyKTgG+1a+M8M4-jFx)UG`d@2KTh|;9FKe
zq=eOU7$eR{w>_c3>jAV@_I0Qq&^IZL4=faE`s7tHY_;7)^OL(6Xwg$1-8Bo|w3fKd
zF#!Tw&<AKjat+-<ttp{t9_!#+K4lU{Z3W^lP_u{5T0w83Zz@6RT6WfVX0KH~SL|D6
ze;}aA3%~PYd*%y!Pp6`+Q9g9S7rOpZtMYaE!<VFh$S(Z_F9LkY-zDt-s27~l09)RA
z%C#GIP^P>!F))w_gs>CXgCE%BdHLuhpDxbjRbLOF5-JeOM?)C?k#^VPVk1xXt_B)z
z#jr;Nk53O!*!<49t*;2{QRE+e3KYv7>~FIw6zcbvIryk=CC`oSPZi75pP+&CGMNuN
z%#okiZAcl-Sw@qCH6&|Lfhin=y@eL-n~+<%*6HJ~@99hu+=NWDH9=-12lupZ|Dmix
zn^We_$5ZU-$^AbKcv)XeMF|_UwCUTGJ2x$i_LbDJT9}4-+E=vXPW|+YG!`juc_?T8
zL+-3eE@x|azG>)P(TV+1BT3pib0}2BR+hPJbR*G}T)G&O!5|}6CNq4`hcNRK_r@+V
zM8TrSC2B_RQ%-5_mna!+An;4kMsRjvOvwotage{>?-Gsvffk+3(Y8~jYCyiel<c%n
zRDnrczDXS3F`s<StiC;;Mv{Vsd}@cLVT`6>W_p8w5U;`qiXH(dw9x(jygW74A-uBY
z0MH?qy{`oIiR$*x%YoZZ#A6obTIaJ$UfTeXn&5A*fU7p|FaQErWiYaPU6Mwdak)3K
z3&<a&k|y2GU|U_CRC+Opy&v=1e$mHg1^T>{joo@!p7oxA&Y>=)n|fuAj5CJy#h~WP
zbL)+r{wxh#Sh7dk;k|zXRtB}V*Yq8tz0BWbC8O|j*69uuWr3qk{ZE8M8PYC<lK0A}
zMby-A;x@=WhL|$dq>9w{!1fTWaNT{#oO)7Dzu`rjHz}82-czPs^1|9Z*>q^mI{##<
zyXLTQ8uxb$9D%2{@U){MN@&Q3@2-9Og`_41AegR&E1<oxAh_S2S3`Hd<Qy0}@5TB)
zxmGz|%cQt?Emdu8bB``Eg4v=E*$E9_dvAcBM8-1bzv0T5ZDaRQ_o|1_x0FdG!z8~T
zy0BJvcSnE)1WMs#vJh7qe^OuZARxP7K|7x}ezNWrO>aXnQ^#8%;*HK1C{%-CGxZ|^
zv5kWu?JqeOl-G&ODSiVMk-hEdVKXA0TWG_EHOBNyWFzquu>ddl)ReAwustVn<cG)T
za*X41w+TZ!@nuOY%lG9eTUKeKtgG&~nI=na?sQM-iGfJiZ|2m3Rwu2nT6e7#bRBlL
z4HF_y+Zu86-o7zPz66`P1~N5cSixI<7^vcB;y^sdwn_V=whH%yd3Dp0N|P4k>)`K1
z0!FK>)X89n<`etf>H)Z(Lpm{}I_FGc`ic{DikWlW?ii}dzwGWOmeEktwNua6b-(mL
zxk3Cf)ao;G^vjw54aX(~oj*WLtVvWr=x;j_?*x|#uIwqh@UXk7QI}6E)jdiDWbK89
z^>Ud2F*vHc&A$CQ!2y<sQu#Q>qb;MOS?8#zkYXH@TSmM228Holl2UrR`R`cXbI33S
zqUg*JS-`uZS#=AZI8qq3-i{5-n?$i3DP7SxdDhC*@ebY^e+UJMXvChEx0KS2{3_yM
zb?D`v09;AAo)>hIM-e#NcmQ=ecS;J>=7cXMYTWzl)Jsj*3V*kdIF74I@2=4RgMnO1
z08;6uA$@!2v~;9yX@k|-sg0i7qVq<oqV%v#EH^*ZkLPQ|+q-++P54R#oAdOv>F&$D
zKC>lLhhNo2WFzBj{^*!bVnb-ScCmRubXv+bDb>x#Tc90SZb>24ULUV!Zd!U_S~{~M
zv07rEw#D1HM4P>-sMK+`8UtxQ_c8EXRO}C%VtRaxPCG@TY@6{{)^e%}edUe%B|`cZ
zHHMAF&By1~Dk%RYEIg5k%Yg?Y4?$^}L4tnFOL#4$ziOB*P~*X^xkhz{%Am99U23n>
zn)4SA9{fhl;FZYPz9l5Pl3_E-<d0Sts=o70|8t<5o%A&NIeV8)%P_~{Iq{LJ>{7yu
z`G5tdN{xzbsU0&D)WX9aGiHpyr5V^R@4j>h{A$>Hj2k~um7CjXZPAobzS8oV8>BxQ
zheZ;>=On)B6IJ-FvL=0DEBq%7r;P)!QN^g80Ihef1rx%zltg36((~j*qvITGlU0JD
zhuM$c_S7f2#jkk)fq`e+c)8jIKn3#ninGthW-3wepg*R<$l;Eo=K=8=)hu51SE$U-
zNykn(Iv^0g4xToQ!vg#L2E=x9mlTS{3j+Epo_zD6Yf%LN1m5X6D1vrh(nb~mP2(Lz
z9ot<^20Rj>`898vE4S0g8|kB+RlG6_7Z_VlW-AxgSLZO&4uPwS_vZT`<wa38VSnUr
z7|PK8R<iDw5SczP`L8PW^KHhwO`}&Sq6Vf(IZPU|!Vay-KN1P1Vf}$F-1%E%EotZ=
zPI`BwT#2^g1|L3)z5=_md+)b(lM1vLnP<}(7^09Rq!F=J`7HD;;rg4U3l0I%4YOd=
zmnSY61;bs;`<$v8t6(xtz@!fAf*coqeQOM~*MiUe4M&V6TSDunwp$+43yfrLIlJ#+
zQ2y9gCFWky-#`y_6)mZsH@T=Y(qjH_zqA;zVXbV?4(K(s+qwMuaV_N^Xe@*mFFJNa
zA?(Z&`b0iw7v^$>+07(%&+H+mI~_5(nu^P6tnCo^DnNA@PsOgjKF=jZenR)DL?<cc
z(4)jNdQG4dXTip8AK~y@2hP}wzDs|pT-jhXe1J~LWa&lktStzA7)b_ANw+9CG;Dk{
z&2@^SZz=6~LBh%ac5h!T;Q;e5+|T6&)GFsAHhdBH5nJ72_qv5V$fa5@70|`B|L$ub
zGNy{1@1Shj!OIhy`n|e8M0#@Cb<JC07d^vb@4}crZ0x@!eTnTAx=fy{Qstdmn^62!
zCU?uDmeG-~s0+^GLW)G+$Li?$Kt<=o{qDKRNwtHdV;6~(qDeRavg-#XJGh2x`UM|?
z0@d20ss)!kQEbn@zBlU&A-#yXjdwXQn3v-}3${x!t1hQ4+fAzgfsn^GMnLBT$PGH!
z!ZEOUJAirzvnaSZ^}amBszfZZSwG!xX79BoX~{v=1>Ja^af^gnIj<!|bIrAyve3}<
zclF4RCYmMm-YHildha7U7TRwVuAY}@Kv8+}1b?oNM)nb5@oPLCNM8{w^%>FdPnx1A
zv_|?o3LrZXO$Y=Qj+)1~Uj9QgXuV?;J~=q_W>@JTGM}-a69n0KRyq3#Ehd<F042jl
zpQZK{K~2VarKYdfkce=NTes`6rny0zuhv7MYlO5t?5<}J(Au_T0-uC{F1y@XBB3D9
z`;*)%?7)WHRd#+k5C|XPb6m4?z7#!!ti&p5N#5==x7&4F6kXu=*yuDGGkO`+;=L8n
z>X}p2r00I=YnzRGH~IEl|4z|Fk7Q1e(`x6e^_lHWG#4tp!@tC1C0QAv+uAsEhjx&h
z@-u+4kee`auEFrQNI5oJzT|JO($Ax%@gwb)<`Imyd<Dnn!TgBqoDx}iz33Xj9^j8(
zz6mS0ylg${YH^d7C(oK;XeprVaLYRa!~^6h-|k<&z$9~s&_2tgw@KGsa2-1R&Pz%P
z#?Q4PCY<Wa&1Kz*ZY%$dV^Y|N_iosYg<Yt$pYS0*&^g93hhLiP3pb)H4L`c8g_r~g
z1h%PK17sL3h;}G^WRdgPJ}yNbuN^lUvaz2DMZS?KiNOP`H95I!he;K^XJ0D>x{aRT
z12eo3^G}5oU=cbiC4sz{QKIX?Ge4$H1br4=WpjgHeCoA-!-|kC4%t3(L=fW#jK$O7
zGhgKFCZ`{^>tT`SDjRix5!Rg`kfw`yvY@y3i6<tBSuDRL)?$-;+YYV(`aloU;Ox8}
zAWd_hFk?$dH?FFYGi;jtX#tVK2FPjvQcr~<yRy;NI)Q+VEB6EkgKaN&QV9jebI{jc
zE}Eg7VzlBXbDolXKqP7UtGw61C=f&UH5aI+JzzZgC7VwXWp3B-f=b7<uIE&(-uTT=
zW8K(<{HcWMu8$IQIAb-Q@0qjot3dmT>-kFQqTB-$$d44mDba65W<P>!XY%h{+U)}(
zF=RX&KkCK2byrNz8-31a+MRjo48$**5Xa(0ybqdPz9k@fVh#PE0CF?!CgxshGOTA8
z7n<H`w8|Be0O{v+&63ux?L6v>5g!)23Cm8&RbzC_ZN|)XSYCg~256Q>yVwp|eeFXL
zzl|soNFZ0REzC+kk*<sQ*kd_*bS!<L^P<`amX;=i)SQL#wexL<UC5QpxTT~46qU*(
zbtSaDhCwW)<0p3Pc7cW+e=oht;RD&!x~$J}sTKsJt_5pPyL_tYPIjqu+Z&iE=P*4C
zBE~=qzTqpdW@%1g@iBt3zMBkK$h!x*Z%}h^nk1x!&3nCOQDG}5br~CX32RbllyZMv
zeRtdOn_rk>$=82Z)$u}mDvZ3ftZ`p^^>{YjUUT+bi8S8E8OkFxq&JBb$>vbXkkP3G
zLVMvA`k(V9R}Z&cE5j3-4NIrP<O_(Q+SEpgs~0C5s75p2oD+-G<MX(mSm=<1VQ~;0
zax~k*Zn7T=y=;Gq)<05VszBgNxCd98pt-XYwyfoj5<4!MnHN(4Lhin%xPDTsCQpJ~
z^xy1KH}eWfPHt0r>$IztdqT1oRm+RcxIOA_x7YAtZoos?S;pxiU0>!zO_sd964SpJ
z7d^0rZl$ZPi42HvDt}~IR6Q$M0gc&%(d0fY{Em+iDYL^7Z9TSX%c<tPw=QN{RO1Da
z6JR`#lhp}Cpizu3(9V0O*#^*4d63zF(OVH6qcvf2li=^>GRyVdZKbxqnha*;8xm}S
z_zxB3W`5UsG17^T7Lcpy@)FLSz9@fj#rp`I^@CsVo&F2hrzKoQ)Wzi-*<ELESmNd6
zz;*?q7D!y>y2lI*Fhvjvls)|yr~}=IH*Qk8AnaY;9$7Xu=djZ97<hFf5;q#%I^PLR
z9$k&6%kc=xRIj+!oD*k+ax*9!{Q#E}060y`zncep411c$(mD8?;s9p<h5LpH<ijMg
z7p-;7##<6p`v@X?^%$bxHVvWikEX|~H5T+-dfkd}OL~(|Q7)a|nS0Z9_4`^&g*7|5
z;OPF8j*pVX`~%M+DXDZcva_K(_ze41(A#+G@t%G!R~^`kknJnCZn2e_@++>@A=2{k
z#*=gF-7hf$2I<|6`;F@hcY1&Fg+I>)OifTfEO0AA=jD0il<}iCENjYZ6|4AMYJmzv
zHX3UMIP$rFF!V_pNkaP5?v2!UDa0gKVeQk&E4#M5)hWMZ?!NJGM^`An(zUOcg>L8}
z3huhXps%|1a*y24UK3~n;@$Tgb@f4?=cPezLBF8p4@WwS`vl#xL&M+#vf5#C3LsU*
zs={4|;hCQ>4A+6YXMMh%AM9XV3~!N$HNJJqSu!SbI`{??{DFh!`m#WVM!K35aWcfr
zNHy#$ku9Hm37Uyjqz308bY+}b_>pKo5~r`5a}`6cR{u+3E%2I0)Ftx=26}q|*HsxU
z(pac=*I)@_SdSY+my~GM(M24ToVu(X+HC$%JgMM>Z!<1U_{Ufcccprzia(H_i4XXm
z!T2&sw+LoQ*U}FqC3k^I$GMMY&r@ZEsCx?e6Bbn)Q-b@MH>uyL{Df?KXne+Hna}~-
z2z-fsDohZa;<Pujm=OM0tU)|ePQaO!1+w|4iu@xjy#c33XfIPpLOJKOBVBd<{a6Al
z*;K-Z4rn67daTt;PZv5#Im;zMuuPjF2(F%#Qr(#NzDL^tqL&YuR*e^>Jt2<#b<)XI
zs>vADwbwsa?b<Z9luRVxk!G1K4$sk%uCVOa;iLsR^PD~0nl-m`dD(b%{_m2fiG!JM
zdwE3{I{g>RP35m`3g3Muwo?2z*u>z^y)Kk&rtPl&f~NL@P7BQ>58OYa^U)ni7JQ85
z{LQ<bxg8CC94tk<I39=zKejhO7Y-(dA|LWgqrq>sKlS}&ekc7G3G5cvf7(D_{9mX3
zw;AmJH5~t6Q2c+I692y@$g)+f{C|lB_<xgc|Gy@V9_s&dg8xPiK(Mi~K~z*!!+(?O
zf3bOZc<}JxseB6xlJ=k8Nc)xmPfzKq`a(u#FUVaeEg|uE#o*s5{cS|n+tKkYKO-aK
zit)q8eN$+`T|q|1O83Rm$@K32(v(okO-pOhpJez44`3kNc@Dqd(Pu~sN7S7ax;B-J
z^j#)8kOWP4zRsy2oJ4F(;P=3IwC6vqEPodbwi9qzYEV||uZQ}{FZAix16*9Q$rf~f
zaM7ZO99rt<a(91oa5MYK$$$F!zpbDH1}FX2Zj!(G?`(wSLkoQ$bKjj~Mm)<*=65he
zX};Rpm|cqf`_Y1FZH|#$6yto;c8dHn(&~uUx#!=yzsz7`haa{`8yWpeu6CnOc=__c
z8?hjyt9pZFVk2gCaQZjg=U~KhH(XlgoV0V|e%0w@bLhVG??C6_L&^N3YqcCSx#xdA
zz`&FDZ>Y-cTb_TIs+G|X34BQYt$FnLEBU49_XN2AQP97!6i44a>s_=2{D1il!+#TB
z{QnXH^Jhl??_n=@<#m~%$0ui`n}5Ea!00hM%RZ3i1y(TaGj1uDz7j1oW(@B^wfAsb
z-?7~3h2ER%0`_(ZT3U9_4I4yy*8Er2__yyuMHcb?C2bIxaGlj&xat4X{}AJF=oGB$
zTp~w8a*vsA+^VY%SGAoeW~1I)YDC1o&ZXX&NdskIY4iovOK4of%+wuato{+(z1<Jl
zzO%bNVK@4B&FV0)whmvuFC)W0waqWwCOJ^wjOyC$_mG+>op>*{QRxSY8L>T_+o?yc
z@A)>&-Wde@F@$<K7^#nQoNYFP`Csf>Sl<fIwf+%X4;(q(qkZ0*lklzhDIMwN#FI9b
z3h#yjB&yQ=P(?BI>K+|5Wz<*;R{Uy-e?+IrjsevCrGX_c_p-z8;Yx28^;b#tY|R9v
zw)Bv!e<)ohf=j+D1@Gf`3oJiXIS%yM;0hXGed0gk=n6=r&lUr0hW5S+*Y~2kD&0`>
z4sR8!>!oi4(@b7~>l^xqhfjRYPxkJ9;Eq(f``N>J8gvYU{!PMoTl6EhrG@y}UZcJz
z>#XH{C|!YmkNHO4Xe-jy-A@{MfUncru+Y;&>3*}-Q4{LTFL^1y1c_^E1QBztOoodE
z%B4uSKqwKl{|9?-71n0g?s2x|EfgySidzX*T#HMgDei8;-QA@v7QDDap|}KhFYc~E
zibHU>0F(Cp_FQw#-bXVBdk!Y2$&+WTM{fE3?{%+0>D34G_V=vbJJ;?!LaCaM_06rT
zmDekIYqYCrcRwio?~B)Bg^)CSQ=tyW0|Jdvumc5+r@^V^1+BA{`?EmXIK2$+?a<)G
zQAQEJD(CLLdzLyOQp`1<Z`G~WEOH7nN8oFk(c@!lui(W3k7+H}leof;>vWpY(aG-(
zhsK>;hY5TF<-*I^LRXHzy+>mM&#`*#KHARHx<(1#xvxX=S)Ba(d}U_hy;Ufz6ppni
z&f4yqM`N#7q8~TIVWV`EOV<6XnQs`p$F$ZD4vr4ny@uBAgojT5nhs5RraNETMmmNi
z{fkyC7W+`B?$BK~?XlPDO0c&>b=~f-ua}GM`VFNgsWQ=AgALsqLM+*#dn9?>7auir
zTwon{cZn@StAS&5MwToSpO#}li{#fcIwCFxP^|ilqVjR!vs;5Bi<i-<gD}LRh(jwP
zsJoR<&sG*>Nt=6<wAIi0Obk}a%9mBERC3=W$YUk!X!{b?@!r+VaDVd3Yq9zh8KyZ}
z75A)l^-y&0f(Y}r6hE497<Ba)OSs(1<)crc_qeLE0~Zw}poFh>G!smd2=;amz5NXR
zb#fs|a2<3}vskbzn9^e9jwGc~4s9Js+%FaKhjn-zuF8XiPdZ!H)}J;`+R{E%xk5pS
z4bX85{3a%voqbO}9ds9&*!D$YUi)kTOv_%pJH=``hEv%wv8V3oS{9r3`~w%ev*J2d
zmJE59><~<-@RCRNG1=|iDs|Js2-zJ3HoX@xz;hq=SfwAl;PU6Sx#1H{MN`4F93;N8
z5sSw6B@#~mU8Y;FTt`=1SY92{Lf!Pux6c)QPOrhofcj9E2=NUkQ{`s(Pm(ToRw^T{
zoJ=dw`0e0>aw0hOm{i2MCjVgjE0zfro?w%fV_t}^vT-Z8ICFZ)w?sYhvL(*rQ8{rq
z82p}HJ{3P!J29h~-l~1Mr&WuYdqRR`J9wlZ#w*|ekaJemUL4K;wqK6qJQwM}a^Gax
zcQzl7^i`?^5J({|)u3<7AmG<%yKLreqy^xZwziGZdvr1h@h&JR^K~M>IdQt`L=JG#
z=n3MgZ$unX?jrT-=3uxJon$CZD-k?3b8%4Il6)Wr1j_w9u6D%2aA1805GWF4vN*a)
z0!t<}AIlcV?M@8&qh(0|YYZRm&%bfw7qz!l-H~V&*jZ#32wn~uhjy7xhJ3A4TGP)I
zQLEO$|3IVgx016$Pg14x1w^7`<5wOP>b%eG*Kj8Qz^bI7lq%^mJ2txw#rRsWDQNIO
zdJvYz@5V|Zg$gpll~~=!BinYmxJiJ~#@=EOlrdZHQtm8I4AH84R+lzq>2gC7BZcN>
z<=ghVgD$yNgUI6(Ecn_4ha<@^BFi>w(J>qb1RzCiQeW++dIT4KC7^_B$j=*5IqLK$
zUb;l+P+QZ5lMN_^l20q>H;;9ng}{c0gXd``ChUxFvmaortde)zEHzXxN<fY&g?Mu^
z=4eh`7$bj`PAj(q7egvZMeA=_E^|7{RK|yk`5*;4^1LCj#Koh_OYD@i<G<lVg|eiI
zAp?o$B7c4GMk9rn{wXSY>^;ih3*qk(xlz$x`~sm3DkMo6sdv5Y%T&ZtDm3T>QMQS_
z!Of&&We|&%osG{_jD8EIBwcjO(ujpS?7&iJ?5T5>^I?*&fdcTN3=%^1X~FENioUiA
z>yBKGq?#z&C22;VKyB4#e~)6lw~k|}0d%mOnHxi<P?SL{uW_}s&yKwhs3h^HMsGDy
zNDZ{XXGynb=Rc>sc5%aLY-S?WpYw6gsx%_Eh}zmr)NNc?;56~VA$Q!s`Wu*b+)>KC
z<lL6V+fq9wAQf_MY!a-`rcUbbW#+P7{W`)Sa6~BqWGSh>F0V^-8rt|(*&S!P;J6SE
zm2Pyl)BBW?*piEw(K63xIlV9eu5QfsDP2iY9-s;1>b>dNw1A!M(l$=aR&qg0Hm8W=
zOdG9wlb7|ZaD9*)w{z$bXufLCV(ccP7v=0?kq#Nk!_|mNYiyf&9Xzp?SbxzLaw+gL
zR_5*i9(Qer8PAm7hvO)xPfb3ay!^MDMn@Q8?C0Ckzqlzdpg!Nd#~oEveDi->^mKNU
zH|eGbM$-VQoKa($y|sxH8p>Zg4+%Ks9c=p*rPY;Yhg{0Wv8K1gMPkYTm&V682c!Ui
z#9GRA8|vrAJPpF$!)bI|iK!be<!GCC?d7)uBg?W(_Y1<Gw5%xFn=>$#cE-o!EoYND
zM~y>w*S;?dOtit4&d9Z^ns>XmD-WKOqA_We|5*Cp=CAZ6k*17yWPH@~eVr-kCZq0;
zoP2k52?z*s$jj{3HCi38DCE;{q>MCJevaOS)ve*R3s<hG*e9hQ11c#Y=gm>4B*!1p
zS^0hQ0^%APD@-h`r{sLb#y@fDqjK_XOR<Wy%uPv9pK5U*57Y^l<%ckNXD)_XWIu=n
zH;hJ|einw6^84SxYiecfkHr3*G{ep(1B;750Y9N$2w`_PV=~fQmM|`VrfJkl{w;(?
zjM<Vw_O!w*X-UB4j3)yJd!*V>3a4>0vLUU{xo_)Zbj^aJ-tlL=-TW5gh@rt<8XJYF
z1av$NFG4Ms<VF(Cq|ZaPMFlOpXY&CO!H`1te1ErGKX3+XbbM8=fNL&nZT?YLqEkYc
zoYK2?NyR7=oMGODBed&z){u*mbiKK+30P-Z>c5R&q^m}acwLd*o*}ZxR(Bs@WqN0i
z_j&9)Z&l(8$7l?v?Cd+vo#RM5PnT)~{a!oQL!{Z>(O`?h^5eC*Bqt}UV9j-2Bqz1M
zKESgxXLU}^T<wVH5YZ>;dtEdY<nY@WIwp2Zq|2e%ZOvG6#t!bT{O1DUFt0cD9OKTy
zLqZ4e=qhwPU$^Z0E%ea$o~yk>p?&B$8bXpFlD6-@g(b}VY9-a^BXP}gD#fjW>Zz_j
zJ}yt0<DR7Wz#ejd-G1L8V92WW6;$n$oHY`tP{MiJNABs@ZuwL$@NK=nhSbty*mT0D
zfi%FfZG$($-?I2f2z%q?F-@o#k=sKQOn!hqFBD}!5BzZLc%~;5m2+Je+Iei|wsCAH
z=8_g9Inlj$6!h=oX?0U7@5QE$RI<8-H0zZS!nQ^@3mj#q%I)5ZAjdM+6Hrx|W-qfe
z0v~(4aY)H<xxD$kJbBflPLp(S?~uUFKe@bpyjT@(%HMVnUMA`cI@pqNs)G2%<Zt2#
zEub(bMJHmFiBx3xRUezl`Ax)jcNALwn_g7_Bvte^gw#CySTTfdwKUv(c!jF89v)RD
zRjW|P8eIlyntznix<92*MpbGxj0-vJ6kS9IY~x~&B+#?y>BYu5!v~d2U9&=Ko!yd-
z1rr`E$1n7~jVSP24?2!$1LRz6ehZ@C4@ci^c#^nZ&h3=63-baG#OgahVPo8w3awQ~
z13g<;`u=K)e!`4Dqm2*nn+BAl;oL&9XBg}XY^+Qr23XC<lCHC}9J8}RY%Kde;@=~W
zL_bb-<{NttTwTD5V&wGiRar>TSVlC=chvQVE!n=02u$t@!9W!L274WSx9>g}*Q#r&
zKe&qObl7i^(EUSxv(<Ah<K#4|%a;J^MZ7!;i-tW{2`oTrse2W@)y(oi`2xDEI%h5X
zOfSIkr+UhP#i~Psp{lB##gLc6t!96o#%CpLeHUH+V{RDs>3z`@Ph%T>B9Ax5bF1yw
zn$&(Df`oZnkC1}6?{3`ro{!xn-Z9JIFq(wuM3vRRd;X$|XZCfo0$v5~ez&ta_77d@
ze9qg$DTfX#uNrvp{+{4j=_~w)Ha+rPhy~b`ph*Ulucdca@w2EbdSmhK#NprN6cyZv
z+sF6`Qy*ggPP?H_*12Qo%+6M#zEpTd#M$uQ99NKYDUBc9FV_3tH4?w+zIdyclOO%%
zE{HQRe&hN-PdND>I`ZeK`1jzBuy_Ce5C7|a{4ZP{vstR;TVK@dN%xGyjEubYFsNVC
z;Tn3<OpV6&LCfQMIKi_-(8|S;z}4u+6Q2Y{GY?ehIlNS;v6TAQ3mI~EVc^;K)6$K?
zO8BX-__a*AFwwJ;$rax}X^+AiHbgFN<7r)o^o2*pd6sTZf^UH~NV`|KP$bh?`m{1q
zrb{@hkySYv8iEqtZ?m-B3VUZ5?|cENRd(A%nH}vjQ~&wggPB+2Ser5LQC{x$wx#TH
zvF!|<LT32rrUGF#=4?g_*0%L~pCQ0ZIp=WxuL#(|jljZ9?xA+QGI^5IiGl={e@5+M
z5O_EHX!8nuy^KgCgMD-z&MC2LO+yw1$^|?QraIiI{O(B<ymuOMgaH7UK>Oped#*sa
z;AF<?L)vtDehBbF(%tXA_<A`bW7!|C{(k-BpPp8)t)@T8;Bi~K*O=)rQrj~(!<+nQ
zl~{>KTg^T0=!Rms<2EX2ioZib!F^(}qwm`Us8lpR>#@v9QrkY0=a~QH=s6iFw$OX+
zEvC?UoeH|?2aRf9!Ds3QH&xO@{rqa4Ru2N7<PfGy2&mFm;@!92!ciO|YdSFch~j$j
z!|eD@-%~n0Baf0|hg*mmK+N+j$}?9W1^=|Ixw?8&=;?Bh5zB1r72-A1d!Adw_H)T}
z^gyu((#@>@Ho+g-DXk&?vJpB$a|A7oc1v<x<4a=6ZLTr(byDoY9->REF~vLZ>UpYu
z)PHd(sk3_W9Zb%x`XS}u1(m6SnL(rdwSTN%wnEeX%>>8}OWxGSOI6}JDvyrB-g&`m
z?JVn8WB4Al(%|x?1D3bf(K5;H^>1wKO0J~B^87;Mg{xNU<-SWL?H_W^vl4p}0yIUd
z=?wF*6_wb`LiiOn_7KjT=dIZ4Ac&~im-m@^&vwA2lAX!8)o`T7m7|vTgDn_!Nyo`1
zZh3220Nrkph9IF3sS#G1(P+CZbHLl=tp6csCqACQwBcHJDQ%9cS^~jFP6iDoScl(V
z*WgOf3tWrIb(-Tf0=Zcpq0VhmF)K_ZN9IWnv|2}I3M5_UR;)?O!;3&*_aH*7KpCcq
zN_f~0y3-!{$*ZMO7Q8X^(|3DvWJ1|KQSB)MRCit<`W#2wjJ45otoKONHz;vKg3kY7
zOa5v<3C~yEajUbBWP5BS=84qtsZyZd|A20RK!cT*1yO^M)a@IFc?Bfn*+Z-@I+T7C
zV20jmIVA`7`>9A>KBiWsq154G$8cQ^jWAZ45E=lQ-M1^JIk`;yTB_<P0VMaPv9~pB
zJ5Mv%0`}xGOI08OD}H`nr+P)&IYbWuq3<XrGv!@g28i_bRxA~b)5cJ7kw?_>V)v`O
ziZ498G}af|o~Z6AObCF`3w(@~19oFC?-S__nC(<KuwY{|hQF?$w=Qny>sIH%TnH+=
zFwA;;TX@|0CMGh23=tCn@!wHeF_NtJD<<C9A&L=0H&*rzD8*9mbmwUX^ldRo9}2BE
zjCk(8WwbuTwTj>EDy;?x1CrMC2#+F1Lq08?C|q6jD?QKOy@w)2+1MQ1c_D7Ef`ibE
z_v8$wtuHcQ9bBoJY4Y%OxhbPj0&o8uT&ol7ankMAn30!(c&bZ@CRLM_lCX}Z=gXFp
zT5OJd>VI@2eY)H#!W8m-%fA||nN&vLlp~HKHEXsqZV4dPnHQL&;~39hhr*_E*=2Q4
zWw_?-+At>+^(iI<Vb*QBQ+)0zHrbdmbrbq{Pi`03AGvR8u9gmR&nkWtMb{fGoQg!Y
z2qO+z)?`)G*QbaX5hO`Gd1v<QJQzY+wnzO4`^eMmz1>?<iPwxZbnT};vG&tuytKMx
zrHZMs*C^&ZF>mvcW=lyQI+6-s4*M1$aW#Y|a_fk&{_uakBW#z~4`x;?tKHot!b7tz
z*IE1z$@8X<N6tx=U+X@b;+Za*PMkxwx4GtR?xwP(WEQt?OEET+K)jPYCXCUU7bd?=
zC!C-;D&}nrPWRuL7w)xQHW#gT&BPoXJeSk@6w<1*8g!83Eqss0(PDNYsgI(oFf(C{
z)$63}W~gYCyw#dime}t6xO>WqrW;Em^iraoDk-ug341Nm;LE8vOUWZS!T_hXL;rd2
zPtren%*LZv$t06scNf0;c!tOTm&TE7<&>0gV~P~q&%gRuO?=XD3$dAG8scx5$*4`U
z@2W^YjG!P#c!ZL#TzF=x(nqL+gDl05Uf1-v*4I(0ZJgG}{N8~3R{zDm!-0pxMZoMV
zDDzb3Rt%PMp-!Te94)7HxQW*e1RkJxE0AuwZJXJa=DX*Xw2w-=|7^7LZ1k5Axw*_w
zNRLb#3u)%@Y8_8nX<2wwPjvlZb3ixi{|IB7T^}u-gWy^%o~x}SUVb_d%c_O>66rak
zMiakGwz#P>vcYfaSLPI!iLRmp4D^}xGS<&03|WP-yuW4{UTz=YeArFeuW!$CJ4suv
zF<mVZdO3lTA8&&j@Ad9f?}{Ka#<yF)fr)AVcOR#}2jaGtcau(GJqbbCTO7$n{NN&p
zIPPX68sz`9VjSa9*Y$4%6s~=|o3V1crDNZEiS;K)<20}9@}&BWZuxIm@V^it*^jtA
zJF%)+nHY2XSMgBq{xjfDUkC!ZE<bz?|BJ$(>0xR9N2YkD{*UE<dN^xh=l*A9t-<H-
z|J48*4?)-doy`C1AAb9=D;)D4(E{kVO~`YFpv*rA{Yw_<A5)-P_KOF2d$>80BN^o7
z{l$PA@Zx-2<<EK9bXHOipBac>KIGl43>fzwyND16KTbe*vZm@D&U_baP(A}A%1Y7>
zZBU+%Jrnv1azyxs^V>x49+iEq&&!|oy{4iO4H56k_vLuvW__M0QWv7aX_;uY_@(15
zCn!6I9*lVyO6;5wKErjcaPsG;&9+CSi8R%%Ls|eJlH<KNNTukJnw?&dnt}gA`@%;c
z@UAJK2vzhEapcc+<(bR7HHL_KR(hUZ;O*T|!1`2s@!_`F2Cx5P>Cb|TNPSxwwCkk%
z;BE-i`E=I75_9l}hwH$=g~L;B*Wof9&X&%o`eAhR*+}6A`0m54&bqPh!&Vz(Y~3dJ
z3LPLv2NrlDL?FX~<D*fSKTPsR80sh$O}#^I)bMbD^*;G(3Z2Jjn!&jR&MQ`~&z;p=
zcQ`=M8G&;b(v(yz)9oeD<833%S_54KYj<=&l?Q8w1<ADsB<la3p|n`_C5G;B(E%;T
zY@r&l<6_Wa6G`oD8kx>j$vy_~p|-f}bG};fy0yj-tBvz`@!Q+OYM(+8=jwSCvJg&H
z?Y<h7+L<|NwG!DLop@JdfDss(nDIhMLfTnHmnbp&YSKC?49*Zl0d+MqHzTtTXgacT
z1?jywW*uD3I3#Bo`cY<wsi-HM^w=3uhcGVBp2?zE!bmpT?cjaWk-bmH%_-5{00^Qx
z*4t#lde#1uo|QDbun}Rwbx6{5>I>yL7Cf9714|#}AK8^+0&wJkV$4h*fYGu^c=Elw
zSEwv96}uq$5Kd)I$M7%4g-##h>3BVY-dteg8JJK<Ymhj4<!&%)L2xpwS?i!^_KdjI
zT)McPS*AOwn-=9ft@uM1Zn3!1e6Rr>B?2|weHF~X5d``OPr24MEwfuW2O`OI^9Mcg
z1E=*CJhH%)9H&BaKuMe1VOj2f=Yn;e-?oP^9fDBG2+sL3p3oQFRD4LQGprHdi%74H
z>)L_Nq~62#WTe#3v8mpiN$^wxNwHCX#cnWg)P?AS0OzL|uOiXn!ZcyFb5G-$*Ar(g
zbTn)&dVqll(wTjWE3ZL^dJX%QO3rs4x-=};C}1#{&gpHmt&h&`d!tbBuHXGTKK@q{
z`fr-T3ePe#!4lnI5Ppk~^`8sf!5GAKiFp=1w3@}AJ*dCV&Dg1F#8Dkd*(+T1!=ZY=
zdj#LEcuPhlN~3qh&Z@N4i^d<?^NVoi)FpV=)>8a5OMMNywtSfB>MhlG|MMN$aw(ll
z6*prxi9e>|q&o0(yZxK{Tsak<$MfxrKX>tK0M!)K&z%}+eX&Gd6^8L5CVB6$$(nR|
zU|z(aM)euCBQjMV8a@ipUcHd@{R1+?kbO))!u{0=c@jn&8oY^C^rEkxQ}L0A8J}PN
zz@|QE(7s0B$>M-Fv3ykNzGQz)QyK2j<o<VVHi$R|xe`5wRS0hX)Bt~Y3h$%K@z;HP
ztol`5eHz4-|J?WZq0)bYlW3Nc<BR3{{wH;NuHAA9^<viARKi&SZq*<3{pE9M!4yc%
z!g^}P^qgxD^By`IzLNbNuth~{?Hu)6RH=92C)>nl=d}UAe80mKvQtYwZRe@4Y+u!`
z;w4m*8-6N+W_qxRnyjm))Xfu@v#!|E#kL^sLs)Ze&cI+u6?{-M`jtrO<sW-hp{;pw
zZ-y8#G^pR4@6|@_YM-w6*+xzv`e$Rx5z=F+|EdKz6`s#ugeX4<x0!tL+rv)1+TvD7
z?6*#{nxk};H=35mMI~#Edu<wgI+7p@EWN%u$PHlVfwde*UZ7Wotg@I+8UfHo;JrUa
zm1u8aauJ$1$&e+Mp0M$P%E`=F8{ypFs<$Mcsv|FCBrI=s26qcK)7KkV)mEP#6}2lS
zfr2Ot#9KQhK-O96Ki8QJX*=2P=6E4$E%N;4bmPere$z+ce{gqyO&(rx^{?XURl71F
z(0V>pzv8t|@z*_$+Ju~ocjWx5o<I9vWeNWu_LK<E*g^frH)QD&`{etQylrDt9br{T
z%ZB0p@fu?)bLXmFGI;xGN`0*#brbg5PH*e8o+7JvgRo{J%#V}Ijhb9Jn3qI&Efh9N
z7#zg~$7<OoY+b({*D-XR<69I$*RxJ$7_F}~wms#`2<*AOu>WN`W-l~KPA*ZS)c0xa
zj(ABaT9!nrw`ZvFId|IfOA&STz{z;31t|!t3jV6Md!|vs#(B$@Cxh$a55ZX22oCm~
zl1fopEVp2RhI0Q{a#4x$gOpEvxkANpSS~ZH>3-_ahG~@+OQY@$wvx>0!0S0%y1}=8
zoH#orfH2j<dX!hC4IfJ;W;Aoi<mL2NjRT1S|G+1M{1ZRJ2JK}*VJh2l2*u4y``H&>
zh5@PH;HfMCz`6j_<(pIeVy>@oAtul71&=*4rEiVu^W+5qId!q=GR&-LhHbH8er?+4
z^@ZB$bz5^EW@gCb)<J5Af(s9__L~v3aUBygU!QczgzgD-H0pcAtXamjmmtHeHoG)A
zb2o&Bv<MmE*|TJNBL&v{N-=9<s6$CjOl~H+xIb5o9-N7tyPwXZ(f^=V$h4jh0Dy?D
zk^E$6%+)18G|I&xNpd`$-7K0r!VNuRHZQsAlZY%GoZ|7TWu{-!KO(_twj1lw>5@ul
zJ2J2m`|f|@^i<fOdfBi0o+xdMVYcl1{oi;3Yt~JHsd>Yp#YZO3akJnG&ii!X^vPbz
zN=zO4R5TKga%j2PTh@L!w`m_5eR-L550PAqh4KoHxyfX_sVOMc%V=a5rhHHB_OrOs
zU-?D>KZ)2rL#<SYQvV3|pc$}LU7bkB+{ZBUKEP;tD=EG!$UoM*RmR(_FF$wpdtpOF
zco!ybm8Mb&+N!$HxO&B+$QF<Qdk*wdI{J0Y{hh>Td*y`sXcy^rZhsls_;P<$7b}RF
zfplve`rdn`{7C#9CQBZ<#fQg*_$}d1g~u{Qg(*e+yPSHDIG>?~rY@**jt1~$591)T
z*&5Lj(a0!3J(tub*$k9-dPTF<n_Rdy*@g(Hf|IiCns~XN1}s(AC{sQlhnKM@tl9N_
z8TU?*?Z&BG|1C*BHM96|k@qaPi440KdCEUiE+Ja~;-30T%rdciVE55n@-R=&#|65s
z5#goaq)8v#F_#J8e??;_Yn(75uf|84e0!fG+Z;2~gNAwS*O2f2vmZBR%Y~t8+<644
z3TC}Q{Ym$IcB)uew;TA~FcK`gFvJB9p<|HYG8aBoV4RI^JGPs7l&fqLKKtR(v+HS^
z|7iqx=_6<O7`D+A+=td^FL}@u!8wA96<MNo(_3gC2{$Po_%2c6Qtuom%+gdKl5|A!
z(~jIf!mJ$o(+vJod>5u^R$hL08JO5T;+eu<;+o9<+VD|OZtF5e!B<!2GcFanE1_@g
zmV@{ssAyg66Uf*ye?MbsHEW+1kO;nTO*#@Mqh~H+P#e6sy+5ZdBQ?_uUX&^4V>l~$
z>&N6uI;v<%HYGo!uFt4e#(`(AG)vU4`BUAp+mgU)-)?%_-pyvA9K!kLQiH)golBgY
zq0y}t?owQ+Rn+f)C+C<mFK9}AOpsj+V?=>x4oA9XETm}lL4QD+wLwWq9rxj9?&i&*
zhyaN@!6G-MZwwEy1~hMQ>6beC%X)$%R<=KXIHBs!r(-8r#Nd-CaDhy0Er%*Gil<@f
zy&oR0!-85z!OX-s;xe<n!xMRbz&Ik9*c7N0@3Ut0C?TJ}{V9ddJ;~n>a<@41YYeH$
znPX;z6nieYdMAfcT+Ou>e!+d8s=T~8Hj0bJ?w6L~*)ZgM{5K%JmTq>gD{9Y3u4LAX
z^Z!|NB(Aa?xtRVT%3dHC*;CW*{gChJC+9s(tj~T6S?4_H<>t03%VCO{EX;gu!3<~8
zO-wb?{$*CyF_sC%h^EkI=upxchR=Qi%uy$}tBu^Lerej}dONvJM5|)f$z4gvo`ev6
ztKBUyuP>-9F(#-<$k#8P0v<9r{A@dGc2iBC@5E$+l`#S3M27(qMGZ~AlIGkXqc_#t
ztwG?XV2dA>Vic~qTs%FODPE21y5XV8=Ja<&kg5UMvaJuYlQDy5{u;ML(sUWO0b2~F
zm?CSMrk7hbtFzx?-2i6P-#Zs4k6*kEaz(`VJ<NQbuE^+Q{4~WoHfYrvqy+-$MOJRI
z0w5jVGF3cFhL!BnRCqxiJ$}K~@uj~GX?dG^>d~c1b)Iz~B@FWZ18vbc>tmzGF<|+G
z{Y6B`Uo+hc|MfwP#fD*y5DezE^+Zx2-@6H)&=9K6V&scGvK+!;yoicFYtj}Fk9+xV
zq`uxv1LWPUook{^f+KkXX*|F;KEc{U))$%dMJsho*!nnWq{H^bvxNUWlD8?eSqsUh
zZa4!czkE)QO5XY*p=rQWBn?tBa~P$RMn$R#n5Bo$QRZ9?#(0W}Gbs?ZDUA$Fed6^%
z^gG(_w&23)+BgUI&r%(wi4fTN<wF%{Vz6-%!JwL@P|E1>-!FmP?&nU_56gPz$G`uF
zY(r++P0sp47VNlzdkXp)2QO%CjIwT=Hi)I6^F$4m{GE{gj#ECF0U<JtcoxgNZRMGX
ztDRSzy6Ax#J<Wfl#10k2N0r<qVcf!wi3<r78Mj`W9T%0`b2XHej%SPpS0?0@p6-^F
zAH36Olr6QkAeKjW{eVeZu4vzuH_IkN`q22ROsjHsjBcJ)eC8;wjq!rUPSiw5;}$)Y
zF{FS<E_HDq{;ZMU-l-r@>1`e5yi~ujz7(s%$#jX$83|$KYWZBlLRCbWEK8cpHi<TI
zO-l!+WB6@%SU`PwY;tewE_N3FZnyF6Yr|}uN%xid>Fl^1ua$f@@19z<IoNWn@&kSa
z&`0VQvPj+D;PfYN+9?oK1Q)Fxy9`i}H3ex;prCbtXa)EuzCwKLaSDD*_N|AN1Q=pR
z<X3$rjj2j5BJmx`wPz6Ysj77C00K?mnLgtBYoXmgdAv}AUJw(KzH>@dJc5czOq}S3
zt=W~Yco>_1JZaDX9bvsPiu>;w(&1zruNYTT+D9fc<cn5PDZStQNA*~-KfC51EW|Xh
z)mEl(Pr;J!371DJFk%LPW;^A%sFst%r8k9QSoSIYiY9@p>*kFQ@z^K9?i-vKr-5Q-
zHMB$aL<h5oWesw#+ql}!Iz^E#i34A+Pe}Jf0rD*u#bk37Pj|moyf(@%0@+iire6_q
zHQqCNqQ0b;(E@~HnijGC1MDV<T52EW7>?^TA><%pHi5Su-cc-`3u|Xyo8Wfs)0~B0
z5Ww@VnkWJ3t6rat&z6q5s;7y~hPD>Z>x=nKia85R0h2u2CWUpGZ!=a-0Cd9@J?x$G
zB*oU36R6+zKWOWHtfPw=6;lx;$?R8>1(p{k(Rsks#JTn&@D>&L&LxPvFR4#(qT$`{
zN#K;kiMfB)E2okT`+>CKWDG<UGbRewXkl#5Jwz9+$k_o?^IyTB?%d{*EUw>zBr<bg
zl!+S|*G<Cbv>*R4AhtMQHg>FkNon&jYvDLQFhAVFCN-zkA*5<TExU;n)`7FEOb0hR
z5U+KV%E-fV#yB^j5P$cyJ(i*ucjX|>r$^-7TvT}lOMu%Fpc||9O=X#uZOA%-2U%Vp
zSWR$&ii%YIbrq{hB*|#}7Sr@L-w_%e#G%oS%@Q-v9bUyNjN)3?Ra9rQ(=|tBrKhd)
zca=TVas9keD52dM4*&EJm^a52?BICl8laFGp<u$bN^D~HqO7*2c!=sS84)7H%-f%*
z#-7B@)bmK<w>u=uE5(Gf%yL~ooLX|WQ2Y;1f4!8uRBp9#+n*}0GUuT=%xp1n=cp!I
z6rg87XL4aj&DV4Mst^hHly#5Pgq|R&BZvDTD4<!qZK03leM0IaOkKmXqannQ_-OY+
z>^M*nB@vM=K8!Z(F&UTpT{sFO-K{vPaG9NueHJrzpPS$CZ|Hnn`_TJ8B))30cUP4O
zl>v7waf%0QM;jbn#^4QcVO=Mr0P!k|uO;9kw`eu*_SU3s7KIUZIu2qC+O|0J`P2)M
zw?!)5P1TrVS8o?~Xx@aTtU#KLC5#U!*l@7*-x(o$UH;r#SQcoV+A4a1!afBRu8Wu&
zFQG8N2h$1Fc~<D<L9nTP+eA5Li}8tJMZTxHKuDBJ{oz1YBnDCd)zdKp*4w&ip4w@y
z6qD=~CM_Gxb6G?$dB8fa*PbVvl0~47w=L+iX*io$n+LB)xSSzzxXs6>n({556+N?l
z6Jj}X%z$9aQP&}j1?M+tfn4(+?h4*_Wkf;t7AKrSgwex6Hrrtv0%3tj%OK;BpU2a2
z{jTtY;Wv)P8N$45mr}+GFyBP$e>w#Ja!Std<9g{ukVjP))vqzPB{T7N>sT&a?kQm8
zG=*YojFz>YRv=KeFYjCLJ?X?pV?)dG`97#+>X}f^uWqs+STRdf|2QZvqmIA&K-gV~
zQP^-u3nU@|3^*)nrOlR<e4!OlkX=`iyDVwaq@Ska(PyaEee*K?+e@P+=(N#00His`
z<se*>Fqj>4>5$t&L0C&5Xb^OqNC7$A24jFsZxaH@vHj3@`Ibb|h%!qdb7^4klzR;c
zQRRu6-zA`n&7@`SgTbce@x0>K{CDko_QZZ)V0RvBkzf0}=E5!Mg^TugWFN}R!_tOL
z7&g#DF$}m~2Gt{j8#?XL!#@1_Ex8v+l=G<Vsvc)i4H&gt5=Y0poNn`Ad7%}^Gxt5K
zoQ#^|(t7LwtT05>NT-McV;#>NnIjaW@+AZSWXcSqtig2cMK`N80i@Uk?RuKUxOX>A
zI5BOf6)>Z7^yN+q5{Bz09gha7H+*Nj?C5foZ<&8zu1sFxVDIgZ>XG?Kd%<m5b$J(u
z);|N9oPQ=z0X7aNon*#ti4Ct9ydhoN-h=o=B%|ufJK(7~GGQqDVfro?*&PNGSI{lv
zC>4WjDdTYS${0403mqEqfQU4=9XltZ+Zz(sR5x5~q8b`JcZoVqAhNG}duMlK$#v1(
zt1mQvnKfINM-`#Hx^>t^3R_9XU~F9ogA+G!>l|41Atj4Z+bw_FKfO}`Pqh17Z_Clv
zJfdo-AM86RtdJ?}9rNEA$4e&LF?s$%<<imn70LED-ZzKJw9K?Qiak6?#ih2DeB$fj
zLZ1=_qiLDYH(yd0%)FnTU_1*lk~#=}ADvG^i;LYD^qKddUq-7;P6Us=shsynX6CwG
zBp$z%3wunoPW<+kVPbPUzt$kqs9evLm))x16h+*CHC*uk%{Kv;wT`2)RI-&*uO6nj
zW?x_AMy9+&Eq=%qGd>}(r)Wl)1%|uP=lHw7f6yOgH;O(v3|&cej^q4_8ia5O<|Y0F
ztQ2hQV$r`rFs^dc>MUB@!^`IzSbWyMoW<)}uFGp-@6j<$@8jD%MguVa@8Cx`m7MAI
z<pv%e30184Pt%s+y5Pq2I98b_eoh{Vl(&Kg0P)}0sgENF!~{mRn^tvu#nbKC+M%&~
z_5jFh96>t!GC?nZF1MBuOWvZAful$LM&OR7$9pdRG0SqO)<GB7+tWEh$C(Cu;@fyl
ze90ggcBNRQg{7=bp=LprUFQ6f+LccTvvxv?n@mbGzv_to+w?lh7PSeEk(DWzUCxT}
zx7+2sQiIvD0m`lXF5}&=bbXcEhA+~_OCXg{W9=$sW9vXbC6}SxM-WR2m@pb_kS*5A
z@mQXfL>n=4|8>FopX=;joXN&_YwhL&!91fIebG-lryCUh@XGz;Rc|J*(Mv@HtjxDm
zyealzbtNGEqP8y_lbjDyxsmHGNf-1N4<5WYiL>h)&1<<itY!U*SU6w%frr1=+qsP4
z;PaekmqPJn)XH9le%s}&&J&yYD56fsOdy@-1^%Dazt1`jeq#iT(5VIW{?7fb)vsip
zP)SS0Ab7cM8xV>?Mnkucp{!5ur20kaKT1q>r{Z-p7-{6!R=c{KHtPfJ?;ul##e~N8
z(0<NIR?@tQEXEw$tVfnFJTLJdMqe=fyKd>Gu_I?SCFFDapHK@yOa31VH*C0eMMl1y
zu!e=##=%_g5o$xKIYfA>EY5Q6u~XEWnE7Db7ohYwkk{$>bk4A>PIqHh!qL(pVBVBH
zd?&TINi%aC6T+yY=a?N_tN@RDUEgj(-&Ah2DPSd6j>unfAe{T~DQRR{J9wykL?yn5
zl}f}*1H6LwEr>_@@Y(N?Uo#Bf@aDuruIfFFP|B0zK_o4wzO(9u`rfn!KXjpYSxEWy
zo-ZaQzXaAypY*^NUZX$jh)7(IBZENYeaP3?0uqSR5RG}oz7bTjDg|?GNpf#ov>dPV
zTRj@Zer{-;{tnN5qm(PgjEkn1Us0g;e9Y2KKEko!BK+mE6PN+_<;Yokn>8l?RiD0J
z<qpN8tHgMv$n4YcsMf1*JNKS@J^tk_H^+Im{*s9<c<=r6EkXXBFaOL+pgw`ncQQIY
zab^aeLgdYmwX(h1hqiv*=g&G6A~{oKUr1=6JPw&ej14)oYJ!#@W8<uRLh{IScH|ir
zrJY!6TMoV;M%Ft!V_SJb6Q0(F<{@A0WE3Hir_c24i^g9;#NT(WsrUx?Nn@u=A{tzn
zUBY>DQ)*I-p}<suhi23BS`S;QGJMx>&LP#R2~@O5h`Y7_hwE7OX)X8jmXr%5r@q<z
z!}1td)IjAFD^@MOQjP4igLC@iZ?hiNY<VPr!Ntsv^dSguAt{T76&kkUcB-zip#fE1
zR|f{sF<6VQShOKFPqP`%4Br~8X-J;`@jZ~avFm5c>8w^y6W$qu>$EW{3zMMlVH#L8
zPq19bEc`yC-aNg1L1%fPmjGZ^1p@yleB!>=CK4)g!GhX(R5^|#cz7Ab<hBmZB#lSJ
zYF;kjr8yA>uef5LO^uv|SwH9IXL>3Dn6R4NHwb9*D{*Q6p$m!(p%|4!yT;NxvcFnP
zaX7pFGv<i@FfVrPU(Bvz<C#^6f76w<84rsOz+C<#%+b;YhEV%(aHPg$U#^>nR*DM$
z75$Frn@13vW?`bO5~>Z*Y&9j%pM0N3;I8^$0-7`mj}fBx_uV2}4qGW?p{Q$=N^7Bm
zXOIEUw1wnQul<=lM@q!J&wkuobfw0$Yg}2M)pz&Z-TiYPOl_m8?uyxG>^DwmS_s9?
zwqkqOSy1&H&lCq3pZ~pHYx-|cLi|OOdtBq+Pl<=CCDx>YUG#f^zO!r`?-T6fSfj_<
zg<71w{dB=OW;Ph>Ft=_}3$~U1Fz_PBS)aP``M_|)n_H)+`AArAOjo+F6LEcx@=uH~
zr8(7N5u!)D#MD)rig5yMwVOKF*Sc>rkMwj+O$yY5_334c6ck%&N<0?_8|U$2;`k4#
zmT?pM<^P44(84q#Y<Bnu6A-%SpV^(<3|GpNvS*{A(<m6UxT<3l0Io5m<_n7_MLd12
zLQ-MZz({i9Ws$V1C3BmJgUbg-BP=WLaGrtsbX&og7;YaWAN2*H#`ET267@g0lVxLA
z(pu;4{V&&~V<}XGDhiRjJx~sDl-@O2!y#$o-k(V!*}(lKX2er0u7KgY(TM<QkAFsi
zYrC38e`KnFA%hfd8Yge*Z0*aeJM>HhHMhwA`=`_rl|P$|A%xI~J$vTzM#k8eyl=2w
z@gC)8)@zvCAw@8!y48=F>kf?AMAp*`k-Uduwg}V%ABkeVpK(P-L{T%dfGGyG)7p|P
zf;v76wJ^9FLd|Tlwt5K-M=Oz@0_mLBzlV6zpCPaZThMB<b5)NMbN3sf@<fY=1OgeE
zVl<;h=RwlQ&_(oX0zxXRge8mO=5%JBOjW$L159QS5+8|BMgP`@D&qqxqJ0<v-n*1-
ztdfV?L1sG3ne5o!#ifyN`}drqE-9-PR>JWq&hEE6JH_Q7X1L%F0XmiC;h5W5zW~Gw
zAwz2`6={68H+VL*;D@xM+DMEWQ>mB7#6H*#DQ#9tYt|ZX(ASz(z?b*)T{z|_z8z?E
z)hOAIqCI`efiLIj5tDbO7DGQF#vC3EOlF~<a*jlm2n%C1_ue1Fo5gseG_)20Z&vOJ
z3U2D1l${f3Y!{i612Q3EK9=Q3er0WCwc_}_^Xr{GCd`&?cHlHfS&IH;kD5O{Ttfqt
zSatAtL&ns-<S%vEtgWXkIuMy3OU165qc}$bZrE=eWH1Y8f)qiHbn`VdjvgoVs<<p7
z)=-|ZIXJ)E7JTrW(Rh9H-ykC&9NmavqkbVJq*?Gfv!u<f)}g#cz&!0vM;_o@pl*wT
zja@Lcg2$WcQicQsK9n(g&23Fqihjp@{G?Y(b-n@_JhKP<12nN>E;o#gQcZkn9vo9l
z)tQ%8i1vy7+O!V&A@UYaU9I>9GRwBATiP+YC8AD?W;kaPUE^HD$>{$=N)xwZM=*MD
z(Nfyvf}0zgbEcDXN84|9)?33}{_wP%`#e~wTm9IW+NuQuU)9$lrEPzK$6Z=g!=g<`
zZFK*nxx+lBwyUIHV|o6}mUo8K9-L%@9s^6r+B!#wh&L@QA}T6iq>L7jbJf1W(KxUa
zx*M|XtP!{e3(un=nEZ#>buAFaySyf=R&Bhvw+OS&E0$C_eQl~Hq6Pmxu2wv3<vi~P
zfom5roY}cP<lak$GJ%XRVk(P(R3n0ZkQ-@HCbidDg#W_9Jr`S7HBp?IS-D&2=uj3R
zK60X^EMFd7wF5H}9Ee!sCkk<Uu!Z%uU#(;{ofeq3R88q0?XzBAVm&5pGWa=dn_&fm
z`|0;QED<f|v1KC4LIgV|=4XT@O*jZc*G@GP!FVst@bv~>Z%_Tmzi48kr5Q|+=$;=`
zp7pqx)j%}e#ooZfZTkYgvD1s{P7;5KhJa>kEF8PunE2L|0D$93>a*wAmGWyb%0IV@
zqawr+Qoe9B*hXl*?bdnCY%ayFOlu?N%rqDZx-1X)gu`v8;^$fi(Gq#EpAeO^3}*w-
z&nEPpk^P#)%d&Sc9=6;3pCI10&b{2x3lC=02W54s8zy5$In6D@Y26v@(-#Rnrm))Z
zTVUy@kA)<zzV1oGS#VJ8RvDzy@;QR3<DnFE3)HA{zs6dRFdk>1j|OWoC7j5<&SpnI
zL|6Z@1h3``;AZ24?m&!-f=;4lwtH^;+{_~TT{fu7Du6BvF>h4t*ItLUEayn&G#J>P
zJ>AS^p^_(}5m_grA4VFmP7{slA`!I_1z@Lj>{I*@<i^w{olBqzX;CT|&&y6&+s`Kw
z%!En2jmfQAck)REN7oZL{OwEpKhZ0x(itgajfpatv|3KFN#DW$=nbH97#jyACJruP
zlr`N0U3Pkz9aT%c?VU?P`=^T!-Of(ax24b`=8xyBmu$3p)oGJZQI279V??(NZ3h1-
zr(lNTq;H~}fu&F0oZd#{akKLXrx_z&1QdU9{>h<#vEMN+5pqN~Ja&u<kf{<_bugAf
zp(!0-z=-I98N81ao}+B?0$?U;A%@t*=EO`Oo)vUd{A68XcvFu0x{^J|4e=^p*29o>
zle{Z{7j@$z+|t8uV#+RBU*@kgZ|rzM5zxy{s>lyr6Var@Fn|K;^4YlJf-<|lu}+6H
z_6@BW7|-WBY3=kdwsuQ5VWlAD$B)3x%{_J>Bf@_X=Y%{H_9`>w%9Qe0q}Ny6u3sHz
zIQc~W&-~Cl0w>dsPB)0kV|SWM-j9TX`%QMO=mq0%EA>2?mg8tP{%kjzCvT6~KoZ&C
zfg=SBG#qfmBZ797v&7tbAP0&ENquIztlRgu7`wOdT!~XAS~<zO@c0$eY)u$U)ApSQ
zjx=Q6Z?X=)*+x9wM%`EF;-B845p{LEqmz@2Gc)Uv!1MALf(HPo;48T(uh_#i=;h0$
zk0<N6>Q^ivBdbo5hcU%>0ePFe%#;6B3xLHl4TaDd23l;=W$PHc$KDGou$#`B_z$l<
z8ky`A4P%>Iw09xsum)o{M?`VHs7z+Zz;FWQH%Eq?OLH9t&;mG!<lZ8DOWc#6ce#}J
zuD;J}A$p~EM1-SngTBRdMw@DickD#NMLu;Ir%SD>dfb>8?|%se_umNJMkIFNhDz8=
zzeRh=#m4*bg)`DI*FQ#m6JJGd6vUb!6iNBoVV+-$ny(c7LhGRY*f9eJI7~EvSyq}_
zpArD&(uB(P1_?1X{3~uWa`OllvB_18NGr$-CmK_L`b~Jsb6-}8*a3mpZu@cw%xbY&
z8lY)mHAiw=wIvU0uXA#oF8=x1@_7`GbPd_tk0Z8%d#RRLW7IViwvxf7VA=egh;%Ua
ztE}N!97o{TG=V)jS;6tU>J82mDK@4WRL}7f``#EfqF`AQfOZot%|Wq~E3i=&#*CgI
z5!|FDyTP0w2%$&52%yG~OniqEzDoXj#U~_8NGPyp#QlAQ`$nRHXV}F(n%a<WY>l-5
z{!IZE0pM*k-Y6RvB@H*ihKZpRRL<fzgQeUx6uNotDGe*EzX!_yWIy?AL@t-2Q0o&K
z2}(1j3$D~qco99Zt66FBob#||6Fq|vxf*Fmrow}{UAOXC;yXFtfEximg$%{Zw`1^=
zU$1&{Vzhf+d+(L6rSxD9WRlkoW|*fOhM*aPJb{R60Tp6I4G^o`e+R8ZIrVu&J^tDs
zPI+3h?QW(PxsLQX^oJY_R8|h&B!EcgXL2l?lo3^K4L?jYV)&)uP7+U?UCyz0d{Pfa
zJc|BhMy(w6v;ZEbriYQy2KmMQH^y12Y_58$29Vl`mnU9^`4ODDLu<CM*=Jkq35Xi1
z=^q%%uiFi_HwkdqAH88!0d&6PtwOb#QX&Y+Pm#NcK{e?UndYC`w$<H{0|B?PR1y!N
zf?JY_i!o*ng6c}~lv{hGiPg7-Nob)MYC3?hkZVwjI0$d?)OPAJcrkX>_I*74dAma`
zmqklyXc?E+1wx%SlyZi?v-AcTQ=<ps6i+W7bJRN7(T8WY2PZ`>+33qc%wXlLoSA!C
z3fs``C2Js1ti5$-P(_=B#HxIza0-2lmTW-Bdato>DgiEt9p&`hQ_;@4&sSW6Toj!&
z5)wdDhLl;q=rM`;8pzr}=(>o7I+c2alV+scW|7*mrX{%5UBO$?^0s;dt3%<RaKF`e
zP?JYQT#6n$=0mNL%$vhf7L}`12@wPUK1r1LZRWonMbN*_^)I_4XqPYZRzI5FGUGHN
zR%_MKDfAF##(3Z-T2TVx+MF-k2Y=|<<Dh+JBEm$*T^-=Gk-MV^o2EBfUI-o-Gw_i6
zQ!Icb@AEtGFo#AA0fT`U*gRL3Mh*s>3WEST_C2VC2oXk2d{$}mNDA}@{cq`&z|}u!
z#!nq5PieM?Jay>5FS-2Ei3rKfkzLEgL&iPqbrQjaC9Vg1OlI<rFCl;?=)wo}bi<0L
zg<jz<vJAc5j5i40kBwQkN>mS@m>1x_<@<3=mWji~b0TkCVSSMQ>_JEfm9$TYb5?A4
zx&A0Q5hAV0Kn++w^5MA>Bn#-26dORnwsxl&e4-7ueBWyKMw6Ip7^g9c!p%Z))f6X;
zY}ls)pBJ36a#h)n*?RZf>}#?Fb&O~7q7KOicTy7w24CAwaeMZ}W9?9v``)>qpnqHc
zh<96?N7U(pO-JHlx3YscQXkXFD|tx`QdVhwuY#8Ks34)NY?Exok9RATbT+P$@Nad~
z*~7{d1HQI00d;d~43x8Su=z4e3(GA*(<uB6vM%?xs3=X%y>^YW?l7rMhPn$%(Ta~B
zkwC_nh$^%#bhP~D?tGlEKrY_8S1D8OSb|UIIa!F9kyKM}2|Zfm87uOidd4Tcbw~O&
zDt|h25;qp?TLHc~TR7KA7RXHSO`MX*ya?O8$T&2wY;e$;+VVR=R-n=I<=cH`q?qiV
zn~JrW3dj%d9OtUnaqH4&E}el~^DB$ih*MI3|Loz6d3(Dk3Q%dk8jiZDAwA@bJl(b?
z%C~1KJwOoX#dVo7!E(ichw7BI0hm{7C_;FaXpX^tdaKW99_e9ZRw15ub1-=cy%X)~
zFwn4G)>!BP8HuFeRvMvHDiv7rV8@8+D6>0NhrfIGYf3T2KgV_4U>7o=VmfnGRoWQI
zy;7O|LQd4Lb%hJwy?uFFOpKI*c$ON_e}8bj9^iGZOW46<pv;t%ZC$L>15EkK9T_s8
z$_60eLtYgqHion@UE73w1yAWeF?_JJ7VWE69eM?Xe~sE^!JRNTmvW8#DuIw3=rN`o
zi+-F6OK^>AYA!Nfow{*|oZ#${V3qWegZV}G8-Hy-N04~9%}>J^gsRCkBR2f)<qNC1
znhRW_CYaMG%p=0lpaXb#OJY3PK8bLCCcAd+)|=>`F|7T@D?YvpKjoUnPplycmA$rh
zMnC2)4NI<CPXcQm_dgR?QS`9>0w#gi{m`Vsh>GU`Zo)QZ)wGv}opl(fjh0)|`NPIs
z8}4LN6wC+{k&jnCI3)^~is)}{Ywn^48}@sYTX*mlZSN3ejo=wI$_=y6zQ>uRFSa8A
z_fM}rF8ku}%E8ss=+p#14ah%V`6aM*n<^R=QO}6Zc+nN^$L#iAAGW`!r#uP!z18{V
zG*Q}fWM{BhFi~VmA6F2eU^M+|*?;o)z9yg9Y(4gbldz&z^K>t~v$GH-%Xa&xDXLdZ
zX8O5H!jNib*^gQDyfR+5@S(6}J*%O@kh*Wnc>6fkSPf+}#X2=)N@F<lGMy?UHc4Mw
z862%TPjSLSz6jAC5M^qPz+-+#{?7XxyMBME;d6H4?dN&+<#zM_{vp%sbGO-D?u|^S
z)U5lJ67btarD&u-RBgqA02(y7j%3cC9_#%O=DNuv$X#4}Hr2Yi0JMaAZRpEgq0on{
z9<>pO)A?&2ZDb~0j6L2X!38nyd|Tj#n$r})pFJCJ%lcMReU@$&5AW{_=Nn1z^8_gY
ztY!-A+wI)h)2zHk>p7;!;`l9fehV$Xe~FZjXvSr6x=uxxok4#WRt`CHX5z=(n3CAM
z+;`&a<yxHSTytD#40pBi{PJ|4b+q{&9XLHPaHn#sf)3N^_BSybHOg32NUE-4_c!)B
zi=DN$dQyA{Oy4@q@Gn}b7G$S!ug)*DaPPF<e`=jsnVS=_C=@pSWVbj4;NWsS-CS(B
zE!ui6+Sx?J+DlIVwi$ep_5FM&5$-Bu{#Gx>05myR%ZU;WZjKBf*kaY!uV4}K3<bSF
zjvUl%XX;eg{LEwC+%DK=|J;kb8Eh{L1NoZ+ds#GHE)-r88Ke22NSMRNYK_0`unwhV
zK0OlHu|C$g&q2@85@~Gjl&0IG!^ZqXra;g3KmHukB+aTm%G(62zIzBCS{W$<akTHw
z<h2RVf^VWyaa?@{HkX{sV83@u-8s8HQ-v=-uGK!Y!WC^hWH=>O$mYHo(ZTKJ;L|~o
zWqtv@h^;W1jX9($?u8YGN7*(v<-?RvfRXwYTpH!0evIaJ9d|kI)#aOIBZR9rSf>xm
z<GT^p1ekN+2$y?_pSTYj&fGPdJIvCcIR?MZt_^2reK(P9bs;ay$MxEm_Hqg~l_f|y
zy{xSL#6{THr&B@#HK#YX17ol8u}`DJE`-`av@m`j32u+2?!qpToiSd%c8A9MwnB>H
z9Xkv0Mt|0e(7VHzGWluwrDN?IHX_rjJ35h@E9ruJkLe9h<nug+TB9lOUvqQ_73cbr
z>@7RHxfU!Vj^l2Xzq^iypATBES7LWGIK1?MkF$5t_b081Y4<F|*{!XbhwI%sQM>;t
z?Z(d+Kp?URo}Gw3x656tc)=>I&(WP}-O{(BQ;h?wr|b#mRekQ+@^dUyivOdx?~ZD6
zYxBk9ryND_1OyZWj!03e0twPp0xAedmr#O$AffjjRFo<pN)HgELr9PkIt1y`dxuC3
zHS`uB%*#15Yt5Z?=Uex?>(0$z@Mh<EcYXHn=^EVzz5*VdI~jwuuL={y`7V;stVe6-
z6J(B<4cCydq5jK#tJ)Px1<kCvwDjHaXg0Uy@{@0u^Y#h%LMN!NE*<Qk$%CtQaXUj1
za_e&*H$0&_dp5&zlR+&J4b$b*j>kLw8YGdE>$}(bSF7vG4s#3e7WZd=tDDUfuzFs*
z9_Vij*?PBEs$ZLI)83_4TVrM^BkNF)v*P^Gs7bTInO*B}^LTEZva{5$nyHnmlS1w?
zfA<J58vHspQj0@y>^-kL@%RVLFIKZ2Q5qUg8lapQj&N!ML^nBKq3qIJ{L7+2V7WqB
zLtgpY@ZbshJI`5N*uUq3GWqa#UaAf5ze~@(Wxe%x3`zCx_nB$l!oTGu-4~rhuckHI
z1{JkD7p0I{!A_ng&zqaYjR$Vg)XjzizppF!Y)@Xm-%zYtb5!v=y!913&Ol4!Sq%b0
zjt`i(*bkoTe1?~C;OvQ&-8Lb)G;hg|o?oCzHI(2q5ch8`kKgQW=E?39&9Qa0w>u$k
zPw4aUM}|DRDJgdp5K0#s-1<?YkBOBmU+wL^72kA$&P+?6eQgbEGzI3rk4>fSJtA}l
zrUAJ^TcG?As9M|fX%$lE)VI->C63Np@$qxfhaUrDQK&T{N1Oj^;K|~qxk>9mzx`J=
z=%>SHVQsMG(Cp@plewg)?ZfPGmOM?L{2_c&uaQ96D=Z{teV=L#ymqlMV`t(#X*C%#
zGCKM~B${NEEsK7@2eebCz7y|afe|K?#aBKyTBWx{dc7itPF{06mrA+~%w-QftetL)
z{)YiC^OM@#JFt5>?ruLosHZMU)Rply?JW-u1@}}7z|@UY@4W%iv>9+-2%8OX4rM6l
zdOCn-695n}tQL1Hf5-mu0XDFE&G?H8&!5E`j)S<){&`b%^1Ils#G3G}`O32WF+LKP
zy!)?WrEl}_cq6HUiPEwy8(L8TX)Qm`)3HKflrtoSu~+!0{rJ^#wwP)JbB$~{UQEFQ
zZZi`U6yd9_SzdSAK3I|2iBlHU_eDC*Q2bg1Ll-U%FU-eMdkg}|-GL`_l-Daj4pcI{
zJ%Vd|&wllzTl-~o0dA{OtcZPbIg%(j_++m@&GtmXpIzMaTx#~;Q?Od9r+Gv{NN^{n
zmcJg4z;Uee>tBKUa@_N>-+BQDx%r<=u%?UXbLO#vqHGvrWN!<!c6Te-*E?oX7R$J~
z`;6RnbT&o~#uqYDWc1uEUo1}?yhE~`W@lRvs)XD&Y7*`AJtjt^eVgZgR{#;d-Mw+2
zidzd1FGXsW$U>gpUZ!e>6b8V$lPjD_berMrle(~b+tv!8&bpC<-=#b#)hoOz17R++
z?+0fj@9kz5B8gm*C9XrMRmI<YYYOT)W&9V!&vDP3cI<q5Fdj!6&W*)l)An|^nWLzh
z*6dWb@%LoZ7do1aPx2{bz@8U*{`5mfNq{OVKL>kOBqt|3Iw_T|uXSELe7MWj`*2jP
zY)|{hgyj<J68pV7Pj7Q`BYQ(`Z-=#Yw~8wkT&G&H$=*6z8Xr5E?s$EP!MlF9AT?_9
z5qH*>I?AmOY*KpR$`yO`IGgO9r^ai(Bb2po@6!~slmSNt=lL<yDr2&R%;|iy+R+s&
z+=x=+6e4aD2Wmo`{(4l4OaAR~KxS#75>K67z$5#v<`}wgtb(3J#OZOV`4Y}3>XLYo
zYx`Cfze5;XX5<Y?r}~lXDhCx2nmX}dAjZs<R$+1i8>B_RP>W_pdefAA%GA1uiCC5;
zjA7-<>|Lq{*~b7nfN(p~h*0TaK2}w#`Nx2M65Dlxt7%I!GpLh;eFEZh6(>Y#AXTWk
zV^|A_vC;$jbM^d7E*P@B)>^aDg={mI(=Q5n1mz3?4<j;`AM9M##pdb)G0_Q=mPju*
zFC0+tTEmsQ-~*S_=YuYr2v3#y`aE*pI8P7**w7yVfOF3xLnv0a_dtOIRrF_eDvyV4
z`?vE%m7bnQ&b8zrigIbJAjhyY<K|$?lM)^O6T97B2iov3cHb5kjVttDwpqvG?pGcU
zl9OXdWMV$r|8wQMv-y!3ltdt`cI1*i@%8d%Gwd>h3J1}MYIhGfE?yna@ChvsbQwA~
zkxLmGPmviOG4Zym7`a0Y_)Xfbr*m}U>SaB+ya(0N2iqy!)q;hfCLK05KCl*_R@a!?
zf4BA+ydcSciKZvuj46BWL>Fvlb-yehAIJ}GjS<fl89)F2w???at7t7<9gAviGY1Iy
zxPK?#t+|SJG}L9nVYW9Mjk>6DUE!cB`(g_ZgB-zO_8Y}=JZ4>9^q4f`06XSP9nHCa
zdk|kG4+abFEojSl=vLLgdib5-d%Evn$6ZSCTWM!IX&mxYO3IuZ3M0W_%*0gF3fufD
zA+ysTFUouG)b0riL!5@pHBQ{df3kq)>)&Y*O60(n77zL9E9KY|HFGzqfir1s%2h6z
zGo$_6?RHxY<k!y<F2sbpgEZMzx=Zo`&L1nS5|Jhwk1lvI(|Gfp-9(WomIE{R8|Q+Y
zvzj9TwmXZheD@a+T;d|wHXNsZt+-*H_BDHf)1O<$qfmWqq2)xGcTwc}%0<4$i<2h<
zze+q@TE-PRQ?4n@;t6B?3kw++WgiwJ&ErTJIj6BF#93|l<j!p4jwYfothFBiqnmPD
zV;>qbI_jHA#Y8p#(%rDv+wSni0*!(8DBk{JND5b#Y3~NtWwB;i1@oWZdMa#+`2hx~
z)_vN>$9<k(ow|lQ{AoTzVu3`!629(1t>}@UIkIie6OlGJt_nbjhokWW!-N-B`S93Z
z{2JBq#bT7L=AF5-iveBSN%ig8@`QtqD$Ikf>cNo`>nt>N4gW1@_$%yd-EH}(8F0bJ
zX`tn6bOd5l=9kE_EII$_ng&?TFQu~+3VcK#16M2X`4?|`;1~ad#LlKGZ4X%8kGQxb
zaz@;QXF1nY!{eL+(|vr<ueh_Yp@-ddsei=>{jUh(pVR$60wMoSV)5sHAdqwWIH1tp
zW9rW*W4C}WY4-bD`Z?-mm2z8epj{@&6n!}H*Sp*N-Nw|u94hBpOxPJXS^kki{<!}J
zLN?O(t@B(a8m{{Jodl$WBu9Z2maG*tJkIie%5mJ^-P|ImqbY#05g#XNY-bb3akJFf
z=<$UAr4_RJL4=owPpP`FnS-3e1fEZUgg)<X7ypYmIl0*C@Jn1Xg&eT|pv>iGnjbQu
z9YRw6N6wls(f?4i;zGf=uj<qd)fd3p)ZK1MCAPGlO8X(&a2k1CU?V#lrl>p@`q?t1
z&Y?eBWzB5_(e#vhj(QS68<F%miV}V7NDkc&u~h7>U&=K%V{EDZT=;#XoeK(`v#?(-
zFC*BVj*fvvd2l(5QSDU=JR%b(^FW=8KECV-9{`IevKob74`WeR=LE6{ixGNyoVQcs
z1nG+UQ#5=b(oPdQtKk<(AW`2hDdmp)(}Mtz5|T@skY6m@Y`@C#nx}~;!b{$5XxxW@
zmy-Oih|RZ=^fTSojhJ-ly3Bs2X25yhljCFB6)n95l0_43NU&CvxTW)tG91U+yegCS
zmKt!EQ`X2y2BJLj?8!i9QYYMy6LvcP6;SQT?B7&a_*fz6j<QX*2a-uV)KGrz_bFfU
z=1RHKU~dt5{ij-IHbXS}YF`V(HINiA=S8<`MVW6(>A73<Um+6aYw<_*a{iRDp9D_&
zR*{jTrrIw;{)#_J3$B6Y+ua=2@oHTPzN>XsVUODh_oU9h*d`r1=pI;JTR+P3CNBIe
z63tHS<Ksqz!@7K(d|#;dPA3&68VV0P7$rK~jK-&@tsbx*YOhwYEN~V+v+;UVd+Pxv
zW2RM-S&8oAAWq~#U%>6J#MF(q%>^DDd4xkYuwn~eOCT{lddw)QYC}7r2uX}%{z!LB
zFsX4RN$s<*@ehj{dQe9_PGRoHBc&eZqWOk;j#?n8VmmjdmB!tp+Fbb}e>=04Y{2yA
zS_C@VtZV^DuG=kL$!q1C>v8^zWMm1aG2?80gh}zZe>Ob2>Q5D6Zc;={@{Q<Y@`rb9
zpc_d$3MoYJN>7|Z^@HN=K+46&3_e<nQU-yHPWjHI;IE`C$thXN0GE}j*MJ6QSv0QZ
z<*|U46mEI=S633yFlb5ym!xZdt#&vgiJyCzN5D&2=kvl|pa#bshnuyY)Ep`sNX-+m
zaA244`r^2wAtool56lL-6lz#1Oa>*fi!y@uPcrqX6~FvHi5~dr=s<OL;>$-0ZwCw}
zpVl!qu;R}#UDghwgdXr&kaEJ^@#Eob!$$(Eg)3I_On-7yyPtOlA4%+|I*mS6v%%!}
zo%kwc`0I=X`l|t%(JRM+$oaRN;qjDmmj{(6pKHxy9lF`>a+{SUV<rKW117w}|0gH4
zAwf{=jp@T9lXHpzb3IKykr?{lYo*e4v4G}(giUn(w~H6c;*Q_bUdY8L0qMfNnfdj~
z&wkWXg04cUPQ`J?l#5p?#nVGay5RP<Czj7v55`MBp7hM16BFDWmu51|8+Ljd%xAwc
zxq6(McBdh|Rl2OSi@I;vXrxdUER=fdcQ0seZ=W7(LHRXzw-S^u#s4u!(SHavst%5K
zcbga~FD~3|3GLWK6ZaY_1@$fJKM741RWJP<Pg7npZ&pjXw+F!1<f?FB{TF+Kb0eeT
ze<(_`=mgO!^saGe(*A?CB7#lUG4oi?dK8z}F<pCguVL?Kz0YZXXlvs2Y2TNkZ{@!d
zXh7rBADP@Im&3=@R<(}!?GJ`u-(DY+_9PD}<`Q-N4V+fr^rqE}^N}1nIj8y+zpk53
zj{K-B%oTm+qSUoIQNMNRBhxybFuqU1g(EbBEU!5j-rK=V9)BGshsx;N<N%h=oL_@8
ze(hzfJhWF`%QjhS&Z18}r53W}m06a|rR|NtB85jjeeaAxUS@ATClMT7I@7tjjADO%
zHw9^iO^SrNVAevhyC#6Lls4B;M6$FyTlVzibrm2CIuObf#9uc9fSkK+Kf8NEe3e3f
z`SP0@N3x}Uv|uL$1Zo<}dvlDAP&4?f{o;#E>3q*S2N{PsecbLGc>)|nj%S}Z&3$#Q
z4^bSFqZEzm-Bt-(fnK0zh;0^+Ge#LAuKIe<$uvzi6E9xCh@xfux5I7i?49K8@uREA
zfFS<r_!H9F1(yJ|DvZd#pTryYckgcnz0yQ?drDbu{DEzL0yVpMRcfn^OU_Y|t*{JY
zVr^g1H{pDkwCOmNC8{K8pMky-p>fljTGxCg;jS53_kI)9WNMbb#dxgq+4r>bt`ZbR
zIGU-;^(o^3TV_<c4`*jtHcj~=NH~NQb<@8d-gO;;QnDpQ<d55J>6Vq2xN_>Ie_?vR
zQpS7}FhGxpL>F`>R_5=}&aYH2iL;O)U_ox@`HtN7y|<}v)lmodZF)WU-R^FK&BI|L
z*rX6|B;~Q(N^9ehOvj1g5=#8_?gy5y;RbLhJ{>Wncu<4=S3gXbDk`CqD$R<G?+~NW
z`c4MvPGy=h0^lj)3nQJ;H>}oY!ux*<{wD2ret7}D_YWmad)8;?uQsGn?{)O=U$m2>
z4$aMW1tEyUCqSW(?|0@efi9{0D4e$Vo1nq+!y>ikcSRR!Wq6-LQ-Zq_eT4Qkn6%En
z4@gN!V&k$!RJXLk34r!cYYK)wA)e+jM5w@$<l8p%tDg2Wu3k}8CudxDdpK}#LDgk<
zd9}=W;bMOGI*(PL=u33^9BU0Dp;Q+s`800F-oA~A&7c}$u7>OyP*W&va|lRp7U}Nv
ztZdha81^(%AzP|x_LAQZ51sm8Y6=ScdtUf82Tqh^D_Oi*p81LQ+SYDA|Ngz3xXC9u
ztvl{#Y?IV2e7F+Zb*Gy9M`cEgjTN9J^I)eHZG+d=ni_j=F;@NK3R_Ge(%?P1HB3s7
zeOoe%U(~uLYwzlyMymnm`Z#>Tc4sjJn6kRt*+uXw@{+u)`%Q)x`k>itG*a4QsU;^n
z-tsK@t7m~WQIY|<<>3eDiq14e0vaBq!vA4F2E6w_!Of^M(YLZWcb#2s@(h61g+b+*
zSC>S7S#f9W{c+5A=3KjY<NDwEOaAxTCZNSX!Jz*NRs<;hr>^}oomaP$XXRgM+d2Qi
zHCe@ae^9Z!2bl1;aF9HZq|7YODn~~^)2ou{j3DO+6&(TjS`RL>yzB=$0=h(bpeVgf
z3i;C6m;1n<en&gN+(&CyG2I_LpG0iTfg)$qYsbbGmd>;SG>+Y4m#FH>G&CGB&!CTV
z#`e&@6luELYdTeGTpAv~oaP*Zb9C}dYJ4U9s119kI@~Zg7nd4b<E$hM&0AHJbLZHY
zJAU^RNWp!Yu{@}%BM_wcd){O~{4$6kCRim?3v+a=+}|=r@i(N-at%A&3q5=521|`k
zE@f|NmtBnuUm4k^`_%1sx(-)5vpia0Y(a{R(~INT`wqzTrOB#cyp4h}0XaGC7_4%$
z@hnMaonlh)3ta)-^{JYpy|wh-owf1ovIjwmjG9$pZOFCC?4yl?N~Z>=NvB!LF1sWS
zPMCIlaFb!U(e^CN2GH~kQ>~3MwRW{~y?4ozRUQRXzyQ5B&(#=es_pW`s0<qF)KGR}
zr)q981O>MloZ(}dUpE*?TF)3_+T2*#@^U64<CmXxG5hPLY3(x72Kb$kEtpQs<!8`B
z?BCAv9_d`SJos`Ec)B65wjTxcn63REl!X5EUDyW*C!P~hHyJ>H<mL->6UgK7*Th3_
z3dFSa`+2SYp)L0_;W@{Q<AkH7PE5n}AIP%>r_pc%)|Aod!A(i7OONm<5YP(HD7&6i
z;_;n(k&q+&N(%X}0t2jW#3>|Ux0eDO{z=q(grs&<glzrvA3+V9{Td2jh~WuxrN4W)
z<w^f=fAZNm{MDCbR5dncdGy54(cca&@24YBgxJ58<^9%$El)9HUIFH_zr1@yqoA>W
zmW}8wyP9w*8b|#7Ah|$1jZwFXR`A68L)$Iq+2-&e|2rqXezKE5)p?+Hhqa#{?6kmn
zHqb@*h8RNfjG_&9X~Qdmdvamz8KvQ^-W@!^$&Po_dGX`Gz<(|LEj3PcAND32K6PgY
z&Q=akIAVH9{)}QdfnC!6-b|ScF#3jR#~12n`vb{wGg_;P891v4B4_J<z&w54SCTu+
zn}Jmt_;&+S_hg@}^gkd5|LcqY|3(<!*hrLDrQ_PNSp3Z2V6|$!<!S|tv#0n>EZ@j6
z!WIY!Vjdvw4NAs$4q0M!q3J^i{JVFzrlUZVk&tI0z25-doJo5psF-T4o@)%1xWtuM
z%A*iL0*KITm^BWh<m4h|Q4XxJ@S-WaaiO7br=F@yKyGQi1xaA-bFQG|oLbmoWzvvi
zxg)$rHWw{tV?hwHDQT&EsjK7txL00MSkC=z_EDcyru`{AB9T{uJoqe%O~d1CaUw66
zAvF5+PDhihrD9_D{B4fwxw-2V@vv}Z&1*K=iZx65qX}@VmFiS{U(a{UTqnr*tIkTh
z!krP@FRvW<7`4|6et!2-o4Ul?n76+i4=d(hKQSwAypW|9dZilg^>8e<fbkj#6h0K@
za~0TN@Y`mH?moR@5sX|qB1p|RWxIJG;<gXg?KO&Mh_C1q;&z|S`iPmK#%8a-e>^%^
z$wVLeJ8v0n+JG+Vnuf;=RV48fOPR(S3jOb{M}XW(vq4w*K`YW3kJxtq8XWv4(8B)I
z*AH;4$R2BL%tWu9-s5dN>{j&|@^dc~j4;vPwrMq<syEWN+IHn47j(L&rTmrrbuuh|
zEPX(C=t0XiA`NbsUu9+B@^EW;^*S~<_)b=6y76c2PPgU-_*C2M3?jVnN57vZ4ZU*z
zq<GTVW%T6JBZ6FrnYHul(7KJ!N9qh5pT896q7B$tKsPuS-R+kLDO)Ep46!#5%N;D3
zK@k|C?(_Gj#>W}C)?Z!A=nwMS!=H_L3%cCR9{$8$qzr{h+~rEV{1xkC2_-l^2K7Qo
zdT|}jGG8~BQ{tXfJ3R-U5R7%V5R1m_+7Q%bCf`OFd~dXQjW#^%VsVoQ8=>y|?|w!I
zAc3_=!et-l!JKH}PHx8iA0gdY7ecEVmS(iXWu%P8oAUZNXs@!{EVFg6gc<kd;KzV&
zeUEZt($@O&B&f0$T>es)*WGOmdpXm~N@Y=<q<G@Pzn5hQ;Zrv<XY9RV=yuRE;h2d$
z9ovU++>?+nY^uog&O}-k8bB%8>xa@B>wB34`2*Q3D5XY+<rG4}`gaZBrE-RQ6;lRE
z5-_``Bf-6Q#rv~?T<;<u^OP#}RqWZxhKJ2A8nuAC>Me2AE9;-^DMEIx5syH<vici?
zIBSln0lwLHa=f&H;ox0MOcP@G&GB!FkL%rfL+*<6H+`IRqmH#Lgtz8@4}GHrK?^_s
zBZ_Z!YDV}df=!K{1;xF5HuIB>JBP(z>hbm_<iWu7Oqu;?-C=ONFbhgo)8?;9cxwE-
z53sNT+Y3n_oGTZaC1(#4h2cUc_^S>-gsWb0In_ZOI!;y38>$oU3-=<#QHaj0u_6vG
z<mWHjy|l&LT$?pU5{Y~7H*_(0?6;lpxVSizO6HAgs8QFnM%T0q3li!hTBxUr?%vgg
zC+W=AEFg?-6r?}fK(s)>p?1a5vOlEnOMuOu@3GdwS`%XBXT8@poqD_j7Z+v(8>`CK
z&a1s!xOTy2wn);pEfo1yVv?H1+?4jTpXy~z7f~_w5tp!IbCTz1vX^YEE7ZxS`Z2fC
z>?n)GQZWAg;c2_`<Y1zPzL1gIkqmFz9f(VVwM)ZN+ZXIgn$-f<hyU)*P_aA=yV8U=
zC<w*ZI!+~3GnE<pxT^w<0{de!Wwhl-c6&2Ek4FyaB*<884$1KMj9~%RmRs?|HO;jp
zh>K^=SLdL$;0&R--U1j*+NH?f`=e9zp!vF}vSD7Kg9ML1?yq+ziV-Hj?<Fmu#}7_6
zzW)(!CU0n!FMz4d2(I}iVWs!A$m0kzEzf-`S5W@CWen4}{;IeDcb|gOVPD2W5J+wD
zcdjV30%FIq<V6?T7DQCECgTld#Vq}{;(2iByqU4vYqeq^Mg17qfR1+c)B?6BH|9+v
z>4GzpuQr=T&3Ce`{oywe-1-oEC)V3M=7)tgw9(miaE9<n<iy<bh|F5njY{^YKNQ2i
z>TX)P{aBG=(`0#HazIz_Mu)p*qTsekO1fN$q@2(_@~$ja>G_eKz0@ma(3*>Zpmws_
zh2;`%6(5NHHJd{pua*f>(;e}<{KFmbHA^Kk%gc^6B0@U1^-*kBbn%u-*S15zOX5P~
z3UF-XQ+S1YiJ4sGQgYu#P*iZPLwER4Xz-i*`gNxdrHSE7;zI)?N>C_=826CZX7H|7
z^0&PF<$T>ntr{1q#7fo)`xj}JA?8eEcfFJszYrTCcyT0Z`W;&#WN=VN4~-8EcFuKe
z`r=e+EJ<7}t;D;Cm9ZrYGSD*gwkSObl*?sC4VvL3rA4p$D0+3}OP0)k{3-PG3czP=
z9z9>vtk>3ZyRd#8(9!KAT5ER*5)EYS8XJ((1)?V96A7AN#Vq88(^SUyaXL-4zzL}Y
z!*IPqor2COMxQ?gpHq~0)WZJg<uoqrzQdjP(AaFO#78NC)=e-IvTAJ5pC5v>dotbE
zTV@jJ>~#9Yz~QFt3#d@bl;9l=qqq&#i>Ff^J8G{h1a0zPX%AE9Yf3f@MW<l;2hK1P
ztS&Tnv~u#GWl$Ofvc`x^%yr}-Df4LCpKMN6T>1RQ_(xUWel?_POMaq@OlA==%Q>lI
z)^1?T&J1_$r_0Q>u*x*xxDS+CbuSXp5!A=-V<L%9P`4z<V>FNWYxkc$@@~ZLCFT*^
z6ZK!(G0od<qHMGo2;$CKV^0f9V#>{y-!9Hs_md4@>#8pZ8<0A3#$GM0$eYAmcV0Pu
zJ#Pd?N+@ifsD#~F2x!-DS)uznF4JT37_x4Jr<919EyUI*W%L-ri;Te4$+5Nl8Nn|#
zuEju}w>wAt_Fd1O(vhI4$mpyfn8b{<`dN}I=Ak~Mm#!<6X+uZishR>D3urv$VqYv9
zJhsAiagqft!!#WHZ-Zg`$N5baXmSD0!Tb9K!-80c37wTI#!i9?2L4vc%u(kkNy6(*
zw4uQx;fC_EzIZwxqLgZ}5<A-Ci83>Av@-S;62%+ws-s<PBFmpD7D~VnQn8!0M>D70
zTvBGg(Rp=LcwivP2kojStN4YLn5?M;l@YUP2z`kUmVRN5^9g?aHBqoV53en`YAk8v
znltpIF&n)XM{fjPHz*tSI{rS&4w+2RRI+%u6I!3?)TNp|{m^N&Ti~4}#~mRlOmJ|{
z?kE@OtOYa!O^!tANsDq8M%ztk6Tf{7>{niEd_Uu1-<`wVr$N{Whbjz<1San7kLp;v
z;$mfaPCBc^^MbDgx8H5$%mVdZY-<XV+C4)HLS~4o=^-5yi<T|Y<1vLf!Pw#$UPGeM
zJ#qKB@2{MgOpKEZOS1ED+pXSsXLy3R>qlPE6t)?6^trDlsD*q>gS<U`kN(HsUunb9
zb6Fz!AxU!mZr%DeyVJ|KN{_a$OJP<OHy*8uKQ7Rg;WDwkR|SEgm`Sg|iRz)r@A^Xt
z_T>iz8+x>8uy3&X%b4K&Rk#jUZ9~(RmQ}L0xR9TE393=%PcK*rEPa>mN-wNKfqww3
zOUAgGFuc2DP&^5jJ>jdFNi@t$62ZE<T$@bFw7+;hOplAb*ThNAZ+oDuf~9l_A$?<t
zQ{G3vbKgpX{d7%qDfxK=0QKGi62zYDSd>9k9)kl?{PoM$Wb`DKKD%9|6z4q~^C9YV
z$EdA3#wSm-baJ;iw6HBkMsbJfi94*C9hAK;%FPWi&&;*)A%^g`@G6)4^GU!+m;c<O
z;3`{GpW3D!ol8sX`D3_FA7kd0TwTXc`=HxJ(M!{SU;LRLQvH^WxY<lO{K5DhL_fSG
zY1W*V2S!3ZEp_jUJ@qRkuj2##$5G&!>B!XU7=%%=$?hh_$5<99m_CWEd?VBOy|G+<
zYwhjB;dxtp>8VaD4XNte0C`kvtu~sRzSc7H3|LwM1OUoE`DI@{n*PR=9TCGqNCtzI
zSr<I4%<w21fly-n4H^5kHnD9xgFz$s`c0*~-$3O4_u2=+_pAb9DS=rc<SLoOd&c~C
zb$NKi8g-{7P@NtmGTN(TI#~@nSR(pNP%`pb;%COS)w;|t`J}I`{w2gW<S)G~@1j7)
zaax(RSwD1l=x+=$GX=?r4G+uctAF_%T-6dvRAyqErcj~Q<p!)ZhZZj_tcH`7$6wtg
z1wYdcl0u2uc}cxm9#?t|Rx@_~OEZ)H@^S8y?MpWj4whRR^_4QPxj$ZN+vUsZS?53?
zBS|4j_lH@m)GH2t;0Ps=GvKng^YnsdDMn7Gx9<$8vP3<p4Mdm*9~o8ww+8-1f*Y{!
z;$Si3EGCpgiZz#I$lT|+p=yWtJ?~rtXyFajDKvbmR{1DHL|R%z#Dt4gPHe|&>aNwp
z)|%S8o=-!Y`jBwcxp&5p&j$=FE=M#Q=icovdzqT1wpxQgVVTe7BAj|)*o9Y9gjOkb
zy&IO*27^LolKSgLx-~8_&7!u@o$~Vd2Y&e`9{Y1Ifn_=tc%kNJba3T&_T&dPKN2JN
z^{6!qi$mbzpfb_%F{4tmpV_R*kujL7GJ^w%wTLa<?0)%Vjj5y%jO*asKv0<Ex1U@b
zQ)QOR-|J8ug(hOr>xRWM_~_n-ApY8FXP@2foGoi<l;fex9Tgwi%97D>eD^hGd={~W
z;oD}#+R3sbj1%V~|4MZ2z_(@VAlOinsR*p2e~mQXk#ddc8){=Yv4+1Yed0`3!9l^h
zP6MK{dzs+EXHIneMGTNT+$wgP5s7hAH*Yx$@_yj07E{}&iF&kc<S`MkrOAuI^*c1G
zt}xV;Ot_Y;{-PEMDDGOj_?VT(M=%#WD7AWmFxfo%%4vD6V4v`2{SPsbm02ejA$|-)
zbgZ85>zw-rM&^;s?Mp>!s_pK!okGVJZWDg%S!en$heyx-eCeP1lEO!}4(HuL_t|Yk
z+Jay7P6-8k<f|?HMcx0o`glJ-V5->C2NO89^uA#7^~1*UonWUW)yz&9T-&WAKP^9h
z!n8Cj7}(1)+U!LN+1np;Iq!CM{wN9E1qpZM@AihiRBFT->5?^BbjR##;a4Ra_f33%
z8*eESRC61=sMs{!w^fvAsRYf>4l7>xxO(bKPEP>*YG~eyv;Zd41c(+1cIjCm#83(P
z+c;}cOje*e3)W8}f4@szFD$b^34u3pYvNQRJds%0nm&Bfu=~?R-)_X_pmL|ill0|L
z=u)v;rm?5qI%pNkanZr%xAVph*ggv{i3U@LDo-H~(Qwx)L#EX8=eZu;H4*<)%w20i
zhAReXTw@i22}EFpCv>`IRL(d7OXC1%gSYe1xPOuyukt<|?NdxSrw}DLgen6({z8L4
zK$R=)S^8dBEq|Fu%<mN?nyvA`?(Xt!*R<t^R@C<YGRKKmUGxeJa+^+6G**%k^Hcnx
zLpt$UZC*}<-;A|S=`z&)S!HbdW^qHu6MCf2NRM|*cAG&cCKoPb6lUS5R*g%aTOEg+
z%pnk0<mQBT0e-rHbE)$=?c!;<_3LVvp}Z!~G_oe=nI6eFIDX9h%{6T=YhAm5CVP=d
zBg(_wqQHVHR>_ei)33UUv@MKEw#{p_T)yXTE8~WAIj}3$bzb`2l!~D;O`$lE%E@$W
zWrt~%K2zJ0iXy)hJ~!*cJ{K7!t<g9DS!t@wYj_P#MhmN19G&<?V+g+C{A#Hyu4BS#
z<c7JXwg5Mdh<*(&rlrb|7rF-FNA^iVo>H&05N#O)CGXLoY;ffwsO$Di%vCn&_FTKc
zAmeqsw3sv{F8ok8aoHw<ELyN4%d{VMlasuxZ3T}422{85hqlj^&c#t{5Kd#RMb8p<
zvMk^9A`^G8<_7L+IhoZmdiM=(i%7Fcnkx*yFi0MMgSl&T+_suQ;&#;zm5$Act~&ot
z!}KUww_~u`TXJo1{lKxiMmZ!j_<E_W+>(gYVBD&N^i|gD?2>6m*;$EGC<$5Vr5LFM
z)zI+dg;dmTL)|$J`~2-53{%jDQX>D*%Xu<=C5-wb3npn7$oHIM`uNAf$w!|_U$`S4
z;WNq$0%@+8KY4KEWurL-6e2%i)MiQsjlpzZ_Wg24hh?JLlcr(pa>AQ&&yjky-rI!m
z>v7UPKk8$WZ>mDaI<iFtxVaPSZcP>ru>!-d{OvxTHpJI&cl8!76;|x!-WNSTj#*BW
z&Z3)7+pKGrV(QaFJF1%wG}ls<jgIK$d>L6fxX8y(8X~-0E@Re37$Le29ZC9c7(r2W
zi@jxJ?_4|4MA#<}UHRK7{S{lSqcghbL1GjH>o!j6Y{Srhy6#+16^1w|p*IAw&Xs#w
zY1JTFJEvU74lg%onS^ZDEki;5T7lM3Xcvo>@bSQ+WuV>HTOPV0;?!NPII()XF2+v5
z5FEpyir!BfTr$QR*o+3*T=BT3GoF|?r3%+F<6v}hkyyi)DrO0*yCdPI*fzi2P8p4b
z!NjzDUf!;KVIC>*ro%vMFq=LPPTaMeQF=M9+O&4tb|l<uJ63<nc-2m9uFHY2T%T2&
zvK96|T{#X2E#x+noa;0!A$*&SyKcwYu8+Oz;m*w?63ZM7%py|w<x&}c?<bSpXYXDs
zyD#x7LGKUS!#CUZm=ShQpL#w`)k_CyUc(%kHSliRy;6~xi4p!-Y){Zo@mvU$ZHPXc
z@8pIkPIZiMG|bK@Lj!kNGe>RnrC_?_^2Lq^Gj0V$m0ZTGuon&mMPVcKUfN&id!tS=
za_{oEwDk4L7cSk^h_$WY;f~Eq`rvdlvjYMos3rtXT!)>_Ht~Cc;Z$_Yk`;Ca`RY%#
zr_OqwhlyW?&FKx9n9|)|X&|Ci`4k7I^ZHpx)LTsY7LgmRY?ae4&V8zI5y&XBOB3p=
zGIK=mkW%2sz@6dHPBRERAA@tnNeVK?e|IgUF3|f22H7-OFh>=CTw+?DResZi=*_Z+
zfz$eL<LT7Al;Gb>`UKLFCgs--zZMqWZa9xmlQ7P|uagWBL^`e4DC7!(s}w_epP;qx
zWn1pW7Ke_g$(Te6AHB$q{CyaKgCu;?UGwPaz4Fs2PJGNw0320$PwmiJsS!qX-x|2=
zSFUWWwG*a*%>63;W-e);n4eUbH^$dCy0&z>h8g+5a{?Gpl?zj_7$H$i?Ht9D$NT4#
zcK@ZL`E-B3rhz;u-Z-d~VbPzpLJs97Tp-SzK|~Xx&?vv)z7E>WgfsE`z~J_6<Y+Ij
z$UT05a^-nzM!n*6p^ZMvD!815rO2?;Dtw{Xes7TBSrWl@H|ax9)$C)SO*a_WOAb<Y
zpu$8ORgZz#sfr*zA*Al~k*Ly?d@JPMeeqiv%c%y?XiM|MN9n<D_|=&}y`PL~r`2ZL
zZ4kEHY4JAgDu{M_Fu2h4NM<(QhUjAF_*I*^H^OI~sdF%HSZ6TSeyJznbG&ZTI=>ep
z3XWbJ99M|V|JXDL0aaBj#8)i53`#!c&RX!@F&V>debcaASiSWc)g{1fCS|DStOu1S
z+`Q`Ac+T2uT{ojf^OYX7(K1i^O<twjpC`wWl9^9*^zxKeIn=Y<ck+y7eq*&{O}ZzT
z_OgpjrJK#(2gY<@WH}wkOfmepwvk)VXlDSk1Oe}@Ov`{lDOX!7TSkN9tNio{k}NnO
zIU8ml#lau-c>x~eZxK&_8l3*fZxuPvx^-`<MgwBaB0_W;6ELgUuB^ms?+ALWI5&H>
zv-JQ|UakP>U(>^r_PVC5RaXStuj+G(4<v{r3bTZD<^{hQfMFr`cz9%eKgdJm@7}Le
zd}v2v`cks|8R<Sq<v42l1a_l8(_pgUAv{8|&QP<*%NfsZOEZkDvhGu@n%=ErWlZ0^
z(UU*|s>G+0E;wmyckl%th9#9!dr_=dVuvNh7!YhOvEP?|ZMm@e!I3K}3@OhBQo7c(
zKpm1e;a(sgj4u{-mpUjM#N__4EevZGy(jb-E#^XAoqO6H`1xERMwKdDvsIVU2gGM8
z){L6r#{g;7^z`%R-;+i7tleQ+2gU)3;M>Gwi!g}CWW=&`v04f8-K|%Z<=<(OjM$}@
zX16xZkC&|q0(umbot_ew{!++5lR9d9Ou{%d_|3RRaN2|$U4LCKASN+l_Etv>0L48@
z)F3~NewB+6V&-awpbUK2sOp+~TcS4pdN8pw2-6LNa$LWDos9)kwI8j84z~X2ABJ)<
z)%aPflAc@pZ8R;o`S3Tl&99c(yh`qqC!T)wd|0V#l2yL`KYxg&=T6y{zFZA0XJEZ?
zBRTp@A|vZUg5e-w2l_?Q8Z9v1cje-gVF;QH{L5ODT(x69pbhxSMX(B@BzcM-11h57
zw)R-%DGz^Oc~ddTlv<~auY{HUYz@&Ez~<;xDHC}i_Qjc5>Ho^-kOJ6WACedq<b8Vk
n{mzK=)ck*SZTt_L&fMvF*8KfZtPS?lSudU`sY7v(P2c|;n$Z%X

literal 104953
zcmeFZc{r5s`#(J1iWW<I$rh0qO9<I3WGiIf$1Zze?1NG$mF(F|mSh=Z$udS%n8B2N
zpTyV(V;>CWcg=hMd_T|g|MMKb?|n4KjJuiZzV7Qf*Vp+v@27e?>dZ&ZAAvw1%$gdi
z`Vh!r8wiAc_7DR&V?O>h2?DtQ(Nw)*7?80rM)olvH_q-UP@81QQ8NNuPD_Lif`mUq
zq>rb9N;C5@n*`3^<X;^-^jNPspU>9dra<p8^LuX(+&qjr+Y=l+_md%iWbh}$H&lBy
zA7yR#r$#ZdKfW?q*djg<?KJ+8T%DVjm!`3^KnhX^7ys8m7bwsx|F6Hn$GB&7!vAsR
z&@p<`|2T2%0z=t<oVakE$%gLVXRe2zYx?cqC&D4(;RpYH0zzj8Ir<+be)|GB^B*S;
zME~DDk=_gRrYZUc4*gGhY>)rv+Gs~G*>u+3H{Z`@n{46zkN-P#=D)UwSt-2Fc5<FU
zc>#?0A77qViD0D-RL4`Q|M@>RAbh9kKTkmZUv|Vaas8@Ae3nyGkj!6WAAdwjqJ!KU
z9j6IX*@wD1^CL%&@+&LDJ`@$HpyUrphUn4MfOeRECSxFwtDa0YYSBdlrPxo06NtTE
zG!619Dln+d85~T5qy*Chul6^eRa63q^SYXvPu+*=tU|3CwIn1Yz;G4t5f*~D;N{DQ
z<~L`$EM~_y6AODH>K4D1=H%Se$yS2ehrPZ)x`h(ElO}E8+9#*=?K!8Ib5};fvu7AR
zl4rz&YaHJ5y=<xSUT?n$@I?msH#2Z2{w2`H%P0v5<OMsu>2bTU9c5p7o`;5}rc>ii
zH*e;6o7-RYY<3_o1|vNvuaFK`?=9;QlwkFqD&MOS<R!(iNoJp}3`MVNzJwC;aCHhc
z#r`I0g!$L?^&5n0XQ#-}SK=JYH`xAI2#C!=Jap1yU0CXl*@Xkwmt`~iR<Fvcxw^XE
zL_xh!W$aDQTzkZY&1*t^R7R!p#lug(HZFOWIAUsO$kDyG!qF5YGmm&6mw98T+HbH}
zTsi-<wEuW>I7}BU3OhYNhV-BOrmOF{Rz;M#iPE-x$O=~dj|0lP5loO|V@VD8c(X23
zD1|y`B}6T+H>7=jDg&Kz&%fAPA9aP`Ypk8!h}SSof7zYy;ruja@-p<0*rL*ckjDsu
zkM>R=RO^v+nzGOuDSq63N$;gO^RTVinwpv}@BQaWzCnx+u-H_&a`H#Ta(o;upA<;6
z&DP*-^1jB={Q;hM)$50TTFt#VAGNIP=?))!W31BBczCc&hYzGkv&YGM;#Z!WSIwI@
zP4}-KYAo4Cpq7+~17U9#l<(`s$1lZnIwe$8NIZ?veU(|ise!{$X1mai#7#Z?^C0;2
zLLgytnm~9Gl+t`NH}r4OdweSwf!uxb#+<Eg)wsrhu=?i0RrNP)*S0KNMwTwpUa~%$
zH#IijiVKO=)RG3O7nR}%kUk<_lepJz7%$ShR-Mu)MYV`_WuEv(4cGV}jXV0RaqDWl
zj^vvt6L=0H^w#S4?wqgC#E}X&+(SK5x5W#(;zJxwNBS?^&1JC}TJ&>78|Y^RDk57Z
zUir+3wLMKJ$gRA(?v-(i-jtq!rEtv;Rq~2~<n3)uTtdQ$)aAg}T2U=LF)6}5R-!Tk
zJLrI0@n62wdtcaj<KU>?#n`fQ#^oQ;eS2CH4<+fsw>TSC-NRg4kdb|hJz`_%MJ@&3
z;?GEQxsafsQK$?K6Y3JkuA7yAdE_<P#zl|(W3D*4b}gk%SDDHSW_7$k@~TSs3+w&E
zg-`dy3Trp1=To+9zp&Unp+J&{X11z1gA+%*C+u$1lLRZ9gCIq3ODxc-;6`m6A<)rt
z%r;Uk!?*Q&x_=wb@0m;Ve>d(7!RF*)jW3h?zQ&~7f%)Oa_b`rU#mtOjgP+|$rTMQL
zI4g*UX1A9qg%IX%-)dp86%RL3ek2~w&%4_C&103U8`M7dz<^&M+^907@IwWZVrt~b
zI={)IpRn_e{23a{=WO!cf1u(%casE#LkudGGAB8sl@hC*pcZ4YW$AukBbH8>nW2nV
z#h#-nP2TH9(@4YpmG}wii*w@42N&&s6#2unQ>sQ5yBpN7;bO6EX9fS6+XT;vMibHM
zm`bH%gUfwk3!+K=j9Pi0=w@urHGSaze7@;}E|bl{s5P^!#JvE+XG&JkuY1x@J+||P
zPkQ^May5Fh+Mb3n&v}%8C}*<aX}A)e_ZgBb+t=5(x=Mg*Y6f1~-rk0%<rEhd#uXO}
zYwF^TMYW6?hNv*v$Y$!0J%le`ewCJ%_Qu^re!XXHO=*cb-k_#kKIBg4;nUQ_6FE}3
z`g+)1nl=y{TPhtXDz2fS;f=?~H*c<I<>hOssi_^?yge1+mpMxA!THQsH13WD9vw^Z
z>XXB)6NH3>_(c|L8v^1)jf{+vkpl^1o+-c-w|(sGeWT<DKfN&U3P^16f_q?cnvkQT
z<Bef#lUg&Q<DVAg`d0K~Qj)-E@u7e%OyA@5&)b}>Obli7jP#~nj58k<1ea<w!HN{|
z@#-h67ZT`-(*~(WRzxZy>4bY38OpAnYg#QWE7J%yt2C7JU9kJq-TmtA#i`Nlqxq#W
z7cUx|5wRB9V`MTmKJMCGnHuuFG@&E2M(@axBZ=6=<YcX=msYeJOZ?0>upC1qaaR)g
zV!0IkU`yZMUR**`uR3Sp_JHKaby`$w&Y<B^4KG^MpI=3=qkgd1EDqLM)b0guF4Z)k
zdMmFwa>sHi+wO?JsP#75VLc~YVy-^tNeuQF!T#dM@+m9hiG&nUi={>{G0TQrcmL&A
zwsniuz{0Ja6^>64gQeDaNT=Tkh1FX}#-1yb|MIK;E(uGfp1;`ME|_2KIQ1^JzP^Tx
zysK>57~<km$R|*s;qCn_x4?NzffRFgZgp*RJCeLX`%$+eG-O;1X-)V<BHoCIdKOLl
zA``c`{!qUOj5WS=Ea($1c=r48o|=N<;@fi6k|IilxVVX`Djz=~mEtu<T}j1x9H2-U
zT3Yh5?+-d`HTD2;VUw|~7!6zgzP|ZL@PyK3`aid?S)DHgX_?Z8tSqvTO0;3MIeq#p
zHmOL)0XKfntkyM?LoUQJ>rz2<&)ii7>R2$Df5kJNZ~V@Q^iJweGcBzTl-+{|pG3~I
z<HTr2t$kWV-jU!%binVooM2D?xkjB`@|7E-#3yey?~yB3y=!-8jA+9ao7MkVw>t+^
zr+eHQ)^af^$;g{Lju@(S%PzKFi=tii*RPYzXXyg>d96;6F12S41~_t)zI>}kY6o*S
z)mPLOz*|i64BWyjDiuNq<_Dov)d>8{>(-LI(~M=sjbi5taWesT?z|Y)4!ZEvKVj;}
zJAqI#VSg{md#mlR*+;*3?jz;uCr&2hR#Ys-MBa0BaA+^=nIXi!7;)H(6!Bghz9T3k
z%5smLUB)8?-|zlvHbR}C;~p}|Z5Q{u9eM5n!V;Owgp$+Hu(iNUag)-tVdJ$kB1sQ(
zcXvY!2JpEqlC=ndenf2*QTh{ADWL5Nk^<lMem*yH&EuPJ5B1S6P5E#*Fy_MM4V5~v
zMSiFAffp1NgEg*FUOPED(!!wBx)Pd1i&^Kgdpa+$o*bPSsZln67NhO3n&^^W9SnYr
z8`=1!RyV-Ih0Dji_L$?oFG_R$SzdvGfyp%!x?lx_De%0xnWe_PACV(JScXyT8;zr=
zVBGR5P^;w6Dv`C+nk1ErT#ETDq*{jNjz(P|I=&OX_}50#xwhOS^y2=BT8=3-?*$Xs
zWxM29VYPK}_Iv*6*AKWspknCj)4L5C+nK{3Q$Nnc^lVQ@Q85@Hm!9g6lyww^b-Ur^
z2cdfJ{fp|lLIr2foM}(w4qFY{%dB62b+J|Fyr;a>Vl5>kJ52mK?cRR=^n#CE7L)Pk
zOR{0Mfp2d~lBIzN%;|`U)wF*)+!HcBeJ{4P3Pyda#4Rv@fKZ?9%$uNvV4-(&SJj&6
zO{EHzr3d#12vQe+g+ZXN$Om<qS2%E3tc;Ys&wjHbL9yqf5&|8!zJ43#UklSsFqq12
zxwYMZ0((dq{q{~>*Wvps63X+PO2HC{HkafUoe_2r?Fc$y)L1?FJc~Mfv0o)<eYg4k
zbvsP&Tx83!5&s1Vj^*urn7za3mS%UA1?$*cidbv3#v(?J7K(xw(n9ThU`+B-&-jZV
z7?(oGRHKe0y{WwaqBzI=?Dz7R_1%Wpi4STK46I4r`oxpFS@fo<si_!0`^jH-ys%Cm
z1<BNXdd58#pq{7MOE0Zkk8E}WkJZv+UiC6QH<wc9;lfz9xiBWSx5L_NRXQ_+Xedpq
zo`}5@SpyYSx<PKBg~AN1Y?l%WZYPLQn7@0t{rHtP&HWhdK3r)ubPK&tPakv}RajbT
z9NADwZ>Sg)%7Y3bONHzeTUMFZh%7>ki~8@@o&IdeeD0d6PL@K+t_XBwG)i{yXMgxZ
zmC-PnHKpUgQ`C?%tx*)M*eqBZu$=7Un~@yNN63H2pW(|Vmhe!oAa~YbNPm7Sv(Nit
z8zvh^Cr9lWQN>*r1=Xs#%Tx|&Ewee-=3KU=9tM{E{+SKSPv<7#=jOL#e0wNm3nuUI
zapO!jh;CHP`n=@#<%)@`;TyYwb-Q~B*7=@m!|?R66nh9XK<gH1fZ4`~t5zUBjCYx?
zI9He50Z-gXJHDbAZj?ekNLG^m?lal}>Br#vQ-@=vJ>;<^7Uhv6%QLIlCP_R7FpuGi
zmiz3^I4cSGHi&N>*9Y6}YNGJAZ0uhl#>Si4W@y`(=Ubk|A%nH`l+}xk>`?8Ly-O+7
z23J>kCY!=6r91u1pE;tH-Usu-&<_k`98MziGFL<Q<V<89$G>{@zP>A6#!Il}bf-mS
zVskSuLBX%yYRFg%BZ;i}frs=*M8*0>aDafG|KOAPifrIUFw2Gs`JK7`*~kWKqzn)d
zUS5?b#LWK4`yZ3Hz1;Bo_XwdM-oIa#50`RXzeZTU`>s{f)jZ8RD?a{&qoc?`c=C*Q
z=rEn|;w1jv%vo<@zXzcKL>?6mbI3Z%uuoZ0e*P_)Xy;0y-nAJqUwYVp*XUIQ{%J4Q
z&F?<13XO=DWqoI(2i>Rl5B8>T%KH<ST3$m<k_e)Ue)SwmA%_0w0G3~YT&~@HkDkQv
zON&}_utZ(sU=alF_t`To$1?25n{?wFwr?xO-nEVkv(A$cyo1QMQL*bIBPi!=LqkKM
znR*1}<<k9Jw@?^~T+N{UDeRy4J>@>tIxtY*=sQDMvcN&|edF;1_7JR3Rr13Kbkb?)
z00zW+j=*V+UHO89_J0x!CK?xer_Fe!nNJGn_-A|VewkZB%X6@7=LUN@%EMUC^SJeU
zCRzovv;kuj55j$Y9rS(iTOgr=Xj{~?)??m_CpZkPN=eMjs4<5gx(TB<RSe!RDYgF*
zpS0@SAyw<W5eZCdmFNAh@OxFt_NDDvs2>#`tz3k45BbeD+8@qdm6mlO{BQOUBZf1H
z8hzWXb|d#Y6`vD6rSMD5p&xHRjIRKP)yP;jzuNe-TMzdjjNVj0C#w%7v(A0xwzT`G
z5M`4)nY#e@BQq;)bF|w&J}xeA<eR`)FgAxDO87o8S>Ze6Ro6;$w;1W}ZtL0V6&GA+
zMZlcUPz5}NiRxGE+2pp;ZIrzEkw<kG(!axOar;ga0tjp|zU=GFiu^@K2oY7iNcbA#
ziw)$e@4?$V@w3SXmTGmX-2h2R$<9VHA!x?QyUx$_y=IS0l#Jvr*)2Fop$Y52I?I9u
zot<35RNL8wQ0W7Q*Ud27AU>K}+s%5;P*!SPU+TWLL9{d&>0Y7$sZdi50VeEh%H@JP
zdk-RU_V`lM?R4+`qJdrlq>A2jm@??2cZ=9Dw1(NP_anY#^2^IpG|^G^8>KvWgvDZ$
zT26JP?R~^iux&|215AwRX;(cisYJef1q?GLK|oi8Tf2Yl!98H=x<hs&=2r>l2)n?6
z=2{l~fb`dGgawR^SF(9!6*w_SlNZL24gFR0_Zr6q9_^j?mdmW8Yxp?R6+C8aY@F-~
zFX`y06M5lc{69r-`*!5Td-SHx66dF*Ps2HzFdZ1<P~EJWrmbk`aLX&ic3=9t=-%F5
zjVK+jGmJy^q&E`;MONj2#T^l{OBNc=&S_30U`@K0T1uDJd}n*dCjI&LApNUJXp2T=
z%lTj+(qUes4e#pRLqi{Wr=JxuE6lJqax|&FYjipkI`Oz@z2ZDuaFN!x@elC`7nWL>
zDaG=GU{NOjd(EAzz{;t^1}OWClfd^OAVsC5qrA)%4zg6Zk+E?;lTww-h?#y?-dy#{
z&k1`+cAsfci3U+G1=hg%z-Xg^#(O5GiJNmNm^ly`7*s!4+U0NYxQ92%8TL&~Of=M{
znB#eaAlmYR?$QGnlH)YknvPsu{2<M{&sbJjgcY``ZYC*t4%LkjH~V)R$M?uwis<F~
z5^?+1dYm%in>(Qr$jjKL2iW!NF)=L@dXb@x)PZy8lphixe=01zyF@fX&j~mve*G$N
znUa;2#Y0n!mz>IPGmQ21f03(QqvoYO#y?~%$%gj<3?VToX?u)JOD$7kVsw{->UT?2
z^Ef$n-dG8s2Rx>RH`pVi+IsqFk*|dBWB0LYm8`s-u#>P_*DCL!s93ITRL8^F2y4<=
z99{8o{LA&)l7QHOYBZvstN#Irt}rft2u2;SNEM0$ZeLPbW3w;gdLlunIja0m_zY|m
z4OSSY-tU`EsoIvsNBrhSZQZ=y2Zt0jj9zNh&4`;6=xPJT>FeCpaT3kWlbsfG&SFEY
z7WeCGT8_E0Dh~o-z+8y-yYSfuq5|dTHyVoi^hrkj{3^$$>8E?Oef2l*;^|HO?Ix2J
z<ui3!u*!FI;$~G^`F6gGKh^zIlmXBdo29eHSgMk#C>3vAMMacZMp~96u2-ZrnKWt5
zUic*(e=~h$l1=z?KxcFSchiw?l$$C_tq5itP9^V~vWp!<G1ercl$(rDg!$>yJ1s)z
z+q**ZSiJTY5CKq8(Yvx<c6N)Do51H0NWjNU!`TG|3o+M=kTcgWt1dv2{Y-^E+)<w!
z2z$?==%>Y{ta;{m+~DAWTHozw!e-T4sS17@eFG|EGg8A&Ap4dJQQbSs`iH5D2Yv+m
zGP9o0SHyv)oMS&rf;Xwlhxfg;Ka2E|5Y^4Tgv~-xfL-6KYbihI2GOq9`VMj=ZKI@G
zf}THVoY*)D;*9jV=P^GZ$<b}qi}Fb~E`@1_yGCV4GI37q*CXkQpFh7%o(x>tJ!n7~
z32U+;S5J3RzY>*Rb0!}@4w7h0({r~C(c^oNWMopesw?&LbWm16X`+*wt!-TKj>n6o
zSC7Z%`|6P#$`87UYo_uxS08j6_E6q(9!LiuB83F}Fvuav^&*RU_-9GuR35^1MlC{J
zu@s3UKea(eI#I8h3}u;7&u>Ifyg$pS7Aa5c|BVA4v*w)$CN$1?)Y*QZR?XH`&daEg
zE!>Ji4W`0G>PqFq@N11!+{Wiq&sC14<?Vfj1qX=YTAWUwIyEm^WM!x-FT6bE^2~c^
z-50OE{e9ee(NBS~%rZ*is3C&YhF?J0pc-vEX`HRTDBcW7hO7C-Nw>P!O+Y>DJ&m4T
zi^-jKl5}e^(RDi;JIIkPK)U@hX=rAC1|@2WWIK+Jx^NXc@|U2z*xF|#;~AN^$7ePG
zC?Oj*QIR1Zrr8DiwBVoB;)w0H!u(7|W5*g#ip_Mv;z2H`X>HvY9qm3|VK5YlerF(J
z-q4KL7v&Cfa#d#6Qf09T)M@J6ae0VGTnk!A^d<c;A&W7p$7XtG3&b;&(Xv{C0xQpq
z7X&MWyYcc-vkdjo1CW&vD(57f(zDXmPZfhermPd-8R?Co04IC$L`~n+)WP+ufQT2p
zDL?=G1f6cS5)sZ`TU(0>v@f-UXHSDv<(NTO#>9BPuFte!K_H7wQgRxV(EvohNi!8O
zGqxv!L&sZ5$BeIlTdWOQtm}Z4Y1C0CCD9S4C`t&wnVA_zx}xG^(po^N!VGr#_{Fi5
zp3+k@vf&#)-%?LkRjR}`8Z(Ym1{O&$5w=;wV5F0uLzz(n)u`a$o_w4HN)gvb4&h{w
zH07O$07&!i$Au8pW->;`I|Jitaw`J-GaWW6_nhh_&C8f?h=&t=<@iB<1)O^uNWTg5
zRq5XI>w(CKGrYX09VXxG>A-V0>#Y=b-)t_!3UsnfB3ZbUL+3ww?aOu}_RA;7g&}V^
zn_NLAM!3PMyP+6PxPL8C1*rxCZCd*EBHdpD^YN+y1qZ}~n0+mT1y)<paHJpBViK{L
z-!7kEKgK+sa%O$xSn<H~=qftlBGOUjZJI~PLon}{8+{PX$7K*3Us@v=7%E?Y<gdQw
zM*&GD6c;u%s7a8fun)Rw9G4B3A{HE6TBF4yc_7CRMtiCi5Ba#7q&-cfE4C?FJ~0b1
zc63Z?2+f2F3gY;9c<$QSmA3t`7f5`_3e5AfXGa{>xCV~M04y}&)7F9Vkxr_L_&Iu0
zfS_TdMPV<+5qt0n4~Vv^L;phdSOH?lD}2DC*!rUmTk(&^w+AG`jSLJfe*MZHpPDMj
z%B2(!;_mh#pBVzc=I6Epxee$|8#f2qeh0-o#&hz#he2Ti9-%|am153{S)5-z!jRs1
zsfP3g^DGJ7uFmZ*!_iDb;2o=Ea7jM_P{F6D*kah@+#zkrhVg-5@o(AG)+1~*HOb7l
z0gw)o1D_jXRyTjokY;}Oj_Z4V>#u_XI*S)}s1WwU|AHDX>NlEjaT)MXeZE?4BSm3C
z=z^VjbX|xb?F1Xw$-!SoA0Fw4^cQ6Su=9ua+)xp^aD*ruUgd_P0})0PPXn;Jl*%mB
z4z$2yta@Y}u`o0cG0wq5Gpp5O>U4NkQ6L8VyxxR)W@Jr?M}4dV$ZWi)7t{!4p5{z8
zX5`K!Ep&^Cm5zx<9I;fmQAkQxeTSnlKEq1?o)6|HVtzTPNE@dWvXo%-IjA#wi@WIq
z5ts=@nm=)2{GyX3=S(P-zEh9s?--gsyYPL-bLtvdnkFaY-B@mABTpae&>PnWEVy~S
zAw+IPe6ho6_H>)Tu!;(p7J6R=u42k$!v+-=j=z&$gYn15>a)a6i!B24uA$$J$W9@F
zN&w9+^YM?7W%JHGrz-}4iz7QL_crYA<#Qp-!0Z)VrmU~KR4lEsM5&m;?_v8FF>_9g
zWu^E}f<7}MSF11y0J1)OvcR;CJBO7^zq&-x*XqH8rxK^8%mzFa9hMrNobVyIMil$z
zCdI`G0x{@WOxU~<0m?{{i0mEgSFptk^ACoTzD<jL=k}5T@M*=^S+Q>T%*yY3tasza
zjqgh}!Q}W|m@TIo<{zvyAUcth6tl?dp~Pty_~~tDflBVDht4(t=C1Oh+G1<^e7@(r
z|70p_6@0GwaDvk(Y9lS7@J5#m9b3NAJ_Bno<KQ{LSf;89Ai1{h6Ymh?U9{@UYv=$x
z#Swz7vpx&G%?$GhO%<h1ehW0qiW7RmQm;XX8NMOBXnWX8+J_akH?ztZ*<wPo_2TLq
zXvKcDvOjW=M=OmNy073KfJA2)jeq*0Cdfa1b>q$PC8Fu}NL_gKkFcgIWNBmMb_;3y
z=#e8yBb%c?WtQ}ww$TYo&a4#V<{Fx5LO~d?UAC5<R1Sdgsz9u?%Xp6Cb(LeZT(wGt
z{iML1jo=~HVR*b^Fqxgj?w~z{Xy*E%f*IG+)^`?Mn3or}$^KIbF<mTM*MrNFM=tn3
zD3_C3@Pa_WB7>yp+MCv%0Z2bkRgp2)tRhvy^t4dH$fDo2#|9~saUT?w1hrF2%0e!;
z)z!g?)t)fR8e4J};s!gPw<49E6T}`{?<o>AKqgpmuX@LyJV!%0Mk8x}chw3tCMlly
zMuP%`_(lDHVWcX22xQ1=*U7*dgnx@IUCXe4N`imZ)veHeIE1L<-mp|1vWAPRxVLg-
zsLrE?1H@FKme1opeNsh7oVloe$2WUPj_K{p1Y=b|(SxYJxBwAmyu1JaGGHip$)V^{
z$1a24J#(Uv-c%F`o6%Z-YcJt~5uO{(i<<Be1|e826TNAF=X2z$T*wB{Px5k~e9FsO
zikFE_`$DBaRfK6*&aleKZ~FxrLyDSh726z*LC)UAzNVCG?`wEy?wmw#`Z)x4AHbrY
zKuiSkU2iG^q{~JAHG-hF<p*nh&0Q=q{7b^MgO4nI>2}%#dH3m4O^k;qfI(-2h%FZK
z;e>ISSRP@9vhl%2`xMWzw*V1fyK+C82FM#D&7ksrOUYm;joTfkW#RMB@pQr|-QD`K
zV8w60zNR+rHZo4U@bxE8%a@7!ms6NQ(5lnr<_Kz03d}#bD!TyUk@|5yJZXl9TnRmY
zCtY0IKM+WStSmCA?_(vd;K9jDG-TYNC%=SN0?SbJxAq*XD`9%PeZDD80$!I#nHYSq
z@#?`iOX1A@YkZfcpY1C6Hx8&kq+QH|KQ%6-Jlw;=-c-Afl`gbwu*;~a`bM=_)Vjj2
zmsr(&Mp!)rB|3L$_?0=GV(%bORTwQ;RDKht^eiAO`_QIa+gh!><NSI!sUFk>_h?Gp
z{f|=5K3OAUq|9(%$^)~a7dxpFijwHwUM*9g<h-fdY50%sj=u&KbX_YNsG(<tLC)CC
z!U8fsD~XTKxw#8InzQ9foUi=O<@z0dt{EF<4X1i+)!4&RKt0k<FEW}J0m1ep6bNE4
zws$?`Xa+KA?Mk@gSXG8=%S4fQjccso)!Dm`Bti&7Kh+P%8{eg*d)`dGvp-UNAo~wB
zzY*N?D2V;h20*@)!cTXQ4|+ZN(}TxmZ1nurLvj8(x~)ArumWmq2P<F5DvNo0P4;B%
z?Pi6M_Em0VvK`5f=4hH9f9Dx>p?5L+^RfOBrSPQq)!Q-w@P)0zpbTwYGb4L_!VQ9*
zt%zdbjN?&JpN(|u_ZobkAp^WLFv3IM`rLLL_vRzebiz0lCQp1h7Lhh%Z+CV17l`TQ
zuk-=5oK~Q~8^z?`$#!&wxPAZm*1FopeI?#;2`laOqkEm8rKL6X>nm0w5OZ}5<38M4
z!*lA)8NmUP9LLlP_L@XAMJ^-X3~b}m=!##X>uev#!os#@<0?AiPfXfh2@d{a8{wSn
zCdybF2JLJAf|j!H?^)N%O-Bz3ga~aO&hBTib#a(Z(JJ6EK(WB!=Ov6d8&4c>ovvM4
zG-~B289*S35Mz+u8*h7;m^<=GOMfP5$><aqn0e&Cd85ZxcFkuqXGwyM%?#s5zc*H2
z&TLZ);>h*RH?WZ|j7wIFpmh2+zH8jc-m|dCrt`UsOi13M-ja6hdhr($Q0oMH!T?nE
z#u(KG<)qrcYIAT6@j2T@f#zL-Rt)Tsb?eAy3VJA{egZ*y=u=>n`)H+=wC6YvsG;P0
zwv<m6BoWCqdbfZHsTwGEsaFWgTG~(dW8Z%nDn)3`9-Y}xsC0O*HU-i)8zIw#pvg-*
z_7H9R)~+#(3rLG$T+5$T;BQ(mkYr=vZwcRhNL3!l46f&N!pHBH+Rs%G=oX8N_8EW^
zqNVwWEEdjs4Nzu?j@|{;HVO&E$&LYLAOz2X^1RryeN?!|sbrU1NLM`k_KlXo$f>)e
zDBu7j5V9p183Qy7+mXAY^ih=^!D|T%fF|AR17f@wxYu~a9o6*+??M+BIxl>lDDX)w
z{4_a0<z)CB^6VH~u@)l{X#gV6qTU!t5s3|`ol~X%ilYP<8cp`y@`MJ;5`z!94V`o3
z7d{^M1G?Epbs;-lo}g9|Mc<h${P6M`I=8o}VBCKszmCOb4`9e%3?iG{t3gV*B-aLJ
z^Lr+bhRS`igW(wfAdVUHYzTU>DNVzjiQgkYS=2>x8Z!`atBv-0n&3QEpay{LZ=LcE
zQ}3Tjc=xJi(~Ay&X2DIIifVbgFu8Vij&5;sqz!(#8Rfzv=sQSgc}&cYLXOw^-rjG0
zvBt~WZM$d>)Rv0)j0zf}+BEzj0h5TgJlT_t08q0+=VesiYu7?jBoNc-wk5!hcZ+n`
z*NpH3A3?S@w)QkAeW#1}Y7m|G`88!mXlQS*^5IhZ`W1tZ3X|_wyf~p*Utt4i9Tg9H
z{E#(*r$7v*Eq`arc4i54lvj_RKd&1})nh2zr>PmXh<#D{{&yhlmLZS6eEX{HZrNaH
zw4I%-0Bm}N$Rf}DBdKsHr-gu)8v<cqYCN>60qsSrvBKHTf(i$Kmoba=p_BOlt`Tez
zEYQuCYACLuD=yGYNJ0x-8sDf#(lqA<7MOn!k>43(1lEFW^aq#L%3O~Fd5u<gB~{Z>
zE<|*#cVDm4!caY|cC^T(zW@nCVeVGba>C<<D12oNiCjgz<Mn&dTOm*gxRoRzU`yx$
zM@SLiB*}I-1HV)Va3(Gb7&-lq)Vz@rniw1m$QR-WcBqihDA~ds(nEN7sQ#aVMcEl0
zJaoW8@g$|;ZJn*4;~^+)Z;?-$-=gkC8g%SdXVT!Q*paww`)eTt&++d;vV68yjAhdu
z2%o{CE~}tfV^2UhlJI;~7aaw>u6k_N<(5;WR3)Fy5G3XPg`Mb%MbfR8J)Eu`fQAwG
z?vl_9wkwpNq}a_+=C?Fl;I0gI)qiMoRAGBJh7O|_C9wF+-Y3-hi|rwi%M~%F<Q7)5
z{r4-ch7eqhhfe~xuNhSpOTaU;sBMuxp5WubPKT-gcI-LG+{hr$Y7o0R<uf_}N$xQ#
zY0$j|GC+VX8%MqeFg=HCkiIMqfRNCUz+Ju}lo*ZX6U$wsKHtrC^9l&+Qk8s4Pn|7N
zht-8q->x=p5lrU2J}2aN=vS974D{6*p+SL8aO56HGp7jK*@E{p01eGCF*y|&jg2dh
z<^36*^Ah1i8OiXC6cSbH+n&Fq$}Ldtpr!c}5aYXd%U8)QQF~%CK^wzxWQ!$;7eSu3
zTE__@0B2mLN%f@11xyc!9Y#|C%JilX`{^}X(~09Wmq7`+*vKhZ?@xkLNq{3YT68W@
zLOy(BIgU)}AZ$HNz&P%LBI4}eSK@kOKfs4jEO!v=5B$k^0o~MTe+y7g!&G-=NXZ<S
z4%|Y8z1aEOOQ@`b#?yE#*7x#X7IePOQ?M4htuqz|vPz2gun}fn0%T7WAzy{aj;$}U
z`N|)xVD`7=D&PMhQwrHW006mCg-R+ihSn7DJns1?QrJ40LQ1NN;#ePA57kfbZ6R&C
z#(PF1f|LzLm^OJ1D>5D(uBNmZlH<9equa8@2YgjdfgC>(q}5pEs2BR7vtR)MA4Zcr
zUbiN2X-8?-no8H=n?hqTrAphE(uxK(+%ad6dZI8qy{X5rpEMj@O(`p?-~{&AkwB;$
zxe9EOS-s~+K&sOQ8CjA1-fH&F*8`O?MV~f(fX%9yCM(Z}a5pdq@r|+E+nUeRZp~HM
zl{$XB(6@g-GW(Td0t`9T_6Fr5anCC)_w;M|5UV%yw3-@-ES{5}M25VioNqdDmr<o^
zWP3XMA|XBO<yD1FpOtt}#JJlf>G92yu)gY@?mc_U1XL=MCh#wf7}_l}(f7@UZh;J}
z5=?d}1i;S;$MIB~PcN=Bco8kWu-I@a`e6`_Ve1R*iF*zZ;*0I0XKH^Z!L)a7gcf(L
zu6ok~(FzgV+d|-6ys0R+8ZLdS#l5W@Ufz#kX+@T3fyIpsIrulCA4m|53=J<sPfG!B
zLV9~f(PVqLqHj3f4<v|7<ER45Sig;;KDYiLR0gn9Ab_Poo^w>5cW_{7#wO>yey6BO
z06;st=mJ0gn29GA0FqE>&Yf&=iy>=kYrr^B@R`o=4wa0;_|l}+duZa~tu%9Z(T5LO
zG9iRot&ABrTG3_ClXAUsXH?E__c5gsI3LBZ{hPH7eoyMvVp4V*ivJWRlOQ)heEIT~
zqU5*Mq8^)wy`8RvC1)Pzn^^q^MPzFx1QUiI7B)^tmW6QM{Ep>eLb3X8NJ)Knd@=)w
zTb}r*NR*hXE3KdvibFds-g3-44|EH#8%#t;2$Q(o@s~Nj>{=e4c<0n*{l?;SKEU3K
za|r-b$@Odddhbp1y>nB|U(dDdHNfS&mL))`{!JJ8^T->O-KucLGN(MnxQ_U9W^f|j
z!M~fD^!jW9!R+$`!BY3v7yEiQelJEqO#yPW!9kV@=hqLueA6q!K8s{>i{!O-M%buJ
z#_Qoenb1+}PFQ~NaCF?c(51Upo7Etem|RlNRCC<*xO_N&PU$1~+-i~>$(fH<cX}D#
zy((q;VDH-<LM5m)yaJS^*-ctD=}T>OuDihja3c|m8fd`=_Z8C`%WRFs6aK?}?hVX_
z_e@6ShfAUc-m-!P;N?9lX5G&$$4RSS!jcjbFBcuEjf?`MC}!jU`$zDFUmKwtQi)SE
zbSc+_)QE8bX-@x`4#0!J2k8cD;N$?+Gyzz(TN09zNo#T(EKijJG-NC%<=nHe5mECP
zLl8iTk(b!0=-;|BWDDGpDy^bQCf=)4fmV0Y`b)EXSEpPAg@pPu(G?Y1Cr*;I00!Zk
zA}N>q&hK>br90`G<ggH@fKMGcId<Fd+MUt)-I`L2s~t!rPW({bFO5$y2(j)Opgh)C
zhN)x$77rj-mRh3n*%y2O*L7?8?wF4dfTvawC!_CgzhU|lb&O`R-9UMVzPy(Fvigcb
zpY8|TQYq(`iX_dAp|N}uRE6%AA&0g)k;Ua46DWJK-qW}&YOTmI__n2$*`#!bB7ho=
z_zkfWI=LSl6qNsC32+^3zb5i9ClrZ;lHgFIJyN1Fm(z5%hs<6}lbDLRxzwe#pwgSC
zqbpWd!<S5OcybkaZjZtWA4tfCU6{OdThekPA5bnNf)*UcY$p`}T!#UKza;GDy#3;#
zTV6$VOg1!N<FJ?s_JajAzfyjV`X|jJrz<ZpDTS!R`VGKP3a!6`6N`6l-AeArKsDVz
zMod^jIri%w%`NV*8Qer->lm!-5j%Mf4i0QtNWh@#FCLrS*nG($^<xH7q_KE^3}ZwD
zLf4n?$1fgMbR<$A@UP8m9cg)rlxGgLCCO~a`WmZEUtWB?OzZHvjHzwqhdw}Ba{z3R
z)iLtB#3V0TUDBdvaak_hv1TNxrKpwx3d#{QE@uL83)t7?lSxSxmh{)eVDot2O6b-n
zTG?v50uRyDsv{|7gDmMdyh>#8LKlFT3H2m(O@L6tRk&zm5;FHJRqZo3l-@LomAh{-
zWwXrp7O-h!4T0EYrE~?ywCCwp%w(1~07IlApj`rBn@7)xCIb!86Qw$$=_G!Q#7TsF
z(Fg?a<rrKyRc>rq8kFvC`i}!v$Sc6cO^`w(Qwo*4u5jqo`;F~T-J0*^i7nbI00I-6
zg2U^j<+R~SsF6!ja`Jg=8qb7w*AhPc90a|PVd4hIWu|YCe!w-VBhr)%kKGQ=K6ZHD
z?OyX2!AM-+gGqsQ0KK;ZR8JyAhf~pM*R(gPZ0B#OJQO^!g{oLvW>`}(4P&-5V{4!Z
zVn&qA;~l3or;kQ$s9eSqXR|K{2JXkE+3|r=*)~cZO3BN^4uFzt7tvBvqd@@pk<ci~
z^D)1EouK^**k8GyK7FAcR4_C)rWGZo2n6Dp!{OyOVo&_W)ueS<B>DABf-k*kk>{QT
z;E?Tvb{?2S+~5nzngkI_ma=XN0CH-BNsW2<Odwi&*_x_=*-ijO+!LUX4KR|(nC#a>
zxBUDTrS0rb(&mK0dL-BMd<Vr+C~a<Qlr?E4o6~2`)Yi;-mF0Z+fFTO0XVtQ}6zrt~
zvO%uj5jf!D<dflB(Q(%J5MV`6)=QuUzO<G~3vz}&xx~!v(JD}QmB~PR5Y7TKAyWw$
zB(rN0ASX~&wVV6}AG!Kr4PS@pDQL&6bpeDdJ`b(6iB0LQ$C>0WwFIt(tpvWmi8Fc?
zLMyGcB;|F`;4xni7OlF?jlCzsp#gzHP-p^3-CvJSf49X8BJZXEY7Vf7v!z}X7OJ*n
z8ko%CCAas0BvNxC3q8{`*{Umy7l0ps`LC=CYKb<f4$^4W<MO_8f~J0Z!D~&Q@qlL!
zL9!4UnF4?r<=e3}8C&jK5kRPf6or3(HVdRZE_5%d4#&-&u2(>0nV~BNd`&a1W8xnw
z*E?6V6<I$!<$}vf@0M!@fdb9_;D{(DgGg9qi{f}>fheFGz>RXJMa;FRbP<j-rHV?7
zzN)HRN<q0yS8KajY&?b=`u51b*LYDN?{M6CK4eX*r=gH|V`?eK`K}MZKiAbbJ5^=n
zVUz1|UQSgxqobDS*tw6rhBQ_e6Nw6#%qd__wFOR9xcY-f&q7B43I9YPqH$sTqi#)n
z>gKjLMW+})!owR6fRS(eS3VQ(8`4-%IbXHEIu%iJi$JnyRloWA`~@P=i((6E)Eu#-
zv@{vC2{2_B(fq(EDWGCQAN@h~I)H@(un-RV%C|n}M7p>7Xmm$!B60vLLkY*eFz_8P
zgB<2#C7EjaKy`a=YzAsp=dPxgMQ{9s_)n}EaD+%oD&dO1q8i1)<PW%QP&B-r#em^)
z5jAwLfiO|TvNE8m>f2&Mv`g3W+#WlI=e<zL8wzo2uQ0m7o^}Lm!hM^X5yE~%ls9FQ
zQ}d4Y$$}oU8ILo7zPBh}euDk1SHSxlk|22i`qW-zBCBs{`OE)4mb-pT6tIwKzo`ve
zOaAgzK*K4YY%i-`0iZJ)D+oxdh}fR<)$lw(O1QLg_$lqHf$Ov761&buYHE1^*H5vi
z@nl@Aow)-_u%mTw3&1xM8L1{E0*8(Ty#!M`FVg9h)vYjCEI**UTGofEfI$fx#L)|j
z@PNacZW{Hdks4APU@_&^)yYK%yIYz53+~C(*s>m4<vDzD_f^E_`xKpq+pn*x$obE`
z-R&AH!ZqoU&i@?9YgWM0o1&d^pGCLTI$s=ZF{w`&)^a*bA9ei;XrkGf>y&sY?;i}i
z@eOdDA!{JTpnGA)_fMzG<5-PtYuTSFCmQpjI7R`0uuAcxHB*34i%$}|%k6eu)nN_m
z+XKpMTz!kt4%h9^uF#uOXNSlo*ADO;^E}toJR<xb5VR@+>Av#nu@{ktQLUG*7!*=3
z0b)~1j-8u&Cf&_NecLQt%kll-4#A;a3B}&}!;ewXTusBE)<$XIl!GJJ;F947U$;We
zj5{6Q_$P4mj-%Pz4pC|phr&l_Z#|nnsHuUS<TWzd)FU0ybB^+cVO~#Bx_S1~e528q
zBDnak1ROLy)=zIrlyP4fips37$5B9We=iFU0~9zc<c!S;deeY(wO{{;;;iZd8M7_>
zOQGS0*>P;SZ{;;suK+g_)Nha`4O3Q|ClX)@@xR}(-9OBVn}4<yoofQ!V~5%zm8IKL
z_88h|ueU1dH&OD}BYyo|Lv1?JXu<$_^WbPbT`@>AqtwdF55H}MLLj!!{!Zl~&@F2=
zNccCA1zOM4A^(3i>z}qHI*85jf2`R*?LeS)>C4~u6Mi}b$ppDR`Hj{xb!O%7#iaH0
z&_lj|qP4$;tNrir{}(L|>C?WguIhgs{dSO;=>K_KZW<R9t<ns=TiDPg7Qc}3TYFnq
z!r4^WRfUV{`aLks`IwZ|1*HBcHC03~Y|o4L&m(7NVJHTW{Qo?dziVsm5zz(vM#C{C
z@oD>7S<X{!F&!MV!N8b-nJ~U>wLE=G*93npEHw9h@1?*ed8=|r4QrHWBJH9fsbXwH
zfsuL6Ganp}|JR{r%H^XsKAk54o7VQzdDswSbs4$#j1O66_)N<~-`tvql$d0qrCE4~
z_NSiVrND#y@#!$(+U>8jYk037AsBhSoto<3pD7x>8Ms}iXZ>H7I4%`$-6-mdQ?GT(
z^ImmjEVW!S1jEoqQ_GVU6s*!T3(RXUuy#rDwn$1G7Rt-5ym>?$lUMfMay3RP?+ti6
ziseJUFWyuJ?_g%DN5I>1C;opfcyu&xm4bhs*Z%%Mhv8?~N5dy-1btI|QU1Ks`mRNZ
zw9!q537Ht7s6n9xyP`5}aNWeA54nCu#YY4Mi(YkCJR7E3oAZ1Hv)XqHBHlUu*CwcL
zn6UkIUw08sJ|?>+r9E0$s+_LN6A24KTFr-I?>2cOzXC%;x!ej2Pqh}fgqyA~@_qd3
zk@`fFx_t_aTHkD4&-2$V|NWkGE745}qbO#yJsmb8v{3cYD6G@m2n>T+D&}kg<31a^
zE0Scy;(t1crSScSlI}OpwB-Mq%ir&J-?iPpg)z$8ArG5Dok0y9{K&{}24<w4gfd@v
zIXu3b`CqFwySUJ)06IXz!dl@u(s24dYsos{zeoJ*!(Bdt+bzt!W7_ExkTZXs{O5fe
zbX)y>FMoZ=f!O~)>chFFzrOL$`;jXQW&bs`=-)sU;-ByQ`RRX$1q<=Ni}3%qMfeuF
zZ2lJ);Quq*ciY&E@Txf{KB(wZ?rr}}7hDg&(tc@u@j}KcJnO05XV0|ZxTwhSsCfN!
zPj2_qMm%V*wol#`dAosxG=M3Cc0DuEgiE>!Z(GnQaqmK3$tvSg0IyVI{qwu{xNV6k
ziq_w@llGx^5LkpZ2Y{p{0idhTZTp}a2JT1PPxaoJEuT~gRetQ2vfsdqK%c)%1KGUP
zUnbX+xgLjPcdT!@Je%<0Sy|d+7>N?9HyHL`$Qg-xf)+l!y{F<jBW9WW!@gA;G-TaD
zBSZGpVB7XR#)6lHS+@7p?P9a@+Xhz>azU$c_vA+<?_X1?uSh5F+CLpQ`;P@XE|m=I
zlEhHH$OsVuA;LW$dS^1(q!yLESCx6yJ?CYm(g<_X(h9n_W%>HrTq~Fb)WqxDQcFhm
zOw{iF+hH!{J8{THF3SRP3MflV4XzmQphe=6-O3CsHnoi}@*TO=0O*l_AMeY-GZEt2
z&ov#v=e&zOH=a$7Zw@;x3~>8fxTqc1!DteoTTfPd;5mEAskGGvUg;ISRAV+UD1QR+
z>A_m{D-!$N+*abh1CH|sOg6_;i+LEzyw{E-5kuG+X&(qXog+&f99mbV=ix0BNyUru
zQ#GwHfFywYI&U1Qtax#RxFH#SdS`Rt#pZU_4;qD9ZZ|kp+~=jRd4=WlZo~Ckv7BN6
z)g-NX<9B@?4+?#_8A@qJ?LOjdp^%n;O!DAsYRaE!)vw~Bh%#Q<YI%xNlspkB5vw6|
zZ{_+clEJ5M|C;Az-_t3H?eALKS9vdL3l(wj;JI_Yfd^5jUXncDR2L|3oK@h=kk?Uc
zQuq5EfVPO7`s_Wce9TfJNaDLoR!`24*j)l(E|?LFL~Z^UFn5HZthsXStY|R8oq^@N
z(16$YrmX75?1PGqOmfVC$8%0)!KoVY6KOk>w+W$cpkDxkF}oprihmsNg17|uMvrcX
zx==v<B5{v>y|WBV_}af0_BWRe647yCOY?@y91==D90i&K;UfUYH*Bl6&wpJs;P~^+
zTUwv{5@k~-j3~4=Ef#MgTgwv`@|0H!xV76(SHq3)P+{?KM^6ZL>3#B}W;;L}O1YgS
zVa38Jdq!OO=g#>iTEA-s`hM*=P``%eWmp-I4FvG`F8K18iDxEf#r9lWEZPNK>c}Td
z05@DE)S^YvLM<sn&POMI|C#~VOf_%sHI+tPFE=I|sYYJH2H~>stNBIrGhq%937<oK
z{zuidH#P~sE+4|p(Ela)Pa1WDLnhY9Qc(Dgg^Bh+W(th&qWYfR48H$S6{n<Pz?Ld_
zcuCS6#o<Rh!Pfu4ksJ;1><-=p@$kMY2j#*~7jCmReZX;(SUF{<*Xn@GS^=)T3`e6@
zL$LCjMZ(!rY@z4oD1A+@@W#9!#lzKj3UgIm&&0Cs>2+I}cK%wi6B9hV=M(;yUNo2L
zG22+7{8T{S9J&i#a?nlQsgC-y96Ujwdv#C3Z<mkdj)sFcZBYTCsO1YJxiQfhM<mn*
zhxA9$6<_fHJ5kqazt+zQAD&)YzunTht-1Q~72cXx5?uW4`<<r9SFF6KP9yHYW2-Ze
zzgGdq44TA@t$6@;x>7F^_Q!>T<99n|e%#-c3dF3xQtnrcJ4F*xdq|Nj=nup<Y{xtb
zMS<Gg)j{-V+y>w~SqBQ!+Vi|E95ZVupbfsRb$hlvfd`FJbpnaO&A43&=_wTrFF5)+
z^Y*`P842=w?2fXug=halZ5=69d2!_lju^Cl&8#kDbgZ{29{KxTKoJ`oHZ6;>0Pf{d
z)HwsTerozOroG1*j=od-tTsq-Dpuxh?w?l0_4T<X*L+F}k_MA$x&-PW{Q-i+EU*i9
z2$AP_x~}z-sS3x+ia&hBy1`ei%}X*a^;}bq-l<hOz9avd+<9GPo%B3P);4G$vBrh1
zuA3oM^nrQ47j$39bfmnS@VY2+;4CNN%ku75e#b~?3}RQ4wXi~7Wq<Iv+D)1@5(fN5
zZ|fONOUoP%Iq%!X#pV~mko+_qVGeVT1K5_Px0ZP(xg0p4uB`gY=`~BQ)U=bau{}=h
zIs9nMIO2!*nqRSl<IGmWE^+iX&A`pkv5f4qvrEp4bET`RF})*c>BtOgJyZ8NKVX^o
zcqXzkt_9M-L$%N}NnNL|9W&z+YXL?Uj^sa$(`;-x=nnz|M}{5khfhzRp08F8S_l|B
z)sPfc3xy(I3AE#;e&s1U605C1I~X+^B_I3pSHnpZPFd2qD_v5_U*}S)d>zK2%~H+B
zN9_~a6qAjf9rHCCdwYe~mmed<4=}}jX871H9@E(<<|IjReSGkyO@|%RxhqcM6y8m>
z3kQDlKqY-4?a}+!*Jl^hf6y-R6bwPngy`7S)qMzxJ8!6Lgt+{!;uf}&?V}^%1AO&s
z3MIFA)MXFFz8(}==k=t8UqClAj+x!tVYN3^BB+BAK>yyL3S-hMTH;^-M$cQ?EAB~5
zGA3$L09$t4Ov1k3vVEvQ?IpKzVZ+%X;<wJ<2pe-FVK#>SRulI%gJSx-iv#O$&1%{r
zc>H2vqNKA}+a_oI)MOqs1i3aEdq%5kT4c2|&R*Zzb`S1X`yzax_NUHI^3ek9#b7e`
zE6|nGJ}b`MwtSq_p6DV;SmT5}-V3!+Unakfiq-mRudvNEL!I$o8jlGWlkpmh11-XB
z!|)-A!1>#3(!AQ2bkc;hlS>jCJhHK!7XCS_JIP7%gu(KY@%4`B9qDL|TaGV)dsj+S
z;}%Qs81ZkL>zT>fv6eCz!$kqN7(S!qymp4*HraEh7USkzZH>Gaa%=pP*|D<4pJ5q|
z-PNc~$qp(JEFjx`3pk$D1UYudG`lbCoC$fOg2Gi!**IOa_kz59{I3TaUH7#F7HFHz
zXLwDdg^Sw5S#w)UCyq9|k`aFqRvk4r#kfOCUG9!38P78s`rgmH(cnK@_crL~e*;)k
z%zQVbe;>(W-njVyYwY0wo^Em+HolO4u{GBjscbg<4GNwy@K7bHig*}4uPwR9*l@Zm
z>u0OHdq8qt>s{0J>rS{#u^0O3uRTBBXfb4y^lJcJg(9xVa!&|xcq2W2Geq05PQiS{
za(zX@F&)n#>*NL@?nkIgJXrPBMw)^7Fm-SUgT6v>E3Xkh&fk{mL%ybkkKi(K1N*nG
zmkkU%w{=+s^JaDU2Mh5BPdYg&H>0@4V6|LH1FaLjZdAHsB?I`E-4Xz`&MwK|7wH{n
z@16T7%&dHXx~UcsS=cyIJ%z{*;pF4%PYK(HQ9taOp=FBvpME$g(5LOKlc8Xxa4YF{
zhJwgXT)LEQO~W{X!m5Ro*)a=Zg)j8psQ`<XG7=p?B>`j^2)Kw<t0GFx4fN=%^x{6u
zh?!@zew^;8+1UO`RqB2^?VOvrr>#*e1~n<&D6wCOCtw!+vME@AZxiM2FB4xkSo;lb
z?>yVs{}#M;=&xs0^}-3Kbp!=PSdX=fz1)F{_zaH6`bRREghp=7<$rfZub!L#X$W}2
zA?VxInRLSS#PWHtvcuV_=G#v;LGRXOa`5@m?gOgy^rqoza9ap*s!+0;F|FI8vf5X$
zAimps5vEr>JN_}&`_^%&%2m0~&IgW!mX5PYjINi@GQ<^|gRQZMIPn=&nLsR(On~-Z
z4%-L%(>I<qVj$R=R=`+1AU}G#9bybr*+<#@edePYyI)gtwz$Mo3LNDQLs~26bR!d{
zJ1mZ^Y+Aea=y;Aby3NUA(7s02ZrQfP2QRqR9+EmV``*?w1YGShb#4WeI1%Q}*#KCL
zo?qCCW7F#R=hPve7S{3IC?}f=IUEI;0w{5f#p8MQu>gz7e3yJ;edt>Cri^xRKndcO
zDsls;`S7p~*kAA2<+%5aCOLcCSAgBHAZlsp{8)nB3Ar_FW^&UGVOAYd<;D4<VSVZA
zE)-L@xu|?DVF3G5qp|T<6?%nB>9@ZgLj})VI-69o`^#aa<pd!#Za2PCc?_r12?$T(
zzcCg7o6LPbeT=SnzPR;66|uKyk%`@Qaq4u<(IZu@r#><9*u10@Zps-}3J1-nW+N?E
z_8S!+$W2LWVL7T9^Bd0RNyjzkFgC)!fv(^QUz(Nc3oWhlBXO>zw)i3~mV=P^1`$^7
zBq5~p^c(*Vds#cbun5d%e^|v`g~$y$;hF+{2}ah!&9#BBCJP>FMLv6zkVsKkNdNiF
zZ+Cibi)jadehF=7m7@j0IHf+Wt{z2niM2cX55iu~4S(4V4HP-0oQF#Hj=ia(qSI4x
zTyI}^RBE{8K`k>u3iMHTlE<I>LWsbKRWtVQB5FxRWg`!+jY+r%Y@lNuy+%2b$Xa(o
zlvKeJkn)u-E|v<6g9jO`1P$445TRKVcGASfD}O#!O>dyY9A&*7I0h_i+PIg2XO=e_
zG+B-eM?Fl9NP-jG$L)g9H0xNsD0dI}=)@ev_-ens5tYtMkhlx(Ihlmt-*}1H1Km+)
z$>bAyBLJ^9HB4tL^BfgE6xgIJD66)^8lZjYb_Va!Ga_+dXl<YwH@Tuc6NkU}W3V=F
zyA*zWa!F%i&*H}>Ba>;y8#o7=S>uUvlymSs6V)TaHQAn*BEg87JQ?Db|M<%eT}^O_
zRSM^3?GdSP!lt3t?<2nP=vS};N@D5Ml_enQj7zxT#mXFfDIMHLk<<#OD+FtA*d83l
zRy68YQ}*7RRQMAs&Cg%3r8D3Phq%qJoAG4Ff}3okd9>iA5d2z!e0st_#}Kzm&0F@S
z^NQ2-i<EkNdMeEjrpkoHIiO^2QBrPF2`W}X-+^VrhaG;ZD{3zl)Dcx-tMW1g{_~Z4
z*O-u`Qzx@*v6KtuxhqNsG>LyNt?|ze^`2Qmy$-?kFh2>%Q^f0kdzpUW=vk2@GoNWJ
zc!F7rb*XqS|BVR7viNv|N<7vaHE3K%Ubx694^POQI+a=?d(?bj3FV>KMIXfiC8kN+
zSCck17|K{Ul}@b6YG{N=WXSl99@xJ3*$z+sb-%^@ErZ=y7N#skx?^@w?UGKGD412!
zlb93?*mVt{t~@C<@(t6-OG@0}sSn)C2pG9)&z!<USmW8^{wcN1ChM+h+*JL4*n97&
zrnatq6!a)I<aiVnX^JA!k08CNpn!-dNRz67C{=n5;pkCNDS|+xD@9u9y`z8#5s=;q
z9U+7!5FjM^&22g5{l4Fy_l|Mzco`}h$<E$utvToOJaewO9xY(PViG9(Waiv1*ShaB
z?W!YK_;qDxyU*KK_yyPe==pZu$SpfnkDM=;Po8<=4-Wg_(i##SIHq%!aVt#EI3I6u
ze^uF;l2FKz;oR`cJTtRF6|IEnG#`mcUVQKQddT_Qu;r+kebJ`xb=?Ej!E$QSRj>H>
zUL?ghIg7178=IDoEDKv>*u}Z{=T;+%7kZQB7Uf(v1&GV8OiBh&5U<|H1HmIAvme>P
zd68;C_&j>@1k;x&qq~AJ54P(~3ma?NMT=Qh5p5AJppXCasg`%K0ZR>dd~2f9=VWVP
zDc3orUebkB`d^1k)*r@O4~_If3Vq^2F7;LygudNUuiMk|sis-;&e+{gS1l%+3QutA
z>X(X6yl$svuV5&7?`M|(^sa{G^)YWU!+OO=uM8b<>Xdxxz5xumYLAq&`__8ni|r3!
ztEX-R6GzP+afjt|79*d^iNmPQo}QLI+si?oCi=m&7ja$mA))QdFSdJ|HK@M;_<C=F
z1mkg9BQ~wlB(d|f<}IDu8<qWpKp)3>Z=a8(&hA$Ep8brcxl?Xh=LqY>GvVVTGX<<C
z+e>rT16KBMEEb9!JxZX*>Qx%+=s{#7A(8D&Otx2*fPqZa@ed#EZWt96<&vr2yD*+7
zz9C2Yl-y3wb4*#@n|;5vxS)_&MPc9@7>+3~><{L>^+-z$8p>73^KZAOI$Lr^i`rip
z#4De-h2$X2BYRDmE9LE4O<wq;c8<g=I$4GpmFUF_>O)CRi(=0dr94**Cad01LvOzP
z7R$Qhx{}m-j5RfH*_APZ5B1VXhxP8Up4!=M%?9k&ELHIaV3%I`fsbG&;mG`*oG5Ze
zmv+QHHaDFzRjcM+gwc`tv+zNirbXWa%&~w8iX0d$QQA2r+;;Vjfko-d6fEU*J#=9T
zCkHhhvn9AJ?-BcDk|w+2C8{MpHF2el;@8z5p@13q9M_!Q!%DfhKVv=PK}o^FOYq!b
z+4-=7z`N`%j|HrFh6L@0jFf`AMxFWb2m7ms&ziDiY}cdq*prH#dN|a`j^O*($XbgE
z_w0@wvcg2mI|U`@FAWKu>5S_VUeC)4@$Z^`6bsXVy6oBY_&=v5teHhH$+*%}Guv2>
zWz+Ccs-S@pXLb9hVnHP7h<uF{uI9If$9Jhmii=Jx!v>%m5%F>o%P$Yb$hutC*8uDt
z5o8^imbqOIXj#)Hg!cn&($2a}ETngJCDp;c{YV((8lvldUF_EcMyNAT*Vs{DnV&1-
zD@ICu+~i|BP*uA;?&!srtToNiBwZ!_;EZW$){qy&;BcOHw11q!kk7Etbzv7hn7}fE
zj2l2OJ~km-aP7?UJ>lDu_Eau|1^#?`EK$Z)o3OgtPI-GCz}gN0GjZQ!g9bI*{!8b6
zeOs<%uvqiFVV8n0^NiSAo~tnl*u)F9oxWO?Wpd$B)q_zc=s^=qR%L>C*hryWCH1PZ
zG(=1Og<uYzXs2QwYf0zYCu|l&AyqAQ8p-C)a|u|>zU3}@+~Z?4$2R9xI&5!B8osU7
zy6Ze(QY^oCsH{s$5%z#HaP@NzDcl1Wn}ppWxB9)aug>tuzP!ei3%;h%a;LP@+QUrJ
zRjfSc+&<I#S<&_kA>{jN-utE=-3pS#@FSf!6|`uRjh(UWwAJ`ad7dguGU%{_DC2PC
zcl(>zS|J0i!v!8N#@}b_jB~>)KzaL1w?4Zm^C|R{yHf7f4Ro=0;D+)9`GV7m_Crep
z{nyymrq*=I%+8*j)fBtGj48y9jz7v7gU%E2UA;vP@U;Mt^3>hR3r~I2M78OCaWLoV
zqD4KRj;HrnG1-Q?MN2bp4J}Hej@9t-3iik^Y+$l3ZyA3!%8+h<$0VFjFOY&uG!(&_
zrPv*?=aKPxnHMWeLNVtA^Z|LLFoe1M!jz%+#;bLw@Ilx>^8s6Wz&;y0m?rnN8^{F;
zC(Fm1v1Zo6sP?#Q&hQlC<(J!CN6%Tu2_ei9{H{Q3DPJe~_=(&q!;jT$OVG;9K}}!7
zFQA1U_hsknV-o85vU97{FAhzVlPvN$Hd&=o^ipl8uLX9W|J8UYWqplQ-0P?|#(kcC
zC;(+mw%~g99sQhlg*0%v<L;-T!q(hP?;Ow-Gg?)$%YKLNJ-9vmCMHY6cz32-j~ywk
z>=UK&TY5g!T1#^`OgERlocR(CACKajCefH(^?w@BuhzAf&3P3v%AGf&@?ttBZ}>dz
zZE+|uYq)l1;CXjnw(Mmh?DO-QPsppHZXbSjj~ydqqSbxC`wjygAHv402z1@gn61s%
z{Yl<)hWRBU*WTnQyn7_{Zu{Agxb${_9KdeOS6(rBJ6npR!^Rask9b}}?C%cGh@?k$
z4-yNoP!sx!(bOY=4*?Z<pEjOjxcaXx5_*6$JC=%o>42`lP|*VcK_THCM|Mc!ur5b1
ztuNJ?OpyEC-tu#u*%v?cEzWqm^Y+V~pHr&3cm+IvU8HizO)08jiV6~v3IGvNRaidc
z^8pweCgb#^+~n~qXMe%>%pVVF_)L59j7E|M7XX$okZmIIBL6|Ir>a_Pd)}VOVq0gt
zS>`_fB)}+r!R3!H6~*Omsp%?K9dWU&!?g^XlUH|h%<Y9a8LgZB`mTje2P=QFa`ruZ
zHx}l{dZX&S(BpFVn4ezXu7^m{-_77+n-RCgDA%gxX4xbH)R)$rbtQU3N&1}}8c4)|
zUO0JGDt;->iiTxoXXv(lgOmmgISJhEzuq2$-9N=lEYcVIropFNLMd2T(PaQEYw~P<
za^pQbnh8{*kBfriv3T9M2MQa@-n=4FMY@;85q)A1-Iy2N<al?xUK=#K;j=(L^y>i{
zHJY`<?gRMng{8}B>f4O-NAk@fcK1rh+NwL2GWJpGq4Z5dVE}LKS=pvRrhG8_(mJ-f
zDxqw<u%OGZpO^4e!Rdt^oi*u*$>oB;mBX3a=kc@kMG^CuVwdtfqHxt<ih!l~afr}W
zd2uS}m#2D{nXR`~Rl`OJL)j<N>ycqGnwcl6(>g49$v&(7f&M)QGg=vB;3n^^vCL>6
z*_m@^)e|Wi<sT*+bZl3%Sa6N7$GdAc4HL1Il%>@9W%rwIc(iWN+-XZ{=QW|qKI2ls
zK{}nqym#~anqG9E2A*0f73Yx2_f&YKhKgfh?{w7BlU)`pKYA^nKLdW#QQ)m@`TizH
zvkyVKKBx7ZX}6UI+8G^^i|^SI^o-9GLJN}h+fVbVM)<>CNqJAa$_pYX2R|o!?Mfwr
zv?0*WXlk+FQ~7f6Mo#|+jaLGb%(IcGJ5o^IayNG55w7e_Bmj3rNWx+E<|n+}ne&i#
zF-7JhE0fO79ANbOe8@%?i|=RqQV<B=cX`pGTlO;4)`;7Dys_5MMAu!+b4}N}e7h(E
zKVd~d?MA#pW!m6y$^Bb(+b`s58jpqn62<{WL*PS`uZkq&vA0d2Lxj2PXXS9;#3xOJ
zSrHR!XLO3>P*ZGpVi`U5AWy4OLEz)(oeL~FLXk&h>$+dxPIo*l9(-H=cxa_VejX)I
zYE7u&?&<Xa?Jl{YY`gO<wDuUC`q{51U_;5>_z+{D?)*C07-o2avC3+(v(DO7J4=rR
ziR#d4pJg+Aj%KCj>ckO+O-_-t`uwU3X(XSo{CHal>fi-W>g@C~2~CzjBKt<8C@p@W
zsE5{Cy%WpR8xe50il%_PgYprbU%796Rd`}r!TYr726END{-wvhsNrS5h-I7i3VZ~+
znDvtzWz)Ey+C)vLs@B~z3WRc_>qj9VoUI&2anbbM!S6P?E*GIVx*9aWk_O|hSfB(A
z3ZLGCjw!_5UfvA89EcbJ!@?@D*UC8>Fx}*XvgE~KR3oSYU^%=1RWZ$_2I{TzOMtL8
z_6F1FJD$FL+q5*!lYttVfH1Sicsdo^=784l*hc`f%h$^^EbVrtke)pgR9K5TTH|?B
z^E9Y4NcS3OHgz%&)gWZ?k>^C4H(dq<dn=mGL%T)7O61q70gX86L=+kU@w(9a7~v_C
z{5|8;xZU-W;uCYF&-3ooADd|})cx2nw$PcDPfysz!O=#UQcZf8-68MTNv;|In+}Ql
zW5)FlPY=m_^e?h!e3AxvI=NMwcPbqgxRrqA?_~Lq&hIXBkVhlCd(*jA+Eu9SNJgt4
zGz;jX1gxa*1%KsPiOmu5WnQ2Jt}TXpDe2y)R3EI}f7RvcMx>;lTgZ+3v{sU(FgN9t
zDGQArtNW71J-6xTLo<Qd8?Dv^IPfv^6JBjhRAHA_^?l*36crt&zP?iJ-pSdnjA_>1
zzuK6Oe#zn+MSENr%8km5za%aRoA)nRup_fG`y>8<pp=W4kLKtD{VH0F$KEiqutAmd
z`~v6eA~U+ZIjKTO$+n9!C}*b=8@$iNN|Rmy{W)W~@Oz?630B6)G6!Jv3@AzhdId_b
zL7Zc$kJk#)3=%eHz2>({s#Cs+7Qt`!b0g+n<}>s_B~?whpQVN``$1D%BEIQ;y;?HO
zw>Swr1c<qwN|t6<RL*hMc&4eBTPgH_N_)Mi+>Q2!uf^TwNc*yE!00NVi<o!Kt~yf3
zl1r-nE_z(wQW2k=QYH7uJn<Ho5xm6^gUarDZd+*5(RH9go`%2K#%S7CI%fvNc6)co
znl~;7M|iSy5oPp>(f`Y}$81D&9Rx|>0_P@3gZC=Mfp|@Vglt1J5s>FhfTmPh@gW?E
z&<*@MM5EIIh}OSdFBZLFUqzoBPg`V(94dP{H`9J=nAV&<(V(y{gSW-?zuf^uHbYnA
zxA=`e_Mx)=z`Bd64}UGU?RBaSvt>7VArVhes8V1Z#=fy3tUpA4d$%RK)X;S&o{0Ts
z+*JzJ8~MNJ_svV>WsdI^8R@Cs)jK6oX}lEck^$IVq;xXhv1A&TM+vTe8CShoy3iU;
z!zujL)n4sk@FnM&ew^C?0EMu4a(H-#?twiih%0VoI>|nkmmtn$I@3aTxH0^$vu@yS
z`L{d2b7Z5VHBAF+r4X7$5*~dF;V`7m*1YlGf0Kv1q=b|3vlbvl1y9}14GOl}%Puf#
z7vLj#EiQz7u%_jsA&jQBpBl9z7~M*L#|&I=ITqTMtM+m7Buh=1(e+fhm*GYbD2Ke(
z($<_%n=4Wl<?k@hoV@rf09+p+dI9?su~CX(lU#Qh#A`@H2(kIp*hMW;1Q{>#oW&FS
zzUw%p4r`*QHy|mx?y14dCeQaqO*ud$=y6Y27e!fr-Cb2+0hbY5mYy;xyEUGzzDPcy
zDMs124$7UL_vP+z_*MZ#mA&TKH1)F6diqG_KKz4rJdKF|m@F~CFzA!29PNvv+hj7O
zZ27gSyfa{_vLLy5sY+#ZjbWm9#H{jl=EWDFhe`O>(_4vPw!3?Sc?HqLa=EVxG-yVb
z^=;0*+o>DAlYGjqdnKRiY?R0TjElZ$^=c9P3awtSb|FS372jiDoUVOhd8xo|$iXj4
zk{sTUI<#Fce>$Cq4SH*(CBv?9JK|D8yNL22UgjqU=BSYdR3g)CbdUifcRBo!f<Op#
z>sFS<wn4xFgFH2-|IHZPHsob6ed)VHpio{{GJLwip7zIyp3HK2r;^=hV3lRn1=<)u
z=e`O|=`bN1O)eJYZ-mC(&(fYj^c?c%R7Uav18eLKXp@;k!{yoR#)}FDHw#R3W5JD*
zY=v(jEO7s1z_oFntKC9g#W^Z{cS|~^q8R;uVH$iDi^2&Fk#eJccUUg4B3i2Z$oImq
zPg<HAK}WTj9^5k!m_UPVW2@=!U)lk)z%Ub7fSa3dzm;dAfdQrp*@>y@&U2=vv-?aL
zVPqGoNp4=MeGF#i5`DcVjF6vtB-j5Z>Z-jMwYtj1XpV;eD{9?*7khEi(mmd;DO?Sc
z&5P!kSNi20L@8ppywz-pI_N>tu5*9pwcKs)5M)f4wCj62SPaa?0gb0~p+_PYz!Sn$
zrp#N*KUE-`g6S`K2_zL)^XZ)kpLN02C=tcOLdJZAZp&}fgwt?s+Svn|5>r4ijR4YO
zw{iXpEYu`G@2;_6CduTz(X`d1ao$jRf#4h5ur>91M70MY$hB_-mnU|`_P4c>d{~>1
znTo8c3XFcM3h@;|h)8p|0J3SqrzlaAh-|%+$n(&nIg$n&Z0K;bm3-G&$uwgLZ!J6H
zUUFDigqrKxX(Umm#IWTT_%S^M=c28figWkSz_V^0t;DQ6d&}E#cXN#gCJw}tCxN?U
zPa1%^^rKY-OmZ*x-M!uR=mkNH_18u=*;6BHI~ldCCki_lyU*E09bWC>u_vsh&e?+u
z+{;q)Y!&7aa_No8JTl~r<s$QVj50u5WaP0Wu0Nbvrf%0$_NxA^kRFStuAn!m<k1%j
zxB5v<Awvj#5=nJ<<_v+afQo<GF1e&kkKr-@c?^e+%S=E2h@~4OV!|Fj--gyXHaorb
z=8I3n0AOG-$2I=o8|4f+F+#!1&k4JqPGRmim&rDrEkod-X<KMXwWV*F?>8}C653OF
z6ucZ9uD(8DGt8x%HJr0@<oU?<P5@XBK{E*h?$k(5Y~W4V#dvu3wX-_1qa=c#5F_Pf
zJc!rgIJx`{zJyIe=c;6Z6jteIIX9nP)LGV=Jz^DK&HI=pKemm7n)qqutbOl`#6i3b
zT?Ry;42mIoX;R*z+=N}ye1i&p3>d3`b&rMG)X0gq+w}`qg%c}>zog6&8nrZpdX8*S
zP94Me?Bj`oO;f>aTHP*R77tjILgMQefsS&G>KtT7c2~&(^DP;?+!>!S=EvRSij5O0
z5%>Qvt(df3Z)rUsfJ7HDA6gC%W;F(a!aSXh07(Ka_$^wECcQ)%2i~J2D1Bb;VyW3&
zVxqRVu_*DA<x*S@;!*E!|26X9y}PJ`;v>^JFH;PR<8ik4(BdV4t8fHKFqgRj^ylT)
z^>Ha*7viRRUlGa=)|{W=-FFGxO`b19wcd01wZ-n@;+3j*d#XY=`i*9>LgQbeLaJOz
z$ypwWvHSD)pcQ@jEA%CZ>)Ek6*C16U6<vIWl=c)1<Bjnx+mD|QAc!yEBLjlsSBMI~
zn{L2DOnyJQNAK<+!@=;?!^7pAu9Xl-$}T+F&k{T7dcoZCpnkEufqrlwosOpCmBQ9D
zg^pd)7Uk0|(*wvud>lR5V1Bdv%L|50ByqUpxp!d*^HAoo{3vzVrXfJzDV*|YC{JDX
ziD!4gy?s@W4>luKnjEv+65ixHkUdnAY|}c|S$lUoSJ{I8U6WeZ9rl)RFV-uoX{xUB
zoLu178Z6BVcIM1cFLz5sT~I=(mU|`Ezne}+ect{YLyo+P{RHc^rsjJGVB2nlg4!a*
zZAoUd)z>B6zTEdjMo}Z2Z*WT@B#^y*^0`oEa;@+zY>4>AZhie{uEkxCHIs~X{2E3!
zkRxj&vWA%{cnRndc0_&Q2yESlY$21R&l(6cL`QJRL}o4!L|#Jf<4kq~Z09S?R<xBH
zrMu4hb4s2twrZ~32kLsj9+Ig1gr^_qB6LS9$xUfW2Y*|&j7tMyVdPx^;sNHu5<@^2
zaTyuuX+nul+pP{6-_m)*=G?+2Tjy-@o)MbVNrl;pgHQv&{G`vPGWz47G5lHgG3#q)
zqRiKqv6LPu)Kmrd5FKK+@{oQ|-Z1OIE>esgogHk38atbA4pUB#jth(7nq+P{=0#KX
zqO<Of*=Xu1rHu?j*-BW$5!s5PpKQ*bLh|NkJ3G0rJ;Ix{m7KGzxU{_SD<qI)<xeJx
z`MMC+j0{>Whl^UnT`obIt%YE5NuAO3k`p=+`i}ux`pU=?xIskU!$`FgnESd)!@c`f
z>#YE?%)Q`%UC_<Pz)9h<g!#xLm4hQ$EtwN;w6$t)Toz>k&xb1_lj22wObML<sA4yK
zT&I~Eh5coWI8?o=lJoXwSXSSvx)bP#zkM?A>cWv=dTjo*kX3NcW9g}lnbWIR&5Qwp
zhs?{7RREDHQbnxur)D&7P5G0(cBJwnj5j?HnjoPgA>QN`vJXwpCP?{Co=s2sLRFj$
zwS_D!Kd!5ju6v{yANZxFGV=L`E|S!eha^`~AqOlt@aR&3vj{vYp4n*=#4dBYtOc~?
zhM?H%-K9Wq41)DZN31}=0770&@eB`_DMa57nDR1on_}TdUtl`Cg&DlJFpZ!_$_n-H
z(|Lj0!=u=!Uy1YrLo8XY3w?z0N{b9}`r=9j&zKo$U_P*q_l-?{8OClf=LF9P8Ta(1
zhR}gNNKiHvC5R~<)zDG+VH!!GNNZ>G@DqBB<U5{04B{g^o1)V>1zcB5&X+lm5(xhq
z9Z@)gncK@zwLH8ARP?f}Z{bAv6hP&^irXJ8BwSTU6p}D)hO_Q0R;{MYve0U-oMK5^
zBvsMSIRM%wv-Y{is{Q&s%}`SWExZ6|t=uYcPn%pdx3t%s=WL|YT@1IxQumz&Zd!Ib
z7XpUk*Y4OCgdTRU!UTtof@9@l42wN*P!J??B|&I7p9_$ns7Mqw6_dk&>499VCuwH-
zYs-t#q85%x^p&gGBe*7HP7q;W6@-C}2LTwn*SMDCvAO-GGdnHd#2+3G#mbu_piArb
zV_-JQ-U!KT-&W70R-m;4&Kl8*VSWv=d-`2wsTwh|&2HpghlAUO$3wR2hfNk)o<YVk
z$eq0`zYtoB;Mcsmz@42@RH3$_5r9)PvLF+3ri^wS?0L@!x@qJd6C(UIe(B{lMLink
z;Da^M65Fa<v`T#1@s^M;a{RX~3NYm1Nge=>hE<M6`aMa!qIG6BRfnMqoh_sjb0~)F
za+|g_)}p|B5717l34EW#F3ThZSY+`Fy_r}vg@@IaXua6Saqze83^{i;KucO%)n;8o
zB2H+RBBDmn*Q$4*N%6}TJx44wpIdS-MRKm&8LT+w`!nRYI&V_<87NTS;Tu=*loW(Q
ztvTOk&#{^L+_H>AZ!+NHDQhV-EuD&}(=yVOYfr?;7B$zqUYut1rd2zP1)q{gd>r%T
zYq|hhOx<VeQ8iH3??Paalo7||bcwM}_HQE($_jPQJe|PcB&Jd=pB_`Voi{@n1HwX?
zvbE6XZ=gQ{v>g?vcps9y&<OefiL~o_4<xbmZbHO*$W(Ayq?yQUb^HTuWErVNC}uEW
z?R^G$>zm!<j;x5}oP#yo)(io^;(Zz_MyF*TGZrS&LXK#%aE~BX1U)`L)$ou7F}N`#
zu_1ib!qPskKzMX#j&sVHLeE(pw9}N}XX>SvCOVyq36;1dIZzZRdn;(x*{rXD+MXG+
z-N7W$SE>|a*E`<GYs}AOto!?r0vDq8>%CRHY-tf$s~ptV4;`cP!(E89S@P`{Ac^du
zs$+ne^9nkhvD~@GXYh?4OHDhaw!Ud3umuuait?7+$&*dCAZGP*T<xsv4%r|2VfpI?
z318;<xof$b0V_vjeJ9bb@2@)t<63fF%@cUnrJhX^m;<x3`*W(>IBG;LyS{`nnwP%s
zl1+(JN{S{JW8HSW`h~3<RH{Agvc5^n0!>YSZOwp%e!Gb@XOcuHZhOCV&&=wehR>&;
zf~^fJlnE{8mtTv`q+L}ZIo-(MIlaio@74rVWKVBZxS7ji(mek_kw}U5&?;bGJjscG
zsGvdRe>wq8A?`lC1)!NLLnpg<b#E~p;yg3Jd4f!FeT{dJ_w*wvpiO<Q51EAQ@wsZH
zm5_Dg@)Rf&T_~{Wx~y*p%QxIsU+N{KCL$VAL&0B%xfI)UolY3t0VQIU<Q1)MQR^0O
zgY4WP1eGYfX7gS|3J;o^ni+a!FRz0`oLv2;pEr0ySUf?yXz4=7f8y+7sH4uX8`xbs
z_T;)}Z`rhCTLX^E(;JG&Zgii8JpO@do;}Yw?lH)NRTqgJnnI8s(Nn_a<8HlcZc+t6
zMka5l>MIT4KqKoj1}IZw(r=B(DoJ4={E7tRo3{O?24?J=T)uJ}DQ+p2mq|d;Hlq{!
zSJ%;uOrO}WgK<({V*TTJhWZM)C{^=k?~pfMmk*kiOiSv-hfp6@<Ii2Oy;Bwo^-^or
zqM;{xye`$BKx=)1qbMS>b<b5*S=CZ6d(o*u?g@CSMNKyP%|20t3V-yQNz)WdF9*>H
zQ6!g#ToL5r;@w3d(_>Wy<5npfqjAD&o7GgO8c!$DTlX-{AT}02)Z`;Cfje)S0vQtV
z(MI~yt?2at8z2c+?{8S+<0q^8j1N~1!rqzhM%<|iKq5Kk%Y{Kw?K8Mf;&`Xq-sclF
zZ))@GP(|JarnyLw9cYh2(68y`9zXv1V8&G3&j4B`s#pOvbjg22Gt>tsfsTK|&v1)L
z2#;P=@p{lZ``{0NgHRq7P9_M^m(VgEH96)_M=?q0gES@J`C9IL>~KP1vR0(D5eExo
z`X;GerRR)YcIF68nC#!!+%Rrv>=0Z~E1}22xb?42+mZ*{%iQMs6H!bamqdKSU+9@Y
z5&Z2kbtp24d^FrPtgs&H12iB>paZx$$n%5k;|TeO%AZWEnc20hOj12o>T4l+2uXgn
zUY>Mh?N?Lr^izC@e*O+>Kw5Wo=V`Oz7Mh)=zZRNUzpKu@aS$TCVx`hO;B5#CsOp7Q
zXt0P`@~5og$Ad9hIR&v=DJ@pjmmzI&FlR6@dPo1{&b#}Iyf<n<ZY?C2k)I2n^vN>Y
z*tkCWfEV|etey(V;?2GC9k(tf6pDVF@gbx-bet=Ff$m$Wf|a|QEZ6bR)zJ-A%ouBT
z-O`o2UQ+#JW?uGwsdR#mY<juuv36C%+VUtN1L=bNm<=r%slI7#hu~e66(Dvt!fH6Q
zpQ;!rFZ`3F)6vaxAt^7=RzWllfig~|$MeTCK#_ok2?Y!W14V@6e)~Dw<dNz=?=oIp
z7L{Eb5xe9|*k;=uD8rw^$V?aG!>6GXt{qB-`pL#+-s<}Dw03QaQt*L&VbMp{Rw3^U
z7|L92*s>pW|MTzKQ_Utxa<wmTwkq=xwn%Lv5rq*jxKBoDLt$O;4d&%J0oQKkZ<PU-
zu1iQE49F{OSzov6)tWv>*&Y30Lq{lFV`)MG0u1?jMEJf*c17kuxM-aFD(7N^tBH#x
zP8B$fs3rQ;H4M+hS6A>4{SBRvdn0NUL;yq2I5P0W+sJEe^QCu{nOkqZ<`6$$M4(jZ
z?Vf|P$G%v$81LF}$$PM*S*m*zTZxAXP7CNw(f`L&q*eeo0AM4+?sbdFDa?}sX+%+1
zteS>Go`cI?%P`T<(v93t2G5vKdFu7NfCbbKJ(+;w+T9zhd`OjvWT4|B$+5iE4N}lR
zu3U2<!57)D*7adowB4F0?b3UexDl}oP~mobEu=sEysKLxi_epz<j?q=;@83M?v)to
zF<!JdX13vZX`BGLBUapnzY4$T=u*pn<ZUh)EM9+v_}0(yVzq?uBBI5Y@{<-fyYEFp
znsNokX>DY#K~47zrfaW!iQ%oOT~dZG0RFR!NaH~8NAhU;Ab#y*k>;9Xk-ErU;VL=Q
zfBW!)D^gmBlrBNeu{WnxI~AERZa83J7g@TZTV4^F63DspLkK>)oOf-w=hWbXpvc+%
zrYIQck0`<rPaf`EB%^7pOgyKffodb~H-$yU?qLNK$9)^So@!Y6#0N;qT1N2+E~=2V
zV8E^~JrHQ<b);Sj0?aP5r<h&T=^bu+3WI5b8(S|dXRN~dmB63{K?REl&**N1tdV(5
zJj3IyC>51`a)ahwl?h`xwOYou11>M1)TIfY5&5+CV%m8k3-%!(gFWRG5C;7!(GAyz
z%zGCFHXdx5g9f7{b832lU?0RckeUYVN(WxRBDgrO2Gz|GJr*wC>d&CI_<h_=rv6uF
zM2$y^-auL40X5u@5``#St}-A$tZAkiL&(3<YK#uWl0JL{Mwkp*;B9;cunOGJd#-_>
zO9CcG=OY<3d%^4iTVWW;FRXgc0Q!Y5yaWmUBa{NGfhKqg%5W#EYLzRFtXZFdVpx!z
zUPBQtn`6#BaB0g&AAZAxKbFWpY6D@3uzvH?ncsxN4qV~maif&*N4UqAnBH^L6<fg)
zaq!|(l<#>XggNXzB0K1Wm?AN4pGRqq3QWT1HI|@?bZGVJ>~V2_)GwUQ5>WO5_I=8J
zV7e$i8?1g~t?oY2tO&9C_e@%^?)Rmue;nn{hGrm7*k9+)cBroj$sL_DzLD$v@rxmm
zvb)GNwh-rL+ti$~R`j0nH^jagKAY@mDOY&6Q2c<4rDpl4M$6cdSsRa#T`o^f)3PbK
z<EL+W$w0Y?K_*;S4<)Zxx?**4jD**^v%xYGF6Hh&<LN>Y<`vBDcKR};3tU*Q%D8QF
z69ngf*8GC=+xa8kAJO10l5}7;PxB4LX0B3$qK)p`t0Rt3H-u=7nGHP<I<U7YhgU{Y
zIwnIvhV(Pig^*OSTx7@ORg`ocNQC*&=A0F~^IH1+w_vd2dBholidU6I9oZ5ZFGJA)
z6i{&a41<L%F)C=osfY7xUZj~L%OX$TwU|^S$sW-u1Z1?IZA*F<j|P&@=yA6M8Sv{+
zb?JX^01lTZkh|Uq%+8VcA@c<xs}X@fR}cP1z~zkUAIRis|7MCLPT5d-v}Z@RQ+Iw(
z{Cj!JcTm6Dw)S}hI7R_RvVi|^JQFYys2=#}jG}%Yu(RnC{ecEZ4ybq4uMDkvztnuc
zCr<)O9aL8^rl&Yt|AriKUuIkn|1GG-=!a?y&Od%a1-kP?P$g*E*6%W9X_1~aLLV|B
zihsqpe{Qf)8F7oQtcXg2RCYa@f5+f$*%Eie)c`>aH}n$)86P7+;S+c`jzbF1zDVJ7
zPAE&e%pY)!9gWKvQ9JYmvSW>J2W2~ODcq1bL?mF3uSZltBTcQ$7Me1-QRD<gm;T)j
zP@SmX010@mVT`f;FN{a8#&NhtLn4sLD^g-1`OU-DiA1kYpl$eCfLh`az_VRQe<AQJ
zyW>Z&@RpcLQ$iseET{2NEp!I~Y#6v|diUg+=CBCuk7cWUw}s`7%v$?EOHpJ;Ls2nt
z?Pe1=5kcE>q}pDb3)jB3pG_J&h@TU%2>FaMijLLi>s^U-+BP2#NM`a|P=snw(@hR2
zj1GYk)^MoGu^>3Wo&|0w(n%JTL#!R{Hu&C0e$Cu<?{z?v;F@Y))V?aqkEvf4%`3oO
zeB1nreOc^m`MzO<>Mk^vWfvj^>Mf>+w<<WLJZ0wrJ62cSsr*+(HJxu6%+yHsby&%c
zBcE?0dpe+;K4LZAChVkgFfK7P?^xe(>DLWp!wBM28e4`>LE(J(px^)k_YN=}oRN&N
zD|N^}5AZ7j>O>~HiRDc-*UrI7fhq{M1~w{)=&B%lL%4@cGwea@*b5pjksTp$qe!|i
z?<|jQ(Lygbh`*`bkvBf=%-NFT<9%r##P)J-PCYcXQWaWRo&=>(**Q`wpM;0>Gt#67
zftrwg3J28!QTQidJ4Ax#&J!6>I+W)|qetXMD0e@OBu673`F(`)t0pLSLGp*@Q1VP1
z&3|y^3T_fmL!RY=4{R2Agj@{S0Yi$bblm*3ks8A?pB-2`6JgzB-vk9v$j*koS1<X2
zfg{JpBHdb(-j6=(FM@JbT$+}p1v$tl?=Ep?A1qS&p)h{vjTx5FV^_D8+p{wL2=E`s
znW5;JbVO-}8h&v~Q~)USU`>WlCWVY1Y(YRgJ+3wiob3bzl_toaA%oMM*&3nf7ktL@
z6ILx-*J$8>F)+H<-A@s9-ZzTtpvbtq@5;^S7c3;wceoCJ>LA76sV?B!={k366Q&!`
zyJmQG3UA*Y#Q!|V5e`=d^7pzMk(#fw9%bVEIIj9=T;6}>oTu#l9QP|~<5Z5H*Q<g3
zk#uy0`=K)5xBvYapX1v6Z=VNn9wog=N_oHjhi2iOsH05J$Ep24FK)_={OB#ezuW>`
z>Acb3ANcdabk}wNzSF;6>|{m&sTDi&p?`h3?D%#`OUQm9Xe=H^s16nX*MHN|ef~={
z|M8;DU-|d{zJQFtf5+qBr^^5TWIVzj-HQ8J3-E2B|G)QKIq!&RD_YD@hr#^A#NgYa
zv#3lK5xq}#n7pU+5?J!#4JLyf)SoArBR}XeKx%kb&Dr#f<ly-_%M|)Gjgy(8M`&4x
zFl3n%@-c>XKOG7Du<tEJFPnjdb+^Uy5wyPCG1L}EYBPAYi=P>dH<%3NHhh<Tj<Vos
z#pRkYLjQVSgInH#1qZuU5{;<vBAK-gKF<4f5qO2qi~CJBn2a}`WL1$(QgFXcyK$;e
zId%49lw;_}X!LuKd;I?89)&{h8#v(1HZUn(H$$b;yn>&W%e}L#zq4!auE+EO$Niy^
zzJ$B>`~zGpIoWaMa!5?6v+^~gAIizMi@a`;aheG-th#Z^Z2_ZNT6^#THs*xDaanM0
z3h!!lho2hzb)3|-8xAHj{N-`sjkynq-P;|?WG`60gAYTz+xoTCQT`O%i@mygQJf+>
zNLT8JX@`C^HTm%^q53W4)Ju)lKe~Bujjei(IWm|$djX#Yef4YHDmeG!O<Wfn7rP1v
z>K$kA{1H>_sB36<ayZ`YUu_nYl*FPsY(JLb+$KBgx0QNKzmYWh@bUt70b+G<?sk~4
z#ieUs<Rgd0>SmTzR3mW`eFSHZF$#<Fzb|v>WfQv{erY++k>rLsd2Xxa2{Ubc>%1)l
z0@GjOC{12F1yTlHu)4*?P-fREm6xbCC;$C8&+bdi%Z6zk**nov`I|!-BObct?>+o0
z>>#iC97{>p<YVKILQgjGGMBC#|G5|Y`*%58kJg9b=t>p%5r;B9slA6^BcHm?Xo_kW
zT~>KqJ1!GDHr^0CPAR?oA2;2>m%)Kcd%nYQt(`sXfqUKP@_JAPB>%jjM~&?2Lt%w4
zTXyT|*!PpH|JjGe^VnAo3E_+fD7V7`OqdhDJpA4FaY`Jiw#IAYf?vmrJt+oFO)UTM
zri2t3Je^Ld8ea^w{$|8m?4kshZr2dqnX}mW_1cs?OHKMA7^CGq#bFUr|MR`l3l3k~
zMN-0aOX@d<7Q=ByEDuf#jNFG-V{x8#tuIdqEVx+33I&JB7;0)xnf_-tow(VGhGw-U
zHqH45Pdg@;*iFz-4M!WNp07BI+_)PZp;13)pM#_v`~a?2^FKT6e3@zS8r-^_rU<hP
zKQ!jZS~U)Z^z`tnpB|g%h>_(>``<s4GyJBCe(7_1f%9-ouI%bIh8(`+_cIZBdoZ%*
z|Klc?y)A3_(q6!S-jo~~bJT^T-#S=>hTIUH&i%()91$YEm;OD48g6)#hdCFo@W;Td
z9NT9)nl`Nf6qRKR3LXpIbJufE!p`!4eYI)Dl1e-rR7=BjO6o?PpLf)A@1jS4dnbF1
zBWzfv$NK%x_Y9LT$M><p|HDD?z6;+b+m0^dfAkzmfOjK3>ySMiC*A3Awg1@xDFl)i
zvQXr*BtOj5xfAYrCo~H9_g5KsyibrUKKh?`abN}<+V99-oZtU*7?NOsYuKQ623G#R
zp7ub95ZsE>e?REILkH{Pzl-6Uas1bgkYV_La52cS$I7`~%QC4xurPEy@20+fB%AzJ
zpu22bYG%jp`=qv-4|qWL@y>45e|Wx?9;9kr3cS_$46@CMH=O1pr)Z4IRMb<85MnCl
zC>{_LwQNRY6vhXm?=M;O*~xiE+u6^RFj>!@P*{cI8dM3G{wt80L$Uxvo+}YeO-=3#
zhi`n8H_rP+^09>!ge#Gn&`*$c{$hO}wk#J9N9Ir6L@SSf_Wk40wko$EvgySNx2Hcl
z%)obQ6XdtQxm;NzIA?X?@aE26-?N-uu6#i#ah`FkIUigNMfbcogT7$`yL9(RqEA`0
zm{-=a_rh=`&v5yrq|Ay6L(mAf4QFSXSQ!vksZ^%e@a#upeoTou4Y|!|e*q{h+kzLz
zE7krv7`i_P1EMCBi^Ab}5zPF$ewCct^$N4IhCF#&NnvTCW0eL<{nuh7(<mIH&eFEo
zUzf%k`dxfnMobTpWW}M4%|9-gi|h{k9wMMn>)F=SMg;v-i@~oCsuL2ph{uDW1X9<8
z@ERLWkL?YAnXm6r)fy|qxiG}luA{BZ4O-rg3KQ}QF<ZcGeNm!`EIpXK$FE9;%d`&)
zmFkJEJtHU6pfAinKwW|!5~`3-HKnsw8}7~_^%au$PKKI7P3(+kq6Qjv!i3=_BY3qe
zRiKvu$dF}Ny;AAna-~B>AW^Bpx$mbS@k@=7(t~1`bb)-g1^G#GYj<Y+W5a3U!)=fw
z+@%V-T91r#7{!D=^_}u{r~msSL)uXFWy%w_BCD^CGCOl-ufvcAk%WG|bhCtH19f~l
z-TFuV-IMbU`;Ybb2>Kmw*Ap(VN)(`7%n)~k#n%^F91gvWo~gOQ3EiIm3e-2SKbH(_
zWNW1BPHIGk=ed6;9Ip;b7<AB=8VW<F;%$1*n4nR5u$5HB!Xi0yb*R$djB*gi%NX_2
zJge1PaI_ExY9X)1TuYfjG1mU-S35fHSc)o!;|+KS&3yt=Qqhx5;TiNeI8^}e#6IH+
z?UomoV5)eF^^GijsN8+!Zt++n(o-z$l)>6uAO8{IDTA`=tXWx1S$cZ<#B7)Ka-U^9
zE=r7GzA%h}BOkkbr=_Cg+!xQog5ot;E^2Dhwm#*i7RM&LUI?c=M-BH7T^TBNKDqr1
zmXxub!9sEEG7N(@haBJT(ztsHemZafOck39HFLpX+IHx)U$xY4t_qb>u`Rw0M%vnw
z<;2ZZ);!o&m3P7`5%O;-3v)NGrSOl)a|A0Z#l=)MkuBp<Yo*H+OU1PhzT}N~BHy}o
z-Hfxo=Ny<e=yv+ZkboAi<LD@kgPmGU#BE;jjCREausZm>NJQu+*Mr;C$g}8~7oOPK
z*c;K(0{hRuIsET`)Jy*jg`oZisnUaWwqsBydS}kQ+81dZcdc4`C%ceBZj;=m_Uj!$
z8opgDIJW$;p$QmG0J{Wov>daeoYvcxT_qZ@+n$RHd7g9kULAWdkTaSXX1g^SY$PB@
z<<&~zCp8b0H5X@&479|^9dR_ebm<b(4&Q?Ikh3AClvDrM=F@Jc8T{0stjB8M{u4bI
z$Y6g6Vim5huaD?Hl9is$*H>g)ju`6gViFv}HL)n6d@+m19qq@+$ql0>zy2U0FKask
z(~iO7({YOY#J+spvehr_YYwED0h1sOnXJm{jv37ed`vVCxGp~Y_TPRZkauQ2^a~jN
z(t$5l7+vG;&4NwwYZjje6vL<a4dJAW7Y9z__m)$^6&#m}b`+GuxXllSha^&eb44Lp
zsIat-WbhXgp8r=<$Jx+X_b%S(|HHRm#Mgyn_hySkV2SV(L54d+H~X<+e8)^E{dNX@
zV-w9~TI+DEoa&7!;y6`d-#F{&AEQs7F#PuBw}g{HK>?q>1SAFt3pXu}jbuGy-Lr=;
zYgb~4{h9glT@U9(=Ey?Fj~{<{Tt?7&d*4tz{*UUcH13Q%PqQ|{vy$2z(XWkI?Bm(=
z@_1RXx9ZVx;G0vPL>v+rMlC$*bcj2)?5tWk_UA#3XL4R^cjF#8NxKO3*^%Pp4jfo|
z=f??Y=_>C_vyxw@nuA|zNEOZw_*_eAVa6HSdI+85+Rq^yrhkW*!~T7pYUFfwOr}Ax
zw!mt##mJ*anwBDED|yw-Shr~-6fQ1$YnzTie63Yy7khxb+u#s(fKvBT@ygxEjLb|y
zefxE&HOASf@4${Nn*_)8TvDp5Q+*lja&??%i&RxjF>#9!5S|W{z*}|uc&=1r-RZMm
zXFVAuHq64_5)_`%9<RGc@0;vU6Y|!VJCuEgK!_53h9>;lnASUEYTKKWJ9brl(s6j>
z$OkHgto9)zLq<<CEKPj;gZdek>=IvXUPYRm02p}E#B@BGda2$i$8N}tdtjw({>k97
z)m}XllvvfJV)BI6wZK(Y@d9$GtoQnZ=M4shRxb5UukPZjqDn?cMz;#8-_SU8M2wem
zb@|G~m~;9!*>n=c$ZWqajy}w7-=i09N6Nik<LUl6QLv0?L|egh;=FveRA=@%cTE&@
z$kcUb4qW-5^<)2H&^dUHxih9uPr)1E7u(()*aFS^#*`T7F!t3ZfK%b@+pCe^{%$oh
z{s%o%cmPJn*NRVZ(3Q;ImQC}`!&J#^glU;gx5Vxk*Vd}Bk}kU4D$kjri#Eusm|3=-
ztXOa7=N|B0?OKP2+@l8_<@pT)O5s5g7Ah&@E#;dLv5d17UxfossrIiLz8wlWcukgf
zb4cO%<sdd@IIP*f81EtMBA)ZLr8+0QL92>>JExGB4Q&pkB`Y?8cNieLg;kn7$BA}@
zMMXVRhBai5ancJ^=0GLPEv;5j-@2RDD7NM6F60GcZX`BLe7M4Is_nV|oZOQp=A0`1
zQa;bMS#~&C<r+#L&W-xGbQ1n9<Q}7|RTCvUNyuw(cPX|`pi#DuPZ?0drL~53^TZv3
z6O+yy6(+8V(>zueUn`G~UI>m5++;q|&vod#vhI6QgI?{F%pN_ir`x)hZq=k`XAAey
zkcA|u5HW12U^jG2b5=63wr>Z)JKs^;YWG;Uu8DAI(x8Tdt%l&{U`MgZJI~2IdOY!t
zR^H1qmbo5Zr~Lg@LQm<+tMW%AHDf!H2=P=+5mzH4BRdbV9oV=^&lC>Jet|2H{=F)Q
z57@fnTpov;?^zMhhr@D9xf=jRjF!yK&T|vQV+mGlvhHVA#jnMjD^0prWPyw5RGY0_
z9OK_X2<JC7a(3u>1&=;x<K*JPFhFFxt6yZ}F)Lqg(jn?f?AOkjZ;6!|{}64@uTP4(
z7VCuJ!rrVYTbdfUGrYB<bYNfw@4vhQ>)r8IU6{pbuGhiB-av<*Q1i$3wEUUaw$Zuu
zwE?jm1P*EEGjZtA<j#TBS|%DQrgF1?F?6yrtNeuPT<?wFjTIFY_i@T|xm3K>e;0KI
zvKGjfa@4j671u*KO26&Eju-kCnl%K4QkXm^a`On)w0Fwf1pB@`?qXTn4~eh@O<XIQ
zqa{)fi!VPv1w#ovVuWPo3AK0ueKdHIGy=86#rp2d=?vdOIDn(mjE(xiKd<4Hj?YYY
zr811&SZK$kBW{8+!)}BgOn{i<L~0)4NVJ@nUE`X4kbC*urW!_wU%$FFmUIaFQl~~b
zMQb`Q|7Kx>)F(K&&o`9VI_qxNrxtQr^*4;k5-Bfu!Epzc)vh8r>0`vgy+b*d(Nd>Z
z^)LeZw_HCJOuP9kWvvg!xO)0Yx-VYuTgoD~Wtdl}NBf-7Q>Oneu1mJVbLS<3=Q(4_
zp1lJ*RPKhEtHyC-B8<?jag|GrDe=rn_ur;&Zf=IQH|VpsHp@Pd81~K>lTzWox6jAw
zUj5mQJvZtt;!ZDAkbN4<>hmvJFz2+}DJ~HBP1b(r8k@E2Ib`Fs%$sr<#=bljSAZ*E
zZfy#)@BDIh2g!x{NlCw*gI|HR<<z&z%F3!1Bv}38aENhDl(?<utUJ+VKfh||DVOf-
zvA*_a&C%7b&7<Eg8<%eD23N=*<Z*6~UVXMIPmH@}fIA`fSwo~N+0)2P(Qad|&uK4*
zA~YRLl{D@bK#s`a`@cT2zlvbMN;&$x&A^&g{s-0a!2#btn2PU}gFB2ch|{S_pJGc6
zkA5b6DWd3`(|+>g$wQaCJ$m;soH634%Ts5w*6&(WkcSyc5u37TRW*pg4fkLUn`f0Q
zqsOAdGejEXe|siOkC^<Ph!p0Wre=XI<LR7GIASKu#%sm`jT_9$%{@Cz8%ccF@IFe+
z`XpE7>zntd@=hx!`iAQq%5a`(J^eDp+vveShR1xE=-oM8?uP4z{hI%avu$vqC&X1z
zG@l<-pA6xNWBU!xWQIz1*PCpXvz_<32jaVy2ERBp3^6+)9?qtRG)ygZ=-8tNz9Y(`
zT%I!bHI#U_CCVtLB~H#ut=q$K@kMAZJgkvWX@R+i(_S0pF~cA>sq{G%3W90d0+s$O
ztl{3A+h*s)#f#S0aebAR8gPW!N%@VH{G+h=-S74~o&6HhFpk_6?za98>=n^lg*{SO
z^X0H?wIX5<`n>fueJlEmsBx+G9oVR-sLqC)25O<Fbh4@9RcxZ-NU(QbO4hxzsHK>Q
zc+8@K1r?MK-%sO>{)h3F`WCt^RE6eUE{y@Fdv-nTP44{;Chl?Xm8BHzz#HnzIIjCU
zu#Wj0ljM!*c(o$_IC|d97X_ZH#oT7FY@fB_Awu=Xl)qN;ipBZ+bI4_9Se18NTlkf<
zLOcSdZr5ci^<d<@tms^+WX5=Dv-}!%TlbFY1;?8$x25g}zjPZ$RclWRXTte}ua!lM
zW#EAz<c0~9gCD!)ny4k9S8}Gzq$B?lDSq4c)(Z~`cuk+0D}!6VQ6n9<SMR_91xkS&
zVyODbPpBlOfU>f(!K2v~o1W3k#>>wo1O-hmDGfSW$A@a(pib_1-g>+AqJ|EAhPysS
zO~`iM==$r*77L}icaQwWavK;VtOGK#=8e0sX7zVl;|yF%v!l%HuhD17wcd7Glk#Zl
zX_mL&2*PaZZcoNtiI7|Va!|0m%_H;_uLp;O#7|t(_BSpexC_I_!%Tm8`1tu4gl%o3
zsK)rw)0s)muo@id!)YCJh*Pi|>^_v!E~Hp&-q`N1B3x7fZn)DSXl0)s(M9NMCKQT1
zkt2J@bfh_HlUBj01orp$r`y-U(jNzyk|{ZLKgG=-BJ=M;WI}kFs8iuvUzbxYw{r{h
zi!WEKUhA3`XkOB+>4#O<m^a*m@62P3O=;)WjE=Lmbdi-PGjzOfI7Ebnl>fhs@}}6K
zoMkb1gfbU=eM7wWVYeZaef`C5Y@ZVs*BxY0MxelsGvy=T8DJ=Q>BYkDL$|b>BJ%)o
zG#eWEOkGMR+S41-FT)~nEV3o@eh7^I^$~}MfY3S$lSf*8@uu~r+}(ccB}->XnPIPm
zN9$Cw`VA8klRR|?kGBw3PonmpY~PC}4ZEQ;KFAvH(Ib-<g!Nr@8k`JV6KQBdHwv>U
zSuxoypKCgrkeZgp+jp8Mrv1}n_y6s&DgEF8j~zR9r+ZE+Eg!d!LV~9HdVqSPF&bRA
zbZegZyDz>`-cuw8VZ`76i_^3mGfsX3%o!r$8}p5V`yHae#PU_bIPR>O6N|!aO{D^S
zDYhG8lQPNLGlH#lQg^E|ok*D7A7SGKKKw%jC$9Q%XJ==aO-IzW?lwt3Jl0S<uT@Q$
zY@j_5#47P-Bsb@F?FWBJpFMg9LZrw0{@BhS66^vYd`B_r-TO;`%;%hh!vaWvp!tGU
zCq_>ETxDkw8~7XAL`k48RIIL*mm-d}t+!Xtl~SPp*sf~Q<iG(303D&*K1jt%D~Fz9
z4nCn8>OMV0+8bon99394nJH*0XjFzZC)?{}@kw=G$v+8}J?t}G`3(oW87mF&|I(M?
z*66AlT7WAZEST|o7+(#al#3z<<(U!t3;7F`v;!f=V{8VdTfF$}M18jE#05<Yd&bXN
z4;1u`MG1N7w>-1giLm+Fj?2DW7b0vL2*9ZCZ2lfSi9vU@#^upk<(slCihldU2Q`MW
zXW$G8WQ{etM~hRgJ5&^~4F1G(iR%A)=ws_6uR|%iQKd8F1&MGh8t8`;ZeeC1+k8U~
zMb;MJs-#i<xCbUMZ*CdXJUdfaFoevH`KJP0q!=tqTYOcb`38a{g)7#t^qoB-Xsns%
zLq+v=Pm5%ZtW1n7=kJDv9}(u>^5ubR-|AP&O2=9#Dw)|gYHmPROEb&LmYzQW#SyH(
zbDwvKIayRXhP~XCc*Ust&6^X2{t|BU75?||+qwfH^RIl!I;W<mLvKA;vOBHy(b%?|
zRl3HgN^^?k6FF$IPMPPtzT}~6vw|^8@2~!8gh~H!b;f)35-(#89~LSrv9{^UOEw>R
z#K4q%_?EH9>gu5M{p17$u5+N~8dHH}9nG$)k}vFae*cuG9#Enaq3{wtKT-4U#{H=J
zj2P@T9VI2G^1Q-M?r4<{2Bh-PCFN>llxJxXX_)+asAUqNCK0jTO=)NChqu!0zZS}Q
zYP(di9y_KPY%%fi2KP76HjBN)6Vto7O~*@?BR|RLNzTlMzW44AM&+*IhI_vLc@WKO
z!w&eCtH0Q{5FuD*@qnxJDmMo@k%@P4aY+;PjfIy&^=p7z9;)>VR*}<H7Y(XhS<c|b
zl~HGebCK9&#!9`ssmBwOifn~zeBi<Qk6HjW6hQmF8#TYF9?A*o*`@<9T$SZb+AC2c
zem-JS2nso=TwfjUBi<rId*A6;3$R}JsHm+@=37Ibdi*#z{D$q@IiBT9$3>U5098I5
z&~q4gS7iCJDENBj;_SD+s~s8xT58$|WQqYOP_hw$t_O0evnCq{|C9t~2q3jUtuFS#
zm@tOH+o^8g>?ZE)(wJJdQt`Z;W>3aiF3SN2Tqa7hp=2&w_k&q5Q;^r@+H)a{;jJZ~
z`?e5UT5gLy*@r5dlP`B!IDne3NSTw8AFX>iHm*UH8Q1YToYVfnt_h5{0T!>Ej(5ID
zv5yWtKi8f96&8zzxy_VnrFfb7Amg5)7q>d4;f)Ec>~7P*ul$jF%GN-<rmXCjwsp&e
z=qCAvsDvMT3fXM`J$OoW;NJKnj__I387zba=o%PA>tlH_aNS>FvUZFkYlv$sui99@
z=+g~DZ$2G$<R-?F8U@RSj%-z_*$h{d4z*5BHAkxnHR#!TnxM7vTS)zd1d-=wH>4o?
zb7P*^JpV2YumSBr(B7?r)-9IFsGw^1*djiNl=WP_yLk>r9L(S~y_BS2nbC+0wTP%b
zjm#i!9Z<kh|Gzo{L-5;r)wdN5fim4?W^ZrORiB-mZEEqoDTILRSv_0r8qbAFCQXuz
z=}2wlfDSkVf4vHK)xJJddpmH_-fA?u4^=z~u5KN04#F|J<}}rGR0W$i8CjcJ1j6HC
zjj%$T(OrIJ2hZRYQ)|U0?=88x%6Wa2dQE<^voo@{zudRbm00$yp(_+DY}4tjW*p0!
zAq4-3fR5hYql!=DwYrW5%gIZEpRN2Q>8F+d1JGFAr?&=D#BHV?Enb;!JCNtgyriaT
z0YFaeiqM7>ab>^50*aK<(j9hpGa!<?K|cnW9lTHZ+qt8NOwcGUCMMQgg(@e_sSeTL
zs6CNlb}7f3jjo6c;7S42=L0Y=tmHr^V6fl7;`{-drw3IFwpdg#$!|%Pxh&jph)4$(
ziwV<>vW9c$9KfY&wSLnfge$kc5mv4%!UpcP!Nxnxm|OX}RyEM~yK@UxrLZ3=JidzJ
zOo|8ldAhOs(Pb#3p?9IH@$QZ)Q$Ek1+lSx%ooq+hEP*JU7W_C(D`m2~JjK2`l$;&P
z$SVHfwK7Nc`q6Tr#*rAhK>ziLj@GgCjPjHq2VemRDd6Iw<UK~n-qDQpT)i#H@0Bq3
ztp8rbw{F!~1r`aJPFml)=f6;mKZHQ}5R-tQ`yG~bvt4){qr-eUT3QD)bTWhB^Xor`
zBqH#|Y^L3U8^cO2yl-O@AZSoj2T<(}IN~vg@n-Xb9!s@MUCh1h1r4Qxxn|0rV#H(+
zMMUfE)xcymOyQSyFMZgldJqxK^z)|?Rj1#3%Zfd)VH_xz+3Kvl8SsdujcJp*FkUUQ
zjb-MBPN&zvUe@M^j=(%U1s$y(f_}gGAjH3VSZ)Y5K{&!ufENO{Do(jB3=hrahMsz=
zouShJq2x}z1pmOK!}lVd&w#mp(oqE5eB<YIbOnrm%Sjl@YSR~B4HrHHvG?31d(SPs
z;~ocJ%&_A}5s$A~%-@utV1=OYx_M2%nfk-j=;(sv{vPAMUQ|ISFe1K96l>S?7h3CT
zKTiFFX}?uIDh}dCB$)v8J(|e${eFCl-u&aIpZTX|XSZH8Gc$`OW<#WOLNhWl+7>DN
zxcB}iKkg<JZ~Ozo(b1*<ynxbQFSUbO_Jas~--1i$3-tD9IQVg~<AHxY+Ru`uzwZ3M
zm--Pp|2tNQhWxX5^1tf}Sr7j;oNrd~-^K9%jm2=r5+ZpbsK9lva!uHYiu828_%H~V
z%5YHl9mqJ{05nVX07Z2UU#+mVfHzrmf(P?mOZY2=^t`C+^XFe##ccu{#!uIQBvA*1
z;6rcj_?_A(fo-2ZKPX_zwqlj=;Y6r_5YTv+0;Z>lsYONNAiNc&dl&mq+T;!CMkEp-
zxK~kJ)n~mz#jLwOWEqviD@*q{@8);)^n6o<E03VZn~NQBhXo98F3PjRjl8b>o9ZPH
zv7q-LjOC%Q(y~)qy^&eRTh5@h+d3AILfFwD@AEz>5v9U*Nh{?VKe<Gx1td7n0;VH$
z>w%J>wP`PCK-x?QB$m%Y7Fdu>>)u~_ZZ?`wzx1_Lp}6r?eKFykA4j8Lv;_K(ZxHl>
z(my`i_R}jVegw~^H}U4*ZI$Zxi%x^*u`4aqh<PxkiX?D=^DMT>p9<mv{4k<-6BrCH
z<Z6N{q2ut(*$LYI-%%eviL*kY<A4LAfPi|Bq|qjPvcB;Sw)=m_=zFY3j0Ouwp1(+m
z_YlAP>Ho0zo>5U{Th}n4h>8h8f(j^#s3bvx<W^Bs1XLtPC1=UW0z{FZf|4_el5;9D
z1tOHhlAI~Y5{e?H0_t1GzV~+bbHDNa`o{O;9gkx$nug+3oxRsyYpyxx-Y511yrVxf
z#A<@{-HVA;RlBC_R9LT3s&4247!h1442sXSeqUOO?b{4YxqO&WV(I#MU|NNWUOD#Z
z<ydyCmk?9{+jq)Ga{s0~|E5&%XxhwnTSZ08a#wx917VXA7<T?{re=|NvSJ(~P?doQ
z{V-%>Wo0!tTqyydixp&-bE6UbW{5gv+!9X@*xL4I^@~Aq_$F#>ZeShn2*@vl<jUy|
zPX;sVNX7<p%74zz&K@mO0QH0p*mS=J<*GnLDJ?oIr({bx`?F>#sOc$bt!tc3PC?I!
z4f<o)AAAhJBMz0PPH@{qTlO8dpKN}I;8W<_wH!}VR4=BKcnKR!W_nM+8w<ef2S=If
zp{!i$1R{8~*btCgWYH5=Y54?&LY=?+=*n7WS_jA7;C$*Fn3KAt32vlG%L8T+36H+9
z)U-{ad&G91X$G%8VW^yc-Gc=1`YCyL$EXK604P=VKO75VmZ<qkq&NR{^mgQK35(!L
z)GtqRHS&dYPYp{-G9*ca8fnm*)&u@9m_LMrW4@BOJ1CBmUcZ4z4A-D%DNRs_5)=lC
z<k~tJVfa={tV<Td2gTKNhNL(=F6m9M*Fw`siw5BWRN3<gDHuFPuxm)lv+GLlL=j**
zcKb-l!B(xH<s4$(cvcV~by_Uzl71X?;Db&DCb)MJ#2KwC-8dQYVCE_Z2Qp!Nm2)<n
zL7ze54y0jsJFj-fvelM?0-FHjM@U}*Etz@r?Gcj*hK!ln*|86D33n<h?0^!v>?#xM
zxVd=#uHCFPXjs<dp18DGodptK9zuCzW69E_WgO=Fj%0?HFi<1cfF|rjNkMZBtcz8*
z*ghD(2i3<L0s(X;dfl2;NDwIa`R1L+4vi2g|AJm1i`F7-ED$wmUkbzYs>`+mFcFzD
zMva}p{H6hzK`|f`Y9i!_7&y1~F`qs#Pqz~!hz*j%5DX{g5b3TBx~;U57FZ6G`M%hX
z&@w0K9K4w2rD9e|?9Rb$e=RV{8K%~AQ@tup@oYN{?RA1~ahsN(DYM*RI^TQZ=pmQX
zQPLYk_K#!{nXP=*;r@YFW;b$6j<F7oZoXc#Sop<j6<QU;`Kf-k%10)QNIYEpi)dub
zDz@m!?&LQGzCs*PJ+9a*MS~{FWI6D8%5ibpBmpbO?x}gD2?sez^Gdm@2P6k%%8>~#
z8L8KL+Lu28x%9z;4^W^O&0OMW9|h7q(S^~fzf3r(nL7vk0t>>%4Z7oZsOutuQi~(m
zr9hW}Q2am9lH{*Vi(P7C^7Zb}$5=V`{J0%JtByzj;P#1$9&Iw7WJ-v(t09(uBaq9k
zBI4G3eppv#F_4ws*kwddNBEEm>Ft(Z9tt>bD`G{4O+nxuifg+<DPAht+Kv3em7tVU
zH|>+Yb`d%zCg_qcMm|A<&Kn#fX7LN-TL%;lUvKvMswnbZAZSLx?(Eu<8Qn<DNNqEC
z`r}*>Q-yOCI2jmE+sGeON0Qt}(;}dz;e<t7Niml@H6l&nyf&+)G%&m#5`T4YZ6dlJ
z6GZ`@W*%K#Lt}By_#lvXf~{=IcLKfnt(Hu@`hlpZiQs2{zF}*v0r><X_hM=2Jz0k5
zBX*DgdDO$nJ`ZrZmG&|@kE<KWiK%k9*@J7P9<{H%36srHF<Z-{EHsGHG?))6%>#nj
z)c#9+`YMgf{1uOLt!x*~5PFi7YFr6yK#6`FG_(vn80gZyCxCIcSwmJ(&?G~yxw-kl
zZq#O2k6qJ}ysAybrfQ871O|7n_0H?V)J@CyQ%Vr|h8TX#k|y+%XMiR-h6vH>Yg-GV
zO;t43)|43=K{o<|mRCn?>OnokB41Fan&P=&NW7l@twu<klMB4Ov2=kK;;8(KP_W)1
zjofDs8%iKZ@R;vJXR_BIZkbjc`R$x-mS$1ePv&Uj(f~hXZ4Tn(K;K<o2F;h<qgQ)j
zd7Gs)8u3!-x@~s3Oi!rUd+NwQh8q-7b1qLdjH&fK%Jh~5j9=3*TVMq&uM@a?U4yGz
z!viwKtu4jd8HTP<A8Oz@5K&AYmXhMMOtdoa$~^LiS+?%W%32PUW$C{yl;?Gx9X?mQ
z4g5h<U=-+~hC^k<gKKdzA*S}Uzom-}SKtPp!ck*<#KUmEg@5VkJpHP{=LI0yyMS+`
zZ6a7+nf5Z`K7dQ}a&SP5Yvs>@d4%D-rz_}JEd*|im&)^o;HR5<Ki{6*k#92}t0&Ud
zXJ=)#Wa(vlt-?y74J^_GttC^xVst?LxdafsnybBq7^teq0-1;KHxD3|Z;y5$E7ys=
zD>H(8%>(4aM?GT1ZCd+TWT_al(?C8kRis2HA?n#Gu~CAbU*t72yMo~q>8;)n>M>R2
zYH>(kZ+Dj>nvUoWd{%SV>ChVmUji-K3P^H}#2!b{FT1<H$(&6l-2jlyMM<X-4(G2f
zJ`n|8E>R#?RIYS%BCLFEJW85_Bb-l1b+!3MT~Z48iU7`CX2U}6h}K#MT@%czbT*YC
zBn@Cd`P4Dml(S&q!0pU=<DJvCB(>pl6j)D55Uce5yk*t?=3^7%ObJUS8Ws(1o7gKr
zvvfKxv0H57-k1kL67YZ|AZ*pY;_Vn?oZsl_sik0Dv5EG!1;QFwBfe4wyV63mSCI*B
z_!nwN;l#Rt;jgP{5xmGc{(G8~t4CYOoOr(2=CD~f%94vLxX3HEkNWP%h)9VV+k^WC
zZF%XUE$7|ipms!&G<HkqCTP`xQsUikEz%nv$9Z*Sxd#Ol+X5Mw2fh&FSe^cXyhqiI
z2`clYQ+oGxxG-}YVEqs#U8C?ClY<NH*(a@?JAYJWdudn1b6+Mb?)RJ0j=(m-)LhnQ
z1*#IM(>0`p7@JMC3Yb4;-~|!A$O=faeA}`0#Tkp*&oD`$&G}s`637kxQS`UO<OaMn
z7gB!_65M69;jB?lIat2J7;-rdzByZWEA<|-68uV_q)m0>_&bG8<S&7V1rbcV6LNIQ
zvkhgyRwb?bd^+s6HVvE`9i71Mr5B;QR-A5g4*S|5$*YUJ`=Znl$=VG|0A5a<o`R$h
zgF-;i=YFbg8g>uuT-_d-9nNA)0CUt$faLL+2H*LwozM%|1Qc_yUU#vj(R-q<z^+Jz
zl3NcD(fugFqMwff06wN@6w|?dZCEM)twdKYPHIu>d4tfLY8XdN%XA`hdF3i@GJFUm
zV{f}h$Z|*HFbj{g-TLsO?M=IkN=J5WYBEZxGuLG{E*5+2@?77;e)@5~bt!PZ49{Kd
z!JhC2^2k(pmhO&KjS~U_{rsRh^KWc!EYj1i6+^v596+T5r6Bw@57d6J&t&)=BHm+2
zkkl+8_7r{BUHiL0NqC?xpU6ez5pZM#08B<3?o0I#xxn-`guJ^3ekVpA32>?)Ca}`=
zG=q8%m0U^42-{d@0Fk`CHoNYFAQOdYCzpeYiXc=_a_Zpg7NQs+!jC~IVNJqr0I9ZJ
z@lRoND1g$tjC4g8_1oO)JcT_G4GF>D{8cOW5GxRZi8z~<`SaAaIqyLZdKaPVAw29x
z8VbJA(5z8lKOkHTDXFwJ8Mw<YhC}zj=l8V_Q7>v=vb{THQ<e3THWd+E%4MHGJGL^{
zRjywS0O=c~pOZ?5H=S#eG!PLxt3=fFXdQJX0#;&1Sz7z^e=j@lrJo15cA-B2zL>v6
zas){ekliY7{m#Y!1ybUM&#uRxC!mPPufT?&CfLfIQ>B}$2xakiNoCS=OVVc?0EeS6
zl23E37Tw=lxUU3&RgD9r;Y2hVt>5Q5rT3druK+t1=Rgq}##EvK89eYRLU!&$tP<2s
z(N|~rV931w;u!nufmLqwXb4F_t`A*<a{kUM{}93A%Gr5$TC|xp<idOR9&B=^JqMc~
z-NPkL#ePDpgtKmq2#74UP{T7zh7d6y8n?%eTG#C0mNeE;RcIbiN4CK#b^QrHFQO5R
z+h##Og^`9Kf=9nhn|ua{<d}IqNHV^32U#ZhLrpmq;bqnxoK@`1h?glqUOlUF?+6rH
zli}BhBdr%9Xa8XQizqIPgFfQKw$F20L<e|e*eGh-K91x$>Vi9nl;n9y25CN4NvrJd
zwNk)Yk|AC%V1T*I?Ed|S$)g_bcwUR9ARnAheSN(P^tXvx>uj78G04yY86PS>KU_(A
zWWp^DF2&!C`n;5TdKv3!4FCo<wv^nS`vOMg*9r|Q{rsR^{3hd$4=p3sC>?G=jr6rI
zQhJTuTs)*~HnEFH=ZB!&S`KcY>heyWIyHu1h_0dRODt0$7+`_uPqvOYe-}w^)IMoY
zGk|DD3@F}Br{kf86#xkc@$q>lOz8EK65o_hdPqYV7{tBdx6-w2?#+2*LLmXz0rBE=
z%2Xjs;_n@i74gTXn@Bf+Brj%B>l;Y34oyVHa252)-Pt-!ptYQ$Im$-zjEg^i7qJyu
z_OIM5sQS@YoO6MZU-$SxG0_zJd8}s++^2yELy&LOgmn0i-l$Pfv^f6y@kt#F3D3zp
z$;OpIIXO8&duWb?4jDtfTijWX3H*NOF<d<W`9sjuZ$pAACn7VsvHIvgX$^tx$Un2c
zGWeg)J&He0{x#o!zJ}uc?Z5iHfBonSNUHy8V*dA1zdgDC|BlttEWf_+(2>8n_~Bcz
ze6eBpA<W;>pNjY2wz<H!Ur=@x7G<n}oF@=zW_yeF-(t{@<A1^Ff8EFb4eaixx_v4C
z_5y$z?0+>N#E;7pco-ZgfhdwW5Qcx0_f<?_?*xyVvLnpIc5+u&R~;ZzRzfYsM$2*>
z#WTsj7W%D$YYxAj&B;7Fv&Mey$DEbS#zM!hXOo+4BhAYO?c-^LXAVEyii#Zb$ki`^
z?XXxwgL%)>;o9={uiojzjYX^#yn>?IMrD_@VBQ|QE{M6!ySbADMwDU&DD)C+I?LJ}
zV_UypJc}<YHYM$$G5>6k@+J|!M%%Ey=*2e5EL0#mWozrT@y@A7+tFfkeG&FK>=MrN
z;`fRZU4hmSZ=G|wj=ZPKQrZ(a(ld|Mz%DGtlhogn=Z0a2C%nwHNL2wb0d|fa<&>#z
zv1cFAT_j01y&x3Vv+>i@Jr!{ANGTJK3eqliu{k$l^vy#9gB>7vdwYB5@(@i{PbrQK
zSGi#RcGphZa?{qL0E>)EbNp2qX&4cgk-DDIH*E$W><YKAnXJ!C39QOoeYz1t{KlR0
z&hG#{W=(@^^Y-t6fPk8B+4;IsdsHjBh`{Mtb-CCo$8)$}QEq=$$F#FfVr|rvTngUN
ztlQ}~FNkMtm6Xx-9E)=jzd`Y{_#zqQB5XGA9;KHNV_nMatcczz1Z#k<tCg&EjDJX#
zHGYrf>tuWiU&%r{qm`cWvi-c%Y9+BoL|Xh~5w2}*WdxfbI*WgQ#3Y{ml&E#1mCUcU
z6gwGw+3Lmy)zSy->+!(N=0K*?gxbw62~~FTF2O<%JG0~Q1-bwEMZ_N3={P@2et?X6
z$v94}s6jdi+hc$~a9T`mN!Vul)umEg+nbKOj#~n#`nmLajS52z*bNjBu@i^ZF3s!p
zW%txwb18Gg@Tq31M~T(H*i*DPu3Xz#B|77de~FmL(gS_R{$@%=s}{Q|XSy2dH&?EV
zMm}#OziCL>#zeYL*X2!qc<~T^xkiCa+vfKWvFabpv|>j+H?<xZvALY`%o6+)U{S$E
z=)}3d^(?S+lsL^wv7ps8NTrHZWCB${`of^gGAo%^U&WOr9sE~Ui(6j#>lG6zMQRtd
ztC7!Rt2>pw=qsb^A-mqx*2B2Ilee&uHpv_~!SU6X9o0QY)&2S~ehMwah*==lvhxQm
zi#zj@+}2h*r%MfXr&f#EM?RAXVla+abIRG;AQ|KZ?~pIprUlE+EDv3RFNklVqqFGF
zZi>q}DzjTrM>4lS&Cf9*^UjA^iq4-ELbYCV`Ced^k24^wmPC{4ovGwnKe)BP8MZf6
zh@84Ei$wtiPk>x3PqzgFd-mv}q`<~>dVQ3H&67R>bBkFpkyi?0OMZTpALHW8)RX$F
z=3AMyoZDlUlwqf_{Jr`!Dw2>0jRBZIBE>AM;gHkRxWFTtIq)M`n+EWp(mapadZ%lG
z5QjWu)W*%DGAz&wY1UQjwED`C-Ul5xs7`hi!o1qWl7~VEL@~Tpws>~hpak>45p~{=
zvJ8y5Zad4}&7L=5i$M|a&SJ$od22qNvg3hM>||%<K1XCpUr>r-^gYTh?Jc)9;E*Z3
z8`MRmx@#FDACU!Af5%fRTa4PWwr-i_E$d1(-BWF&sG=nJz(^iJ($nG~ZBBA_fia<M
z(3W34w?tvhJ+qQc%^ts@`18Bi@f=qJOtkugJ7p8-a)YH%vpo0p_()ODhmyO7Pgu<1
z4%5cQWt_xgT|Fd)el@7)JGdelaFSpB@s$u;->W!&k}Ij4h<cnm40bX)d=~x~5Me=Z
zDqG!znyzy0^X2dr;*I5XXJahwQ?N~8A-mRr;$yH9F?P_nXUm|6JF#lFxAd`;)n7YN
zRJEc=Q!<9(IZGzrwu;OYC}{&}fX$|)C}bkmYTc%s#W3VvI|+`q!<*EZLDFn}bA+HG
z{_S(=+*XjoGJ-s*GuKwNz~{oQTq++UJcKiGsyG7>bifdU?VnxDbHQ(i7p+_9qEI)l
z(@np45tNi2;W<4f<5bDv$e5{RT`p1F3WT3(e#NIxpFT3I*2fUTGnFB8#P%(E4~hf1
zXf`9DH?UkkC|<l?T5K5SLmR;mTG*a#nP-4)^&Z$AkxNJ#cJg5T3tblZm>XAJjyqsc
z-6lOJ(iP3`0iVYJc1raE=skI|k?iwF@cF#?^1}jFTbaoC!zh28K_SLy*r#T&7Q2b0
z(a{0n*~`002JliFJ%t)Qr`xh~gQeWbyC%0Y)$;_8oKDShBO~Q4>gv?DIk9Cx%`GZq
z&Tk{Nz6LG*j=wYUWM*mJB1w;E#1rHQgNis1*9aN@JEV0rZK8|ETk=9}_=ele3Q)0k
z3zD^lflx)RjRYYr6Q4i9>Y9qZJ$Bgh=O1A4r1w3-%D2(?Hp+f<Hm$>cs$j4b_D!Mg
z$F4YL>X3A1HsBQ5Ku-B^ENpi*Xd6vJ#wP%)tfs~UshnZ(=<4cfp6OzHq>!um<Qm1c
z2yjP^nLDJO_8lQLEvDS|Rs$d?cy!Pl$+$??nBr~qMZr^>=H?!)Ev@i?utslzj!;tY
zatc8Ld3%F~_6g3Z0vFFNkFy2vM(QQc?#}mKey4R;p#_Hwn8U1xjx}BZLq8AZ)HQA4
zO1*e#11H#9z}=m_ldWKq3y1zW^XTUDAU6xOAbm^v&4y9;Kr+c{evmo}hwZLnS8~r`
zrbAZ!?=gaV1wm<bv3Rn|s+B0fTS**v`WF3sTWE^8QA#ex!&kGwX^5^oCxA7LO4VMk
zX9-a_XKZ>V(L?1ndX3_TOYQLvl0#*B5hRU8gZ$|!jdf28UHZU!;`bIQTvrv%_ntu<
zZ~xY!-d%gWH;p?3&cA+)boNX=r8&}BUxg9|)mF{6(wvP}!9YrCu5Qq_C02}UU7goC
zuz#lDBibXOtDRKYKV{c}60)C+9dv^O5Cw{Lb%s2NA$G;C1L%aONMyOUZuc&Yb&He^
z(a`~=C?+1e*<^%isx%hTX`M^fn!hZeXfH#by|(HCPcA6!DT4M>b(^QE7b;cWv$o*K
ztpt`lCxSEeROwy&`51Eyz2C+}-c{#$??@4pYJtpAi|JWgi``1AR#$6F%jP)WZQ>!1
z{;G2@%BoJUbI~p>h#yTQqv{>`ehiDuc5adexpg82K#29W%=Y3^z}TRz8abdqe<C8P
zaYq8JUo$!=-m_MbXSfMG=Lap1S_M=iTN8B82Lm+gi1=k%&2z(Un7M0kE<j6`GZZYN
zp0SOT{|MO`MKdBc=1!aGmmFg}rHrDxpD!-AVb9qQC_=$7bcJrXVxfJubUJ2v844X+
z&QZ_u(G7!oML*=j1Y1csm0euTxyZrs8ndZb!=FV&E!@?1S=75%Us6u=g7us{SEUE=
z<XVn>PcWf%c2F2LoP5s5ycH4>`j%^=$LAgsl!PfEXPGKcX5iv>F7J-IR7lrbKvf#{
zfJZ(g_J;y9alyDXR(UPbnb6PbypH;4SdQQmvbz;=!>Oe#ptv+RJaEWCVrzI^zd5cr
z*YNU8@=>!T+)y}sasB6@qr4?V1d`O0fDEs*K<n;-z>9Dmop?7%a>ef2AWgXY`uv+=
z(cO%n+ChM0-r(pcFl=CSXSE>j3Oma*g?rMU5_yiF8yM=Q&fH!uvG1ARfExCAi7l;z
zSoW=x+<Z}Dx4#HqmsN}packw<Tvic)3GXBXV8)*lR*N6udsfRmADDki0aw2$w;EPh
zDqBekT~3nzk;(rB&UcIxSM&(r$990F00EOTq=~>dzJRkg6D+z89nZk%Xk7_;sEmNw
z?J=@-0EiQhoCd(2c^gk+yI;x5q`Mu#yjd67Nzf#DNRlg`LMoTMvXIxgygV~|?(#0>
z1B>~A$z8UNU{X~tAQZECfpHl**bX)ZfR5pLX>Vu`-X&#}snBXu(z1P+Iy1Z~`_}f7
z&n8)SK*DiA%LbG3vk0@1FK1?!Z`Lt6h>L%2u0B(xwH5uW&_m98+BJJk>JQl_nPSrn
ztS2Y082TQ0?Xb&2-e7)Qxl_cDO~(`}LT5P3P{W>`)+}LqoQv?tDQkx(RSIuXwBnJo
zR=QnXEytbRkwtP$D|Q9u0?C3Ub4%8o1KOMGp5O8(@S&9ouoO5Md3B>*2gqB+^GKfo
z+fa#0I#r(J-9c%Y9m~fJOW__DVprWHk>b#ZA%C8;xS!PC-K=3h7NnDN2c_`*=|TrJ
zc~@wvs$om<498OhjbfEO#CNjgVTam-J}N^C-5{-HqLqB>GECD{Hw%m^Y<>tj7(Y;V
zs~*<oK)JKt_VU(%vZr1YEa$!fwRzWtVVZ>TdY4}#Tus*Obc>tc`R!+u!;X=k_jMuI
zkga&wL#a<-$p*(>uKO@wk}RFNQW5Cqva<N8)DiEx{&^4w(SDF^*374Nbj(^4lhv4c
z+Wl|EQdQm<vnAZ>jnv7dlz0XAm*igtHw8U6t15AowhKQ$1zTa2B4bMl9kseVee<iL
z@RXQMFz#lT>_GpJKE8(l1apLTkR<QX!}rKO<DYyJng^Y3`{*&4xkJsHkdbL;OTmsA
zY-8DrlRP#a#TH@=(=#%fP-j&5;yikiX83Oon9n62Wo@*=uZ-C5md>u?wB);+$kleW
zuZhYs#~N@^to(O&u2h=MLD=5gdG>&k*2@pgt<TC0>&HX}wkw2^Tz7pZx=eGZx{)=q
zMRXb=eZItLfQ!LgT%}DMeJ*DFyaBzbXLrPXej)(Q_*`b?^xPW^UeOX;<;lDqVo_yA
ze2w8$t4>t0{jT>{%u3GW`sZ+6MI)rBOX*IvYN_V~xwYnwLsCOR(00Dz02C-2H;>q!
zQVYqA1^N@k{Oh;WEr|cU5|%M%lqz!?pWpt`jjO#t(5N<Vne7L_aJ85Kuo0}{2D00a
zWE=XG=CwUAm(~jksZ{0l=mWcn-?PM!vgBvFImKwTxPfaAHpp19!SC6#d=O5I2YZMz
z<t(%pIt$C;l8o&KOEy{72Ail!rf+cG{mUp-dE&ZxLemaA^JCk%?O>%{tKIPq{>#=q
z&>W=|JV6P#Sz5>4D^Mjga{mfskvQuZw@9Bn-hDTwAuTE4fSQ|>2c#B3?A%H@UmCF`
zqi=1AJEtLRJH{Swh~m0p+ujpJs)7zIY;d@{f~|NGKM)>2wN2HnLhdLqj2Wd;wa{C(
zuH1<a{%U309^ercPlJGU>pm^w^9T7>RVTPrC%YB6b5+lgV^1&@Ey)Ke<gkR@j~C=E
zo|nnNNUblYk)uA4T!kZqTQPb__FuMPz*7I!J7fv3<2+4mDJ|xcnAi!mHdn!G<2Kgf
zY~O?=GGx6W!05TK^&_O9dF%OsOCVc+0L~ddQPJnI-H>9i^|lX5qs+*l4KRA1i6=L?
zc2xOF@7!pH!p_L2eVptu=>zgj4;{{P%mYfBfZ0-KZxu=ocvQy*-&r^lp2s}~DN&%{
zzKg`@KfJ$#d+Uwi5HA>`&NH@ZGC7dw+MnU&2o;CDfs~Z5wLbe40cMckBPE=#*XX^8
z2axN1loOc#(bq9s4BLr2HNFY;!AVVHKn2hmHzGZ*@T}n5EY|XkJ>j(cyYfhL#SE?2
zbLpj~!8xP4scdN3vAo4YtTvU)*OB{0Koy5al(nSizKV?96qAbGdI<r~nnV}-Z|>9)
z+|w|job1deJem7fHa1q4+hB``t(EvKX$ou(h|I{MQYlXWX2RPsnlyrPKasnHXGg6p
zepk<XYV<bYO43jMMBFSmrI!8xL}^>&6EPW1h6OZMfRjVuR{bbv)4gG>6HK-NCe)^G
zxGUD%U%)+Xx8kY)pl0y|F7e^C{I8+%b%xUe3dMsbkXny`RwOPKdN#Wl)sY=>FiM<P
z9|-MO!Z*}c9d|tE;--~P$PJJ^$!$9o*HlshE;ssol{H8^a3Gp_wfh^-mTAR1fqDPe
zCHk_Q0mtijO$Q&?zM;LyadChC#mff|*2J;eP)_jl5UFv8hOSBtOtT#MxvuP3=@k`!
zwZmO+hhQx-ydz*+I65U98WJN{8nI;7#orM7;OW?;kQVXdkM{OP6kd*9=~EmFDRrY>
z;obmRnJd}AIq~4Wo7$edd>)cXmiIo--r{uNARQ{E&Bo>6`>vy9vI*SvbwMd_bvz$w
zxN@FgWSn-YP0K=!oA=)q47812<Jfm&*LLejzu?wz<lg=dc@g*Io6;6E1=NB_+vgnU
z3v@$oQs?Ydx9+y!_SBF&YHkkpH-A3uie|#SCGZRQr>@_*&N<)bbbXV(d^RzPLOxm1
zubx>$B%ZKFX}HapzljgHgKv?iR6XzdY0KkqSeTk!V#*$xpmf(rsepC`z4thxf(&=N
zL$OwPg0#D$(L~r_wuF2HSK7MN^T#GzEz0Db!vvXUkpVV?UpjfGwWYRdO8m=o!V1e5
zSvJ$vUj+OrdCUPjJJixKpKsN3Sw3bjaE!;vc!y`*NnB>)duT;CcljdE=*;7+?_Vk_
zU(%NIFQ1X}*bbc`n|;hQ;40mc>vL?l+aK9-AlJ2eiYRrPZ?^X?{6*rIE{yHiyI0@R
zw0rN&8bqzBUWnHa`0$ioCg!@?fK&S>ZK;F6RQ{D9S<R_SB3AW0;w~58T((hZtBY;Y
zJ|${7t{!)EAoFzYj=#?v)%PqkM~!SZC6D)tkK>we4i*6%v!Cb-kaJwsmPoCxcWj@*
z^CZ-I^yHto+bVPL(7`j+-Zhzrsd$)qC@8~uJ_O`2oVx6CwmQ8^uhwzq7S=I$3Wfa^
z_=rZKM*qG2m-ro0BH!G*V8Qv#xet5#Yf4Saot$C}ogDYld4`wfbA<R1-jnm}bGFE&
zqvoZ=G?aP@ZIk%>lwH!P>u;&}7jAe7M=qC){_<m$)^xc~L23!u6Xa(~eo;F^mf3O%
zu=eI;K4cei*KFYG+e8)LxdIKYy75a_4|91I+L{#Zl-u#V#o=f7_lTF*j^xg>F|O$t
z_y$eJJ_d@_i)vspd&5=OYB1K=e0_ds>g&<MHQYS$7@g>cJQ3FrM?(RZOVwLXCr=Nh
zZ^Xy5S>Nzg@GUFz{LW4<w;OpadZX{qNOsEH5xIT?p~8?@wIy1|5&kKiiTSh~n+G{j
z3O5SMx3ag5;^s@=y;B(6%RE3V*yH{!Vn5+kXeur}&aX;C^$BUc@A>;{W@XPr_lP7A
zhSnptJe?k0aM~~(;bWW|Jw<5a%-^v^=Ujs+vrailt-2TOj`Nt0zTe;Y)_@_iefUUQ
ztBlj|3qStP#CLZ;qR~!6QXoF75jPF6Z1d3(6Yt}$#O>BuHi^87+j~JUejy^QhfT&K
zeOJ$6`^RjnqN7QO?n64y=jTaM9L;;x1s!h))ql??_{K?lS-M8Fkd41r#6(bK-dU!i
zYh#yKPw#;sn*Lfwpj}E&n7Cc06=uYd*r=s~!s%~k@bufni+bkG$FBt*$z~ghEsHCU
zM@!wTG`?_Kxn0Dz-J#Z<f&8?wK5LL{g!+1W)wVk?#9V4|Hu`Xx$-bA@g)0khC^%tr
zVfoE`9R{G6CC6|*(>tzEAe#Qi<ns7xjN_Am{{B+;^bGdY9uD4@f`qL5k`^THL?WkM
zPOEa`3lVFo7ZjqpZEP$ysz<EDRZ@GN`UZ)d=(GshC_0X}c;cKK@P-}7Yk77?N>I5}
zdaB$f97nsCYGwx}bCrDQRB<{PPwt^>nqpvzNMFZo;fbs$dS=N#yr^GloZ72?MV*3*
zN8?QOOdTy{_ts%d23Zd?;#|9srqzDwtnFpa^NL9`Bw^Wa&V@`o+SbfYDv$8!*15|P
zPS30hy@i+$rM+xkuRs5+r}soae@y_3C02TN<5DfDm-5sv_KIWrhr1=&j`)_oNDFyk
zH~MATyq8O<&gxM4*ZG0IWfGw;bGh{4l^03X^+W9wqbC$H4bEL~3jNWSI+!xfo8Y-u
zxVSLAN1aO|@YG%k3jJ43G?d&D4jar&9v_Q5ojl||RepZCX2kYoj7yQ0E3ReXk(bd*
z1uF|GBpr^nzvhPj`jta?F20hc#A5Dzij!cFj}+ref)=yF4QD5(G%~x0UFQ6+8`Ntq
z%o*q83f2A9f<5I`ax9$ZpFUZBXZrR2UUx}<nG1>+KXS}S)n9<AzIP|Kk#z#g)~BMW
zX}uv~nGh&7bK9x8L0XhFuJL3;tC*O&zFlbdZp*W;FpLFzamAOSscG9_oz-tc@UnPg
zuwTMs0?zLH!Q8n>)e?QD@vsxOS2b_dS*?;gjGOIN?k9eyhG6~r2kSZdsA6`fEsFdJ
zoeN~Gv&+`H2XYOUs6G@?G(q}~*x?avA4=z;7h}?|!;sH%y*7Sw>q>ta*RlOS;IZ&#
zJ@NOm@r}n1`aHh=pdTF<j?X-?-MID2XlCs2C9Tff%=c#QTh^=OfevR0x8%1J8D43{
z$GH@Gcz-?kUKyGbZpGOOak$e)6b>*EA?8V3F|*BRUEY*Sl{jtQS5D+#ji>K3DX}n~
zICJ`l{b-gFm**uOi@76)0sf3RrylC;cv+Oo%BjUm+v`?l4~4buUmH5{<fMD7@u#1?
zO1!uP%+D(JLkj=QwvXhF1-kS1=MYco?$1@{3SEno=6)oy%G&d6a*n!|1W)sONR+5Q
zWZhR&>J%JsOT#g3h|jr;9~BtbJMwuth}Au{sHkPBvd>1uZjEm7<%!cbyJaAEpKNy3
z-o)VW<ujLHf@*8Zsmc?-H-Gv=b_P9Mdpl6L64zpKO2OLf$ylrDQmA8qxij~VuaiNs
zgOaP{xi6Y;Uc5w9?Pr&(8^xW1X=Q%&%Sd3x_Q6~<Zv`;%tts>x&dXSmbZSSg3{~_M
zr)!tL;gV=@ow6<(vA=hZ<n&FwxXOl$_Ve9e01;-$ErD&OR#wWy0&zRpH(@S51bz!=
z8-uhQBK_lDG4oe`xSW2SQ<+yZFY$YyD9Ob}d|$)%RdJMmW|4Q7OE3k3lD(7Ml$_Ok
z?e-^`z3RG??B&EizQI98{y*pEtykGpEq^+SIb5!8KPb%+w;-C)(`&Q1=}s+ISC{lU
zWJFVT@%z*B)xl}>e*1=*qrR8z<aW@!=Oqem;txhSFWb>%-dXbY4*OetDaON%YgUTX
ztyG2yy&G3A3}}>IOnvBie_B2uaBtY^0Xa=}nwMv-O+M!@-CI35;Jmsi_aj{|*oxT7
zcdq(rooQp+Yel~=hunsSqwB76S3jj*)*MV<mWJv!g4$HeNn0m;Kb8_h2k;~I+U4Dy
zqh>0P1dUi_Zb8bjlRKTiF6C~_kEwE54A%N)a6X$%($?F-2D&!uCuFRM_M-nN9EfCe
zqQNyN8~1PNT-orVpxsv>vOiZpmtwDazU0PgiXXN5QIDNV|B9;KFd9WQO<vuy;8SPn
zzXcwTb~=_;eWcZ9SV-Dif7Ik^=k+~JP4yS7&wT2o8N1L9H<Ff{d#8k2kkoRUn2E9}
zAbfq{{%1^W-}Csy=SkYG<bE!aWId*;e!0S>&vZ7fh&VLd_JoDqT2kv$fvTK)zAaY#
zzIwh=yb4iZz~9@?RBMZGb@-)kekZvg#2hKrbe1xocN6v<^sP-!Hu{~@u!k#->zf5V
zHhdD4v~hL${k)rj0lm>&>z6)zkB>*|6}~(<hdqd8Fs9-uXy8<RTU(XVcHUtvtzeMY
zKdtwUh2*ayWCxk7cQ?PU*yqOCc`3p(4$@n~cKSr!n+S9D0)y9n8|UVG$2tv3V@_KE
zb9~3<9$w5h<GvdB@Yhkw@Q6+9yu`89u!r0uZ<kL04k<%wb>G0#&V#Sj6*lBFbMnfc
zUz`l`|D015CFj1zc4a8<Awv+)Z7QB9@fR1%494$_^(nIdfv#v8_vAJl{u6~>ues+n
zk<9<S$s_#Kv^AH~wG;Yg&MR$8b<JWkmBt(w>0%xgr<pxH&#cn#(6*SKFa0EAYXiu}
zLNP}Pg&2W1^>24xLD6IErnjux?{g#ems}nUL%X+6(<M@;#>~ud;>8Q+sx=G0@Fy_o
zax=abJ{K(bOV$0<UC9C}9xJJqQPnt;3#ScyUMW(m%Wl*8-A3EmpG1jo%CFi;l!q1-
z6=mEoOu#><k#TBXUCkt`OOsk+inYtQFB<hv^$^co@*XN}X>Ie>e?~>gc*xl5n0}2u
z<^Ej5X^-|}c@!BWf0wWs{ckvYyw$(G0JN0hg4g^FyXYi7J?-hW8YGCHe;Yd@TRG5P
zV1j+KFGGzs+y05{9zpH_$fwxFJ+Wgx6c)Kti|y@pP-DzD+yU~|WYv2<P@dh0L+#R)
zjop(iS+o@8`bch;{4!jtc=?TfoTTSm@8?~1Dr8fs)B9;(`ok4#{3oe+$}_Sx+9E$t
zH1V*t>{Ta`#h;dwVd>|0D5(rz<@2c6lKFhsR78pp-Epox>l?S?R@2;<P}bOSHC{{n
zaygkturlI=dam5bhBd4aET#XB4fLS@gZSEj!xenKnG~}NAL!Awmm(E5nmR2S%k!oa
zi*CuQw$JwDIF9@$=P)D++z$6Qk+6yY{MA5K{f)nPIHp{Y$mr6mI-@ao$63PlYZ^t<
z+;@GB#1k?(szlzL5+k=9Mk8nTbGEcGQ-KEpnL}3(oa(~X==;$NX+(+WIXF9al&!`b
z!s7tDvXozSOuWiM$ryu+JFSErEj-kSE*4z0RP&lpiNkVmS98oLxT6!&dtbe3aHvdu
z<+nAXlz=b8clGtv5#m>&u{s=-be^M({4vL>=-j=WG}qK&-2DDh{^gHbo)U78P3C1X
zhcTljV{y&ZKleeO(A<v{F{)$wrPt4w>mN=U%JHk9LkjYzE$}DC1;#gI@0TAyhwx2m
zqlKJibw$5jI>^hL<uJ1%rite8Ctaw!eAzl<J-@Y%mMIIr`LxyO^z~jPB*k2It*EMc
zu|{@$HQ7pfSbUNnkn_wh7jWN=cSPnT^tw&G5sR?OdSy4(XRY{0f;dXC(${h3O>Z<>
zxiUh^13nxQ63lm~ctra#yV1<C82z*@38%o&GaOs<GH+guF>;7es-7*-?4Kg)#3kh0
za<fX?dAI77$U?CQb)5S$^6gOh9#!XJ7bYr>-R}&l`wdNKGE0{|3cHHi`L5)BZ8&n<
z7|(cUji7H>jA@-z%Q)v>SYc`Ts5Y8)?1t>%q8?aIRmtoMl;M`YA^ny+4NviM(2(<)
zV0sQ0og<aU^&7e^4vsvFgdylaujmLtHy0-}@g~aN;mLoZ#sSl&WMJ6mg6?o?2zTZO
zY($)VO(DNX@4r|5pwqIqcL-~4#R_$U-~(!P4XP1(S}j~*VPW)eQ~O|h`fCZ&`mGVE
zDgN>3Np6jV+=r-UHm&L9b+)?|yeKAC36B6f{t0C>GqH%NcT06KqBfU^_b54Y@b}qK
zlDE{@E$YMtsWOwALORKMt>xyY7e#Wl_8ARmMY*84tC!MS4Qy|EB`r+0Xr<@aeC+R+
z>+I+#rZ;nU$7fd<uX52nR8l&Mk|tQJ?m~UioZqcuvzb{A%9Z@O0n^Mk!~m`JV=^u<
z?yY)QC`1+6YiDe-<|oxZqUzQn9FY4aCjeW?MCfs3<=?9wlG6OP_foE{J^mw?J!bhx
zPRu9+Z&K34;983%R@W8j!OhLt#64_&vI35J{gmzKzL!Y230L)AH#u|c0hy~nQ}@*=
zoRd9Obe#UqQbuVqE=GbV_sQVE{|p(!pyK@FZ!YET#K6rB3bRml#}XOS$$BvrcbP?q
z_g+ARKuPD)aKzy5bL8SJh0fYnrpjJ3wx#D@JSZV8NJ9Gt%~&dpUknWmPkWNNgbCNb
zlKOfT`z=aw?({X6$B<(jWtF`+W6*+Q%s#uv^j)Jo=c@L6h&@&_YxgURLLRMqHSzP<
z3Fp(9snU#f=iYokXpSqjO#=Crk^^SthE3%WP;;EG(x2Nd%vU<UxbQH}$fbPswTAA4
z+~fMI5&U<;UtF%fr@0d|O_H4<83bMF3YcLC9s2Ng=}o4R`eSzA+9!$*hK0ZMt(Goe
zHxoaN9N^Vn33<W_mE_(~@O%j>_oW6)sF{t?SYI|pQ-*j@9fUI-9GAef_O56z03Xr9
zZ+APac-uKSqPK`PozFz?HQp!cpc9oAoPT|{T_sCNNtsJb2l>;_m!%zp9_ZZhSu%?_
z7oLI*P|6jHmjGC3|L~f);N<l6q`8FNC0P0Q2D*zcdo<*$ydF{ZR7!#CUxK#7@syL(
zkMo*zX+MUB6b>I&N`=qb^CH6bHQa)^nORbJxN7b78aVE;Ys&MAbt3fIMa`{mQLixr
z!)>3coUbqoRU9qxWunTgiN?CSxphkJu2}_LIjxng#>tsMHmUP94mrbrDh4j=PdN8t
z&;=bs|06C=XGRJ-NVmS;^A$NsNn!Twg~iUPJ!cS;o4)Uh^VN2rcV=_^YiOBBs^VBk
zdLxEWROL;6&@lDT1k>r~QKd8SpYnOq*PwruGQ95_hkNFca*3C1uMWk;3*>!H&1iC=
zIh%x;HZ0!Hp<BVB*??0Nia9WW{zCW_^IfB$rrQSNx*RT{DCfYyK-bn`f-?h<b`eG+
zTdzqm)ZAHCdB1P%VEWFW{N_xN>A_sX4prmRpY_AmocxS;^GHWz?QZPNY5JrFLE@HG
zP$180bJG7*ADRg3Z$5g7eBeNc&y#n*xq-qzxdF61y2AZZb+D`GRe>Az*)m-gx66sS
zJ5;I<&V?}fxlo4R`PTNkQZeYW070NTUSM6R{_4Ajz4o@tO}bkeu1RhQT{ozB8~M`w
zLy~E8U~;;0BJ(dPxCH%<w}Q<<9$xj4{W1Lg65^>aqO%zVuK=N46hq5caap~c+zSth
zBe01Z&vCt$V4KiwRBJ-pWg2`jdXQWh_Rgf7iYI4AGW-s;dP@s01HDAR)2DK6Pz;#E
z3m#njR(JEslMf?T`&h{r&fj<H)H4hU6&k2a|IpXfJ;i>VU$<gByMQW}FkOB)AtWRw
zWta&Lr9$KB4@v){4;yfhG5bh^+5JZFQ<0pPa$A^H>fAB>bs1lIOg~Ri02*>u8Cy-J
za7W2+z=RbS9NzbG&^%nmX|BzOFf%h5JNY5Af=R5l&&t8~-D&RAxp^<Q>f}lLq=3RK
zwPDQqk(y)k^Fn4ctD>FPcZ2~`Uv`;KdM=#VmY!QkV40EXOKJU+tjK;YBrH7pHD60c
zLgNJ=2?0L-8*x&{kEc93bL?j}(sryych}HRA_wwG96C?Q_~AKe%JAvJ?n_P0+-G80
z_wI=>xU<k5+E*&Q3ibXq2M=1NUa>Rx`~KWsp$ZMvPqfaQnD-<UgeD}-UFnF=?)A_*
zm%7JG5>Cy=D16T?&v-6ie}www*`Wfp9EFEOTQ|#|IWd{kCmOcFH-O=sue?P+(!U}=
zf5r5n)8~avcdm^>gW_k`?k6bjKB|P>IeTV`enWkd!RRZwS{uco*42qV|7r+Tzw!3}
z#Htg-Dr^3Yz5M?QRjbwL!!zV}feTNZ(LWT!?WpiaDov~Jc->-fjXRbF$&d6Tg%He3
z)P;y2ZpkDV)ZUK~kmuTKX>C0cNM+C=dx8HL9gw%`m1`M)9P5XG<tY7)x>dscH{9ZN
zel~vfD1ck8+A@y6qR{8kb&yw6Q}dGRjxn6xCNNZn@-1gP^tv;@kQWuPz&bxvo+Dje
zF&e(W_Pc~;K3BUxckzi{#EG*O%XK9O64J>%2h;rBZpk+mTXgg*_A|E}cvbsk{!YEm
z8;^D$t8SiOso5TX$lCo5V*h^yF(Zt+hS-_Wpaty`Q=fUaE6j=1v=JHWk^bBvp7Ik*
zL0wN-cx{F&CK?OxboO?1)cSvn$hy-$q>RG6eq;Yoi!?rcm5(0?hT*ny?;2|0up*1D
z1D!<;$!We?9L311ad)=cMz9E;h?x51-99Z@*%ZZuG4WD-YrK*MR<S*AEX8!!J85v{
z+v+KgsjtIu*R&EgyHCYGpk8M)h5Z0dupOdiMwoDrQ^Vw%#G()^N<<-mqw5hiY{g{q
z?0jVrx0K-ex|r5BC<rqVhK-e>N}wQIG8$90UU;8xoAKF!>O*aPxyr6?u?PKBiRf{C
zy2GuK*^V1133utR(D1eb_;?kgj8ktHHaEk50vNJ4{RX;0OWMG++rtA!3F7j=|6_f4
zD^x8d-Wetk*7iEM%h434&%U&!Hv@@ci==%dX*a$#NeNQW&^^cf$ce+fHD)r}5&}X%
zR&de3%v><7`8vTUkmNf=-84mv+t@XmI4SP9b$X~m<2tl&KeregrL3$7WhM>#a|08u
zwJ3yU>c-rNSk7+8PuV%_FtvSqtLine9Q08P&-*2FEaf7wd)Aht@B>s7P3eL$y&!?W
zI(UBh8_xI#cyZf+5f^{9a1pshQ75{(cPw+`jkzBTkdNEg&@!glQgDMS3Fj`v9g`mz
z_l4-GUcVaQOlWXeAwk6%9Dlk^Vs8f)Qd!ZO%?g&xgjzxZzV9p$O%n(R7ADU%N#4<G
zj;;0Snw&DF{WI&|G~_2_`5`Om$nTYOmb-fEd4CVOzAW?DSJSV0$+{URb*zs3E^k<R
z`g}Xo5=3n&o>jjw`glkbL@tKaEtqa(R;{_tUZqt1;&|iFqA(=wb>DUUkr(H(b+VP7
z9L;)j8hQ71zEWHg0C2ON*LblfemER_j3p|%hr3-C+OE1~lKudszxmIRYMEru_u%Z#
z4P`Y7J|rsYS!zF*nw1GfE%B&49#$o`9n1}#O0vRz>@aCn1~H;UC-yfBcLpF~bJyyp
z2MJeFVCA{N-gDAd;$V1{yn^zFRJrSa3NF~aRiYPOpp%G+UoGk!HohO&nu&2OD|xa^
z?f%vd)+jOwUER`&TU-0Youz#(Vnn`J+Qy0)+fx-41(hsGEEceY=FKXJd!CI@-3e|^
zVi{ok9(w(^<U)W9Rgt!=4$QgngqL5cS0Bp{=o3use=P`r8gjFb3ui}#u(LY+m+7i%
z1K(B-qG*|R4EsdQtgZ9jW`HwM*|m;0ot*LlTAySA1DTQbg0??Q%N$&fug7-cJJLXu
zLO$CL%@KRs`1jYkR!r@#Y`pk8fm6+@jxAtCu&HonpZ*&^Q(!EcrcmTs!4ao#b89)b
z8KHnZR$hKj%QbrlTD9+o_r9|n+EOU1IY>9X?<Gf!h=J-iIbn*a+?UQ0P74phPj=t;
zx+QdNc>}_l$Fql>o=bZbjy%w^_WAH3ik1H9tLB2Cc&`f_ZoAt)M#KL8tek^+d;bK*
z&-#xB`Lovfu$vMRhVW0EPa(<v4#$%oww*7r9}b@q>wflB;kMUmSwYA^+6}|GJfYiE
znf?haAG6FP6cWz$U#~X5F}XOFGMH}t*#lp?ycJiR`D6aU7xlZBFtfGEomSz~V=KR|
z`6MSBH|1%;++D7+Rb~=7w*Q&jp_5T-enN@AXrX2x_{Kn#(89cb6Wc0La#nUB{d7Kb
z`>JZ|K_`bH%+b19#U3FO?vO*6x*Klezvy46<_M_xOB?j#;3w+R=5nA!Gtm4%oODbn
z#0!Q%Q4I#+Qb$XK-;`Qcn!F#-Z|l%h5&s?Zzr+yghk7ncp;0rAYcU#ancop6=Ac-w
zNY4~|4eM;`X=e+xLDeHg4bKv~4_mL^&5T7y`-bn>IZa)M4&BMgR-z}mGU(2>MVN@H
zJr#gt9#8kdS4yRyHT=gL^}ir;hXkEIovZTHrAS~_8((;Lsmtbl*64dp)IUMyD7P=x
z+{gq0)^dXS^MY(;VpWdG4t7b5{cVhCi55Gv_&<b<pGWZI+~$WVF2mb(=Di>`c9BoT
zkx&Z{7>lWH<pJosWRG!?ck=<%Sf&yn?Md9*2n0fExt6EwPY?<^NxflWnxWTIojBg4
z_RygnT!Wwec>n%dSoS#6Nomp3M>-(dZ=~Se4US&~&9cL0-~8BPFGqm;!aU`bg6?zs
zoAjH<R>?v?3Rw!SrNr71nXXPfKvgd0Wk8xNT#9fk%Y`>JznS5$bCm;ywj;yq?kCuY
z&NIx+?0zEd7Tk$cGTtGsuY62aWe#K=M0O|NzDDr1;PTz4NtzmWW>^dbgzZuosRNy}
zJyyd%c1b2n+rVwbC(eb3msc&p_2<ur^P13pX2CvQ>$zi0GV!gus1I;hZx`7t=+q-8
zi-#8qfm)F55naK4d$?qi_O<F4XlAQboK30+@H>E@th;1LgTOcbV5OXVH9GoesFi|)
zt~DXb_f<$c(B?@XY~RZgu`zYIvCPDCB0K_)My#}c8Z_Z(!j+{P!!hT6;k=@-WVj+)
z#yTYj)Q-0oP)7fX-XWLQKrzm+h6<Xi`F)g%R;hVo=OV;C@bJ{=@-lWP{{|(2&PZ_e
zB;?DJbJmY7qj`1W4NK1O!pOH}TIxupE^I6+uX^^gYB6wR(f`RRm7^$p?lhKbZQ=>e
z1s!Xw;&$34P2)KhB0n<J$SSvl6AcOtmu{d?dtgL_nN)!YTI&8QHRs=u!*cgWqeGTI
zojj1+*vJjFAurc@6Pn}4q+G>~c!=0e!SF4K1jfdKx3avftT~<dYadYcLeincz;9fZ
zs_Ym`%XWhFIMhVYLhh=lI8Sf;XxBccJK~E-F;7k*kiPJoLC%v?=3ydElY0Z+$op{Q
zZmi3EQMuc2<Adl2ZI-u%mG6Y&GcwpC(Y_oNsmp$TP^r?_jpinu_X%^;@KF2QdVOOO
z;&<A-#<9c3e&*%+W}Tej<?-=J+j5;e5%<=kvAKhOAm=vr#+h9_BCm_-TNLpBAB<)7
zPpG8I%F0)v040MSK8t>dPAn>V2k-Uh)`XQD_GHO*cXt{v477hPa~la%yA2JB+u|rE
z{N&N<&dJq5rz=7%&92*<%S?|oH5K`FMZ^#GbadQ=h<|X`j73;T()O`*;^y3)U-R?H
zKmepBj*4_iXVPagAc6e)q;9b%;5uQ35{V?RG%RH^{P<Lh{RQ$oQWa0&OQ!pm2}>(|
z_GONwK<lOEOF4R&WKh)}=nTnZzdI)`QU2??0&iG&INU=4H|{a=F7@>nI>N>PJe`CN
zHhqRqMP(={;+;Y^+w!OJ9^g|)jxZbVeR<t&X@vzrxATKp$!lvhMO3;Mtc<V%PVK|*
zOjhJ}KkOWlaM3tYc_UeucHhmF)a-bO1Xd;MDz{ZVXn|#QbllDcuo}+1GJX4D$Xuow
zloQ?2uJX$Hxi2wBCmyS<E6L*C3i0oyqBOU*{xlh`+ELahulGJ?hlgb@bOO2pz*wEV
zz2A~T+OqZF`^OJ$V_?+#)3vBxc+IcJ#AtPzoFe@3eZIakQ_OAP5dZV9z;Xha(;ipe
zMdyF3th{`>b;!KTzPSHk)s=gvxEvfR5@80BLW>>qzte;yQXob+Pp;;ro@Q?A?7WX)
zxSE?94!d7D%gBFJP^8EJb?!jE&Krk$FRy`BdU*ZGL)ovZ+1b|V6)Lx&^?C#{0?g`>
zkuHgS|G?BRb$|V<{_(XzpkGnUW3+H<PAzAbyTW87G2xK&J(%GuCI3)i{`w>2J7!I=
z9YjM#Ujm&7;NpIyLtg!!uaGvNy#vfS#m>?H<GXTGs$OK^@VtL|bNd_u2S%j8+@R)J
zo;ZrOz`zj}XZ~3U{`uyIc#p6(CPwx?L^@}P0jJfzuCAlMU`T7nXv+UHxY0L0z0W`{
z_L2M#IP%YnA^+#K|L-Kuzjvtq?R9?thoSi23;a1y|2v5P9|zJQ6lM4l>lNlh`(D=Q
z|M!1p^-j%Q#8V<7mgT=htpAr+{rRVp?+!bK5|JRj`dd}4{=o#>gZ}H^2a3N-V*mAP
z3JN;pjk@>2s~F*8|NVkvzdz2uHMRf#{r_G7#^iqo@&C#(*he)qG_*2W*JO&>M@Lsw
zSolZ|n*rZbWDCA;?0rDvxS!&u4hQq0M`~)$g?a`*08yrW8o67jHx@V5&|$)`e{bT>
zNeZvC`|9^p`?a?6fi1Po<FMKvddcKJ;;1N?FaD3-$OgZL*yC=#RAxHl1P>|c+CF_~
zAFD5@MCLAp^FshN#)JINL1)iN4xj1fmiq?y0buPJ_{qfh<gHa5FLwq;#)r_N2Kcky
zn&Q_ESespuFgD^@U3U<+j*ihvTzP%d_mj3SkJg7TlVQ)UohJ0;wUq1b;;A#YMx3^I
zQ)%NCq3OQ2BNaC~ip_8wj?imyoai$)a!UQ8?CdOxxS6251I@p3T_xoRC!9{H2puW%
zZt!3uzqMJ4*WmTaFsiH=RV~!RDgz?yw9%;);q1>Di~JO;`oUx10oze#x-7JNZfF7^
z#~)K2RjSx=xCVfniN=D@C)SNoQJ>oNPF*}SA#Rk5KD!{`<;?PrT0Zy$n#URa@86}F
zML!^1qO01$#GNvVYlwkSm_Nnxp8aVL;2O*~N;Vb;i}ZRdALMKrj1Ia@_-*J9%Jy&_
zzkXFIz4+f=fR%=Z7Uhmr*|jKBj3UNBwLVytoUH4<dpaa2A3lR2;_I=Y_1T9@CpcGb
zV`zJ)eX&Q_72ZT-e*x+3tI0<`hkDT7W=36RFc{l^4;Jv|eDeTg0@t`J?Ewsqwx2O@
zHZIgVa0RwCsw>2R<EYJpRmpXA1~XI4r<pJK-y?J-Gy%M+KBx}x@2JJI!)Z6OO^3pE
z`~P@yvFFmuqQftOC@Y%&5kbY%))}8^rY76o5y&?qRCi^{3YW;g|L16H%jbD?nJFgT
zq&I5g39ps=?Ls{k3b|aWOaNVhPLA#%2!djfHUi2(lMW`<S*3EVOLTeA!%+?h$Hc0p
zY^g{;mdh^Fr(GW?%OhPT;_&!%4y%Jg>kOX?`2+E5If%!E30#vKGP>Av7F<{rd^ev3
z9zn&f)PjloD=W<drhYkz4<-5|b_lHn@Vabi+xfaz7udL0Gw@Xe|21wpy0%14ZnNI+
zc`L(_uS_ukLQehRw)E1dDcNT)Ip5LDzOp=jXdk6N%T2K?jve%iYixeTo?6KSbb7(Q
zo10Oq7<>kC1KiLn*w#u1P!J#hwOu_5M~5@{uRh+g*yHm;J*C7)&1(PiLliDFf5)?S
zAv9A}%D2>Rul>|^s5_xsqqu#Z9Dc8S%`hD;g%U-2Q=pQ<V=}KfY^WFNouU}XrQ(5w
zw}axtI`z(ln3U#fQZhay(wPCtoR-2>M*rZ`1HXegCpz8*=ciWDJY(XII~P`*-f4o^
zjx%uRH%p`rOr(`d&_kA&_MJMf?N~>_-Zd+@ck0&<UxIHA(7Y0YYw5qOFzX4oVvh~7
z)2GnWe&Q>{rFBeomS`?6pX^B>^X-Sn)96-MegQK5ftHqgq24W{EvAC54c56{GcBYg
zgJ#$5u^Jv{!z8s&{^U`khe6>rXU+&1Tuf2<f)_c4-P1N_(^NR5>e#J+QD)AzMfWt8
zDXWC*|6%Vv+?q_g?om5-MMM+?6i`G^6p&slD54Yr=~AR4O+-L}5G)`_8w5f6AOg~x
z^b({a2tzM{L^=dQq$HswIs4K1X5RPro%08rbDg<{Yp%hVJkOJR?|bdF*V?zpLhJq%
zSZ$`K`UD(DwK=wNZ{LFZFEB7X)<{9?zs()s%=crTuUEfO$1(~{Rk<&ZJNJ^SZAdHI
zeOSJ1%R&@j2V;Ro)b!cu6Lr<ca(`TM&Beo}FJ8Qj_kIS9dDI&iP&%EH40i_f&7%iK
zEy7P}YoxbZ>`sa3)l0b@-%Trg(QK+bo+L!*6gj?w&uahV7xp{&U0Zcl?%|xS*IKA2
zAX*0IncS@v5D+y#w*Ob7{zZIz?uyJq6twBxSY=og6cv%?g$|zSRU^xXTw|K<NdBh`
zLQZnBz{{_vwDGwbb;a&a2llf4%I153MNO&{+zFLg_H2kE6tdFN#u~s$EEqyU?fLmJ
znE($Nsca{W1pb7|witKe=-y7~_NJGXMl9tTCqtW6m2_ywww}(#x5icL!c+#EuyGgp
z<B@XX``6VI<x0p{#jvK?d)Gj?0Hs%*l56B>2C09h7GxB6<O_zj&H*|3REl(dL?|;a
z-aYR1zFn^f6?xmXCs*PI2XFQV-ue9LOAvI495Ct#JD@xK5$H37eBD@p>Jbs97#WQe
zC#Ib_y!#%pPWl_hBiJz_q7!x+rBQAL?>h|=j+&6Kpm>cj#&|n;FyK$%Z#DF40q1{T
zPfu}@wd6H+j_K94jBJ!5Qn$i29zFPmQw~#65sOsp$nybNrLEVXYlvj}c8KMqkPuz?
ztDodOwFu%@5}&$rVAO%wfVM_bAODcYw}W3zZ__U598cd=kDa<@*_Pw-B`xg@S5J>7
z?)|p&l{zXwSx9<Y|Kb#^^mii97HG><XV49O7kR|?$c`Iv6~Im2t7=k1^$ZTC;4)3`
zzwyVN=@KEVRK)+1en4vr3C530;<^-I&0$bx?>bS#sA{w-Eb??3ZENxp_wF4?i^u3f
zshX=R<3ryyA!KQEwJWc^pS@eE;j~|So>C_xQ&CEXd5%uKb~FvPZxfs!n>Vf^)JH}}
zMTDn7q9ZQr&s$6n^&_O6kekifyDzXu#7<0Sc79&7Nem=AskVv}?TQ~Yn~dReKw3Gw
zZXk4ryKd&(sp6_D9*ywMuEZCtcf1~L2;XveFH)V6Q9d^_z$3FZ)tkux%pn*fYnjT9
z`9?)H5`vOO;yh4!tVfS^PF7|<Iw^p+Cg*%}GAuIxej)o2R?`G;s%I@@YZ&pgkT5OX
zqOQ0Q%E3eA&zDp-KbD4Hczy4jVkm(iz#v>XfAL}pu-fF9@ICq!<B=d!eK=^QG1g-9
z;45VrVu86Ot%PN(vddjT?fb*2AiF&;m^(4nwl`Y5Is1!<XEjH4!fk@GaP@b4*;5%e
zUP18SGCpSR?4JejQ@ruXjo@cPEeYUZ86U_l4Em;i?kGZubid!c?y<R=PLy=Di))zL
z+Nl@+y~19hu1(3l$LglwLO{@lh#R^e+)rO<V<3AtN7a-cIVUhD!M&Z?d9qKL<J!c?
zv+iJzWAeLPKFX=>ARYV93g&L)La}tym|#OWmhh3bp7YRs?2Z3S)#W{eDjsJ|)$cbD
zh9lml0lMzMP~S$xw;kS_s{)7^=-~iJs6K(!Vt-wNl;;aii3X&H-}fcH_LBR8j?4Ct
z&CGtAwgL60qa7f{QmoqE;yNcW>&*+W12#0>RSuwpK<?hdIr>@FbFu4v?Vdy<Pm!{%
zXmA;+-u{r~c?%TwPv<C{>SIsOC8_AGn~(L7Ox{P>pKu&}%cu7A+!0e?=rl;m^b6Y5
zAP8N9%BN?j*tdwrAEff5PD)1>K+Q*x19@U5qkoDVD<L?O9GbQ}(eA8@ot<6U+P+9a
zEkK=_(0I>u2&YEX)d(*-vluj!A{R5y0Jk_q*}w4lOaroEpQxaV9biz)P8yxiv4?J}
z-z(=cA#4DrASI;%QJTIlvHVOttODP<htf}1KP+$}RxIy2Qe+2-KuC>HwXKyL{-faL
zjDJ3F%@YGA@U#?NO3-7<jFfTDv;{20jKjc2prjUAh&B<Up%O7pDH-}F3ZI1dT|W&7
zbL5h`QR%Zmij18=rH)XW6Np(1pg&^krPyVaPpm~0CFG%_3l)(<hBx^OIzFRwRdE*U
zbo+`=lC{Bv!#f8>*jwDOXB<5J@~R&|R}T{4g`IkU1rZU-L*q^8FqUsle%XI>i2JWd
z2ETe@Cvf>sJC2J|Sh`2NfN!@2VbQ~r4bagY@uYD0Apx%s0S|Cx&|6vA7Jr$`xX)MQ
zIe(Y@VP=iHcLhr}a*9=O=zDhTx(15)_85v}EjV8czF4IE!~t0>W*=&K_Q;K-!w$;W
z(_Z}mtG=AJ3_Krm@7{W;^WwNKsgA46rsrbYnq!hj=m_u5_juaOxWF)@$ovDCPc)&i
zy7wDH-S4F^|5|EUO0Sp^=t_a^%fWR}T0oB0LwuU4vVP8?7kV4}$A8QgPDeT$Lc<;F
zd*d>YZmJA3am2$_fmg=XQd({jmH5^InyZ{&sVD?A*s`~JRTx3D@7UB_M;c1CmuhFP
z+APgkk~d2mYq&eIY%DIG-XH9iF$hK!GFL;>=~$fG4n0`(`!+7#NyzzJ>2SPX#Nlw5
zjIHHs!{0%VfuOJHOM;XmMhhG){}R9{9|MH(ae2J*$l+|dc%T;ZAK}t>4ZVl3GBcS@
zQ+vk6Ameo7U0vc_q2D(tajv$_W!j~O5f4r+P{zn}3SJ7*8D=>Fr21x#?)Z?+MuRAo
zdn$pMO#$ZuvERA2FKPxl>#ig&880!U?@(^q*}9l&FSn1o?#FTdm+t%ivrIU1m#@O)
zK!Z`<yxL}7`wL`2S9m9XQW<dW8v-SX>%&~O_j-Q8P`N-dbbZ)i(p<Fp9k|Y?qXRFj
zpzD%~F}bH_F(Y<g2=Whg6OyJ0O0;8X<gB;&jcL8sfsyG5nV9zuCxkza<XMb8{hTDJ
zlM3cB?Pd^Pi*nXu7Uu7dJAowXzD9_Sk2XVndsL_%9RK-nM$cMR@JFE7Fkt6iyR26s
z-{&|qi}j}Vg@p?o-o4vbIqQ2oHJKn5py*TN@qJe-;%<Uo_?vBWtD*%UFh81eUUv*J
z8@yKIZV-1=Oa9^@ql&)4SF4r4pdD)6A8-3M;G}^LxTgqL-Hw=87{K<3dSzL?2JvwH
zVU9n*M7`?5b?jNowr^79po?h53tV!ZKb|jYo;c~kawKi9Zm!Z05`j?r_4?`;*t7Pl
z#d1a&XuC#vM!wYG{CG<17B9_F#{MqeQlEnPAf-ez6s#!-Psp!RatV>;x4fOIP!q|3
z=BjVIb|2#08cWO1SDumVGk`Ao)655!>qi{>Ic~7>Zxbp$unrpfb#yM_dUPd=t%=`f
z_cXS!EmsZC-sIWAo3%r)RfjK~>gKA?s0K|8=pV8-IHLm;WoAFIN_s)FnH*zNv;i{n
z-Z_|SYQ`>ctN-S4Rf7TtZP16QVkVK*Qei3iT>>Ook<<dSn<;7{cTBRk2!fm8!1xc?
zr5=^`+G#!Q=U`9Jo05Srf*wb@pL17np6i>>Bf)$M%w?jEf6VgRI>$7M;2qz*>k?@d
zvxIbZnxm!Em%PU!Q99Gp3LIq*o^|GE&tI3iX)h3qgNF~Bi2eKRofhdT91}VQCq^T4
z`QLeT%{hs396GmVzEH{SyKjfSmZG<i+MJ)wN=eGis|N`}#hY#L)vF!Ny2AUl5<4!W
zlVxiGSFYG2cvhS4jyP?s3uw$8JM<1>13_nI9Bh|NWJ?4;pwS1YbQ3m?BT8m3DzZpY
zeWS)z2Vsx&Gv?SouK3gOzks_%Sw78#d0(ERJtNTuQ*8$&AslQq_IkTPzQ(2FpOCV7
z%k;pa)_uq?-vk{y)dl+>zdD-D62K~#wQ0#I_c=WU+B)Tr7ez|m`Eu4XGXv%vlOD7S
zm+0($Id}iTgFE0(D|_+5?cHlmoAZ&C-lAZ#?aYyjCaB2|sckOEZ6KHoFx`)nd_&hZ
z^2gIk^9;M)G)IffGSZ*lM#Mn7&JT%>=%>Y*{U2u6;fzmke?0*KJi*;by9H~$nRQLt
z=oCLZ-Zu+M+A{wgdKeKiUnn^cYcJT-G@YH(b5!yUzPMdC$ZRT5Y}0ZF(OWo<RNp}S
zry+|-PnV5*Xru;Y7AmlN%nYxcgnc*V@gJnuurIiDn84nG=p-;5lYdbagvP%u`9)lK
zpqFiK0bip4$ZZf51)89;f~B=Dxvtn$J5KS!>CLNbE*G^ZEroG5uZkjq4UuBt&Yjk$
zG8Q)c;a@sHuy9j36P*l*Vy0)-Wq2aJBRBE>WtTg*44C9mlsM>a&DMNPCXhkl{5h-g
z9sGY8>jE4g@PH-{y~L-m7&1PWs&0rJda`KeE|Qr%{(jx?&HywZdl~tHqr9x9`OnXv
zbvx>yj#oXCVj1C{;$x^k1GW&RD-_-4q7wJV&ei{i>$kLPVfUGCtAHV2L`nqep;?lP
z)O};;K>yX2E6JQkK>DRkl5&?<qG6(4?xzNQ^D1G5=k;`w3M&OEPqI~Ue6lYi;iK0;
z%EbCG4)Ztwa60s{nEQ>@7-q%n?aC+K%^u2|G|3N@Pq;24O3`@uklAv6J>2DL<3a9h
znVc6!ob1pLM?8aXzhR-IxI%0jXllUpm9g8J)CPK(e;$LhXfb%6Z0vUJm9A@&3NGM_
zFw0)w8L%ss6_5T%63X~osfs9I_VEBc)Jb9f47->Xtc43kxc)?`$3H(CSiNu9k60AS
z5ED4S7{qL#W|7!Q+>v3_!ab`v#w|m6>|F5Qrt=314j_@ba<ZbX7pm`4YrndO@jtH#
zb|IB@e`5~bUhrbT{GPlBC*{G2TfV+GpDtVNbQo?UZSw$a0~^k^dXMk*N9+Y=TPD$9
zsCs}=!SV;988-m&u*3t_L{i(rkyC;-pckGbTus4Utac9XDkk>qVT%a3%<m8wy+yEV
zQ;|;r$wmQ>e`TWvfJkLO_XKDOn7f}vssYN%$aTgGx9j3v&aHt_!30K>kYS3a1o7eo
zPgvyA!u&z~f?0>NH87cf>Z~ijxA-d&H)~C33lj%DePnoq0LB_so$KCJ7N%oW3iFB#
z)IDep00ZphP@rFen&d7pieuiMK+X)8%DgK-%}#UBM>hGu3kq)$8xYdM16wY5z(uG*
zKo1cJp2Cg#uxL}w$-rT`%3k?nhn^bbE^x<%*fG5|@j@iS4p=pW4uTLn%R}<oZ_fo*
z#=lAmr?nuh-oK}(2w^fl^ao-(*As4vEg%bd?SEw#w;OlizofB$8^ZJ2vEVKLi%=v`
zRcy8Wf?jEyOHhFHf?|~*2cTDAPm@9Tb2z8gXsuOx)Q1R#HGwe=9uBqzSL?KLk&n8S
zy`B%QUOGOpOYtKy$0_3HK{d+ft;DNZGKUX<v8e`PD#Ed18Y(5nCsCZog$xQbgIPK=
zf~`A@cQZXu^hg`7Tnls^#mY#Rew~@>A$B=S-+#DM4`^h<)xTz*?c&iK=ZCN)udFEY
z)o6C{!!sWZ)3qPes%H@yo!^@Wg0U{S@OYo)rh4aoL_sn-h`*1xK3#?eQb3l)rt{R|
z8kiz<kG(HAwtGjZ$0^sl<rnP@4P|t7x{4RExrHHH!_3cuTy%k^nEBiqq$&hg;^lJ&
zV5_IG8?DND9(qiD>Q3ErJ~-}Of$J$|jmhlu-R1HArO8+wdV!jI74-cBO*H72>OOPb
z_gD0Bg@$yL$s_K**@RZLzf@^diDG=z$crD4oXY2r25)zqYsk0MsA8i_23zCN<QR{R
za`G7OwxdcZ3TH#G?{J?Fh6yA)PH6F7PdcnyttmdsuX!`mY|!Hh=yQs)>8{^*8Lfi#
zK)UYcwkI+OcKFjZL~YaF@1i%@s{2i%F{T3Ua<E^wfQ1O59oNz9Pca=iA8=uv)B_@@
zJ-KtiNw1Bz>e$(F=td6ob{Y5jhD{+Ay2!i+7vdG+e{^uytGKJ@p-^}j7qDtRZG0um
z=8A-%9*e5@VdfHZun@QF#Hw1vsSSC@%rv_ZCx*Tk?ByY_uAgI=yD#z(96|>!$z!}1
zw|chy5x&O*gx;Mcc}ksL<nOWz2A|ga;MviGOtG(E(_vqz;RD;nhA*NpcQ-cW$5R$I
z0xPW294>>SW`bYiS=zYY?G0tOygTNDP9-l#Y{$A=ObF{cfOY6q{Z=q}$8GrIm$D(R
zbmF14%_<pEK~FC&+1T9I`d8$djn6IHn#_#}o;*0W@G#8wl|}cry%H!nwK?Tn%=erv
zbBI63)eyu*{QjjdmD58t)p4eSUYxbtzagW&Yi}MLB$Q>h0S}ffZT|Wh;U@jPx13Wi
zK~xI4t?vNyopB@e>S7>Az+%<U%QkqU6)Z?0hUK6W-(zPSB4IhFzj}Pvv?OyS$A8hz
zh&$bvIAAac38<F0a{eB|`}|T^GxVLCpz4}eAQ|MdJA%^HkD7glfIaddKFf?L1`6<V
z`&-p&5li+@E;s8_{1u-Mhe?0vloruXdjJK|6BZevd5Jt{Hru#^+Im}$F?T{>Kia&n
zJ<>aZF3h@Kl`}svcHf8f;G13s$hhq}^G~ycG$(8kyy#u|@L8X7@6b>x9Zjmn>}P5h
zntv<7zYUI#_tve;#{aAsMFB?n+d;2=QzeUc1|BWUr93rOa-*LszfSsHk)aFABFhJu
zaBx_ju@b#ZkekoHH#BX{sbIN^$_jtun#C@4#&Yf|k6n|RwRMyS3KFB=Vyhzu1}tf#
z75<l=>=jVtskt*)+N%>+s3u%tua5s-6yO%7DqL)&S1#Lf$?MW_&G?9qyxRuWO&dBg
z%j|Bs`m3C9<xOP&s<zu3{Etb?A-B<duR2k;>~9Z#^s|hwR;0uwyImr{CW;3-n2VY;
z+0c5cDCctK^i4QhRfiS~>N_PG`V%UE{#nBB2&8ZI1o`n}ib1hIA&%HxPlq|<!e(3f
z)M9e{P)qk^6D-|3SKTOHN+kO;HD<b=b~}58vRo45SNtt_!iWk`%RXF<wU?<;6BDSA
zwYhoXZK)&N<|A$=s6a|R2R742PWSAW*(Q`cvg_qn`TX73+;=S!itRh~f*J0^f9?if
z5;zUZNQVPf{XO^_K|q@ZnH-U0FT@0Gxht;F5`u73gI~`FTVh7`rl2PwMO%GkMk`iT
z=;o~j#sBf1vm{Fu_lchPU6=Jeib#H&=;<Ef4|-2I#$Ti61UcAE2@K0_>}{V0x&mZp
zkBOv6kiE2Cun~Q$%X|xpRxg9H7n~-c-5&3nH=GIuYeb}Rwo125WLg(q@@h$}SfgcP
zwh8HcsjXc%AEq$rCB1&Nr4_r%wcFddP(GAR-fx>#$SI%{Mx8Sis{-X%xnGGSEP7N9
zayv9v5X_G^Bk20Sn(P)~GB1Ccbb6!uP2)>|)p!ddM6M9?S$UM+a@PK`qVqp`sC)WL
zaj|m;9UeX4$15kV3VgCBU}Hw?|3oi%CEoaPTy(Ae;Nc=Qr=1kNL!IJuMMVI}8B`c9
z>9F1|1SI<~rBo<OOReIgL14iXKDhC9%<b`~pFaZpdU-IcJNyF6w=l7=d7p*^TZPjP
zMJy9#?Pl(~@Wyd&jkJ-t;;W5Wk+KB+QU=31-tyy!=uy42FqW;yWc-iq8EZ4;k8&ps
zI(Z1s4Wp3;6@&H7OPvoXKMV4e50pGhA5d=Za{@bOnO&Avqy4^lM8>%>kbE}i*On4i
zWIpYo5#V7|QMhZL;k3|$FSS4AneRwS?9{VQ5Q$mk<8kzKNy##F9yLp3QMXkX$o>)h
z2NDu_k6sP#k#>kS<L4KIov%NLa5!Cra9#e&Sli$}zsV4wuOHh^Df+PP_d5s4oINuB
z3*VC_sYiX>rmYw^rX3fut~Lem7G`ETS>JYJ`gD8a2n`6_GXwHXP$AlaZzJP^e(@b5
z`rI+l7;*LXx^(#8GP-RM=kCul*P3V9Yk$Q5v-&CCm>nW@DzKQU-yaWV73IsOtJ2VX
zECKe?`4zr4Fb%-&&|m|vy<Dr>pXZ)iH+0w`@;HKfKFfnU_~uzPMTodJ2f0P}cPxkr
zu4BTzl7A@rSn_?={R1pl;Ynd!WH8^q`>tN_ANznra#>k}TX_NTvdn2g8OMiMUAL%k
z&|&v_(f&+zn!eE|ku<^Pz<DYb2R82FlX_&6fy%h>SZfdAKn;$GTLvv={r%%#66Qml
z3VCZ_wGCa8HDrR(2SS^e?(!ss4QwY^*0Ea0bShge`Y%6;OZoHPC7yh<X|LnP@d5G9
z_ON;(Nb(!W38*O4e#PzXfUyqzH^w^Dj$+H-GWWHN^ov?8T9Sv}HzM3L#7hi7@8aHK
zaBR6J2XMB4NWUj6Z%18n<bkf4P6=l<NSJp;ju`zSt5C3Y4i!>;9{Vnhr3jX7n42l>
zQJtI6FlCClh3x{-bZ2C>V*P;_#cf&8Sy+KtEeM5q6eQ(-AH|RL38cARw^@S$IZy>W
zx$sVsGs6b)jpuXE=P1o@iRZLe;;AWrXL3$u4$*spcl|_;U!WMQ{62)s%~MoF?CjM1
zin9Dy=E>T&iks)ffQxXui|SlVu@W-q(miz4SWvtwO4Y?}X{cG?&l-@(>a;|?*QH2>
z?%$!OBiK05yO71w(kvig$aF+s#tjSyFcEZ~bbQZX(7oC+ff}>rh<JC(T5#w}H;nlx
z-6P-N7ku(AjL1ow*RoE}yo<3*viHa*zU;e}<{R(T?KqiRAKYwfdH+pwgoeaYI&)TX
zNnT#_im~Mz?nD!znsRrNJh&~?U<%1ckn1PGPz_%i+lgr#KHApe&A<>ni--J5MM~$Z
zz>!xFlK2rZc!Oc$D4T-u>c)`ArFYee=pK$6d-!EKf7MwBW1F$%m%1uhluf2!`)GRJ
z1avr&le2gntKvfjMv!a(Om%9<!_dp-p>G3VCs5@tY<YwD*n+nSZi7(|xmTlz;Yd@)
z&ySyg|E9q;&lpgCA~V2jI#Oxt^#u$1!O!G9cR!&_d91eyWhTD?r#g_hE4^5bk{Egj
zv&c4~!A(9HNB=L07EGC9ku*0^y{)ecZWJ)jtMSgi&YCZsBx1S9XhH9V*mJsWrFyZ$
zo<b3t@`K|$-ZO07zlN(i@ov?jv{YC7XiE)%_o6Dw==JrZ`bano-t7A~9J;vJS~MR#
z$ndjv_lr#DSTDqIUf3ELE%|z6GKAIixm3I6I-6SP|7Zd3)n4<NM0p*$k12hLmEXnh
z@bMVb9FBd3KQHgkaprj@@n53Bf~O_DH-%~lj+ud!xeCAdWc8yVR+gF6M<q{2fJlAF
zWMJ{}#Rw>9CDYRTK&a5diI$v0V@hbAAKfViKE1=kweeAomXOBV=T}+&cGdSL*pkH5
z-kj%wWc<S-wBCY$N^klq-!>thkD!+A_PPX-aNh*~<BlZkx}s@s!_19N)C@)cX^QW-
z_;!2k!j9eh3=jFAP0`nzKI&O-g5Hw{LuPH)y@9B`&g2`WrCEHCufT2ooQ##^<uoNd
zfzjckrU7vVI>qjIlVW@sH1zti@fNExuyKJ@xg}fgy{a%o2hT_7!k<Y@WTWf%?gW@(
zXerj^^#~>`D-2v@%rhruZ4o@a-?`mHFtA?gd^cod#wahp3g)tTe<Go3kblFCSoys0
zC04nvO_BU(_uuOgB%`2JiTUGFw0N4M#L*5<ZMJVyoN1^NZe~pZ0!j%(Uy(#icW3BZ
zte<o{;v;wd?7IL(epeyGW2`T~{<*&2lKK+ym!iJCb_2Nh4md)1BYqz52i8}1^_VI7
zSoZ0h*puhaLy|dkbn7ugrbi8YZeh%(EmQo1&f7ICXnZnyDf#myv2b9)L+orh47q}o
za=kCuIj~^$&R|1!Rq_q0A#jjk9e9~AWyKXl+|K1-a$UR%tf^|>w#tOjn_$KegV*8J
z@NGfC;U%(UHvh&rc7AtW8{r-==m92NZ=fk9$!7p{guH9k^O>BKynAgA(^efuJ@x8J
zU}5R3xhdYLq9T_Sa_`7z>rwMdj>)XM#{L(`mhiV=%S!sP!5RhzsB=e;NQ>`_F2thf
z#?~e<+zN3RNux)Pu(CxxX|g+UU><-5(zA1ztticY!n*M*S@sD;7d!A9wUyc1&WpEz
z(`29*g>+qj;w9n=6A{}Kq+5jYL59FQzEm$gSs+xLWi_6D^RakUIOJKN*O0y~Mx+dx
zUSzEVzP9#7w)8D`t8)Ki9s&<i);hA~+^&0$U`o@Hq9P7IYyOXMyYnLUTua1n`pYxl
zjm*}pgLbH+2MLh?kt~^(XlH5)hUhV_Sp}Ix#Cac9WzO3Z_P@s(kU4Z_|GfFUT35!@
zsMLnm4&0iIwA<ZL7z2V(TkravrU)(#K|1G@-Wfv~1ID>~B;AC%oD5c}eCQQLix6(f
zUopG!?HG14aik>_FjABFD%4jufW*Gp1Q`=)n1f(m(A(JjIMppKSp-R}xlks|N)$9T
z3n(eT;DRUN4;D%2+nAiet1z_Vx;3NvHpu>wejd48LvH4ia3?pp@m{U6!tick!u67+
zgJHDl{eq9!q2Xjm@`S;7$>W#6vt{q;<aYEhGiL6nr+w7?LEr`&WwwKl^&(C$LRrYt
z6;p8a73&*Xxz%>6!#9i1y$9oYDvz29ND^hJC0hbVt_8u>k1J&+PXs@<L#6_Sb8HjZ
z$q!3ea&W6)SAoTjInpJLWoG7Vm;vV@EOUCUvD7#IsiT8KGW6l@w}L_U6pyjb8n~gB
z>ndS-&jx2MT$EJa+gzaRdp+Otu2~G7lIZ%jx5Nty%NF{oI81if3p_P_-s#X;7(p{G
zv~zN;U|SY+8#AZ}bhhfC>m@pCmVd2fC~K5y3}{P-j5R}VhT|7o<MO|dgyHZ2T^Ku-
z$$@3CBC`|HSQO^>GBpg!z;rYMBO;qrG+`w0SS*j12T?D;9F;oP8aq2~PzN=BM{Q?M
zYqC20T(BksT!U4Gw~yac6g&N}AVuq<E!im*pY-XC(R98(RE&y{ws3=naA2pym2B7b
zmc4m;(9VpPMuiC8-8iH-{V?+}sFViGtJ~sAfZEa|x$x8=o%W>huW%Hjs2j}|p5F)S
zn|!b`0o@$m3nv;L<d#ap{hl9iOHFxD`j6(Je3-28+J*i3izP3>xZhs;LK*^O?XiS|
zv%(Vos=cX@j`_a#y=8Z6`j$-JK@HUa2}`ps8wv4bX~oo_@-X#aQ%<_oBqlA5)XbHL
zQAg_8GLO?R#NpEB(1fZV-bvffVq?4gTFDU=L1IJ)zGVDBh0H9>y=3OXG^^3|0*)MQ
zTmKDqVWqV6_!>`g7FMgAI()b<(b4Q|&0f%pTtTbE%`V6?9pus`S>6;6Q{gL^wGh{!
z{?sr*i8$7#4Hw;b6Pn(S*pSu}MmmGy?>%xN{Rt%AJNP`iNS5^*J`HARq<LQ$Tf<$z
z!zO+R21iI;WHYdU5j1NppuRa)=>3i}t7{+_mLN9QEHu5u<B;3@L}MwO?~-fc1vUrQ
zHwWC5SSY)@z?`X_pHg6VED-GfI<L)HO<bmFpK+NgwXI*SIevP7!g1Xrt}ome&7r~A
zo%cnr_W*4W&!w_W2w^O~EeAIerrW8(O$SfPK3Y9#In9@d{<$}Aowxd?B38J4EH(5r
zkYdSrtHmdk0)`#6O@FnTo`m+`_Wx`T{yWw|67+DK-t(u(&@Jj^V4e*ECy^6l%A^b8
zm!7V!J1`Q)kA-ty#<;CaMRC)o)xPFG#ym*;1@6;^gH}N&1?HX2t<=h(cjDKyqu}Eq
zH`C(?YZ0_VPgV8%@SpK=AMaFjhih%sQCAO**#%0^-S|LP#jHDbBKM}zFtP9)CVqA{
zX?;#pVi<$AM2A1q%iDTe))xoV^-^$toxnw{drF^Ci%|n=DHD6UkbD&&+R^<4COV8Q
zG8ClR@*Avc`B+Z8J_utMVCr30^KW>%7!vO~M;_C6+XlpA1mQ7r(xzY7a?|d~HI^f1
z_vHdqHq$-1&^BPbiUkBn@C22QAqfUkT!Z`W!QoC<a_#l)QFefJ`IJ8vNv?{hrUhu4
zPZM4sWBo`H88?Q{Cx=aG@ear<gJHK$tWAEf<a*yUi3Mg7Tr1=>9Vq|aCUyS&jRM+M
z@k$`u9;b;@o}G4k`Thd$kn(|@Zey>rnRtnJSCpzQN5F`{Gg^qmCc1imMGRKu>S95D
z01`!o*6n8}AbToqD!z3a(?=Y~72Ojsgdz8)NLaI4LUh1d$tU7Hl3|tAc6TE9p9ohd
z9E0&LxN0IZZv1KgRvsr9CIMt!qWzVj>`vgyT63oi<O4^1!&prb+&s4t5OSA~$76k7
zN_EqI7d+{ljboX`zOZMXiA}U<IuJ$)pErHq=ooQEG{TDnP2QE~K+e?_&1U^<2zK75
zfw!Q-P_kZkO}7xudxX!Hg711(j}e=v-fsyc?pp;>M#@*_a(Jl2ibe07AjR^meG#cs
zHBslgt}ToSZkE{^sWS3cBF!OJ@#;tEyI|@@kizrouq~OOP0PDrF$)tM#;P$p^==VM
zwIB^I%KbqbGZ<dFJS;SaRdoYhN@?}}yP)IhZF)S<Q1k!kQ7NGH|FrtWM;u&Nehj-0
zhv-QZGXlBdHbQ<0W;_x=Fp~!JOZdOs8H_mV)d*Cm(SYEZ?}Mg9&Vg(?X8e+u_qdVI
z0PkNB4$GkUDLFp|<NcnFf?ByO;HcZnuXh2r3J5&`IhCtR2ud_9?(bm+j)!r8cTo)B
z2nj_9QvoBdc*fkFwB|RsBWD*}&cixv;K*(^TUG;~ljf*@C5vehP$bVCMnAIl0Fh^m
z2BX{bkEOME$k~!&PloeCQb1&pu{%iaPS-RWsiq(NTT+zZ9h$V$kghk1iB=E!UxN8R
zj<@!AC@_PmSu+=E(vLr}10u+Dv)Y!A(Esi6jN>Y)Q!Rfw!?_f;I}b!?Pn;2{0AqN4
z*Fs6GgY?8eZ^heY{}dQgqUzE&dN$S=UN&GftM?)?jCTMSZo%ZGwVvHXf@UXQhPd$R
z<|gy&ZxszN#ZGNop{3SQs*dIDVrYt^6EW^QI&*Q}%TpKn6$~rCbnIzecpF~qkhVYt
zA>KF6!TRcC6_eUI5A$=QDKJpyVnmCK2*BZ+Wbo*xr>E<)QD8nwj*29V<pLGOv3{<=
zvwQ$~rwKAL4&q_X()nb64bJAie0j{Xu4~cF%thDse*1I+D-keZb5Qtq0N5acX1lC&
zAq_cO0$G;;0i{&5tFgZ&T(Z>VfeX~skhy#ub|B83lzF)tqmpg~QQ)o-#C+q^Z@_G5
z+0sr5JeGo(hgmY@6@<N<&4;fm67p}_OZA0J!?=K+5v^z0dQ>4m7K)qgI?$u)<vlXE
zYU-|U$rjP_<(lG>t)*Wq2uYw5<joQ04ntsm5fzSaeX<Bb`oBTOnYb{xKzA7G+jW8K
zz^)sF%Pk+hmA;H6G?&5H&Q-2vZ|4h+YsUfU>V^u#XrPPsg||K#8quy+O-(-2Do*eX
zeP|lOV)$RvGn7`brZe0B(-Pw&13jZeotz{fT(q$f<-sr|d2E-*Tb3F6EBPkuB1>A?
zH7d}~NQV=&zHek$jKuP~9phs+4bLN9#<Y$EE$CaT4TOOW+0&h(;tZnT@3EK<&{9kS
zl{cb99(JpMtnKo!>ZmC*bBTu&h@+BV_Q>Zy^Zeb2Efc#gfBgCfGR1+qa4@`B?v+}i
zlseM&N=THnm7e}9BA`3TKYGjDE#>HoIXAbRNZTfq%{u`NPdFkz2qY!fK%Ob7<OBQk
zdEu_dia02ER^JD|g<*qxrk|QFe*#*M*`zOm)DA;3LtuU*n1UzI9_n*ijo;@99aeYL
zP>}u?D1D?+Q?f9aWePV3@9l~;2e{b^O&1t`_NO`65vS;N(oOzuflox!KB;it?x{HP
z?f?U(@!f+a_kE2)-CZE`IR}lJvM(brG_PDk^A>=O6esJB>1x#q&p1}-#rS4U)7xb0
z8?OB-XWM9R%BTk9yCN`4Ck+621k5?pZPyfcETUD<=WD?bq8aEi-8bCuC(LmmZTX8i
zFeG8L_S+|2zHM1xr8S}(<~=SOrCG6D6tTQ7o*0u9e>+~>{20>Dgpn~fpvD+GS^PHN
zb&Kb43&^IB`HqOR^i62o54W3QZ$1B~-*lc74WA7b3XN~6VmVwPFt2ydi9|Wiuf9-i
z>_qyrh!qyvdF87Q=dMLpzwSqXK4dy5@1O+@d^!wOalC#8296^%4JdNYfqj3Z^g7?U
zOLcdC;W;rxALVUO=BE}fuLN!TE-;>d=-U&f##c})oRT0L^IjF1e1ZrJ2m?l*D=+u+
zd^Cw}k%548KY3vYe_8rs<KDj`SV08o!G3`miEzoz;a}Z$>VYWt38u*Y<`Iz8MI(hA
zqXQSO(4;Z2#+^eliJ*Pe&Ux})@btxj*Y~bQ9(eu7Yu`WiiNE%Jedd8aOC-lOzQec8
zLQHon?an(nDw1|Ua=`Q_>RY74U>_=Y%0@YnbZ99kErqK{_MMQqoO*Aj8*h3_=Zjli
zl_Rvd6bbcGCr-wn#z~hV*g4`hi<}yX?(~be2a9UME~M@08&x~^@h9wjbe?)4c$Xe?
z_l8Hz0_i~anv_7tefcKQMZ6|2SntzwJDuXZ)rL_d?y>Kzq<RPU;aCrRMlg4^3Y8k^
zzw#<--?0#ynm8^ea)ib4ZeR3SD;J+$Y=6}HiAj#ML>5fdG<~%x)2Xov<9UgU|N1Vx
z<92+!g*5e=D7h@AO@)@77QMC49^+Jar6#7G>Sw;TOi>B(S*o^Hb@yStT!FE^IdLeD
zr)#|Y41XfCx;)vwa(Us~>UbiTa(sU3Q2udK)k*r84U-;oA$3tcfpJkDr$P^Y*c4)v
z-tXG(elf`MkleA{s%jp`Rn>L*MLl}8)Cj4N-uT#yp75+LxFn@o*n$?+5YVyZ?l<_k
zvp?^{2{O7e{tiEy7@MDI=}vIne{63$S|ePWW_hoXVdg$Zbf2ysL9Pbm!SRnb3ca11
z%fG|HuqvDq*zH-m^u=2X4jByHD`W!WoG#<dtE^+_$+^zK!7HO~s?+8kAEWJkSeaSq
zm*OUo%bvYUz4B=E<C(>-*4*#S&V^EN5;vS~-_MRq5Jr=~43s-45!r~zoN$D&?9U%{
zWh5#qrc!*lXF^aH72!EQh_61iJYasMCd1gussQ_eycRtl`ffZCEr#EoS+KCZQQ=gD
zJBi+Qx^*?TMc2erblE{Am2T3}tJ^!jMUdz0=Hl5*I8Ur})N)V3(Y-g)(b)=vbKlo_
zO$rlptzcOwwZFUPP{3q*c4OS8eud5vztBHx!S#G4K-q*8Z5_|nZ;Uo4qWc+14jYvC
zbcHQe+6>`$h4Pf=j039E(=XOTv4tH~AJ(Hj=`#*kp*9;sMH<~(I=uBac$Zd5ue#Ut
z&BQTIaks5JeONm;skO6SM6r!RmHGipX?q3cLEht~yFpjpNx(C?{f^Hy;Oi|*qgqet
zLwtRVlj4Ka<Xeplp$IanlCJ5y@0gm`DfbL3b67Q1xv`7Z3K^8e7+!1dSOVPVSj?Pb
z+=|;U8M_hUWh~O3@mFVOw8vwi%$tGg0lka|v1^p&1;eu(rZ>eHWU&!EN9u-4mqqH5
zR6_fPJS+Kz|1Fb5I0`Xph|#`YW+#m)QT!xaB{oQ{h4ZD@gZW|2vtFji@sp;r;0;?U
z8L{oCd-ZKzIqcEt7_!(h>Pa!aWRTrdmFiiSzy93wtkTuz_(Cf)pDT2VI)yH=?5TsJ
z{^6gGPis8%q>%w<AK69r(W$>z_eThjRjh0{H))(q8q)_2<bHj|IX5pjQQUEAa>8nv
z`hC_bku2dizD%uOWULlN7j9W@u=Y7K2|s6c>9qw3dOvqqIFw_Z;A*@{h)G!-SW5ed
zL7!SC-#`Dpl#X_c`Pte5f$5K|-IbM<zJy3ugNgT<@^@&h>5ok41Y76tt`chNTh`u|
z;9`FY2V^!OXNGGCsa0}qMqa?4t&(G&HL*c5%T(*;qIzhLaVq_3Gn|vypVPV-#jk5r
zB?fztCPO+Ix2o_hd)?G^s%h#Yw-LLHTd~+?sR~2|Pda@JI}>^<^a47AlK-4Ai?Oa&
zA&2^otG~g(`W?#GXS{{u|N0~uwSoMb*B*6_X^k-{Z0gVBMq<_|F;WYI7={UPQYU-;
zGi4>+D_iN4`l~7z-Mdq*^G-5{-D#BS)x`z|D_)M#<lG>f8$21RVC3mzD!o0+KObF`
zK+bJxmz}HBqd%jh4`k}(te<n)Z6G(U<V31(#oj!*c4KLc%{Xptv%NiMXs&!QRYt@l
zl^!ZOF3hXNctfbJrk73@2cY!~zpO^+QT{TI&aI#e?T1s>A5FE2Ez9L)<mM_YR4_Wy
znf4U6`{%o2LwYbgS&UWVr9u;Nlt6c9XXh%mP*|murX5a`&`~%q*@FvPD`$L}?`&hb
z${_a?jv@EgU9y&>6lqOQBJ^}uv!V?sGp}14`|PHcwG~7%7*V0m<u|-;5XkCo73`=(
z=@RjbTWQO#G1K{z>X!7d<zktI;ICi5_MqLz87bpQl#rfDmW+5$+|B%lb*ayYWY%!+
z`LrecJvbGuhe2g5#;A|gym;jd(JD1+on44QUCT0(Sv>NWcBsPQ%In;I-@wRv+99F9
zCuK*{5-8bzc&4=F!g_lY4Eg9`oUC?2yI?Tir~Zy<(R&cnk4)BM4Mn;ClG(tro$Nha
zge!Q%m06Y0a#2oP?_50`Z}NVP(jmREaX{EwbP(l+n-(ye_tfu0wMJn)41_#q@|7`f
zqV7!gTn=vJ=<OJM>C2zeZsR4EVRCo8<JP6#jSNCZZ{V>+k<sVfYvuY?9^YS!?z1?M
z$4+b0b$a&9qV_~UM#=ahMxN#Ux3JcWBW@dV(YeV*t|kxYfp%xT<k=ukJ1?S*!`4jA
zv~j3b;hf4G%1V|f$4xORS&RiEp+cSh)G~nzNn5T~@6FKWwxr9tz~ecQoxL#@@2-o)
z&1}E_6xu00gS)_@iUDJN2FHY36WhF^XT7VL_W2HV=T=kv+RP0NDD@qTxr{xeIk<_2
z2FCN7Qwp2uG5?b_Y$?_i(W~-Ou_QPb@{r1;=S<9%#J&*pSPLd4K_Z@XpouU|v|6a(
z7agQ#rEgMM!sI!g_gO0QT9K$(gy~B9ktBWjwUxp)k}Vr;rfZ<8;>wk=EQ}E80cxI?
zogpOpzC^|l^2s8SPu89GXX@s*oU}<mFv0-|T;EUYA^$-d%0(J)O$#1f-H=;M<VI_H
za+7EyuMU_f@QZI35>SAj%Qa)GMHu2$uWD~|EezkGL!tEm0~TA-5-p7dQ6eKFa>&xs
zqYke3q^C?9<m&|iFWeZJjZIq#e3p!69qjJrnCr_9J-{K(+1q3#&8=nC{$e|m`S%$0
z@gGSP^C!dkIt-?IZj((DRZIc|$;`}5kZWRgD7;PT#at=YDikW;vbA`1e)&K?WQk;X
z?^H|L-BI|*#&(c}J9mu_P6g(!s}pr0%*}coI?2fyoREOCaUy+KG1ob_zoD2YV+J3V
zoSf`ZE+LfyIq_hT`zQK28J1hOZjJr;dIPza2Dsp4%@*%J3r;kcT^4s7I>I60V7t1-
zhPP=BrIRpAmyk9jQJb4@&tvh&5>eHs4GbtJ$!OiWI$k&-w|$`0_O2H7z1Eu3j18LW
zLtDGig?#7k$euHvODhyggLR^l|A?nS?D{HfeD(I;cvC{^a@AvL6B*|33?Z%b`(}{!
zR-b+6?;I*8eK0w1_UxG?h3FL6(eD%#99ujQ!edoCGh+iYM(h0!#G2LlsXBkIGB+>}
z6E3jAIKFK#gFpFnF-n9Jz#N=}ST6bahpAR#pjrNL8TX=kSXNdEWzR&kXlwQb<I_uX
zw$cjxlU2CNjzxP635Yi2QU@xZ+jUcCo3Nw{h3V_~ujQ_DaD-)Kvh;HOQ_?G|F_+$E
z6}o+Y(4ZIIN~;jh5kl_3idv?UqS&M7@WSDI0r34cfO|PKwy?Ers>!=p9>+h1Z%F$H
zSy9{x$DWw8vH2O}{qIKR)wD#d=To-YBn5lH9;m!_!c;k6>#?}cF;zWB+x+4y491Y%
z16kUTcPlumAJ9@JxEOPyO$)oYrbDKlNc<XyP}6p~=G~HL&ATJpg(Njjm^#ZU1BkHA
z#p7JiAhqjBP>_|4V>h{=_e^tsqyl}=X>qaP?@0?&ep@3W65;2#>DPd7TLQ<wn?x!^
zv+E(R6_Q#DlBBh{*lkaKM5WWemQ|NEv2I5uM{n8kfn%4RrZ@bU`RwG+;7{}rKXySL
z4$6~11M5blUxJB;XDnC(9|9;L`ci!csi<GK4UwxM@2LlyN9jrdBVjJ~_j%~cZ~wW7
zt&i==)I;?ff(k)zxSz}BRM8t($z8F(k{J>~Nl9Z5@Up)y!H4~y==}XQTYQB6y{KO=
z*|J4{f8M7}_^JPAvP8kZ&-w4ySp56+{{Bs~**~D-@8A5<@DFbO`!}Zo|Gntnzq)$t
z|LYg@js@+bjZ)x)<@NW!O~u0HgpG$jXRfsWDk}cx_wa(kZZ;z_?NZG<b_AaB)BpJf
zV&LU}L$?3_>B1BE&-GV%b<d9f(E|K_IREcji>C7Dj|C#9LzY#a_<jA4A3$RIJ2_e1
zDti#{^?K4n<#%mlRoR?4kD(GX1mUJdJ@9VBQyNtb&7efgHyu@W#&S}*mP^ndXXfYM
zy5kL556P}RmMz{)*MswZBkoL=RqOwL|F%>AM4g${1GlwYv#+(`XNgEnj^J_JbN9&y
z_+hCMn?-?N?+dlE?3B|6+NrvbBBfty({dTTVe+&?j-g3hj_Rc{#`$6YmFkyZ`Stcb
zCrtlYtfJW|X@VC$C)ZY^HWq>y?jx*=jGPJ{`ee1tc!6$0Xk<c8S@rWmtMl8l))&yG
zgAec%Qdgq3XO-ZeV<^v8JJm1BOgS+EAHl}vSUDRafI<n=zxA7sl#^Xh;lC&6d^r2h
z&BQ1xpx4%hW->IQs+Kk%;M?>y6l%(eA)ey^jr%=*e0?*%&L|V8-t6tx<b9u(K;L+P
zpO+Ga&-2f3J)HAwuIlss^DavijK5>~WKK^%=}P~|aZ+W42(qan@C52r$x%BmH1<VV
z_2BPksq*Tdoc29Jc*I?4VKsvuq{kn#4)W%?>b9u#`{$h}wfki@G}~xf0+U6>?yDTg
zH1?Y9ZHwYKc{0eQqvA8=$z8O|+~w+&zrP;7fA46Imeg|ZsyBTp!1Zia`u;o~o;xW|
zh?B=I8XN%(5nhd}@}xEq&^f`ZPE~AxJpus5E1OgUT3KITPk!L&Wt9eqXJ&3L6bg~!
zCzLU?uh$>eF4oo6Ee=j|jM3h6H&)XeE=x;G&pLc25a$A2=lYtUlnczpx_vU9zQ0S4
zmzUR^1TMfu+y*zyE+K|jSMez$+w=MclcqX8-(0tHaSDr|nW63s62ro}h8>_(Umt35
zREfJuhLjToZ*{WwMB!fFB)yH6ayX^+J@V>v#{#wFDbETm=O{z{L?|&otXTHv80mTr
zBBT=Gxo_>g6*5^V>5|y&+-GmjX;h_5MfrHQYvQlV8>ui%+bohAF=t|8G6!IjKbB23
zBM!NC;&7KI&ELFvW8T_F{Pj!t!%l3!L}t_P<)ZTDpYKam_pW-sMrdwE(aO{B<nM`>
zwGbv{b1vPw*H|3F4TdTLIhCG<5_IiLdKASNi)s6+<nFFcw9H{7#<Ew_FbeRQlMpVJ
zgy;L%E(Gk{r~WoG$Cy3dXvF#Jp^NEq*+XNwUZ`4UGJF~1-!i@BM%{!TeBq-*?RNW}
zMc3B8pFeMJTCRn&T(mBM0EW|a1s0*aw>sFy<zexh(B&>M@<f+N6ar-N07X0it@NRC
zVb`)|Az{pt2Vwa>gF=GJ@c^Fc@2}0B)xJ4=0p1;s3SHQ<Jzx0c6+8LtDsHyTAMb{v
zOlTcNzrK*^If>K+W7-Eg+~yToH(1I;*m3|$q9#`G#E{Ew**tFY^VMB55{`Djgz+>4
zrjV<}H{?{45*XtM<y2=576NXhT8?fq_83Gf-EB=cA$RcC+BH4<4^-%Tdc}p3$+9S<
z2agp1N{{iv@bblPUeO5C<YKRZmrzr%t{u#SCX`(VhO*AVf%CJT+ok7(S@tG8@6GQ`
ziK4m3J@0!Sj`IU1$*y*e>%@tclO;XwM6!hVNz>q<p!!hnC;AH;XoSmy<=vCt$|WyS
zQ$C{<r6!pwT{Bdb<_gc)E;qLswc(E6c+(b2OpKzPp$-(b)4dl?{23wvC^nt?a6I*b
zYE=SZ%iKgRs&KRwu)2<?3_SY&*V84%3wIC96&S#&@>%rhp%Ze&dP0pD+6MKkoZF&q
zH5bz%u9(O3Z-6I%*eqF%Fh)ifDy%0Ye`mtze?d_<Ib~zP#>0m!OdWw#iEdP}^y$Un
z!lc8$|6)!=pdx`P)G-0I(4bf4q56x5EfhgfH@VX;c8Z5@&w4bCBE4B$5$$LKFh5q*
zkAK_UAzMPJM5w?$QT`P~il^p{NV{CjWn)j&&B~=v36YMsSG;|+(QY}&%G_9BxMTsp
zVvnyDMe>j2njJn%jueXa7IU?yZOI(!@b<PuR^wu*E<Q-TAH~HSekf1gi29tcYUo%Y
zgELusm}Ojbc7aBFl^)vR(t(MPE-on%cAW?Odjf_8ghH({j&KnOVjWtJlv~lO>*!c~
zw5eaUuueqfd#cZARE5kQM80w@?k4mGmDGTIA36*dhhfGW1@+?x`a)MyUFM-)+FW_p
zYS$sNoV7gGl9mvR6n1QM(tCvBvFq4qoSm*WP5PsJ1TRU88(NN{PxTEHqm+<BXU?gT
z6VC`u>`8F%480g1HvT)OTK$WcRdox;GavE4UEkXGUe|~l`JVM8@Fy^(OXZRzPX(1=
zna0pJJUp(p)yPxxL^FQ8j+&jFRW*ts(G^aXoy4ge%JcqNm#A8*XqKX>9IOX*ih(B%
ziWn`@_&05C)o0k;&GBGmCOu>`MKU##8~Tk+E|0Dj7r!bpZ!+2Iw7F%DEP-qHVsISD
z^Lz6~i<<!iTjOhU#+tLoDG6EG2c9^50xF5J!k@5-eQhoQAF;9O&CDc<@Mf~xyOFF!
zr%uU?k5F}Prr%FkaaD2maRq`x!xQ(5_dSw8uKT3KSn59^MOoxeP&-i4nE2Hm_EFcq
zq78069ZwvLz}9;8ZE+V+52etrJyVpMZWW4*6opbn`JbxbiqS4Ta{`mzb2(s`SuS!P
zXGS)H9^<KsX@=x2B_&aOA1p`B@u-YwE>laRI~RDy)LXf-tJ*SitMonB!`0<HC+2Uv
z<MBU<!nE(%2blD<ocjjxxxs3L-a~mgWjTu*cpIN0!mHk*G{)GsId(2IQ189Qj&sGF
zMQIA~q3Ioq0W*;I({?@6H+tSn&W9bNZ9Gl1hW+HpEIAZhIiQc|=U#@`uaZC>)$3cM
z6&zQ;J9Nv7^Nh_qncS1{#?$9FeAh+)q#>(H-2~teadz6|nR6Z0v-1D;p1aF-j7BX~
znCCdrgVMQ8k+h01^+kk^jQb|EX97H9Ie46|C$273R(=+1xcNS}-?$hyT^=hppQ2Sk
z6Q^gJun>)8yw}Fn`xD^!XNkUqYABcen)*$w7J=J;f9H&AS&0XEd)6X1)&rU>?jtBP
zaTdwzb>k)|;`gCe8m)}YPCb`VilqPHpRri8>72-94@UKFc<kd<R0aRmiwy0$T;k4s
zg&jY{<G1S2t}fVgoDz>W59dqglo=$3NG{P)Ynf@i34J3Y;p?SHP??hnR}L^mcK?&G
zp?>~dL-#$UZB9<da+xCknO>jj`0yLT?CId<;tGKccf1cvQVTwhgez=;<sP=g*-Uvo
zxmj!`=Kc_nJIt30w`U={gkMvxaaF3@rg>{(h8zt~r+F5osk;f3<EnYB_dXJ<@c;<0
zh=G`!_L{Cm(vZF6O1iE>&H6-l2W+diwr80b6^fC|*`PKqT;$En2n!4AiGG)X+)D#6
zZx@Z9Extd_eqOxN$mBk@nB;GHNH{k>I;)z^#N!INp!<ZW9HX|iC=HKL`UG*c>48^o
zhSFACFVpRkOLB85(vFyAcNTeZBrdsW69vyEI{80VRq-x6NO+$76#z9V{}i}cvyWzH
zA9=vUtL`gE-kvy+N1zc0*)*+-(#uyBazD#erC4@+%1!nb`m#_+{{0XbP3r7iu&%W^
z{}eLt`u3@$icSpTHg$D#vpo2mUE8S~@NOvMekNn{rsC1ShEg)6LM!UYNreP`%FiVh
ziqNe&c|#Kp{a^)_`}Hfk^nNklD?k}gK0Ee54H+p$HEE!YU|n>*ZoMQ=UcvKMd5vr9
z3V*K@vn~7^=(O$l4;1-5Zs(k$^oDkQ=Yc$+uO4lWU(fIA?Z@5o<Rs;8KJMyY99c#`
z@EnA1nb(Z4Jq!8=-a5PV$aU#v`HRsB9v&Wc!V<_<vMU{-cHwUxKBTbptn%lW;9`4)
zAOg$M+P`Q!o$UbgAvgV`Q{|eQBZs*CH!qG9O(_H+4FjW^jx{7ga&UOIQ9VN`;k;dy
zi$c+grd44l1YF|+D)zg%R`RIxsV?@k6M1TKL_@9h@@M1UOOo#$kNH^+%N{}gi*J~?
z?-<=F96IE^TG)pDYu@?SSGJ|w^53#!@-B7c^5kOg?-*VPl8M=>qgW4MtctSK+e#jR
zmgOULLtx{>xlGVyg<r3q=HV%?@O-3R0VIp#vw2ksyp-VftU1Q?)KE9af$&Cd6NQ?g
z{K7L=&V!_<U6$Tf*dF_SYo8OT3`1FghQY|sRjV(>3xR^U>#jty`lQgqrf>uv4l`;B
zN*OOKwaSCcXwx=8jSY2YZqI7LF#xbfNky&$dk4WmAxB$EH=R`$u}drgB=f6>i5ejd
z<lFUy{7%V|2LGny@YE+~vsj32y4p&jfO0mPx6J$wGW2R^Q&CzXjkph}K)&VGUkGq`
z);ht^a~+64hpXC*l|@3w{VM<`p#1S9&X(Z3-Rs74%h#KuQz6Sc<vine)h`l?ceP%N
znT3qfgf0->%Np2V<1oSoRJNwI6jCJQ<Sfh(iLJ7Z78ZO+H6_xq-?g#=aF>;Ldm+*j
z?a**NB}pguC{*F%-D&bJKHBHsYel(bC9FAA(j1t^;z$pUTcbB#mX0=JQ&IMc>uvVo
z!TSysxhq1=WMe0z=V_31=_pLV>g??u`Pmgt#w*~SEfZ}ynSOoOm%{(ysO(Y!y*G52
zc+0!q%0lX|O~_u!DQR{&PPnXS!j??n@V&-YTpkH~_K#5e6JT$BCoS4{p+xoMWw6wL
zYWFUhADv8}PF#-P$Ip3MZl!stN7Cvnlb&G-@pjb$d`l9e1J;S2m&qcKtk)kJ^kKQ#
z&!_H^6_u-D=i*XBZ8BEVlti3v(3(o=<L>Lx(~#+5huYJ0Z10VtP!be2HqSOfltN|K
z6$wK3>=g8))}BC2T*;Fme{o7lFhNJ=E6A??^?JPDyWk>ujT2o~vzY6-IarEhc|gn=
zRc*YX@|Ss=<mvs^kJK4Uy6S-;A?<rgXh0UWpS;zV=)AB9HjOL_jj^gsv^>ZqE0+B~
zsOQ~3#m;3>_<AwM9xlTh6-;(W0E`XIIjIE0I7nFm1f=}B-vpqIKehL`(0$pOU~l6R
zuG%yhemw4wE_x2xJIyWlP?1@&j%9-6brRZCAL+M0+sy5#N3c49*s+4NQ*n5O4<58A
zBYNhug|(<LSbd?1#!uE>mp}-;_3zoBBG)Oq)>D}Oq*rP2FWy$Ix}w43P<cVCVEi?f
zvAIvU2>|s;^yYGM`rWyBSk0PE@{1E7I!FODWH>*NFX%>c3`Xh*HTsYQR1eEJc!^3>
zQ?gn9hxK7(yZqJ4tYuUkfgJP}?Y*fiyB>v6TRmB|J`|hYzf6%Kr6r(YS8hb$qHyKv
zolTF~@9DX;tgSkTB%(b2e@P-bI$rwD76z$K4*=R&9qh=>l5=Wlv96b+${*(TUU5cJ
zVg8ClNot4@`72>4e_S~GIq)%!2=NX@mLB}F^aoQEz*0aziIl%{mT1dA94TlEwr8b3
zUFxqsQDNX_U7Z6>)^Bp4-!?g%qWQcw{}s$4uz1%CIt|CZU3$=#h`y1z?p?JqHFVD!
z(Byk`W!Q#u#e_8`t_X77x~6~lNC*+@o*E)})NibkM7u;CfM&iVq;d{i^|-dDrxIb_
zB)sTx=R2go7o9u(s|`L-;q7Ts2XCOLq%{5d^1v#>Ps5H+4B|3GLYT+?eqVo2b_qV-
za~Nq011r+r{69DIFX8*)gzo0j&~Q>cq65H`TiGHs)C`IH!wNb30a;^ez!G4abDfi8
zAP!gU*W~8r+7v2G&)s9qA`MZ|ka0*SZP$HLb;)^Gd-8{08iYBM!l~||MRnP=l06;5
za7&G`3m+b1k-pqwk7!2&)C@%X8`FULA(C>8qMjFLBBeMYQz<;qoB4mW_uWBF=54#8
zANnq+s0*UhRTo8yh)8d{DzX$sdJriRkwrkH_u{$=Qi7s10Z}k25W0Z0fCVC5dM66f
zOAHVK1j4z0vF)6H&iUiaocX?4=ACzT;!}R*F4uis_wziJx`U<7o$}>tP^aWnTu77A
z&jPyVC%aSdWvl5qHxvdT4>t@WrvtKxg!qVS(=3z?#rhsWK_~A%oEOk0h-7<u<c1;<
zh#OJQ>2BHDsXYnT<ccRhPq5TO?U8r!6N`SwtTZ8#y<Fw(x)c~`v6^Cf3gGE2=O880
zA_zOJ<bI`(m09eZq|<lrZCht)$^y$HIS+StUGTy}0G09mhC_f1{>lX6oc}jT3n+v-
z5)Ox}L9)@+ffYr?VFMrwkpxoEEdTb^jS$?*5{Nm_ixMemUMw%5(pWS*`>;Frq9K9d
z7_fEwcA<{EAF|bL*OFs8#n)z`L$Df&38eKET~tM;0=)TK$7a;tnG#y)&{Yj8Tq567
z$O+vgnIfHp<>N}qWw@R^K(w9|`^cy+|6PzMaFc67LPDq*9=@liu46HJt>|kai{Jho
zm;9?iKsNjDEsD4faph)ELVjo%6Wxm%rUB}ZpKDmkT<nj3viDp`%_Ir~jv0o3{`6MZ
z`s=&Tf0Oy1&cD6P{9noGt5Wy{+x{!ceQhfEe-biU%X2R5Rj(4`|89WL2~wBNW>RvD
z9>vgcOJ<854KUk82>hztZrJe0w%nC%xlbCl<{qbHZqKcY`PjZ8v+tWc7wnV0^3sR?
zlFfwX;<-rza=P}mT<wvMqTKZ@R-&i%f?oYNGRt!_fq7zqH%wnNHqA&#t}1%+SXFDe
zltZxWInlk}26U7H<j7_Y5eStBHc2!xS~n4Xy%iR-NA!Mb*N<zVyHY-~b)L)Hh0oX7
zp-tOsZ9f>NSjFeM`HSQX15ajicn27xZiCJ|5zw&vOB;K~;11<;p^<%DZ&#e0q>m{n
zb<yp=n%Ono$Ov2w{G8`Px;`$rhu@k<C#H88XxUcGX3PV+pdzCKa}uAYvtyCQRb3Q&
zGB42FoLeWRglP4pOxX~O%{WIu7tYJVtFEks)ExO8lhH0@m7_MO*7bdHJCtwaDTls^
z`$a{is<*9^XR5fcnt8IqEdbur{^gI<KDbF0UHwIohwxr&LE?X1Ojk+rZLoOIjAm(C
zA@lr*TR2{u`<7UXJSL)P_IfYPF`4~q{0Lr7J!+J#YB|`Uyd&U7wdhvkR7}Q`CVwaq
zAu8!>old>5x6Dw~_*NR`Z0b1)QkC`LQok)}wpMloa_4SyPr)!(TkmYjR~Ws)+Jr|(
z%W=@>Xs5G7_yD6Uwan}2=FK{23*mgDbj!eNv%-`(TnNOmCs%`w%eG$Jwdn?ad_wA!
zomY^fy&^Z7;H?>_md-)mn72E=jq+!ml4Al4E?Q@kf1#6?pSvebQ!i*ATv^&k_ez}b
z@v3OtB@luq>UYG}VeMY=35aQ01??;K-JDucpzis?vwil`kMOFcbhodh_&{$NBQ4Vo
z<R4CHc<c4FscoF_{Th&y1+#s36KoFOerzMcadKo_SmLx7#TxENdWCz~9h3`@dMeDR
ztPeYk+vFA)a_EO%-KzV-g>k*Rs7%$9LJ2F{G~kk(c1WpgB@Gr~WlOmJ9x)OaV70-}
zv}x;0Sb#SjQtsg)QYRG@jBw2Br8`ahyrz}k^Dugqu+7ZHKYRQ{Jqv{*lKr;7%~suF
zGxqRCo<sAi?!*7Mp-Xpm@4D&^Wx7D9MHcJ|<#BgGrRrj#M-6e4g-b3Jyh~Re?YVJs
zWRKWEeThR&fg-lBOoG{^@3Sm!<r>Mq=94(BM~2DKHT_JT1;)p5MJEUHa<XI=g|Z8?
z4$#*1{;d4Rx{-1tNZAEK!-HL&d!0f`hkw)bdf`Po4Li565ShH3Ax9JwELpXt<<Uw4
zldP01kAcr-RHp6Ww-M3blkxV$xrxvJ$vo;QM|gOBe0nkpmkqDco{YR9sOs`O?a+3i
z+28#11n&R1--N;>{4(P*Gl}h=v8ZTi>EKPaSZnE#*)dRYqovJML4_!$aq;;sysLqq
zz`&CBgLt;s<Jpsfr_+;8r6&mx1ulwg4j)0Gz}Z^Vml2ZsEN6#m#m(_a!9AIFM@xOT
zM-}*PPMiO{{?F8#Jw@>NM4g!&9zcgqh@Wy^Kew=LYxQrBxo=dvZsifzS6S^|?*32x
zk~WGJb<YF;HqPGKb@mx%kC^6T3@Fft!7L$~RaaR{uWSixQCBb_e>k`BOicTGV?*@u
z5J8`<WjRcj>FYz?*ufCtO~MlQQ_m4jU3@N3ZLsTP^%GB;=&*RY3qXJy83zd3$9Cc8
zx&`abxlBi3uwKWpT_uv-;^0+WrhEDS+!iD9!zPqwGt{yz))nY*tn_D_bl;fglV&-$
zxYPr$`iq>2g%#4Gb>(I;^%CO&Qf<&W^}Erp2MU$r!HuVJW1o}t4yW0q@BeYVRu{uj
zY+s1p2?Gh^W=~nqzoPR<4N)prAx4pPNNy1CxHGrsWnc*h^zQv*>%s@_l3pcKwUv6o
z&<|>pcSh>=ULc$N<GQOyC@wREeX&o{!RLPb4vTc=^1na)u$6z;<NwMWWc5pqUFdrE
zq><(n^TQ4sDRV+y*+E<Vvz;>+G#WPOJg}i*GZ)%^9HF&h<Mqkq^MN!1#4O8|REUpf
zTJI_+QrG<yv`5~^zH}3d`S~B_iAy{t+?VaQ>bLq!CUY9&wzgE^t^yV;E9&5Ftp1X(
z>_*1mUJ*^Emybdi{?w0cd@`KfTYEYq%FPtFN?G~cq;rQuwlFCU*9HC&kujXP^3mAI
z-D7Eew~iJ!7kOU?*=$>kn7*zo-RsdmF0$Nzmy{b)ql&W-JESimyu6+nbvsUcxH-)B
zZxLAtM|@p>Q;i2cU%B>NV2ct1tLdQW*zfWSB;$YjCMUT@aEpzdgQmc=K<KN-+LL*%
z2PEw0U?8P6Ao7O~Lgw?FnMs;gM!kOD{)f{jqkCxN8SVAjEpb5Nu=pm4iEEKHrVy^o
z&9`^VUh3^-09N>-Zg1G2aQD9Wo4oaN&NEc1lV2|YxS+!);4c0UFg|8@ZPz@atRP41
zt*BH+NI|k}I|S_p+M3{3P}7iMqj<YfnTv(6=)dW4>(qAdnEJdSlPT?qB)6=|6JCxL
ziKp_6ZWFH?IQ5uI7>}-~eY-jC_N&LPGt{~3ujW41?>y*X_vQhEw2U7{C{ZhAEyH&+
z0WROU32Rr`OCD72qN5MMp}%Xog+k-EX??vzzxi2l*K5se#WejTf`=xfXhMP2Hcd!2
z=AMzs1}*q4Un{bB=M1}7y~Jk+I8Mfh#@<S1*Qo;(sXe(F6T&ZM4A?3?`K*h(yL&dJ
z>&q=Re2C{0+8YV?uxZ0>LTT|_x`E$?fekuJz(I}%3`?nFR8)w3qW7<S2i5UW8BvK`
z+}a_{e;K>%Jz;+VAxvY+){Hn|0Z8nku~_T(-@)#3mRuE|gvMhG?y-#l;Hx$4Y^y&s
z&;hDF=H(bHD^Tsa>&8vj1upJw=!?zhFTM+|Pv_#s=AOe1eWV%#epLE7_IQd6;B6=X
z_%9mg7{UtMTzk$Pu<7Jx%$Kt^G&ppS8X22!q2H?w@QX_;-5VTch3RplN(hQ)Y$D_p
zSc^y-5g_v``a)Uo^}Kj8y4?a-HT(=%T{Pxi@9^|y45DBGlJAkwaJKqq9RS$f*$QDj
z*!R<D=J+j`H)zt2&V>nmU!&2I-o3di9Mb1R(bNrmx;N-#)T3DgQyKJlkLucwVLNLA
z)DC5yXo2(%n>9}a`7ZDN+jDsWYc~zt>D&0e7Z*9k!t#_^{s`uY!?(glL}M@fbuI%Q
zaAFk*MrRE+5&n7q1988A;H^FK7Pd0!YhlFpeSA<DZ3Yj6!syAR)eV`@+WK`h?!se7
zPc}m!@vd}NK_K?~K>zIv{YvP4U8(=S-HPj#70Qg3)P}wdt3f-?s{E2<trEOR`iM*9
z<@l<IzxH3>_g}XCr!@pz-oMh{Er0I5#_#$UHfZ$k@VfiquSXj<{>9lFtaIa7aPYv3
zj)6)_)luR1#?BQwvIE^+G5v>R3RMba4^ooH*nWxJ82d*cckZcO?B6TXv|y2FVRnhT
zr`W!cKCPnGw?ApJ>HMl+^{vi7&Vkv#tY5WDi~F0K{d*~v-TaSTtIS=Ik&)CjI+-L-
z4&?V+oQ7V)PMpxLuii3q3hYB2tm5`Ylh|f?CmiFM>K<M$A--o1JxvzId&EmU)E}Sm
zrBCp$ZMncLA1TONAD0vQ^yyQakdj4zXI9@(WAUKc{`y$SsMy$8oDiQtarCdZbBHTS
zodgSBxZTY7$1k@cg?_hL!kdl`r^ugvrbG+|tUQg)s?&;kSYflUZ9O7N?R-Z|+(}+p
zW|6W1xiKYhr6et6GYKD=;v8nEr#ux(nIJNRr^hdTNvx#cAJ+^e$L&t?C2um0%g%Rg
zR6k8>N>=w+7-^{%wf^0OkB{$|PKl1CS#QgmFU(4B!jDsV#0N9&YcgFgzxAD*U>6KX
zaNoy)IhSOdX=29=s2r+uQ1bO=P2x9Y!>V1iQE+B!Atwf@@?|_ZxTXrj*{Sh*eE7Ml
zzlO>ed-)TBy0&aDeUTROMP7X&18%tr&iJcEad4qcwVy4|vlXtFqEDOSc_<a@zdQDp
zD}wZ~SAA{4&7aoMmFGH=5l??>D1B-Cb3RVit#cYjoX&9S&XpcjrMB<%q2fgZRV55W
zt$9d(LH^=H%K^(HrU^l9q=93^fX!dvjXU2rPcOa9=J4iLWQlG1Pd^_bHLJ&2VS0+4
ztyEMPcgI@_Olyaa_+QpnwlrfT9CdM>oC|YT<G@r?2ZhODzJaC}e9lbD8=Dpv3Z8~9
z&cdJj!GB)&^PP(c?CG3aEJ5zPnz_=AW^loWR+vDdz@?`L7&_NY-5f<z1=P87!-gx=
zi9EDb_yUp5N`zTUP?d(u$10tny3Cx&oXWx0?FYVaRZ9HdS1TvDaAjEUSiSzqTic^<
z-MaOlxuvyrm;CxvXT!X1f>KtnxMC5vK2G@SfK}94LwscNeTbH9;tq?M^Gy`qEnIRu
zo)5u9Uycf=$>?C<N!=sU7f65Ye?vXVmZ>nv7)~7fvRm!iUp+#rOUznO;o2_+I|_#?
z=$z{0X7%+XAEF(v<dIeX8Lhh?mmUWj3sBamjq_hj>I(jA2!7(gldDF4p;#Dy>_g6t
z-kGE}y9RC5F~Oe?7WOIj-S|J;vjQwAz54#`d$U)H-2%-`<9wUKw{STXyA^HGxHTNI
z(Zr>kPLgltVommW%vUpx&Ni-kpy=RvMcS6RdUM9J3EUj^x68$9<GD);fnSYfewB4r
z@cF}EQ^Ul0c0xK`_0D-+pYe~1GrogkyVZs11M44l`aq|kgVN|Tht8VSWzOMQzo&0w
zOs)9Wn5%K)1J9h3yaFp<`nMZPUmW`6Jxx6{^d?4FLq|uahveks6iHWKIvOiw<#K8>
z*WOrP3T|-r^YP=yUnnxS2xmJM3^c3rnr>C{&OPiQ5gEC~u$T-6ndpStmFEQdii3DT
zmUO=`AJrm#?LFRQ(%w#^Qhi<Ih=8|NM2U-|ibBBU^72de(}M-ia;Gv*$+8pRsi&e6
zuFBPXDK|!kaL_IpyGEQ#aYWSPH>cn3wR^~@q&vTR|Iwwb+l4w5E=9r#Dsxs6f7KdF
zi!!MmpzGdt$SK=*L`Y>JXiWHX*YDD!HF?t5(Kpn|%pB5KqMW9io7=2(AEQEw&J0{%
zqf3KF?r|IL9#{X6%32Elx(SvkQ+@P=@|^4#v30cNr;T}^6Evi4C)ZqNJmlX7S8fl3
zU<d8b$vihgwuZN0uZH=}CiCS~GB5XxU7?K8u>k>zGbTZ+T4(6{hUj~D@v71pm0W40
ze(p_MEcgzkxcb7g3T7xKyj->_u8BzCB85vy-d<<YD`k@%7>ktN3vY^?`ecf8GW+=4
zgcEtabmO_>qDsY@lq;<kX4~YO6z2Q)D8O@ED-WiygFow4$4Zjhk7r9*`BQBh;+L<X
zwcRQxHxx9cPFW3fp~-fU?x(j6-Q=|l)9WHcS_Q2YTGX)2XTwhLuo09wkol0tR1;RP
zt6&^`Ehoiw;JfGLOGEW8gUf3MIS0g19)a$JRd^Wgw^>EcnO@_TJRRF=KZ>x+w5s3Y
z)2sB))0!M*nwjd%UugoFCRt|(m?I)OeU5%ZS^);d1NkF~FRy(N;TgE0d{8$`IB@B4
z?v%JD>^Y=^%*I72;)_qAPTPeX!>XGr&rum(%g-}y=0~Nj5VL3cD#H_Na5~BQ*+xxj
zV}D_Y{u;H|;xRv~rnP}QtQ{2RGa^ySHlLoaJ3+rH-T)F8K8Lt_6I1DVs$Wl<UCtiA
zc}aLI(Lr0NvLb~HhN3l4#Mju^NNvjZ!h%8ZL^&<QqXz*ajg!6lC5QV2oTnR$1@g|o
zhp7BNf2`Z1Hk2P$;{hu%lx#~m4Zj*=l|NNo-y}^VZW;Pycs6HAH30%Wwa>Y-!#$9-
zwtsxXaVUti*2xW&rtGL-EJ!-UCgF|;F<&cCpQy?5aQZGx^SB8mn9r$jV4OHHTG4M$
zay6$<SoR<HyfE3IH1k-M17lv~Z|HJ(XuRKpen0FoR{2RD)mqoj+P9H1Tzw;?W`)LY
z(A;vDogisWJe+CdS-v~>q4}zRV^CSC$9jeTeOd87szH_S8cp7Ti31q04|3M?Ap@)>
zo5MPDP1?OX^g)d*{C~8}SWNz>7`$xdA!MZz0kpyg;nu9lTvPZS%QJ%uZR_O|)cXh3
zXI|liEHg$&M;lI@DJ-F;$lEn>rv`gmVw=j$A>smqm^%CDY3sq^xZ3=`HF$H?R{k`u
zE;wsDGN*4^{p!XUTdR7|%v0e2j)3(xA`K^I?bKIPG2L2AHK~G6+v5OONG$XudmE&9
zuixP6OUf+Z%{^~!KFqY|+U+ZaW&+RDC+CySWdzf}>yiSR*l$Kmw6`^7cz0Ho_mIUJ
z$+w~iKIyuwIVgNXNGKm@oI;*7ui3`}DsPleoIH6lVvl0RXW^MLkM#h#M-_fS_HJj{
z3F}hUGu?RwxkLJrBY$i2m{qM@8_~R3=~vwEYi`!n(%roWy!!m2i+F<B`1LJz0xsFx
z4_j9(xoY6!hSP&RK2%-zWb}1pF@6Fta5pGZ*^Mpp@#B5j<tx3OWxNGK4=g$r@;NZ-
z>#J`2WbO+-gcN7$$u^l?)<$tU4`|JNk^BjQ-zh`GWm`SgG~T6tOHNZfxleT~)aSSK
z390&3LkyYVuIH7NmnYraBvrd6?OW3jGJJ!}v<ASP4Vf6AZ(1y?wsg%_H$_^Uu1Q0w
z$Sn)(ZD`CY^k%b!(tfjo9fB1DAA1VyC_72B5%{}=jqoJ`hgGMgckNiT3-QNjOmCms
zR!n8!NymXwNs}C=0<yF#wfkmD@G;~t10yzvSFi14bk4ldys(=y#f%%lB7Z<Nd656%
zX(~JH>$kPGjTjn4WYYk_5Ml>p$1u}aBA-=Ig$Vd<DA|rLBZs_`BH<_RHJbm1Gj3*i
z&~AWCFld7K&yR2`*V&Z4;4%F4vn5iuwh9V)4XBO;k)|TZtsm*GRaRR@h?`KbZ9Z~d
zK-@Gt%z0`OIX1Pf)pYpPgbZ?b5&8_E8h@hwytH3n$8Ka(SU^C_^r2fpH3i|jNg?9u
z=)56h#v}EnZ|~_fN;#~jao)6tz3N)Ux=%_sLojX#aI`Ehm>yX2ZyQBxQoht09e>Q@
zd_?(lSikfdgryQJayuQN;nFG6TXbdcRUGEE2Yg_dI`N<o#pbyFpx#YwZY0*`Zt#Ix
za1KQd_lk|3@IE9ryZ0#6FTr{#yC*?5h*Ko~tT*|y4)j6?;qOUQt}U9Q99lbNvDA>7
zUn2uqynWXx5hbksui&ZHuVm8K8U3VDLH+;wW4=vKo%BhWa(EdRS?1w?vCIEODhI}%
zotU`p;owgnpqF610g{T4%kJqZsy;|el%eP3knfgIM$)pwEXq7baE}WMWe5GIW*YVn
zLH>&=;U3$kQBL1EL8p%|2w&4Lr!%+M^8BVeT<rdCS}`iNya|;CD=UH}W9uK@#Gp)~
z%@kavby?{Mr9B@rbz+;UeKs0b&g(^%!4v%Q?B_>c&aOy{M0t4clRR^tO?;*grHs7G
zGo}5~Syq+%yfzm@gs__>x3)%?tRsU+l#3%iJP8=B<kG}^UukLn*KQiKf2<>Pxc+ss
zc{Fw(gu{T^9Ke0Jl%S>~*)KvMv(yV1B1{6X-Hb{_nYDeGHr|s-*!Y{Nn6+(;M_q|t
z2*bUxH(KP0tM>K|(TrdZcVzP#!`+1rrjTa$&wJx9zj|<#+SDG9O&ne6ANttRnM1y#
zcuSt_TlR@af-?|scy(h$Dy|dKQ)nod*0G#C&1OqmNh|M{5I^G=s}>rtXH%pzKQRT(
zs(Oo@{A&GB!V(kGOb;qUNiSMwHbzF7ywo@QPEtfDJ3amI{Gj`kC1{t>qjkt5MW#tb
zp2;Auo48voPWL1(M-E6|G|(Wi_=4cH?<nyBJ0UbQD5|o8Fx2=M?U~BL=cJ|S0vgZS
zZx-nQH5*2XH*YUJ&d1MX;?W<#ShS7JJ-xP;(Z5#a$~HCacI0{K-*mu42_l4o=8{K4
z$Mh9@(}D{fd*(7~@}Y;UVM^GihbMu7mlW=X#M?gdu`cgZ%)*%e^7B>-Gf&id4Wda{
zoa#&j*#OYkXzLAC-^DP1eI}~0$P7nayeNaoC03d|x$q4{n-7oRJphU*Q#R(t8(*00
zT>Be2*l3^+JE7KV(6GZBd{-u}9{KaAu9w$9a-g32g=Kx?;iaPNBQ)nTP>=SGP`+?0
z79rmuws{rEa|h3siWmFei@AQ|NaSI|XVr5f;_z^n6$gJ8_<!B%K1PVJgP#y|N;Z@~
zEdNX2^oX^w(tJmY3Bg-xzB{L4@$?zeSwnZW%ytR65rmwNktd)oX%A=(;~u`c*Q!k+
zKh{hFU%`n%Qxu+>5?8adTa7g-rw5KIzwloUdr$*(`&OZ260~kERh2_-m5>0lE|iGP
zTN;@kRq6*|Xe*@dU{+(mPC#kFb&;ULuTH-2GflwnloIwZPIS^!ogrk9cH9k!L=d6P
zg;h+C_kOqifsLK}q@>KwyC%GJZKE^?-A2>Y6wb=9FN!q3S|LeWLjU@Xb~Zr?{+n~R
zilJ*|_W7y@s$(rDYGeUWwGUeXdcP^KeobR{?pc*|Jpljh#~=Qxbu21H?&ot@EOxR;
z=CaxanCs>K!?Kwse!RH{&k)Np93~(hpTUywSJmM%Cu$17x7&xg_A05krNA_8d9H`8
z3~~uUBmA@2@@S^BM*7Cinr8V9m8XQU_4YPSgW^i>&+o$?+A2czaaZY9IsP<ja*w#b
z0TB+&&Pu6fujUFvo!u^CwYLw^ZbP(bNLoIi1BR6Z=}L~IynMe+#*QPSJ=>zpfTZI6
zE;pLtQN6Jff|qf(>%G1rSV2uN5qNFIq}@X;!%J)quiq;7dFZ0FmFUFJ&-L`G^5UrZ
z6}~qxxavEP-$cCwND;AV%l1pNZG-HDW_TQ-qtLy`d7_vcSTB(u2vPKA<Y6cKx~l_v
z?^bUqr3QmMHCoYKGXE^BIa$Qvas|OwwtxdOmQ2pMLoH{nB&L&6Ag#8~w8dtsz;GS-
z-T*YB7Jod@=RejFXvazmJ01s%7@TF%goHOUJq7Z>9~hy+ElkJMtOOPcQ|4)5HfB|L
z#bZ+Xa)bZ#_fxBVpYNuR^;GzIjjCDX1=AK*Z{Ca)-ycw$b#=hO>fy|vu%Th`dk^g&
zf@0?>*jdrT7gU6a7H9fQ-+9+{JY**Ttk6JMcX-l~Y+$nYPk5_f{cj!TS64Y(z_;aU
z#pFCrL1BKlCe^OY!O7{2<h18h;E74EXsBQr-Q_20?#Z4s>uh~&Hr$hY5xZ}gwS&Q_
zKiJH=xeik+5~L^F*ch=!C_Kzv(+fgF`<OEOJjjqYZd&$nN|hVA?0hZ`qa{+pANmnf
z|2k0^CT4AHXjB_rcpPI=I};|JQ!BAxWPU#5wBPRBBTI(s8KjOLBA#%p5wMM@qe{nk
z=th&y3ehWjdk!>tIINVkhDDkU_r55}Pv9#M0A^sGOgyfqCadnjK$(wD*8Tz*W4}3)
zsC7&lMBL773tm)^AvR@{aKJ|q_DiQp^f=g+90OV0>zuKI=FVq0=N7kSyV<r54ou;F
zZ2olrvf*S2l%+4;&vP4BDKU~bIr!U(Jv`E}zEGPR7N^X=gRiSS2OunFIaqLh#;l4D
z3XU(60GM`Wz!NI!n~~4>1of-xN_l7W#p=Z5P_}3+GGiwg$OxN=&5&ydX75qnS&oFy
z63bf#tu?-``64<Lp8Lvmr3M>kQHUSCqG~s6*n1T90x;Apy+7jj(C7=cBl)ecsY|1M
z&W2GwH3?%yJ%Ip~Zbk)=aLMV|MCtjD4FRR+*&HSVxVYt>zDWkK?bPG}2k!R80gN~q
z5-IAaYu2om8Qjs`9bY0b^!S3>WCj8h)Ox9zVu_2eH`!%@x*aTQYLW5h!5;wh5kz9F
zElU+zYG(j1)b4^nlT%Tnm^F`L+J#<nu|fSgoRFJgt#di7j?FA~euzP-lyZz<ZP2;H
zKZ1eApN@_ZUa=J{hzJ3<PV!<hD(3-!%aLk(y`Y}sejqK6JEPj{w4QLsC(<G-*!YTE
z?)k04E@t~~-Z221>M+=$bRG{GvQ_4jKr*a+q&=5z6qjir_qJ`@Zbq83WtKZ1o^kGa
zSD!8FDA6$qR@Gba(%;DQr*xB%hf;9Cg{|Q+yK}*Xcu}c0#g7Vb7O?^k>nQtQmSqjQ
zboW1o-B)1eJgR#j#124URCf+kc0IQD7VE$l5`8RSj3~9fu5o|KzwYBUxeWEO*t9^<
z{f&TW08X0Hj?f{8_XjlJUjmHsr@ei;Z$AfSnQYK0p^NCX*EI%NSPNt{C?i#MJkjwh
zM%7=VXL26AQ4hMK?QG+6w>Kj;1C9`Ou2?&JTuw-0L5Vfe57)jiaNN1Q^>*;EDN00h
zTRsIam_ZXSP!XSzs&#j-$|cMw&Ao7AC%{`U?T`6k0_vSzyq-9912*yfHdCEWhyXIK
z?1EK6bTJ_#0v{Z+F6l&OT1<KxK0PZA%c<1KPQbn7g{obYmaKl>P7;c=X>z4{&A<bz
z3r*T6OaqD*#j>Kv`y)Smv+$W!U=J@USx2L4oXe@5>qTq84rMZ_CC>qH1QAyzr_d5^
z5lXu2OGHI7Ea3}S!c#zVN%+n#BmU>XAQeF<AiGT$U-IP6RpJSi7C=88`7tseFQumV
zpn{va1B@~Wtl;?sKjKGKieCoA-eEc0BL{=;&ek#5nZ=Np4;gwBH@=cbRC6l><nE?>
z3|Ogzt`-OmDgLETbEO53%&4KbIo(^Bnd`Q?lM@rdfTM*{=$9rN)JHBu#nkft{T;s}
z?1WY4bYh_9q~|?K`Lo<SqbUq;E&x}b21+%1&?I@(A8|B^Gq?~)`|uEPR9u`yWWA<^
zF-=|#%KN2{n(NzG1m|xvKNe4r6E1d$wq*!V&>C3|=vDkx86fSIu6<h1$>ho1o{~)X
zqs!9k<m56`1f0qw;fi371sAf};#C$MVMm&T)$3<uqy2=&p3;GFX?Y&G*eill8%;F(
z!+|S{T`eBDgNosoH8nR_h2SWm2hk3Qw(cQ&!_L}3kYTs@(hgwpjS1bwPQYGVp5sYZ
z-=5+!TB7L~xA?|2OWl%p#QU&yz{|O`6C4=5W-Cm0{Pwt_3z!y>&}^eBrSnk9697fc
z#veV55X;ryu@E-2g>uAsbH$cpTbZ8Q1m#k{uHOFrv<e1fN{ByCU$|HR)^RFQw&cWU
z>O}u47f3t|xl|O<ZnN@%%g>vr&Y~>0AW405V2fw05`SrVEG6pQ>_AymZHd?H>S0>Q
z$F!hTwc!T0KF2oT$4QqWe0mFlkpl3#Cc*f5#*1JYg<8xDaTMQZ;s$jQhpHyvOTlbB
zUPNu#{mcc0&(YEBk>Fta=J${w@T3v(FZMUoK1;If#$<Htgq87;%8w07g0e%dkEzdr
z(aZ$45bI3Df0AdeOgR@#?O_dd3Hx2>@Zi7zVX3oru_!N(8lR*-)34ba93xi)S)Qj<
z#i9@fXnd*1zUhD)=V5Ca<Pd<?ocyMz-tt=cC-`Qk+Hn|EDH#ABkidM_y{w2ug+5(%
zkOLz~lY}MR@6m@`>r1xn1eByZum}YiU(VAksJPCmc0om0)Uz0MzDns5jg)ffh+e$h
zfiHu+uk)R$KWsg))SPG-6d!;XpS6Bv&uLv%dg$FWT=$VIiE|k$?h-uummt>bRuK1{
z4B?e)BFyPS$OgC-3RT2zx$MwTGp@$7s?9)oa;QdaG$|!erf@&q6YG5@!=0<tSL{x?
z&oC&Kbk%x$#r+g3ojtkA81E-JR3yorw)E7PEK!33BGGAm9F<C_xS|CjW{Kpum9?U)
z)NlA@LWv!o7PP#x^2V{(;EaYJj98{gbvcwp{!V%hJC~&mkm8>`-+!`qtB8hVa|cwd
zrEjeY*$JuP`k=zO>xNm9{Ma%J3k%PLeV)pxe2Tk>gcyc<Cj_Ull~^P_c=V;loeS_~
zzHXm~7q9#=K!l`e6}W6XS;V`&{K?RKY_#!fWhjvD{;HKYqihH@Gr!cNa`TFEqURUB
z=#jv;7+!jo&0(Ol`B=Cd0AJ@WH#<o!5BKFKB_)c;PbQ;2v9jD)bzJOQK-2d340JB>
z7++EVD>kGczE1W+3&kYseDZQcCKw1vik`Ep>7y<hr%>IWKK5r6etXo|#?HZt$|qM5
zF6Z2<+3OK2Ch0M{(FC~kvuYy??K9y?wnwu*v;iT8$Wr`OGT3tHv|R!4Lt<)Pu^~ba
z@A={gudmvPS<@KvR=tj<MrKkoN@YOy1rl<kJ}t2}!5vu9FZwr3Dl;!n+M^~OnE+5_
zFZz7olX(gS?{a<Sd7X-y#hUM*KbW-(*xq#8JLnjANrl~PT%o@?z94KX6eKi-`7tR1
zt<|QToRjhLxIsp+vC&V^cH3~GCg^GkW}X`5sRF#?`SS*qZK<(4bo{pC!-O>|=rb-s
z%6-N63%7nm+4Ibq!noIJ76o#&CE&hdOZ4=cb6Pic-e|LXdNpWKk(c|}&uvjOT0--o
z%ugK&9GJK$?Vw6e%Am#ko_r>g$ION$nmuv=P5+B73GTXcC)8F+%V{(aoRB2*c&v}O
zR@Pu!&Xn`NG^vKa{BZeGo2+cq1W^0hs*B(y+OzTjHH7xHz@?8NVNL2Y*C*0R6A)#Q
zg4fYSgRE#bSZsj5TfWhxc($<l!#r^Iy|e_O8Sf*IZ4m*QYNM5fMWRSUK$tJ3Z<y&>
z<ZRzIx?uYsv;{)m*G_i~-(ITtO&J6+gD6#co=*Y;#6U4g>i|%=e56KIjuof6J*yRa
zheF6aIj_m6>VdMC<>b<{=6K`zJ*}6!CP8&-Bz;MjQ{U2MYas^)>@QtsRj{tGYv4}F
zePjIOWYOi=oVmJR&DifF&E;uhVx~}AzHPk>X?{pYM|(EWxZfAvEiA_O1~l<R#ambG
zmRDA$Bohh}M`BLb9k%wEvJCiXD*YMnC82q!64EE*eQ@-RooQ~udIO8)^Nfxc<%4gv
zyzubp$&j&2v+(kKvJkzvAV6p5PGB12O2}|z&J|rCNk8w5!wVGvWs?Wr0&NHg_YDM`
zw?E&Gj3^23(mJy`ATPfV7&;cFV7y4>o#(q^wrdF#gQr3Ts&*ytHm(gDK1At#4|a%#
zmcT4I*1EnzCWIs;_>iKB$13DWq)kPSA^J-sDi2;A7%dWt_@p5hNgt82KieUxwDk91
za9t-Pl%R?yjM4!RAVo12@u@X6HThAr8h+=P@-83zT~|&F5+48=ne+@_adK)5;F_HB
zx*t%kEkI!>0CtL7W~M+f*$om+Saaog$(T&a8)U1nv4h23YcslJgSV9CY@=FQcG<H}
z%q+!zU?ztj1VuEdSf=;n><<GLl{=S@pI;`<Zw65`px*ODJ_eo}1=LaM+~6~?g0Rp%
zfD<P@P&2|Hz=!IwL8uBx$&p=_erYx0EM)RX{Cm2habUn_rF|RDl!)BmWVWmCmhe7E
zWXv-1ab+MtNRQnu5wWX)<)@nw>JAU86f2Y+bsg87i4ixAS!Jt)M2c=Q+G-IpHxg$x
zg0t%@nh_!8!&2tY8lGbAvO{2rV7cZ}izP6Z?!8<r<?o$VUbz)yV#HSq427hHC-uW)
zB;hx>h-mEsqU6E(Qwl0ks?1Y8^h^T?-0(~<)XuTxK|pjHb^1(Ac|F;!x7`--nh0HL
zvcfrs(U(BPpVV%A;q|93I>uG503lVno?q^zoixxX>XP$vfd@T<F4ZRMpfebbFz7>z
z7Ye|?T^7R9AF4`&KSx&=0dh2SJ(wHXWLmZ2Z@3s8gLV{Um`?$UPhg=hH~YM}WM9yG
z;!BBf3Ubu_p8=&j0g+&TpwvYRueJDSb*9kT$#uYI)xZMZ?r{@}WamtYRE%nf1TO7o
zM4BTIZAL<b8`a6e!VK#O60mp<QH~yOm*jJ`e>KM(3#x(*bzbW2YrEamNLB<)em^N-
z<Q%*V;dirPXdk63H6wvi+SLdZfN0NaZFg%T4lxfU4VL;_X6xVJ`=@8W@(3}ytD{Vh
z+zrC922vb4p)M8)_q9uL`<*2mBZ2Lq-?N%0wO%CPq3a|+cuX-Ft{{}%_aJ9dH38r+
z_Bo>_gc3?01dbg@GDcaO2-+p4#MKySmP_=dJ}hvFI<sWB*AgXY-Q2Ywg>auB<@#dx
zmjtiR<CP%?PUFH*YX$HT)eCzIY#Ji5!>_N$eL8Z(8zjus?5hs53eZadg2Dd%h-8`e
zb0Ph$g_L0snNLd3c2be3+aFNoA?19#y~zYDJ|6H{Kf@JinRV^<)VXMU9(Dc<BDB4)
zQs<@Z=LV$x-`bW?v@O|ovJ%_ecW{B2+BzLf;Zq1YRA5|rBJ;qeXG@jWLe}@s^$(4S
z^XaAAZf!Hj=r4qr6fIL~bnj&K9fNgp3y2gR9_EO#D1K{bpS?^P?>F<iLW8x^SXJXR
z0KOY<F}Q{zD(KAhe11DA0q|O#ra4JLr^O`AzL6fpfT!AuhI<DVa>Ha1N8nk)d+1^N
zAvwoxOy?dYEDN=K+UikwxhH?*rll}z@D}&}L9i-)0&Yjjp)>XTF<{W(jjXE1Q7&LO
z+|0B!bLUD!ssg0cAryp-E-9b}BrzpR6QqWMr>#^DKXo!hZjlO;c&d7|;tnGa)*8A-
z45$G)?ZS9eyn0cjq=9-lL0$*1DW0A)J|ztkA(NXvOX7X(ddhC9l`%IR$$0M1qu(%}
zS%^-7g+CGQ%Db8#q@h#kS+mgu;@TnSgM=%C*b#Bo9KycIYrt&nPlXtk8{PO(5z2Vh
zxiv2@zNvW$jYL<3+EnRhBLPd8s^WwLSM#QA^Xkk7a{-Ff^eYriPVM!oU+QKlX}W#c
zy-<)@1<*WZqrJ@(f&Lka!RMF+G>g+Tp)<wclzu+iV^En)3s<pOtT}|@)?@Rb^gk0p
z{FoxEUIvbuRa%9anio%ndFWeJ9=OVA{=46HUK{U~LPW^|Ffn1gKe;g2<K3-o{8$je
zIu;(fLtVK#ws_lV5X+j~^P69H2x==9k!a~p9eFu7>5$31z8WFZ3_Lg`%415+A+84p
zIpXbFn-Jm8gDi%;B&snSNNmo%Cs7IDV{3l_g%o_eD+eaTpIRM<XpVde0}0Zl9w~Ss
z@tHkSUCw_D6!oK3t~Y7&8%l4F{{1}ie+et%eyA?$iCh}*#KP~3i9BiCaeOwGdNa}<
z6zOzq#-+UtKnHn$ycs8UWIq!mgLw6zi;eh*^Mi~<Vr9tGbLYd&!0FmRA<4rtaVzSj
z#BTNV6A0x<7XP~cieDgzgguwbptLbojfG7jfr6(eIU2K~%!IUPZ2U_^XuH`{c#{et
zBWK^4^I9Gt|JMyxg1m*;{Tk@MN(~xb0b&Yyc6w0p7w-9cKN5Ft{&88^YUqK9APEKS
zM=I=9KIJ2)BLsL*Ta5zR;-Ob3hbJAfqt^S?5GAXyTa~^ly+$ntxQ$j8wd08ESVe}|
zsqgZF29J9O$%07Llp-#<B0McC8Gy-#wmHQj$K`{l6qR#k?gv0rGpp*CA@)d6rJEaG
zc@+-1^T4Q@oD|YBm~M=>NJ;XZOJB}|?ldZt6uadXwPAx0p%7c1e;ge;OSIGOUrhOl
z`u>d@ye@4J)lCns<CA4!Mu$?eS*;VOZ%4O+a(z!wpP&msc~n9VK{p3>q|W#zQCw4e
zuELp%v|=u13a}LFl2BQA0KV1KDjX#h)Zc*;irW~IIgLdB)wz12r=X^tcVJdlRvrwS
zC6)sBO@+D(3q52mP?G@@I!aQmAB=?W&HPFCYuO7QOhSkcn6p6~JLkjOTb?yXpv63>
zTP`E?aP1F?K;}(WD@ei`%eEi==UYv{ojcx}A^EMXJIMc^zklnO4VL)t{Hvwe%9Sf@
z4ghHcRgbe~zv0o1Zz7+5RjLDHrkFeg<@W)b#V>Jf!!IY;be<$Zdij+D^W}^UcTRtW
zqPI8h{`%9CZ}ms&_l|Y@A7l~B4K{4}jqe-(@$aQj59z;a#cGQEA8ib)!WpzEMYUHg
R706SxG|ryNK4JaW{{lir34Q<o


From 18dd767cae9a8e441d0c79c2dc4703dd41342bf7 Mon Sep 17 00:00:00 2001
From: Anton Dosov <anton.dosov@elastic.co>
Date: Wed, 28 Apr 2021 14:08:01 +0200
Subject: [PATCH 27/28] =?UTF-8?q?[Search]=20Unify=20search=20plugin=20step?=
 =?UTF-8?q?=202=20=E2=80=94=20Search=20Interceptor=20(#97845)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Unify search interceptor
Deprecate TimeoutErrorMode.UPGRADE
---
 ...earchinterceptor.getserializableoptions.md |   22 -
 ...public.searchinterceptor.gettimeoutmode.md |   15 -
 ...lic.searchinterceptor.handlesearcherror.md |   24 -
 ...n-plugins-data-public.searchinterceptor.md |   12 +-
 ...ns-data-public.searchinterceptor.search.md |    8 +-
 ...ins-data-public.searchinterceptor.stop.md} |   10 +-
 ...in-plugins-data-public.timeouterrormode.md |    5 +-
 src/plugins/data/public/mocks.ts              |    1 -
 src/plugins/data/public/plugin.ts             |    4 -
 src/plugins/data/public/public.api.md         |   36 +-
 .../search/errors/timeout_error.test.tsx      |   11 -
 .../public/search/errors/timeout_error.tsx    |   14 -
 src/plugins/data/public/search/index.ts       |    1 -
 src/plugins/data/public/search/mocks.ts       |    1 -
 .../public/search/search_interceptor.test.ts  |  323 ----
 .../data/public/search/search_interceptor.ts  |  245 ---
 .../public/search/search_interceptor/index.ts |    9 +
 .../search_abort_controller.test.ts           |    5 +-
 .../search_abort_controller.ts                |    5 +-
 .../search_interceptor.test.ts                | 1364 +++++++++++++++++
 .../search_interceptor/search_interceptor.ts  |  408 +++++
 .../search_response_cache.test.ts             |    7 +-
 .../search_response_cache.ts                  |   11 +-
 .../search/search_interceptor}/utils.ts       |    5 +-
 .../data/public/search/search_service.test.ts |    1 -
 .../data/public/search/search_service.ts      |    6 +-
 src/plugins/data/public/search/types.ts       |    9 -
 src/plugins/data/public/types.ts              |   10 +-
 src/plugins/data/server/ui_settings.ts        |   13 +
 x-pack/plugins/data_enhanced/public/plugin.ts |   22 +-
 .../public/search/search_interceptor.test.ts  | 1111 --------------
 .../public/search/search_interceptor.ts       |  225 ---
 x-pack/plugins/data_enhanced/server/plugin.ts |    2 -
 .../data_enhanced/server/ui_settings.ts       |   29 -
 .../translations/translations/ja-JP.json      |    6 +-
 .../translations/translations/zh-CN.json      |    6 +-
 36 files changed, 1842 insertions(+), 2144 deletions(-)
 delete mode 100644 docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.getserializableoptions.md
 delete mode 100644 docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.gettimeoutmode.md
 delete mode 100644 docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.handlesearcherror.md
 rename docs/development/plugins/data/public/{kibana-plugin-plugins-data-public.searchinterceptor.deps.md => kibana-plugin-plugins-data-public.searchinterceptor.stop.md} (54%)
 delete mode 100644 src/plugins/data/public/search/search_interceptor.test.ts
 delete mode 100644 src/plugins/data/public/search/search_interceptor.ts
 create mode 100644 src/plugins/data/public/search/search_interceptor/index.ts
 rename {x-pack/plugins/data_enhanced/public/search => src/plugins/data/public/search/search_interceptor}/search_abort_controller.test.ts (94%)
 rename {x-pack/plugins/data_enhanced/public/search => src/plugins/data/public/search/search_interceptor}/search_abort_controller.ts (90%)
 create mode 100644 src/plugins/data/public/search/search_interceptor/search_interceptor.test.ts
 create mode 100644 src/plugins/data/public/search/search_interceptor/search_interceptor.ts
 rename {x-pack/plugins/data_enhanced/public/search => src/plugins/data/public/search/search_interceptor}/search_response_cache.test.ts (97%)
 rename {x-pack/plugins/data_enhanced/public/search => src/plugins/data/public/search/search_interceptor}/search_response_cache.ts (92%)
 rename {x-pack/plugins/data_enhanced/public/search => src/plugins/data/public/search/search_interceptor}/utils.ts (74%)
 delete mode 100644 x-pack/plugins/data_enhanced/public/search/search_interceptor.test.ts
 delete mode 100644 x-pack/plugins/data_enhanced/public/search/search_interceptor.ts
 delete mode 100644 x-pack/plugins/data_enhanced/server/ui_settings.ts

diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.getserializableoptions.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.getserializableoptions.md
deleted file mode 100644
index 984f99004ebe8..0000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.getserializableoptions.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptor](./kibana-plugin-plugins-data-public.searchinterceptor.md) &gt; [getSerializableOptions](./kibana-plugin-plugins-data-public.searchinterceptor.getserializableoptions.md)
-
-## SearchInterceptor.getSerializableOptions() method
-
-<b>Signature:</b>
-
-```typescript
-protected getSerializableOptions(options?: ISearchOptions): Pick<ISearchOptions, "strategy" | "sessionId" | "isStored" | "isRestore" | "legacyHitsTotal">;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  options | <code>ISearchOptions</code> |  |
-
-<b>Returns:</b>
-
-`Pick<ISearchOptions, "strategy" | "sessionId" | "isStored" | "isRestore" | "legacyHitsTotal">`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.gettimeoutmode.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.gettimeoutmode.md
deleted file mode 100644
index 8ecd8b8c5ac22..0000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.gettimeoutmode.md
+++ /dev/null
@@ -1,15 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptor](./kibana-plugin-plugins-data-public.searchinterceptor.md) &gt; [getTimeoutMode](./kibana-plugin-plugins-data-public.searchinterceptor.gettimeoutmode.md)
-
-## SearchInterceptor.getTimeoutMode() method
-
-<b>Signature:</b>
-
-```typescript
-protected getTimeoutMode(): TimeoutErrorMode;
-```
-<b>Returns:</b>
-
-`TimeoutErrorMode`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.handlesearcherror.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.handlesearcherror.md
deleted file mode 100644
index f6421d65bc551..0000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.handlesearcherror.md
+++ /dev/null
@@ -1,24 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptor](./kibana-plugin-plugins-data-public.searchinterceptor.md) &gt; [handleSearchError](./kibana-plugin-plugins-data-public.searchinterceptor.handlesearcherror.md)
-
-## SearchInterceptor.handleSearchError() method
-
-<b>Signature:</b>
-
-```typescript
-protected handleSearchError(e: KibanaServerError | AbortError, options?: ISearchOptions, isTimeout?: boolean): Error;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  e | <code>KibanaServerError &#124; AbortError</code> |  |
-|  options | <code>ISearchOptions</code> |  |
-|  isTimeout | <code>boolean</code> |  |
-
-<b>Returns:</b>
-
-`Error`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.md
index 653f052dd5a3a..e1b27f45c6339 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.md
@@ -16,19 +16,11 @@ export declare class SearchInterceptor
 |  --- | --- | --- |
 |  [(constructor)(deps)](./kibana-plugin-plugins-data-public.searchinterceptor._constructor_.md) |  | Constructs a new instance of the <code>SearchInterceptor</code> class |
 
-## Properties
-
-|  Property | Modifiers | Type | Description |
-|  --- | --- | --- | --- |
-|  [deps](./kibana-plugin-plugins-data-public.searchinterceptor.deps.md) |  | <code>SearchInterceptorDeps</code> |  |
-
 ## Methods
 
 |  Method | Modifiers | Description |
 |  --- | --- | --- |
-|  [getSerializableOptions(options)](./kibana-plugin-plugins-data-public.searchinterceptor.getserializableoptions.md) |  |  |
-|  [getTimeoutMode()](./kibana-plugin-plugins-data-public.searchinterceptor.gettimeoutmode.md) |  |  |
-|  [handleSearchError(e, options, isTimeout)](./kibana-plugin-plugins-data-public.searchinterceptor.handlesearcherror.md) |  |  |
-|  [search(request, options)](./kibana-plugin-plugins-data-public.searchinterceptor.search.md) |  | Searches using the given <code>search</code> method. Overrides the <code>AbortSignal</code> with one that will abort either when the request times out, or when the original <code>AbortSignal</code> is aborted. Updates <code>pendingCount$</code> when the request is started/finalized. |
+|  [search({ id, ...request }, options)](./kibana-plugin-plugins-data-public.searchinterceptor.search.md) |  | Searches using the given <code>search</code> method. Overrides the <code>AbortSignal</code> with one that will abort either when the request times out, or when the original <code>AbortSignal</code> is aborted. Updates <code>pendingCount$</code> when the request is started/finalized. |
 |  [showError(e)](./kibana-plugin-plugins-data-public.searchinterceptor.showerror.md) |  |  |
+|  [stop()](./kibana-plugin-plugins-data-public.searchinterceptor.stop.md) |  |  |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.search.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.search.md
index a54b43da4add8..ab5ecbac119f3 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.search.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.search.md
@@ -9,19 +9,19 @@ Searches using the given `search` method. Overrides the `AbortSignal` with one t
 <b>Signature:</b>
 
 ```typescript
-search(request: IKibanaSearchRequest, options?: ISearchOptions): Observable<IKibanaSearchResponse>;
+search({ id, ...request }: IKibanaSearchRequest, options?: IAsyncSearchOptions): import("rxjs").Observable<IKibanaSearchResponse<any>>;
 ```
 
 ## Parameters
 
 |  Parameter | Type | Description |
 |  --- | --- | --- |
-|  request | <code>IKibanaSearchRequest</code> |  |
-|  options | <code>ISearchOptions</code> |  |
+|  { id, ...request } | <code>IKibanaSearchRequest</code> |  |
+|  options | <code>IAsyncSearchOptions</code> |  |
 
 <b>Returns:</b>
 
-`Observable<IKibanaSearchResponse>`
+`import("rxjs").Observable<IKibanaSearchResponse<any>>`
 
 `Observable` emitting the search response or an error.
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.deps.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.stop.md
similarity index 54%
rename from docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.deps.md
rename to docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.stop.md
index b517fb036798a..e0d77c5d13537 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.deps.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.stop.md
@@ -1,11 +1,15 @@
 <!-- Do not edit this file. It is automatically generated by API Documenter. -->
 
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptor](./kibana-plugin-plugins-data-public.searchinterceptor.md) &gt; [deps](./kibana-plugin-plugins-data-public.searchinterceptor.deps.md)
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptor](./kibana-plugin-plugins-data-public.searchinterceptor.md) &gt; [stop](./kibana-plugin-plugins-data-public.searchinterceptor.stop.md)
 
-## SearchInterceptor.deps property
+## SearchInterceptor.stop() method
 
 <b>Signature:</b>
 
 ```typescript
-protected readonly deps: SearchInterceptorDeps;
+stop(): void;
 ```
+<b>Returns:</b>
+
+`void`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.timeouterrormode.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.timeouterrormode.md
index 8ad63e2c1e9b4..bbf789b7dcf26 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.timeouterrormode.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.timeouterrormode.md
@@ -14,7 +14,6 @@ export declare enum TimeoutErrorMode
 
 |  Member | Value | Description |
 |  --- | --- | --- |
-|  CHANGE | <code>2</code> |  |
-|  CONTACT | <code>1</code> |  |
-|  UPGRADE | <code>0</code> |  |
+|  CHANGE | <code>1</code> |  |
+|  CONTACT | <code>0</code> |  |
 
diff --git a/src/plugins/data/public/mocks.ts b/src/plugins/data/public/mocks.ts
index 573820890de71..f5def327b5473 100644
--- a/src/plugins/data/public/mocks.ts
+++ b/src/plugins/data/public/mocks.ts
@@ -33,7 +33,6 @@ const createSetupContract = (): Setup => {
     search: searchServiceMock.createSetupContract(),
     fieldFormats: fieldFormatsServiceMock.createSetupContract(),
     query: querySetupMock,
-    __enhance: jest.fn(),
   };
 };
 
diff --git a/src/plugins/data/public/plugin.ts b/src/plugins/data/public/plugin.ts
index 862dd63948a22..2da3b90029980 100644
--- a/src/plugins/data/public/plugin.ts
+++ b/src/plugins/data/public/plugin.ts
@@ -16,7 +16,6 @@ import {
   DataPublicPluginStart,
   DataSetupDependencies,
   DataStartDependencies,
-  DataPublicPluginEnhancements,
 } from './types';
 import { AutocompleteService } from './autocomplete';
 import { SearchService } from './search/search_service';
@@ -122,9 +121,6 @@ export class DataPublicPlugin
       search: searchService,
       fieldFormats: this.fieldFormatsService.setup(core),
       query: queryService,
-      __enhance: (enhancements: DataPublicPluginEnhancements) => {
-        searchService.__enhance(enhancements.search);
-      },
     };
   }
 
diff --git a/src/plugins/data/public/public.api.md b/src/plugins/data/public/public.api.md
index cc7228268cb7a..cb3dfb839a023 100644
--- a/src/plugins/data/public/public.api.md
+++ b/src/plugins/data/public/public.api.md
@@ -10,7 +10,6 @@ import { Adapters as Adapters_2 } from 'src/plugins/inspector/common';
 import { ApiResponse } from '@elastic/elasticsearch/lib/Transport';
 import { ApplicationStart } from 'kibana/public';
 import { Assign } from '@kbn/utility-types';
-import { BehaviorSubject } from 'rxjs';
 import { BfetchPublicSetup } from 'src/plugins/bfetch/public';
 import Boom from '@hapi/boom';
 import { ConfigDeprecationProvider } from '@kbn/config';
@@ -579,10 +578,6 @@ export type CustomFilter = Filter & {
 //
 // @public
 export interface DataPublicPluginSetup {
-    // Warning: (ae-forgotten-export) The symbol "DataPublicPluginEnhancements" needs to be exported by the entry point index.d.ts
-    //
-    // @internal (undocumented)
-    __enhance: (enhancements: DataPublicPluginEnhancements) => void;
     // Warning: (ae-forgotten-export) The symbol "AutocompleteSetup" needs to be exported by the entry point index.d.ts
     //
     // (undocumented)
@@ -1695,10 +1690,6 @@ export interface ISearchOptions {
 //
 // @public
 export interface ISearchSetup {
-    // Warning: (ae-forgotten-export) The symbol "SearchEnhancements" needs to be exported by the entry point index.d.ts
-    //
-    // @internal (undocumented)
-    __enhance: (enhancements: SearchEnhancements) => void;
     // Warning: (ae-forgotten-export) The symbol "AggsSetup" needs to be exported by the entry point index.d.ts
     //
     // (undocumented)
@@ -2387,25 +2378,12 @@ export interface SearchError {
 // @public (undocumented)
 export class SearchInterceptor {
     constructor(deps: SearchInterceptorDeps);
-    // @internal (undocumented)
-    protected application: CoreStart['application'];
-    // (undocumented)
-    protected readonly deps: SearchInterceptorDeps;
-    // (undocumented)
-    protected getSerializableOptions(options?: ISearchOptions): Pick<ISearchOptions, "strategy" | "sessionId" | "isStored" | "isRestore" | "legacyHitsTotal">;
-    // (undocumented)
-    protected getTimeoutMode(): TimeoutErrorMode;
-    // Warning: (ae-forgotten-export) The symbol "AbortError" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    protected handleSearchError(e: KibanaServerError | AbortError, options?: ISearchOptions, isTimeout?: boolean): Error;
-    // @internal
-    protected pendingCount$: BehaviorSubject<number>;
-    // @internal (undocumented)
-    protected runSearch(request: IKibanaSearchRequest, options?: ISearchOptions): Promise<IKibanaSearchResponse>;
-    search(request: IKibanaSearchRequest, options?: ISearchOptions): Observable<IKibanaSearchResponse>;
+    // Warning: (ae-forgotten-export) The symbol "IAsyncSearchOptions" needs to be exported by the entry point index.d.ts
+    search({ id, ...request }: IKibanaSearchRequest, options?: IAsyncSearchOptions): import("rxjs").Observable<IKibanaSearchResponse<any>>;
     // (undocumented)
     showError(e: Error): void;
+    // (undocumented)
+    stop(): void;
     }
 
 // Warning: (ae-missing-release-tag) "SearchInterceptorDeps" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -2643,11 +2621,9 @@ export type TimeHistoryContract = PublicMethodsOf<TimeHistory>;
 // @public (undocumented)
 export enum TimeoutErrorMode {
     // (undocumented)
-    CHANGE = 2,
-    // (undocumented)
-    CONTACT = 1,
+    CHANGE = 1,
     // (undocumented)
-    UPGRADE = 0
+    CONTACT = 0
 }
 
 // Warning: (ae-missing-release-tag) "TimeRange" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
diff --git a/src/plugins/data/public/search/errors/timeout_error.test.tsx b/src/plugins/data/public/search/errors/timeout_error.test.tsx
index ec803fce27bfc..f1b83ae959a9e 100644
--- a/src/plugins/data/public/search/errors/timeout_error.test.tsx
+++ b/src/plugins/data/public/search/errors/timeout_error.test.tsx
@@ -20,17 +20,6 @@ describe('SearchTimeoutError', () => {
     startMock.application.navigateToApp.mockImplementation(jest.fn());
   });
 
-  it('Should navigate to upgrade', () => {
-    const e = new SearchTimeoutError(new AbortError(), TimeoutErrorMode.UPGRADE);
-    const component = mount(e.getErrorMessage(startMock.application));
-
-    expect(component.find('EuiButton').length).toBe(1);
-    component.find('EuiButton').simulate('click');
-    expect(startMock.application.navigateToUrl).toHaveBeenCalledWith(
-      'https://www.elastic.co/subscriptions'
-    );
-  });
-
   it('Should create contact admin message', () => {
     const e = new SearchTimeoutError(new AbortError(), TimeoutErrorMode.CONTACT);
     const component = mount(e.getErrorMessage(startMock.application));
diff --git a/src/plugins/data/public/search/errors/timeout_error.tsx b/src/plugins/data/public/search/errors/timeout_error.tsx
index e640bbc6f25cd..29b921c9cc12b 100644
--- a/src/plugins/data/public/search/errors/timeout_error.tsx
+++ b/src/plugins/data/public/search/errors/timeout_error.tsx
@@ -13,7 +13,6 @@ import { ApplicationStart } from 'kibana/public';
 import { KbnError } from '../../../../kibana_utils/common';
 
 export enum TimeoutErrorMode {
-  UPGRADE,
   CONTACT,
   CHANGE,
 }
@@ -31,11 +30,6 @@ export class SearchTimeoutError extends KbnError {
 
   private getMessage() {
     switch (this.mode) {
-      case TimeoutErrorMode.UPGRADE:
-        return i18n.translate('data.search.upgradeLicense', {
-          defaultMessage:
-            'Your query has timed out. With our free Basic tier, your queries never time out.',
-        });
       case TimeoutErrorMode.CONTACT:
         return i18n.translate('data.search.timeoutContactAdmin', {
           defaultMessage:
@@ -51,11 +45,6 @@ export class SearchTimeoutError extends KbnError {
 
   private getActionText() {
     switch (this.mode) {
-      case TimeoutErrorMode.UPGRADE:
-        return i18n.translate('data.search.upgradeLicenseActionText', {
-          defaultMessage: 'Upgrade now',
-        });
-        break;
       case TimeoutErrorMode.CHANGE:
         return i18n.translate('data.search.timeoutIncreaseSettingActionText', {
           defaultMessage: 'Edit setting',
@@ -66,9 +55,6 @@ export class SearchTimeoutError extends KbnError {
 
   private onClick(application: ApplicationStart) {
     switch (this.mode) {
-      case TimeoutErrorMode.UPGRADE:
-        application.navigateToUrl('https://www.elastic.co/subscriptions');
-        break;
       case TimeoutErrorMode.CHANGE:
         application.navigateToApp('management', {
           path: `/kibana/settings`,
diff --git a/src/plugins/data/public/search/index.ts b/src/plugins/data/public/search/index.ts
index 92a5c36202e6f..21d607eedb152 100644
--- a/src/plugins/data/public/search/index.ts
+++ b/src/plugins/data/public/search/index.ts
@@ -12,7 +12,6 @@ export {
   ISearchSetup,
   ISearchStart,
   ISearchStartSearchSource,
-  SearchEnhancements,
   SearchUsageCollector,
 } from './types';
 
diff --git a/src/plugins/data/public/search/mocks.ts b/src/plugins/data/public/search/mocks.ts
index 273bbfe9e7b08..562b367b92c92 100644
--- a/src/plugins/data/public/search/mocks.ts
+++ b/src/plugins/data/public/search/mocks.ts
@@ -15,7 +15,6 @@ import { createSearchUsageCollectorMock } from './collectors/mocks';
 function createSetupContract(): jest.Mocked<ISearchSetup> {
   return {
     aggs: searchAggsSetupMock(),
-    __enhance: jest.fn(),
     session: getSessionServiceMock(),
     sessionsClient: getSessionsClientMock(),
     usageCollector: createSearchUsageCollectorMock(),
diff --git a/src/plugins/data/public/search/search_interceptor.test.ts b/src/plugins/data/public/search/search_interceptor.test.ts
deleted file mode 100644
index e74581e9a6ffe..0000000000000
--- a/src/plugins/data/public/search/search_interceptor.test.ts
+++ /dev/null
@@ -1,323 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import type { MockedKeys } from '@kbn/utility-types/jest';
-import { CoreSetup, CoreStart } from '../../../../core/public';
-import { coreMock } from '../../../../core/public/mocks';
-import { IEsSearchRequest } from '../../common/search';
-import { SearchInterceptor } from './search_interceptor';
-import { AbortError } from '../../../kibana_utils/public';
-import { SearchTimeoutError, PainlessError, TimeoutErrorMode, EsError } from './errors';
-import { searchServiceMock } from './mocks';
-import { ISearchStart, ISessionService } from '.';
-import { bfetchPluginMock } from '../../../bfetch/public/mocks';
-import { BfetchPublicSetup } from 'src/plugins/bfetch/public';
-
-import * as searchPhaseException from '../../common/search/test_data/search_phase_execution_exception.json';
-import * as resourceNotFoundException from '../../common/search/test_data/resource_not_found_exception.json';
-
-let searchInterceptor: SearchInterceptor;
-let mockCoreSetup: MockedKeys<CoreSetup>;
-let bfetchSetup: jest.Mocked<BfetchPublicSetup>;
-let fetchMock: jest.Mock<any>;
-
-const flushPromises = () => new Promise((resolve) => setImmediate(resolve));
-jest.useFakeTimers();
-
-describe('SearchInterceptor', () => {
-  let searchMock: jest.Mocked<ISearchStart>;
-  let mockCoreStart: MockedKeys<CoreStart>;
-  beforeEach(() => {
-    mockCoreSetup = coreMock.createSetup();
-    mockCoreStart = coreMock.createStart();
-    searchMock = searchServiceMock.createStartContract();
-    fetchMock = jest.fn();
-    bfetchSetup = bfetchPluginMock.createSetupContract();
-    bfetchSetup.batchedFunction.mockReturnValue(fetchMock);
-    searchInterceptor = new SearchInterceptor({
-      bfetch: bfetchSetup,
-      toasts: mockCoreSetup.notifications.toasts,
-      startServices: new Promise((resolve) => {
-        resolve([mockCoreStart, {}, {}]);
-      }),
-      uiSettings: mockCoreSetup.uiSettings,
-      http: mockCoreSetup.http,
-      session: searchMock.session,
-    });
-  });
-
-  describe('showError', () => {
-    test('Ignores an AbortError', async () => {
-      searchInterceptor.showError(new AbortError());
-      expect(mockCoreSetup.notifications.toasts.addDanger).not.toBeCalled();
-      expect(mockCoreSetup.notifications.toasts.addError).not.toBeCalled();
-    });
-
-    test('Ignores a SearchTimeoutError', async () => {
-      searchInterceptor.showError(new SearchTimeoutError(new Error(), TimeoutErrorMode.UPGRADE));
-      expect(mockCoreSetup.notifications.toasts.addDanger).not.toBeCalled();
-      expect(mockCoreSetup.notifications.toasts.addError).not.toBeCalled();
-    });
-
-    test('Renders a PainlessError', async () => {
-      searchInterceptor.showError(
-        new PainlessError({
-          statusCode: 400,
-          message: 'search_phase_execution_exception',
-          attributes: searchPhaseException.error,
-        })
-      );
-      expect(mockCoreSetup.notifications.toasts.addDanger).toBeCalledTimes(1);
-      expect(mockCoreSetup.notifications.toasts.addError).not.toBeCalled();
-    });
-
-    test('Renders a general error', async () => {
-      searchInterceptor.showError(new Error('Oopsy'));
-      expect(mockCoreSetup.notifications.toasts.addDanger).not.toBeCalled();
-      expect(mockCoreSetup.notifications.toasts.addError).toBeCalledTimes(1);
-    });
-  });
-
-  describe('search', () => {
-    test('Observable should resolve if fetch is successful', async () => {
-      const mockResponse: any = { result: 200 };
-      fetchMock.mockResolvedValueOnce(mockResponse);
-      const mockRequest: IEsSearchRequest = {
-        params: {},
-      };
-      const response = searchInterceptor.search(mockRequest);
-      await expect(response.toPromise()).resolves.toBe(mockResponse);
-    });
-
-    describe('Search session', () => {
-      const setup = (
-        opts: {
-          isRestore?: boolean;
-          isStored?: boolean;
-          sessionId: string;
-        } | null
-      ) => {
-        const sessionServiceMock = searchMock.session as jest.Mocked<ISessionService>;
-        sessionServiceMock.getSearchOptions.mockImplementation(() =>
-          opts
-            ? {
-                sessionId: opts.sessionId,
-                isRestore: opts.isRestore ?? false,
-                isStored: opts.isStored ?? false,
-              }
-            : null
-        );
-        fetchMock.mockResolvedValue({ result: 200 });
-      };
-
-      const mockRequest: IEsSearchRequest = {
-        params: {},
-      };
-
-      afterEach(() => {
-        const sessionServiceMock = searchMock.session as jest.Mocked<ISessionService>;
-        sessionServiceMock.getSearchOptions.mockReset();
-        fetchMock.mockReset();
-      });
-
-      test('gets session search options from session service', async () => {
-        const sessionId = 'sid';
-        setup({
-          isRestore: true,
-          isStored: true,
-          sessionId,
-        });
-
-        await searchInterceptor.search(mockRequest, { sessionId }).toPromise();
-        expect(fetchMock.mock.calls[0][0]).toEqual(
-          expect.objectContaining({
-            options: { sessionId, isStored: true, isRestore: true, strategy: 'es' },
-          })
-        );
-
-        expect(
-          (searchMock.session as jest.Mocked<ISessionService>).getSearchOptions
-        ).toHaveBeenCalledWith(sessionId);
-      });
-
-      test("doesn't forward sessionId if search options return null", async () => {
-        const sessionId = 'sid';
-        setup(null);
-
-        await searchInterceptor.search(mockRequest, { sessionId }).toPromise();
-        expect(fetchMock.mock.calls[0][0]).toEqual(
-          expect.not.objectContaining({
-            options: { sessionId },
-          })
-        );
-
-        expect(
-          (searchMock.session as jest.Mocked<ISessionService>).getSearchOptions
-        ).toHaveBeenCalledWith(sessionId);
-      });
-    });
-
-    describe('Should throw typed errors', () => {
-      test('Observable should fail if fetch has an internal error', async () => {
-        const mockResponse: any = new Error('Internal Error');
-        fetchMock.mockRejectedValue(mockResponse);
-        const mockRequest: IEsSearchRequest = {
-          params: {},
-        };
-        const response = searchInterceptor.search(mockRequest);
-        await expect(response.toPromise()).rejects.toThrow('Internal Error');
-      });
-
-      describe('Should handle Timeout errors', () => {
-        test('Should throw SearchTimeoutError on server timeout AND show toast', async () => {
-          const mockResponse: any = {
-            statusCode: 500,
-            message: 'Request timed out',
-          };
-          fetchMock.mockRejectedValueOnce(mockResponse);
-          const mockRequest: IEsSearchRequest = {
-            params: {},
-          };
-          const response = searchInterceptor.search(mockRequest);
-          await expect(response.toPromise()).rejects.toThrow(SearchTimeoutError);
-          expect(mockCoreSetup.notifications.toasts.addDanger).toBeCalledTimes(1);
-        });
-
-        test('Timeout error should show multiple times if not in a session', async () => {
-          const mockResponse: any = {
-            statusCode: 500,
-            message: 'Request timed out',
-          };
-          fetchMock.mockRejectedValue(mockResponse);
-          const mockRequest: IEsSearchRequest = {
-            params: {},
-          };
-
-          await expect(searchInterceptor.search(mockRequest).toPromise()).rejects.toThrow(
-            SearchTimeoutError
-          );
-          await expect(searchInterceptor.search(mockRequest).toPromise()).rejects.toThrow(
-            SearchTimeoutError
-          );
-          expect(mockCoreSetup.notifications.toasts.addDanger).toBeCalledTimes(2);
-        });
-
-        test('Timeout error should show once per each session', async () => {
-          const mockResponse: any = {
-            statusCode: 500,
-            message: 'Request timed out',
-          };
-          fetchMock.mockRejectedValue(mockResponse);
-          const mockRequest: IEsSearchRequest = {
-            params: {},
-          };
-
-          await expect(
-            searchInterceptor.search(mockRequest, { sessionId: 'abc' }).toPromise()
-          ).rejects.toThrow(SearchTimeoutError);
-          await expect(
-            searchInterceptor.search(mockRequest, { sessionId: 'def' }).toPromise()
-          ).rejects.toThrow(SearchTimeoutError);
-          expect(mockCoreSetup.notifications.toasts.addDanger).toBeCalledTimes(2);
-        });
-
-        test('Timeout error should show once in a single session', async () => {
-          const mockResponse: any = {
-            statusCode: 500,
-            message: 'Request timed out',
-          };
-          fetchMock.mockRejectedValue(mockResponse);
-          const mockRequest: IEsSearchRequest = {
-            params: {},
-          };
-          await expect(
-            searchInterceptor.search(mockRequest, { sessionId: 'abc' }).toPromise()
-          ).rejects.toThrow(SearchTimeoutError);
-          await expect(
-            searchInterceptor.search(mockRequest, { sessionId: 'abc' }).toPromise()
-          ).rejects.toThrow(SearchTimeoutError);
-          expect(mockCoreSetup.notifications.toasts.addDanger).toBeCalledTimes(1);
-        });
-      });
-
-      test('Should throw Painless error on server error with OSS format', async () => {
-        const mockResponse: any = {
-          statusCode: 400,
-          message: 'search_phase_execution_exception',
-          attributes: searchPhaseException.error,
-        };
-        fetchMock.mockRejectedValueOnce(mockResponse);
-        const mockRequest: IEsSearchRequest = {
-          params: {},
-        };
-        const response = searchInterceptor.search(mockRequest);
-        await expect(response.toPromise()).rejects.toThrow(PainlessError);
-      });
-
-      test('Should throw ES error on ES server error', async () => {
-        const mockResponse: any = {
-          statusCode: 400,
-          message: 'resource_not_found_exception',
-          attributes: resourceNotFoundException.error,
-        };
-        fetchMock.mockRejectedValueOnce(mockResponse);
-        const mockRequest: IEsSearchRequest = {
-          params: {},
-        };
-        const response = searchInterceptor.search(mockRequest);
-        await expect(response.toPromise()).rejects.toThrow(EsError);
-      });
-
-      test('Observable should fail if user aborts (test merged signal)', async () => {
-        const abortController = new AbortController();
-        fetchMock.mockImplementationOnce((options: any) => {
-          return new Promise((resolve, reject) => {
-            options.signal.addEventListener('abort', () => {
-              reject(new AbortError());
-            });
-
-            setTimeout(resolve, 500);
-          });
-        });
-        const mockRequest: IEsSearchRequest = {
-          params: {},
-        };
-        const response = searchInterceptor.search(mockRequest, {
-          abortSignal: abortController.signal,
-        });
-
-        const next = jest.fn();
-        const error = (e: any) => {
-          expect(next).not.toBeCalled();
-          expect(e).toBeInstanceOf(AbortError);
-        };
-        response.subscribe({ next, error });
-        setTimeout(() => abortController.abort(), 200);
-        jest.advanceTimersByTime(5000);
-
-        await flushPromises();
-      });
-
-      test('Immediately aborts if passed an aborted abort signal', async (done) => {
-        const abort = new AbortController();
-        const mockRequest: IEsSearchRequest = {
-          params: {},
-        };
-        const response = searchInterceptor.search(mockRequest, { abortSignal: abort.signal });
-        abort.abort();
-
-        const error = (e: any) => {
-          expect(e).toBeInstanceOf(AbortError);
-          expect(fetchMock).not.toBeCalled();
-          done();
-        };
-        response.subscribe({ error });
-      });
-    });
-  });
-});
diff --git a/src/plugins/data/public/search/search_interceptor.ts b/src/plugins/data/public/search/search_interceptor.ts
deleted file mode 100644
index f0df6f9216c0f..0000000000000
--- a/src/plugins/data/public/search/search_interceptor.ts
+++ /dev/null
@@ -1,245 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { memoize } from 'lodash';
-import { BehaviorSubject, throwError, defer, from, Observable } from 'rxjs';
-import { catchError, finalize } from 'rxjs/operators';
-import { PublicMethodsOf } from '@kbn/utility-types';
-import { CoreStart, CoreSetup, ToastsSetup } from 'kibana/public';
-import { i18n } from '@kbn/i18n';
-import { BatchedFunc, BfetchPublicSetup } from 'src/plugins/bfetch/public';
-import {
-  ES_SEARCH_STRATEGY,
-  IKibanaSearchRequest,
-  IKibanaSearchResponse,
-  ISearchOptions,
-  ISearchOptionsSerializable,
-} from '../../common';
-import { SearchUsageCollector } from './collectors';
-import {
-  SearchTimeoutError,
-  PainlessError,
-  isPainlessError,
-  TimeoutErrorMode,
-  isEsError,
-  EsError,
-  getHttpError,
-} from './errors';
-import { toMountPoint } from '../../../kibana_react/public';
-import { AbortError, KibanaServerError } from '../../../kibana_utils/public';
-import { ISessionService } from './session';
-
-export interface SearchInterceptorDeps {
-  bfetch: BfetchPublicSetup;
-  http: CoreSetup['http'];
-  uiSettings: CoreSetup['uiSettings'];
-  startServices: Promise<[CoreStart, any, unknown]>;
-  toasts: ToastsSetup;
-  usageCollector?: SearchUsageCollector;
-  session: ISessionService;
-}
-
-export class SearchInterceptor {
-  /**
-   * Observable that emits when the number of pending requests changes.
-   * @internal
-   */
-  protected pendingCount$ = new BehaviorSubject(0);
-
-  /**
-   * @internal
-   */
-  protected application!: CoreStart['application'];
-  private batchedFetch!: BatchedFunc<
-    { request: IKibanaSearchRequest; options: ISearchOptionsSerializable },
-    IKibanaSearchResponse
-  >;
-
-  /*
-   * @internal
-   */
-  constructor(protected readonly deps: SearchInterceptorDeps) {
-    this.deps.http.addLoadingCountSource(this.pendingCount$);
-
-    this.deps.startServices.then(([coreStart]) => {
-      this.application = coreStart.application;
-    });
-
-    this.batchedFetch = deps.bfetch.batchedFunction({
-      url: '/internal/bsearch',
-    });
-  }
-
-  /*
-   * @returns `TimeoutErrorMode` indicating what action should be taken in case of a request timeout based on license and permissions.
-   * @internal
-   */
-  protected getTimeoutMode() {
-    return TimeoutErrorMode.UPGRADE;
-  }
-
-  /*
-   * @returns `Error` a search service specific error or the original error, if a specific error can't be recognized.
-   * @internal
-   */
-  protected handleSearchError(
-    e: KibanaServerError | AbortError,
-    options?: ISearchOptions,
-    isTimeout?: boolean
-  ): Error {
-    if (isTimeout || e.message === 'Request timed out') {
-      // Handle a client or a server side timeout
-      const err = new SearchTimeoutError(e, this.getTimeoutMode());
-
-      // Show the timeout error here, so that it's shown regardless of how an application chooses to handle errors.
-      // The timeout error is shown any time a request times out, or once per session, if the request is part of a session.
-      this.showTimeoutError(err, options?.sessionId);
-      return err;
-    } else if (e instanceof AbortError) {
-      // In the case an application initiated abort, throw the existing AbortError.
-      return e;
-    } else if (isEsError(e)) {
-      if (isPainlessError(e)) {
-        return new PainlessError(e, options?.indexPattern);
-      } else {
-        return new EsError(e);
-      }
-    } else {
-      return e instanceof Error ? e : new Error(e.message);
-    }
-  }
-
-  protected getSerializableOptions(options?: ISearchOptions) {
-    const { sessionId, ...requestOptions } = options || {};
-
-    const serializableOptions: ISearchOptionsSerializable = {};
-    const combined = {
-      ...requestOptions,
-      ...this.deps.session.getSearchOptions(sessionId),
-    };
-
-    if (combined.sessionId !== undefined) serializableOptions.sessionId = combined.sessionId;
-    if (combined.isRestore !== undefined) serializableOptions.isRestore = combined.isRestore;
-    if (combined.legacyHitsTotal !== undefined)
-      serializableOptions.legacyHitsTotal = combined.legacyHitsTotal;
-    if (combined.strategy !== undefined) serializableOptions.strategy = combined.strategy;
-    if (combined.isStored !== undefined) serializableOptions.isStored = combined.isStored;
-
-    return serializableOptions;
-  }
-
-  /**
-   * @internal
-   * @throws `AbortError` | `ErrorLike`
-   */
-  protected runSearch(
-    request: IKibanaSearchRequest,
-    options?: ISearchOptions
-  ): Promise<IKibanaSearchResponse> {
-    const { abortSignal } = options || {};
-    return this.batchedFetch(
-      {
-        request,
-        options: this.getSerializableOptions(options),
-      },
-      abortSignal
-    );
-  }
-
-  private showTimeoutErrorToast = (e: SearchTimeoutError, sessionId?: string) => {
-    this.deps.toasts.addDanger({
-      title: 'Timed out',
-      text: toMountPoint(e.getErrorMessage(this.application)),
-    });
-  };
-
-  private showTimeoutErrorMemoized = memoize(
-    this.showTimeoutErrorToast,
-    (_: SearchTimeoutError, sessionId: string) => {
-      return sessionId;
-    }
-  );
-
-  /**
-   * Show one error notification per session.
-   * @internal
-   */
-  private showTimeoutError = (e: SearchTimeoutError, sessionId?: string) => {
-    if (sessionId) {
-      this.showTimeoutErrorMemoized(e, sessionId);
-    } else {
-      this.showTimeoutErrorToast(e, sessionId);
-    }
-  };
-
-  /**
-   * Searches using the given `search` method. Overrides the `AbortSignal` with one that will abort
-   * either when the request times out, or when the original `AbortSignal` is aborted. Updates
-   * `pendingCount$` when the request is started/finalized.
-   *
-   * @param request
-   * @options
-   * @returns `Observable` emitting the search response or an error.
-   */
-  public search(
-    request: IKibanaSearchRequest,
-    options: ISearchOptions = {}
-  ): Observable<IKibanaSearchResponse> {
-    options = {
-      strategy: ES_SEARCH_STRATEGY,
-      ...options,
-    };
-
-    // Defer the following logic until `subscribe` is actually called
-    return defer(() => {
-      if (options.abortSignal?.aborted) {
-        return throwError(new AbortError());
-      }
-
-      this.pendingCount$.next(this.pendingCount$.getValue() + 1);
-      return from(this.runSearch(request, options)).pipe(
-        catchError((e: Error | AbortError) => {
-          return throwError(this.handleSearchError(e, options));
-        }),
-        finalize(() => {
-          this.pendingCount$.next(this.pendingCount$.getValue() - 1);
-        })
-      );
-    });
-  }
-
-  /*
-   *
-   */
-  public showError(e: Error) {
-    if (e instanceof AbortError || e instanceof SearchTimeoutError) {
-      // The SearchTimeoutError is shown by the interceptor in getSearchError (regardless of how the app chooses to handle errors)
-      return;
-    } else if (e instanceof EsError) {
-      this.deps.toasts.addDanger({
-        title: i18n.translate('data.search.esErrorTitle', {
-          defaultMessage: 'Cannot retrieve search results',
-        }),
-        text: toMountPoint(e.getErrorMessage(this.application)),
-      });
-    } else if (e.constructor.name === 'HttpFetchError') {
-      this.deps.toasts.addDanger({
-        title: i18n.translate('data.search.httpErrorTitle', {
-          defaultMessage: 'Cannot retrieve your data',
-        }),
-        text: toMountPoint(getHttpError(e.message)),
-      });
-    } else {
-      this.deps.toasts.addError(e, {
-        title: 'Search Error',
-      });
-    }
-  }
-}
-
-export type ISearchInterceptor = PublicMethodsOf<SearchInterceptor>;
diff --git a/src/plugins/data/public/search/search_interceptor/index.ts b/src/plugins/data/public/search/search_interceptor/index.ts
new file mode 100644
index 0000000000000..411c4beefe96c
--- /dev/null
+++ b/src/plugins/data/public/search/search_interceptor/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { SearchInterceptor, ISearchInterceptor, SearchInterceptorDeps } from './search_interceptor';
diff --git a/x-pack/plugins/data_enhanced/public/search/search_abort_controller.test.ts b/src/plugins/data/public/search/search_interceptor/search_abort_controller.test.ts
similarity index 94%
rename from x-pack/plugins/data_enhanced/public/search/search_abort_controller.test.ts
rename to src/plugins/data/public/search/search_interceptor/search_abort_controller.test.ts
index a52fdef9819b8..5d9d8a9903325 100644
--- a/x-pack/plugins/data_enhanced/public/search/search_abort_controller.test.ts
+++ b/src/plugins/data/public/search/search_interceptor/search_abort_controller.test.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import { SearchAbortController } from './search_abort_controller';
diff --git a/x-pack/plugins/data_enhanced/public/search/search_abort_controller.ts b/src/plugins/data/public/search/search_interceptor/search_abort_controller.ts
similarity index 90%
rename from x-pack/plugins/data_enhanced/public/search/search_abort_controller.ts
rename to src/plugins/data/public/search/search_interceptor/search_abort_controller.ts
index 7bc74b56a3903..1e2cdae1070ab 100644
--- a/x-pack/plugins/data_enhanced/public/search/search_abort_controller.ts
+++ b/src/plugins/data/public/search/search_interceptor/search_abort_controller.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import { Subscription, timer } from 'rxjs';
diff --git a/src/plugins/data/public/search/search_interceptor/search_interceptor.test.ts b/src/plugins/data/public/search/search_interceptor/search_interceptor.test.ts
new file mode 100644
index 0000000000000..89b696a80d57d
--- /dev/null
+++ b/src/plugins/data/public/search/search_interceptor/search_interceptor.test.ts
@@ -0,0 +1,1364 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { MockedKeys } from '@kbn/utility-types/jest';
+import { CoreSetup, CoreStart } from '../../../../../core/public';
+import { coreMock } from '../../../../../core/public/mocks';
+import { IEsSearchRequest } from '../../../common/search';
+import { SearchInterceptor } from './search_interceptor';
+import { AbortError } from '../../../../kibana_utils/public';
+import { SearchTimeoutError, PainlessError, TimeoutErrorMode, EsError } from '../errors';
+import { ISessionService, SearchSessionState } from '../';
+import { bfetchPluginMock } from '../../../../bfetch/public/mocks';
+import { BfetchPublicSetup } from 'src/plugins/bfetch/public';
+
+import * as searchPhaseException from '../../../common/search/test_data/search_phase_execution_exception.json';
+import * as resourceNotFoundException from '../../../common/search/test_data/resource_not_found_exception.json';
+import { BehaviorSubject } from 'rxjs';
+import { dataPluginMock } from '../../mocks';
+import { UI_SETTINGS } from '../../../common';
+
+jest.mock('./utils', () => ({
+  createRequestHash: jest.fn().mockImplementation((input) => {
+    return Promise.resolve(JSON.stringify(input));
+  }),
+}));
+
+let searchInterceptor: SearchInterceptor;
+let mockCoreSetup: MockedKeys<CoreSetup>;
+let bfetchSetup: jest.Mocked<BfetchPublicSetup>;
+let fetchMock: jest.Mock<any>;
+
+const flushPromises = () => new Promise((resolve) => setImmediate(resolve));
+jest.useFakeTimers();
+
+const timeTravel = async (msToRun = 0) => {
+  await flushPromises();
+  jest.advanceTimersByTime(msToRun);
+  return flushPromises();
+};
+
+const next = jest.fn();
+const error = jest.fn();
+const complete = jest.fn();
+
+function mockFetchImplementation(responses: any[]) {
+  let i = 0;
+  fetchMock.mockImplementation((r) => {
+    if (!r.request.id) i = 0;
+    const { time = 0, value = {}, isError = false } = responses[i++];
+    value.meta = {
+      size: 10,
+    };
+    return new Promise((resolve, reject) =>
+      setTimeout(() => {
+        return (isError ? reject : resolve)(value);
+      }, time)
+    );
+  });
+}
+
+describe('SearchInterceptor', () => {
+  let mockCoreStart: MockedKeys<CoreStart>;
+  let sessionService: jest.Mocked<ISessionService>;
+  let sessionState$: BehaviorSubject<SearchSessionState>;
+
+  beforeEach(() => {
+    mockCoreSetup = coreMock.createSetup();
+    mockCoreStart = coreMock.createStart();
+    sessionState$ = new BehaviorSubject<SearchSessionState>(SearchSessionState.None);
+    const dataPluginMockStart = dataPluginMock.createStartContract();
+    sessionService = {
+      ...(dataPluginMockStart.search.session as jest.Mocked<ISessionService>),
+      state$: sessionState$,
+    };
+
+    fetchMock = jest.fn();
+    mockCoreSetup.uiSettings.get.mockImplementation((name: string) => {
+      switch (name) {
+        case UI_SETTINGS.SEARCH_TIMEOUT:
+          return 1000;
+        default:
+          return;
+      }
+    });
+
+    next.mockClear();
+    error.mockClear();
+    complete.mockClear();
+    jest.clearAllTimers();
+
+    const bfetchMock = bfetchPluginMock.createSetupContract();
+    bfetchMock.batchedFunction.mockReturnValue(fetchMock);
+
+    bfetchSetup = bfetchPluginMock.createSetupContract();
+    bfetchSetup.batchedFunction.mockReturnValue(fetchMock);
+    searchInterceptor = new SearchInterceptor({
+      bfetch: bfetchSetup,
+      toasts: mockCoreSetup.notifications.toasts,
+      startServices: new Promise((resolve) => {
+        resolve([mockCoreStart, {}, {}]);
+      }),
+      uiSettings: mockCoreSetup.uiSettings,
+      http: mockCoreSetup.http,
+      session: sessionService,
+    });
+  });
+
+  describe('showError', () => {
+    test('Ignores an AbortError', async () => {
+      searchInterceptor.showError(new AbortError());
+      expect(mockCoreSetup.notifications.toasts.addDanger).not.toBeCalled();
+      expect(mockCoreSetup.notifications.toasts.addError).not.toBeCalled();
+    });
+
+    test('Ignores a SearchTimeoutError', async () => {
+      searchInterceptor.showError(new SearchTimeoutError(new Error(), TimeoutErrorMode.CONTACT));
+      expect(mockCoreSetup.notifications.toasts.addDanger).not.toBeCalled();
+      expect(mockCoreSetup.notifications.toasts.addError).not.toBeCalled();
+    });
+
+    test('Renders a PainlessError', async () => {
+      searchInterceptor.showError(
+        new PainlessError({
+          statusCode: 400,
+          message: 'search_phase_execution_exception',
+          attributes: searchPhaseException.error,
+        })
+      );
+      expect(mockCoreSetup.notifications.toasts.addDanger).toBeCalledTimes(1);
+      expect(mockCoreSetup.notifications.toasts.addError).not.toBeCalled();
+    });
+
+    test('Renders a general error', async () => {
+      searchInterceptor.showError(new Error('Oopsy'));
+      expect(mockCoreSetup.notifications.toasts.addDanger).not.toBeCalled();
+      expect(mockCoreSetup.notifications.toasts.addError).toBeCalledTimes(1);
+    });
+  });
+
+  describe('search', () => {
+    test('Observable should resolve if fetch is successful', async () => {
+      const mockResponse: any = { result: 200 };
+      fetchMock.mockResolvedValueOnce(mockResponse);
+      const mockRequest: IEsSearchRequest = {
+        params: {},
+      };
+      const response = searchInterceptor.search(mockRequest);
+      await expect(response.toPromise()).resolves.toBe(mockResponse);
+    });
+
+    test('should resolve immediately if first call returns full result', async () => {
+      const responses = [
+        {
+          time: 10,
+          value: {
+            isPartial: false,
+            isRunning: false,
+            id: 1,
+            rawResponse: {
+              took: 1,
+            },
+          },
+        },
+      ];
+      mockFetchImplementation(responses);
+
+      const response = searchInterceptor.search({});
+      response.subscribe({ next, error, complete });
+
+      await timeTravel(10);
+
+      expect(next).toHaveBeenCalled();
+      expect(next.mock.calls[0][0]).toStrictEqual(responses[0].value);
+      expect(complete).toHaveBeenCalled();
+      expect(error).not.toHaveBeenCalled();
+    });
+
+    test('should make secondary request if first call returns partial result', async () => {
+      const responses = [
+        {
+          time: 10,
+          value: {
+            isPartial: true,
+            isRunning: true,
+            id: 1,
+            rawResponse: {
+              took: 1,
+            },
+          },
+        },
+        {
+          time: 20,
+          value: {
+            isPartial: false,
+            isRunning: false,
+            id: 1,
+            rawResponse: {
+              took: 1,
+            },
+          },
+        },
+      ];
+
+      mockFetchImplementation(responses);
+
+      const response = searchInterceptor.search({}, { pollInterval: 0 });
+      response.subscribe({ next, error, complete });
+
+      await timeTravel(10);
+
+      expect(next).toHaveBeenCalled();
+      expect(next.mock.calls[0][0]).toStrictEqual(responses[0].value);
+      expect(complete).not.toHaveBeenCalled();
+      expect(error).not.toHaveBeenCalled();
+
+      await timeTravel(20);
+
+      expect(next).toHaveBeenCalledTimes(2);
+      expect(next.mock.calls[1][0]).toStrictEqual(responses[1].value);
+      expect(complete).toHaveBeenCalled();
+      expect(error).not.toHaveBeenCalled();
+    });
+
+    test('should abort if request is partial and not running (ES graceful error)', async () => {
+      const responses = [
+        {
+          time: 10,
+          value: {
+            isPartial: true,
+            isRunning: false,
+            id: 1,
+          },
+        },
+      ];
+      mockFetchImplementation(responses);
+
+      const response = searchInterceptor.search({});
+      response.subscribe({ next, error });
+
+      await timeTravel(10);
+
+      expect(error).toHaveBeenCalled();
+      expect(error.mock.calls[0][0]).toBeInstanceOf(Error);
+    });
+
+    test('should abort on user abort', async () => {
+      const responses = [
+        {
+          time: 500,
+          value: {
+            isPartial: false,
+            isRunning: false,
+            id: 1,
+          },
+        },
+      ];
+      mockFetchImplementation(responses);
+
+      const abortController = new AbortController();
+      abortController.abort();
+
+      const response = searchInterceptor.search({}, { abortSignal: abortController.signal });
+      response.subscribe({ next, error });
+
+      await timeTravel(500);
+
+      expect(next).not.toHaveBeenCalled();
+      expect(error).toHaveBeenCalled();
+      expect(error.mock.calls[0][0]).toBeInstanceOf(AbortError);
+    });
+
+    test('should DELETE a running async search on abort', async () => {
+      const responses = [
+        {
+          time: 10,
+          value: {
+            isPartial: true,
+            isRunning: true,
+            id: 1,
+          },
+        },
+        {
+          time: 300,
+          value: {
+            isPartial: false,
+            isRunning: false,
+            id: 1,
+          },
+        },
+      ];
+      mockFetchImplementation(responses);
+
+      const abortController = new AbortController();
+      setTimeout(() => abortController.abort(), 250);
+
+      const response = searchInterceptor.search(
+        {},
+        { abortSignal: abortController.signal, pollInterval: 0 }
+      );
+      response.subscribe({ next, error });
+
+      await timeTravel(10);
+
+      expect(next).toHaveBeenCalled();
+      expect(error).not.toHaveBeenCalled();
+
+      await timeTravel(240);
+
+      expect(error).toHaveBeenCalled();
+      expect(error.mock.calls[0][0]).toBeInstanceOf(AbortError);
+
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+      expect(mockCoreSetup.http.delete).toHaveBeenCalledTimes(1);
+    });
+
+    test('should not DELETE a running async search on async timeout prior to first response', async () => {
+      const responses = [
+        {
+          time: 2000,
+          value: {
+            isPartial: false,
+            isRunning: false,
+            id: 1,
+          },
+        },
+      ];
+      mockFetchImplementation(responses);
+
+      const response = searchInterceptor.search({}, { pollInterval: 0 });
+      response.subscribe({ next, error });
+
+      await timeTravel(1000);
+
+      expect(error).toHaveBeenCalled();
+      expect(error.mock.calls[0][0]).toBeInstanceOf(SearchTimeoutError);
+      expect(fetchMock).toHaveBeenCalled();
+      expect(mockCoreSetup.http.delete).not.toHaveBeenCalled();
+    });
+
+    test('should DELETE a running async search on async timeout after first response', async () => {
+      const responses = [
+        {
+          time: 10,
+          value: {
+            isPartial: true,
+            isRunning: true,
+            id: 1,
+          },
+        },
+        {
+          time: 2000,
+          value: {
+            isPartial: false,
+            isRunning: false,
+            id: 1,
+          },
+        },
+      ];
+      mockFetchImplementation(responses);
+
+      const response = searchInterceptor.search({}, { pollInterval: 0 });
+      response.subscribe({ next, error });
+
+      await timeTravel(10);
+
+      expect(next).toHaveBeenCalled();
+      expect(error).not.toHaveBeenCalled();
+      expect(fetchMock).toHaveBeenCalled();
+      expect(mockCoreSetup.http.delete).not.toHaveBeenCalled();
+
+      // Long enough to reach the timeout but not long enough to reach the next response
+      await timeTravel(1000);
+
+      expect(error).toHaveBeenCalled();
+      expect(error.mock.calls[0][0]).toBeInstanceOf(SearchTimeoutError);
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+      expect(mockCoreSetup.http.delete).toHaveBeenCalledTimes(1);
+    });
+
+    test('should DELETE a running async search on async timeout on error from fetch', async () => {
+      const responses = [
+        {
+          time: 10,
+          value: {
+            isPartial: true,
+            isRunning: true,
+            id: 1,
+          },
+        },
+        {
+          time: 10,
+          value: {
+            statusCode: 500,
+            message: 'oh no',
+            id: 1,
+          },
+          isError: true,
+        },
+      ];
+      mockFetchImplementation(responses);
+
+      const response = searchInterceptor.search({}, { pollInterval: 0 });
+      response.subscribe({ next, error });
+
+      await timeTravel(10);
+
+      expect(next).toHaveBeenCalled();
+      expect(error).not.toHaveBeenCalled();
+      expect(fetchMock).toHaveBeenCalled();
+      expect(mockCoreSetup.http.delete).not.toHaveBeenCalled();
+
+      // Long enough to reach the timeout but not long enough to reach the next response
+      await timeTravel(10);
+
+      expect(error).toHaveBeenCalled();
+      expect(error.mock.calls[0][0]).toBeInstanceOf(Error);
+      expect((error.mock.calls[0][0] as Error).message).toBe('oh no');
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+      expect(mockCoreSetup.http.delete).toHaveBeenCalledTimes(1);
+    });
+
+    test('should NOT DELETE a running SAVED async search on abort', async () => {
+      const sessionId = 'sessionId';
+      sessionService.isCurrentSession.mockImplementation((_sessionId) => _sessionId === sessionId);
+      const responses = [
+        {
+          time: 10,
+          value: {
+            isPartial: true,
+            isRunning: true,
+            id: 1,
+          },
+        },
+        {
+          time: 300,
+          value: {
+            isPartial: false,
+            isRunning: false,
+            id: 1,
+          },
+        },
+      ];
+      mockFetchImplementation(responses);
+
+      const abortController = new AbortController();
+      setTimeout(() => abortController.abort(), 250);
+
+      const response = searchInterceptor.search(
+        {},
+        { abortSignal: abortController.signal, pollInterval: 0, sessionId }
+      );
+      response.subscribe({ next, error });
+
+      await timeTravel(10);
+
+      expect(next).toHaveBeenCalled();
+      expect(error).not.toHaveBeenCalled();
+
+      sessionState$.next(SearchSessionState.BackgroundLoading);
+
+      await timeTravel(240);
+
+      expect(error).toHaveBeenCalled();
+      expect(error.mock.calls[0][0]).toBeInstanceOf(AbortError);
+
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+      expect(mockCoreSetup.http.delete).not.toHaveBeenCalled();
+    });
+
+    describe('Search session', () => {
+      const setup = (
+        opts: {
+          isRestore?: boolean;
+          isStored?: boolean;
+          sessionId: string;
+        } | null
+      ) => {
+        const sessionServiceMock = sessionService as jest.Mocked<ISessionService>;
+        sessionServiceMock.getSearchOptions.mockImplementation(() =>
+          opts
+            ? {
+                sessionId: opts.sessionId,
+                isRestore: opts.isRestore ?? false,
+                isStored: opts.isStored ?? false,
+              }
+            : null
+        );
+        fetchMock.mockResolvedValue({ result: 200 });
+      };
+
+      const mockRequest: IEsSearchRequest = {
+        params: {},
+      };
+
+      afterEach(() => {
+        const sessionServiceMock = sessionService as jest.Mocked<ISessionService>;
+        sessionServiceMock.getSearchOptions.mockReset();
+        fetchMock.mockReset();
+      });
+
+      test('gets session search options from session service', async () => {
+        const sessionId = 'sid';
+        setup({
+          isRestore: true,
+          isStored: true,
+          sessionId,
+        });
+
+        await searchInterceptor.search(mockRequest, { sessionId }).toPromise();
+        expect(fetchMock.mock.calls[0][0]).toEqual(
+          expect.objectContaining({
+            options: { sessionId, isStored: true, isRestore: true, strategy: 'ese' },
+          })
+        );
+
+        expect(
+          (sessionService as jest.Mocked<ISessionService>).getSearchOptions
+        ).toHaveBeenCalledWith(sessionId);
+      });
+
+      test("doesn't forward sessionId if search options return null", async () => {
+        const sessionId = 'sid';
+        setup(null);
+
+        await searchInterceptor.search(mockRequest, { sessionId }).toPromise();
+        expect(fetchMock.mock.calls[0][0]).toEqual(
+          expect.not.objectContaining({
+            options: { sessionId },
+          })
+        );
+
+        expect(
+          (sessionService as jest.Mocked<ISessionService>).getSearchOptions
+        ).toHaveBeenCalledWith(sessionId);
+      });
+    });
+
+    describe('Session tracking', () => {
+      beforeEach(() => {
+        const responses = [
+          {
+            time: 10,
+            value: {
+              isPartial: true,
+              isRunning: true,
+              id: 1,
+            },
+          },
+          {
+            time: 300,
+            value: {
+              isPartial: false,
+              isRunning: false,
+              id: 1,
+            },
+          },
+        ];
+
+        mockFetchImplementation(responses);
+      });
+
+      test('should track searches', async () => {
+        const sessionId = 'sessionId';
+        sessionService.isCurrentSession.mockImplementation(
+          (_sessionId) => _sessionId === sessionId
+        );
+        sessionService.getSessionId.mockImplementation(() => sessionId);
+
+        const untrack = jest.fn();
+        sessionService.trackSearch.mockImplementation(() => untrack);
+
+        const response = searchInterceptor.search({}, { pollInterval: 0, sessionId });
+        response.subscribe({ next, error });
+        await timeTravel(10);
+        expect(sessionService.trackSearch).toBeCalledTimes(1);
+        expect(untrack).not.toBeCalled();
+        await timeTravel(300);
+        expect(sessionService.trackSearch).toBeCalledTimes(1);
+        expect(untrack).toBeCalledTimes(1);
+      });
+
+      test('session service should be able to cancel search', async () => {
+        const sessionId = 'sessionId';
+        sessionService.isCurrentSession.mockImplementation(
+          (_sessionId) => _sessionId === sessionId
+        );
+        sessionService.getSessionId.mockImplementation(() => sessionId);
+
+        const untrack = jest.fn();
+        sessionService.trackSearch.mockImplementation(() => untrack);
+
+        const response = searchInterceptor.search({}, { pollInterval: 0, sessionId });
+        response.subscribe({ next, error });
+        await timeTravel(10);
+        expect(sessionService.trackSearch).toBeCalledTimes(1);
+
+        const abort = sessionService.trackSearch.mock.calls[0][0].abort;
+        expect(abort).toBeInstanceOf(Function);
+
+        abort();
+
+        await timeTravel(10);
+
+        expect(error).toHaveBeenCalled();
+        expect(error.mock.calls[0][0]).toBeInstanceOf(AbortError);
+      });
+
+      test("don't track non current session searches", async () => {
+        const sessionId = 'sessionId';
+        sessionService.isCurrentSession.mockImplementation(
+          (_sessionId) => _sessionId === sessionId
+        );
+        sessionService.getSessionId.mockImplementation(() => sessionId);
+
+        const untrack = jest.fn();
+        sessionService.trackSearch.mockImplementation(() => untrack);
+
+        const response1 = searchInterceptor.search(
+          {},
+          { pollInterval: 0, sessionId: 'something different' }
+        );
+        response1.subscribe({ next, error });
+
+        const response2 = searchInterceptor.search({}, { pollInterval: 0, sessionId: undefined });
+        response2.subscribe({ next, error });
+
+        await timeTravel(10);
+        expect(sessionService.trackSearch).toBeCalledTimes(0);
+      });
+
+      test("don't track if no current session", async () => {
+        sessionService.getSessionId.mockImplementation(() => undefined);
+        sessionService.isCurrentSession.mockImplementation((_sessionId) => false);
+
+        const untrack = jest.fn();
+        sessionService.trackSearch.mockImplementation(() => untrack);
+
+        const response1 = searchInterceptor.search(
+          {},
+          { pollInterval: 0, sessionId: 'something different' }
+        );
+        response1.subscribe({ next, error });
+
+        const response2 = searchInterceptor.search({}, { pollInterval: 0, sessionId: undefined });
+        response2.subscribe({ next, error });
+
+        await timeTravel(10);
+        expect(sessionService.trackSearch).toBeCalledTimes(0);
+      });
+    });
+
+    describe('session client caching', () => {
+      const sessionId = 'sessionId';
+      const basicReq = {
+        params: {
+          test: 1,
+        },
+      };
+
+      const basicCompleteResponse = [
+        {
+          time: 10,
+          value: {
+            isPartial: false,
+            isRunning: false,
+            id: 1,
+            rawResponse: {
+              took: 1,
+            },
+          },
+        },
+      ];
+
+      const partialCompleteResponse = [
+        {
+          time: 10,
+          value: {
+            isPartial: true,
+            isRunning: true,
+            id: 1,
+            rawResponse: {
+              took: 1,
+            },
+          },
+        },
+        {
+          time: 20,
+          value: {
+            isPartial: false,
+            isRunning: false,
+            id: 1,
+            rawResponse: {
+              took: 1,
+            },
+          },
+        },
+      ];
+
+      beforeEach(() => {
+        sessionService.isCurrentSession.mockImplementation(
+          (_sessionId) => _sessionId === sessionId
+        );
+        sessionService.getSessionId.mockImplementation(() => sessionId);
+      });
+
+      test('should be disabled if there is no session', async () => {
+        mockFetchImplementation(basicCompleteResponse);
+
+        searchInterceptor.search(basicReq, {}).subscribe({ next, error, complete });
+        expect(fetchMock).toBeCalledTimes(1);
+
+        searchInterceptor.search(basicReq, {}).subscribe({ next, error, complete });
+        expect(fetchMock).toBeCalledTimes(2);
+      });
+
+      test('should fetch different requests in a single session', async () => {
+        mockFetchImplementation(basicCompleteResponse);
+
+        const req2 = {
+          params: {
+            test: 2,
+          },
+        };
+
+        searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+
+        searchInterceptor.search(req2, { sessionId }).subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(2);
+      });
+
+      test('should fetch the same request for two different sessions', async () => {
+        mockFetchImplementation(basicCompleteResponse);
+
+        searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+
+        searchInterceptor
+          .search(basicReq, { sessionId: 'anotherSession' })
+          .subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(2);
+      });
+
+      test('should track searches that come from cache', async () => {
+        mockFetchImplementation(partialCompleteResponse);
+        sessionService.isCurrentSession.mockImplementation(
+          (_sessionId) => _sessionId === sessionId
+        );
+        sessionService.getSessionId.mockImplementation(() => sessionId);
+
+        const untrack = jest.fn();
+        sessionService.trackSearch.mockImplementation(() => untrack);
+
+        const req = {
+          params: {
+            test: 200,
+          },
+        };
+
+        const response = searchInterceptor.search(req, { pollInterval: 1, sessionId });
+        const response2 = searchInterceptor.search(req, { pollInterval: 1, sessionId });
+        response.subscribe({ next, error, complete });
+        response2.subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+        expect(sessionService.trackSearch).toBeCalledTimes(2);
+        expect(untrack).not.toBeCalled();
+        await timeTravel(300);
+        // Should be called only 2 times (once per partial response)
+        expect(fetchMock).toBeCalledTimes(2);
+        expect(sessionService.trackSearch).toBeCalledTimes(2);
+        expect(untrack).toBeCalledTimes(2);
+
+        expect(next).toBeCalledTimes(4);
+        expect(error).toBeCalledTimes(0);
+        expect(complete).toBeCalledTimes(2);
+      });
+
+      test('should cache partial responses', async () => {
+        const responses = [
+          {
+            time: 10,
+            value: {
+              isPartial: true,
+              isRunning: true,
+              id: 1,
+            },
+          },
+        ];
+
+        mockFetchImplementation(responses);
+
+        searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+
+        searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+      });
+
+      test('should not cache error responses', async () => {
+        const responses = [
+          {
+            time: 10,
+            value: {
+              isPartial: true,
+              isRunning: false,
+              id: 1,
+            },
+          },
+        ];
+
+        mockFetchImplementation(responses);
+
+        searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+
+        searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(2);
+      });
+
+      test('should deliver error to all replays', async () => {
+        const responses = [
+          {
+            time: 10,
+            value: {
+              isPartial: true,
+              isRunning: false,
+              id: 1,
+            },
+          },
+        ];
+
+        mockFetchImplementation(responses);
+
+        searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
+        searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+        expect(error).toBeCalledTimes(2);
+        expect(error.mock.calls[0][0].message).toEqual('Received partial response');
+        expect(error.mock.calls[1][0].message).toEqual('Received partial response');
+      });
+
+      test('should ignore anything outside params when hashing', async () => {
+        mockFetchImplementation(basicCompleteResponse);
+
+        const req = {
+          something: 123,
+          params: {
+            test: 1,
+          },
+        };
+
+        const req2 = {
+          something: 321,
+          params: {
+            test: 1,
+          },
+        };
+
+        searchInterceptor.search(req, { sessionId }).subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+
+        searchInterceptor.search(req2, { sessionId }).subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+      });
+
+      test('should ignore preference when hashing', async () => {
+        mockFetchImplementation(basicCompleteResponse);
+
+        const req = {
+          params: {
+            test: 1,
+            preference: 123,
+          },
+        };
+
+        const req2 = {
+          params: {
+            test: 1,
+            preference: 321,
+          },
+        };
+
+        searchInterceptor.search(req, { sessionId }).subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+
+        searchInterceptor.search(req2, { sessionId }).subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+      });
+
+      test('should return from cache for identical requests in the same session', async () => {
+        mockFetchImplementation(basicCompleteResponse);
+
+        searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+
+        searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+      });
+
+      test('aborting a search that didnt get any response should retrigger search', async () => {
+        mockFetchImplementation(basicCompleteResponse);
+
+        const abortController = new AbortController();
+
+        // Start a search request
+        searchInterceptor
+          .search(basicReq, { sessionId, abortSignal: abortController.signal })
+          .subscribe({ next, error, complete });
+
+        // Abort the search request before it started
+        abortController.abort();
+
+        // Time travel to make sure nothing appens
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(0);
+        expect(next).toBeCalledTimes(0);
+        expect(error).toBeCalledTimes(1);
+        expect(complete).toBeCalledTimes(0);
+
+        const error2 = jest.fn();
+        const next2 = jest.fn();
+        const complete2 = jest.fn();
+
+        // Search for the same thing again
+        searchInterceptor
+          .search(basicReq, { sessionId })
+          .subscribe({ next: next2, error: error2, complete: complete2 });
+
+        // Should search again
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+        expect(next2).toBeCalledTimes(1);
+        expect(error2).toBeCalledTimes(0);
+        expect(complete2).toBeCalledTimes(1);
+      });
+
+      test('aborting a running first search shouldnt clear cache', async () => {
+        mockFetchImplementation(partialCompleteResponse);
+        sessionService.isCurrentSession.mockImplementation(
+          (_sessionId) => _sessionId === sessionId
+        );
+        sessionService.getSessionId.mockImplementation(() => sessionId);
+
+        const untrack = jest.fn();
+        sessionService.trackSearch.mockImplementation(() => untrack);
+
+        const req = {
+          params: {
+            test: 200,
+          },
+        };
+
+        const abortController = new AbortController();
+
+        const response = searchInterceptor.search(req, {
+          pollInterval: 1,
+          sessionId,
+          abortSignal: abortController.signal,
+        });
+        response.subscribe({ next, error, complete });
+        await timeTravel(10);
+
+        expect(fetchMock).toBeCalledTimes(1);
+        expect(next).toBeCalledTimes(1);
+        expect(error).toBeCalledTimes(0);
+        expect(complete).toBeCalledTimes(0);
+        expect(sessionService.trackSearch).toBeCalledTimes(1);
+        expect(untrack).not.toBeCalled();
+
+        const next2 = jest.fn();
+        const error2 = jest.fn();
+        const complete2 = jest.fn();
+        const response2 = searchInterceptor.search(req, { pollInterval: 1, sessionId });
+        response2.subscribe({ next: next2, error: error2, complete: complete2 });
+        await timeTravel(0);
+
+        abortController.abort();
+
+        await timeTravel(300);
+        // Both searches should be tracked and untracked
+        expect(sessionService.trackSearch).toBeCalledTimes(2);
+        expect(untrack).toBeCalledTimes(2);
+
+        // First search should error
+        expect(next).toBeCalledTimes(1);
+        expect(error).toBeCalledTimes(1);
+        expect(complete).toBeCalledTimes(0);
+
+        // Second search should complete
+        expect(next2).toBeCalledTimes(2);
+        expect(error2).toBeCalledTimes(0);
+        expect(complete2).toBeCalledTimes(1);
+
+        // Should be called only 2 times (once per partial response)
+        expect(fetchMock).toBeCalledTimes(2);
+      });
+
+      test('aborting a running second search shouldnt clear cache', async () => {
+        mockFetchImplementation(partialCompleteResponse);
+        sessionService.isCurrentSession.mockImplementation(
+          (_sessionId) => _sessionId === sessionId
+        );
+        sessionService.getSessionId.mockImplementation(() => sessionId);
+
+        const untrack = jest.fn();
+        sessionService.trackSearch.mockImplementation(() => untrack);
+
+        const req = {
+          params: {
+            test: 200,
+          },
+        };
+
+        const abortController = new AbortController();
+
+        const response = searchInterceptor.search(req, { pollInterval: 1, sessionId });
+        response.subscribe({ next, error, complete });
+        await timeTravel(10);
+
+        expect(fetchMock).toBeCalledTimes(1);
+        expect(next).toBeCalledTimes(1);
+        expect(error).toBeCalledTimes(0);
+        expect(complete).toBeCalledTimes(0);
+        expect(sessionService.trackSearch).toBeCalledTimes(1);
+        expect(untrack).not.toBeCalled();
+
+        const next2 = jest.fn();
+        const error2 = jest.fn();
+        const complete2 = jest.fn();
+        const response2 = searchInterceptor.search(req, {
+          pollInterval: 0,
+          sessionId,
+          abortSignal: abortController.signal,
+        });
+        response2.subscribe({ next: next2, error: error2, complete: complete2 });
+        await timeTravel(0);
+
+        abortController.abort();
+
+        await timeTravel(300);
+        expect(sessionService.trackSearch).toBeCalledTimes(2);
+        expect(untrack).toBeCalledTimes(2);
+
+        expect(next).toBeCalledTimes(2);
+        expect(error).toBeCalledTimes(0);
+        expect(complete).toBeCalledTimes(1);
+
+        expect(next2).toBeCalledTimes(1);
+        expect(error2).toBeCalledTimes(1);
+        expect(complete2).toBeCalledTimes(0);
+
+        // Should be called only 2 times (once per partial response)
+        expect(fetchMock).toBeCalledTimes(2);
+      });
+
+      test('aborting both requests should cancel underlaying search only once', async () => {
+        mockFetchImplementation(partialCompleteResponse);
+        sessionService.isCurrentSession.mockImplementation(
+          (_sessionId) => _sessionId === sessionId
+        );
+        sessionService.getSessionId.mockImplementation(() => sessionId);
+        sessionService.trackSearch.mockImplementation(() => jest.fn());
+
+        const req = {
+          params: {
+            test: 200,
+          },
+        };
+
+        const abortController = new AbortController();
+
+        const response = searchInterceptor.search(req, {
+          pollInterval: 1,
+          sessionId,
+          abortSignal: abortController.signal,
+        });
+        response.subscribe({ next, error, complete });
+
+        const response2 = searchInterceptor.search(req, {
+          pollInterval: 1,
+          sessionId,
+          abortSignal: abortController.signal,
+        });
+        response2.subscribe({ next, error, complete });
+        await timeTravel(10);
+
+        abortController.abort();
+
+        await timeTravel(300);
+
+        expect(mockCoreSetup.http.delete).toHaveBeenCalledTimes(1);
+      });
+
+      test('aborting both searches should stop searching and clear cache', async () => {
+        mockFetchImplementation(partialCompleteResponse);
+        sessionService.isCurrentSession.mockImplementation(
+          (_sessionId) => _sessionId === sessionId
+        );
+        sessionService.getSessionId.mockImplementation(() => sessionId);
+
+        const untrack = jest.fn();
+        sessionService.trackSearch.mockImplementation(() => untrack);
+
+        const req = {
+          params: {
+            test: 200,
+          },
+        };
+
+        const abortController = new AbortController();
+
+        const response = searchInterceptor.search(req, {
+          pollInterval: 1,
+          sessionId,
+          abortSignal: abortController.signal,
+        });
+        response.subscribe({ next, error, complete });
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+
+        const response2 = searchInterceptor.search(req, {
+          pollInterval: 1,
+          sessionId,
+          abortSignal: abortController.signal,
+        });
+        response2.subscribe({ next, error, complete });
+        await timeTravel(0);
+        expect(fetchMock).toBeCalledTimes(1);
+
+        abortController.abort();
+
+        await timeTravel(300);
+
+        expect(next).toBeCalledTimes(2);
+        expect(error).toBeCalledTimes(2);
+        expect(complete).toBeCalledTimes(0);
+        expect(error.mock.calls[0][0]).toBeInstanceOf(AbortError);
+        expect(error.mock.calls[1][0]).toBeInstanceOf(AbortError);
+
+        // Should be called only 1 times (one partial response)
+        expect(fetchMock).toBeCalledTimes(1);
+
+        // Clear mock and research
+        fetchMock.mockReset();
+        mockFetchImplementation(partialCompleteResponse);
+        // Run the search again to see that we don't hit the cache
+        const response3 = searchInterceptor.search(req, { pollInterval: 1, sessionId });
+        response3.subscribe({ next, error, complete });
+
+        await timeTravel(10);
+        await timeTravel(10);
+        await timeTravel(300);
+
+        // Should be called 2 times (two partial response)
+        expect(fetchMock).toBeCalledTimes(2);
+        expect(complete).toBeCalledTimes(1);
+      });
+
+      test("aborting a completed search shouldn't effect cache", async () => {
+        mockFetchImplementation(basicCompleteResponse);
+
+        const abortController = new AbortController();
+
+        // Start a search request
+        searchInterceptor
+          .search(basicReq, { sessionId, abortSignal: abortController.signal })
+          .subscribe({ next, error, complete });
+
+        // Get a final response
+        await timeTravel(10);
+        expect(fetchMock).toBeCalledTimes(1);
+
+        // Abort the search request
+        abortController.abort();
+
+        // Search for the same thing again
+        searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
+
+        // Get the response from cache
+        expect(fetchMock).toBeCalledTimes(1);
+      });
+    });
+
+    describe('Should throw typed errors', () => {
+      test('Observable should fail if fetch has an internal error', async () => {
+        const mockResponse: any = new Error('Internal Error');
+        fetchMock.mockRejectedValue(mockResponse);
+        const mockRequest: IEsSearchRequest = {
+          params: {},
+        };
+        const response = searchInterceptor.search(mockRequest);
+        await expect(response.toPromise()).rejects.toThrow('Internal Error');
+      });
+
+      describe('Should handle Timeout errors', () => {
+        test('Should throw SearchTimeoutError on server timeout AND show toast', async () => {
+          const mockResponse: any = {
+            statusCode: 500,
+            message: 'Request timed out',
+          };
+          fetchMock.mockRejectedValueOnce(mockResponse);
+          const mockRequest: IEsSearchRequest = {
+            params: {},
+          };
+          const response = searchInterceptor.search(mockRequest);
+          await expect(response.toPromise()).rejects.toThrow(SearchTimeoutError);
+          expect(mockCoreSetup.notifications.toasts.addDanger).toBeCalledTimes(1);
+        });
+
+        test('Timeout error should show multiple times if not in a session', async () => {
+          const mockResponse: any = {
+            statusCode: 500,
+            message: 'Request timed out',
+          };
+          fetchMock.mockRejectedValue(mockResponse);
+          const mockRequest: IEsSearchRequest = {
+            params: {},
+          };
+
+          await expect(searchInterceptor.search(mockRequest).toPromise()).rejects.toThrow(
+            SearchTimeoutError
+          );
+          await expect(searchInterceptor.search(mockRequest).toPromise()).rejects.toThrow(
+            SearchTimeoutError
+          );
+          expect(mockCoreSetup.notifications.toasts.addDanger).toBeCalledTimes(2);
+        });
+
+        test('Timeout error should show once per each session', async () => {
+          const mockResponse: any = {
+            statusCode: 500,
+            message: 'Request timed out',
+          };
+          fetchMock.mockRejectedValue(mockResponse);
+          const mockRequest: IEsSearchRequest = {
+            params: {},
+          };
+
+          await expect(
+            searchInterceptor.search(mockRequest, { sessionId: 'abc' }).toPromise()
+          ).rejects.toThrow(SearchTimeoutError);
+          await expect(
+            searchInterceptor.search(mockRequest, { sessionId: 'def' }).toPromise()
+          ).rejects.toThrow(SearchTimeoutError);
+          expect(mockCoreSetup.notifications.toasts.addDanger).toBeCalledTimes(2);
+        });
+
+        test('Timeout error should show once in a single session', async () => {
+          const mockResponse: any = {
+            statusCode: 500,
+            message: 'Request timed out',
+          };
+          fetchMock.mockRejectedValue(mockResponse);
+          const mockRequest: IEsSearchRequest = {
+            params: {},
+          };
+          await expect(
+            searchInterceptor.search(mockRequest, { sessionId: 'abc' }).toPromise()
+          ).rejects.toThrow(SearchTimeoutError);
+          await expect(
+            searchInterceptor.search(mockRequest, { sessionId: 'abc' }).toPromise()
+          ).rejects.toThrow(SearchTimeoutError);
+          expect(mockCoreSetup.notifications.toasts.addDanger).toBeCalledTimes(1);
+        });
+      });
+
+      test('Should throw Painless error on server error with OSS format', async () => {
+        const mockResponse: any = {
+          statusCode: 400,
+          message: 'search_phase_execution_exception',
+          attributes: searchPhaseException.error,
+        };
+        fetchMock.mockRejectedValueOnce(mockResponse);
+        const mockRequest: IEsSearchRequest = {
+          params: {},
+        };
+        const response = searchInterceptor.search(mockRequest);
+        await expect(response.toPromise()).rejects.toThrow(PainlessError);
+      });
+
+      test('Should throw ES error on ES server error', async () => {
+        const mockResponse: any = {
+          statusCode: 400,
+          message: 'resource_not_found_exception',
+          attributes: resourceNotFoundException.error,
+        };
+        fetchMock.mockRejectedValueOnce(mockResponse);
+        const mockRequest: IEsSearchRequest = {
+          params: {},
+        };
+        const response = searchInterceptor.search(mockRequest);
+        await expect(response.toPromise()).rejects.toThrow(EsError);
+      });
+
+      test('Observable should fail if user aborts (test merged signal)', async () => {
+        const abortController = new AbortController();
+        fetchMock.mockImplementationOnce((options: any) => {
+          return new Promise((resolve, reject) => {
+            options.signal.addEventListener('abort', () => {
+              reject(new AbortError());
+            });
+
+            setTimeout(resolve, 500);
+          });
+        });
+        const mockRequest: IEsSearchRequest = {
+          params: {},
+        };
+        const response = searchInterceptor.search(mockRequest, {
+          abortSignal: abortController.signal,
+        });
+
+        error.mockImplementation((e) => {
+          expect(next).not.toBeCalled();
+          expect(e).toBeInstanceOf(AbortError);
+        });
+
+        response.subscribe({ next, error });
+        setTimeout(() => abortController.abort(), 200);
+        jest.advanceTimersByTime(5000);
+
+        await flushPromises();
+      });
+
+      test('Immediately aborts if passed an aborted abort signal', async (done) => {
+        const abort = new AbortController();
+        const mockRequest: IEsSearchRequest = {
+          params: {},
+        };
+        const response = searchInterceptor.search(mockRequest, { abortSignal: abort.signal });
+        abort.abort();
+
+        error.mockImplementation((e) => {
+          expect(e).toBeInstanceOf(AbortError);
+          expect(fetchMock).not.toBeCalled();
+          done();
+        });
+
+        response.subscribe({ error });
+      });
+    });
+  });
+});
diff --git a/src/plugins/data/public/search/search_interceptor/search_interceptor.ts b/src/plugins/data/public/search/search_interceptor/search_interceptor.ts
new file mode 100644
index 0000000000000..5fa0a5c301019
--- /dev/null
+++ b/src/plugins/data/public/search/search_interceptor/search_interceptor.ts
@@ -0,0 +1,408 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { memoize, once } from 'lodash';
+import { BehaviorSubject, EMPTY, from, fromEvent, of, Subscription, throwError } from 'rxjs';
+import {
+  catchError,
+  filter,
+  finalize,
+  map,
+  shareReplay,
+  skip,
+  switchMap,
+  take,
+  takeUntil,
+  tap,
+} from 'rxjs/operators';
+import { PublicMethodsOf } from '@kbn/utility-types';
+import { CoreSetup, CoreStart, ToastsSetup } from 'kibana/public';
+import { i18n } from '@kbn/i18n';
+import { BatchedFunc, BfetchPublicSetup } from 'src/plugins/bfetch/public';
+import {
+  ENHANCED_ES_SEARCH_STRATEGY,
+  IAsyncSearchOptions,
+  IKibanaSearchRequest,
+  IKibanaSearchResponse,
+  ISearchOptions,
+  ISearchOptionsSerializable,
+  pollSearch,
+  UI_SETTINGS,
+} from '../../../common';
+import { SearchUsageCollector } from '../collectors';
+import {
+  EsError,
+  getHttpError,
+  isEsError,
+  isPainlessError,
+  PainlessError,
+  SearchTimeoutError,
+  TimeoutErrorMode,
+} from '../errors';
+import { toMountPoint } from '../../../../kibana_react/public';
+import { AbortError, KibanaServerError } from '../../../../kibana_utils/public';
+import { ISessionService, SearchSessionState } from '../session';
+import { SearchResponseCache } from './search_response_cache';
+import { createRequestHash } from './utils';
+import { SearchAbortController } from './search_abort_controller';
+
+export interface SearchInterceptorDeps {
+  bfetch: BfetchPublicSetup;
+  http: CoreSetup['http'];
+  uiSettings: CoreSetup['uiSettings'];
+  startServices: Promise<[CoreStart, any, unknown]>;
+  toasts: ToastsSetup;
+  usageCollector?: SearchUsageCollector;
+  session: ISessionService;
+}
+
+const MAX_CACHE_ITEMS = 50;
+const MAX_CACHE_SIZE_MB = 10;
+
+export class SearchInterceptor {
+  private uiSettingsSub: Subscription;
+  private searchTimeout: number;
+  private readonly responseCache: SearchResponseCache = new SearchResponseCache(
+    MAX_CACHE_ITEMS,
+    MAX_CACHE_SIZE_MB
+  );
+
+  /**
+   * Observable that emits when the number of pending requests changes.
+   * @internal
+   */
+  private pendingCount$ = new BehaviorSubject(0);
+
+  /**
+   * @internal
+   */
+  private application!: CoreStart['application'];
+  private batchedFetch!: BatchedFunc<
+    { request: IKibanaSearchRequest; options: ISearchOptionsSerializable },
+    IKibanaSearchResponse
+  >;
+
+  /*
+   * @internal
+   */
+  constructor(private readonly deps: SearchInterceptorDeps) {
+    this.deps.http.addLoadingCountSource(this.pendingCount$);
+
+    this.deps.startServices.then(([coreStart]) => {
+      this.application = coreStart.application;
+    });
+
+    this.batchedFetch = deps.bfetch.batchedFunction({
+      url: '/internal/bsearch',
+    });
+
+    this.searchTimeout = deps.uiSettings.get(UI_SETTINGS.SEARCH_TIMEOUT);
+
+    this.uiSettingsSub = deps.uiSettings
+      .get$(UI_SETTINGS.SEARCH_TIMEOUT)
+      .subscribe((timeout: number) => {
+        this.searchTimeout = timeout;
+      });
+  }
+
+  public stop() {
+    this.responseCache.clear();
+    this.uiSettingsSub.unsubscribe();
+  }
+
+  /*
+   * @returns `TimeoutErrorMode` indicating what action should be taken in case of a request timeout based on license and permissions.
+   * @internal
+   */
+  private getTimeoutMode() {
+    return this.application.capabilities.advancedSettings?.save
+      ? TimeoutErrorMode.CHANGE
+      : TimeoutErrorMode.CONTACT;
+  }
+
+  private createRequestHash$(request: IKibanaSearchRequest, options: IAsyncSearchOptions) {
+    const { sessionId, isRestore } = options;
+    // Preference is used to ensure all queries go to the same set of shards and it doesn't need to be hashed
+    // https://www.elastic.co/guide/en/elasticsearch/reference/current/search-shard-routing.html#shard-and-node-preference
+    const { preference, ...params } = request.params || {};
+    const hashOptions = {
+      ...params,
+      sessionId,
+      isRestore,
+    };
+
+    return from(sessionId ? createRequestHash(hashOptions) : of(undefined));
+  }
+
+  /*
+   * @returns `Error` a search service specific error or the original error, if a specific error can't be recognized.
+   * @internal
+   */
+  private handleSearchError(
+    e: KibanaServerError | AbortError,
+    options?: ISearchOptions,
+    isTimeout?: boolean
+  ): Error {
+    if (isTimeout || e.message === 'Request timed out') {
+      // Handle a client or a server side timeout
+      const err = new SearchTimeoutError(e, this.getTimeoutMode());
+
+      // Show the timeout error here, so that it's shown regardless of how an application chooses to handle errors.
+      // The timeout error is shown any time a request times out, or once per session, if the request is part of a session.
+      this.showTimeoutError(err, options?.sessionId);
+      return err;
+    } else if (e instanceof AbortError) {
+      // In the case an application initiated abort, throw the existing AbortError.
+      return e;
+    } else if (isEsError(e)) {
+      if (isPainlessError(e)) {
+        return new PainlessError(e, options?.indexPattern);
+      } else {
+        return new EsError(e);
+      }
+    } else {
+      return e instanceof Error ? e : new Error(e.message);
+    }
+  }
+
+  private getSerializableOptions(options?: ISearchOptions) {
+    const { sessionId, ...requestOptions } = options || {};
+
+    const serializableOptions: ISearchOptionsSerializable = {};
+    const combined = {
+      ...requestOptions,
+      ...this.deps.session.getSearchOptions(sessionId),
+    };
+
+    if (combined.sessionId !== undefined) serializableOptions.sessionId = combined.sessionId;
+    if (combined.isRestore !== undefined) serializableOptions.isRestore = combined.isRestore;
+    if (combined.legacyHitsTotal !== undefined)
+      serializableOptions.legacyHitsTotal = combined.legacyHitsTotal;
+    if (combined.strategy !== undefined) serializableOptions.strategy = combined.strategy;
+    if (combined.isStored !== undefined) serializableOptions.isStored = combined.isStored;
+
+    return serializableOptions;
+  }
+
+  /**
+   * @internal
+   * Creates a new pollSearch that share replays its results
+   */
+  private runSearch$(
+    { id, ...request }: IKibanaSearchRequest,
+    options: IAsyncSearchOptions,
+    searchAbortController: SearchAbortController
+  ) {
+    const search = () => this.runSearch({ id, ...request }, options);
+    const { sessionId, strategy } = options;
+
+    // track if this search's session will be send to background
+    // if yes, then we don't need to cancel this search when it is aborted
+    let isSavedToBackground = false;
+    const savedToBackgroundSub =
+      this.deps.session.isCurrentSession(sessionId) &&
+      this.deps.session.state$
+        .pipe(
+          skip(1), // ignore any state, we are only interested in transition x -> BackgroundLoading
+          filter(
+            (state) =>
+              this.deps.session.isCurrentSession(sessionId) &&
+              state === SearchSessionState.BackgroundLoading
+          ),
+          take(1)
+        )
+        .subscribe(() => {
+          isSavedToBackground = true;
+        });
+
+    const cancel = once(() => {
+      if (id && !isSavedToBackground) this.deps.http.delete(`/internal/search/${strategy}/${id}`);
+    });
+
+    return pollSearch(search, cancel, {
+      ...options,
+      abortSignal: searchAbortController.getSignal(),
+    }).pipe(
+      tap((response) => (id = response.id)),
+      catchError((e: Error) => {
+        cancel();
+        return throwError(e);
+      }),
+      finalize(() => {
+        searchAbortController.cleanup();
+        if (savedToBackgroundSub) {
+          savedToBackgroundSub.unsubscribe();
+        }
+      }),
+      // This observable is cached in the responseCache.
+      // Using shareReplay makes sure that future subscribers will get the final response
+
+      shareReplay(1)
+    );
+  }
+
+  /**
+   * @internal
+   * @throws `AbortError` | `ErrorLike`
+   */
+  private runSearch(
+    request: IKibanaSearchRequest,
+    options?: ISearchOptions
+  ): Promise<IKibanaSearchResponse> {
+    const { abortSignal } = options || {};
+    return this.batchedFetch(
+      {
+        request,
+        options: this.getSerializableOptions(options),
+      },
+      abortSignal
+    );
+  }
+
+  /**
+   * @internal
+   * Creates a new search observable and a corresponding search abort controller
+   * If requestHash is defined, tries to return them first from cache.
+   */
+  private getSearchResponse$(
+    request: IKibanaSearchRequest,
+    options: IAsyncSearchOptions,
+    requestHash?: string
+  ) {
+    const cached = requestHash ? this.responseCache.get(requestHash) : undefined;
+
+    const searchAbortController =
+      cached?.searchAbortController || new SearchAbortController(this.searchTimeout);
+
+    // Create a new abort signal if one was not passed. This fake signal will never be aborted,
+    // So the underlaying search will not be aborted, even if the other consumers abort.
+    searchAbortController.addAbortSignal(options.abortSignal ?? new AbortController().signal);
+    const response$ = cached?.response$ || this.runSearch$(request, options, searchAbortController);
+
+    if (requestHash && !this.responseCache.has(requestHash)) {
+      this.responseCache.set(requestHash, {
+        response$,
+        searchAbortController,
+      });
+    }
+
+    return {
+      response$,
+      searchAbortController,
+    };
+  }
+
+  /**
+   * Searches using the given `search` method. Overrides the `AbortSignal` with one that will abort
+   * either when the request times out, or when the original `AbortSignal` is aborted. Updates
+   * `pendingCount$` when the request is started/finalized.
+   *
+   * @param request
+   * @options
+   * @returns `Observable` emitting the search response or an error.
+   */
+  public search({ id, ...request }: IKibanaSearchRequest, options: IAsyncSearchOptions = {}) {
+    const searchOptions = {
+      strategy: ENHANCED_ES_SEARCH_STRATEGY,
+      ...options,
+    };
+    const { sessionId, abortSignal } = searchOptions;
+
+    return this.createRequestHash$(request, searchOptions).pipe(
+      switchMap((requestHash) => {
+        const { searchAbortController, response$ } = this.getSearchResponse$(
+          request,
+          searchOptions,
+          requestHash
+        );
+
+        this.pendingCount$.next(this.pendingCount$.getValue() + 1);
+        const untrackSearch = this.deps.session.isCurrentSession(sessionId)
+          ? this.deps.session.trackSearch({ abort: () => searchAbortController.abort() })
+          : undefined;
+
+        // Abort the replay if the abortSignal is aborted.
+        // The underlaying search will not abort unless searchAbortController fires.
+        const aborted$ = (abortSignal ? fromEvent(abortSignal, 'abort') : EMPTY).pipe(
+          map(() => {
+            throw new AbortError();
+          })
+        );
+
+        return response$.pipe(
+          takeUntil(aborted$),
+          catchError((e) => {
+            return throwError(
+              this.handleSearchError(e, searchOptions, searchAbortController.isTimeout())
+            );
+          }),
+          finalize(() => {
+            this.pendingCount$.next(this.pendingCount$.getValue() - 1);
+            if (untrackSearch && this.deps.session.isCurrentSession(sessionId)) {
+              // untrack if this search still belongs to current session
+              untrackSearch();
+            }
+          })
+        );
+      })
+    );
+  }
+
+  private showTimeoutErrorToast = (e: SearchTimeoutError, sessionId?: string) => {
+    this.deps.toasts.addDanger({
+      title: 'Timed out',
+      text: toMountPoint(e.getErrorMessage(this.application)),
+    });
+  };
+
+  private showTimeoutErrorMemoized = memoize(
+    this.showTimeoutErrorToast,
+    (_: SearchTimeoutError, sessionId: string) => {
+      return sessionId;
+    }
+  );
+
+  /**
+   * Show one error notification per session.
+   * @internal
+   */
+  private showTimeoutError = (e: SearchTimeoutError, sessionId?: string) => {
+    if (sessionId) {
+      this.showTimeoutErrorMemoized(e, sessionId);
+    } else {
+      this.showTimeoutErrorToast(e, sessionId);
+    }
+  };
+
+  public showError(e: Error) {
+    if (e instanceof AbortError || e instanceof SearchTimeoutError) {
+      // The SearchTimeoutError is shown by the interceptor in getSearchError (regardless of how the app chooses to handle errors)
+      return;
+    } else if (e instanceof EsError) {
+      this.deps.toasts.addDanger({
+        title: i18n.translate('data.search.esErrorTitle', {
+          defaultMessage: 'Cannot retrieve search results',
+        }),
+        text: toMountPoint(e.getErrorMessage(this.application)),
+      });
+    } else if (e.constructor.name === 'HttpFetchError') {
+      this.deps.toasts.addDanger({
+        title: i18n.translate('data.search.httpErrorTitle', {
+          defaultMessage: 'Cannot retrieve your data',
+        }),
+        text: toMountPoint(getHttpError(e.message)),
+      });
+    } else {
+      this.deps.toasts.addError(e, {
+        title: 'Search Error',
+      });
+    }
+  }
+}
+
+export type ISearchInterceptor = PublicMethodsOf<SearchInterceptor>;
diff --git a/x-pack/plugins/data_enhanced/public/search/search_response_cache.test.ts b/src/plugins/data/public/search/search_interceptor/search_response_cache.test.ts
similarity index 97%
rename from x-pack/plugins/data_enhanced/public/search/search_response_cache.test.ts
rename to src/plugins/data/public/search/search_interceptor/search_response_cache.test.ts
index e985de5e23f7d..df277c289f973 100644
--- a/x-pack/plugins/data_enhanced/public/search/search_response_cache.test.ts
+++ b/src/plugins/data/public/search/search_interceptor/search_response_cache.test.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import { interval, Observable, of, throwError } from 'rxjs';
@@ -14,7 +15,7 @@ import { SearchResponseCache } from './search_response_cache';
 describe('SearchResponseCache', () => {
   let cache: SearchResponseCache;
   let searchAbortController: SearchAbortController;
-  const r: Array<IKibanaSearchResponse<any>> = [
+  const r: IKibanaSearchResponse[] = [
     {
       isPartial: true,
       isRunning: true,
diff --git a/x-pack/plugins/data_enhanced/public/search/search_response_cache.ts b/src/plugins/data/public/search/search_interceptor/search_response_cache.ts
similarity index 92%
rename from x-pack/plugins/data_enhanced/public/search/search_response_cache.ts
rename to src/plugins/data/public/search/search_interceptor/search_response_cache.ts
index 1467e5bf234ff..1af32afdc5e90 100644
--- a/x-pack/plugins/data_enhanced/public/search/search_response_cache.ts
+++ b/src/plugins/data/public/search/search_interceptor/search_response_cache.ts
@@ -1,21 +1,22 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import { Observable, Subscription } from 'rxjs';
-import { IKibanaSearchResponse, isErrorResponse } from '../../../../../src/plugins/data/public';
 import { SearchAbortController } from './search_abort_controller';
+import { IKibanaSearchResponse, isErrorResponse } from '../../../common';
 
 interface ResponseCacheItem {
-  response$: Observable<IKibanaSearchResponse<any>>;
+  response$: Observable<IKibanaSearchResponse>;
   searchAbortController: SearchAbortController;
 }
 
 interface ResponseCacheItemInternal {
-  response$: Observable<IKibanaSearchResponse<any>>;
+  response$: Observable<IKibanaSearchResponse>;
   searchAbortController: SearchAbortController;
   size: number;
   subs: Subscription;
diff --git a/x-pack/plugins/data_enhanced/public/search/utils.ts b/src/plugins/data/public/search/search_interceptor/utils.ts
similarity index 74%
rename from x-pack/plugins/data_enhanced/public/search/utils.ts
rename to src/plugins/data/public/search/search_interceptor/utils.ts
index c6c648dbb5488..2f2d06d3a5494 100644
--- a/x-pack/plugins/data_enhanced/public/search/utils.ts
+++ b/src/plugins/data/public/search/search_interceptor/utils.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import stringify from 'json-stable-stringify';
diff --git a/src/plugins/data/public/search/search_service.test.ts b/src/plugins/data/public/search/search_service.test.ts
index 7ac3a11c08446..debee42d8bf34 100644
--- a/src/plugins/data/public/search/search_service.test.ts
+++ b/src/plugins/data/public/search/search_service.test.ts
@@ -38,7 +38,6 @@ describe('Search service', () => {
       } as unknown) as SearchServiceSetupDependencies);
       expect(setup).toHaveProperty('aggs');
       expect(setup).toHaveProperty('usageCollector');
-      expect(setup).toHaveProperty('__enhance');
       expect(setup).toHaveProperty('sessionsClient');
       expect(setup).toHaveProperty('session');
     });
diff --git a/src/plugins/data/public/search/search_service.ts b/src/plugins/data/public/search/search_service.ts
index ec7a486445b71..28064f4736d31 100644
--- a/src/plugins/data/public/search/search_service.ts
+++ b/src/plugins/data/public/search/search_service.ts
@@ -15,7 +15,7 @@ import {
 } from 'src/core/public';
 import { BehaviorSubject } from 'rxjs';
 import { BfetchPublicSetup } from 'src/plugins/bfetch/public';
-import { ISearchSetup, ISearchStart, SearchEnhancements } from './types';
+import { ISearchSetup, ISearchStart } from './types';
 
 import { handleResponse } from './fetch';
 import {
@@ -147,9 +147,6 @@ export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
     return {
       aggs,
       usageCollector: this.usageCollector!,
-      __enhance: (enhancements: SearchEnhancements) => {
-        this.searchInterceptor = enhancements.searchInterceptor;
-      },
       session: this.sessionService,
       sessionsClient: this.sessionsClient,
     };
@@ -187,5 +184,6 @@ export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
   public stop() {
     this.aggsService.stop();
     this.searchSourceService.stop();
+    this.searchInterceptor.stop();
   }
 }
diff --git a/src/plugins/data/public/search/types.ts b/src/plugins/data/public/search/types.ts
index 391be8e053746..8190c52b5c0c5 100644
--- a/src/plugins/data/public/search/types.ts
+++ b/src/plugins/data/public/search/types.ts
@@ -7,7 +7,6 @@
  */
 
 import { PackageInfo } from 'kibana/server';
-import { ISearchInterceptor } from './search_interceptor';
 import { SearchUsageCollector } from './collectors';
 import { AggsSetup, AggsSetupDependencies, AggsStartDependencies, AggsStart } from './aggs';
 import { ISearchGeneric, ISearchStartSearchSource } from '../../common/search';
@@ -17,10 +16,6 @@ import { ISessionsClient, ISessionService } from './session';
 
 export { ISearchStartSearchSource, SearchUsageCollector };
 
-export interface SearchEnhancements {
-  searchInterceptor: ISearchInterceptor;
-}
-
 /**
  * The setup contract exposed by the Search plugin exposes the search strategy extension
  * point.
@@ -38,10 +33,6 @@ export interface ISearchSetup {
    * {@link ISessionsClient}
    */
   sessionsClient: ISessionsClient;
-  /**
-   * @internal
-   */
-  __enhance: (enhancements: SearchEnhancements) => void;
 }
 
 /**
diff --git a/src/plugins/data/public/types.ts b/src/plugins/data/public/types.ts
index 8686823ef0568..5ba4ba2bc48af 100644
--- a/src/plugins/data/public/types.ts
+++ b/src/plugins/data/public/types.ts
@@ -15,7 +15,7 @@ import { UiActionsSetup, UiActionsStart } from 'src/plugins/ui_actions/public';
 import { AutocompleteSetup, AutocompleteStart } from './autocomplete';
 import { FieldFormatsSetup, FieldFormatsStart } from './field_formats';
 import { createFiltersFromRangeSelectAction, createFiltersFromValueClickAction } from './actions';
-import { ISearchSetup, ISearchStart, SearchEnhancements } from './search';
+import { ISearchSetup, ISearchStart } from './search';
 import { QuerySetup, QueryStart } from './query';
 import { IndexPatternsContract } from './index_patterns';
 import { IndexPatternSelectProps, StatefulSearchBarProps } from './ui';
@@ -23,10 +23,6 @@ import { UsageCollectionSetup, UsageCollectionStart } from '../../usage_collecti
 import { Setup as InspectorSetup } from '../../inspector/public';
 import { NowProviderPublicContract } from './now_provider';
 
-export interface DataPublicPluginEnhancements {
-  search: SearchEnhancements;
-}
-
 export interface DataSetupDependencies {
   bfetch: BfetchPublicSetup;
   expressions: ExpressionsSetup;
@@ -47,10 +43,6 @@ export interface DataPublicPluginSetup {
   search: ISearchSetup;
   fieldFormats: FieldFormatsSetup;
   query: QuerySetup;
-  /**
-   * @internal
-   */
-  __enhance: (enhancements: DataPublicPluginEnhancements) => void;
 }
 
 /**
diff --git a/src/plugins/data/server/ui_settings.ts b/src/plugins/data/server/ui_settings.ts
index 78d7c15cac5d6..ed3510c5776e0 100644
--- a/src/plugins/data/server/ui_settings.ts
+++ b/src/plugins/data/server/ui_settings.ts
@@ -715,5 +715,18 @@ export function getUiSettings(): Record<string, UiSettingsParams<unknown>> {
       }),
       schema: schema.boolean(),
     },
+    [UI_SETTINGS.SEARCH_TIMEOUT]: {
+      name: i18n.translate('data.advancedSettings.searchTimeout', {
+        defaultMessage: 'Search Timeout',
+      }),
+      value: 600000,
+      description: i18n.translate('data.advancedSettings.searchTimeoutDesc', {
+        defaultMessage:
+          'Change the maximum timeout for a search session or set to 0 to disable the timeout and allow queries to run to completion.',
+      }),
+      type: 'number',
+      category: ['search'],
+      schema: schema.number(),
+    },
   };
 }
diff --git a/x-pack/plugins/data_enhanced/public/plugin.ts b/x-pack/plugins/data_enhanced/public/plugin.ts
index 82f04d82ea2f8..ebc270e96767e 100644
--- a/x-pack/plugins/data_enhanced/public/plugin.ts
+++ b/x-pack/plugins/data_enhanced/public/plugin.ts
@@ -17,7 +17,6 @@ import { BfetchPublicSetup } from '../../../../src/plugins/bfetch/public';
 import { ManagementSetup } from '../../../../src/plugins/management/public';
 import { SharePluginStart } from '../../../../src/plugins/share/public';
 
-import { EnhancedSearchInterceptor } from './search/search_interceptor';
 import { registerSearchSessionsMgmt } from './search/sessions_mgmt';
 import { toMountPoint } from '../../../../src/plugins/kibana_react/public';
 import { createConnectedSearchSessionIndicator } from './search';
@@ -39,7 +38,6 @@ export type DataEnhancedStart = ReturnType<DataEnhancedPlugin['start']>;
 
 export class DataEnhancedPlugin
   implements Plugin<void, void, DataEnhancedSetupDependencies, DataEnhancedStartDependencies> {
-  private enhancedSearchInterceptor!: EnhancedSearchInterceptor;
   private config!: ConfigSchema;
   private readonly storage = new Storage(window.localStorage);
   private usageCollector?: SearchUsageCollector;
@@ -50,22 +48,6 @@ export class DataEnhancedPlugin
     core: CoreSetup<DataEnhancedStartDependencies>,
     { bfetch, data, management }: DataEnhancedSetupDependencies
   ) {
-    this.enhancedSearchInterceptor = new EnhancedSearchInterceptor({
-      bfetch,
-      toasts: core.notifications.toasts,
-      http: core.http,
-      uiSettings: core.uiSettings,
-      startServices: core.getStartServices(),
-      usageCollector: data.search.usageCollector,
-      session: data.search.session,
-    });
-
-    data.__enhance({
-      search: {
-        searchInterceptor: this.enhancedSearchInterceptor,
-      },
-    });
-
     this.config = this.initializerContext.config.get<ConfigSchema>();
     if (this.config.search.sessions.enabled) {
       const sessionsConfig = this.config.search.sessions;
@@ -96,7 +78,5 @@ export class DataEnhancedPlugin
     }
   }
 
-  public stop() {
-    this.enhancedSearchInterceptor.stop();
-  }
+  public stop() {}
 }
diff --git a/x-pack/plugins/data_enhanced/public/search/search_interceptor.test.ts b/x-pack/plugins/data_enhanced/public/search/search_interceptor.test.ts
deleted file mode 100644
index 0e511c545f3e2..0000000000000
--- a/x-pack/plugins/data_enhanced/public/search/search_interceptor.test.ts
+++ /dev/null
@@ -1,1111 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { MockedKeys } from '@kbn/utility-types/jest';
-import { coreMock } from '../../../../../src/core/public/mocks';
-import { EnhancedSearchInterceptor } from './search_interceptor';
-import { CoreSetup, CoreStart } from 'kibana/public';
-import { UI_SETTINGS } from '../../../../../src/plugins/data/common';
-import { AbortError } from '../../../../../src/plugins/kibana_utils/public';
-import {
-  ISessionService,
-  SearchTimeoutError,
-  SearchSessionState,
-  PainlessError,
-  DataPublicPluginSetup,
-} from 'src/plugins/data/public';
-import { dataPluginMock } from '../../../../../src/plugins/data/public/mocks';
-import { bfetchPluginMock } from '../../../../../src/plugins/bfetch/public/mocks';
-import { BehaviorSubject } from 'rxjs';
-import * as xpackResourceNotFoundException from '../../common/search/test_data/search_phase_execution_exception.json';
-
-const flushPromises = () => new Promise((resolve) => setImmediate(resolve));
-
-const timeTravel = async (msToRun = 0) => {
-  await flushPromises();
-  jest.advanceTimersByTime(msToRun);
-  return flushPromises();
-};
-
-const next = jest.fn();
-const error = jest.fn();
-const complete = jest.fn();
-
-let searchInterceptor: EnhancedSearchInterceptor;
-let mockCoreSetup: MockedKeys<CoreSetup>;
-let mockCoreStart: MockedKeys<CoreStart>;
-let fetchMock: jest.Mock<any>;
-
-jest.useFakeTimers();
-
-jest.mock('./utils', () => ({
-  createRequestHash: jest.fn().mockImplementation((input) => {
-    return Promise.resolve(JSON.stringify(input));
-  }),
-}));
-
-function mockFetchImplementation(responses: any[]) {
-  let i = 0;
-  fetchMock.mockImplementation((r) => {
-    if (!r.request.id) i = 0;
-    const { time = 0, value = {}, isError = false } = responses[i++];
-    value.meta = {
-      size: 10,
-    };
-    return new Promise((resolve, reject) =>
-      setTimeout(() => {
-        return (isError ? reject : resolve)(value);
-      }, time)
-    );
-  });
-}
-
-describe('EnhancedSearchInterceptor', () => {
-  let sessionService: jest.Mocked<ISessionService>;
-  let sessionState$: BehaviorSubject<SearchSessionState>;
-  let dataPluginMockSetup: DataPublicPluginSetup;
-
-  beforeEach(() => {
-    mockCoreSetup = coreMock.createSetup();
-    mockCoreStart = coreMock.createStart();
-    sessionState$ = new BehaviorSubject<SearchSessionState>(SearchSessionState.None);
-    dataPluginMockSetup = dataPluginMock.createSetupContract();
-    const dataPluginMockStart = dataPluginMock.createStartContract();
-    sessionService = {
-      ...(dataPluginMockStart.search.session as jest.Mocked<ISessionService>),
-      state$: sessionState$,
-    };
-    fetchMock = jest.fn();
-
-    mockCoreSetup.uiSettings.get.mockImplementation((name: string) => {
-      switch (name) {
-        case UI_SETTINGS.SEARCH_TIMEOUT:
-          return 1000;
-        default:
-          return;
-      }
-    });
-
-    next.mockClear();
-    error.mockClear();
-    complete.mockClear();
-    jest.clearAllTimers();
-
-    const mockPromise = new Promise((resolve) => {
-      resolve([
-        {
-          application: mockCoreStart.application,
-        },
-      ]);
-    });
-
-    const bfetchMock = bfetchPluginMock.createSetupContract();
-    bfetchMock.batchedFunction.mockReturnValue(fetchMock);
-
-    searchInterceptor = new EnhancedSearchInterceptor({
-      bfetch: bfetchMock,
-      toasts: mockCoreSetup.notifications.toasts,
-      startServices: mockPromise as any,
-      http: mockCoreSetup.http,
-      uiSettings: mockCoreSetup.uiSettings,
-      usageCollector: dataPluginMockSetup.search.usageCollector,
-      session: sessionService,
-    });
-  });
-
-  describe('errors', () => {
-    test('Should throw Painless error on server error with OSS format', async () => {
-      const mockResponse: any = {
-        statusCode: 400,
-        message: 'search_phase_execution_exception',
-        attributes: xpackResourceNotFoundException.error,
-      };
-      fetchMock.mockRejectedValueOnce(mockResponse);
-      const response = searchInterceptor.search({
-        params: {},
-      });
-      await expect(response.toPromise()).rejects.toThrow(PainlessError);
-    });
-
-    test('Renders a PainlessError', async () => {
-      searchInterceptor.showError(
-        new PainlessError({
-          statusCode: 400,
-          message: 'search_phase_execution_exception',
-          attributes: xpackResourceNotFoundException.error,
-        })
-      );
-      expect(mockCoreSetup.notifications.toasts.addDanger).toBeCalledTimes(1);
-      expect(mockCoreSetup.notifications.toasts.addError).not.toBeCalled();
-    });
-  });
-
-  describe('search', () => {
-    test('should resolve immediately if first call returns full result', async () => {
-      const responses = [
-        {
-          time: 10,
-          value: {
-            isPartial: false,
-            isRunning: false,
-            id: 1,
-            rawResponse: {
-              took: 1,
-            },
-          },
-        },
-      ];
-      mockFetchImplementation(responses);
-
-      const response = searchInterceptor.search({});
-      response.subscribe({ next, error, complete });
-
-      await timeTravel(10);
-
-      expect(next).toHaveBeenCalled();
-      expect(next.mock.calls[0][0]).toStrictEqual(responses[0].value);
-      expect(complete).toHaveBeenCalled();
-      expect(error).not.toHaveBeenCalled();
-    });
-
-    test('should make secondary request if first call returns partial result', async () => {
-      const responses = [
-        {
-          time: 10,
-          value: {
-            isPartial: true,
-            isRunning: true,
-            id: 1,
-            rawResponse: {
-              took: 1,
-            },
-          },
-        },
-        {
-          time: 20,
-          value: {
-            isPartial: false,
-            isRunning: false,
-            id: 1,
-            rawResponse: {
-              took: 1,
-            },
-          },
-        },
-      ];
-
-      mockFetchImplementation(responses);
-
-      const response = searchInterceptor.search({}, { pollInterval: 0 });
-      response.subscribe({ next, error, complete });
-
-      await timeTravel(10);
-
-      expect(next).toHaveBeenCalled();
-      expect(next.mock.calls[0][0]).toStrictEqual(responses[0].value);
-      expect(complete).not.toHaveBeenCalled();
-      expect(error).not.toHaveBeenCalled();
-
-      await timeTravel(20);
-
-      expect(next).toHaveBeenCalledTimes(2);
-      expect(next.mock.calls[1][0]).toStrictEqual(responses[1].value);
-      expect(complete).toHaveBeenCalled();
-      expect(error).not.toHaveBeenCalled();
-    });
-
-    test('should abort if request is partial and not running (ES graceful error)', async () => {
-      const responses = [
-        {
-          time: 10,
-          value: {
-            isPartial: true,
-            isRunning: false,
-            id: 1,
-          },
-        },
-      ];
-      mockFetchImplementation(responses);
-
-      const response = searchInterceptor.search({});
-      response.subscribe({ next, error });
-
-      await timeTravel(10);
-
-      expect(error).toHaveBeenCalled();
-      expect(error.mock.calls[0][0]).toBeInstanceOf(Error);
-    });
-
-    test('should abort on user abort', async () => {
-      const responses = [
-        {
-          time: 500,
-          value: {
-            isPartial: false,
-            isRunning: false,
-            id: 1,
-          },
-        },
-      ];
-      mockFetchImplementation(responses);
-
-      const abortController = new AbortController();
-      abortController.abort();
-
-      const response = searchInterceptor.search({}, { abortSignal: abortController.signal });
-      response.subscribe({ next, error });
-
-      await timeTravel(500);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(error).toHaveBeenCalled();
-      expect(error.mock.calls[0][0]).toBeInstanceOf(AbortError);
-    });
-
-    test('should DELETE a running async search on abort', async () => {
-      const responses = [
-        {
-          time: 10,
-          value: {
-            isPartial: true,
-            isRunning: true,
-            id: 1,
-          },
-        },
-        {
-          time: 300,
-          value: {
-            isPartial: false,
-            isRunning: false,
-            id: 1,
-          },
-        },
-      ];
-      mockFetchImplementation(responses);
-
-      const abortController = new AbortController();
-      setTimeout(() => abortController.abort(), 250);
-
-      const response = searchInterceptor.search(
-        {},
-        { abortSignal: abortController.signal, pollInterval: 0 }
-      );
-      response.subscribe({ next, error });
-
-      await timeTravel(10);
-
-      expect(next).toHaveBeenCalled();
-      expect(error).not.toHaveBeenCalled();
-
-      await timeTravel(240);
-
-      expect(error).toHaveBeenCalled();
-      expect(error.mock.calls[0][0]).toBeInstanceOf(AbortError);
-
-      expect(fetchMock).toHaveBeenCalledTimes(2);
-      expect(mockCoreSetup.http.delete).toHaveBeenCalledTimes(1);
-    });
-
-    test('should not DELETE a running async search on async timeout prior to first response', async () => {
-      const responses = [
-        {
-          time: 2000,
-          value: {
-            isPartial: false,
-            isRunning: false,
-            id: 1,
-          },
-        },
-      ];
-      mockFetchImplementation(responses);
-
-      const response = searchInterceptor.search({}, { pollInterval: 0 });
-      response.subscribe({ next, error });
-
-      await timeTravel(1000);
-
-      expect(error).toHaveBeenCalled();
-      expect(error.mock.calls[0][0]).toBeInstanceOf(SearchTimeoutError);
-      expect(fetchMock).toHaveBeenCalled();
-      expect(mockCoreSetup.http.delete).not.toHaveBeenCalled();
-    });
-
-    test('should DELETE a running async search on async timeout after first response', async () => {
-      const responses = [
-        {
-          time: 10,
-          value: {
-            isPartial: true,
-            isRunning: true,
-            id: 1,
-          },
-        },
-        {
-          time: 2000,
-          value: {
-            isPartial: false,
-            isRunning: false,
-            id: 1,
-          },
-        },
-      ];
-      mockFetchImplementation(responses);
-
-      const response = searchInterceptor.search({}, { pollInterval: 0 });
-      response.subscribe({ next, error });
-
-      await timeTravel(10);
-
-      expect(next).toHaveBeenCalled();
-      expect(error).not.toHaveBeenCalled();
-      expect(fetchMock).toHaveBeenCalled();
-      expect(mockCoreSetup.http.delete).not.toHaveBeenCalled();
-
-      // Long enough to reach the timeout but not long enough to reach the next response
-      await timeTravel(1000);
-
-      expect(error).toHaveBeenCalled();
-      expect(error.mock.calls[0][0]).toBeInstanceOf(SearchTimeoutError);
-      expect(fetchMock).toHaveBeenCalledTimes(2);
-      expect(mockCoreSetup.http.delete).toHaveBeenCalledTimes(1);
-    });
-
-    test('should DELETE a running async search on async timeout on error from fetch', async () => {
-      const responses = [
-        {
-          time: 10,
-          value: {
-            isPartial: true,
-            isRunning: true,
-            id: 1,
-          },
-        },
-        {
-          time: 10,
-          value: {
-            statusCode: 500,
-            message: 'oh no',
-            id: 1,
-          },
-          isError: true,
-        },
-      ];
-      mockFetchImplementation(responses);
-
-      const response = searchInterceptor.search({}, { pollInterval: 0 });
-      response.subscribe({ next, error });
-
-      await timeTravel(10);
-
-      expect(next).toHaveBeenCalled();
-      expect(error).not.toHaveBeenCalled();
-      expect(fetchMock).toHaveBeenCalled();
-      expect(mockCoreSetup.http.delete).not.toHaveBeenCalled();
-
-      // Long enough to reach the timeout but not long enough to reach the next response
-      await timeTravel(10);
-
-      expect(error).toHaveBeenCalled();
-      expect(error.mock.calls[0][0]).toBeInstanceOf(Error);
-      expect((error.mock.calls[0][0] as Error).message).toBe('oh no');
-      expect(fetchMock).toHaveBeenCalledTimes(2);
-      expect(mockCoreSetup.http.delete).toHaveBeenCalledTimes(1);
-    });
-
-    test('should NOT DELETE a running SAVED async search on abort', async () => {
-      const sessionId = 'sessionId';
-      sessionService.isCurrentSession.mockImplementation((_sessionId) => _sessionId === sessionId);
-      const responses = [
-        {
-          time: 10,
-          value: {
-            isPartial: true,
-            isRunning: true,
-            id: 1,
-          },
-        },
-        {
-          time: 300,
-          value: {
-            isPartial: false,
-            isRunning: false,
-            id: 1,
-          },
-        },
-      ];
-      mockFetchImplementation(responses);
-
-      const abortController = new AbortController();
-      setTimeout(() => abortController.abort(), 250);
-
-      const response = searchInterceptor.search(
-        {},
-        { abortSignal: abortController.signal, pollInterval: 0, sessionId }
-      );
-      response.subscribe({ next, error });
-
-      await timeTravel(10);
-
-      expect(next).toHaveBeenCalled();
-      expect(error).not.toHaveBeenCalled();
-
-      sessionState$.next(SearchSessionState.BackgroundLoading);
-
-      await timeTravel(240);
-
-      expect(error).toHaveBeenCalled();
-      expect(error.mock.calls[0][0]).toBeInstanceOf(AbortError);
-
-      expect(fetchMock).toHaveBeenCalledTimes(2);
-      expect(mockCoreSetup.http.delete).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('session tracking', () => {
-    beforeEach(() => {
-      const responses = [
-        {
-          time: 10,
-          value: {
-            isPartial: true,
-            isRunning: true,
-            id: 1,
-          },
-        },
-        {
-          time: 300,
-          value: {
-            isPartial: false,
-            isRunning: false,
-            id: 1,
-          },
-        },
-      ];
-
-      mockFetchImplementation(responses);
-    });
-
-    test('should track searches', async () => {
-      const sessionId = 'sessionId';
-      sessionService.isCurrentSession.mockImplementation((_sessionId) => _sessionId === sessionId);
-      sessionService.getSessionId.mockImplementation(() => sessionId);
-
-      const untrack = jest.fn();
-      sessionService.trackSearch.mockImplementation(() => untrack);
-
-      const response = searchInterceptor.search({}, { pollInterval: 0, sessionId });
-      response.subscribe({ next, error });
-      await timeTravel(10);
-      expect(sessionService.trackSearch).toBeCalledTimes(1);
-      expect(untrack).not.toBeCalled();
-      await timeTravel(300);
-      expect(sessionService.trackSearch).toBeCalledTimes(1);
-      expect(untrack).toBeCalledTimes(1);
-    });
-
-    test('session service should be able to cancel search', async () => {
-      const sessionId = 'sessionId';
-      sessionService.isCurrentSession.mockImplementation((_sessionId) => _sessionId === sessionId);
-      sessionService.getSessionId.mockImplementation(() => sessionId);
-
-      const untrack = jest.fn();
-      sessionService.trackSearch.mockImplementation(() => untrack);
-
-      const response = searchInterceptor.search({}, { pollInterval: 0, sessionId });
-      response.subscribe({ next, error });
-      await timeTravel(10);
-      expect(sessionService.trackSearch).toBeCalledTimes(1);
-
-      const abort = sessionService.trackSearch.mock.calls[0][0].abort;
-      expect(abort).toBeInstanceOf(Function);
-
-      abort();
-
-      await timeTravel(10);
-
-      expect(error).toHaveBeenCalled();
-      expect(error.mock.calls[0][0]).toBeInstanceOf(AbortError);
-    });
-
-    test("don't track non current session searches", async () => {
-      const sessionId = 'sessionId';
-      sessionService.isCurrentSession.mockImplementation((_sessionId) => _sessionId === sessionId);
-      sessionService.getSessionId.mockImplementation(() => sessionId);
-
-      const untrack = jest.fn();
-      sessionService.trackSearch.mockImplementation(() => untrack);
-
-      const response1 = searchInterceptor.search(
-        {},
-        { pollInterval: 0, sessionId: 'something different' }
-      );
-      response1.subscribe({ next, error });
-
-      const response2 = searchInterceptor.search({}, { pollInterval: 0, sessionId: undefined });
-      response2.subscribe({ next, error });
-
-      await timeTravel(10);
-      expect(sessionService.trackSearch).toBeCalledTimes(0);
-    });
-
-    test("don't track if no current session", async () => {
-      sessionService.getSessionId.mockImplementation(() => undefined);
-      sessionService.isCurrentSession.mockImplementation((_sessionId) => false);
-
-      const untrack = jest.fn();
-      sessionService.trackSearch.mockImplementation(() => untrack);
-
-      const response1 = searchInterceptor.search(
-        {},
-        { pollInterval: 0, sessionId: 'something different' }
-      );
-      response1.subscribe({ next, error });
-
-      const response2 = searchInterceptor.search({}, { pollInterval: 0, sessionId: undefined });
-      response2.subscribe({ next, error });
-
-      await timeTravel(10);
-      expect(sessionService.trackSearch).toBeCalledTimes(0);
-    });
-  });
-
-  describe('session client caching', () => {
-    const sessionId = 'sessionId';
-    const basicReq = {
-      params: {
-        test: 1,
-      },
-    };
-
-    const basicCompleteResponse = [
-      {
-        time: 10,
-        value: {
-          isPartial: false,
-          isRunning: false,
-          id: 1,
-          rawResponse: {
-            took: 1,
-          },
-        },
-      },
-    ];
-
-    const partialCompleteResponse = [
-      {
-        time: 10,
-        value: {
-          isPartial: true,
-          isRunning: true,
-          id: 1,
-          rawResponse: {
-            took: 1,
-          },
-        },
-      },
-      {
-        time: 20,
-        value: {
-          isPartial: false,
-          isRunning: false,
-          id: 1,
-          rawResponse: {
-            took: 1,
-          },
-        },
-      },
-    ];
-
-    beforeEach(() => {
-      sessionService.isCurrentSession.mockImplementation((_sessionId) => _sessionId === sessionId);
-      sessionService.getSessionId.mockImplementation(() => sessionId);
-    });
-
-    test('should be disabled if there is no session', async () => {
-      mockFetchImplementation(basicCompleteResponse);
-
-      searchInterceptor.search(basicReq, {}).subscribe({ next, error, complete });
-      expect(fetchMock).toBeCalledTimes(1);
-
-      searchInterceptor.search(basicReq, {}).subscribe({ next, error, complete });
-      expect(fetchMock).toBeCalledTimes(2);
-    });
-
-    test('should fetch different requests in a single session', async () => {
-      mockFetchImplementation(basicCompleteResponse);
-
-      const req2 = {
-        params: {
-          test: 2,
-        },
-      };
-
-      searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-
-      searchInterceptor.search(req2, { sessionId }).subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(2);
-    });
-
-    test('should fetch the same request for two different sessions', async () => {
-      mockFetchImplementation(basicCompleteResponse);
-
-      searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-
-      searchInterceptor
-        .search(basicReq, { sessionId: 'anotherSession' })
-        .subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(2);
-    });
-
-    test('should track searches that come from cache', async () => {
-      mockFetchImplementation(partialCompleteResponse);
-      sessionService.isCurrentSession.mockImplementation((_sessionId) => _sessionId === sessionId);
-      sessionService.getSessionId.mockImplementation(() => sessionId);
-
-      const untrack = jest.fn();
-      sessionService.trackSearch.mockImplementation(() => untrack);
-
-      const req = {
-        params: {
-          test: 200,
-        },
-      };
-
-      const response = searchInterceptor.search(req, { pollInterval: 1, sessionId });
-      const response2 = searchInterceptor.search(req, { pollInterval: 1, sessionId });
-      response.subscribe({ next, error, complete });
-      response2.subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-      expect(sessionService.trackSearch).toBeCalledTimes(2);
-      expect(untrack).not.toBeCalled();
-      await timeTravel(300);
-      // Should be called only 2 times (once per partial response)
-      expect(fetchMock).toBeCalledTimes(2);
-      expect(sessionService.trackSearch).toBeCalledTimes(2);
-      expect(untrack).toBeCalledTimes(2);
-
-      expect(next).toBeCalledTimes(4);
-      expect(error).toBeCalledTimes(0);
-      expect(complete).toBeCalledTimes(2);
-    });
-
-    test('should cache partial responses', async () => {
-      const responses = [
-        {
-          time: 10,
-          value: {
-            isPartial: true,
-            isRunning: true,
-            id: 1,
-          },
-        },
-      ];
-
-      mockFetchImplementation(responses);
-
-      searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-
-      searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-    });
-
-    test('should not cache error responses', async () => {
-      const responses = [
-        {
-          time: 10,
-          value: {
-            isPartial: true,
-            isRunning: false,
-            id: 1,
-          },
-        },
-      ];
-
-      mockFetchImplementation(responses);
-
-      searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-
-      searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(2);
-    });
-
-    test('should deliver error to all replays', async () => {
-      const responses = [
-        {
-          time: 10,
-          value: {
-            isPartial: true,
-            isRunning: false,
-            id: 1,
-          },
-        },
-      ];
-
-      mockFetchImplementation(responses);
-
-      searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
-      searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-      expect(error).toBeCalledTimes(2);
-      expect(error.mock.calls[0][0].message).toEqual('Received partial response');
-      expect(error.mock.calls[1][0].message).toEqual('Received partial response');
-    });
-
-    test('should ignore anything outside params when hashing', async () => {
-      mockFetchImplementation(basicCompleteResponse);
-
-      const req = {
-        something: 123,
-        params: {
-          test: 1,
-        },
-      };
-
-      const req2 = {
-        something: 321,
-        params: {
-          test: 1,
-        },
-      };
-
-      searchInterceptor.search(req, { sessionId }).subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-
-      searchInterceptor.search(req2, { sessionId }).subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-    });
-
-    test('should ignore preference when hashing', async () => {
-      mockFetchImplementation(basicCompleteResponse);
-
-      const req = {
-        params: {
-          test: 1,
-          preference: 123,
-        },
-      };
-
-      const req2 = {
-        params: {
-          test: 1,
-          preference: 321,
-        },
-      };
-
-      searchInterceptor.search(req, { sessionId }).subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-
-      searchInterceptor.search(req2, { sessionId }).subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-    });
-
-    test('should return from cache for identical requests in the same session', async () => {
-      mockFetchImplementation(basicCompleteResponse);
-
-      searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-
-      searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-    });
-
-    test('aborting a search that didnt get any response should retrigger search', async () => {
-      mockFetchImplementation(basicCompleteResponse);
-
-      const abortController = new AbortController();
-
-      // Start a search request
-      searchInterceptor
-        .search(basicReq, { sessionId, abortSignal: abortController.signal })
-        .subscribe({ next, error, complete });
-
-      // Abort the search request before it started
-      abortController.abort();
-
-      // Time travel to make sure nothing appens
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(0);
-      expect(next).toBeCalledTimes(0);
-      expect(error).toBeCalledTimes(1);
-      expect(complete).toBeCalledTimes(0);
-
-      const error2 = jest.fn();
-      const next2 = jest.fn();
-      const complete2 = jest.fn();
-
-      // Search for the same thing again
-      searchInterceptor
-        .search(basicReq, { sessionId })
-        .subscribe({ next: next2, error: error2, complete: complete2 });
-
-      // Should search again
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-      expect(next2).toBeCalledTimes(1);
-      expect(error2).toBeCalledTimes(0);
-      expect(complete2).toBeCalledTimes(1);
-    });
-
-    test('aborting a running first search shouldnt clear cache', async () => {
-      mockFetchImplementation(partialCompleteResponse);
-      sessionService.isCurrentSession.mockImplementation((_sessionId) => _sessionId === sessionId);
-      sessionService.getSessionId.mockImplementation(() => sessionId);
-
-      const untrack = jest.fn();
-      sessionService.trackSearch.mockImplementation(() => untrack);
-
-      const req = {
-        params: {
-          test: 200,
-        },
-      };
-
-      const abortController = new AbortController();
-
-      const response = searchInterceptor.search(req, {
-        pollInterval: 1,
-        sessionId,
-        abortSignal: abortController.signal,
-      });
-      response.subscribe({ next, error, complete });
-      await timeTravel(10);
-
-      expect(fetchMock).toBeCalledTimes(1);
-      expect(next).toBeCalledTimes(1);
-      expect(error).toBeCalledTimes(0);
-      expect(complete).toBeCalledTimes(0);
-      expect(sessionService.trackSearch).toBeCalledTimes(1);
-      expect(untrack).not.toBeCalled();
-
-      const next2 = jest.fn();
-      const error2 = jest.fn();
-      const complete2 = jest.fn();
-      const response2 = searchInterceptor.search(req, { pollInterval: 1, sessionId });
-      response2.subscribe({ next: next2, error: error2, complete: complete2 });
-      await timeTravel(0);
-
-      abortController.abort();
-
-      await timeTravel(300);
-      // Both searches should be tracked and untracked
-      expect(sessionService.trackSearch).toBeCalledTimes(2);
-      expect(untrack).toBeCalledTimes(2);
-
-      // First search should error
-      expect(next).toBeCalledTimes(1);
-      expect(error).toBeCalledTimes(1);
-      expect(complete).toBeCalledTimes(0);
-
-      // Second search should complete
-      expect(next2).toBeCalledTimes(2);
-      expect(error2).toBeCalledTimes(0);
-      expect(complete2).toBeCalledTimes(1);
-
-      // Should be called only 2 times (once per partial response)
-      expect(fetchMock).toBeCalledTimes(2);
-    });
-
-    test('aborting a running second search shouldnt clear cache', async () => {
-      mockFetchImplementation(partialCompleteResponse);
-      sessionService.isCurrentSession.mockImplementation((_sessionId) => _sessionId === sessionId);
-      sessionService.getSessionId.mockImplementation(() => sessionId);
-
-      const untrack = jest.fn();
-      sessionService.trackSearch.mockImplementation(() => untrack);
-
-      const req = {
-        params: {
-          test: 200,
-        },
-      };
-
-      const abortController = new AbortController();
-
-      const response = searchInterceptor.search(req, { pollInterval: 1, sessionId });
-      response.subscribe({ next, error, complete });
-      await timeTravel(10);
-
-      expect(fetchMock).toBeCalledTimes(1);
-      expect(next).toBeCalledTimes(1);
-      expect(error).toBeCalledTimes(0);
-      expect(complete).toBeCalledTimes(0);
-      expect(sessionService.trackSearch).toBeCalledTimes(1);
-      expect(untrack).not.toBeCalled();
-
-      const next2 = jest.fn();
-      const error2 = jest.fn();
-      const complete2 = jest.fn();
-      const response2 = searchInterceptor.search(req, {
-        pollInterval: 0,
-        sessionId,
-        abortSignal: abortController.signal,
-      });
-      response2.subscribe({ next: next2, error: error2, complete: complete2 });
-      await timeTravel(0);
-
-      abortController.abort();
-
-      await timeTravel(300);
-      expect(sessionService.trackSearch).toBeCalledTimes(2);
-      expect(untrack).toBeCalledTimes(2);
-
-      expect(next).toBeCalledTimes(2);
-      expect(error).toBeCalledTimes(0);
-      expect(complete).toBeCalledTimes(1);
-
-      expect(next2).toBeCalledTimes(1);
-      expect(error2).toBeCalledTimes(1);
-      expect(complete2).toBeCalledTimes(0);
-
-      // Should be called only 2 times (once per partial response)
-      expect(fetchMock).toBeCalledTimes(2);
-    });
-
-    test('aborting both requests should cancel underlaying search only once', async () => {
-      mockFetchImplementation(partialCompleteResponse);
-      sessionService.isCurrentSession.mockImplementation((_sessionId) => _sessionId === sessionId);
-      sessionService.getSessionId.mockImplementation(() => sessionId);
-      sessionService.trackSearch.mockImplementation(() => jest.fn());
-
-      const req = {
-        params: {
-          test: 200,
-        },
-      };
-
-      const abortController = new AbortController();
-
-      const response = searchInterceptor.search(req, {
-        pollInterval: 1,
-        sessionId,
-        abortSignal: abortController.signal,
-      });
-      response.subscribe({ next, error, complete });
-
-      const response2 = searchInterceptor.search(req, {
-        pollInterval: 1,
-        sessionId,
-        abortSignal: abortController.signal,
-      });
-      response2.subscribe({ next, error, complete });
-      await timeTravel(10);
-
-      abortController.abort();
-
-      await timeTravel(300);
-
-      expect(mockCoreSetup.http.delete).toHaveBeenCalledTimes(1);
-    });
-
-    test('aborting both searches should stop searching and clear cache', async () => {
-      mockFetchImplementation(partialCompleteResponse);
-      sessionService.isCurrentSession.mockImplementation((_sessionId) => _sessionId === sessionId);
-      sessionService.getSessionId.mockImplementation(() => sessionId);
-
-      const untrack = jest.fn();
-      sessionService.trackSearch.mockImplementation(() => untrack);
-
-      const req = {
-        params: {
-          test: 200,
-        },
-      };
-
-      const abortController = new AbortController();
-
-      const response = searchInterceptor.search(req, {
-        pollInterval: 1,
-        sessionId,
-        abortSignal: abortController.signal,
-      });
-      response.subscribe({ next, error, complete });
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-
-      const response2 = searchInterceptor.search(req, {
-        pollInterval: 1,
-        sessionId,
-        abortSignal: abortController.signal,
-      });
-      response2.subscribe({ next, error, complete });
-      await timeTravel(0);
-      expect(fetchMock).toBeCalledTimes(1);
-
-      abortController.abort();
-
-      await timeTravel(300);
-
-      expect(next).toBeCalledTimes(2);
-      expect(error).toBeCalledTimes(2);
-      expect(complete).toBeCalledTimes(0);
-      expect(error.mock.calls[0][0]).toBeInstanceOf(AbortError);
-      expect(error.mock.calls[1][0]).toBeInstanceOf(AbortError);
-
-      // Should be called only 1 times (one partial response)
-      expect(fetchMock).toBeCalledTimes(1);
-
-      // Clear mock and research
-      fetchMock.mockReset();
-      mockFetchImplementation(partialCompleteResponse);
-      // Run the search again to see that we don't hit the cache
-      const response3 = searchInterceptor.search(req, { pollInterval: 1, sessionId });
-      response3.subscribe({ next, error, complete });
-
-      await timeTravel(10);
-      await timeTravel(10);
-      await timeTravel(300);
-
-      // Should be called 2 times (two partial response)
-      expect(fetchMock).toBeCalledTimes(2);
-      expect(complete).toBeCalledTimes(1);
-    });
-
-    test('aborting a completed search shouldnt effect cache', async () => {
-      mockFetchImplementation(basicCompleteResponse);
-
-      const abortController = new AbortController();
-
-      // Start a search request
-      searchInterceptor
-        .search(basicReq, { sessionId, abortSignal: abortController.signal })
-        .subscribe({ next, error, complete });
-
-      // Get a final response
-      await timeTravel(10);
-      expect(fetchMock).toBeCalledTimes(1);
-
-      // Abort the search request
-      abortController.abort();
-
-      // Search for the same thing again
-      searchInterceptor.search(basicReq, { sessionId }).subscribe({ next, error, complete });
-
-      // Get the response from cache
-      expect(fetchMock).toBeCalledTimes(1);
-    });
-  });
-});
diff --git a/x-pack/plugins/data_enhanced/public/search/search_interceptor.ts b/x-pack/plugins/data_enhanced/public/search/search_interceptor.ts
deleted file mode 100644
index ed91b7b598488..0000000000000
--- a/x-pack/plugins/data_enhanced/public/search/search_interceptor.ts
+++ /dev/null
@@ -1,225 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { once } from 'lodash';
-import { throwError, Subscription, from, of, fromEvent, EMPTY } from 'rxjs';
-import {
-  tap,
-  finalize,
-  catchError,
-  filter,
-  take,
-  skip,
-  switchMap,
-  shareReplay,
-  map,
-  takeUntil,
-} from 'rxjs/operators';
-import {
-  TimeoutErrorMode,
-  SearchInterceptor,
-  SearchInterceptorDeps,
-  UI_SETTINGS,
-  IKibanaSearchRequest,
-  SearchSessionState,
-} from '../../../../../src/plugins/data/public';
-import {
-  ENHANCED_ES_SEARCH_STRATEGY,
-  IAsyncSearchOptions,
-  pollSearch,
-} from '../../../../../src/plugins/data/common';
-import { createRequestHash } from './utils';
-import { SearchResponseCache } from './search_response_cache';
-import { AbortError } from '../../../../../src/plugins/kibana_utils/public';
-import { SearchAbortController } from './search_abort_controller';
-
-const MAX_CACHE_ITEMS = 50;
-const MAX_CACHE_SIZE_MB = 10;
-export class EnhancedSearchInterceptor extends SearchInterceptor {
-  private uiSettingsSub: Subscription;
-  private searchTimeout: number;
-  private readonly responseCache: SearchResponseCache = new SearchResponseCache(
-    MAX_CACHE_ITEMS,
-    MAX_CACHE_SIZE_MB
-  );
-
-  /**
-   * @internal
-   */
-  constructor(deps: SearchInterceptorDeps) {
-    super(deps);
-    this.searchTimeout = deps.uiSettings.get(UI_SETTINGS.SEARCH_TIMEOUT);
-
-    this.uiSettingsSub = deps.uiSettings
-      .get$(UI_SETTINGS.SEARCH_TIMEOUT)
-      .subscribe((timeout: number) => {
-        this.searchTimeout = timeout;
-      });
-  }
-
-  public stop() {
-    this.responseCache.clear();
-    this.uiSettingsSub.unsubscribe();
-  }
-
-  protected getTimeoutMode() {
-    return this.application.capabilities.advancedSettings?.save
-      ? TimeoutErrorMode.CHANGE
-      : TimeoutErrorMode.CONTACT;
-  }
-
-  private createRequestHash$(request: IKibanaSearchRequest, options: IAsyncSearchOptions) {
-    const { sessionId, isRestore } = options;
-    // Preference is used to ensure all queries go to the same set of shards and it doesn't need to be hashed
-    // https://www.elastic.co/guide/en/elasticsearch/reference/current/search-shard-routing.html#shard-and-node-preference
-    const { preference, ...params } = request.params || {};
-    const hashOptions = {
-      ...params,
-      sessionId,
-      isRestore,
-    };
-
-    return from(sessionId ? createRequestHash(hashOptions) : of(undefined));
-  }
-
-  /**
-   * @internal
-   * Creates a new pollSearch that share replays its results
-   */
-  private runSearch$(
-    { id, ...request }: IKibanaSearchRequest,
-    options: IAsyncSearchOptions,
-    searchAbortController: SearchAbortController
-  ) {
-    const search = () => this.runSearch({ id, ...request }, options);
-    const { sessionId, strategy } = options;
-
-    // track if this search's session will be send to background
-    // if yes, then we don't need to cancel this search when it is aborted
-    let isSavedToBackground = false;
-    const savedToBackgroundSub =
-      this.deps.session.isCurrentSession(sessionId) &&
-      this.deps.session.state$
-        .pipe(
-          skip(1), // ignore any state, we are only interested in transition x -> BackgroundLoading
-          filter(
-            (state) =>
-              this.deps.session.isCurrentSession(sessionId) &&
-              state === SearchSessionState.BackgroundLoading
-          ),
-          take(1)
-        )
-        .subscribe(() => {
-          isSavedToBackground = true;
-        });
-
-    const cancel = once(() => {
-      if (id && !isSavedToBackground) this.deps.http.delete(`/internal/search/${strategy}/${id}`);
-    });
-
-    return pollSearch(search, cancel, {
-      ...options,
-      abortSignal: searchAbortController.getSignal(),
-    }).pipe(
-      tap((response) => (id = response.id)),
-      catchError((e: Error) => {
-        cancel();
-        return throwError(e);
-      }),
-      finalize(() => {
-        searchAbortController.cleanup();
-        if (savedToBackgroundSub) {
-          savedToBackgroundSub.unsubscribe();
-        }
-      }),
-      // This observable is cached in the responseCache.
-      // Using shareReplay makes sure that future subscribers will get the final response
-
-      shareReplay(1)
-    );
-  }
-
-  /**
-   * @internal
-   * Creates a new search observable and a corresponding search abort controller
-   * If requestHash is defined, tries to return them first from cache.
-   */
-  private getSearchResponse$(
-    request: IKibanaSearchRequest,
-    options: IAsyncSearchOptions,
-    requestHash?: string
-  ) {
-    const cached = requestHash ? this.responseCache.get(requestHash) : undefined;
-
-    const searchAbortController =
-      cached?.searchAbortController || new SearchAbortController(this.searchTimeout);
-
-    // Create a new abort signal if one was not passed. This fake signal will never be aborted,
-    // So the underlaying search will not be aborted, even if the other consumers abort.
-    searchAbortController.addAbortSignal(options.abortSignal ?? new AbortController().signal);
-    const response$ = cached?.response$ || this.runSearch$(request, options, searchAbortController);
-
-    if (requestHash && !this.responseCache.has(requestHash)) {
-      this.responseCache.set(requestHash, {
-        response$,
-        searchAbortController,
-      });
-    }
-
-    return {
-      response$,
-      searchAbortController,
-    };
-  }
-
-  public search({ id, ...request }: IKibanaSearchRequest, options: IAsyncSearchOptions = {}) {
-    const searchOptions = {
-      strategy: ENHANCED_ES_SEARCH_STRATEGY,
-      ...options,
-    };
-    const { sessionId, abortSignal } = searchOptions;
-
-    return this.createRequestHash$(request, searchOptions).pipe(
-      switchMap((requestHash) => {
-        const { searchAbortController, response$ } = this.getSearchResponse$(
-          request,
-          searchOptions,
-          requestHash
-        );
-
-        this.pendingCount$.next(this.pendingCount$.getValue() + 1);
-        const untrackSearch = this.deps.session.isCurrentSession(sessionId)
-          ? this.deps.session.trackSearch({ abort: () => searchAbortController.abort() })
-          : undefined;
-
-        // Abort the replay if the abortSignal is aborted.
-        // The underlaying search will not abort unless searchAbortController fires.
-        const aborted$ = (abortSignal ? fromEvent(abortSignal, 'abort') : EMPTY).pipe(
-          map(() => {
-            throw new AbortError();
-          })
-        );
-
-        return response$.pipe(
-          takeUntil(aborted$),
-          catchError((e) => {
-            return throwError(
-              this.handleSearchError(e, searchOptions, searchAbortController.isTimeout())
-            );
-          }),
-          finalize(() => {
-            this.pendingCount$.next(this.pendingCount$.getValue() - 1);
-            if (untrackSearch && this.deps.session.isCurrentSession(sessionId)) {
-              // untrack if this search still belongs to current session
-              untrackSearch();
-            }
-          })
-        );
-      })
-    );
-  }
-}
diff --git a/x-pack/plugins/data_enhanced/server/plugin.ts b/x-pack/plugins/data_enhanced/server/plugin.ts
index 29e6eddde65aa..a1ce3709e51a7 100644
--- a/x-pack/plugins/data_enhanced/server/plugin.ts
+++ b/x-pack/plugins/data_enhanced/server/plugin.ts
@@ -8,7 +8,6 @@
 import { CoreSetup, CoreStart, Logger, Plugin, PluginInitializerContext } from 'kibana/server';
 import { registerSessionRoutes } from './routes';
 import { searchSessionSavedObjectType } from './saved_objects';
-import { getUiSettings } from './ui_settings';
 import type {
   DataEnhancedRequestHandlerContext,
   DataEnhancedSetupDependencies as SetupDependencies,
@@ -30,7 +29,6 @@ export class EnhancedDataServerPlugin
   }
 
   public setup(core: CoreSetup<StartDependencies>, deps: SetupDependencies) {
-    core.uiSettings.register(getUiSettings());
     core.savedObjects.registerType(searchSessionSavedObjectType);
 
     this.sessionService = new SearchSessionService(this.logger, this.config, deps.security);
diff --git a/x-pack/plugins/data_enhanced/server/ui_settings.ts b/x-pack/plugins/data_enhanced/server/ui_settings.ts
deleted file mode 100644
index fff7b798d783f..0000000000000
--- a/x-pack/plugins/data_enhanced/server/ui_settings.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { i18n } from '@kbn/i18n';
-import { schema } from '@kbn/config-schema';
-import { UiSettingsParams } from 'kibana/server';
-import { UI_SETTINGS } from '../../../../src/plugins/data/server';
-
-export function getUiSettings(): Record<string, UiSettingsParams<unknown>> {
-  return {
-    [UI_SETTINGS.SEARCH_TIMEOUT]: {
-      name: i18n.translate('xpack.data.advancedSettings.searchTimeout', {
-        defaultMessage: 'Search Timeout',
-      }),
-      value: 600000,
-      description: i18n.translate('xpack.data.advancedSettings.searchTimeoutDesc', {
-        defaultMessage:
-          'Change the maximum timeout for a search session or set to 0 to disable the timeout and allow queries to run to completion.',
-      }),
-      type: 'number',
-      category: ['search'],
-      schema: schema.number(),
-    },
-  };
-}
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index f20bc0f72ccde..dfa8bd387cbd7 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -1415,8 +1415,6 @@
     "data.search.timeoutIncreaseSetting": "クエリがタイムアウトしました。検索タイムアウト詳細設定で実行時間を延長します。",
     "data.search.timeoutIncreaseSettingActionText": "設定を編集",
     "data.search.unableToGetSavedQueryToastTitle": "保存したクエリ {savedQueryId} を読み込めません",
-    "data.search.upgradeLicense": "クエリがタイムアウトしました。無料のベーシックティアではクエリがタイムアウトすることはありません。",
-    "data.search.upgradeLicenseActionText": "今すぐアップグレード",
     "data.searchSessionIndicator.noCapability": "検索セッションを作成するアクセス権がありません。",
     "data.triggers.applyFilterDescription": "Kibanaフィルターが適用されるとき。単一の値または範囲フィルターにすることができます。",
     "data.triggers.applyFilterTitle": "フィルターを適用",
@@ -1437,6 +1435,8 @@
     "data.kueryAutocomplete.lessThanOrEqualOperatorDescription.lessThanOrEqualToText": "より小さいまたは等しい",
     "data.kueryAutocomplete.orOperatorDescription": "{oneOrMoreArguments} が true であることを条件とする",
     "data.kueryAutocomplete.orOperatorDescription.oneOrMoreArgumentsText": "1つ以上の引数",
+    "data.advancedSettings.searchTimeout": "検索タイムアウト",
+    "data.advancedSettings.searchTimeoutDesc": "検索セッションの最大タイムアウトを変更するか、0に設定してタイムアウトを無効にすると、クエリは完了するまで実行されます。",
     "devTools.badge.readOnly.text": "読み取り専用",
     "devTools.badge.readOnly.tooltip": "を保存できませんでした",
     "devTools.devToolsTitle": "開発ツール",
@@ -7262,8 +7262,6 @@
     "xpack.dashboardMode.uiSettings.dashboardsOnlyRolesDeprecation": "この設定はサポートが終了し、Kibana 8.0 では削除されます。",
     "xpack.dashboardMode.uiSettings.dashboardsOnlyRolesDescription": "ダッシュボード表示専用モードのロールです",
     "xpack.dashboardMode.uiSettings.dashboardsOnlyRolesTitle": "ダッシュボード専用ロール",
-    "xpack.data.advancedSettings.searchTimeout": "検索タイムアウト",
-    "xpack.data.advancedSettings.searchTimeoutDesc": "検索セッションの最大タイムアウトを変更するか、0に設定してタイムアウトを無効にすると、クエリは完了するまで実行されます。",
     "xpack.data.mgmt.searchSessions.actionDelete": "削除",
     "xpack.data.mgmt.searchSessions.actionExtend": "延長",
     "xpack.data.mgmt.searchSessions.actions.tooltip.moreActions": "さらにアクションを表示",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 3b32e1c184f26..ce47b76c71949 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -1423,8 +1423,6 @@
     "data.search.timeoutIncreaseSetting": "您的查询已超时。使用搜索超时高级设置延长运行时间。",
     "data.search.timeoutIncreaseSettingActionText": "编辑设置",
     "data.search.unableToGetSavedQueryToastTitle": "无法加载已保存查询 {savedQueryId}",
-    "data.search.upgradeLicense": "您的查询已超时。使用我们免费的基本级许可，您的查询永不会超时。",
-    "data.search.upgradeLicenseActionText": "立即升级",
     "data.searchSessionIndicator.noCapability": "您无权创建搜索会话。",
     "data.triggers.applyFilterDescription": "应用 kibana 筛选时。可能是单个值或范围筛选。",
     "data.triggers.applyFilterTitle": "应用筛选",
@@ -1445,6 +1443,8 @@
     "data.kueryAutocomplete.lessThanOrEqualOperatorDescription.lessThanOrEqualToText": "小于或等于",
     "data.kueryAutocomplete.orOperatorDescription": "需要{oneOrMoreArguments}为 true",
     "data.kueryAutocomplete.orOperatorDescription.oneOrMoreArgumentsText": "一个或多个参数",
+    "data.advancedSettings.searchTimeout": "搜索超时",
+    "data.advancedSettings.searchTimeoutDesc": "更改搜索会话的最大超时值，或设置为 0 以禁用超时，让查询运行至结束。",
     "devTools.badge.readOnly.text": "只读",
     "devTools.badge.readOnly.tooltip": "无法保存",
     "devTools.devToolsTitle": "开发工具",
@@ -7326,8 +7326,6 @@
     "xpack.dashboardMode.uiSettings.dashboardsOnlyRolesDeprecation": "此设置已过时，将在 Kibana 8.0 中移除。",
     "xpack.dashboardMode.uiSettings.dashboardsOnlyRolesDescription": "属于“仅查看仪表板”模式的角色",
     "xpack.dashboardMode.uiSettings.dashboardsOnlyRolesTitle": "仅限仪表板的角色",
-    "xpack.data.advancedSettings.searchTimeout": "搜索超时",
-    "xpack.data.advancedSettings.searchTimeoutDesc": "更改搜索会话的最大超时值，或设置为 0 以禁用超时，让查询运行至结束。",
     "xpack.data.mgmt.searchSessions.actionDelete": "删除",
     "xpack.data.mgmt.searchSessions.actionExtend": "延长",
     "xpack.data.mgmt.searchSessions.actions.tooltip.moreActions": "更多操作",

From 5560802d80149a7cbb4165324eda79b3da11c3a2 Mon Sep 17 00:00:00 2001
From: Larry Gregory <larry.gregory@elastic.co>
Date: Wed, 28 Apr 2021 08:33:14 -0400
Subject: [PATCH 28/28] Replace lodash template with static react renderer for
 discover's row formatter (#98072)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../{row_formatter.ts => row_formatter.tsx}   | 41 +++++++++++--------
 1 file changed, 25 insertions(+), 16 deletions(-)
 rename src/plugins/discover/public/application/angular/helpers/{row_formatter.ts => row_formatter.tsx} (71%)

diff --git a/src/plugins/discover/public/application/angular/helpers/row_formatter.ts b/src/plugins/discover/public/application/angular/helpers/row_formatter.tsx
similarity index 71%
rename from src/plugins/discover/public/application/angular/helpers/row_formatter.ts
rename to src/plugins/discover/public/application/angular/helpers/row_formatter.tsx
index b219dda19e10a..c5e64f38a3117 100644
--- a/src/plugins/discover/public/application/angular/helpers/row_formatter.ts
+++ b/src/plugins/discover/public/application/angular/helpers/row_formatter.tsx
@@ -6,24 +6,29 @@
  * Side Public License, v 1.
  */
 
-import { template } from 'lodash';
+import React, { Fragment } from 'react';
+import ReactDOM from 'react-dom/server';
 import { MAX_DOC_FIELDS_DISPLAYED } from '../../../../common';
 import { getServices, IndexPattern } from '../../../kibana_services';
 
-function noWhiteSpace(html: string) {
-  const TAGS_WITH_WS = />\s+</g;
-  return html.replace(TAGS_WITH_WS, '><');
+interface Props {
+  defPairs: Array<[string, unknown]>;
 }
-
-const templateHtml = `
-  <dl class="source truncate-by-height">
-    <% defPairs.forEach(function (def) { %>
-      <dt><%- def[0] %>:</dt>
-      <dd><%= def[1] %></dd>
-      <%= ' ' %>
-    <% }); %>
-  </dl>`;
-export const doTemplate = template(noWhiteSpace(templateHtml));
+const TemplateComponent = ({ defPairs }: Props) => {
+  return (
+    <dl className={'source truncate-by-height'}>
+      {defPairs.map((pair, idx) => (
+        <Fragment key={idx}>
+          <dt>{pair[0]}:</dt>
+          <dd
+            // We  can dangerously set HTML here because this content is guaranteed to have been run through a valid field formatter first.
+            dangerouslySetInnerHTML={{ __html: `${pair[1]}` }} // eslint-disable-line react/no-danger
+          />{' '}
+        </Fragment>
+      ))}
+    </dl>
+  );
+};
 
 export const formatRow = (hit: Record<string, any>, indexPattern: IndexPattern) => {
   const highlights = hit?.highlight ?? {};
@@ -38,7 +43,9 @@ export const formatRow = (hit: Record<string, any>, indexPattern: IndexPattern)
     pairs.push([displayKey ? displayKey : key, val]);
   });
   const maxEntries = getServices().uiSettings.get(MAX_DOC_FIELDS_DISPLAYED);
-  return doTemplate({ defPairs: [...highlightPairs, ...sourcePairs].slice(0, maxEntries) });
+  return ReactDOM.renderToStaticMarkup(
+    <TemplateComponent defPairs={[...highlightPairs, ...sourcePairs].slice(0, maxEntries)} />
+  );
 };
 
 export const formatTopLevelObject = (
@@ -70,5 +77,7 @@ export const formatTopLevelObject = (
     pairs.push([displayKey ? displayKey : key, formatted]);
   });
   const maxEntries = getServices().uiSettings.get(MAX_DOC_FIELDS_DISPLAYED);
-  return doTemplate({ defPairs: [...highlightPairs, ...sourcePairs].slice(0, maxEntries) });
+  return ReactDOM.renderToStaticMarkup(
+    <TemplateComponent defPairs={[...highlightPairs, ...sourcePairs].slice(0, maxEntries)} />
+  );
 };