From 51d034e2cd7934ea4f16a28e3acaa9e34ac70119 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Johnny=20Marie=CC=81thoz?= Date: Tue, 11 Aug 2026 11:22:46 +0200 Subject: [PATCH] docs(shibboleth): document the SWITCH edu-ID login flow The module had no documentation, and the SAML exchange it implements is hard to reconstruct from the code alone: four interaction steps share a single URL, the assertion arrives encrypted, and four different certificates take part without the code ever naming them together. The flow is described step by step from a real capture of the test federation, with the HTTP requests, the SAML messages and, for each step, which certificate is doing the work. A summary table maps the four certificates to who holds their private key and where each is configured, and a section records which SWITCH federation aggregate the identity provider certificates are extracted from. Also documented: the Resource Registry configuration this flow depends on, including why the private identity and the linked affiliation attribute have to be required together; how to test, starting with giving the test account an organisational identity, which is the step whose omission invalidates every other; and a decision record on the OpenID Connect alternative, kept as a reference rather than a plan. The consent screenshot is redacted: the name and e-mail are masked, the home organisation and the linked affiliations are kept since they are what the flow exists to obtain. Personal data in the attribute listing is fictitious. Co-Authored-By: Claude Opus 5 (1M context) --- .../shibboleth_authenticator/README.md | 609 ++++++++++++++++++ .../eduid-consent.png | Bin 0 -> 87727 bytes 2 files changed, 609 insertions(+) create mode 100644 sonar/modules/shibboleth_authenticator/README.md create mode 100644 sonar/modules/shibboleth_authenticator/eduid-consent.png diff --git a/sonar/modules/shibboleth_authenticator/README.md b/sonar/modules/shibboleth_authenticator/README.md new file mode 100644 index 000000000..9ad88eba0 --- /dev/null +++ b/sonar/modules/shibboleth_authenticator/README.md @@ -0,0 +1,609 @@ + + +# SWITCH edu-ID login flow + +How a user signs in to SONAR through SWITCH edu-ID, step by step. + +Every request below comes from a real capture of the test federation +(`login.test.eduid.ch`), taken with SAML-tracer against a development server on +`https://sonar.ch:5000`. Analytics and unrelated background traffic have been +removed; what remains is the complete flow, in order. + +## Overview + +```mermaid +sequenceDiagram + participant B as Browser + participant S as SONAR (Service Provider) + participant I as edu-ID (Identity Provider) + + B->>S: GET /shibboleth/login/eduidtest + S-->>B: 302 to the IdP, carrying AuthnRequest + RelayState + B->>I: GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=… + I-->>B: 302 to the login sequence (execution=e13s1) + + Note over B,I: Four interaction steps, all on the same URL,
distinguished only by the execution parameter + B->>I: e13s1 — username + B->>I: e13s2 — password + B->>I: e13s3 — consent to release attributes + B->>I: e13s4 — session storage probe + + I-->>B: 200, HTML page auto-submitting a form + B->>S: POST /shibboleth/authorized/eduidtest (SAMLResponse + RelayState) + S-->>B: 302, user is now logged in +``` + +## The steps + +### 1. The user asks SONAR to sign in + +```http +GET https://sonar.ch:5000/shibboleth/login/eduidtest +→ 302 https://login.test.eduid.ch/idp/profile/SAML2/Redirect/SSO?SAMLRequest=…&RelayState=… +``` + +Handled by `views/client.py::login`. It builds the SAML settings through +`auth.py::init_saml_auth`, then redirects the browser to the identity provider. +`eduidtest` is the provider key: it selects an entry of +`SHIBBOLETH_IDENTITY_PROVIDERS` and names the certificate file to trust. + +### 2. The AuthnRequest reaches the identity provider + +Sent with the **HTTP-Redirect binding**, so the request travels as URL +parameters: `SAMLRequest` (deflated then base64-encoded) and `RelayState`. +There is no `Signature` parameter — SONAR does not sign its authentication +requests. + +```xml + + https://sonar.ch/shibboleth + + + urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport + + +``` + +Three values decide whether the IdP accepts the request, and all three must +match the service registration in the Resource Registry: + +| Element | Value | Where it comes from | +|---|---|---| +| `Issuer` | `https://sonar.ch/shibboleth` | `SHIBBOLETH_SERVICE_PROVIDER["entity_id"]` — an identifier, it never has to resolve | +| `AssertionConsumerServiceURL` | `https://sonar.ch:5000/shibboleth/authorized/eduidtest` | computed by `url_for(…, _external=True)`, so it follows the `Host` header | +| `Destination` | `https://login.test.eduid.ch/…` | the `sso_url` of the provider entry | + +The `AssertionConsumerServiceURL` is the one that bites in practice: change the +hostname or the port of the development server and the IdP will reject the +request until the new URL is registered. + +> **Certificates — none.** The outbound request is protected only by the TLS +> certificate of `login.test.eduid.ch`, which belongs to SWITCH. No SAML +> certificate is involved: the captured request carries `SAMLRequest` and +> `RelayState` and **no `SigAlg` or `Signature` parameter**, so SONAR does not +> sign it. The service provider key pair plays no part until the response comes +> back. +> +> This is a default rather than a decision: `init_saml_auth` declares no +> `security` section, so `python3-saml` applies `authnRequestsSigned: False`. +> Setting it to `True` covers the SONAR side, since the private key is already +> loaded. It is not sufficient on its own: the identity provider holds the +> certificate for *encryption*, and whether it accepts the same one to verify a +> signature depends on how the key is registered in the Resource Registry. +> Reusing a single certificate for both uses has to be agreed there. The gain is +> modest: the identity provider validates the +> `AssertionConsumerServiceURL` against the registered service, so a forged +> request cannot divert the assertion, and `RelayState` integrity is already +> covered by SONAR's own signed state token. Worth doing as defence in depth, on +> its own and not bundled with other work — a configuration mismatch would break +> login outright. + +### 3. RelayState carries SONAR's own state + +`RelayState` is opaque to the IdP, which returns it untouched. SONAR uses it to +remember what the user was doing. It is signed with `SECRET_KEY` through +`itsdangerous`, and decodes to: + +```json +{ + "app": "eduidtest", + "next": "https://sonar.ch:5000/login/?next=/", + "sid": "60906f8a…d718f2a" +} +``` + +`sid` is a fingerprint of the browser session. On the way back, +`views/client.py` checks that it still matches and that `app` is the provider +being answered, which is what binds a response to the session that asked for it. + +**That check is conditional.** It sits inside `if "RelayState" in request.form`, +so a response arriving without `RelayState` reaches `authorized_signup_handler` +unbound to any session. The identity provider always echoes the value back, so +this does not happen in the normal flow — but the protection is not +unconditional, and reading it as such would be wrong. + +### 4. Authentication, in four steps on one URL + +All four use the same URL and differ only by the `execution` parameter. Each is +a `GET` that renders a page, then a `POST` that submits it and redirects to the +next. + +| execution | Page | POST fields | +|---|---|---| +| `e13s1` | Username | `j_username`, `_eventId_submit` | +| `e13s2` | Password | `j_username`, `j_password`, `_eventId_proceed` | +| `e13s3` | **Attribute consent** | `_shib_idp_consentIds` (one per attribute), `_eventId_proceed=Accepter` | +| `e13s4` | Session storage probe | `shib_idp_ls_success.shib_idp_session_ss`, `_eventId_proceed` | + +Step `e13s4` is not a user interaction. The page reads +`/idp/profile/user/system/shared-local-storage` to look for an existing single +sign-on session in the browser, then submits by itself. In the capture the probe +comes back empty — `shib_idp_ls_success.shib_idp_session_ss = false` — which is +expected on a first login. The `_ss` suffix names the browser's `sessionStorage`, +and `shib_idp_ls_success.` is how the page reports back whether the read +worked. + +What this stores is the **identity provider's own SSO session**, so that signing +in to a second service in the same browser does not ask for credentials again. +It lives in the browser, disappears when the browser closes, and writes nothing +to the edu-ID account. Do not confuse it with the consent of step `e13s3`, which +is the durable record of the user–service pair. + +### 5. Consent — what the user is actually asked + +Step `e13s3` is where the user authorises the release of each attribute. The +`_shib_idp_consentIds` fields submitted match one for one what the page lists: + +```text +commonName displayName givenName surname email +swissEduPersonHomeOrganization swissEduIDLinkedAffiliation +``` + +![Consent page shown by edu-ID](eduid-consent.png) + +*Name and e-mail are redacted; the home organisation and the linked affiliations +are the values this flow exists to obtain.* + +Consent is stored by the identity provider for the user–service pair, and it is +durable: the page is shown on the first login, then only again if one of the +released values has changed since — or if the user has asked to be prompted at +every login. It survives browser restarts, unlike the SSO session of step +`e13s4`. + +That matters when testing. Widen the attribute set in the Resource Registry and +you may see no difference, because the stored consent still covers the previous, +narrower set. To force the page back, tick the box offered on the login page to +revoke previous consent; edu-ID administrators can also reset it for a given +service or user. + +### 6. The response returns by POST + +The IdP answers step `e13s4` with an HTML page containing a form that submits +itself to the assertion consumer service: + +```http +POST https://sonar.ch:5000/shibboleth/authorized/eduidtest + SAMLResponse=… (11 829 bytes once base64-decoded) + RelayState=… (returned unchanged) +→ 302 https://sonar.ch:5000/login/?next=/ +``` + +This is why the development server needs a certificate the browser trusts. The +POST is issued by a page served from `login.test.eduid.ch`; if the browser +raises a certificate warning on `sonar.ch:5000`, clicking through generally +drops the request body, and the assertion is lost. + +The response is **signed**, and the assertion inside it is **encrypted** to +SONAR's service provider certificate: + +```xml + + https://test.eduid.ch/idp/shibboleth + … + + + + … + +``` + +There is no readable `AttributeStatement` in the POST body: the attributes only +appear after `python3-saml` decrypts the assertion. + +> **Certificates — three at once, and this is the densest moment of the flow.** +> +> - The **TLS certificate of the development server** protects the POST. It is +> the only one the browser checks, and the only one that has to be *trusted* +> rather than merely known — see the warning above about losing the body. +> - The IdP signed the response with its private key. SONAR verifies that +> signature against **`data/idp_certificates/eduidtest.crt`**, the copy of the +> IdP signing certificate published in the SWITCH federation metadata. +> - The IdP encrypted the assertion with **SONAR's service provider +> certificate**, which it holds from the Resource Registry registration. The +> captured `EncryptedKey` names it explicitly: +> `Recipient="https://sonar.ch/shibboleth"`. +> +> Note the asymmetry: the IdP certificate is a *trust anchor* and is legitimately +> versioned in the repository, whereas the service provider key pair is a secret +> provisioned per environment. + +**The `Issuer` must equal the identity provider's configured `entity_id`** — +that is `SHIBBOLETH_IDENTITY_PROVIDERS["eduidtest"]["entity_id"]`, not the +service provider's `SHIBBOLETH_SERVICE_PROVIDER["entity_id"]` seen in step 2. +The two are easy to confuse: the first identifies edu-ID and is what the +response and assertion `Issuer` are compared against; the second identifies +SONAR and is what the `AuthnRequest` carries. `python3-saml` rejects any +mismatch. It stays `https://test.eduid.ch/idp/shibboleth` only because the +service requires the *private identity*; were the affiliation identity allowed, +the answer would come from the institution's own IdP +(`https://aai-login..eduid.ch/idp/shibboleth`) and validation would +fail. + +### 7. Attributes, once decrypted + +> **Certificate — the service provider private key, and the order matters.** +> `python3-saml` decrypts as soon as the response object is built, *before* any +> validation: `OneLogin_Saml2_Response.__init__` sees the `EncryptedAssertion` +> and calls `_decrypt_assertion`, which uses `get_sp_key()` — that is +> `SHIBBOLETH_SERVICE_PROVIDER_PRIVATE_KEY`. Validation comes next, in `is_valid`: +> a signature on the response is checked against the original document, one on +> the assertion against the decrypted one, both with the same IdP certificate. +> +> The practical consequence: a wrong or missing private key fails at +> construction, with a decryption error, never with a signature error. If you +> see "Signature validation failed", suspect the IdP certificate; if you see a +> decryption failure, suspect the service provider key pair. + +```text +urn:oid:2.16.840.1.113730.3.1.241 displayName Camille Dupraz +urn:oid:2.5.4.3 commonName Camille Dupraz +urn:oid:2.5.4.4 surname Dupraz +urn:oid:2.5.4.42 givenName Camille +urn:oid:0.9.2342.19200300.100.1.3 mail camille.dupraz@example.org +urn:oid:2.16.756.1.2.5.1.1.1 swissEduPersonUniqueID 0000159046867193@test.eduid.ch +urn:oid:1.3.6.1.4.1.5923.1.1.1.6 eduPersonPrincipalName 0000159046867193@test.eduid.ch +urn:oid:1.3.6.1.4.1.5923.1.1.1.13 eduPersonUniqueId 0000159046867193@test.eduid.ch +urn:oid:2.16.756.1.2.5.1.1.4 swissEduPersonHomeOrganization test.eduid.ch +urn:oid:2.16.756.1.2.5.1.1.1029 swissEduIDLinkedAffiliation member@library-demo.ch + student@library-demo.ch +``` + +`handlers.py::authorized_signup_handler` reads them through +`utils.py::get_account_info`, which keeps three of them — the ones named in the +`mappings` of the provider entry. + +Two are worth a closer look. + +**`swissEduPersonHomeOrganization` is `test.eduid.ch`**, not a university. That +is the signature of the private identity: the home organisation is edu-ID +itself. The same holds for the scope of the unique identifier, which is why that +identifier stays stable even if the person changes institution. + +**`swissEduIDLinkedAffiliation` lists every current affiliation**, as +`@` pairs. Here the same institution appears twice, once as +`member` and once as `student` — the specific role always comes alongside +`member`. + +**SONAR requests this attribute but does not yet consume it.** `sonar/config.py` +maps only `email`, `full_name` and `user_unique_id`, and `get_account_info` +keeps nothing else, so the affiliations are released and dropped. Whoever adds a +membership check should look for a *pair*, never ask “what is this person's +role”: one institution yields several values, and the specific role always comes +with `member`. + +### 8. Back on SONAR + +```http +GET https://sonar.ch:5000/login/?next=/ → 302 / +GET https://sonar.ch:5000/ → 200 +``` + +By this point the account exists and the session is open. +`authorized_signup_handler` has found the user by e-mail, created the account if +needed, linked the external identity, and authenticated the session. + +The link is a `UserIdentity` row, written by `oauth_link_external_id` with +`method` set to the provider key. It is what lets a returning user be recognised +even after changing their e-mail address. + +**It does not appear under `/account/settings/linkedaccounts/`.** That page +enumerates `OAUTHCLIENT_REMOTE_APPS`, where SONAR declares only ORCID; this +module borrows a few helpers from invenio-oauthclient but never registers itself +as a remote app — it is SAML, not OAuth. So the link is recorded and invisible: +users can unlink ORCID, but not edu-ID. + +That is defensible rather than accidental. Unlinking ORCID loses an enrichment, +whereas unlinking edu-ID would lock the user out, since an account created +through SAML has no local password. The absence of a control protects as much as +it limits. + +## Which certificate does what + +Four certificates take part, and they are easy to confuse because two of them +answer to the name "SONAR". Every public part is published somewhere — in +federation metadata, in the Resource Registry, or presented during a TLS +handshake. Only the private keys stay on their respective servers. + +| Certificate | Who holds the private key | Used for | At step | +|---|---|---|---| +| **Development server TLS** — `.certs/dev.crt` + `.certs/dev.key` | SONAR | Serving `https://sonar.ch:5000`. Validated by the browser, and the one that has to be *trusted* rather than merely present — the return POST is lost otherwise. | 1, 6, 8 | +| **`login.test.eduid.ch` TLS** | SWITCH | Serving the identity provider. Also validated by the browser, but publicly trusted, so nothing to configure. | 2 – 5 | +| **Service provider key pair** — `SHIBBOLETH_SERVICE_PROVIDER_CERTIFICATE` / `_PRIVATE_KEY` | SONAR | The **public part**, registered in the Resource Registry, is what the IdP encrypts the assertion to. The **private part** decrypts it. Not used to sign in the current configuration, since SONAR does not sign its requests. | 6 (encryption), 7 (decryption) | +| **Identity provider signing certificate** — `data/idp_certificates/.crt` | SWITCH | Verifying the signature of the response. A trust anchor: without it, a forged response would be accepted. | 6 | + +Two distinctions worth holding on to. + +**TLS and SAML are independent layers.** TLS protects the hop; SAML protects the +message. A perfectly valid TLS session tells you nothing about who issued the +assertion, and the SAML signature stays valid whatever happens to the transport. +They fail separately and for different reasons. + +**Public and secret are inverted between the two SAML certificates.** The +identity provider certificate is *meant* to be distributed — SWITCH publishes it +in the federation metadata, and it is legitimately versioned in this repository. +The service provider certificate is public too, but its key is not: the pair is +provisioned per environment, outside the repository, and its public part has to +be registered with SWITCH before anything works. + +## Where the identity provider certificates come from + +`data/idp_certificates/.crt` is a copy of what SWITCH publishes in the +federation metadata. That aggregate is the authoritative source: whenever an +identity provider rotates its signing key, this is where the new certificate +appears. + +| Federation | Aggregate for service providers | Identity provider entityID | Local file | +|---|---|---|---| +| Test | `https://metadata.aai.switch.ch/metadata.aaitest+idp.xml` | `https://test.eduid.ch/idp/shibboleth` | `eduidtest.crt` | +| Production | `https://metadata.aai.switch.ch/metadata.switchaai+idp.xml` | `https://eduid.ch/idp/shibboleth` | `eduid.crt` | + +Use the `+idp` aggregates rather than the legacy `metadata.aaitest.xml` and +`metadata.switchaai.xml`: they hold only identity providers, which is all a +service provider needs, and they are an order of magnitude smaller — 271 KB +against 2.5 MB for the test federation, 1.4 MB against 21 MB for production. + +To refresh a certificate, pull the `KeyDescriptor use="signing"` of the matching +`EntityDescriptor`. The repository stores it as bare base64, without the PEM +header lines and wrapped at 64 columns — `python3-saml` adds the headers itself. +Two details cost an afternoon each if missed: the file must end with a newline, +and no line may carry trailing spaces. + +Verify what you extracted before replacing anything: + +```shell +openssl x509 -inform DER -in .der -noout -subject -dates -fingerprint -sha256 +``` + +Both files currently in the repository match their published counterparts +exactly, checked by SHA-256 of the DER. + +The aggregates are themselves signed, with a certificate chaining to the +Switch edu-ID Root CA — see the [SWITCH PKI repository](https://help.switch.ch/pki/aai/). +Verifying that signature is the rigorous way to trust an extraction; fetching +over HTTPS from `metadata.aai.switch.ch` and comparing fingerprints is the +pragmatic one. + +## Configuration this flow depends on + +**In the Resource Registry** — — +where the SONAR service is administered. The same registry serves both +federations; each resource carries its own environment, so the test service and +the production one are edited separately and approved separately. + +The service must require the **private identity** together with the *edu-ID +linked affiliation* attribute. Those two go together: +`swissEduIDLinkedAffiliation` is only released with the private identity, and +requiring the private identity is also what keeps the `Issuer` constant. +Declaring the attribute alone gets the request rejected — which is exactly how +the first attempt was answered. + +The *Identity Selection* preference — "ask if personal or affiliation identity +should be used" — must stay off. It permits the affiliation identity, which is +exactly what breaks the flow. + +The **intended audiences** must be narrowed to match. The registration authority +asked for this explicitly on the second review: the other home organisation +types are to be marked as *excluded*, leaving only the private identity. The +vocabulary of `swissEduPersonHomeOrganizationType` has eight values, so eight +decisions to make: + +| Value | Meaning | +|---|---| +| `university` | University or federal institute of technology | +| `uas` | University of applied sciences, or university of teacher education | +| `hospital` | Hospital | +| `library` | Library | +| `tertiaryb` | Professional education and training college (tertiary B) | +| `uppersecondary` | Vocational or general education school, upper secondary | +| `vho` | Virtual home organisation | +| `others` | None of the above | + +Leaving them open would contradict the identity requirement: a user arriving +with a university affiliation would match an intended audience the service +cannot in fact serve, since that path releases neither the linked affiliation +nor a stable identifier. Excluding them makes the registration say what the +service actually does — everyone signs in with their private edu-ID, and +affiliations arrive as attributes rather than as an identity. + +Every change here goes through approval by the registration authority, so plan +for a round trip. Group edits rather than submitting them one at a time: a new +assertion consumer service URL and an attribute requirement, for instance, cost +one wait together and two separately. + +**In SONAR**, three settings and one file per provider: + +| | | +|---|---| +| `SHIBBOLETH_SERVICE_PROVIDER["entity_id"]` | must match the registered service | +| `SHIBBOLETH_SERVICE_PROVIDER_CERTIFICATE` / `_PRIVATE_KEY` | the key pair the assertion is encrypted to; provided per environment, never versioned | +| `SHIBBOLETH_IDENTITY_PROVIDERS[]` | `entity_id`, `sso_url` and the attribute `mappings` | +| `data/idp_certificates/.crt` | the identity provider signing certificate, published in the SWITCH federation metadata | + +## How to test + +### Give the test account an affiliation + +This is the step that is easy to miss, and it invalidates every other test until +it is done. A fresh edu-ID account has a personal identity and nothing else, so +`swissEduIDLinkedAffiliation` has nothing to carry — the attribute is then +missing from the assertion entirely, even once the Resource Registry allows it. +Two causes, one symptom, and they are easy to confuse. + +Add an organisational identity from the account itself: + +- Test federation — +- Production — + +The page offers **Add an organisation identity**, which links you to an existing +one, and **Create an organisational identity yourself**. On the test federation, +the first lists a set of demo identity providers: + +```text +Demo Home Organisation Demo Others Demo Tertiaryb +Demo Hospital Demo Partner University Demo UAS +Demo Library Demo University +``` + +That list is not arbitrary: it mirrors the `swissEduPersonHomeOrganizationType` +vocabulary documented above, one demo provider per type. + +Do not expect linking one of them to demonstrate that an excluded organisation +type is refused. With the private identity required, the affiliation chooser +never appears and the user always authenticates with their personal edu-ID, +whatever they are linked to. Linking `Demo University` simply adds another +`@` value to the released list. What the demo providers let you +vary is the **content** of `swissEduIDLinkedAffiliation`, not the identity the +assertion is issued for. + +The account used throughout this document is linked to **Demo Library**, which +yields the scope `library-demo.ch` — hence `member@library-demo.ch` and +`student@library-demo.ch`. Note that one institution produces two values: the +specific role and `member`. + +### Check the prerequisites + +Four things must hold, and each fails in its own recognisable way. + +| Requirement | How it fails when missing | +|---|---| +| `SHIBBOLETH_SERVICE_PROVIDER_CERTIFICATE` and `_PRIVATE_KEY` set in `invenio.cfg` | No SWITCHaai button at all — `get_switch_aai_providers()` returns an empty list, so the login page hides it | +| `APP_ENV=development` | The button appears but `eduidtest` is absent from it: providers flagged `dev` are filtered outside development | +| A development certificate covering the hostname, and **trusted** | Login runs to the end, then the browser warns on the return POST and the assertion is lost with the request body | +| The assertion consumer service URL registered in the Resource Registry | The identity provider refuses the request before any page is shown | + +### Run it + +```shell +APP_ENV=development uv run poe server +``` + +Open `https://sonar.ch:5000`, choose the SWITCHaai provider, and follow the four +identity provider steps. The consent page of step 5 should list *edu-ID linked +affiliations* among the attributes; if it does not, the Resource Registry +declaration is the place to look, not the code. + +### When nothing seems to change + +The three causes, in the order worth checking: + +- **The consent page no longer appears, and the attribute is still absent.** + Stored consent covers the previous, narrower attribute set. Tick the box on the + login page to revoke it, then sign in again. +- **The consent page lists the attribute but the assertion does not carry it.** + The account has no affiliation — go back to the account page above. +- **Nothing at all reaches SONAR.** Look at the browser rather than the server: + a certificate warning on the return POST swallows the assertion silently, and + the server logs show nothing because no request ever arrived. + +## If this module ever becomes costly: the OpenID Connect path + +edu-ID speaks OpenID Connect as well as SAML, from the same Shibboleth identity +provider. This section records what was established while documenting the SAML +integration, so that the option can be evaluated later without redoing the +research. **It is not a plan.** Nothing here justifies migrating today. + +### What would trigger a look + +- A certificate rotation that goes wrong, or the per-environment provisioning of + the service provider key pair becoming a recurring cost. +- SWITCH announcing a deprecation date for SAML. As of August 2026 there is + none. + +### Where things stood in August 2026 + +SWITCH publishes a governance RFC on the OIDC identity model — published +1 February 2026, final specification 21 July 2026 — whose purpose is precisely to +release **organisational identities** through OIDC, which until then carried only +the extended identity model. Its motivation is stated plainly: *“SAML is not +actively developed anymore and lacks support for use cases like mobile or +single-page applications or OAuth 2.0.”* + +There is, however, **no deprecation statement and no timeline**. The service +documentation presents both protocols as supported, and notes that OIDC support +“is currently limited compared to SAML”. Read that RFC first: it describes how +the affiliation model this module depends on maps onto OIDC claims. + +### What the integration would look like + +Discovery documents are published on both federations — +`https://login.eduid.ch/.well-known/openid-configuration` and its +`login.test.eduid.ch` counterpart. The endpoints follow the Shibboleth layout +(`/idp/profile/oidc/authorize`, `/token`, `/userinfo`, `/keyset`), not the +Keycloak one. + +`scopes_supported` advertises both `https://login.eduid.ch/authz/User.Read`, +which the attribute specification ties to `swissEduIDLinkedAffiliation`, and the +newer `https://eduid.ch/scope/userinfo.read`. Check which one SWITCH expects +before using either — the affiliations this module exists to read are reachable +as an OIDC claim through one of them. + +The integration point would be `OAUTHCLIENT_REMOTE_APPS`, alongside ORCID, using +`OAuthSettingsHelper` with explicit endpoint URLs. Three cautions: + +- **The Keycloak contrib is not reusable as is.** Despite looking like a generic + OIDC helper, it derives endpoints from Keycloak's URL scheme and fetches the + signing key from a realm URL rather than a `jwks_uri`. +- **Audience verification is off by default.** In + `contrib/keycloak/helpers.py`, `_VERIFY_AUD` defaults to `False`. Binding the + ID token to the client is the property that makes OIDC an authentication + protocol rather than a bearer-token scheme; leaving it off reproduces the + weakness OIDC was designed to fix. +- **The registration cost does not disappear.** OIDC services are registered + through the same Resource Registry, with the same approval cycle, scopes + standing in for attribute declarations. + +### The trade + +Gone: the service provider key pair to provision and rotate per environment, the +identity provider certificate tracked in `data/idp_certificates/`, and the XML +signature and encryption stack. Four certificates become client credentials — +either a client secret or, since `token_endpoint_auth_methods_supported` +advertises `private_key_jwt`, a registered public key, which trades one key pair +for another rather than removing it. + +Added: rewriting the login path, the handler and the attribute mapping; +re-registering both services; and either a period running two mechanisms or a +flag day. + +## Reproducing a capture + +Install [SAML-tracer](https://addons.mozilla.org/firefox/addon/saml-tracer/), +sign in, then export. Two cautions: + +- **The export contains the password in clear text**, in the `j_password` field + of the `e13s2` step, along with the e-mail address and the full assertion. + Treat an export as a credential: keep it out of the repository, and change the + password of any account whose capture was shared. +- Capture in a private window, or the export will be buried under unrelated + traffic from your other tabs — the original had 62 requests, of which 45 came + from an open webmail. diff --git a/sonar/modules/shibboleth_authenticator/eduid-consent.png b/sonar/modules/shibboleth_authenticator/eduid-consent.png new file mode 100644 index 0000000000000000000000000000000000000000..8645f51080a28b25873ba8d6cb232941b8f4cde1 GIT binary patch literal 87727 zcmdqI1yEaU+b&9#0!1o7fdZ8mC{Uny@nWS#iUyYg#e%y-ixzLu;u%Oi#5o+%g$Vur*iHL~E z-@cL4AR@YcL_~DsU53lR}%g^jGN+FM!KM`|vPmNs@4L_}U0Nh!oy2|YC3 ztEZ!~S3eCyLgucoU;lE~=h-Nt24I=;ANv*4{C0ALtM*2Ajs_}vA^Aj4H zE1l(JPpN(hHyUp^s_!IfoH>{JV1>0+~&O6X!UEd(rtSpWJ(ZE8>S z=Pw$i2b4rT_eX5#Hog9$w6WyUlnn1ycu8#9otTJv7-Db-tzdTj*3fcMcR&i;xub}A zr-)ve7w^!P1^SOevw$=o=f;J2?1ephPu{WMJ{23wt(KrK>UTtHR^LMXfA+^2tw;@t z589nQXZzeNvznT@LN7RE)APOGd!=&5@27Ws%JHD7m|dXX*_Z^)FsLhOI??9SEjH z*EerZ9d^VEy&QaGKBpW#)FnG`J&q2|u(`81_0munANozrx%ttod~@<6kyj6gR1WWN z*wB4nY+V0^G5p5xNb-kVvS+*aHR0bBeqSlcL$12M4{o?|>-zTkjNm$dy0a12ue-R# zd!shDmph$plqIJ>@D9w3&Cq{L#fy1L%*|%|r+g6)knZcd@qS(4YCVmB)KAqdx$@De z8!E&lQ9;ddhpTp9Uzop>9r80Jy7T6WUe5Kgk2J%?U2p8s?MyG9Qu|&Dq`La#yJGuI zl1DdgNwew_3w`oayHyuFoAdDD^>Asymsj3>Vs)Z0ysGnEWtjY={pm1eSUcwn3dxUe zZv{C~(dEe~ei1FWMkl>O#pn_;^VsCst;i6w9Iwxm5jpO|mc>*YpL%m;)yVfb-DnWk zjlz9$h=+*;NLxZ%+n;^A-q%rD$=!Ut@W<^5Vv0{X?YmAK8RV@`nwkJZX5`#QZkd#P=t#^O=i2nzmHn3|3}Mmg-yfK6zED=a&dQV!(bJu1 z7HdZTV(Xh^Kh?@Lny931tf_sa@x&XuCmvjNx0;v@;_N#Q-xF8ed-?DkiB*Ve`|*-) zgPWnG1JCx$?I-25!Xc+2DecgufnBDfXX4D+Q9PZ@KTO*3i{ZNo*GZ+r-z)rKbGoG$ zV%Bj-hHQbx^z)0iiLBT=jGrI>lv`vqqpOOYc;~0=$M*PfF1sn`ooC+@etmtG@RHqG z#q8B0|J$$+Z(La96XXi)3pg}5*RQNIrYfUZ#1is)ht!;CQ zbo;u`yS_2{l_~b=v3u#ek4Qff|%#@4Qz47=;cygE*Bws`$q4f!L z8x*94E`6xIu9d0=(mc?jF5U*Ul!+FyR;-jI7uP9m1x*!;f@ak-i&~Wkc_&I~4`Za2 z3X?|4hr0x|1eyip=)(mN0<3}u0qA3PzGbRt&rwxW#aNs9N5LG1zvwoF*MvgI zVYlzy=Dh7l_x&~cwRk?^wL}zels)Yptqymql`@~@1FHw)^pxLzr5~j&rwODs8|StB z1@4JuVN_~O)lX$jXX5q$z-qo?pKOaZJ4DY6XV@E?26PA6Etpn~0Nm50|AN#0qpj=+0(5%@oMceV6oZC^w7f8u zG!|>#<^`qNS(3ZXOn3RV;HjD8RV!5+hxkooO>!Nhm^W9q>XAFUe3=$!7AoiM+3Rh{ zi?<(*UxC{lKTWiMY>#ZGm9~`L2oen{`3?<=yAgQHnS`Cf`+g}i2dO<-0%;Tll;rfm zHjVM!Ip(Ur%=~{2yurLN{@{9_o8vjwdhDkQ9@CUUDQ_UZsxWVqTW>ZHxxtyF!&)KU zrU<6CMXf(jR`%+z`o^9t1&tTH(-%EUD>mq1v18h{_|nzG`E?`3%-wCL3|YgsGjEz@ z&jyc1t`~)jhVW)_R%GB=M>u!iFLwWRQBYd2zWitT!1Dx@^85e5w^+jenRRQ!T#1 z1#MqWKRr!>ufaFr_8S6ddwt=`tg7?jo7S?MVRbS340}Qp7_SvA$0rVoQ~SQiG+gp#G-|yNoW16g+NIhESTfq1OjlR)f z-_O2sz9)TteQ9{`&TOk^sd#R4MF%7=AiK8}b}G5Oy166q+b?H32m8Gv*d$G%V`Dem?qsy0lIqnw4l8w||W z&2mX7`Eu`z9vCCGJWjEUE1Bv3eJ4KKVRJ2kJSWB%{)2?C#66UA;{9GPkDsmbt~h_c z*PAd}#G%T0@!}}IbslkX_Hp{vYRzw}xSNx~6(gEtCWs-*cW|A%rW9GG| z7+i{M#q|o-ZrnxUx$C?wVchE6WpIN?vmYxyCp*~l)muOHE`-j>1`uQ}W{*fYh^`P3y_J*J@|xP5 z^)v)wu66H*vj=U)Jh~eByZy#?OMPQKM7zAUtp7yMQmEg~Krgw_#->paKSzcqqL!1N z^o{7BXV!@gZ)z}nH6po_!ecVyzTLPgj-T0+7~*^O{P}$VBNGvc^W2`i{`X%&+<(7a zH~RbS7UJ(WDmTCk09OCIgOAoOVK&jL;TxB4|D5@+2S4VJU4BL+O?&z8KWF~yL85=X z?|+>6za0F3+nE2-!hekU$Lt}=rJ{qbqF~ujs-hrSjHeLgzAeofUfHez`8_v^#!;*6 zqPFK+p^DF^j{RuFeI}TX)yFtagPXu|c)g~(PeUVl>{m?hoV4WdCD0-^HY#AQ;OM>! zG`SUDR^awabGtvgu4Jxl1DZ1V@^T5Kb%y+k*q&A7kYm5R9B?CVC4L!K%1!a~xBPm=1u^j?E^ zck(NQoG(AS7|3Z_TUD_zl(Dcy%sl^PqB(4_X>m5b$gTJH$2~bv_x+NU>abQY(tPh# zTW>N`k&4g4ekv6To+;!_gdw^3-k^jA+^#*4a}8WFXwS4JY>y*?Fu{P0z{m=NrgG!8 zx&2jbHZ2NAI|GF_jBiI7zk~>FL z@{cuJXMVCW`WR>XL%(z79^wIw(W0DOByUE~WkeiRTsPw4-%b4XI6GoMfr~qf4OklW zw3nW4^$O~T8eX-24>(X|O<=sp)Qf9GM8Bns@~1O6)YJ>t)8y1sR$MAn%ZEc{#cKpx zu1J>WHwo&&PcsS|nq0<3I*}8Gmp6#JX(X|djuN1AjNr;h5=D|e*5>k8J#9J_@>Aa; z2y>TH$=ttxziv}N|2#N;xiYnDVuJa2~j=R8lqiay%!B`OeeD01@KZhof9GT5X)zM}(O z0a=G=)I=6hR!a`lhLuU4c1FX(NJW*KSGAPlwAp(1HP@srl1LvXos^J(>`Z`lfK+lz znZYBAF(;iyDBCNF21i;>YwP@vOM}Cco|agYH7gY7^;zp-NkFtv-9n}qJL&;XK?|u_ z6I_{&FSrL0Iiv*PCK5LwB_&1jF~1QW7*JMGsm)|AEU=34*(qAySAP66{=m!&PlHtO z7~gH7$R;Bk4rRs-y|Rq)KM&dt-pmMZ^hSu+q&22iea*#kf8iGpDAq>x4-bC~BGoF- znFieZYatRtvZs{Z3;1LSxo?r+I3-jC#$vgoh?>#&B?U2fDwS2E&5waVR#o|CQp&Qy zBqvDj`PYq3-r4j-4|;~qTW`~n8(qd5|Nj4{(sl0kZqP^+2%l1X80?=_&7FiG`qMA+ z;34ij&K8pHKP?#GC?mx+G+((B{RG2NHtFu7Re?Sf((0GwJKEa8Oe;)_Oq5lrZ1|8o z_Q-A!cZ{e@;H9KJb>PC{cP7TZcg1tvUiDr-S~DYUQ= z`lS$wq`6XH`^T4%FY!``%5-!o}{2lXICxHYhgd7{i%0tFy*dLk8GrK4}aiP zp%8|HtLEqGD_=AyeGAAdf9&*H_Cn59&_7lakhPfF;-mWz-^KXRiD-+jCTckZlCQiG zO2Ulvk{jXqtB#e89~JMo0nuZlSfrTrCGw}iHY`Q(27e5GW7y&NEgFN>IW9Z;SajfT zPx4*2{uWG$2E`ZYsFzm~yP&58;|Xzis`b_V%5Obd`aA9*w9TP9TEfk^PYLVO#6G)( zwf>RpceT3Ob?(^X0F(aJjx%2qz5YQs*O|@Sy6A02e*VMh{QS3TM{sz)%m7(D=QdVpSRf_F~L}GsdJ2fRecOZ z!~hp@yp|GkBQ(^G_?1?edWsGZXj>n9Si1O8U&QTkA2qQw5Pv`R+;U3|`=L1;xE{z= zZF*nY1X3%fBK5Z5Kc~z~pLhwA;l^v7N)ADIGV(}^cj@Ah}j*RK4uI$8x693!My}Lt%2C%~ZM*hC*j3$~HRdZe#@v z+taM+l$LR->M4rAv_5J2YH1F1rEzc^Sl2%{*^;NH*RhSrncAq0f*lsn(h!>8YR*Xb zv&yZ}xM8jZvkSTGy^>OCDyvPQ4xtbX0Mb)wzJN{S&osdJ_-txb2i-o) zdMR8aL__7UaKUqj@;PTi&0)|VH+SImo*{YdN5r+QGA_k~_`^@<_l&K1KKw9LJ+?dE zD)xG8>-28;21lPbV&E#_vU>GxR`#%O>4pt^{$($8l}Ia~(fioeGaJ2c{YGvKZh+tL(b4gLCe`+Pcv7w8pe($`C^M}$ zC5w!#GjlEEivhkOWLBxq?>E*O*(?nMQlV(Mft?vx_rvBu6Ys)T=Q?c~cQ687zOV?I z9r-!2Ce=`6_k4iZljH;!w>2uk8&Tr(+-kj0R!NxYIZBE3_S&Pk8K7?GCn?QqF00O_ zca{!<^Ggn@nX0te8L}nsY0z~UphvH1E3y3Ph3p&)`Bl~4(b4Qpl58ks&+M%i)#(cn zh`e3a_eDKTW21w;1tnCC;!_w*z$3fvA*8%}KPEqHBqGY|uOaQR`d+fMPOm$(F|^eU z@kMWmNLb~iy|$-hTKQG<6pOC@KJ)e(Mit2Y=XUEWvQ|-U)fV`*(M$T zURZ>m3T=wzpL~HqI-^GzAe zzXrZ}X0~Q!<|CJJ+BB9);%lRxv_x4Xwvj^|0%g8YC-51JwCC!s zl4h7Y`_@mG>DMa9zylq_>NJw@LBkgJ6)YE5MT;LlE|__|#2-fWL`1@MaPeT=VK!T` z`ZUl=Se~umVUyDmejps%mLo`Gk(Ge-%afuJ*0P`iM<3+<0Qo-li84!Sa}&^L+A)bhdIT8*0@FTQau;ANiV z6{N3N7BU87wRr^{P?d+fQNobZ`iJ7etpYY|!aRY8l(vE_pe+r4rsmVxd7PrWg%DW^!lswRi<-WNvSv4FfJr#9~*MSJqo64t$5?y8hz07(*Xg zuNmb391p;+zVj}wf!975=5<0V`M=(`UjJar61bvzu{ki<<6l@GX!>^V8cUHC$9ak5 z{&qtv1ZJr-fVg+l?GYv@=XCjQ#bE>IP`SQ7k1eR^>>!_~^> zZ zL0jO)D!!X1OTuAXwMO&?3bj8qJUt>7XAzE%S*WPrIjlHj-DI(L2l1wo zS`qoum_>+|m`L2nfPz}=qvx%C&${{mH)HGfFY*+WAc{tew7$Zk>Nb26$H?$W10Bto z+S(WCV%};h!U_k{I_OyaTO(zy_~YT}Zk{=IH!aY93Zl|?YH5%0Um=&EtFxD|{EH zS!8pP?b4GP$?hueE$|&S+{ z6^zl%=Nv-dq==-E7V5pcF$${Rqzc7X+NecqjnNvi&=U@odv`!?O%^JGJp)SEPtOI$ zPfh?pt;ugE?YlBMrkvboux9MPwQdGIZBtBl>2`CJX|f$aU9%AP4Igo};fQX?>3~`|2M`Iu)LYv8j6HN&s2L zNFpZng~^@KcQ?YZ@$M)JvFE*NOB{}uV8WzZM*=pbuCfDdNjk{O7G@X1UG^jPGoa~m zP&eXxs+2wQuA(6P8<#USr+Qo&tXN|aJ)E@H@f~OjZ6?hM3;`1_H@O9;ouEP-q~sSH zt!^`o0H)`^}FSz97nY{p<_eZ-H%EW!_zkoIMlB^Ww0&DMeWCr z+*^Upx@q(#@igDL+8(MLy7y!=1*mxKK*ggabCIrzStdmtmxTFK$)<2o~mD? zQf-YZ2aM~kl#deT=qL~$E7>xIvYZN1?sINEQ;9_Pv9w}IqU-%QUTWQu0}=O*3XCO- zGpVNU2jvCn^u0C!dZwPY%@cGjR$XAv885GRA|dZY31F(czQnM7`H{OHQznl{=4HqY`$zN zcO5>fFZ4xKr55wM@u;BotAqi{%~e@>py4h}<9fSZXMFh3iRt;isq{hf#ZzCH#VZ)Q zY}48Pknws}!*VTUfFXXXf8^q8Eu~gh4iw^`oi$0bE-sfa?7eBRwZyf7D|NA}FJsYH ziix2Xz68U&tpHFfRAI^~>D5^WsTLX|ngJ3(P7}1+YqVORR?1>xqu4o>^1LDm<-5EZ z1|N%~hw1L|aT|))XfEA6YKV8al7pLe`(1Ws2|!sDcAZqGL}FaZ?gM;4QJtkm-&li%UbxFpIKuOG z^6DO+LpuOUwCb>i>H_^P5zb0&KS9n)Xb2^kj`lp79@+9XBAt=w&zQyPa`~*QV!+Us z@&R~TfofA1E*`trfT<*|_!V2C2{=w;+d_S8X7rdCnC1^-OUTYd>jZH>4C)zSay|AN^STP{O@$ zB3n~acCwmBuWh&XyvDlfHqlU|e^Ghw-w^_)Q&T!s+Jr$5z(}=#A*rT!$w#kuqBoF6 zu4p)X?Bz&oNyKgk-P0*yu7!tXj!j+JEka{QQfTma|Jd^0csM(`^1-@edPUfLk=->_ zs}~&dXfAVyMEZT~*PDW&5?d9epLdfFex3O^wgAgh_Pj{xc3ubli;c_&@NnoTcVlhM zQtURmK!$D1U;Fw|19!$~dLkKMU?637%KSrgekiwuII#ys{Jgl&!fQpJ3wVGQK>Z2gC1s%Sw8f^>Rt0Lzsoc-TThC`|)l z8$*?&V`^u#lx$42ctJ?`@Z{VHwEi`_iT07DyMwW0Cj*sg0PqC*01%QunSKh5Ma3r& zTgPSU`?PDvd-RR^fY&_?Vht)r>vXl#A1DcmR^@fn{mdwNV}f|DT~#|u@euB$=*Z>T z!+|15s+#kpfO&|BIFdSRy4QD00Uji-;z;cv0Pabur#U@m&j2j>T7aR3n~b7^ace?m zlBYYHtn9VNKZhMy1X8!h${dO;-8DyR% z2BJ(y$ZZ=-Gr@0mSO-Q$O>Rfg$Ox2S^kd0*lGc6-pu~_hE`AaZ_nF?O>RwX7|FETt zBFxd3(;EN%z(2%t2$ibcn1y)0%l5XHm#2<5*T5J=K1u(_Wa;I(w-8=Fw^eX=d+lR0 zI0O+j@|T?Sup8awXa8LJ-!rz#UrHu^6tWN*-SNd5t9(KXKF-#@d_|8w3qE6PrP8Nuz z#p##dmzZgXC=(v3g8WpWAnBEG>6;1tnqZ-bBIn>P&J~k zx_23_*JnvRcTZ;H0%z}2XP4pc4u;7!AAKJphzfXHyjSqu0BjV@G7Q({YY#x@?RO4y2h$_?r34r>b-a9G^SybG(B-lLs?HNmv7-466AOz~ z>p*>I7+m4d4mDgK_Vud^wVR#BRC2J@#hiQf&(P>~q$Tdl;3hEi25j(}cFw#o^SS$v zD_p8h)$lZe;zf?n+*C?JWl0Bci_OOQdKtJCb6pV%R9Y#5$7QPMsZ*)%Vp!Z zfyc|g0qC|OqWJg)QzfgL;==ce+U(K$84I%pFDDH)T73Y=?paS|U)KX_JvW6=*XuB9 z(KR;>@M~~aFb8W_GL0oblu_?;)9Fn{l+Xbb9I7;JQqSO9TH^E^&$H*seO_NOl2c98 z-rL%kn%g*h_;6$xV4C%zrQZiTr zfBop3YeM8#6xq%n#<*`T(9xyWn(ok{PN8Y3t)j*GR8IhmKGefG9cSFkNX-){qaxf5 zU;uZp_BiVM>$Mk&I$9ZNso`RR(CM5yg@AzXC7cVs?~Eti&*De#`P7oGO;t<3H{u~6 zxK~$c4N2NOaT*i3HMxo#JRz0v+BK@Rc|?`ty^A!kriG5qp+)jV*7*j`CV{Wy)A_CC#F<{=Q6g@w*V=Vx}2t~MO+S%A*excXdO zzN#%{dL!TG`q<$!Z+}u!d`5HiQFe>s+t)CFje31(hgs2;A(a4Bj5hg;;yFiKn<`9` z@c5?a@zT6+El)1cRx~Eu)YJcF<2_iZCj~G@rE?c;Bn0enLtvd-AL@^<%m$T7P1nKJ zR9@@0K|`h5!xkt1U8z&8J=hdx=)r7_ReD%h=MO#omEfwHKy)>H-0xhUT*p@>&Oy>i zyRWPdphdX7%tIE*;hUlMQq6>AC3y|7W%jxW_~h5us)%etojejR^L=3C5C~Wl&S~Z7 zQi3kF5b)fdDZ+K--WdtpK~F#~Q6)WUcg(Se9PDj~xRaV~@@Fn2pdxN_Ax~Dnl{Q@f z@EQg@v6ZFN7={ZV@y;jxIi7BqzL#+1g1vQAVA&M&2OR{+$_6udngOI7q%V?DA~4@S zC%aLPT4hMD9`B~#bq#gORjLh4XSMCJu++{pp9Oz^4Cqc9$6Di<8n(g@%?AhB&^kt? zw?lUkpl~J;Pl+QeSKtoTqndRRq^trg+6B~GzXV9>`(Wf7`|016zb5M2&Xtg4_FP=8 z>4NC8$cV!hHGpO)Hil*Sm3aMmfv;f1LaSYIxB%T6HZeAxQwE5Y#g1q|i7BHhZA0*Q=vm?qBYex`tHaZlVx2U;{kKRO;dS7GC zZLB^4Sbmgpd0k0eN5S_@cbk&)hlzj<#8Ty4RVSBn^P@FM5zoAP0up0Sa?lBS;Y}kE zI|22D(PWK`)KY-TTGjRphRNw@%t5FXkWt_P;2N+%6%S@eF?jH zlew9%9j&qS49Uzh`5^PllZrz0=#)rt7Jh9Gb|D4<(zw;>NYukl;FgyH8qod=f>HqI zMLX~7tFL&Q&0RRd=HMQR>~4MEYp7c~0H=Yj)lUSjOl>_opncS81n1|F)H}`5d{?K< z#C;C3)Ij-H~1;RI6KWr-@lDe&l=CzSo}=DOLBd zXP|HO)#cp5=OW1#HJ7xml?sINRV{8ncr-L)EJ@FYnW&8SZ-%Ehz6MiDktJVDSDV_i zi9tup!x~d<)FgJM1P%GBtAi`#t@R+YY}~30a|3gQX-v%M`94?xm!|<|)Sq83;ZOPB z3T;zn@gl<2*14gOZpR8Ca$--Ll~oLDEUTiYRRbXLlqxIs0}O=Idx{6&SK!sc$OVzy*9GMP%k+W`$; zEy*^Pb<8bC8f|qD{g~t{a7i!sk1>!&0nF%5ItACP+Z*eQZ^G(vIbx2zzqtoC-U^%0 zP3#U-oR4WqFqCtz*w7VWk>g=*w@VGm-q6u`IHGclG~0yR3?Uv9rNu|f=CqEr_J#@p zt5N>bS!9j=-1~LI!-YQMRZ99o=SSyT*EW14m?0elBOU-%1Gg2=l34q7yiwC?ln+U* zrTV)OcqNW0>=SA9rvDMP65cxku*dp0L23NX?cJKhO5U$;nZAESk1p9=J!8*|3>R%w zISqzi_sT7NQajQitf0uQGh*uA@sWZcCIIksYl}}s))$9{3V&&qQ{{z03HX{W(t)S% z*k==Vf9GO9tBr`qNB1l#b=Lm^;Y5Y?G3WTtJwgIt|J#C^0r%-_>xw zl@+J4uwd49P3Msh~hWIzX7o?-Wl1D%?!+YTB+?_oQa z`2EB^2o?hA0HQ`^mu41sb759rP_4=0iFy3XzirIpQ|4J-$L6q0&Nke8%Hh>)p|bVf zx8Am(PEw^@_Dk3Kml4tN2JnuW{%nu7^|vJje4O4;x6$07c0{t%x8vWrXO_xlrNtk; zoq=#gN$&Ty#~%32xEl@v1q5gg2s4S1E979C#*QU3N7y>&k59LOg(1tUq@2EQ%LS{Ui;@gXI3!?ps{zSZgRo-HQBcp_X`UtO?AQ%UZ@IRDd;Z zyi)g`dA_&iO`G*H&JPFK6%^Qg@g!0e+Lw_Yse;7Mfji`A5YGY(i=f1QcbfvdU#cJq zkZfqn=STLf!C_r*%&jbP`*60_#j)DT_);<}m(7)PV zE!DZWS04XHU18x~SYi)WiH_;D_2-Z+adNI4!C9j?SRYmbH@n1&O?71zm=TNt#YW3= zNaFtZ3Qsm}66e{f2NMmer0SSaHjf_TO|T}FpRxia#btj0Yb>LIA54^DunOh6*HDhG&0@r_(HS)bUgbJ9F5xsuGe49f3bZttah~X5q zNwrp?pxW0MCHyR}bA(J75GZ&nU5A0N$FzXpf3+Ln7v0wPyd|FKC$?s3YjiHZ)fz|| z|7g5D=wXUw9jBJD2A4s}Hoz-sOr(v}2a}^*z;n*-oSzf&b-1|tIZhDm3GCD|x2~DC zKPCYT@d^tDqT2D4H7%%|YB4bC{CMj}3cS`yJKd%2)ONgacp4`ryeU>=I-lAjD@wVJ zHXJb?pZGNlbS_)JWUb2Q=x3YYhn|hhDP=ZePkb5rRx3U?*siHaG%NJ2KSd;+PO}tQ zv=R}6Tn^oUJ0-7zvCYG+pGjRJpWXJ1l)5Te9-q{VvkBa=; zq~u!x7nA;qeQK(TDIAhV&Y9akZe=&zud_qu;!X+@FWIAyIR@IVUx)3etQ8SNE)4dE z*xDRo$3_1*0+{^k-gviv0{|GDwv=kBe8vpxlw4yZLTJy<9RV++$U9Xv5%XCH13JR% zV?O7RpG{PBa!s|<8>K3S#-{?|Ih9TexWG1o>uNDRV3be%+j3FhAqVJJiuL4*tiqrP zPl~Ey319-ym|=2M%;&E#UV}>kb)Aebe{`}pU!T=*pS41!f3TgM$3eBi|V9 zVBN)0Rnni{1iq!SGVwRB`U_7Z-^RiGljI=|!Or#Ehdrp;LcO+3^yYuKFJ z%D?G#DU^py@e&a~TFW=!HfESR7)$zd*BlGruDXZfY?s|gWu1Vk%Ft-bCn(h-<_aT# zlJ8eL#}T{Tp7DC5t67@b`a6!|)A<#+?UC0@p!1w*xaSXGAQf{y_U5sQ**$&5umfw} zos<|b^OXN0Zu?$}!oKxnsj0m%n*rdvfHvo8e)qDk*f?T=umQaGh2Pqi$UWi-15Qew zhct9zR=YmA-WgcH!vfDwwN+HV9dBVRTurK;P1h>_=N?Ozrlkf5cn@>#1t52if%Sq! zHpqPbIK{+sXb;VJby7d=z8IfeVnT58E!M0#k(Buih&DE<&e-=(ze?>D`WhVm z^JyK@&<7{Sgxx7(Q?zXOs|#Q?oJU`LwdsCz5x|(1NHA*kGM95_n_g|o5rFRS!!lU! zrSa7&H5CSo4p^j9Ft&MVT9@Bv1bW0p$7|Pk0qPw9iD_BQUR$k5oep_DU#!M|(4Gz= zC76Y?(`Fq&WlbKxT12sNvTiF2$4_U7)ZqciqZh}$S9sfD(PXbpO&h4olSM{LeB2-2 zj9cPFY~nK7TJ37Ojz7&jw3h;4Q*N0^wLFT0%$S+GmIBF0ovqQ8RG@VkAlGMImOfa) z-L^TGPV0G=T5T4bEPn zU24eXbSKsA*C69kZC-Eh_u*Og^xU&vPDQ_PZFunD^EqR>5NzWB*f;=>A_<{DJ38oB5|t8 zUhoQy?te)#=HC{b)OY?H(=A_8l$;m(lD`H?B0fhpFlVQIO#)t7srKeJ+gR(3#rIog zj+bC!svZ6uha)q)tFhh5Ivc0d%AE4y!v||e`}Oyl1AVhS-LnxgPgBxUn3?DpvNM=c z5&>Q&nebwKaH^vR-TNIqIypG?qq8-7kD$f$Ph9*xKmPHkg7WocLi^82^8ZUz`oEIy z|8|1?-yZx|wc-CWW9|PtRQms+^6>wdN^j@y{-*NhIcW={|5-;2(LDVp_m&CzVeT_y z!=D7N$02b|2|DfyLT^g`f>>sewQz-0)>Kh^yAQv1v;9edB8Yv;wI?ktolDg*I@A9-n>q7_Nz}L2-;|y6CM|-c z0G*}SR0?pE_@(%#=67qDSEls!8bqd!d=T{X^lPmlKv0g5ut%`dc^@AGu{@i(mAO@> z_?$~`QUqwx;vyTW)ZwL|S}7?O38esJ*Qnv?9@+mq#;kb6fmy*=NqQBZD_MWg9hfOw zJnZNqd}lb!yd$GbHx-&=pby~S)IFr=W4XPXlGLYm@-Yr^z(7k z+E8~3!0h=?332f9Un{;<#2x-N&;;R}vLtnS{}PKp!)4Tep~vIm!V|<9K^=mI4Sv%< zRg+5!4Ij&Cdko^Z!cW_FFNc29i~|6zfOqHO>~!S^7-(C~0RCNeUQYl(9Kc2)%7*$Y zE)<9Qxw|PFd{#*y2XEi?-Dd$^wGHe5*hdq7*wh4& z<7-;gQ8LDBp`X4(7(Ay1%8_NQsul(<1H^+4;#AKS!TRF62^LWo!sVu!^tjU+SC^DB zsmemH=&=vL0OG2QL!gwcUBtkZ#dxITiNz0E$LMDusEvxu(>yKyGqmh#_o2P!Vd#8p zWT5}|UJSG9^QvQkKZa8PsOSxhBYlj3+r7xM>SH@b15++-KDJ}6nmS<^Y6Go zckjXkSW;9ld^9tgXBu(((_(g>n_I;GY=)(6(7W+xc@Z#pcIMx=0FWv?r&fjlD92_7 z?ud%ySt$W6TQ!dqx5(D`0kLK4SbARUMb5PP?)Z)z*<<=siO`dJfE~$lF#iph#;@b} zHc-l-`=WQfWCv+QP`U!7lUKJMmxr6^Re{QXItBb}(oFM5@<~IM*|` z6#E1M$`Zh!8>NjSokdg#E%e9Uq>q_amYF01mprtZ&qiX1gV-py40E4qUG^e?J!?Wc z@`-0FpP9IdV%7?ent*W)z^{*;c26pss-mpoTwSZVXznBVq>kMaz;Chy%PX4iI7*u? z0Qyy{aii>cEx^74XiDYbOvz7F`W_O2*<%IMb(YE*P-Y|dhp~*^?v#jN#C7*u`#NV5 z7S<_154$8~_$07nYc1r&t^JY%IoFg1=nsia2Ri@{00Da_gldM09ecez^+6|`*43Pb zCKBMU<{B9GUa-~c`DX*Yz-ETw;}9S{GJCSA?0icxaXPZI1_%wRywiYEovYQ8I|`8a>;ne+{vatb|vq`7C$_ZuRyKex2V#e=`Qwgk54_ zxc$9TiY2g9#_4S`#_%Syjjz1^Q{U24BjZnQw(V`DL0nBr^gHF^GyoLP=7G0Si3^jH zGiq{gEBADlNZ!;z!Zp=q306#TMf54(Sp5|19q!a(K-r zX_3I(#7GlqQ`0{v11njFZWhR-7C(O1=@R$&?HQA|0UV*OmR}@QUan(|Ho5Kev=*|O zH8gb5*l_gVbFu9mbwHVF&Ejs&Di07e0%kV^Rcsh&=zPUEq^szF91p0YhEbmpz*zA+ zw;%xe)i-H&wn(w(vNluQSs}cG3NQ7}(`3Lr-gp8SH z&6FR&pyUI9jI^C>pF^ZkE%u`fO6VvL2m1Lx38{;k&8%DFp zf$wU2p3i|QdXl*|{J9t~H_L&-UEBze{|xlMQQyDM1n?RUQPeu!0GbP(i=~lS#$c3q zr2M$YW;RDe8^orMQEni@)nuo$Hb#Ij0?kgABNFU4!dlZ}mo3h2CVAAX)nAt&O$r*7 z^#79Sy1A&*DH}r&r#>}8;!ipb6s`%@+iU_V9xjAZ)5nip(LFM6Uhj*>TZ5+4F@W*} zR*uK*c5O}F?=pHohgIfd7C&3xX#t0ef#=$-rv5n0rOD>2(Y;!0YV+X0a6bO&yL5U0 z5(am+OcbaFPW!3P-oFvtB*1VX;|sYGvg~R;n9g@JyMqpqlY9F#HlxvJ!|qK8RUV-B zM#iz(h;qJs@GwvJGnLtTctyiY-6AUsCD-YP`X{a6gxNmfr&1>t=30K$XM=FxcO;K* zx{>+;x;6Y7V+dH?#K)>n&LBJ(lnnwT%lraA~Clg!5ABY zz7h%0{pVne2P$0LaMOf&(g-dc0AwB@ImF}H=DpA27dOs+Gyx+;jU<`V*o`U$52m(S z@HFq^p8!8zY7ee*nO5)QTUDVe`}G$<=ERK}i#fAz{)BY9{y5w1DbQz%VpE6~t*D7VIasGbEYZy(3k5Ph2Er*0aVc? zK)_I1ZSBw#B>KKDlXttOCe~+%O(pmw3-M6W=Wy|hfjZ(j_E+P^UR1zVV!uh91!0cA zmv}#THLSH}EiWwM2>6MU1b|o~`?^Z2nOEMO?|ZUiINk*Bhsk%{G--m^NL zf3p(+S31MA*p{6ObrpI5Ti4JM_5hUH)d2#ehU5ME0YGb4_bsuQD3dQOij(;aOthxX zmz}$w@@}Os{)AKl0wIW?!B%9|y0?V|D33n8O5d(i0fF?_*l{1~5@UW)UYs_$fV^Z( zIo-`}0V}BV^$yZW;dQtYe3N#VN*;;D8POl1>jA*II3c+>%Zy5vP#17INgPV%JUAQ& zqpO`1~Vi>fh1~d-I4Y;3|YSW=xI`d^u$`fo-v4QXeBp;*#1!#p3>`al% zx6x3hqGu2ZG7b1!k7c0kR#Y4SFm&++08nB)MK93gZ$Ho)@0=3_#1_CuM)hWE zZ*Xb{o~Hrj>Jaj_?X}?S!|nse)s6o~-Ft;Ky+vKWy4`juN>KqpRHO+=m#!!xAiW6) zD7{B|4;GXyRiyVCdWTQ~1QqE$5PCrAgeJWPzRBL-`<}aVb#Bhpezp(BB&`2hbB;O2 zZ_PU_7>s`M{_f92=s4T8wb1CiDXV)=kCwnX()NE zaM(nF*C3VhM?daX7IwQn{-tM}74&A-?hoJ~;wX^^LoYr;oXJDhV+r20!srvQ)O=0S zC!3>&D$dMYpG#EIbp3m&|MrD|K=1A9x;mt1c;EZg<7ASd6RTdXJ!xe3-ww-Hrtxrf zrKdUiiOd5h=OXrECL3_nXmmC65CS#QD?$9aL>$d?Au~s@`pP!8BF^B~`^PYv9)&Py z$94SUxf+`&vfePpSWo?uLwQIu3O!#g2PIcHkxkeeO^G zYYU4vQ!ldw+y<|{jD?SIxUBbF3StR7E#ooz$w{H_e#hiiAPp*%S4pBw9>--k z4&O-OGj{Vvg~ZE6&vNoC{rc%gE=tdygd1I0R^Yfw2cgFr@#GJbsYOL^V6v~q8>#yR zv@vSY_LclBerlNrH?X+qYUE!*@+_;o`DbE>>3Y}$__bZ<5ys#Utq&#^awI3y2ryj1Ba5`I4rayjUw7st;hus_xQohID za+fTbO}Os3yC$gfvxHLT`twXA4&Ub1PMzx6J~(fD`!BZOvK!%KreS@YSU_$|HxN_j z6p)+Np+FjzYua9n9}Nj;l*<8Wm6TVkw$B8!vvNhE%^=gkw7;!CQxTMCf*mH^g^$C8 zpKgBHUcWw)*%9Bc0N4O-zvCxL(~qN3_$$&cR+#PedtWHV#z|;})e5lcjJA9bH}S@w zaUs{OaVbolKOX8Bl8Q+%O7*3L@;EAQoF^f#%d5Cz<2&exOJf|rO2>sbk#*WO5`1}{ z7nkyT?s2tCdfUz|G9C6fwYax^cZ3oID_9;?bJEdkRafQ4h$e?^0c@xT2Y=mmUdpx2 zzeiic>-BQAC-JaiE{P`TdEc0&j-CFh{4Yq3v5Cr(L2iuE>1f#A3&xr(E+4?3uj+Y2 zpCb&Dr{(Y_p+(0H_Qp=GvEIdyr z?}<<9SI~T;OLrBz3*=^h7KkP3tL+Chqtx`w9Fn_EyS0`gjKO8cN`?kvcXJRu2WV%8|$C0iVERb#KQ*|dqTZj zR2oFQtM58%6kdmH0CH`_Y##GlR{hNB{>`sECM(&wYV~~-NZsuLbM-)hjVibOhOtwk zXNb5k4f(t96vpr^_7rSvyIlOUxnoK=yq@OSI=K<~cs6~OVt&}GwVPXwrenguPWH~#OlP*RaClx&=w%GF4`!TQM=kwQIN;^=^)e2_OXX;{nZ z6^$b)q%^V1XLr6AxIR!vfb&svW67FDs`li+St|eEUTHM;3g=dL7wR=jztmO4^+`D3 z%Z+vES}!mMULr%i3s`>2`fNMy8huC1gI`b|O*d_Wn8Km^J|-?EXUSEdNd47#Dw8;> zKmRL?Zb}V^xf}f5FqIF>*X+5d%u#!10$HQ6e!sw{`igRMdMSe=e=ov3c$H1^R=~S= zU=MJF!@!pk)@$(mde-laiBxUD)m)JUl%%|r4VVtWX14jJIO?m_XU`ntFGn@(AJBmp z(MRoQX8yW5`UEyYSY)W?;=P}kSZeHGpzvvq2=+R1iwVj03icH1++Wak=IA%M_bWc;==dke&N>sGrn?5)N zvMPDP!}9TEso}ZzOSFqIq1$&i!h8&M&-CR?&gbmxBVT^430cMVhCF={!;8s0*icQe z)Gvf7`Fx4uU9$Om36kz)*)-_cpIN@d?x#Cw_IB96TJ^po^?6YPSMhDMT|8KftBPc8D}~qEJ+Sqs-7J*DB;^LXzCrKQoWjX~n*7(+3x4_C^7;9EZ93 zF#80j2WllDF0Dgd{Q3Or>+2anZ3U*Syru@nV!0uE>f9D=S4Q6>0drqA3YLuXS9B3%^@SOf!^cWSUkg zE0|sAbkTxmApU-G{daz5v0#0T8_c&sK^=k0u8mj_EM%qb>+-sR$8$tiH@q?erjnD5 z3D?}Kze8kkpoj7@3x(sF*43_pZKE*k!KA(RRNsX2Z3wAfMT}}sB+TbNIIL~#7*As-{|R#pQg;Nu6xokxrRDBh1C&88}%(Yz~s=MZ&kg{@*V|91iI1ClQ1L^~Z z?zg9ncc2Thg1wadoikKh7K?`JQSOGV)*%`XyMw|rJTL2>%~jvvzof1$GNav_ui=~n zy~1Bso^05BS)S1c;E;g*xk8J~qug!|Fn~ZCWwUz3!L*|-$M1ZbFI>jS%irk^BBd%U z0QFG^lqlIweQlGq|J@pBUO(y5^2dRgcG!;pW46hpA0z6r`bi)*>fqLly2$f+7ajR7 zb!tM_`x6gU()3dL4mqqtzr6hMtD=Lr?SJ`q# zR-cH}H)C~AYUUg9m6&s?3WSF{mD~#QeGNYQYQ>h)nJ1$mVQY!Yuh}u-Op3ilPh(%` zXez*(_E_oKjfBe1A14EFD!i&J`Z(@;)OrA2ktsABsr|Xh%PX|Efo7JU ztxTeI-tC?G7Go_>vaG*l3@)16q_E*qxqe!FqxBVyaZj-Csnt7wWI7s4+y4>=7I(Gk zX*v%6?B*(wVU6yqtqo&Om!5KaXmotW7Kero=P2ku9qr+xNq?XDY3Y@b%}XpociHbY zdbxomg18G}A#NPblxU7zAtb=9li6)*t38RyW)ak3@dt}zc6;y4(^EvTk)mQq3Qj&>f^S_2{{dk_uDnr|jxCcJS zoG!^FI!+cUv_`JuQeIg{sw8-z5cCxCtZAUgdH%Vtog>ZAQ>v+XgM%sk;7fd>j>-#* zEWKI&U5o3J`%$Cc8-M2SsKIuH-0F;Nl{vA0&F9J%f?Ybrzpr^b8n8vj&qL|$(2 zYgT(Mt(Q~b`6VH(%{6nhPGwj*8*&#>TO$dYdla|)g)iVIzkJ;cFHc-HR2G&UVa)%_ zmweMW)h%}uN*FkA6$qbc267sae;hxn&qqRysMe6*)fKVGA*W=Q*ez7InuagX!si7} zKcPkkMhlz1@$1#DV3g!Z>bHOlu4>yOGK zgBei-K2f{K3;NPJ7x05vTblaGW04W|97E-(+~3=%PeN${6$l>=zihRhNorJ?`6EE9 zRVo}8)z}c}Rfv>DBojC!fiFK26GM14E&>qkAaC~cS?*2L0+>eu9 zJ=M*Z>;e`Oha(H2$QfuV4XbCvDUI-TO=rLh_y8FceciqlTq;uDqyKklinU9EM%f$C zWrjV8$0lLlJfRhjCuMAPXXH_$hfO~-D=j4t4eM^`5658I;A}KKPotU@EBq&WekRMU zT2M^6J?6nfy4-9~cY7xuCrCuphj*vMs9jf9l^4G_@#H#C+Z<$a_3Kd<=YmwY2Gk3E z$9rpQ!vqd}!L91ev>n5f_9Xc1Pxli<=2X#xHs*gTW}j z-}N#qR+VfS*WNiS-PFuMCbhm@5GL(-u|g)-l{G`$s%pvv!6m3C>UQ@@Z!Qd(QN6d9 z;6LMg#IB(I4~65O6L(fiJc}EK4O)2yFEU$UMCA1&(s}Q*01hfv)Tc^~zYP)(5Ym6X zX9Dj&nk4U|I9X^x=THjbLFz{71(6}$UC*j)Qf6PGEn%z|6Nnyx602C|_N#!@GY;#K zHut(y?#r#8II3Mw&&a+9y@b56tMTJ)IEc0<^2|W6B``-&ofIQ@OaLN1sKFsI6=|_{82G5a=EB&!x`CYVk>D~ zIb26FLZqlUin+~f*PD^<`^-ne^P31iw8ZLF;??#VmAPp<@S@G)xwLms*v_~wa=2Re zJhKs%dc@v1lHYLyX1!UYievxyY7jhxW$`Y}wW3*JxIHEjSJHNBl>mB9Przw*Q>kUKX`gn14X=ZTT zdK)-5!gs@1S`+0w15l=-r}b~Ru;korCk+w`>A zt<-W|7Im`QL5ay(QdfDwMtfAMZRI$}_+; zu#as#A2F$SzpfiP~Vb?r7B@Q^RW}}feSrYA+Sa~t)dF~^q^J0(krg-1&n&z zs7CHhm-v=Yb8ta4f%Qg3rZ-j^lbk*LWGQopSD1hc)YSCdQQ$IO*6~PS) zqAn;|KqhG7>|m{cx8QNMA6b;yX^4fP&93D#Os5gZ-AnMERiQvms(eZ#Fvy%ZyV>T)jm3)El=Jl=+- z>%PP*zQj5Zx8b@yDaCg$S`JmUROg+|Q6G4t#3B1ldg60xX|?d`>VC zFE6Sc2iDfXpBg%aKm3voFz&F*BW4wo2KzmW4fV1SOYjuD3?;k9?OW-xaM;%s3H%`w z(^;>LwolE2cbK0%dh|PbC;&=9M<{K>424@VFNr`hL7eeHvMwyG-JeqMqH=TxcW-lg z!myxh`}7yxBSskXK+;JDolni7E0D#am{|s{Ol2hD4n-K~!u)l+3Ra%GVAD5cs@ZnY z_%XQcBk8!=-+1afczVAuX?!S@98OFu;aS;99eOhPwYRa|;GUEf4K?jy?ZVW?X&(zI zx@U_0M}r=Bm|66l#ZRYTbyP0STL{gEndZ92e;IHytakQ+h}J;B-Q-x3gAeLFlGCF! z-21#KyT)+gWOa|9 zKS9}L#zZ&{sO?krd+%bPx9fYYUjTlkbNYUrpBP2yb(?zeP4(>iua|eb#c(WM%s<~> zuSZif3SfOaWy~%H1m4)|OpUb*Ry?qVHbp)g`rE$hxl1k0&41SC>!GMBO%0mx&zFVs z8P{F$lkOU|9G*^X= z&fR?%YBId!mk`R-;-t)tZP-;H%uF;f_lBjP#FJ4aHUdl@uLqXD6qpWD2Y*0pb`-f` z1luBD&Hi}WukHH7uqb4ifLZ*Qo)P!>h+L5-td>i+*0YC509mvcUGl)4_c_Myn#R#; zd`mw4F8TcM^B$xiEV#AII&i?^3#SufNPpHkny*M;|VDq+;g?R~PmxqoUu;)QCQ8etL@lm``yN5)5cy zr;9rB-SMpALi)rzqjNlb9`0J|sQd6pJhieV8al2n+OO%hDhS`+PQY?VF*A(-Mw{bq+k_dR}l}Q9S3MPrGTXJQ-s44ZMgv}#>$#M zBVp8pAE+DhR#li+jdr$PwfhHdP7J z1O|8o?DQ`Y_CUeSZMwni!7uONxrm||%)RFR8*(D^Znx?fb3C5k7%J72(20Rz7qs6k z9)F5{ZrW&#&o*rvsEHmj)xLS0=wKeWyt~)Ts0?+V_j!-2IahoXKe-~<_nGa|ENO?1 zr?%7os_B+p?*&LFTJ*GA#8!Y&EIQZfdFwOol1k05pv&MJr%vXJ%mBb*+bPk!JsSu0 zqgc$n9NC4p_$1|sBy#`M;Iz6LDFZZZCv-p!O;oI8%XzWiiEfxqkL)fUrspcL4-3oc zY0mU-M$+93n(x)EQyhSF9)`y-Nj$xjsH~Kki~)%^4r2Sot^UrIsz-&p>JY)qh*cdC zSR)bhRgaT1lb6;KV)2AM(g;({+WR_8GNVS9=a6h6_DJ5xxPv|uMs_|tZnmJ^T17!d zpEpl00F==sLV0M$Xnr3@p?|+1(|BF2z}DyZRQghr7a_EmMV0K#cs47`$ghbkzV|th zxHOjt(83|65O9zP!AKr$o2x8=y)y?*nPI@iOfFji$B21t-|W7QF^Ud>FQt{hs$hH^ z@#R5%xL3IU+-9|6*g~~&OOUdF5p^Kq+d#`r9%!@)+*FO?=)1TiH zBHLqbCfR8;(;XD1pKyaXR4 z8CYw&4-=yHqO}F_YK(jEW8kKp(!(Fq9S-cvD-NeWtOCv`SwKJkza%USD8M=xLadx- zi3B1mjkEa{P!KpJ6CXhABIoQ8@ci~Bf_}?acQrS^X)WR&ujPNb`3+z|-=qwmFK{d@ zWxJFf!6H?gyqWEnv&HkuSgOm}5G!d}w6;3lk4uH-$;XG+79tlpC!g0LR4j!RhN6-U zQ*w;d9NN$)6PQ?uCw13%kA<`~RQG=pK+au?rCX%s=hyo`GRL0O5IXa*%O=Sm^m_0K zf=~+M19(YiUL5{{GzB^2r+Q@kWUqQ!U%f$Y0rFbvq`De^iA{cvrfUfo{x_I=?u!VPs!$K> z=|yfivIigatg?%^?}9fI#-tp0Gxo{jgC%jkK0Nq;JU(}h2oQmHE<)dnnm-T9*?%Dh zH^#mHe-iWmzXjv`zlAOi9|!(>8^JgJslBDS1=myrAs`@7E>J;ULB69IVs$MYRMK!F z>qW;5>u5Wcl&-xg-ga??X`60l1}8n)k>Ht+fO9^MiX`&^azWIKdt(Y!1m0y+Nw*g{ z1IPXWjjn2$hxsmw2SDu|ivI7jxy1%UuxWCx;n-6m0YaK{?WmV{yoCOZmy7vJHaR-6 zaX@Ik$n4;-jw>w*Q{w~T7Z@(Vk75w;kAI+CxWNc>cO97DZRrPI*T4Vw7ye6b#9?l9 zn2`BnrGee9+-_Qs{cr{!*fd4Yc!o)9Wz2b^gwn|CXbW`6Z^8e;uO8~4GR$v?_>iC}^`!(UZhkyv zp32}IKr8EBU=`2xKp`M3yIp2>;nshjVr~if68C=mhzv{nd)Y>K7JqWnx=JbnUwOp^ zG4?eGW-Wg$cy!PWWMaZ@RG;~8P3@(R-e}?my^$^1B}h4w%$=_z;^T~2d+F8uTBmip zw}>DLgL&ot)BmER-m=*SOvBXvsu$NSfHVL=@3~@N(jLe3)J(^L*(TUm;2-c7H@$Bg zy}HO}LIq3egz^}~O96oJcVB_3oLT|pkG`L7Ff)aiPNBeMx#Oyeu;JinqdO2lD4hB;)Ll6xFmDE8Z>|>aZU`cbZ2tqq zU3@9~@$J>+Sw~(zgT`0wp0K8~9WD=GRLmoE1CnVOalgWK`|t{)>EBIeBi--BF=E7F1aq2j6^ zcsv}LoQ@>C4gm<#Fs^uD1qOH36LH*Y$dmhtiLr*-=mRWR8 z%7*8UUUx7yjBDmbZ`qCf6LcoL6}%hpOz&2Tk#TR(_?y6c;m&LnH zji#Lh`naXg>xX9-tTZ>>((q!8vJb#vSJAj((!?qEyyZpdLb}s>kg9}NR>vuShPpTW zfX>A1u7-avBc44G-Vckqex<>^a&X&fJrMnA4xiBj{Wts(Jg~LUH7v@XJCnvC3nhBu z{q2FNvUVKyKD(eJIpuBxW$tZ2ete5t+wFHeluWZL-jDFNaY^EO$8%j|Ay5E zAuM$9L~@x6LoJ){9P}=wm23WZEw8^p6zxo%2pd1#D+K*Yt(M57<4Zr1saP*6IJh9M zhAV|()?I&()J|koUCO(Yai>)tIEyUqC0I0!pF~SM-L~ogM%J7?26gQk8us3g_~Dt_zxTwo?@H0M;~}`hbLkv;l6^-=H?>*?Bb2C_P(D(V;G1afbA!5 z$L;Gu%)(ZDzjyJ%wj^?GwB;1=3kIj9P5I6@+~1b|2e$bIya4q+sRwc%FG!U@N~eoRgHBT%nRzGw}g>R6+?13fv(}3sEmrr90q8mI3=~ zBAlmpk@?AODP?8tvs)E8pwk1piyEv&k3U3Zub%Pe&oxSY@M&;F!&s8}#M?1Q<+J!& zXpLu1sM*O3EO2NUtUfyN-fq`IcR+y}@x{j2vY_pvXBqjgQH}6EN>jkR!L14Tdy>nW z-lIe0C*GD+BE>}4zdwekKBtdcWfM2njac;_m9NHB zy}p!C#lkQDFE49>oXPBLW+w;T83;Jj_;_MO|HiM=#uhGt`r{VfqIWur{A?{S6R!zgb`abYU1C>rng8meS`y*onp8 z@GQ5>sztv6QT*eA>(8`;LuX(QuCHA@X7T@NNAKIWtg_E@Z}r1#1rgm`E^Q3ddfE=T znxeR_M672y0MnOLd578e-Tk@o;_Twk*PyAkw7rIB5(;ZAd=9od#S&~Jy9$ir?F8oo zT!$Dhzyv_{WU#%b&tL-t6GD!vEx$U|g*R2yuT*EwXFa~1s$_7X+FkfAH~Z4}`j;!j z;IU;T1AIbkf4-%u>YCR()6uqvEEh1YsUIn!vf~h#=J=XFVRqV-fHANGAI-oDrPHHs zF4oJct7~!Ov0|&B`T{n2jBLO2pNaL=L^h(*{r?~y$2VJe^@4Oim+{_rd569#76gI~o-|!8z_1hlLXqdI|xs9usS6 zd3}cZvvy2&9k~gC)YA8KORKfxo)(g=fLUOB$oevb4}g`E;c<>u8X~EH8K{nw!-e$RQ1@GQyi)E<*hXk;uibl@ZY zme9Qf#F4g`tQu-Gf>;4@uyGUhooA;VKz4`oR*8N{u{RZ1iT``VLQ3S=x-e35`zg5f zp$G%2nb zqwQu2F@IKsl*jkc_6;}yK!iv=5rsMtMIcp9?J88TZ3v@^`65Hs zR*ps0qG_^Pl{1ghx!>wzh7zc7&W2(CHjE@==fqEtVoq|1q*Xc2O6G54>5xZL)3WA5 zU{AmZ6c)07Y1gk|&bBzC5BpyVAvV{0rs~T`@706LUR=^`aS(E|6{Q@-*xwN24AMD< zBc&M%6&!3^09H6-*2GLo+(}44;8u<;l@!YQ2(Azr34W<^05=5nV?rBM&$`^GbCO!_ ziRtgQ>)_JlMkv(RYULZn#zh^q6vjbABFMEgLx`4OEfC0G$Tt&=vsx0I$S<#}HVQxn5A8;y%&!W(Gl2ltXgbXZ)xXyMsTQ!sprt>12Gu zQePsnfi)8$;k4Xyxu3AxJ=6_(%K-iTqGGQUV|7BC!A@=*fMYQaZk`Bvt6jY)2gI2(PP3=Y7C$u07uRHsN z>Z{dS>oO`bASC_W1F*+a6&@1R`5m=7>__Qe+jaM z7Mb~lH#+3yXzR){YhtG9#}UER^-U*L`f_2$2V&qvpYx?osd`ER)(X|tdQ4eXq0mC4 zDbJ~hZXg3ef)2*;c?^DmJ>d=`0_#-L3}W8;dxrMPRnI!yinjY`I0JGBdOgCF?^UDP zrad$u|OsSYeYfIPKwtcJ`^TesH_4FgEyf=9ftOcHh}dF22FCC}9lNq{%B5ao{sB9gOb zK*EUYd|8mGd<~9R>xeJlf zj*8WNfjUy)bu%{O!Rpt;KUNP#D$q!DWvp{5OAkr{IOFgvXP=pwV?<*YM36%~R+_SQ!mlW(eiqvR zGgzJ71CAzf`ijLVxi;j=nh2%PJ=mi9r&r0R%0p%4h#qVm;YFEQg_B3E)kyJOq@dnhzmUy~3fhxc#=DJ; zkVd7|?C{@8djWpLnUZ7nZZ<;f>RIdgd+zmEe)xiK+O9*UYV5H7xqhrX?Ch|6j}G** zaEi%ppNR*h>>`qf))2hqfq%n z&T0lt7ItQ$z)WdGLY`(A?606W`aO931UaKXS~?-%|mUEkJy zLEg@ewsDBt%huU^Vbn)24MvaILi)i;r|YtWF8RXPkCsmPbC=_yF>hpw&wQh&_#1BN z@IDPWX2Uy)DQWWi8AwQW6jv0`Mtr&QOYgD$EEK2H?8^{)W{(vBtf~R_@^1ft4~Nhq z7^2C`BdLEmhzv%yLbw)UUM%CXVP{;4eR+uj#79sch4`$5VwU1B){^#T9*2E$;x7Nf z2PcdJgt;iC2ZuB~|6;F@-e2I5d_OUH3?i5I%V--CsREyWx(`Hv;YJ*dk$c`por4e} z%?a3>*!Fo0Hw~%pLW)|IPBGnzrZh0npKTAgApqc-O10OjIsFCIs1DlS5}LEA!k|hfp1Sb+80`gM1ggY8lLPj|w(a=N zM#LW=t)=FN_rM;%WIb(Sy$NX;?_uGsoaGnw__2Xr8LQYzuxrD_Qc{w;j@L`0OKYv5 z`RS)mAn&-I%L6O-X-ii<4MA&-CUpx7Mb-pmA7Sg~fIWuT5WuaSn2c@KzdOd6bR;%y zBaXi3p2`s$;!yK__wJo0I_D%-a9C(n%zHYr#y)L0qiuTaB$XNtHRcT)Uy>pdhx0*! zk=1BU3IdK@W#>%5lB(V`S__Y?5I4XCFmqx5+MD@}-d0=-~GDeR};xfm=F%_$Z$P-+vuR6 zOHl|BHI)~@&~#bUI%dFKgt`ZIr97ut7JqKivN%!>vrEY1jWtpR)~sQ;X+)h1@y`WB&^*eiK;;pDt}2I9v>=k78L~JAJc#*3 zD8%8?%hsgZWHWbs=lV;&Po?PhVWE+1c`y7);nAGUv!8&^9v&c0W`7{n;sb912JyFW zE@Rz%Ueulioqq;kF9G-E-=xVTtEpG=d4gttJ(B{DvsAHIe!f#5+oULQJU?CgMsBrW zkyD$;9cy#rBkg1$Dy(TeQNnuV}I*J*ubZ( zavjaJY5%3QT>6XS3@Ox>>9;m!q7!XR23)mP9)J};+50!x2Xb|XrWfYx~t7Pv655lWz^)t7|a+K_>hb7kQ1ZxBRlYQKKgNC(a= zveJp$Q&Tg=%Fykc1*{cP$aapnt1hVM|7Ol6Yr_@N1jA>;82YAHEt`Ofe$h13cJ?u% zjh+jr&FcH7^8w)oA-(#>Li0<+E9p&?k5HRyZ^?%jxTZN7{zH07;^87mpdFG4C?`yU z(LY!5HojOCPsG(=jY^m_XH7?kS{BIB=HyalE2OY6*HlDa*oUmUz~*<(2*|1JhA)GR+_Sb1G*7;D)R=B$ zWb{{N9%;B4CC%F|#9#5WAUA4H3QUB$_i|6*{h^g6iQ4@UYkVGJO{mDBRurEgJXm4&Q+fb3s55L@}g8j?|K~t2Q<*>iEWMO&B zU!mksN&4I_t(HRUfaJZoG1#y zf737CDceB|R>R6GwdKLWZTWZM&i9BuMDrJ=8^6+bS6thdDu9^Q3JAimm809ao}cVr zdBrI&5?WbfxIJC;Y$;-J&7L9RsaP)pD(0B%&-O}o24JQhi@@xmMjciP^$aw7zxlAu zY4I1PT5NB^a|OkFdO$UF?@R|}%Wc->qU>V4SnP z*=MQc>cbmfx&=Y=I*k$g#O0|Jo@i&kr@KYQAUQb_F~YFlr1ZA?lw#OKPzx} zcB}{jd;giDzc!UavS1z9gfJ!dbFm%EH$8>#k~!Hw`ASb$P1xq6PXIU796+Fplap2G zisb8{hBc!#%K$g&yv~q^Qw@i4E7y2l?wl_|6&dyNU8I1I#jOJIAsc5E`z; zj+p!Nb)1PrZOQ6}FdJ-qiHj?oh2+8zeb`~7fUk^ z2W}dLsX2>hdNG_?O#FGa3|+FboWPrN3V)6nhD`Utb_UVvHcnI3sM#;E81ENc`PbA; z>iJ-`$7vJEvNo!-n)W08{YuLV^WS}9d^=tFKTjY_Fqbfp`9Q$PCQ|^fs-#yx1#?9z z+c#6G!3(uS_l?NiU$3uk^QpuP>1b0)-$9v(M}+GI+eXtceecB3?Nc8cc3$X4dvDG( z1K9i)K0SZLbGR4(XsmW?b*1)oG1CD6gd?mTi0xhv`DkMj6*y5>N%Le3Sy+@lU*)Wu zYQrv6qN8@vlmf(-{=(^keR=sbxr@#bxw_>pDS0?%FmMKZ2wFzupq>)2mzw&;haQYw zk1G_}|u{DGAJtzN)5aYRE`Dcf2t*;1Tth3Xzxwf~myvy$>=4iQl zEtNm47;{(??r3WpD5Q??AEQEr4;180$xOsN$YGPlcEA2B5z=rrqpoH!SCF^mh8~X9 zYhwWpvDW=2wYQrO1|yMz{)9!XR>`|LOL&FqsCTXHEu9>|O?z%+wWNleZ{?hh)UGW^ zJ^y+5`vF{&p){JXMB8~y#QD%+KCw{Cu5j5TS9Cu$<=s2KfZD#vx#R3+)Nch8CXZhe zN<#&LnMdF9_j(3J3W@d>Xc~LnIWjx}CiF@7jOS%(YDB)So|gV3hu8{4$|qae_c+HB zYe$5ZN3g5vJlboT7-y-1pDp5!4(nwbyqwz<7A7WxX_^lK1Pz-mXyt=0Q||>VBPl0< z?cQ*-*ehug&ZaeV=#~k$e5AE0l!+@E`2KLx8_wTfT`T^F1AqDHd|*wDiz&2wUEft@ zsB@3Xz~QnFg#cWD=Lyg=eOB(4((WT#Qt9tp;q>!UY~PgM*1QV=eFs9@Nq-E^Jef|E zm;z7)T(WB`laLwV(8jXB@w8~&?G_i)$<>-*%;;d3<5pV()(yPT=0KlAOZno)aqXTS zZ^AZ9zf!zG$vt}X+C`~ArFU;{b^61z4&ws0AZJSz+=zY%+iU6I_dld}*{auiGN(_) z$5T|1OgT*@4h~v(7 zO!Sh|UzASh<1lr!r0vvpJJf}iWpd0<+TJ!znje<0{`#=Uu$0LIER%aluG%=T3hvsF zd7Ad#IY&lyW-DfE8YWl~N&?f`=-bOp(^eMi83G2+KAV3wEF4a$Z6E}vU4;ZeB-w?f zJGp-Lp=aLsD=3Yq;dZj1zoF$GkId3mz9OgMjo8h)^P1(xD8(7SdjzK}X>&7cc6zH# zSQaoxJeS|Q4&L`p)~%D1UvW51U3KVTydfaw^(X(zS-Xh7RVOr;l|?K#n8AF$)OBP# zd6Fvx9$jw3;X-7L)-hIf2N1}##wQFI^+6M_-x*yXc0?uf>F?@|WH}%%1m@hn0BZ+rzjBF(bjGM+VsI$JRx_nSz;~PSi2<0EfnDF4@X*XJN(f@xg`X3MgCi zN_)ei3|aUZusWM=e4n-yNmGuq(bwpM=62oW2T!*h)zas$PW=Lq2l$o|;*{bx{i&cE zZH&1>(=mOjzH`@-RL>AJs|iov&UmU%q@DNXCUK*xl${EHp;ORQq{rDhU( zvT{q1y^tb0G@=&F%2&<2ZjXPE?zdG=hqLZ*4$0#?Bao~>IZNNTb>rQ z3Pl8^zP5PPoe^5-CO$-3?w+{%hkHEG%lo^$M0uk&X9W*@Vsz~Wj8tW@+i5kkIQleC z4v9=ewNY((W0!sjrVmJb z)Oy*9U(u)L7WHG9FXTdT1#4_t^XszxIE-Tu&hy;G*a^Y={vb@>J!(XpE0Ss9Y zY3A|>zg}ZJizu^HYZ`Cs0I3T+%~5uvn*LVcU7gS4qe~1+IA%y6B6_57y50v18Q_F~ z`{m(ACCyx27SQ;?c|}gGq5kP$5w?JA~1tSgg4i>bC#!3={`xo7{Dp%#59OAt(#b*@R_+~&tOp}^deII#A|-c`QCjgs!N^Zf^R zL?qT*ydJ_GsFx-5-44HwmOvY#YHu5skTI7WOyHUc8|J|k~bRyP9!u zPpY4lhNgqvq@#xYoAS;pYl~NZj%!dkDy>7$W9mEHn%$rCd(px=CO(pe?lKx01=VoC zdA0Gxh9B$aIstEWfrSQf_MW=O>IB)K91E03RN5?pP4b*4)iGzX0TFQH{Qbb{D_lalX%Ri0hgk=RC?*}dpad5Lk8m+100my060^8Zq zn`%sW9xp&6z->&CN7pzvn`v}spHb62J*D>dB5+Yaf3Wb-1s@fpA~p6^0MD&`#wFZU zshSSCk~1@t_b=t6OyT-Aq3kkYx$#as=3r-U8sLi%iLmlGgoMP1P=R_%gXLOxXGPlN zbgmOjLC-tahscf8NK5@{PRu_ZzfWJ_5|bI@SCn0f+f%&O{Tha3I0;a~7ou%6fi(ir zjU(XN-CMa=wEDKOyb#2p(CvF!Q?0pqT5GpfpEGHKqYeBdJLoR$XWMy0&JG zn-oo?{>AE3)}kM*i$>yk7G(JNgq+BUc0uKAaCCG$ zpH*bsIOHUupA#Pd283svfgMqoIn7`J`D)W7Cfs22A87BKMbLm?C++2{rg@-q=1NSg zj1Hy)L(@#TNPSil+Ure6wHtp+Ca0u)KU;`ZnW!X(A?k2hK@?+>>yL{|$B+EJBV3aQ zKwZ`q3LXK9%iC@HlM45w?Sjj}ZHA21jl%?6W4&@^r zd-?Rvc?O#}{PwQ(p@x2A&OC@vfDO#)9Mfn#9v(n?*8k)PSX_4Q71SA_fd;W4F)#dw zDW^v;QvW+T%SvlveME3Gtb&tP`uGZXdaV0nD|b`N*Ftbf4`co*n4ZnJ zA1RO^$mRc#_a0DDWm~&wciSy0A|fgZ0tzA-RFY(oq#!wGk(_f* zDxwGiA{0o@IcF$BiHb>J|cd&zgD{gyaTI2O7~gA8MuIZ4W$nYxR>=^k)jS=dS zhBjqGH8wcDpv}r95Gx(k8fBJKmB5})xokGkaYZf=vJ4$9IzA%Rl@fF<->fmaLFOS; zB!-&%P6st?LqQBdmzCSwkGjB)Z${;0-%wx3QePvj%QidTX7AmSdYkdy6$Xr}(Bd!nA#5RE~0sU0J9(MKh zF7PF&b1&$d^*~kn4i9y+T}R)};+LW1G?~V6Em_GSScWy?gENDOHi_VLbMZ@)o$mFo z?JatNUI=G+AFP_rQrJf1eW(M#?}5`L`;2koN!H|(>^CrJm_RMO9CJIs5!YeL(+ zUSYf_Qw~k?YZeaVe5pPDl#h)3hCH1$kbb&|du^X~n- zXo|RKmY3G~CHDCR_N7Ic?f6qJyMKWGzaW42y#gB$8iAvHZIOw*kuy@d;v(Y1%kG8O z+z_>ZO)t&hK@>NI_f|^6U-EH)j5OEn^SObgKx*EkD~p`^j;X(y`W2`nDTagU5taQz z<(2)2ln`xKLq}+a`}lzbU^6)gpQIcm8p^n>hVY(7<(si-NfJ=}2}119n>zF@6Et;% z+r=#ANN#F_{JGA}%y#Pr#|;jCtZr@$?z@PPYQ$1X)&hW(ijdQG4JvybsO)V+&)uu) zi;Lo{?rZagK+S=SDMQ*9@&2~)v!NG%xtICNM>ZpHisM*^_L^zLL+de&M z@=Msfltu7^drCJyT%`>%9tuaU7 z=BWFMxq)^YuvwjA%FRJC!EY8getgV$>WRW4;L<+l@jZ{WCHkuyE8eSoTJk7xk2*gA zFgUq+X2GB2O)0PuzHVEwzWh+8uSc_x4OHJdRt;h|z5t?n)%(ngSs&S@bJ3@X5@k>6 znm!#y2D6g={)_mfUz{!7Aq6%zMCCWrJ}4c11=zY0h01^gb&+IO0reH?G%Onh7;yb0 zf2w56ssU=ovZIdUi$Hpi;;ZZ^kUZ;AJzxi%$)4W?ZeVZN_k~*^^>HPQ+k;C|cC&3f zfOZ9SQ_c2XAY`fu?4Fu_-S~sCO|u#^{!|bc8uBc^b0Bd%*$rz!7L(fLqmw%R)=s5B zXnh8SpX(GzJxu>+)ZGWmoXy}i7J%J<;|nkAre}iQ7|?^ES|Q8MfzFNJnZtzIajb4x zOV1%|Yv{%Dz;}t6tco)+s@kE1wo7yObx$QMJ=4o8Xw*T|3Eq6_A9Pq*OJLC+)&|W3 z2%f2wvj%RSFp?v$y$n}l_B{a})RblCxZ`Q}SjO`KXItj>9EpTS~Zw_DqmM%Qi7!lltcro=IDR0wZ*^Q zWO%Uw<>H`|br8Y1KWW~um0_F8f6=-j0xUucQY6@Pz4> zR)NjknZs>?_^}kw?7V)2T%47Gl#S83yuWYLb{&Xn_6|_6ue2z`5OVcQpEAAt*3cr^ z)+jB};QQz?^rSgYan+5PN3lBhNO|Svipz~JP)GL1oUR)qH5+0en7)qmSTMnT7g{$8 z9u9l%LyevV^FJ>b9_4R2D*lEg!(BLqY~zE(;X2Bq8jTQWjpm6DDI}F-F#v1iU?pwW z*QoVEfM=+LM8(J7=A>u7%SkVYdbWn^|CDges~T`>Ex^*N+itrRWAh4xWeDDUi?@l$gVq2q-S3djx2RJ^lmKPU^4hZ|oG z*^aHBNqi8v91Ag&FmX+ZiU+>Xgc4ZtsGUProZ~Ok+R!8^-S$|zjSr}u$ueP&=v7YH zYrwb777FdBKZGv=+ys=sYV1fP0GDT|a8rhs63|ukdq{@xMK4zMBCPvN z%mp1>#m!AthdL=EfQv9rn&E5S-1Nu07dkS;zyF=FF^budnJjx4L}f)a-`FL$qVB%hSv&&V{C?M}7RXGf zg*5{*&lzZ#fX3>!SW2~3dGe~S*6)z;qzjlnx&9T^uD$BC(sL?BoR=%hNY8`?mG;WN zdV-LCRibHi)%wB%XtXPT9yi`+@mYk>9AdZYHT|J><@84DWO%m#^M+&S1fl48B`BX+ zG!X=3w3OF;eou40RGD6?qlCUC2+F%z4~UMp)(gvs?%Z)cNUHHe;d+G%Bo@AFiNqSu z8-I8MTw+<%hU|@Z)eam|R?y++MkwQJ0=gHtnLszAEbvvJ5~=(?u89_HngIiUZOgb^ zPgd$^5z+R9NXIkzOoAv5xquR%$4tl10{?s!$l}m}(C0i0x-`V{D6ijxO&=e>fM;t4A3vgK8e5uzq;Pqd_I8Cmcinyt=0~z%{On!abN&?d z$5}xCW_7uue^rnxPJcaCZ$Ub~c+bhAMGPK@YmsvNZK-bgQ?1fsRogf=;54UxzEgX zP{&a5{Keme?u#f7EH4KI?`kbqYuZRHZn|&O-?lScYL2LNM%#VA_OJCZU&mv1Qi77> zl|8R+k2}VozHlAO;8Y#Aw)(%_I_XDd-T!1${Pjg0YJCqnqE1RoOm~6@j?rT#CLYk- zH|{uo@L0i}4rBK2A7lA>?Qe~dzrFb94*j{(e|_$MT>gK|_ir!$dl%v2_qI8oMW~?P z?Q`W$@SOu*X@h=5^yUrf@Ut6rbF+kb z<+*_J!p)ELL|5mAUj4}4eb9%Y)m-tJ5%pRam&Un7zX)v)6f_>K)DTaX58(cPzum*p zz5I!={l3Ez7w!T`G*?H?O9&qm!R!_!!p#e>p^3Hp{k!)OF$#NHYxrmMh^>YjTl&;= z6q6rS1ye*hC*|k+P7~t3`?5BDsi!_~QzxJEI^V4uTk4H{l4b4!Hu-NJnQXT-x9(cZ z*XkK1Qt1&RI5>MT2Rv>B3xkR324;)zRW8VX^{UVmxpj8&yJGcRqs8;*Y1E-oi%}KT z2ez!(OoX2wJLHwB7EM|^O2_(!78PFWPr(2rr12qY^*U}BJZn$XkT7Ueb?0_@$jvB8 zG~hNdJQyP`Q8D=@Us4#Yk>7ZfA89LklY`o-yqRB zdK!WI$cjC#({>vx-9DzR8rs*W$mja%Pfz7+2(ll%E)gXqAf&=g_q_e`b8ia_>#cLj zVP2Zp?F{@oP9ro7EVBXJs5C?UH@;aR2aG3pJa{a}`hSg?yVuWP<20ed2pGqP)3Dn_ zw6AlwovW2%+;;tjU8c5@NUKhum&Nx^blD$%5A(KK1g>&D`Si|GVwXB0_;s=T9o!@D z&mc8PE%-Eb$huutu?WM;o?X7xbK@TKP(R8j%r%g?bTIFbr})pyO;uf%ET@b&hbI?<+2so-D5Fqv0cy#s?K zN=c2qnBu-}SU5FV;yl-DB(%IlZ>qySd7r}F@Ana`uGZ+>JiRaiL-1?86U8|W)rAN4 zRfX}t%X#FMEFgSd&T~0%a$l-fSE?v92=$3{jvCBPgkmC4 z=G_!>YQ=^v)mpqX%_91yrkPv%y#tCR@;>hckcAE|9TwL($A20rOWt!Gt$I)T!W!2$ zD0?A)c=n=ox?|;RNphJHYdy`Q)o1d11JS}S-X&t;)v)7f@& z0vvV)$Rn+G4E=(P4tVDZoa5>7*WGrO;@_rl2VKW~olo=D*?riwfB3wiHv!b=oFk{0 zA>r|Kerj!az_B>{DS-c~%l|5se=3~6z4%Z5>R;`ZpzvKbJDR8y=WKYNyJ7mO$q~4* zC5Zn2)X?~cru*wk{Z#iWB5ePO>UPH|Lhvx?t)E}wC>(`nX`%l9_=rDW#k2aaB1s*x z#}??H*Z%3n{+Cko|7tLNzu0At9VQPqN3RcY8tg6-RWD>JCQIWs9%%hjKaGP$j$5g> zlo-OCGPO%Ax?C?chPiy4%o}ppcw$}dYj4rx8+yDLzmJHsFwM<<^`Mm;+-vXO)5~pX!4$@`eSkV(#ifv3w>DXf!Pw?uExH4HVIjvr@a}%Sex{Y9ij*R zOM2^*#o=VgdwvfswV}*Gz%y#2&<}fEdn1>c!a-@QYZHEmb-?LXsx|pMM{R=nwLj%n z0fWNVMDwfoMD!Y86AK+GzOn=^IheI-R>_GRmNDnc)PGOCb!*%HqwfbZ?Ij0BB|2>5 zM`^zMxLIGf*E;OmG@c%x(`ThxZOEYKVj~FaFiwuo|2CHTH8*fMU}?R>?0}hB0?Q%P z8L%qJ?{1}t)d(u zt=HfBMTjb5BX!O6JZNqh>_h)#{ZH+dAd<`WiL2&ijUm!e<)mZU(=Y1h#>9%YAL}1T zpV`qj2vFF}tRCbdpBwtx*!ciECY;9nt+~+zJ#5jLKkW%NL4pDiB(OB5${p}j^*2>k zCESV2yP2HbZ+m^?skystrt7|LjfHEeRi@oO`STn2y(fLYeIgX|5v{X0puM;8G`rBm zdb>B|l|$KWuF8mDey`2knAgHR!T~cQxiYW6^R410aSFNiw)I6+0+V72@q~_J6)Xg3>HhYsvEKH={@G7dXuerd{@6N8*gHO{xna)*g)u zM?Up8jh73bHa#C(51+2)dca$0%3gS5tiMW$*FpL&m~&hx3$z{6!cf_3v+%ao28C9A z*e{3A(=dT@g@F+f5rLG$n+Ln|52$jDDd)0MG~~OA#5PRYgmKm(?BDD+fhfWEH`WATwGbrMt>eklBheQlADsfA$ZY^nMQ!y zp>YB2g>{dH<~Umkp~}6s%3-WqrYeuMy2Lm zfQwM^pyFHqmlmuySS&ACMZAiieC|_tHFr%%Bs6pg9-~AY9vT&a-}i^_H!v5aV}g`_ z+xk``z!K<~K%#fl@1ZH;IhvoQf;CiPR2i$lVQe^?IlAHswk|IUfvF)sd$wXhyH9s3 z>T~zy!55zr^Zc6Ht_h}VM15_v?b<7Wm%CTH?*Qg(;$+D7HNyGv#RNM#JdG%y<)Gp` z^+zHiq@|_{cbEJPs0t11i8y9%r6#wi*C?qS+IEh$GLvOiqWZH&-s&9k5IN3Tf2*VH z+dt^_jomZCj;0G7@Ve1AwFWv`d6h}Pd@9|)nr+T^pAWXQAk{z=$fha`I;{<_kEpK> zj%P8F5?vwp^Q|W$*~GpLrbdnk-;fjfrob6rww$$ zVjZMc5y@0!5Y*d`hnGaPR=+fPRgHTuLKDox&eS(qF;b!iE+TPT5{*h5%fkz2h~|56f>*0$Ix}o#0=e>qa2VqXhxN%sc<E|0=X|FWE-dz@OsLQAkPBz+w?F+z)PCeGocIt8+)WAAc zC5aAx5t-u|yp@vb?`t)5YcML4WO^}~Y?f~WhJgcLePP%RW`h+x17+q@!xaX?-bK^B z875ibPlypd2efTu+|G{D+TU}A&!~T<@5_~wI-+J!rpscY^VYm%!Y*;nYHA|==uGaX z97lqZkfIsKfZXh&)T*9E;&i#iK&jN!TVTKy*{w-%*Ad~K2rieVzu?uO{yNw z*ued(+s<(K-Gbt}29P(#cA9lK&$%qukBGO8qE`?6UQ210vs|BXFWyRpBUlt>`3UME z2G@>gbdg=f-Q;C%6JhS#lwCZ%0|E7NArbg1VY1^SxkmYra_PCCN2hq4b{`ri%V$Rh zY#xxKa~wBi>ItG(n{)=aT|$fwdeemMWVU$_459vhQp3fpbOPK;A`9jWHI~M=j(ucs zbUp1&daN4>(7R@iZ@vi%ksO{zUUxe8oo~6CD1~xaA}-G<1j4v%%HPsR9|tG!85MJG#+PTlk5;S)14Py$VB9IAsy zBF-B#1G(u&x;BIkLwO-ao2CfmT}lBW$46STiq)osRzV<@x+*R^G&4woq3e71@@1IC z57`~-a*OnqaExi)XO7?kLYR7w&NDRrOucXFbuz(=uLTbl>kbke0`v-79zpxbSL zTg1PQrTnzt{;f9gv$WuU7{ioAsHMg9pH>0O@i_iAwDY$Y|B4>{t1N{#0 zQO?yyNfVv}`F)+A7Gi>{%@nh;v-dqT#s<>M3k{eA-8|ye*NQ~FMjBhpCgwKemmT?N zahq0XJEIIcGoV27^oz*Xjb+sm`9G*>$|(6fSmrW)-(Iy2e=n2z=~JS2?KqWuSMT=( zyb-XW&=HmD2Y2{xB^dDrd2!8n9$^F5!zV@cKcnkY&u%Lz$D*!z-M&{9jYx59Km|n; z5#h73dA8x)_ZLe=*MAt}qBn0H?h!5r+-74e2yrz2g2=&>e)CNh%_*bT?vYHi*F+PA zFd&;>vxq{brWz^bsve^Gv-V#+Fi3dnQ#eeG8~agRZc{BuBFRC4(M0>w@PeBI*tZwg@}ud|=N|KHU_UkR>FRbI#599IEB``fdIr&1 zZ9x|9Oij%=O{BCIP@E0AcN^Ka8FjTG2z~?Ljx;wghGJWK&V27JlWEfoR|s*7 z2;P9FpZmW0(H~|fKIvU}nwR2UZQnFaj2B)*Y-#A&YNbI)!ApGUY7||a-rZe?Ez*9V z3pVx+(tyqV_Q#8E{RXWqAU9)(<-KS7F%*;qeeXXws?2dYENx7{^ zz6EYnt2W?uF}JOHTHpCHHnLD`M&CNOI6BpeKTLF`@QKAUU#9&hisY|Nx3?94kM-*> z-xhiJ<Otu$p| zRirm2#AjUjD^ul+?42>j||Uv7lzY(4$wGfEanV>MZrtMAT~K-b`-Z z!LS(0W!sa0_quFPN-REq${0 z5KM+a48j{S;z#S(-$lf*S@lRCeLTO20Db&gn1$k8#XUf|NZef3m;YQI?tbONrxRmk zH5xQjg1HBk;4Hqs8_Vzm<&|8W5sy(X?<>x_5N@y6R**llGX+rc8=V~0wOPhe&R!ng zC4L)e5xzO@P2;}q=5Bjf5^%t#S?f`pb|%h`U-)jAqO(PlkbMelp6VzKk-(Q?6g=eP zT~#%!=38GE&6DLoZ2O1r?aRi9RvZ9=(}g=;X+`vL+XGMM4xHWFFd*vrFVAv$HQI4q9O zMQ27@anI3oTsuh}10L;n-p)heAQ(tCcs#%6*$vH&hJf*I=z6 zK=68}G*`XBb$a|AAo?QuqnR-%kHfvsq-V`~3v(Lz8Q=sB=IMF!aM-Tn2fh+JEWnog zGHH@L(JAQ^jte{vp$lz~n@x`I4aT?n9}Uw|EqkI|Te2VRT~#V}-S;eT4k_d-%xeSW zyxBi(+@nGUTj#Z;h4H#a&v5_%d)~fnRYr#8Z{SX?jx%~THdliX+l*O@@uj18+MB64 z;BjH7izZ(j1&J+EN`B9PZ-(X2F7CZ8uPevS$|ckpOm^s|u*Z=3se7ET3%o1o=(l$* zb4J}WUJpJUPEq=d7$T&<>V_%(xLv>1g)TEqIg@v8fr(07m>MBFSfr&u*|s+*Rbv-s zr4R;a{4Pd7z?7z{J!vr-T}noXq$)K3YDO^k!xalJC|0dFkOiLsVi#ay?whcxl(NuL zji__E9yDQeRy)swO^FQ?zKW1mU;<8&YBX&VCne!l#&#GD4|bxIn?jjyM)*l1A_&RFJ{C z$*y{rk4H%DN*5~RP??zcY8OgxCEJ*Y`>JDwk{-!oj+O?8d{Shh@@8h^i%935$?|&x zG%2a`RW4bRwyW(5teYk(HQCQiJjJ#)cd_3hcpcwJB4aK|Nrms1$asZ!Py8B?r-jPc zdc;!wjj`*o(=jiM?w-RqrpNFZ|KQX*!Z8 zLDJ^N-qtVDEYglAgC^CRwACJ#dny=(DA;5xAsD682EA1-iC0#($z-MWx|W>X9?41B zeiQEJbUNsfY-FmWEi=uc=L^f#E8Py{1k3Xa#zy*190Qp;_aS};c}iJYNs+Do<#YSh zdkW`A@HX*%7NV=reo>ADelpUSI2>mHP@C>_m8QdxzLU*3yw32ju%o9z`)o_38?QIw z_HXYqGBO53)HbxOnP-z2N!r?}kI?C6@{x`YCux(s&O3yQu>_WwDRS7ZFkEUvi<5sR z8BXzh%c$}7)0itY8wLMG(~^GGaI2y2o*7~J7%x)XJASd$l`PI1R3vBPwa9&gs>@4t zI=e4`%M9X_-g?(Fa*24d|Xs4#${fQbvXtJy}TS;0>I~mTNOzKOFlsVffhM z29b(%Y^6Iotvfk3q!2=l@2;5M17Wpux@s1Y(*)Rx@3-e;_#nYI@o%OXn)6!ECD@1H z78q3UFjI3&O*DIXa<3==8i31+>Vt-Js0=j4i=zrK1TR~H)6t=D+ddDQF4I#ZQ3uCL z#d?fRMGvLzmO!^xTup33fYWwiksCI-v#y%8R@?dH1vRUMYNyI8Mvm1QJK zVa-HaCj$v~=|C~-Lt4yXxuJ^v>M!at7m0~oYBU&$8d@8ocALHyH){-PSS1@sMQ#qM zNS0OI!EV3JzIJ#_UIV{fhP;yDk`Ze6)07%&)`~&TM8IpWX;MHZGA3mE^PJZ6G%B7l z(-~tU;&5lZ){|7QUMrKXL=i<# zhsL{z05nj^Q|7)kzPEKEEi^bF?(spT^CHhRQi_oC?l)Z9ht@#|jm_!D#e_KV@ENuh z+%_njkhs*Sj##;T994a>6w=yM-TEbAgd`Wg9X&N+T=rz|+nqROqTnC4O0P@D2E?}r zYGU{3?)48eyXy5raL;ghO0=HV3)+Nl^-foobjC5&H`FvPaOr&Dw2}g0uWvp9fN3B7 z$`WAjNWk6|=DI(5bmlMNVBUuSTE#4(J$TsBuoA@1^*Kz;hSl5)BNbU-DFHf!GY2+O z1@=}h39_*%{A2akrW~YMqzcCQt9eVTxym!Z9_i7M>Au?B@D=GEcdmuYovp6E=#YF< zm9HIOi(P(>fUrV+|5px2+q?4sRd;F64#c-MpKc3stC4(k$8#jQ;j?RTj!xyPE!QAd zX}eMP1a|s9=TSh;+{Up<>YTQ{tw-e5q}d<1bM2a5oeVTI-IKLU%$QxwEbY!T^~O`# zQ_)cUFmL~d&fY*4Al2K*qM-`!oR&}$cR@H?^f=tYc`(BGimUh%Pn5LoQweob*D&vx zfZzddilFGK{g+cwWwz^@*A^w?LaZ>~b)a?xgPyLDLI<*{=QDrGMz#i6%m6O;I^-)U z%qS$}=g-)>+Y0FhTNunUAQ(P;SjorvD?i}|*r4zqoIu5i)j!!P|5ou)dqQw;I1!QsCJxBm9xUvaFzZp*)Y z?%!T~hWAAJ(!M{iVEhmJ?bz81%VdfYYAiw#s|{R`?x7&E&*S34l_So4JXs+X5&ffv zb=p?#yYe5Kn>TWZ_>V?HfT{t-6@{tRKuXt)Qh;81^AJ*BYR9aJOh)>B@GjzB_9Dle-b}wa!!eGEzhWZ%UxZ^Ju&j?8W?{I@=DOb9EJ}4c&mVRAN=L2Xsk2A-W zo;IVQ=L%V+l$V1y(T`blO5e&m&lLX=p~k%!Raq@qO1XVJr&CBmA#EWcQ?W4LYo{xA zFnLiWTz|y=OGnqz^l4%)D-)A?>24e*iqM!67#$9at<)M@cpMH{DekhKwMT@d*W8#z zMG7r3w#Q%&6qIJDZxx}riSAaL9anCukr0hRxXDBl6M;PDALQU*r^1g%{tPTHoM=(^)6oy#!-Z%#dn~lCxz|^TD&K8s6>exyj@IoqsW(=*#j;& zd1;p)8s8)Y!XHjHQg(L+U^i7-J@r0#wqFVc!PNljHs>xd0%Yr2xiLgv2q`_QjGy zlIUmTaU5lFjQ${J^-;#*^Bdh4eyo2SsR!>UMVQOsoECtW#azG>@~F`#Rys!2KRr<- zv>YG&C8i+MN~a=XV4672%a^h{UOE8cCswEKg@K_p*qq{BS!Sw?lHM&0Bf0}5`+E?D ztLr*``0pdHuiu=Icoaop2`~4JaOKFureQn2$0D4+Uqhd_);#oL(25%5$fP(OFcpE* zoxdc^uX)_Q!@PLDKDF+Il-dWh@B*uzNql~a&n}n>Ubjo*wjPUu*AHIx!QL!mZb|0+ zvV3c!ya*FhGv$gq?iRn4t;ZkE)H+*}1|%mNXi7fHQf@%HmPjZb6AXUJy+3(7|5knc zSC#im(6fJpDt;Yi{8K&uAIjVLsZ7Rf{!;=Md_K*TN8)0lqH@cyK|U%p*46n)K%n>d z5Pj6sOYAUC|3M@EdF`KG+7%hQC9dDgL%%C0;}$$)v@24AiAv! zlw1L$-CocKgN(wgUtejz9Rc?OGC>1px;&j_tnlrM(gfR%j+`!EVhlZSlDP$}7`1fy z0zQ->?hL=YJo4HATib=s8xD>MNy`NwT&<+g0f36dr?CWc?srVA4d!iSu$vU8kol9c zzG-eFAp0XDKk&VpL1)fHYgA%Hz4Wc99!Wh=jL7-O+)L~M)Ye`o z355=;AK6={y6_u9xc0giFd7JoCV|*Z2zuP-#hA`_LPZBI9oew51wsL`OGZ=q zV3UZ7o+SO~&mOrm6$L@sZTnY0?33a7loX>8KN$(IkdQ$ zxgkZx7XLyHYl%%5WqUa8OY)xr$~A$pw!y9HWFMNK(YlC%XmBg z0Iam%x88%=0Ih2&<vqR@tU!Bep~48og;;dPVDUh@L<}r^_i;hFsfm0 z)rb}Cczx!98e6b7#wqXL1NI(#Q?PH62!vf1YSF=|4nea>``bV%#gi9stb^>?JvsEmO4pH#>_B8IymQ zW>TbE!$D?80`?3K4%&Y(s-jqqch(`X5Z8)gdExCu8LTNHXIcGlvsTLrZ{$SU=+yy@ zH>rSGOQa5#Z%@5?re~@vwVM7(FlVTGX*p@I9zYK)@X}#lmXK%CV@*-NX{o9fo39H( z%%^=6M?CuP_S-^Ypb8U}NyGqfy5LVyxW$O;Sm;(@<+;}sg2W{=lXqY@+c!>spZ4#a zsR!VS#Qlak_U6%Pq&3w-XVtb?dIk`7DFo9tCVE*ark(p^Cv{=18!PBF!1K*8QDDw6 zm+zatbdj#9!ew`mX7YlSdx5^fOr2_s#u(+53Cb&LiyEJ+qk6lv^Uji8{_m_UEA;}* z{gvIO^-;3b=Evuc=?n21iFV<+4EO=XFQSP6Tf`C215yBja)^9{2sHx-yQ^ASSvohR zBEomyN+Ukf*3H=sB1DyMQ$!WbCnS!9A7#u+_@@T~(5s|i*{2-9H!>eu#6V0Gl5aR2 z3~{oU)9>s7ZMWW5meP!|G&BTa-2KxZ?Yy>+pfTOs1?PS9(D$|@^E?2H=SbD9)wha4 zCucec3@rvy>pUjSzQ{{gYQc<79|}=odgfSmRPz0=M9R(za>IvmC`#WO+qz6{>tj^6)a$mPaEn z{?&s$xpIqZJ;^CihjP6~MArL&Sno*T#PP~oypgHyvj(+w9l4>E?Dn}CzmEV#FeaXn z%7d5P3nGLPVZ_0bHji+*0EvCkTskZEc?z2O4Iguv(Qzp0v_(0Q3%O`To(KNEj+H6@ z(I8G-Wz*a_Ove$rn?{D%uL^kR0++CWO%CkAbFQ@6NNa9wwGW)gyv{rQS-M)=NDhTA zHms9Lf;j^nQ)H2QRN+3vM*!i!!%@x8(SgrD2w4=B((Rk+(^GP7k51=Gw39=RNfYFG z)?K^2_qIc>Cq33!V1P;smu;{QNhDH47UQD*1f=+_x7gr;FD-H}uCNIlvs@Sy` zdCHBKh%&TuI%y|Q&QN+yj)u&!@KoE8n=`gu5&X6@OMoMeX%b~9CM-003^6vTEJYKm zic3`vkw-aE@@lB^y;PbGTRKsBcqCF;-zG+Xr_zJ1432a5X;UV%nc0+a2IyREf220*Xhgd>;p&!q4?+m+8PnZ05mCO$hWaK>$2#_z z5!(!p5-Mh?J0WUm?t#6#%>;8+(JaJx>`#XBcW9|m4SaRJ8 z+L}-I`khe{KP74HgnU%C&cdRF_4$SI>MDc}^$ijSPDD}R#;SRIQK66)UIo9H{Vh}j zPT9t;#?Pzr33O>;Pe`ur-=916u_sHZb3lD4A##{oCTOkE_+XHum`rf_VS@A)kJ+ch z36U>Ju^|-^<2-pPP1I>f47Lv3D^v;W1SGIr)^WODM6Fjp|PG)niB*Er_}p8 zddGyKB}YzFu?v-H=gghNS5;G|+q@i=J|w19DaJuu9hs||kiE6?1UH}+CcF_&DNTeA zYAc$KsV=nWSMgQ`e25E~GlccE`3(wYzRAi@|3W?eodnQtWMAZm523~W!BSM<3ar(b zB>_IzWLVXkVj%1wH8$%j7q_2y&LdjK8fz{U5c~N==T*;v>ud@NL~@1u+hm)_R zZ!r~;Dw{^_h>6zE;Ovf`w`Kwqqa;ES&&jGM+cRd(fSLMfZq9%WnnM1P9O*7F-At&H7_# zY`AokViSV=uSDxo4E1xEmbT1q&M4Dq7%uU$1{~SC*t-LqJ|{EpG=I_A;fWD&OZL@q z_!s!<;a@sG?T^S+_q9dryO$~N3G=vg+wJKOKeIxUTHeNFD&VO_k{$AVgy6{@cZkkh zPcCeBAh!Zz5tzg4V5^{AD#CeGpaX5hRzq|2%08YRmi~kSJy13G9M<+WyHqp@q>xE( zA85MnVYIF-_BKcMZ@2DxE}AoV@>o7;+mb3#Ik!Apy>cLD>ScxF%sq&-9&i=#XCE`7EwBtmX!s(1YF29eP-&?iz9!3uwgL58ReuNW|Erg+9G} z`TKq@ZhCYy!~x$0+3{zAfV4B8F;Hd;d|}uS@^xzllpS~uWZMo9t#{LUof21_iBd`m z4lRCbMsL!?pf)cvg!R=ooW42wu&oB6QLT>2L@-{tT7Qp!z89=vL&H>%n39ons^W6N z-^E-FeQcGL!!D=r#U)ZnNvIo61h50Ui^H6eE%!KE8i&24%V)SFBrueX39VX4@;wo-12mO{SX;BJdc6D z`v+CgWUX@&D3%1d%Q@{gNK8ewOjXcIg$H_<19*8uT3^bL6v2V7H zE#-VAoK@Z+y z&Bv9GfQom_ZT(x^`+vpx{%b-_+gV7V5lqj|U&%uqGB7Y)2u=`wEwJ+|+uggpIU3<1 zA#Co=5xo8pAd;m!CX(4hK2@X6SGDs zlS=M22izJ#`2At@J)2KWxS#ois#mUPPV@fw=&w#_kL}03MLs@t!PMfnWMcP6-IjAS z$^vy5a0?6wV$efFLqlupeBY_5seS)6o5Ot<3_A~yDYBIvlEebOx5c&P5#v7lPr%q3 zExd1XQ%g*FS z>)%@>_d;L1c(DknAunHQ*0@(lAQ(nRM`1{g_V$YS`v==-U`zKSJ)Y~0`1bsXgZ8pLn6Z{qsN#%I5=2H zNQhQCy4+>m5QZAXWwnIC7#J9AUf<@Sr>AFU-`JS#GHQ$ExN|21Mupv494a=^v$XW= zvs{F)-GlXjA)EGQ50u+X3VEMItU2OV&biYhmYcPDG1#xfeEUF|9{iiNf5cH}F$?|+#&)F(7Fl!D(iJ;JE@!<{z4 zBljHjk_#6ua9WL4J*oZ8zyluK7AL4vWGIEHM|)zW2I>X}_pp7ZXEPR(kEtrm3l^Npvc_&nzlhhczpSIv=3(4JNDOw#czrf0fP9ey%$Mb~eNt z1&{WNE|61GQSEKa+Re1zQ0N*$t6jW&xn^g=zwut1#QJw%B5IHqVG$87Yg3O5{E~!U zpW}~pBch}fv>v-(^2)=*!)yG)h1&i_d(B_(BZVStUE{*fP9 z+`;~SB)f_2d~eRjkM}oo11R_hdwWZrmPdIiv-lg(?&~eETcaW)Ek~==Jfyz{QBqP+ zc=pA%;WjA5!jJr_-L@I}`tx;#z5ft<%7j(lMck z_35@g7D1<_;TyuQG%FpYrtg`4jpcEe<9BFLauauRcD_kNGkbAoHZ88ZYkhlLrO&KP zS|;Ky4KJ^TTV8s4I;X|pw;0x61d+K-!mrNC2^zyL;t?MzG754WTpq1JdpI;F$YLsTzb}0-=p7`xIcG3Xfm#<%E9lZ3~8OQS$FD)sF;dk4b zJdKneP89ImclI_w+Rxr~UK#78T!$?!KTM-h8LS)?9D zBM)Osb2HLmK9$KVsQU*%gk|UU*ekwBIHFkbdry{%N|U&_I3qr67-imJ&-E5AkiRB9 znLV)5#KgpuqUUr9^&dS-OXClJrMHUV_M}K+Vqz#|6sLu0vh@hkVR`w>8GL+69aW1H zPEJl-@(Z~|zmlCr29R9oem-5xAEXIKrEIvP_hO0dK}=k!T$0#e2q8i~MFKGj zN0kfh4ie55)D;}ufHm6%kgyR~m@wm(G8Z`C~4A8U9Y|QnTwZ{vk49i)N6P!8o z9?!U?H!f;hAhK3VQ!|uQ8GD<|ersU>doOix{WzdICD`vU@FYsN$gm~Z`I~{mFSH)w zK@=^mt(>;jDk`{hwF6I@lT4^|TJ~H?Z7Q`GV!#*sO2fjyFo^O(-93wF6|JkQvlu~^ zB$M|v7^b}JZIujX!Awv4Yfmp8V7J2$FLZORq)3K?5LS{f*658LOxx%wd|G#AGsnb3 z$9=U9PHBl54ori@3bpvwY+@p!gsoX6c$<$~UM^Ry2i8)X_va^A43&cZReAmDLNM4l z<>lqsT9wL``X#14Vu9B(m~<*^>&8q%FE%S@t9BHdbSdYk!^a+L?apQ8G2nY0?oMYa zWqoP?{hLCX^djs_*k8mKE+jjj&4iQ8&_sOe@k1%89<)tcEI*@i_HE}|aAWy!2Nqe8 zrA-3;l2@Wr0bHZEcRZID28twI$#&t?kn`BXPC3M*bcZ$~S=rsOADlkDJniD*^3-@M z9#+nI?BjC*0fELV$0V3Tjo5MS7bO}*sJ*$YjSc$%F$G23Px8eNcMbg1pL~4wtBsA# zT+Qz8?%Yiz)l(y*w1pD=h70tuDTbhq<`V9*vGu%BMI9ZwEq2LHzrRG}<#n{b?+*8o zm5n#=ahX?&pnJ&u>*h16wOTw%eFKAx`o}UdUh_F+-8o>l$#a=-P4V#XQ1Cg+jwq_C zrnidgl17`%>Onmhbbw$Og@844`_jV?OdZgf0`XEQUy4GQV=2Ek>nHJfXW@f;(Fx@|^ zggV^Il7I5Wm#8@p7sTM}iN(Zgz}z{lG6`a-)=)AAWDNx+{nqv1@~sC4F>x9R7NCYnjhT(#k{CDigYkr=r0gsY47Ne zo1Q;;T&QRTz513=tOrg4s88e9RIqf5rwz?5EV#h%0h#HzI5;al4Ax3Cw_U2;bSsa= zdoVC@yTC*c7ErU=wM3dkhd!2S=93TpAm#YXjB2hXH_>cgUR-4HP>I>}{Crlm9=rva z7@o}@6&-F~-ue1g9nW1%dxG%ZdV6G46r3;K>(}p38~-=z-UBGg?0pj*N5_PUnG7O= zl2wvqMFb@(Ib#435RjZ^zu=7jSKsyrlraHQNMRxutd{P zF#F|Jfo&_3J1!Z81G30t2l;%PuPE^(xwsU@xh#y0<18^E`%%ZGb`+^y`PLmPI@;Q6 z%VQZRk)~&7n*#FD@95vTlc*#Q4)yTR<_xGPZnll*&rN4%XAuMNjuvL-stmu2BaZxuETB@m!?nNMAHOlymeJYSi9e(JS)!-ne@R*z?NBq`37r8O8{5pE zR$eDhoIoREVqzjHB2t*2-zDG{A0Kak8o9e$KcUbrnV*eq2<_ex4z)!6A_o$&g=tl7 zvtsy5w75T>YO_K9rrSpdo%T2p*jFWtmGG^x?^pU|_@eQ;QDT9a3#HSnW$750X%| zbIZiI3ygXqgSz(T)TB!d3v5Ykhl0~~RS99rxNl|3R;xB6ouRZaU!f?VmFQcEX_5Hxm{OXTc=h*1u0q?GrWFN7gQ-}?;0i8P5Tku<%9yai? zksqd+*1c7D|EI2{)jksAicH$o-AmP)ArEnljP;j<&ixiy#6_N-BIG6-2cu`9hmj;1 z*^_ao^(`s(r!U5U6K&N;6Xy>97&U17l=edG-pN_8i919ic3mtSy-S8qTh_f(+O;Tu zcFdR-x5Z^78b_=jc#fe1Onz}qWK3{pq0{|w?bSbg?(m13w^_+l7?vFl%?3H%?8kLr zX)vH9G=t3(W5rnH1hDiW58-357aSaGaJcmz|DNW>fE6xS|2b z(L{_Gv|aEFf&&SxomflVc~cG|Jbv#I&m9O8{=UQ!LYVa>m&*5fqV%BHJVgQ18UE4N z5uhh_-iGl=&U+Z{0n@7$H?#r-XHJRM5T&&T?XO+}!r2vb@`BObx1p}xw@Kz?C8`Bp z==@8A5t`ubKbp6rknwqLlVc=bN#F7~kYg{cddE``HBI;x%LN5#p-Rp=nj&B{G{%}|OddZ?*lj?99x zSD);@tgKX%Z~nf*VIA)enT2`RU`iFJ{GI;!fx+SFsn!`|Q&P&4JZZGVvWDaa5SsVb zwkmrY_^G!xXXwYkY3C7HG8f>scDuYXz~jL4YaR^S9j)TB>=#!gW+ zWLxI>oQe#(G_d68aq89$=Ho$zPU)#3gRcfVn{UA?w-|Nn24P0Nq_dsv496LP7C1EScDsYcwY1C}hbyGF7{3Qeq5l`p zpL;Qh<5fhY;+OYZMM$Iddc##uFhI!wPfTMp!731T56uMkms#T^ds|RB;~&4D+4a5bgg&~11BZ@u$O^?6SKx0I|7uIx-%sO_>Vh$n0vmkyf5v;lfpJxaXwKK zSSX*%$kQdN*C-;q~i#vV$B<@Mx$gfw<3yxE$Y|JqYb;e&}F_EX3oefQ2&m~=l zY4=0l)THKwlcSMU&g!tQ5M-TdFTjzF8?-UwV;Jn5zJgvd+d6rux~fzTQ&U(U!dFi7 zm}zWXB3Y&)J&o46u#MeBo$WZ=jhb2(NM+3Sp6W8wWEyX~ApJDDM7*@&bg!Us8rP-R zB;7O&xM}cUz#K?TOAL_$D`l2t(X@k6Y{@`5M}AC(WTr{=9M&axW7@SsCwsr7Yqf2j^-%87hIeY0{N|1Z+(k{kTOX%WgTMq4LAlB4W|S_3+`N6C#HT7d{ujbPIE|c<^-eBSo9B}}0?o_SCIclQ>E#DrY#ZjP+P=;*-?Qnr<6XZk98 z*+7scu{B%0HSdmA9tQs0lGH`WC`H(%a&-~?*6veTdT2PfZvgWtUkQ1)q+1smnwKd> zmAHp1uH3N5eRI3>q?~G=4uSPV_hnA@5jMTDq`B@R&%u?Y@6#9<>o&TYrvXh+ibIz= zzk{{fuevvGJU?h>I5DOQVYAL_1MU?t$E+hRLTL-cKWiz+Y$ix*kmQ`A*x~gFo}d)X z6t(amb}p{vo6~H@&PImOIGRb^(Yy<$Ws7wsDXWwx{|w5=r8k&iRx2?eUu@uaNVr>~D@BKC%Sl;E^pK$BWbIjr@wlq}a(0NqjGzvE zldkEXIE3Oy7-yX}gAxYY%8z~=bYizu7Ihp=9?9vyGQB8%JkaoJVk`shzAKVp&%Rrt z7`?S)PaG`ZuGQ<;BSY#O%}E%;L^&8(M`f6)_~qaVx3}!cu64bVhAin=Xi6;8=q4o` z=C9;?1q`dTD8r5V@2*sMt48KbFlPYI*X8o(5c9UC<`9eUd`r=La?UymlH{x=`#f=IykRdNq;-_n$Q?d~O`xD95OFTqt#&Fs!y zVp5g(3p zvNwFGs=dCYO=n)ED@4a6NU6F^s>m?!t*ZP2dCHcHBWH{_yWu@QrmmcypL~25<`PpV zuOJ#(eNimh{^ewXMAR&~C)ioI@QTkh$I2}BW#BG~C%PpHa*SzO8*2(IHZyzd80Sq5 z$}s6mgmbUpv0iV|mWtR##cIs$z(qZ;=Fc28Ebt0gR-2unXr9Pt?Q&Gj$jYV z-u?31p+|P+s72Obc(_)x{>^v#T7 zm2>}cHBai~!`CgcCV0upquXc1e0fdhNSKT5@CkS^Brn71g5x3n#J9wWbvjgXUT)g_ zt&E(AdIqg4_u!@kh1RP<979fb;Tnh47?Rr$GmRJOjuV%EPd1@Kd^LiKm6Roswl_1{zz7FIX6VU$FRN zJ4NEy-ts<`!oYh)pWb0&C?uszXR43!rgGit-=6dK?4@RgOP-x=I3057vkJ%p06gheO8tCl|? zupDz>XsLC)L|a1`_x@E`)(2yGOA=Pr_MCl%oILKG^C_MeY5cOjc9N8^@#%!FA5WVC zX0Lg|5Iacs0K;D)zmC&im(gjB)h=_-v8$%b@~o>QIE!s2ke&LW@?;Mt{GZFW7N#-$ zfl6}G^rclqJjq;F=Vi3NpSaud+q301VP}sL>o06A%I$JK#gF00Vr<_Zj#3y9yGuPH zX_uCML(znfiBf4y*yEAj@yEC)#fG8?Cb0Tw zWc6Tvuc@;At$ZC~Gj&%93DQ>NZWx3_@?BGIlg5I1&1nwUTAz3b9I!4GNR?pBY5NI(k3-v zxiuLczyy^Hhwl((o!P}sJeQpeAMu*|Kx$?+9JiWnc~(R5+1n)a$hB%&CMtpEP?!0; zz0KKnlYUC{9pf@O@haSOzdnVTCS5=>O>vx7J>Y?i1heDRx)NzAog4aZLT#0=pQ2j$ z8MKE;=1+WlW4iB;vQ)U`N=x6bHQXoSsh!{=$sqL3VESA2Lb8Lu8I#{QCX{d=&m?S2 zao{6Ub!F#C&Z_~1m=KUEz|2$zzDaB(z5uYsgnYx!m6=}c@~Lp_Rmgw5!)5d1rIVYBvwn#!TyzI!rJ3>{ zMBE8~uAUZXFFbJj^Y%!AdE`F~ zNp(F*LxWVYCf%9ud8{;u1{MGPoMEC?7o|L*=IcNN&D)0NcR6PkOR7*7g(R%~_nu>F zXD6n*C336$H<~t3)@Z*eXZ$}0(uvIikxEe0)9cz)q5$Cq0k2*16{LGYY^=}a07h{R z_2k&}0Dph|tlR!xUY~&8a&vJ7hZGbPfI&O>95^U=^=R+dIgn@@09)U_J$`^j#O~CQ zo6=HJAOG08BWlS|9L+~U_+y!vH%Fsnpq$Xid=(H7Fk`ZCh(|zx1j6j`PiyX_C3_zAJ15)R9O?Vs^bQayOJ{Q$+{G$d?4tW>3RijOEX?OD2Y}%Sy^ah>Aj#l4#Xis-dA#zCfs{5qF$;Wy1_|0|ep?VDMxX`PMDlHhd~lReO%Prjt{C zLBSH39uUtw$Dw&q-Hm%J!R9z_Gc!eI*|G0fdX5Ltr_eWnrSF zrKP8LTU)lLB7cQKRuMX*Glyl15_c6mabf@m5*ij<^LR(jSp6HX#AVqOUHlb*-R06Yb{Y3Cb+RFMvABx{0YJcJ9*4-5zKu^pywJXbiFszq9gl? zl9Hg)0EoKZD2`I6DhLUI?8+673Tn?b4a#h(s2B#5f#q5D&dJRs>!6pu4_4-6QQUSd_%=w8?>M2QJ=a>|zpW(O?w2S}Pts(=DL>if42 zDm5miAFn|UN2?=aW4eUo&LYQ*<^HjZGRpxE_o)v%hz8JmEzHq94+@%{D4L{AeP&g* zrm-R@J|{c)ef?K6{&2(@>_EEW7woF>vGMUesx^m?903RY_4;evUlgB-67Ka1aPoBh zCdRFL0=7d6WG-}Fyw0PZG&je^K9GTp2PqS)g}tq9bxlo+@K0>K$&PP}vvrb^kAkjk zbmV4baV9-hIb$<$IkK!7OJZp`0p$a9$AbusC>eXq3u1x&Ke<0|%}V!mr556^ z_G}^O?mwJ-ynp#cKI4k?1+{UlL^f{-A=0$7ZX-YtMB@NXhni2^T^j8vDJsMcGQqc* znVG%!F@%e|<~ppmzrR%xBSAyTuxJR^pReXE>w;hbyUbp~y4;UOgf#nw%J7cRrS+L= z-iiPw%H6wlAUK@wonUgC`eT~H^xM1d$UScE?uY_u4R;>xp?TZgLk%^N;1u{&`IW1X z-9));vyW5R3OSA2)aw+DQJfnggcro{I*Ap9BE?L|A4J*}%1moH0-4xU|pS{Jb;LU4D1r_7rkHOy6>)i0OiYg2JdL)$ZN9JF-n%(uH6WS5R{s2iS+31xPTNkfm>}5 zHW4WItwij#&z)$`k`<-3pX}+rJk^vTk`t4YlVcARwM+)9s^Tb8XJJC`L&!l*7k)z0 z(%RMjErr4BlJv@FMncTYyC`R4f^m+OEd*slwJ(OD*wEsh>M+mf&bh4tIrj@D0kdYr z<($0R#>S?Oy^BcTd)JBFTJO%gX5bhlN5m^elyBU^y6r3s;20q$q#|qUcPBHX941!3 z?MTyw6vS+-2}^7?brI^I#HNsi1Cf5UhMmiiUl_z9OvT>=#6hfF9>`IAsTAA)@tm!_VBO zPF;1SDk>;2^%fa_O}Bsl>#Tm9>XtO<@`SX$6E9yY_e%ee+*GQ)T+)lZdQ7KZ%yeR~ zMUPZK0z)2L@2*)Cr&FZ#_oC#`6-P$uU*Y|s^z!tF>r<_v(a{+OIZCrdL~;OWDcM+G zG27F+-a>c!`tR!os__bEJhZR|VrF&gb5clkyrqk8YYB*^Db>p*LOB&)>RGDN($e_g z76YX@0N7%gbwdCZX{`A{XbUUwtb%Gl~O4LgGA` zv4p(EQ}r#?RCpi=V)L!sd~)~aX{r$Y%<5!YyB3t7rl){8K2d+(kTlnNn(R;5evWO?Bj zqz}OlksXCh8>Q2F{$RaYCnzSS=We;Fq)RZuwKuV9k@^A%pInBZ?b=6w?sZQWA%v4o z>^tsU%0Gh`%C7QJOv|i>OE16vIt?9N1TuNW=g)3e8&4rw&Bw?2Kh{ih-0Ky`-RIl$RQ7oJUBVTiA^_5EK7A%nI6& zxb9`0<>W)pp=IRJ&XktM5@y?vwQkwE{j&AsF9H{nCk1^kTUuIP(N2fPRPIww$HKQy zpJEVwSR+H`tA~@lXA;FyP1d2ABUa6gG{nT(zI*>3HEuO3;!6Xl3UAtNKTF!?=a#1u zBeR!f$F(xMdW{4n2KJ~-pUvpB${DqGRNu?ab=__-iF%yBI zp(l@fQ!+(CZR?Y5-d5Y$smqv8)4NEYMbtd9-AWbdg`_DXEq#h&Vq!w(Y3id_fx&9_ zgy${yQUt$0@#)~|MO5@+F6KAPhaR^1@);86E(^-RYtCAA#V+?CujvmOO#Yq~%eemu zs`3}{w=qkWW|a`55O#Jo15!%zxRTgpjWjc(6o=|SYqK&#=+7IoEouBNQjQsALv2OV zp4=TDJ2$V!D=m!=MG7in?Cmog&&|y(=PO6DLvCwBhIq7>E=tsqhn+nMQWA3IrL5fc z_#z&B%C(qs$b91##p`yIjS_a&L1)5xspQJvUFbwb+05*-l~bZa2Y^O@}64e?ns z!P?5oQ%LXv0wrTs4?dKRE$`qr;FI~***RNA{-8fh=2NtoIV&U-edbnqknPRwhJJ_B zls>){7=Gf@oUAUd&xej?MZS%dM)2;-vj^)st;)uShfORjN{p+IT3JoT#-3m;zGAKV zjn1n0jP(!c1H1O^({MCI_AANNq78ojoO}%2<2q0@He04_FN%`e<=?V{lJRhw#MhhI zkyGnVuC96JZ4>BZkIx{Nu9Mmf5gs+IqHF1k5i{t-U9zXQCUbu!swr=$`8l|9nJL6I z&i!mdLj&Q{-Dk_vqmFVyT70rk>A&|1;eKGf@eJzd=Rbb@F^spREqvNsqXRoopO=v zlcVb5jk1>}))=;tjQrGQ$ojvGUD+Aki+j<9Eu%!1g`PB|&E98zc2^@H}H=14?ZMpBxTwj#v67iq`G(XX&-A6L670c#EDO zHzJ}F2XoN`+aBcWp5>`elyOdaua0u-Br;gX<+CGzD$#6y!2#0P|4MrRwG8YqtrF2_ zl~C#?-I72pcWUjyk&djF*x@!<8d`rD(cSZ7ZOXzO(2F&HcqX6Zv9`RvzD}4yC`B++ zRar?OYrZQgDkR^UP0!6WS6ShjteO*_i#Sc9of`SHCb; zDU#zj-kY~h9yu;<5EwzQ=ED|OyS4*?_HO9XvG1Sf$ z*uif%QctduSMIj3J4{}TmT-svD%Ebm-`96`dfM8~?k;Z3#bp`cHz)egnYrU*EbeL( zS0H&^U+kweG&E#q%pZ$%>@h_PiGCcRCSG43mFUE`_c65EIik1mIQe;b>lzzXq{)UY zL3YnW>8U2S`#KAf6S zNA)%QG$%rtDF=Z};7pf>Oe0HR?t$H57F9F5@JaYi7#6ey zAi0Gdf{v!A)dvBjyR*|3D+Y}|_B`;BHsSZOJNBy2ZU71NQ%fL?x&;-fN&T+u1qAIhUDA2muD`Ta&tWn2~i(yGmq{;DQq**Re-#1 zY8aW5LwbF|i!7EsJ@{fyy90IG(Bx#9QB@!+0Ag3n-@@3)R;}SX3(I@%I1(cHO&hna zi@f}g^44OXxp%f`)>{eHX=5er6~jM8NSg5(6OCza2b4;(mv&DA=3 zyZGLBDSK_t$~h#7Xi3kW>#SsbFS#ROZ-a4e(~LPKeWt;qf8W9hK0ZFw7|hHc8XGgQ z_tBzkEHmY!j)y<8%(`C&O)I(DB$NQ5C3~s*`+@Y()6-{Hbhv8){eunb;Gsi+!pKma zxw&qM3#pNE8|m1SCr?mv9%f(|ClXyU+(Z29@9^*1wF?OvwKCoX`cX>i@qt?B-^ZGh zV&=Y(0XpE9%lkP8(6`{%0Pf`F!D1pFP2l{4FV8o~d9nIAk6lIw>6s*r&s`XA?Bl zvHK&T7QrJVn3I2){GE?tg?~2j;^^Ul99KzFiGz>g8Z&%K9uqN)7iRF`;hAJ;kziHu{#ip(aE&+;4ZTfO0Xp4K1M$*BBIE&iS0lG zFJ=G#hz^kcyvZ^|>;~lHL>oq)t@*t-=fwfTj0GBye&i>Es}l9^i(-L!k)g93;gY>blx{F0V8pa_=64DGD=%&!^6)?~J! zR0bHrwS&A^DyWKA6QB*h_5I^RPR(?<2kU!@z%5`6*~cK#TwWeOSFwtUr+E+uG3hT) zF_IE` zm6a9zT6}CQh=Uy9f+&iRxCpHPxL?0McA%=dTGf#ZA_MNp{7EDd2M1ZngbkATq32lF zT&rG#4KHjdglL)rAayJOVR~%wmx*!f!hwU~u^kl++D=zz=cJP?juDJ(|87m*dlW!G z-b|FmUzC^~o)&fp1I#Jd0kyTYaE;E8NHG6is}3z?%*@Q}aUNzc9)vFy35DZ0_8R?} zn-2*IYZ7r6P zlhW__|B&oi>kkSGOA?z(P>ycB!;jTP-GkLFnG}wLn?~y5MS!yI^FOr*$6lhN?IrO` zpTN4nf{g+gHBF*gQXooiq{n2M+;U;Px9_!@1o6!abFF+)@FhuSar$GSX zTI@*y z@~}H@TI`hw%0j;ZUX&Mo-$a${{C&Lhno0It`8-{wQm z`>ZTnX4HHQhdQmcXZ+lJXT9p`|D1b$7 z+-aGbO7@F+>6 zZtfo+??yWZ{>P|>Vc)&u4ve_(n9EP)^qLmO%O#qHl zh~d7Kh-7;vA_4;&V`M4qdjYG6;SeKf%3Zz;TWD6twl=s_$=2*tZPksPg#82nd|+0| zB%_=h;q4{g;EB&Q2f|L@_=r^0Qb(?(5Tp;& z({mliny70CT6Sq^`v7s9(oNNSh^iDPtE9LXkw__8VhuZqV?pTLxka!oOpw^t`|2?aRl5&jO!D)56p9Ega63^0 zyX+Wrh4VSuV>xLZ6Loqwnq9?>35N?pzke`ro4yp68}f@V#to2>0g#$v&ND@mrK%~_ z*S(*DLIS0AHSHPF52`>+#plDe@Z~MNs$_~YkDhU~A;z0JoI_iC5rG+KtTQ4#yxv!x zIZ#)}%Pim(mX?>{;f5Xi4lL=%4<0!1-i2f~el1^swgztLX5kdjE#xGR_djy@FnU?D z=^tMRRd;)emqIiRwDT+@gWvKwpyLb)x>kA(#jkl|Y!&YE*R5MydS3&PM0GPi(XCsS zmz9|Tt2wYA3kwS}=evI24L}i#j9cQJ?yo_qYhMBEgywFcnw06? zyQwlMvU&6DqjLcQ29$_IB5PIvyOL6o!UL7Q;}_W@nmaTMMh`!Szfr=;H+?4Uf}30M zyf>M%-Xv*AUUMm5{^n>3L~^FPU_3OP)jV?aC~?jK=EaP?x%cESCJAJH$8XI~u^U?< zVxldHnkOa%&Bt?s&k%Hedvb=}v291uGf4phrMU!(dk_D!~6vc4lAXfbh zuoRas`xLT^h;&>IG9{B##i_HM*=|cV<5o0w;TFKhb9Af0+`G4hJCEnIHP4V6##5*2 zduVBBlDb=@#=mCdj&L01(t2IehOHsLTtc=%JxZ?*Xa;`PA}JH1lp9`D(z|%-e!9ca zNJ-Dq4-73IyzTC%&-XS#$|0Da(ReIX@Ftyt9okzFS9Xgio8hs{xFm1%&`BA_W}eT$ z$Hfmgo@-gX*Z1cZV}CGiUOV)W)V+9rVBS=s{s)BO?2C~OIoq~v8~K@-?ZyFrs_DCr zk}E&68n<J5mq@1mhjAI+egz%8{*fGxi8P1aXO2qJR{${t7jSa!yfRKuU2o^ zFwEDt8i4g6!x{Vfy_A$~o}oXjgw7=~Vo$4IsNv#0eDL6LS2>^s?-68>^SwQ3Z4_+K zFtRDVx-%sJIJ+tOY_bve8~yJ|NX>0~uPJ{3?BCLR1wxK>!dH|%D63U-Nus@e&nN_{ z)4RcQGe20D%7@z)7?9kgF$xqT4^=@>ypv@Xl8b#?IXOAkDiELso;71|4T+nQwD%z- z4UQb}HR8B|OhqwS#)ClGYcgt2LibSXeHr5v;jmaZvfKw6X zAwAemH-jJo&X7HWTz=6{6=UamB@F!hN$#W9D$v#rx+031dbPdG%Cf}?4Q`{C^w6UY z|0z!9^>@HXdomAyexnCnh~q@+Mjv`we>aBR zSZ2kJ4Jn7l^zxVT;Ka_~BF={N4?Q zdYLB&1xy=1SL#^L#CwH9eOA9Orq7eyJ!8x%KW;2h^O_p(zHVk|UFoR#RV)E(*Nsv{E#@;^WYmPApS-xsy zNZ6D3BFoqKMh~m}i&NT`D8C_5TWIe9icoI;m0)S)MPXR=idSuG?4Xb3nn}yVHwNyu zu10j&hZz}pEGIu6k*X93Ba4(yKcHj&WP%oDaz4BN$Bzl3)^@t4y1Kf)xZ`E)YZ;w= zyKiKE>UCO)2oEQ)R}g-`FS@-O+<!TWE&%|n9_Qdl#t{l};_{+7A8*(%F1g)Xy?Vi6tabc-1!GbFF6z~D0J}pvW3lbz z@L$TxWvFn`sY7l8B!~CGH;iXN1jhEofSzXC-;t?W^Q?Mby`nF;JcHcow2^QPg9#e$ z3|uv1QRJX{dNhx6@Q6(4&(coblpms~<(JWcJ>0)zAN@B#V(31grApW{dsHfMY-Bex z>irhqOGzz&Q|_GX;-C{27M6LM66MaV7G(d>!D+QgS<=1Ywvba#5;QNld9;C2Cu3HJ9JB?~>+0!<(Vj60f>K8%fxxmN5m5~e@zkfpi094sm% zB(zbHac1el0JV)5>WIPfyZQ~&SKAz;4aq{%Z5Kl?9Z7i=dsj|8~o2SIi4*^7; zuNi%pL^Oig{q z$UF1*SpWcjT!r)VomRMA?e%o5$uIVHDe36O6~g(G0NElpg?GwZ6DXqs1K*}!VexzM z;#%1>_Ux&QE}#68;%6@VzGEhv9l?pHnR+dhDlld5F6JoDb!RUoTSO-*9{`GDYV9Gc zS`HIkrc?eluZSkm?(wP-!%tZqFsH%%&G?&^Bqh7NiL9sT9)l+!wF1vQLl~#FI;wp^ zZs#=Sb5N&R#27Rt70*az&Z{`f$;%sC>%0lKPgUK>{b3|MH#hh7>(^$_3(%&VN_c9C zv|pcIWi+)7<+TN9Wpnc)z#>mP4V*udqaKer+q!|Y;)W4u|Hj6~x!yPf9kJubr8fHq z)P@34->OIKjeb7|nxcf_tC)ziC#v`-qmY&sdCER5 zaYSM#D=VvwcH03K86y*u>ICutxrz5`W%4|8A{fFE_D4&`bKeS#DWDgzyIguc;g`oE zBWC=x_HkiAYEQ7S5fU(1Z2f0e-ILDHa&BHp&_t-;suQsDS`GzZBF&zoekGl+b)P!` z%gt0)*?Gox=g;66aoX&T-^hf=(>CKY_ZFgV7FClZEn+Vx5fU1jz*8^) zgr4das?t{z94K(AsiQHfRH?0w58T!7hmL<;qU^uUA!6DKDpY#}=ba*?#evpHMj zLLQM8P1>olbN((}nKGhkT9R%+SJh&On^fxuhDVPc5u$V>U#EQL^HNtBH0%M}kerFr zZnc)xsQvo#Mi#^;-4<{84%$tA+efQz^4g=8>JhO?!sj(-LN0CWMgd177p*^82}C$y zxcWlEzn~gN)7tGl!+r{btxtJ`C9tFYxZLC414ZA{PE*vWJ?r@OcfP7 z=@pP~va+RsP}Jx6^V=Jb5~Um5k>%i)PtT;BU)te>IfEqK%}EXd=l%8lh)6W#5pxK7 zc8pBGT(E|y03Y_)sFHWs@D^*=hq|h&O$dGWmSzTt$Dk0R19Jjt^y>>--{>#OjkGK- zVe}cq8;2sFUcmfFRCJI7Ri^Xd39V(3`7hvPpFVz^+xX$x?=J*3Jg|r4+2C~#>4y}5 zU{AzikX$qnAOw-+VYX~@US6n5E1z5#Oe<0A>Ce3Gx1THs5=G&SsMV}*i`|DgYGect z&={%LqvG}fDV+7yfvO-BZY`tJ=3V*INQA)R(0T8fP;|Ha!PB-Jj-J`wV0>t32-9J@ zaL;IT?W3MRMdi7^3Vo@6u_Ky2K*>xPe6*g0m=C-jjdrHenS`RX;^noeL2&^zZ`eA@ z;rv%d)N{b1ngKEfdfFTSeOeVW0i_Um7U5DOWC=}VH6lp!K-8O(4*p=&1r$)*% zU|`bk#4oYsyh1KmQ`DR22Qga(3@BMrlL3LW>d}wZwzhm)NjdrX=L7`>1q50?ePTI% zy8g0&=9|0;O*1p{(T7qF!U+t*o8aIEtPaVAeu+y9YE(#DYHG$AkB+A0i{^UipuRCP zGt<%0xpCu77Ws=j3ucm!LVZ;X6floLF}d-d@?FVwIRo{_nfC@ zvOI0sbEBpUt2&Z6a@!!j?|K;zA;kU zhX3MpCom`oI33%AcX@e}oq4=_$+-Q_M?7Rp%P+^M3pagN{TvJC}&FgSfM==M;_ej3DzBlAgvdJc2FO)3*7$Ez<&X)bp zuIXr1pK)`1*)NQ=yt1x z8jiY>Pahim;$`@A7XeWgQK4a(3my=46#KkAjh>*SyGzIAXuQp|HiZS`SrO14bM;Mn)B+$6(_A^(nTLa_pW zUFe?63N?$Sb&m}fWD`t=>Sn#AE?9M z>Wua9ELIteM=ZNG9^O22=fwym`O#MGYn|(N!rzvUv@jdZy{?^`xc?d@-S4su!@3Th znWiVlud?{lb=l)b*;_YHkdxZ0qL+mu)zLBifp?zJa(yoQAb-I9SGTS^yEh-_)lU{H z{oh2REn*lL4`fyBp`LO&HU8HoGD{5*l<`>VkIw$Y!ur(bqbBal5cw$JE>lV!LF!tX5)% zGkWCy`t@I~@eK{0y-6eGGhP(nnSCbE;jeA{wlL%USEA~(($(oY3s3qOhRwD7J+YKz zlXPMm!=zj8c-I%TjxC#qRZZTvbTv%o7pm=>cbv#9(VHnM!t>bS_tKI4*t)!*@qhjK zdHcYZ;nP*|k=a`bv-sEJB$~e$X@5(iXeeG_*WWLo^o3Pbfa>k9A@<5&Sey23K7iM> zi$i%^`G3t<`})H=pKtMF)0L z$CP$;wX0xdn|OUiiKh3np)Cd>_Mf*lOxvt1wo8}Zcg>v~Sn{@gO`6^4AGyx*;IdLR zz2GexZo_U~y8Aq6GPnG4z9#+vElXWg!9C~MT9!k@o~3=W7TaCjC;td23hJ_?8L82{ zSGOPx-t(EFP^IpPH;)_bh92f zwBc-0!?Ip?gP>aSu_))L6uq$fjq)FRTgC=>WA$n(Ywc~`4YtvepIqPbsV|*}in}fC z^Lp?Ze$`*w?FYURYl?zp1y?gY@6zMijH?G&2L_{_)4%_&MBbS#hQA@7*N z$3gFVhlNghm-pn^f6v`H=kP9vP+Q{}yb-s}sYtsyo%O-JBy&wg-YBIvTUN`xu8+W9 z=ybSQP$+^VjkoUsd zwF0Nj!S-F>l^tjFtgD(HU4$^zROxuug1c31H@TnvB zrhmErrW$!~*~U6sH1s9MgM1H`-pb&He0fvrE2g`uMxX8z+$*lPO55BgSn#$aqOzOs%8p*}DSc4jm zdT%F>%bI*my6zmDf-;4|q6)qvoDWV53Ax5^+%nIdDClQ&6MrSjZ{B>izO(I9L8?Mf zU{ucVw|0x70IHNyUU$;Zv`;$xmPZCUzjdZ5anEA76}{inl^bmh=Iug$`j~snXx@-- z{7jjJw+%%6V(c7FH8$6gqesTdoTQ_l@{oQ$*gxjk6B-qE>z4L#*p^70ZBC*h-v+3T z#>JXgcH1j>UK{gS4-oF?+{wI3n|~^x*)dzy(IsR3hNh*#n`Q3!c(%0rZk-Po1xQwX zdToLNEGs`BRu=_Ct&O<_p5}KiL5P#`p z{{2uJ<>aet^)IXE>RZ)?Jt@8)!CCsat9aIDU3FY)HGa=zOMTO&;proEEFm9)s&7j) zB|pxn&B6nimFTuPJ0G~dZ=*YA{H3S(#C3Dl?3TwpOLtRh&5yd}Dq1?4Hw}zeU7Q?N zqsmwr{4tm!GVFiqO^k zUD@t5qusa#7nP!?NM)P;+H0IvT#*6&(q~P{ab1#o@Olxl-fe%H`V3on`z$;~e$oQ{ zp&ny=Vr&LirWY(l#x38joJo5`GCS!hX3b;W_MA^D z=Q`;=)gxWq)@yan`}WS!G$h<|vsv~GwJ5e540o~W?%dAlTFsg7Jn>`jNQPf-qN;qZ z0_*l}@Bf?&0!PywiS}$haZcH#_t(6ZMR z?l(W ziW@>_*@#_wcYcm9&wBIOsiZG!-TGAYHS%t zskcx&sDM#{*?qHRE4QL4CJ)jM+%mBU!?|Q9PJI}0VwP?UF>j(uGbD9TW15ysPkP-$ z#{*IjceR@@7-h_77C#FpvNeu0YyRFukeMwvVB{gGH1a8amK0Xb>AT&qwY#kGos`dy zz{b6jlbX4j?owegt7qT==rmg`Xh;6i*y%`_Y z6Pcx7tsd3> zupag14+)KfKI^vRoP#O9+?+ZOZLcW|?FugKf0%FNgA8*LbR z{OZh5?@T=4pG{0NU!Vv@S*+Iy$16s8LuGLLth{m+&G?Tj#dY ze*%M)#3GT3rLI(hxmanubA3u{riE9|E;}=^#H}^)yai=chPQ1*-y`>r;Q{XbhnS^3 zZZzbH?o*;|{j}IX;rpa_d0@wz$kcqhAwC-)n~Tb!$UzZrpBCrMgFaDkoB1%ZxUXh) zt9w^4d;b5`*Ofp+z5ado7P%>Og;Gem$p|;aSh8G^kWn%ArIMw_Qp8xYWJwVULyRF? zj6IC8jY-#1W8arCMi?^o$-d0|AL_j4{NMAQ_nbLr&iT!6p8ffLKhNj$Jm07BuWY&R z(L#f|bsyagaYcozwUXB?4|+%Dbqz7cyheMeMoFI`p&Oo5TZWkrJCp~b=Oj2T5$ZHX z9|YD(HwZ7k`kFJzef_k`I+b=xUymiT0W7!Q=A5HJxw*wAB#c*9dj;$0CSGngAR%jp zE{gD4Q%Il^)`MfE0bH%Snn$fc1RmFH6}tSXeXIZUV%l2jGfTf+PO*wPWjc*s={l+f z*7vl$zfU|xl_&?UCfG7}^i>6X>$(0_QEjMj>%<*_;r`g~H@>)3;NW zzme9eMOhas&7F5HSbB*Np2_Qf&4{!Ouuw1HUg-DLn6{j_L1fwoHg*t8VV(;O_3(2v z2quZgby_axVd%yZT6nxdwF4`gq4V zLzzZ;ueeI^)FkUba!${V)|)S5lxdJIuw5~qd&o?`WPmzr2(Bkn(8n@DM=hA4=qX|2=#MXc_( zQC9$3jvQt5vHsnd3$yGor(k9|wyLG_FU&ff+CeJ7s@)4~QBnNveQ6@|=zgqq%NTbJ zo@=yXyOMYO@y+1t;*gDL-|Un}U~szxpEAM7wv@u=Yd@oT?sv3%f|zYSP6sBnF$JD8 zBwS?TpN{DA7H}M?nEHd-^sm-wIKaFS*5=e^V#z5Iq zPdpo-DK0@VU8DxHF_YXj(U0ChGN7#tD~I-U|MrU?QOTvftntR7be0_(Dxj zC!4caL+f9*Zq{-JN?KaP5{6oIorWmVM~w1C_KNp?@_NcU#qt{7&+WtAy$xE#NY9}c zR1qs;ev1FmJy5UF2AvpU+PFp&R22Na1=>PlQuJ@)@Hn}55*-pYUFY8v*zgIAJekIx z9BK+#IO%elQawA^Z{565`S09FZM9cF|E3knJx}@oA-^}#-qCI|D0qPt^yP_*F?oF^fp|G}vG6`@`RfdO7!7u?4?7}$i0e3i;%RlX*=Wt=LHAuh zz7~h5>WOK&N`_HydJm1jv{;LJU0`MZxgxOwU43@)gtM$^v#5X}VPcj*!N_D;^$~<0 zpV@kDb9JZs7n02?|HD-g)Qiz9C=l?lBmm0{x;Y_N`Wk*kQbrQqByBo^n}tF)NP0?e zS<@WIs=SiYpxR4HzZ}%B7XGGswxh4hW?DV_@0bi^IImF;(Jd5!ETX5!w{BE~s4@2u z1sh4z@R;x)*8W#Q@Y=AZ^Flt6r~k38w}fbNB3hJ5m9(0TGrp45Sy{bbT!JBf0P*h8 z6Sq*i`G|ad>`7aeuLkE^6dF1aa#XaAQDF6liPJzMKRzOCOTldpzWld1WS?xeYY{GQm3YHY1Os(tj7;agSWPiWiivb50jGkD~02{{p7918Vm>)^{9a5 zB}?wT_2<%st&TWVS?j6~M=q&)d}Hhw;@dHbW`q|82TXOchh452PET_nkF8VQnho?T zOF<1eyVA`wi$Eop%ZwMWCdWoyd9uPcsj6g>b_ss>o-><|_dq`>xJi8LY5YG>DG5XK zQ|1ZB^32ZEezTwFz%3209fW_|)v^HdL`8+huN+?ZyLjva z*u2q?8TDT&Xuo44zdioj&vhL?xX*p7sX?ri+hwxeD9x>^kW){**s{!wrRc6e+_{&K z1Kez6gp_;3hp4NlC}CO$>|&2oG^WbwS(M07;Pw~{ZXA_eBITb(P!9c)T&_NMwc48^ zdz~2cU+}E`$L}sK3eN(g^f`FX6-YP&2QXU z!BF{={rMDi+}3hP)tT6A4J;o0gea4)ttwKk4&IY~3rz+={Z=zEqk zITri}<)0R>_(zL&8<2aGV~CM*%yF9SVrT9a3l)XRLrOn;Qkfn0yw5+e^`#S~0h+&Tu4vEv`8hpLbs-(EH0$5ej+*f zU4f6sPNaC+V8zp6^;jj*hQP*di)?-4}|ndMF?5!GF?3c8JRDypuMnyETpVHD3F z5`esd@6te2w^i2ll?14~9uDV2BtN;~6kg|Mt4ttP6clAF+O<(JTk)@W&ubo882wO7 zzoj}XZ~bG+`;?1m1#gD`WtM27K_cF}pH-{=!#B0kzjvkZJ;HH!?h_1$Na7Nk9GL

+oVXlQ;cv_4J4I>Kcj8M<$Nr&t7jZT^oneBurBkC)sjF@cBsYDW-5Rg_^4qMX;*ZVLV7kd%x~9VFCD4bfY8 zG9BI&yGjiBG5ee}Oa}P)OMMe7wQiEpH>XmU{SiN#3~iPo>loU;D_!FHYthA4fda#w zfIl=h_kz_`RbeqvDBs+LT0{I!<#gz+C`Z@A>JwKqCr7@>N=kZ^l-*e$T)g_s!n)h5 z4L#9^d#|V0B3DekAT90jwB$A;rxQpyKQ+0U z#z+k?*?Gh~w~9@Oj|YweU3z!E>#|@NZ`*-dlUljq$u*3l4e=gmOG9~{s`7$4thwm< z9Q(sAF8uE{zr3jOpCOJC?+GG=QfG(iEv3eyw-+AvYHp(?)ohx8`gI}PZGc84)wF_SstdU!l)Lf-zh1b zL#I4Rl+&JC822#V4kFHiuvK1_gw~L#oQiw|H7AR$u(LzHYrXb^!v7%hti~((;+Wz@7lfPa$>Oq zxCJ&Z?eLP9pG<9we#Z*9T9uTv;#UwBg=$PUS`K6xP&00mKLjw?*B|HYEvpZ&t@#&d z!=*^$-|isE3ll!;#+%ohL(?htp95zn+9YTA3m>Ln(9~?tH-D~O5qdJY!Y-zDTXzQe zHk@(TRe|B&m-NBX!lYtRYp#5KAg!0%&xGu=ar35T1ThhzN}wg$@fEjPZ|;Kk!@$Ng zkfmV<>5r8sc$1^*CRVj6%k7Sq>eNz8N4ClD|6ou%JN}dD>%heGAIq z8gQnlB55Da!p-1hkGT=-#${Lqm%etM>pSVk-@v@<>1I)`c6_*|6VQndK zh|K6OlXm-F8V#Zr>^JDh(-NE)*3qrSB9@%8Dh^09wB1SyxY_JZq4j9??IR)LSJYy0E}Eu zH$fmhoUO)lnb4K?Wr845d}>nJIQmAq#i=BPDnrAyM~31-`t19}DjSb2m|EDyA|pY@ zL&0%J^Be(bk2JtGtkHQHdy32N*H`Gg-M!Q}ub}rj;0n6;e*!5Nur(;{`J@i+_vVmB zFn%5$eEfD_1zGB3J?JvIw)zAaP-?opIOLFhdhe&|I%3;;Q*mt3T)2gvFRgO$Z7ver3qk*A8?Wr-P60{nS~K#XmK> zteyCvI-vkm8_uOCzcdmJPx-OsPS6eI2aX@x{mgMy)ZKD*f{TPKljN-SkvjyvXg0>zx|xX@NdCzAOo=7ifjF)^MrVx+jiHj`l*CCZ0!v? zb*8S$OC4t$8S#XF_V&$a7*x#1*a2xK%8NIqRj8#vjeURn$fG(BK_fx`O%G5lgWDlt z8&Ge_3?5YIzKrroeDa5Mjrve|oLBDKrlSkWzPB8I$vRiv|1`P`q?~R1Zr7Et+<)?= zVnlj}$ZfAa{M3kIij1Co1-C+vt%qE?qK)e(STDs9hM}wLS&~1Mw@}`*m*gjMR3!o^ zqL|dAYY1a;Ko$EUIcLaNc0%QTUD#d-N9zs($O6n0;EB40;0b_=0VWCnvPXO)Z~A}c zmHX!P+{ooW5+`E2L80yxJ2*a=o*KDuq0-#ADJ_}jE%wzbU;w=o5@6gFuI=2Tt}y0N z`XTwJNcWQLCqGNW_Fm|x5Vj}fgRb5?TDSkTFBI(w_WSzv|M~D&3j00(KX3l`!~d3l pf4%wN5C2!b`(KH5*PX!*nW(+8>T1KZiZt&A{|EERQM>>E literal 0 HcmV?d00001