From 52e3f66588d67d9d2614bb1d823049783e45d150 Mon Sep 17 00:00:00 2001 From: Karuna-Mendix Date: Thu, 6 Feb 2025 16:20:42 +0530 Subject: [PATCH 01/11] Describe user provisioning --- .../modules/oidc.md | 171 +++++++++++------- 1 file changed, 102 insertions(+), 69 deletions(-) diff --git a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md index cc7f4946d59..ba664fb3c2c 100644 --- a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md +++ b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md @@ -484,84 +484,56 @@ When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module cons ## User Provisioning -Initially your app will not have any end-users. The OIDC module provides so-called Just-In-Time (JIT) user provisioning. This means that an end-user will be created in your app when they log in for the first time. If you do not want JIT user provisioning, it is possible to disable it as described in the section [Custom User Provisioning at Runtime](#custom-provisioning-rt). +Initially, your app will not have any end-users. You can on-board end-users into your app using one of the following mechanisms: -By default, end-users are provisioned using the `Account` object in the Administration module. If you need to use a custom user entity you can do this via [Custom User Provisioning Using a Microflow](#custom-provisioning-mf) or (in version 3.0.0 and above) [Deploy-time User Provisioning Configuration](#custom-provisioning-dep) or [Custom User Provisioning at Runtime](#custom-provisioning-rt). +1. An admin user can manually create users in your app. The Administration helps you to implement this. +2. Use the SCIM protocol to let your IdP create and/or deactivate end-users. The SCIM module helps you implement mechanism. For more information, see [SCIM](/appstore/modules/scim/). +3. In the Just-in-time user provisioning, users will be created when they successfully login via SSO. Both SAML and OIDC SSO support this mechanism. If you do not want JIT user provisioning, it is possible to disable it as described in the section [Runtime configuration of end-user on-boarding](#custom-provisioning-rt) below. +4. Proprietary user provisioning. The Mendix Low-Code platform offers the flexibility to develop a customized user provisioning mechanism. -### Default User Provisioning +The OIDC SSO module supports two methods for configuration of user provisioning: -By default, the `CUSTOM_UserProvisioning` microflow in the **USE_ME** > **1. Configuration** folder of the OIDC module uses the `OIDC_CustomUserParsing_Standard` microflow. This applies the following mapping: +1. Deploy-time configuration: this approach allows fully automated configurations in your CI/CD pipeline. Mendix recommends this approach for customers with an ever-growing portfolio of Mendix applications. +2. Runtime configuration: this approach may be the preferred method for configuration if you are not yet familiar with configuring various settings correctly. Additionally, this method is essential when connecting multiple IdPs to a single application. -| ID-token Provided by your IdP | Attribute of `Administration.Account` Object | -| ----------------------------- | ----------------------------- | -| sub | Name | -| name | Fullname | -| email | Email | - -{{% alert color="warning" %}} -Do not change the `OIDC_CustomUserParsing_Standard` microflow. This may give problems if you upgrade to a newer version of the OIDC SSO module. Apply customizations to the `CUSTOM_UserProvisioning` microflow only. -{{% /alert %}} - -### Custom User Provisioning{#custom-provisioning} - -If you create custom user entities as specializations of the `System.User` entity, you can store user information that is more extensive than is possible with the `System.User` or `Administration.Account` entities. You can use these specializations as target entities for end-user provisioning using one of the methods described below. - -If you connect multiple IdPs to your Mendix app, you can use separate custom user entities for each IdP, each with its own attribute mapping. - -#### Custom User Provisioning Using a Microflow{#custom-provisioning-mf} - -{{% alert color="warning" %}} -This feature is deprecated from the version 3.0.0 of the module. -{{% /alert %}} - -Review the microflow `CUSTOM_UserProvisioning` in the **USE_ME** > **1. Configuration** folder of the OIDC module. This is where you can change the way that end-users are provisioned in your app. The OpenID token is passed to the microflow as a parameter. Use this object to find an existing, or create a new, `System.User` object for the end-user. This is set as the return value of the microflow. You can find examples included in the **USE_ME** > **1. Configuration** > **User Provisioning Examples** folder. - -Make a single call from `CUSTOM_UserProvisioning` to your own module where you implement the provisioning flow you need. This way, it will be easy to install new versions of the OIDC SSO module over time without overwriting your custom provisioning. +By default, end-users are provisioned using the `Account` object in the Administration module. If you need to use a custom user entity you can do this via [Runtime configuration of end-user on-boarding](#custom-provisioning-rt) or [End-user on-boarding at Deploy-time](#custom-provisioning-dep). -The OIDC SSO module supports multiple IdPs. Since each provider can provide user data in a different format, you may want to use multiple provisioning flows. The microflow should contain the prefix `OIDC_CustomUserParsing`. See the microflow `UserProvisioning_Sample` for an example and details on how to do this. +### Configuring User Provisioning for Version 3.0.0 and Above -#### Deploy-time User Provisioning Configuration{#custom-provisioning-dep} - -{{% alert color="info" %}} -This feature is available in version 3.0.0 and above -{{% /alert %}} +#### End-user on-boarding at Deploy-time{#custom-provisioning-dep} You can set up custom user provisioning by setting constants when you deploy your app. This has the following limitations compared to setting up provisioning using a microflow or changing the settings at runtime: * You need to restart your app to apply changes to the constants * You cannot set custom mapping of IdP claims to attributes of your custom user entity -You can set up custom user provisioning by setting the following constants. You can set default values when you build your app, but can override these in the app's environment. +You can set up custom user provisioning by setting the following constants. You can set default values when you build your app but can override these in the app's environment. | Constant | Use | Notes | Example | | --- | --- | --- | --- | | CustomUserEntity | a custom user entity | in the form `modulename.entityname` – a specialization of `System.User` | `Administration.Account` | | PrincipalEntityAttribute | the attribute holding the unique identifier of an authenticated user | | `Name` | | PrincipalIdPAttribute | the IdP claim which is the unique identifier of an authenticated user | | `sub` | -| AllowcreateUsers | allow to create users in the application | *optional* | `True` | -| Userrole | the role which will be assigned to newly created users | *optional* - The Userrole is assigned only at user creation and remains unchanged even when the user's details are updated
- No bulk update for existing users when the default userrole changes | `User` | -| UserType | assign user type to the created users | *optional* | `Internal` | +| AllowcreateUsers | allows to create users in the application | *optional* | `True` | +| Userrole | the role that will be assigned to newly created users | *optional* - Default Userrole is assigned only at user creation
- User updates do not change the default role
- No bulk update for existing users when the default userrole changes | `User` | +| UserType | assigns usertype to the created user | *optional* | `Internal` | | CustomUserProvisioning | a custom microflow to use for user provisioning | *optional* – in the form `modulename.microflowname` – the microflow name must begin with the string `UC_CustomProvisioning` | `Mymodule.UC_CustomProvisioning` | -#### Custom User Provisioning at Runtime{#custom-provisioning-rt} - -{{% alert color="info" %}} -This feature is available in version 3.0.0 and above -{{% /alert %}} +#### Runtime configuration of end-user on-boarding{#custom-provisioning-rt} -You can set up custom user provisioning once your app is running using the `OIDC.OIDC_Client_Overview` page that you set up for the administrator for the app in [Configuring Navigation](#configure-nav). You can set up custom user provisioning as follows: +You can set up just-in-time user provisioning as follows: 1. Sign in to the running app with an administrator account. -2. Navigate to the `OIDC.OIDC_Client_Overview` page set up in the app navigation. -3. Select the **Provisioning** tab. -4. Set up the following information: +2. Navigate to the `OIDC.OIDC_Client_Overview` page which is set up in the app navigation. +3. In the **IdPs for SSO and API security** tab, click **New** and access the **UserProvisioning** tab. +4. Set up the following fields: - * **Custom user Entity (extension of System.User)** – the Mendix entity in which you will store and look up the user account. If you are using the [Administration module](https://marketplace.mendix.com/link/component/23513), this would be `Administration.Account`. + * **Custom user Entity (extension of System.User)** – the Mendix entity where you will store and look up the user account. If you are using the [Administration module](https://marketplace.mendix.com/link/component/23513), this would be `Administration.Account`. * **The attribute where the user principal is stored** – unique identifier associated with an authenticated user. - * **Allow the module to create users** – this enables the module to create users based on user provisioning and attribute mapping configurations. When disabled, it will still update existing users. However, for new users, it will display an exception message stating that the login action was successful but no user has been configured. + * **Allow the module to create users** – this enables the module to create users based on configurations of user provisioning and attribute mapping. When disabled, it will still update existing users. However, for new users, it will display an exception message stating that the login action was successful but no user has been configured. * By default, the value is set to ***Yes***. - * **Default Userrole** – the role assigned to newly created users and remains unchanged even when the user's details are updated. You can select one default user role. To assign additional roles, use the Access Token Parsing Microflow. If the Access Token Processing Microflow is selected, OIDC verifies the updated default role configuration and applies any changes to the user's role. Note that, bulk updates for existing users are not automated when the default role configuration is changed. - * **User Type** – this allows you to configure end-users of your application as internal or external. It is created upon the creation of the user and updated each time the user logs in. + * **User role** – the role which will be assigned to newly created users. You can select one default user role. If you need additional user roles, use Access Token Parsing microflow to assign multiple roles. + * **User Type** – this allows you to configure end-users of your application as internal or external. * By default, the value is set to ***Internal***. 5. Under **Attribute Mapping**, for each piece of information you want to add to your custom user entity, select an **IdP Attribute** (claim) and specify the **Configured Entity Attribute** where you want to store the information. @@ -572,26 +544,86 @@ You can set up custom user provisioning once your app is running using the `OIDC * You can map multiple **IdP Attribute** (claims) to a **Configured Entity Attribute** but you cannot map a new **IdP Attribute** to a **Configured Entity Attribute** if it is already mapped. * The **IdP Attribute** is one of the fixed claims supported by the OIDC SSO module. * IdP Attributes(Claims) cannot be of type enum, autonumber, or an association. - * The image below shows you the default attribute mapping for the configuration. - {{< figure src="/attachments/appstore/platform-supported-content/modules/oidc/default_mapping.png" max-width=80% >}} +6. Optionally, you can select the microflow in the **Custom UserProvisioning** field to use custom logic for user provisioning. For more information, see the [Customizing User Provisioning Using a Microflow at Runtime](#microflow-at-runtime) section below. -6. Optionally, you can use the custom logic in the **User Provisioning**. In the **Custom UserProvisioning** field, select a microflow you want to run for custom user provisioning. The custom microflow name must begin with the string `UC_CustomProvisioning` and requires the following parameters: + {{% alert color="info" %}} +If you are using module version 3.2.0 and below, you will need to refresh the module containing your microflow as described in the [Installing Mx Model Reflection](/appstore/modules/oidc/#mxmodelreflection) and select the microflow in the **Custom UserProvisioning** field. + {{% /alert %}} - 1. **UserInfoParameter(UserCommons.UserInfoParam)**: A Mendix object containing user claims information through its associated objects. You can use this parameter to retrieve user provisioning configuration information. - 2. **User(System.User)**: A Mendix object representing the user to be provisioned. Ensure that the selected microflow matches this parameter signature. +7. Click **Save** to save the configuration. - The microflow must return a **System.User** object to ensure proper user provisioning and updates. It will be executed after user creation or update of user. However, starting from version 2.0.0 of the UserCommons module, this is no longer mandatory. If you have added a new microflow, you will need to refresh the module containing your microflow as described in the [Installing Mx Model Reflection](#mxmodelreflection). This selection can be blank if you do not want to add custom logic. +By default, users are provisioned by [Default User Provisioning Configuration](#default). Optionally, you can customize user provisioning by [Modifying default Attribute Mapping](#modify-default), [User Provisioning Using Your Custom User Entity](#custom_user_entity), or [User Provisioning Using a Microflow at Runtime](#microflow-at-runtime). -7. Click **Save** to save the configuration. +{{% alert color="info" %}} +If you connect multiple IdPs to your Mendix app, you can use separate custom user entities for each IdP, each with its own attribute mapping. +{{% /alert %}} + +##### Default User Provisioning Configuration{#default} + +The User Provisioning configuration fields are available in the **UserProvisioning** tab. In default configuration, the custom user entity is set as `Administration.Account`, the principal attribute is set as `Name`, and the default attribute mapping is provided. + +{{< figure src="/attachments/appstore/platform-supported-content/modules/oidc/default_provisioning.png" max-width=80% >}} - {{< figure src="/attachments/appstore/platform-supported-content/modules/oidc/user commons.png" max-width=80% >}} +###### Modifying Default Attribute Mapping{#modify-default} + +Optionally, you can change the default **IdP Attribute** or the **Configured Entity Attribute**, by editing the mapping in the **Attribute Mapping** section within the **UserProvisioning** tab. + +##### User Provisioning Using Your Custom User Entity{#custom_user_entity} + +If you want to use your custom user entity which is a specialization of the `System.User` entity to store user information, select it in the **Custom user Entity (extension of System.User)** field by replacing the `Administration.Account` entity. + +##### User Provisioning Using a Microflow at Runtime{#microflow-at-runtime} + +If you want to use a custom user entity that is not a specialization of the `System.User` entity, you can: + +* Configure a subclass of `System.User` as the Just In Time Provisioning entity. +* Build a custom microflow (e.g., `UC_CustomProvisioning`) to create or handle your user provisioning logic based on your specific requirements. + +Select it in the **Custom UserProvisioning** field. The custom microflow name must begin with the string `UC_CustomProvisioning` and requires the following parameters: + +* **UserInfoParameter(UserCommons.UserInfoParam)**: A Mendix object containing user claims information through its associated objects. You can use this parameter to retrieve user provisioning configuration information. +* **User(System.User)**: A Mendix object representing the user to be provisioned. Ensure that the selected microflow matches this parameter signature. + +The custom microflow will be executed after the user is created or updated. + + + +### Configuring User Provisioning for Version 2.4.0 and Below + +The section below shows the methods to configure user provisioning when using OIDC module version 2.4.0 or below. + +#### Default User Provisioning + +By default, the `CUSTOM_UserProvisioning` microflow in the **USE_ME** > **1. Configuration** folder of the OIDC module uses the `OIDC_CustomUserParsing_Standard` microflow. This applies to the following mapping: + +| ID-token Provided by your IdP | Attribute of `Administration.Account` Object | +| ----------------------------- | ----------------------------- | +| sub | Name | +| name | Fullname | +| email | Email | + +{{% alert color="warning" %}} +Do not change the `UserProvisioning_StandardOIDC` microflow. This may cause problems if you upgrade to a newer version of the OIDC SSO module. Apply customizations to the `CUSTOM_UserProvisioning` microflow only. +{{% /alert %}} + +#### User Provisioning Using a Microflow{#custom-provisioning-mf} + +{{% alert color="warning" %}} +Since this feature is deprecated from version 3.0.0 of the module, you can do the custom user provisioning at runtime or deploy-time. For more information, see the [User Provisioning at Runtime](#custom-provisioning-rt) and [User Provisioning at Deploy-time](#custom-provisioning-dep) sections above. +{{% /alert %}} + +Review the microflow `CUSTOM_UserProvisioning` in the **USE_ME** > **1. Configuration** folder of the OIDC module. This is where you can change the way that end-users are provisioned in your app. The OpenID token is passed to the microflow as a parameter. Use this object to find an existing, or create a new, `System.User` object for the end-user. This is set as the return value of the microflow. You can find examples included in the **USE_ME** > **1. Configuration** > **User Provisioning Examples** folder. + +Make a single call from `CUSTOM_UserProvisioning` to your own module where you implement the provisioning flow you need. This way, it will be easy to install new versions of the OIDC SSO module over time without overwriting your custom provisioning. + +The OIDC SSO module supports multiple IdPs. Since each provider can provide user data in a different format, you may want to use multiple provisioning flows. See the microflow `UserProvisioning_Sample` for an example and details on how to do this. ### Evaluating Multiple User Matches Review the custom microflow `evaluateMultipleUserMatches` in the **USE_ME** folder. The module tries to find the user corresponding to the given username. This microflow is triggered when multiple matching `System.User` records are found. -You can customize this microflow to determine the correct user. The resulted user instance will be signed in to the application and passed on to any other microflow. However, Mendix recommends using provided unique entity attribute only. For example, `System.User.Name`. +You can customize this microflow to determine the correct user. The resulting user instance will be signed in to the application and passed on to any other microflow. However, Mendix recommends using the provided unique entity attribute only. For example, `System.User.Name`. ### User Identifiers in the OIDC and SCIM Protocols @@ -603,15 +635,15 @@ When using OIDC SSO with Entra ID, user identifiers need to be configured correc Entra ID uses two immutable identifiers for a user: -* The user’s object ID: The user's object ID uniquely identifies a user, making it ideal for crosslinking users across different applications. For example, B2E application used across the company can use the object ID as a unique identifier. -* The user’s pairwise unique identifier: It is also known as a locally unique identifier and is derived from the combination of the user's object ID and the application's identifier. This means it cannot be used to crosslink a user across different applications. For example, applications that need additional privacy can use locally unique identifiers to avoid cross linking of users. +* The user’s object ID: The user's object ID uniquely identifies a user, making it ideal for crosslinking users across different applications. For example, B2E applications used across the company can use the object ID as a unique identifier. +* The user’s pairwise unique identifier: It is also known as a locally unique identifier and is derived from the combination of the user's object ID and the application's identifier. This means it cannot be used to crosslink a user across different applications. For example, applications that need additional privacy can use locally unique identifiers to avoid cross-linking of users. Role of user identifiers in OIDC and SCIM protocols: -* OIDC protocol can use both types of identifiers based on use case: +* OIDC protocol can use both types of identifiers based on the use case: * The ID token contains a `sub` claim, which includes the pairwise unique identifier (locally unique identifier). - * The ID-token also contains an `oid` claim, which includes the user’s object ID. + * The ID token also contains an `oid` claim, which includes the user’s object ID. * SCIM: @@ -619,12 +651,12 @@ Role of user identifiers in OIDC and SCIM protocols: #### Guidance on User Identifier{#guidance-user-identifier} -The default behavior for the OIDC SSO module is to persist the value of the `sub` claim in the system.user.name attribute. This is not forward compatible with the introduction of SCIM. Therefore, for B2E applications connected with Entra ID for SSO, Mendix recommends the following: +The default behavior for the OIDC SSO module is to persist the value of the `sub` claim in the system.user.name attribute. This is not forward-compatible with the introduction of SCIM. Therefore, for B2E applications connected with Entra ID for SSO, Mendix recommends the following: -* For any new application, use the `oid` claim as user identifier by modifying the user provisioning flow. This will allow you to introduce SCIM. +* For any new application, use the `oid` claim as a user identifier by modifying the user provisioning flow. This will allow you to introduce SCIM. * For existing applications that do not persist user-specific application data (other than system.user or administration.account), modify the user provisioning flow to use the `oid` claim instead of the `sub` claim. Delete all system.user and administration.account records to remove old user data. This will re-provision the users, allowing you to introduce SCIM. -* For existing applications that do not need to use SCIM, you can continue to use default `sub` claim value or any other claim such as `preferred_username`. -* For existing applications where you want to introduce SCIM, you will need to define a migration strategy for the identifiers. +* For existing applications that do not need to use SCIM, you can continue to use the default `sub` claim value or any other claim such as `preferred_username`. +* For existing applications where you want to introduce SCIM, you need to define a migration strategy for the identifiers. #### Configuring `oid` Claim in the OIDC SSO @@ -634,6 +666,7 @@ By default, the `WellKnownendpoint` (Automatic configuration URL) does not inclu 2. Select **Search** and click **New**. 3. Create `oid` claim and map it to the Entity Attribute. + ## API Authentication {#api-authentication} You can create your own APIs within your Mendix app and secure the end point over OIDC using a custom authentication microflow. To do this: From 14cc484dc85cd4e3d92baa9e2aefdafbb06f0ba2 Mon Sep 17 00:00:00 2001 From: Karuna-Mendix Date: Mon, 10 Feb 2025 18:07:50 +0530 Subject: [PATCH 02/11] Mention default user provisioning first. --- .../modules/oidc.md | 52 ++++++++++--------- 1 file changed, 27 insertions(+), 25 deletions(-) diff --git a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md index ba664fb3c2c..f196f405499 100644 --- a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md +++ b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md @@ -500,7 +500,7 @@ By default, end-users are provisioned using the `Account` object in the Administ ### Configuring User Provisioning for Version 3.0.0 and Above -#### End-user on-boarding at Deploy-time{#custom-provisioning-dep} +#### Deploy-time configuration of end-user on-boarding{#custom-provisioning-dep} You can set up custom user provisioning by setting constants when you deploy your app. This has the following limitations compared to setting up provisioning using a microflow or changing the settings at runtime: @@ -516,7 +516,7 @@ You can set up custom user provisioning by setting the following constants. You | PrincipalIdPAttribute | the IdP claim which is the unique identifier of an authenticated user | | `sub` | | AllowcreateUsers | allows to create users in the application | *optional* | `True` | | Userrole | the role that will be assigned to newly created users | *optional* - Default Userrole is assigned only at user creation
- User updates do not change the default role
- No bulk update for existing users when the default userrole changes | `User` | -| UserType | assigns usertype to the created user | *optional* | `Internal` | +| UserType | assigns user type to the created user | *optional* | `Internal` | | CustomUserProvisioning | a custom microflow to use for user provisioning | *optional* – in the form `modulename.microflowname` – the microflow name must begin with the string `UC_CustomProvisioning` | `Mymodule.UC_CustomProvisioning` | #### Runtime configuration of end-user on-boarding{#custom-provisioning-rt} @@ -526,32 +526,50 @@ You can set up just-in-time user provisioning as follows: 1. Sign in to the running app with an administrator account. 2. Navigate to the `OIDC.OIDC_Client_Overview` page which is set up in the app navigation. 3. In the **IdPs for SSO and API security** tab, click **New** and access the **UserProvisioning** tab. -4. Set up the following fields: + +##### Default User Provisioning Configuration{#default} + +The User Provisioning configuration fields are available in the **UserProvisioning** tab. In default configuration, the custom user entity is set as `Administration.Account`, the principal attribute is set as `Name`, and the default attribute mapping is provided. + +{{< figure src="/attachments/appstore/platform-supported-content/modules/oidc/default_provisioning.png" max-width=80% >}} + +###### Modifying Default Attribute Mapping{#modify-default} + +Optionally, you can change the default **IdP Attribute** or the **Configured Entity Attribute**, by editing the mapping in the **Attribute Mapping** section within the **UserProvisioning** tab. + +##### User Provisioning Using Your Custom User Entity{#custom_user_entity} + +If you want to use your custom user entity which is a specialization of the `System.User` entity to store user information, select it in the **Custom user Entity (extension of System.User)** field by replacing the `Administration.Account` entity. + +If you connect multiple IdPs to your Mendix app, you can use separate custom user entities for each IdP, each with its own attribute mapping. You can set up custom user provisioning as follows: + +1. Set up the following fields: * **Custom user Entity (extension of System.User)** – the Mendix entity where you will store and look up the user account. If you are using the [Administration module](https://marketplace.mendix.com/link/component/23513), this would be `Administration.Account`. * **The attribute where the user principal is stored** – unique identifier associated with an authenticated user. * **Allow the module to create users** – this enables the module to create users based on configurations of user provisioning and attribute mapping. When disabled, it will still update existing users. However, for new users, it will display an exception message stating that the login action was successful but no user has been configured. * By default, the value is set to ***Yes***. - * **User role** – the role which will be assigned to newly created users. You can select one default user role. If you need additional user roles, use Access Token Parsing microflow to assign multiple roles. - * **User Type** – this allows you to configure end-users of your application as internal or external. + * **User role** (optional) – the role which will be assigned to newly created users. This is optional and will be applied to all IdPs. You can select any one default user role or keep the field empty. If you need additional user roles, use Access Token Parsing microflow to assign multiple roles. + * By default, the value is set to ***User***. + * **User Type** – this allows you to configure end-users of your application as internal or external. It is created upon the creation of the user and updated each time the user logs in. * By default, the value is set to ***Internal***. -5. Under **Attribute Mapping**, for each piece of information you want to add to your custom user entity, select an **IdP Attribute** (claim) and specify the **Configured Entity Attribute** where you want to store the information. +2. Under **Attribute Mapping**, for each piece of information you want to add to your custom user entity, select an **IdP Attribute** (claim) and specify the **Configured Entity Attribute** where you want to store the information. Note the following: * You cannot use the IdP claim which is the primary attribute identifying the user and you cannot use the attribute you set in **The attribute where the user principal is stored**. - * You can map multiple **IdP Attribute** (claims) to a **Configured Entity Attribute** but you cannot map a new **IdP Attribute** to a **Configured Entity Attribute** if it is already mapped. + * You can map only one IdP claim to a Custom user Entity attribute. * The **IdP Attribute** is one of the fixed claims supported by the OIDC SSO module. * IdP Attributes(Claims) cannot be of type enum, autonumber, or an association. -6. Optionally, you can select the microflow in the **Custom UserProvisioning** field to use custom logic for user provisioning. For more information, see the [Customizing User Provisioning Using a Microflow at Runtime](#microflow-at-runtime) section below. +3. Optionally, you can select the microflow in the **Custom UserProvisioning** field to use custom logic for user provisioning. For more information, see the [Customizing User Provisioning Using a Microflow at Runtime](#microflow-at-runtime) section below. {{% alert color="info" %}} If you are using module version 3.2.0 and below, you will need to refresh the module containing your microflow as described in the [Installing Mx Model Reflection](/appstore/modules/oidc/#mxmodelreflection) and select the microflow in the **Custom UserProvisioning** field. {{% /alert %}} -7. Click **Save** to save the configuration. +4. Click **Save** to save the configuration. By default, users are provisioned by [Default User Provisioning Configuration](#default). Optionally, you can customize user provisioning by [Modifying default Attribute Mapping](#modify-default), [User Provisioning Using Your Custom User Entity](#custom_user_entity), or [User Provisioning Using a Microflow at Runtime](#microflow-at-runtime). @@ -559,20 +577,6 @@ By default, users are provisioned by [Default User Provisioning Configuration](# If you connect multiple IdPs to your Mendix app, you can use separate custom user entities for each IdP, each with its own attribute mapping. {{% /alert %}} -##### Default User Provisioning Configuration{#default} - -The User Provisioning configuration fields are available in the **UserProvisioning** tab. In default configuration, the custom user entity is set as `Administration.Account`, the principal attribute is set as `Name`, and the default attribute mapping is provided. - -{{< figure src="/attachments/appstore/platform-supported-content/modules/oidc/default_provisioning.png" max-width=80% >}} - -###### Modifying Default Attribute Mapping{#modify-default} - -Optionally, you can change the default **IdP Attribute** or the **Configured Entity Attribute**, by editing the mapping in the **Attribute Mapping** section within the **UserProvisioning** tab. - -##### User Provisioning Using Your Custom User Entity{#custom_user_entity} - -If you want to use your custom user entity which is a specialization of the `System.User` entity to store user information, select it in the **Custom user Entity (extension of System.User)** field by replacing the `Administration.Account` entity. - ##### User Provisioning Using a Microflow at Runtime{#microflow-at-runtime} If you want to use a custom user entity that is not a specialization of the `System.User` entity, you can: @@ -587,8 +591,6 @@ Select it in the **Custom UserProvisioning** field. The custom microflow name mu The custom microflow will be executed after the user is created or updated. - - ### Configuring User Provisioning for Version 2.4.0 and Below The section below shows the methods to configure user provisioning when using OIDC module version 2.4.0 or below. From 9cbbef34647f886ae9510e56b2a853215b36099a Mon Sep 17 00:00:00 2001 From: Karuna-Mendix Date: Mon, 10 Feb 2025 18:21:36 +0530 Subject: [PATCH 03/11] More feedbacks --- .../platform-supported-content/modules/oidc.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md index f196f405499..1dd67a3e0ac 100644 --- a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md +++ b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md @@ -496,13 +496,13 @@ The OIDC SSO module supports two methods for configuration of user provisioning: 1. Deploy-time configuration: this approach allows fully automated configurations in your CI/CD pipeline. Mendix recommends this approach for customers with an ever-growing portfolio of Mendix applications. 2. Runtime configuration: this approach may be the preferred method for configuration if you are not yet familiar with configuring various settings correctly. Additionally, this method is essential when connecting multiple IdPs to a single application. -By default, end-users are provisioned using the `Account` object in the Administration module. If you need to use a custom user entity you can do this via [Runtime configuration of end-user on-boarding](#custom-provisioning-rt) or [End-user on-boarding at Deploy-time](#custom-provisioning-dep). +By default, end-users are provisioned using the `Account` object in the Administration module. If you need to use a custom user entity you can do this via [Runtime configuration of end-user on-boarding](#custom-provisioning-rt) or [Deploy-time configuration of end-user on-boarding](#custom-provisioning-dep). ### Configuring User Provisioning for Version 3.0.0 and Above #### Deploy-time configuration of end-user on-boarding{#custom-provisioning-dep} -You can set up custom user provisioning by setting constants when you deploy your app. This has the following limitations compared to setting up provisioning using a microflow or changing the settings at runtime: +You can set up custom user provisioning by setting constants when you deploy your app. You do not need local MxAdmin user to do the necessary configurations. This is an automatable configuration in the CICD pipeline. However, the configuration has the following limitations compared to setting up provisioning using a microflow or changing the settings at runtime: * You need to restart your app to apply changes to the constants * You cannot set custom mapping of IdP claims to attributes of your custom user entity @@ -541,7 +541,7 @@ Optionally, you can change the default **IdP Attribute** or the **Configured Ent If you want to use your custom user entity which is a specialization of the `System.User` entity to store user information, select it in the **Custom user Entity (extension of System.User)** field by replacing the `Administration.Account` entity. -If you connect multiple IdPs to your Mendix app, you can use separate custom user entities for each IdP, each with its own attribute mapping. You can set up custom user provisioning as follows: +You can set up custom user provisioning as follows: 1. Set up the following fields: @@ -612,7 +612,7 @@ Do not change the `UserProvisioning_StandardOIDC` microflow. This may cause prob #### User Provisioning Using a Microflow{#custom-provisioning-mf} {{% alert color="warning" %}} -Since this feature is deprecated from version 3.0.0 of the module, you can do the custom user provisioning at runtime or deploy-time. For more information, see the [User Provisioning at Runtime](#custom-provisioning-rt) and [User Provisioning at Deploy-time](#custom-provisioning-dep) sections above. +Since this feature is deprecated from version 3.0.0 of the module, you can do the custom user provisioning at runtime or deploy-time. For more information, see the [Runtime configuration of end-user on-boarding](#custom-provisioning-rt) and [Deploy-time configuration of end-user on-boarding](#custom-provisioning-dep) sections above. {{% /alert %}} Review the microflow `CUSTOM_UserProvisioning` in the **USE_ME** > **1. Configuration** folder of the OIDC module. This is where you can change the way that end-users are provisioned in your app. The OpenID token is passed to the microflow as a parameter. Use this object to find an existing, or create a new, `System.User` object for the end-user. This is set as the return value of the microflow. You can find examples included in the **USE_ME** > **1. Configuration** > **User Provisioning Examples** folder. From 4d8b47489e7622d4ce573310c41ad4f0c388d7d6 Mon Sep 17 00:00:00 2001 From: Karuna-Mendix Date: Mon, 10 Feb 2025 18:25:31 +0530 Subject: [PATCH 04/11] Update the microflows --- .../use-content/platform-supported-content/modules/oidc.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md index 1dd67a3e0ac..db228ccd6af 100644 --- a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md +++ b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md @@ -339,9 +339,9 @@ In this case, the OIDC client is the app you are making. | Default Microflow | Use | | --- | --- | - | OIDC_CustomUserParsing_Standard | It implements some standard OpenID claims to find/provision a user. | - | OIDC_CustomUserParsing_UserInfo | It is similar as standard OIDC user parsing flow, except it works with identity providers that use `opaque` tokens. | - | OIDC_CustomUserParsing_Salesforce | It offers an `id` endpoint that retrieves information about user. You can use OpenID token (`id_token`) to map user attributes. | + | OIDC_CustomUserParsing_Standard
(renamed from UserProvisioning_Standard) | It implements some standard OpenID claims to find/provision a user. | + | OIDC_CustomUserParsing_UserInfo
(renamed from UserProvisioning_UserInfo) | It is similar as standard OIDC user parsing flow, except it works with identity providers that use `opaque` tokens. | + | OIDC_CustomUserParsing_Salesforce
(renamed from UserProvisioning_Salesforce) | It offers an `id` endpoint that retrieves information about user. You can use OpenID token (`id_token`) to map user attributes. | In version below 3.0.0 of the OIDC SSO module, you can configure the timezone and language using the `OIDC_CustomUserParsing_Standard` and `OIDC_CustomUserParsing_UserInfo` microflow. However, in version 3.0.0 and above of the OIDC SSO module, you can set the timezone and language using any standard microflow. @@ -668,7 +668,6 @@ By default, the `WellKnownendpoint` (Automatic configuration URL) does not inclu 2. Select **Search** and click **New**. 3. Create `oid` claim and map it to the Entity Attribute. - ## API Authentication {#api-authentication} You can create your own APIs within your Mendix app and secure the end point over OIDC using a custom authentication microflow. To do this: From 5dfe34f1d7ab99726b3e64c631ac618140f5ab91 Mon Sep 17 00:00:00 2001 From: Karuna-Mendix Date: Tue, 11 Feb 2025 09:19:21 +0530 Subject: [PATCH 05/11] Additional changes --- .../modules/oidc.md | 30 +++++++++--------- .../modules/oidc/default_provisioning.png | Bin 0 -> 150571 bytes 2 files changed, 15 insertions(+), 15 deletions(-) create mode 100644 static/attachments/appstore/platform-supported-content/modules/oidc/default_provisioning.png diff --git a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md index db228ccd6af..81f7f2aff07 100644 --- a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md +++ b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md @@ -482,27 +482,27 @@ Example: `OIDC.Default_SAM_TokenProcessing_CustomATP` When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration. {{% /alert %}} -## User Provisioning +## User Provisioning (End-user Onboarding) -Initially, your app will not have any end-users. You can on-board end-users into your app using one of the following mechanisms: +Initially, your app will not have any end-users. You can onboard end-users into your app using one of the following mechanisms: -1. An admin user can manually create users in your app. The Administration helps you to implement this. -2. Use the SCIM protocol to let your IdP create and/or deactivate end-users. The SCIM module helps you implement mechanism. For more information, see [SCIM](/appstore/modules/scim/). -3. In the Just-in-time user provisioning, users will be created when they successfully login via SSO. Both SAML and OIDC SSO support this mechanism. If you do not want JIT user provisioning, it is possible to disable it as described in the section [Runtime configuration of end-user on-boarding](#custom-provisioning-rt) below. -4. Proprietary user provisioning. The Mendix Low-Code platform offers the flexibility to develop a customized user provisioning mechanism. +1. Manual user creation: an admin user can manually create users in your app. The Administration helps you implement this mechanism. +2. SCIM Protocol: use the SCIM protocol to let your IdP create and/or deactivate end-users. The SCIM module helps you implement the mechanism. For more information, see [SCIM](/appstore/modules/scim/). +3. Just-in-Time (JIT) User Provisioning: in the JIT user provisioning, users will be created when they successfully log in via SSO. Both SAML and OIDC SSO support this mechanism. If you do not want JIT user provisioning, it is possible to disable it as described in the section [Runtime Configuration of End-user Onboarding](#custom-provisioning-rt) below. +4. Proprietary user provisioning: The Mendix Low-Code platform offers the flexibility to develop a customized user provisioning mechanism. The OIDC SSO module supports two methods for configuration of user provisioning: 1. Deploy-time configuration: this approach allows fully automated configurations in your CI/CD pipeline. Mendix recommends this approach for customers with an ever-growing portfolio of Mendix applications. -2. Runtime configuration: this approach may be the preferred method for configuration if you are not yet familiar with configuring various settings correctly. Additionally, this method is essential when connecting multiple IdPs to a single application. +2. Runtime configuration: this approach may be preferable if you are not yet familiar with configuring various settings correctly. Additionally, this method is essential when connecting multiple IdPs to a single application. -By default, end-users are provisioned using the `Account` object in the Administration module. If you need to use a custom user entity you can do this via [Runtime configuration of end-user on-boarding](#custom-provisioning-rt) or [Deploy-time configuration of end-user on-boarding](#custom-provisioning-dep). +By default, end-users are provisioned using the `Account` object in the Administration module. If you need to use a custom user entity you can do this via [Runtime Configuration of End-user Onboarding](#custom-provisioning-rt) or [Deploy-time Configuration of End-user Onboarding](#custom-provisioning-dep). ### Configuring User Provisioning for Version 3.0.0 and Above -#### Deploy-time configuration of end-user on-boarding{#custom-provisioning-dep} +#### Deploy-time Configuration of End-user Onboarding{#custom-provisioning-dep} -You can set up custom user provisioning by setting constants when you deploy your app. You do not need local MxAdmin user to do the necessary configurations. This is an automatable configuration in the CICD pipeline. However, the configuration has the following limitations compared to setting up provisioning using a microflow or changing the settings at runtime: +You can set up custom user provisioning by setting constants when you deploy your app. You do not need a local MxAdmin user to do the necessary configurations. This is an automatable configuration in the CICD pipeline. However, the configuration has the following limitations compared to setting up provisioning using a microflow or changing the settings at runtime: * You need to restart your app to apply changes to the constants * You cannot set custom mapping of IdP claims to attributes of your custom user entity @@ -519,7 +519,7 @@ You can set up custom user provisioning by setting the following constants. You | UserType | assigns user type to the created user | *optional* | `Internal` | | CustomUserProvisioning | a custom microflow to use for user provisioning | *optional* – in the form `modulename.microflowname` – the microflow name must begin with the string `UC_CustomProvisioning` | `Mymodule.UC_CustomProvisioning` | -#### Runtime configuration of end-user on-boarding{#custom-provisioning-rt} +#### Runtime Configuration of End-user Onboarding{#custom-provisioning-rt} You can set up just-in-time user provisioning as follows: @@ -531,7 +531,7 @@ You can set up just-in-time user provisioning as follows: The User Provisioning configuration fields are available in the **UserProvisioning** tab. In default configuration, the custom user entity is set as `Administration.Account`, the principal attribute is set as `Name`, and the default attribute mapping is provided. -{{< figure src="/attachments/appstore/platform-supported-content/modules/oidc/default_provisioning.png" max-width=80% >}} +{{< figure src="/attachments/appstore/platform-supported-content/modules/oidc/default_provisioning.png" >}} ###### Modifying Default Attribute Mapping{#modify-default} @@ -549,7 +549,7 @@ You can set up custom user provisioning as follows: * **The attribute where the user principal is stored** – unique identifier associated with an authenticated user. * **Allow the module to create users** – this enables the module to create users based on configurations of user provisioning and attribute mapping. When disabled, it will still update existing users. However, for new users, it will display an exception message stating that the login action was successful but no user has been configured. * By default, the value is set to ***Yes***. - * **User role** (optional) – the role which will be assigned to newly created users. This is optional and will be applied to all IdPs. You can select any one default user role or keep the field empty. If you need additional user roles, use Access Token Parsing microflow to assign multiple roles. + * **User role** (optional) – the role which will be assigned to newly created users. This is optional and will be applied to all IdPs. You can select any default user role or keep the field empty. If you need additional user roles, use Access Token Parsing microflow to assign multiple roles. * By default, the value is set to ***User***. * **User Type** – this allows you to configure end-users of your application as internal or external. It is created upon the creation of the user and updated each time the user logs in. * By default, the value is set to ***Internal***. @@ -563,7 +563,7 @@ You can set up custom user provisioning as follows: * The **IdP Attribute** is one of the fixed claims supported by the OIDC SSO module. * IdP Attributes(Claims) cannot be of type enum, autonumber, or an association. -3. Optionally, you can select the microflow in the **Custom UserProvisioning** field to use custom logic for user provisioning. For more information, see the [Customizing User Provisioning Using a Microflow at Runtime](#microflow-at-runtime) section below. +3. Optionally, you can select the microflow in the **Custom UserProvisioning** field to use custom logic for user provisioning. For more information, see the [User Provisioning Using a Microflow at Runtime](#microflow-at-runtime) section below. {{% alert color="info" %}} If you are using module version 3.2.0 and below, you will need to refresh the module containing your microflow as described in the [Installing Mx Model Reflection](/appstore/modules/oidc/#mxmodelreflection) and select the microflow in the **Custom UserProvisioning** field. @@ -571,7 +571,7 @@ If you are using module version 3.2.0 and below, you will need to refresh the mo 4. Click **Save** to save the configuration. -By default, users are provisioned by [Default User Provisioning Configuration](#default). Optionally, you can customize user provisioning by [Modifying default Attribute Mapping](#modify-default), [User Provisioning Using Your Custom User Entity](#custom_user_entity), or [User Provisioning Using a Microflow at Runtime](#microflow-at-runtime). +By default, users are provisioned by [Default User Provisioning Configuration](#default). Optionally, you can customize user provisioning by [Modifying Default Attribute Mapping](#modify-default), [User Provisioning Using Your Custom User Entity](#custom_user_entity), or [User Provisioning Using a Microflow at Runtime](#microflow-at-runtime). {{% alert color="info" %}} If you connect multiple IdPs to your Mendix app, you can use separate custom user entities for each IdP, each with its own attribute mapping. diff --git a/static/attachments/appstore/platform-supported-content/modules/oidc/default_provisioning.png b/static/attachments/appstore/platform-supported-content/modules/oidc/default_provisioning.png new file mode 100644 index 0000000000000000000000000000000000000000..0e9c264d7b685a5d56bfeef7dbcda8a647e476ae GIT binary patch literal 150571 zcmeFZcT^K=+b@h;5fzbbMY@WDbm`J{vlS5mktQ9amw*sDgs7+}MU>tn(xmqiT0o?i z&_fSMCqN*fg+Oxd?Du{4e%|MN>s#yl_d93SVzFizGBfvFP(iO3fyll0tSHkOAE-}9G$k>x>ywiAA0;L>wk&i{!If&qw(u^cT zlLI#DwZ1@=@c1fw${~pD?O%keYzSwi}{9CB1tl?9kIg3Nwpk4<^qCF2?Ro^$7^M9Nu15U)n7B~#&<|DgaP3h+mN}Z=lE0A6PoHd$xilb5F ztII@XbZo4&H*4{PfUvN}R3)Uxl$O~4wKa-7n4$AJ#>B+LFCgH!A#PEnr>h(N{{8z! zk$)oFBJRfjQK8%S4asQH7AtBVW9)*Ghc1ac0;}dQk#%DUwqNdn8@YuW(aS9L$6R8; zb0vI9>`5xK?Wvhsl^{}dP3!pu4GPo{(~8qWNE35&gfEeWc51n!9_5_w{`B|Pds#h6 zRr8oQ)0CT}pYN8k>gw_n1pUTh45(rfw!IyEq6aSzwm16!Eif8Itg6m&=oVl<2Xm)< z=GU>cUa!fOl$6YPpr$rn<(f3x9Bkdae0(s+ifo$$nX1`A9(Lk%^eV3NsGif<+b}Kj zSP6-ai(BwEFhP(QuPpr_qC3r0PD-l7@LA*I<0f0dN#g#!b;Mp#7v?sgYs4YL~@?#Lan4yD4qv40^$-d(q_!sYr@G;d{ z_ZAL zKEv9CkW_E-(KG!5qo^oN1vyoYz(;cg$V8=0grc17aITaCwgFN$w5$0&XDr$L@Su|e zHg8EEUL|Z){%EN;rPQaRwA^VTD?z~8V0(+PSHs4p>ZT}z4j0`0g$St#zZ8<^(#_o9 zuXavx{*`TEan8WNm9a9{BHI0M%6s_e;I+rAZe?%O8*$!u?X~fAYwmQC)Fx%5#xpNqbAC%Bwq6`}pS%l! z9^~+4&;mX8@1pW*N_7k8N}!ZluMiXtm*0W_U3voobJH>?=`B-aMs@XFMS>YkhoivP>zyEj2k_l`G}*4o)WP`}f;ZHJ%_%Iii|^4x~;prY7zOa0Tplk}0kkwVX_Z^lt}bCcZ%#8{DgeUqMO z6<@z!jANxX>JPa~;d4SKjH^Z#TO1?^?N(ZLW2G@U1qB+Rk&(LkUR`Q@95Kg^$h^M3 zKUW1QFRiW!nMB@1{$iGq9_g#nLbr~4Z6}z^j?8Ikc3WvZd7?M`{-#>CCa3#+b^n+v z;=IFHX?e%4=#zw0oJ+MLqHcLIIxc1*b^_l!iDZ0M1u^dI>MFx4sX%{isb=c=l6sTb zYQql>4it8O4kFj~FpIOQeAZJnx!Y@o3C$0=<0a5{Zv}@d-4QlA+!=XhU=YW^6{rwL zS!DKg{6%!=|MsAj%j>0x0(Fh{exn-E`D0MxM=iK)T)+{+z5R8%d(TeQd=;vecQ6ax zS%umva<#X86&V?M_G+IfyNtfwLg#RJ7oWnBv(jD!HMT2oCkXUq#keC%;^9Uod#TUX zz~QX7a)(V=wf%*t7HC)-GiFFvUY)Y>izVkUA!kay_bGy z1@apl?o!=4y?q-;4Sxvc}!^6WiY;Qt#%3%$vXEvBK zIU*TqqV@Cu%@gCqI$W`V>;a`>ZsB{ z1*Ap5dL%x>7}HA{U{Q)u#uD!Zl53ra?dcZ>(p1PCof=;^jRo zhwMfl?_OgCF4uj@l-YKCdu*(Zw9u!YBz>7xyc+&ViBRmZGRd#zjy{T*-|*+^RaJKP zd-!QIZzi4=M6?KO<(8LjQdwVOQM#+~r`h%7DJngrWe>qh=lGw^Sx z1YSPXDU+43tB(#DDG+}#`Z;C1DlP3gv!dK}@2MS&$42GtGxtIF7!jvI(NG<`#g-fi z=;8{WEeiJV(ps%w&$x;2jz$7;;LTZ%zA87AVcF6G0c#!yqFy$A7v_s9G?iN#O=l*n zr&B^We1E2`)Ty>zV!6yBdDJjo9Ln$8=7gWt!sdp|DuZMOsv2SfMh+( zs&MT%!x~Zt;jbE7^gIS@>ZY>TV;q0%_yGVD3Nceuw(93~)`l*JbBMt#4IGF2X5fn9 zn6QK$x@VqWf>0~y+RZ1Tzz2%cBZtr{vH{)q6C{0&c(oEzn_D?XNADT-*WAd=EP{m; z8doXBnYx+AikNK7zRySa>&-a;!W%c8Xs z6G7Ruo^MYJCo9U%B8AKw1Xxnx`b~kgwE$Hf?s^+6v12Kyzk-p>Zr;P?@6pW|mA%ju z%#AknR*vsySVtHf{H$^wOQe#=TnU5bCaHtU9xs#vXOUyYX>#6&q=ta)Z=&=5Sjt{< z;Oa;E9u(shq0ag}#pDTmooIHdyNS|E!v6Nkpi?#uf^9I3LZMS?uMrnT+nM134z}IN zQDs`nx765@NbGEE?&Orcd8`Nt0XjM_w}L}}kwLlUPV1@(d~h8}$(kSr;msmdm}Rf2 ziM#(S4jXs1<_h%q$PXZO0yuGpm<5WIcI$Qh;nRh%Qpm;I3eyP@Vigv)vE zt-+d|DEPX%VZ9$DHDEQt#JjnGw%*}V8;?A9vJN-f;uaZ{8zeyl$Dt3WNc(TwnuI$D(a4QkRYP4Nb6cM1YJjB zBu?R}Lhy#ArsO-6_AvPXk6ao3r4jj!jy9#OmcunwY&Te6X%`e|`~fTGA{}9dP(lf@ zw;KiD2^}l8v?{D#ZJmVSRb;7k642%A4A%JbD%id)EKb@vzc&+AFVGcR(EYjTNW!D& zbxz(yY(m+hZEJVjK$UAztN;9fjUY(A!cLHH63)wwG`s_%Slnq>Jwd_d;Vze0x!B81 zTga4A63(SgQS?b_tP;#`vE40Q$J8`xiMKx9sjyZ!&!DJFOqFwFp3Mxzun76c(-0MC z1rYHU8q8fE_e_xU)L*PCzvk)b>2P#z+L#Y@mj^TT(s z+l93|EU|)apSLoT@hEngIyj^-%UBO)^&pqulmVC_?ULWS08lYKW1RJ}*>Q=0(HSA* z2Jt99Ewrm>ZB_^L=(0R{ax4M*522gpuhpCRTH~i9osW&z^!IoYd~V$g9&BJ(ZSSyA zOYL9lN9riKHOXr1nwPkH(&{gijMz{|bH&hyBh_Ptv;Y8WI1oi>;6@7A;?PN`+bHB= z;*)^IcWa6Pj~=V5m)T*>XmGLauBX0!p-Ia1pp$iJ?|)gvM)aO9V!Q9R z`ISOi$TY}$5PF5xd;dCp`Vq?TBEt82ioACxDu6V&GMWZ!I+(8apZ^7?JQ=TZ{BsA? z&+eJ~QP3%-Dm#GYGqvzs4pTLHyR5Q8g8Bu$pg|3~qLn5%VgCM=kcn9NjT&Y3xWe`h zKCYDJHjbgudq#lJ_~YS{d(%|=4gZ<`WRD;H^gWqcnm!_S$zCtcU6m?zGX-1;xqC1{ z_%ZL0fUA?;EU)hX);Hukj$4uAWG&4f@I1Q-}VrCRMN zZaxZxjp>m(m{DJ%J}GBy`715_v?3}i?;AEyo6T+ai?6fFSzAQS9nK~y+x{%Rj>Pxk z%p~l~6hS;B$Uz>yXJ(HSNnuQyhZBfh(D`Z=VmkiFuIU4{Y^l3zFL1Mq!=tf*Gy;cJ zbd-qJ%uF5<4XA=x5=Dy`$_?j>nX1h)KzD{Iu6+fdRL8I~;K2b!r5& zUue`~#oo3A+HN=57fC4Pwi{~jml08(Q{l@jEOe>mX{Q#@)=hbTD-&GBG?@{tob49- z5!Ak9uhox#foXL()TV*3fR;{peM7BbX9_XjrhNFYSLx_@c$=fWeS2CubGKc?W)Z1< zjC*|J?70c(QFzr-9aO7}v&tl)5+Xo3Fw|7Og*fO|Uh1vgK))vAC-z|qn|)TuIrQE_ zsXA3AJNa&d8yU98`UOQjGij@cbdMw|z4$h%JuWe|t6u$R{nXFE3Fs;`Y+6*6|~<2$6yF>YsZo@apF zZPe_g37J;j;67?!8S~#aKOUwUE-x8p=HilxKLBY_an=1^E+IS_Gx()2pg=_ctB%f5Xic5u4PN-aDpr`a~qH03+9l_ zRr~rC5T4)&+1oKOrVa=`YV7Q^voG2l_nG#IMmno zxu&LOy-*McHy5Nwi%aCHrrfkXDLOiT;+XJ|+$t@NmEBz~F|2X+MhvJ@ca!j5+5CP;+Gov6c z7Ux)!liIl8auG@t-N=lLjGMvSUN3EX6Qi)rF7_HfFQ#g%hIQREfSkb_{gL_}N&?87p3t-d5zgpC*{NZ2?B^kISS3T_teFe>u z<#@o4x~kpM|GFhloIWdj?YslX;kVfc?ChQi0Fo$bbGTvkOEt}-#{D-lW2?hX#9yHj z5;JbHE;a6<_08$JTU~KQPbQ=<12hMzo!H(O z=DA#8Y}5ZObF30#{P^)>HcUm1eM)M~6yq+xsHi&VOgegcqi3mJASAJt>HA4E;Q>T* z-5~k$WtL2^{>D`gI29Z8@(A0jh6zilh)BIWOqL2c z>;4zeuW5Rf1?t@T1jJibjqC-1?pp@WD^tmE9bFQ`Wk7lV~4o>znoX-bTgp|U$ZZKbaP(iG^w z)?Z@L8jFztN9ZLKZ;F~nfF!Y<{m~-76X-dy`pjT&*Ki|8UZ2Umn2 zmj)iSw%Qa;#;LB)P{u*UqPL8$8U(dmM_)fS5a#dd4cl`urO~|n=STrSOw{u97c@p( zK>?S+dKu98frO?qKY3lEZbmV-;CW2=aMClN;;>{r5qwU4T(WrvH=v#aeBOESVrs`5 z(4KN^)uml2IH7avRfCgtW%`8yNbMt6yH7q9=QziKWaCm>CVvP?=PxP(RS3SfMI1;k zHKr^vD5DopC=rmJG|J&cBhXP$=brHjK*bK9_*pvA;BAVWCPpL$`*e9uCeD0nAFJrE zzxYaCnkdP6Y0PHlPZv$japyoz` z6j=BiwA*#rU@DqEG}e0gbDXLId~r-I#|Whq%uxrA>hG?yyGLyx?VzcASjw~(Awl%e zNzTI_QKqRZ%S~P$V^t`|;x^1H0%41y&!Yk4T6;O6nId;n4Jea3#fAC#`5lV5g4<4G z;=;xo`_r3M0=3>f;GLJg+=}GA{{cv%G|g*eFwbth(syn)bgu@i&w>s&^`%P<37xPx zM5KM?mR+U1DT3Q%qcj=;uQT`kLH;*6e^|-ZtQpYMOn(x*5 zD(c~6tci=lw6axLvluH=juzZo2pO4xPnQb`YfPk^8e9t#HmOm?oLO6ACiwC_0}ZY_OjOYMwivC9B;F=uVsvlcr`SP&cpeXBz!%MPSDJ0gap*&((FEjMiU}$GmJPC=>xm1^?93wdXoRI89E0 z5(~U(LMN-jclby_UT1TJQjA8DBjL5qCm4op&B;+3WS48tkVDx(j#cnkZl#;`{(3YC z4>DffF^ri$tmJaVjZE2X6HV_M8g?abrA4_9Y^g4N%uelyF_?-+Q6~+=EgDlvctfuIh_KkGucP+;ejUJgwhq=Jka%fZ#rS{gHVN>^dE$i-AYX_er! z-S5MPeb+u_Lx-xxSjFud+5Hee_Fc?YKC~5~5SH8rg}oP7aW1_@fy7{w{gN``Fr4&< zoR`nhmma`@3GZ>!dSS|o9}Y>W48$UHs=m@u2eAy_ZfRIy3jyyYB0&bOP2&@AI}rA`g|$k0-cu})O?rWlX% zQ45|{_GR&tg9C+A#;zM!SL`gnUfB(45FEQ%gO}IPCe`J;tNkN@?o+0Vva*2k*33DFhy#mpy0~bFG-fluIoA_V;_OyXciS>(_`##qEX$MeIKtaT|Q z1VxGa?#d_)POQnh`_y=BMF09$wNwr`n0iP^$g_Hf!E;rHRW7i{>c(}8LZ@nzdQ;?Y zsg2|t?j=st6UbF#_shINL6vo!j6Ymt!J_NE&61`S1!;U+f$@rnW@Nc5Mg&IQehgSW z@EnOfD14>EsvqSE}y&SnMF)|1yiuRar)szoug6p=gDELJfpaSs$ z>w*aMzE!I&NU=%xi7EQ)d9 z;(XHyX?|e4g7j~gb*eVTh^UoL8QMfv?K=A^+JK&rrc&$N{Q|uC|C$9D8XmR*uU0wF zTs9CFqVHfhE_q2Cxb?Jd#C^2sAWQh5BH=y#V{)%CogQNb5W>w4Cnf)B7uW57s|r;U zpeo!J5a|34Q_ZmH8c>j(9m@|)d5<#yGRzZfLw#w9pU$H2^YSUkVvl+Bs)iJ8>2KY- zjA3&%au2sO}UMt%xuDj!FWZRusHU-H-C#QTw zKk5A3bUevq3AkJmE^EtA0Ilgxkynn;^5L!b+ijnPx78l9wzqPek-2 zc?V2+;KpS^aq28XYjou5Ih`573=c2ld_>y-e!ViBPSC(?|K)yhAI)QE6lk$G{ywq8eeUR()0Dzl$%|q;TJ*ue8;+0 zbB9Rth8H$XO28m7EPkohL;zhb12Q3PSZ=?<9%$xej}=*1ut|`2o%KqZ#del0gkJ?E zeRZ|crnP(Byg4*ZsH?_PZ)H3a3IyoHd?x_HP37=k!1{40Eq>jeDD&p>4|tK9wEZG# zotE4*;dUvLK4_IK3k;<2m6B>fo=cgoct6rt`sM)DVA>?srl{Xcb{(K{E}BxD~rK;7~fyE z08$)Hpmg8ylv&zlPKl-*9Y_}D<>je^Sp$0f80fN@UHY^alk@%iBLczIkMOb0dVo=f zNHjkZVVBltSu+4WDPWLQq>Bx{KnJ*~vd0#!4)@o)|L6sHI?_}O#;!Y!VX;_+SzvVU z>+xNUqEtn9s!9Y<>(O@9qg~BCmv@$kb%1v)Yq2Vz@_~4*v3U3nrKjC5$HxWNO@#%z z7dB90dGW*GcG?ih@kuTuXe+m(^wI9x(R)X~DjK1`2$U@s)7ncXqPErV&;e|C6oeHv{@sSY+AeaB~69FrX$h@Ni1Zj zWX~T3LdPl&haIr{51CLnvG$d>F;M%IwqMWDK#v_FDUwQFaRr+E17H^=0DcaG8WRK7z1?CyG6%>DKw^n6gtI<4 zn9?^KlLD-_R|2iso57MLWoQ6QB}h5Bj8{5EHNgBc9j6Xb3T?1onkBXpI*_E1T7WD`tbHg~np4PPp8Q2| zZ!KlI-tW>HC{9?=?W7}=4s<~|%S1SswB*=4MZD!1>blXUEc3t+A8O{(Z#0Q-q8qEyvDC}|kTnaeacDk)cH zp$T-wGIafC;5N^i_)x|)9umv}i=a@T=4yt%hOM7uZwE0jw|B-k5tgkkx)UMZ3qYrc zx?hxdem01YJC5d7uwxG_xqOzlXrg#|p?%810VIL&D@^El`AubNf0elXj1&6XrVBvE zc9ivB@OC@OY@X~z=tp3iUr(^ZT=j1F9hXjm) zEiD(<2Dmfw^B36VHUO%Q#vg66$XXtLk+qj?qP~&`1HV1-w)Gta* z!5@`()Eqm$+f8#RK_6wU?Gd_FW{d6`#!Mzp*9%J6TTsEYlM<0dq_^CmOs67HMd@W{ z378jBP$T?&Ye#4d(#imS4uH<)pr(r3ZM=DcP?86V2PmFkP5T39*B5lxc;K7cU}5hUNGR40WwlRN<>hE(pVmrbP~<`2dCAalz*B^fQK{tc za1sH`NH_%OS2`OeS^=jHYZeG8L~e{I5Z4%4?-rYn6q?4dN|-$c;9zAKmy%?Y4m|N> z&sKiY`T}M#4pnm_=;Th86ylW85)hntTmvQ#L8htyz%0(EiE@At z(vV)hS-ms>;3A?8cX^JVTuX?I{N+5Mk08MlPOm@_4Ku>;rv8I<6b}0yhyb5klIF~w zleO0c*sP;Y()&ITc_h>ZzGd88pQ!2yB%c+vf5};a|KNcik%HF{r)e^MDzHcYV~T)- zn-4U*gzXFTJ2kpAmfYvqUjj&{ecaKg6w!vHh6$j-ZV6AQt3OuU?DGnwB&ivM?N3zvTh~vG~)~9yzCLK@Hr>hm7iAb!&30>7z1oH5NQU=>}<}l!z?IA zdFBAIh6~th7THh9aVssUAa{0aL2ObLXaiCz!Mm*fqfLKF`Bo8Zn2e4F;8l=**okxk z7izu}OvzNpOvko_#z}7w$57N07|PEjW|3kz1cC%v)j3!-nPKA z1dJvyX|v&9M=-^su+x7{Bmfgqo5mSwb~|{=JX*5me78S(@8l;_Cr+O=l-dVQWZ&gm>-0wTB{dhriC*D>GB9wL`$(1Edls?mgYCW_B)oXJv}V zF2(op$%b6*z@nz(W!4>p?os>dDTFZW>>UH7>g%B4hP}hK^r=v1yY2< zfv!<>bVg~ZvB=@5VUGQjfDV;pIMs9RL6*h`h!o0KF5IUHvm$#LnJIY#?)k77<>g z7Ipy@nkeb(Scu#m31jzvM7wfJON+*cjHKlJi1Jia8y6y;h?eK!dC%mM^?2+{&Y+#m zsF`csea>lSUfOKO&R7x6+j6EkClmGFrn_V(A_9AO-=+G%K-OYN32(1hsPgyCyvhnO zhhOyajLPnQ6gqH)Rodg_{bm<}`%{`c0VLZ;Fc?fi_tev6FsqUQPEcGx8V<)k%7FuGLVHGIt3{J{ep&{gHs z`EOn{g(gNT8-ZODVgYhvi zJDN;;mHA`D$eVVlfiD2bDDe%Y-w&PpBzr>!>t~=u%`9448`SDp?q|pVvt+uiG&BS(@s*!|N{Byxt#5WRgNe0Y@W&tsOOUup84GfQg$*!UO#Eh*NQ}no} z9&)KcRUDu#=gH?OH-XX<3Dhv#{mtvNymr7ALL>}2K0QfM5^UaO8=ACftaTY)tpMXG zNl=U;^WsN7gc_KKHB10-#QLz`3fieQ2WAw5y)&<1uK#@>_jG<^C}!+iKHG!#JoWd{ zK3zBHKQ<0Hyyo|R^c*$~Od5cd&O@rdvK`EXW=F@wNP&@FW86?lklp#e*R3({QV&8I zl~!IZ3CM3aoc2Zm*#~GZ=hcjgs%sD~ zRfS~q>zeegEb^OeChfrwjT-iQfVow3uqd(wTTVg6dQ~j_{Ki+<+t$h**HHgZa%9*J z8|B{0QiPsNtSYJ;e}}Q7PQ#JdJ<8LBuBzFA1p??p$Ui?n=wB`)pwnK0lZ3y`Z_h;9S?=;xcrl{AR& z!RydxhPp%Dp6d!!&40z{w38Q-_1vodWL()p&iE2;lC4X?VUcCfd{GYqbF__u5~_nr z_u5>=ZrrTRfP@;LCjZ=K$KJ&P*7ukDKn zlV8~9P$;%DVqxxNZQF5ZU9~W%QK; zBhdWmiV~yg~A~3wpAf>-HH7w4fREv9{+9sUHpmvzW14W+qg3vlFq50 zQSt}sNI0pIw=1+$F7t)_(F0Y4yYBc#2uv0KRagi9rK$d5h80$HaphpoKCZ{#uzAe{ z(D9W?=%17wN`d@j{_rS~Fib^H!-5~U6=n-G|M5e}2l|#b+KsFxVTo2O>lVjaI4BnIc)W*W|tZNs9XkXzF_rNOd^ACv}LE@`<<4$JltwM>W@A5 z5LG1u2Psx_Ny&Z|%y+TON^T})YVd%*c6Lei1-DE72BIzf5^d*MD-f<>Ph*T;g4HBn$Dr()DmA-R`ihsOXf9a?Zp#CgG(NnF${`PX>}@^H1Enl;5`p51J8@D0tJmGI_@ib@9W0Y)^vK9%Ly^mK|fbD9*zE z{Oiu><>#_vm!%(w2dO>#o!jjqxvuKPob*?9@-Ox$v9@B$HhcO)I3eyjOiUDKq@T+_Vp{*k(>Ky@`c6)zXv2Ny6 zJ8pJV5_3^w75Ss)4I>DS#;jcS@pJp9`I@n8*HQe{OQ_>2j$~hg6xWn)bb* z*Iq=qUwA@hGpL8FYE?*HA{}PzdF1b%ZgCQWqFU@XBsrA$LmHo#l}GIlHGJ|2^Q33l zHX=5D75qKQjHeqepT)%S!AM|1H|vE&bv09KxfI3cK$Gm5@z6Itt^NhIGStO7gC!iM z&YNxnvoW%9s!$2;pLjX<&csRXz0bwVA8f1`(rpV)3ar52PhYH>BM`miBIG3-=)vvJ z@C1w9-O>LNG3rFVldENrGbvHzyH%q4Xe9EX$@2NIwZ03@yY;FG`H|NJ1|sH)%tW-vdp zSwFqzv3%l2Tx4@3{i{m~Op0&tZD)0G5+j#a(~XV-ua>@KcENpbuCr$Zq4r$L>yD$Y z-eS6bt=i~Jc734x9HiUS+3ZkQ4w<)yDyb7#s(Z}$=e4u>&kUU8 zCF>MQW9wPukX4bLX-`^gzfZUb#d0yqRGWTK+d8Gxz^NklBzE<}Q#>XYW>Asb#^oct zuyTly=>O)WlEbl-in+3w3(GIk)q-OOJg2)$?vznH!p+B9ku~eQR!cD_j;nWViao9E zCfnkKJnzZ|!zQlonNEetY}_Wuf)$S`7sng0yNNv8J9<3flPHUDFsXeVUF5h!wj5Z@ zV}+i0C!>8VUe^Ar5yfd4S(LLVQ#FTLjn9N}eSWG6-zie% zSs(xnGg!~l@E09&;~o&kFExyH^gNGylbvQ)?CfkF_Kek>i#yq3lLK>gE;{}a6T(xX zyxV+x*v{+dUIHp1=wxn>RhO>wdn0fQeQO$b*(o;+pvjXxc9+DL+HC{^-)qcfM_fAQso-aKX%KXHX z{R6qAC==Z>f5K!B8x~k#G&3l>1Wjo;w7HX2?(#9~_?2Jw%NOgu45&Rgtao~@+#z9w>?`$!j_@0^8zEsfI9KT3XP7X-@G=by$+WZqzoyW7UEHhwr z?nk;Gw3_Mp+wkln9{tSZ6JqDl8>Y>zzH?8D`mImcUcAP|8o=IvzIH~tUhyGiBXmNn zvwXn(!Q5(Ei~ah*nX;o_(1Z!hT`@fLt|am2o8y?@_a3u0CQ}41P^LrsN-P<|racW@ z1xmM_PMv|hZq`v!DG(_u+4}*b<=>dopL|0bHCz$8Z~C95*Y&5(d5^LXZp4ucuAj7w zp17UA>l+=EQqTu~ZtQ?-si@x!AL9IcDPaG^1@Tg0(dpwbW5fA7S{Sh!TdN@ml~bSd z>@%FiJpr@Uw=>I~NPF#UmdX`}!B=kMKcLhH-&ZD?vE0?~efSCdmrE@9HhaEmZpP0u z*KY50*0B?mhb)AVE@$A>G4PZkgMl? z0t3!D)_!VgCGKVLNymMEs)W%B47^-&S=h8Z2G1(Q+JCyRnR(T8G|~yL&DFW(&Li^R zr`p1`4?8{A~A3u+eDPJb7wix?tpib?WUbeEdJ<9oHF5I?%T|1xv zn(WWE80t1PDLG!L)Oz(e{m;3+eHYffo>3vsWx*YY>7I?%r1y^4NOgK5x}IetFC)em zMfk%Tv$$M#n=Grj=rdlasYMGv22lw-EX0k3W>uLP&~`%|_#ZvGE6ETM;@UtZg;pMGo+<|ZJ;`+E?ZcVnY$ zFv!@tz5?H1lU|$4R_;B!*jZ*2&XM^1{*ynQpPc$sU>?F%VDxL^c+pNqI)4>0A^(Kf zg*X-S8T<~9c3zirxZ8pL%(-oc>0_y5-4)?6z2rWOjKmU?y4{l>txl^}Mh)FeOwnUS z*+R-`BfJttbJ=P~GeZ^^0uVR~jBcJH^ZS1!tu`-l&AUTX-+ru6`lbHXJZ^N5C}!_= z`A~MMScX$!4-wiM6_9!D4CBPf0KbKlV`m{Y7O~&ObJ}Jd}H{;g6^A7 zxVu++wrt|Z0^dwCh0fUa$$xlrOJKiW%rN47w-$8B>y9yZS#w~5V-CHC#N{! z;N~cc9nbXr-!B&Xcb(ffuNj>AXO7?dHvT3w&H&yt zU%@phUmEhO`p51vrk0)SWB(@h;#)h`Vf~&8Mz*{YEG%C6@Be5oEHP?Iw=;;=guioA z)l_d%%f+0a`}UMMlfE$*%IqQJaY>2a{S@J)^Z1nzio~iTui(R(##H|S+nrR?r&_Vi zpLm8;BFq+M>Q_$FF-GU;Gq^Baf-UyUC2gLri_oQeqrh>|zgwlAoj9A%v%UvmIDWVR@jw%7vnvnQhA1w|4sN!k_nUJJaJL-+l2stbyB~tod_%#LG5AC-HI*U`tIqs zhi{ZjHGh$Ik_>yZ$3(7xzm=S(Gn|P`anBN}Pw0!7)qOze_=Q{NBY!35RWR{3)w;!LsYnt)mxQBN|+(4JhC-U@M z^gbIZj6LZ431t6L>FHpW*{+l?1C@?P87+!GR~X?uN`@uRJ?ssd$6+o@65|}E3MW)k zZ(pHz#3A0qzk=yJ{OVY7sK#gT^G+Dq`nFe_;PFj891&t7IsM_4?^x=79r6G@bC|%s zIN7Wi)$jMMsFUx?Z5ylbKc1qpvs;oI??vR?{k}9EH-WwPKhgJ}ev3eCA6 z2)w$;cxC1hMq}ATg#4=ONt3c>>o0cJ`w`-NJ}Kkx(}qLUuw6^ZRMN8WQuM7e`d4Qv=#_U0^4($lK5VO@d1?jPS6{*Mu0NkX;{y=orS=;# z(55Ps(4TWACn?ADukIglT!Lv|tWPpf>A11FqM)qAu=9Q$+{u2Z{0#e;x}8OC{H2fC zY9Ry)Zs}a{mjSm7<>~Q-R$~l=Pg)J))bUWDD}b?!^v*s4M1?Myt|-g0 zzipu}J+JKX5&zAH&O!dT7N468KjFJpan!x|qPZGuk#L5^9y4mjrB!9MVuy*;^?Uc4 z{8cAcw%rpm`5`su8eNIGKQgX-9^sknR^J9={~<%*Wr7-cfxSRYg1{7elH^Wn5P5rQ<`0<>&w}K4>H$L z7EK#kC6%ru=dvinIOGZ@g1M*p&)ehn*ycGZl|k7M2*>RkvKw~ZZhT1%GJk{#(v zzGFxAdtz^WD>L0_1LVZ8d0>PzCN6zlb^Q3rL9<)e%!+@!LJX51JekqjTrOip|M}qQ zY|qS}1xq^h)YF8QYqDG)DYEvVpoAcl19K}V7kDbuV7QiQL4*0D#`ik$xPFcGKq_U= z6b2}R$>EkiKb@(u+>2+D(qY^ouGD8?OMFWaE$#-~VR`8=0p1U%Klsy^bJS`>wru>m z?+1+d#12(%Fkp3)Mb&FR)E}_Rd6@^PvfB7NYyE!3-^V_=?fD$s3jo{*ZoWVCYdF0~ z!hbl$l*sI^3V7fe{&1CVC;1W@Cc~a#UYrO_@O_$C=7=kE{YLo_hX`aq!9C1f1G`~6 z{-_d7Hgh@-Hhjd_+bzG&;NGj01SHt{4==#l`0oe2|K2v9{OG*~K((`$O6ej&Kg8RPyI1~FP;Rl$(_EDH`oPJCN~i~;hiszGnRAJo@5`oQY6?l&fjGshgy6udmZk3=3-Xz=Stxe zhPl3tobP$1U++~YEQo4aj8-?FIw(u(eRqH)G5u%BiS8&??O75t%*h%phF@8Y=ReNz z%u3`%|JRM%<|V=ph2+As@qebYDNmC5G_wU7;#lynE4t+EPnha%90}V>X`lGgJ`m)# z*-cEgds_ENioH3rN0U+iJH4VnVG}*$6{dTOL^;=W`L|Dz;%NT!)6cy&!po-|cWn=| zDo5$)&ZN~r?K~WwbNJ@y2K8QDoc&$`j&@e!-%7u`)T8n_c&@eHBOIoCIal)Pgn>u< zh5YBgZD2L;BQA7)t;}O_WsO#)hLbb0hhiPKIVo3-dDIPKUXk~7GNJ9}$&G1F4u(?RpAlZMxRQDi4qJa@??BarWh?Hz6OR$P0?$<9f^Oe&(@75>M zqoOQdzrC^x5hFlZ!Yy>@iaoX)S%zaWx!AV;bTvXk7#+m2H?v*8m77Ap#y!M-j&W~# zBMcpC{V-Xgf;g`z^;;+1z1z=DE25q@JOC|?;lmZr2zlRv$5q(hSCzRHP1Y=pb5DiD zmX3_uL31}=idM9od}WL5oWDNmcl+7IEJ;9d@#+Y-LHTLz;-46&KwU# zabPz=ap`vi^YE?CAWnNXGvZ0V_wa5V#C9`c}g!!T1n1qnvKaDnHlTV zch;>E!~lD+t_&J6Y&A=IpFTX^MEolFq1}?x5zLX;X4Gh&QToustdqH(sxC!#b|a&U zeb+6P{Z9s@qG4rU46ID=wtKbJ@x6P=4D4m^{#DL?U+ zgR}PQpF>U9U6s+f7MHn8-qkK3O9s)ar;S^rXQnv=v* z+1q}Qr2w;m$U&QH{VRX{(Rw4*11gh0k=Zax_cVH`Atohr{VEl^Ww(#Q{crRj;arpv z_(wADIF#FRlH~6UHfyd!L0vd5*qZ(+N?rkD(&Q9=HR43FoV)3G?sQq`r|h>zX%FQ2 z9B_mLcG+IzXPf*SJ_V=3z9bE|Epc`_P8Hcp7}yk3Ci1HDFXY3i-4FO*DNRi>S)E+u zt#0404jfY@N8Nenw`reu_N|6r%y(pj$cwAHco;9lFJLz9i2u95((gb2JV8H=NwBW* zH9otZd$h87IT6`(Jze$GiyLOR(BFDg-*J#FJggpUMqN{C9)Vznynk;lR?kcx50rX3 z$8?IsUj@0oGjc0N1|F?KJ+@Pk2HKTL^sp%O^KeaSt7G= z+5E(1CRMet$hC4B=15y-B&~TgR2cvmQ?XH)j!ua}6UGDz&nCPtzwyr+ybX6Vr#%f~?D*`E*sP=3_Z& ze#l|6@8WapHY4+>1FM#@i@xfC@g<@D3h#^IFuJdP^{Yn8qPJxs3@->yb+8EHybY2y zuaNs>@FPb0!JeuAMc!Kn#no(mqXPuD;4VReyL*5D!QI{6E$Ac=BxrCC?(XjH?(Xhx z!#8=}^L*#N&pB21ulv{CHC4NMW><7)hhc{6SX;VL}oo?dIePK3;c9R`k5QW57?MZ@DFGNb(< zb9%Y56i~Xwn|F^GXrP(!CGJ;Z>j-&WXCL>nozk8qLk-_u;*F*LoJu+hdLZ~m{ySJE z=*(gel7ep6PZIdMW1!$uiEb5=5FuQgUlrJUdfrDC+xWT2-P9b(TA>y8$zXzy26@wz zJL0KjF4@sCuw zcdUFbgI?|jD;$P~4hK?bc~Pj!`DbcxIj|LGin$=;)bj|3DLB&*-gggh_V`&CDSCNN zU^-zTvLH)%I|&N>A+0DmwT@~h0HGjy?Au#BBP>Srh=zbOq$_@%ip7g;5y&H)4*_t$ zClWu%>T?)_qm@Ar%tIQ8Ys?6W__lJ=(&moE=T6d5IW63PMc%*MV9_!t#;;?y+?5Tt zt8BSz#%OU=Lf64c{`LHXfM|U`ED;kPc>cQJ$`5BQVnq6}pZrX9$Sc><1|_X2OO|E3 z6cNKzu0UB)-BZn>P#=xk3l?zkMys!@LCn_RWx3sYk1<-sbX7aGv&gE|qJ9E3 zU1U{VUhVIRCO51!TgeFwG^>9}Cb1axv9_HW(U|AaV40h%#sAMa9e z+ocNGLT1(I^K5-(-`mMf9T6@q)9|QS3gj7A~%5Yik(Qb@LtwuyV33=3m0bgdp8M>F{|5}w>$^{T-;1w5ML)M zKxMM&IOy>|r7=K~k$XU8Wep2My>gQ*|U)8oQAEiz5*s7wpfd}BSt3=gfFp&+&{r#*vK#Vrc#(IU_oF1IWuhS z)6LWzWp4Yrpil4*NE8@VBBp60IfJcW4Cn+rET`%thoQVQ0@k^N+DTB4VfghB;f6)J z&o`ILq1oHJbU%gCwdeZXl{I(gA&u<_(>VN!*_enVS<2W1VNco?Mjj%0=OxA(V(Xqu zA*!%Rl&Tn#-S|Nb*HWOJ5wteJ>h$eP>a$f0&Yz`ixUr=1G@sjZ5j|TdJ?wQe1e(k* zF}OIWWn%jmPKc^?5D5@O{EDxMmssVv&qks;J&h8uRY7A3V?vMl)kz4u33B;QvTLBs z-io!fG1IEut!BRdo7CGw#*ygje>jABoi)VYOZ*jjP}16-iRwkwv$Nw^hZDFw$W?yB zMsB<&NQYmEKhIU?^ulBrK;Lh&Rm?t51wV z4q@s!UTD8hs?iTxBWB+DFljVJ`L&L)5Z%V=dy{Uy!Ry>AT>MfO%2&0wdj3at=%D-? zRYYoVg+5VyiN?=wq4~LY?d~nk5POP}eN(P~F;oE`#d{IitLyXENJ`*X0 zWh(bDI!*wUTEz}sNr8X}`OQyvA_|Y631OG{JQ1~T_Aw*5M6nU|0HSzwIEoaq-u>(L zRo0$EqYFB$UOp6HYIND?le)D3l(&ls9m+@Q2pnj-u$3y3P=PAJ@7!2(Rp7cmd*ZcT zV*&Yjc`3O$kQnEbk(}Y+LJ~Oxz`5ui@!Wi~c-qF|X zt?pOr^X>0YQe5om*+fir)^v%7NaeSku#D$vGm zmc-up%xFKFC$aH3?;4n{urSeHulGkr8F@a;H{qTbcFSrJ)f9gDeIJu~ zF4d&16@^-TiO&Mx&+0!>kbdNp?RWoYfYNs@+_L#8&O_Cl+hVxZAaaQ#R(`V;>4qno#4PBJGuWk3F9O1xC~7J zX2)09zYt?*v%!@~x4#}94q5tFU5T~20wQ*a$$7>pDKZV}*_K1w|f4|pzZxm|vlv#k2uzsDkUqa#;!Q*#Crph_a;;pReM=mZ*!p)_e zf*L$*2hn?Odhw38=&O6h@TVs1kN?bvw~}CJIsEd=$vJ_7CrRh|DS_um>y!jVE7_^- zb}-W%QKNs+7tVbh=}7WHXQq^a7h5THoSp$NJRd}mDvmXuH>KPS4p1tbjkaFf>m48bUtZmo zJPVp{f9vM^|lEnAMemaq;<+d4g>}THUV&2ZplLl-b$UQ}urZ8Bf_1nGQ3>z2<@K$VGJxair36ha zfE%%Io~zK~u(F2xL0paQbgN@q`|Zd2FdmpAqkpMi$c(-J86~DY3R;i(LM4O7bA-`5 zPTK}XTQ!Smd{@~GWJqWM5b#Tw>UTaWl?bNx*=1wlGlg2#{e=l@-O7jnSzKDyUo{AR9H)HpULAkN{?D$X`y7- zes}z8lXlz=xa%mcXK}BzTtoRWgbW9RmTa)1K9p|`^Rn?1zM1$4&P-A`@y)H|N>N`y zp}~zStSB>V#K^2^I%Ehc)Wd?o~9`Bi)F0SP?VmW zuR6DPU1M~4%uWzyb?HV*T&8$uDZFar=U@av;-Y)<%7Va zjc2UlTD^P3eNSGq{j3}%&;ve3q9nf0%=XIrECo4+;26Oub&3vu*_^%;^lN{qpMeD( zSop3=TeUchl}97Uu;ejJE7^!_E;0q~+~L;kVdYIC>_In4;y6!tLrd*Gbz0*PSBiQG zoxF*5*=VPe2DjmWRnNQ-^hbgWhv-kjRo-3VjI1cM548qmX6KTzXnHdDA>U0M%vY+b zXYMDGPr2dEM;#R3mb(5!d_SL$=VYP3yF@;NKI@qO&c`ZP`H6k9^+HU(;{l%sE{xO$aj~KvTwm}#e8?UuDf_` zOBeRAxf^9lJX^;IwWs*AIp*VJev)Vx5UH!30p9O3a$;wMUF&)cdubZy37fQ{Suk8V z|Glu_%k%r^uc-yjUi7*-Nn0Mtv{$WI@^r!iG_UQ zWIa8K9Zt(DY}dqUl6;^6?+@8XTvL6;1GJDg_jK?-u@b*q|2)u2^_3h_EcIh%e`3o} zI1&Gndgs=1Jp{mB#8)`mD&?}$T9+bVRm?=h_QdA`5r6-}a+YDa8R8iQ3b4Z@mr*V4 zJYzQpM`_%R2Fk(ROIz{>p&WhJ5Sfg}oynz;JNNqO9+@5W$nQDN^xW|QM;^g$u2>+% zel3_Qi;TO-KJCuoeC6G4DBRcUhmYQn=j2$QdP8|Jwg-26LZ_LtluVZGwU99-6UWSlX>l!a_Zq3a(lxkptsSfGw|32*< zX5qoNDS6^Uq$~CsroFtf>%f4e22!v^D)}rTB*2I zkm0GE=3(03UR2q)VzA^FN>x~36eC?FX!cw9r8Yv>eFNmBpK7jYH+EWOy<4b;E zpWQ071%In)2;#P!uS~6xoMHoSYQ0USnIXHfyYZ_H7eyOu^oc_|9|t zuQd1!At&ney~UpLs?T1sW5Gjm?|C(#e8&Be_|0-i!LYL?$m3|<-rqSX-_qkKa6oddMcRU@i zTp879p#nRv4xgY_;R~7Pyv5U?cbJ%rT#7#?Mo*&j?tJZOm5RE1Zz`8qU0}``N)`sr zUm#>&`yE>NS{U_h#jB+1T~gAP*TnA8+HYrFimRjoAK&#Vf)|n*3F;|KJ>X5xBK@n@ zWwVBt$C&og@WAeWtRE)4_S_S+SWL#*9FTGJHYtX+>zt(!O{UtTViR*{Qy3q=tMsfl z2fnVsR!%>YLW*EPs5gH61K@jRZkP2qBxm7)n14kz&c7Ev;l-qY7C2IBxKqElzEc^@ z-m=W7tegxUMbF9ewUdz1T0rhq^^;ud3*4xATgNxek>AyuX3my`HwDFXZ8lS7d$VE_ zgsoPQ_*Sntr<&kmE2>d`Ju0IZH8#PHv|d|sV1(LGi1JLU zkX=82K<4JTTAGBhr|xdd8Z--9J>;t+jR=sy_FfFNAdq3mlo5BKHu}4{I`xzRMf|-g zFU0vW!!Kj%mxK zHvFJfJ+5Sfr!G1?sfK&kZ*O&~&tqrG$XU^qu?sZXevi}o$ehD(lACNa+*pgNr2B~Z zbfX@n#JB3aRB_29WV+W{?q9_~vs}$Oo@EdqD0JSSK zH0<5}S|pUgi-bw)5X9}{vGB>woiZ4T81P$Qe}#x+_Go89VLS{>t{ZZ~M$pbQoTuUby2-ug6)QZL zXJ=tyhoBf3py0m2)PU7QqPM+NxQnN-)9h{Q9tJ*9-aHc7UzhRsO}cVOM$_qo{yhwJ zHoAbuNFM~TfPli}FJ(k<|8IsbELA*3u}XCxs-xY&8`sc`bxY0WlV+!3>8((FxV0HT?rc z&~FxqCqeqQ9*tdLyM#3AyvR9Rm;8OBBkrL}j3X|C84S^w1L(iCV9cYU1o@A^6D=o< zek6i=GGaVlTF|O5&j+8UG<@GL6uC816+xYuZDE?5yfr@DUuov;m1f*ub>>#EsiO-N zN1{gs?`~c2`k*A#jeaiQQ=NVKy(Pt{6yaICY)_%v|b zXzwOtSwdIfD8c<@c~E5Pd{&fIh75LuWb)k0=_h)R0gSdOg`D++ zPtT<7Q-h@;A!UR9k#q@`i8*Z9 z{1)uAquT*tSt;DqNYGTnq}RdozjW{KMi!8qk(=}>gTi3B$aqR^6a+Pqhuh5Z5B$~t zH1SBt<9-U_mOGja&Oe-;5CFb`Ap$=pM-jN?|LNNO)xNPe)tkU0C0kvC1_i=oqk`R& z@+`FUl9#f{1CN7q1GP^)@`2~XYDxni93DRR&|sFHyTI0J2VwHhfBHXd z5S`Ve!S~vc;WT$|8;Jk&n3Rz97I_d8bYwKu^pz% zeDnu@Na3b{5MSQ@VW<9{TNaS34NTboez7}rLi|^%p`lrB_(A>M$3N~<9ni46Yib`%VlbpIIS?RjT-5&g z=)gP2f3bKHsG_9AO3%Q6$V>3gd75PXP09lyT5x~Z*n7}v$bYlo?>npF-@LdXp$H*+ zCk*54{9hP%`tQEJynmOIn~UYb`5)8z@%Oa;N#g&%OWr?O^Z%++yFW2?^n{SZkMFx} z+7JB3kak64-y$tE+cEk|T7T~NjfF-1l$>1Pv!^&xasCc2q|i_=h&-}0-o!}Ko6!8P zwhY7Q3K2zb9kHjX(qFM!%|EO|17|_SwVSGyYCCB4L$EA5B5$Y(*&ihK#G05D)e=bc zPZ@-fU=7|Sudl8HA*zu`g&|1)(OFJcQ?lvDrmLWMQixsRX@Z8q<3q(~0>31jl^~*}@{^b7NzLoKBIseyv2p&Vv;R0X6>`oYq zOP-$F0ok!!DaXEN=iLgzO|N{+lVPSj2v&gve;x9#;tz5d4N$_NEvz3oZ(S{v!S}va z{BF7TPQE3Ixf=r`9^8q)P=d;wS*E*LBggX(yHA+h9&*%O0pFCD=L(W@L4qcQiuo0r zF9d*3ady&<$7`}ZYluDT`*~fOdB?mM6|>cd$;jH_-zqe6XqCH%6Wo*y9YO7r>3_KNsUK_6t4`V!G`VmciwK&j#)L0|kFP`{90H zH)jCXok%;eN`gkGfQ00JD5lm?1k=^al5Lpw_d#lu)G&_R7VLG;X%S%#pV=y2PY=gu~rv5W{i&V_Twi| z00I!}PUJ__ANhfOfkfSV-e7iR%|fRR=?T?3#{QI!VUO3FT&Ze3>PlzSP(NE9o~;KK z6qcJWG}0#b`E#H1DihpKfD%c1(E4kQ-f&$2|w8gwl7k<^h1WdGJH99?`tUY{vf{56Yvhup(`ZxIcZ@zQ$|d;3}$$FXKR_ng63vxjFsuYkaB?Ai*gBW-d z4=62FoSWkvp8}@4{YtkT0B#HNV|>3N3f!u8GV=g-(J$!BBq~6fI^k-#k8yzm3~>2_ zwwt_I>j>9}1+DBVXXl&C)D(%NnX}nkfQ~GN>$2?$=oXMyNBmH( zl_C21Gt7H(2hbCr##|XhinhDs?H1Hc(Vogg|qSCL+ZI6Ooo?Vgl^E8G-eKtWnsT2nBT3+2l;Tw;a1Zoa*F?NQ%Ayz z;oU6^c~>GB3{IHYodw?VwX0~`WW<1xnyN>CYRitoFQ=b<$~jPH+NDDJ);!23bAHqP zDL4cFW>eI(8M8KB*~tVs2>3S7U2jKwRHGm94( zsy_}<|FnCuJh}{czf#l-XQ5szK*ETXEaHunNE=*LHe)M9;2U)g0N7_iGM`@CRSe72 z&za*^?;+^z-#`R-=&2>|PGq@thrJ$W2QC}X3*LP()+fc+v&GK}^FclN8jC^-;gyH< zT~w^sBkvjS`R5+qe(?hyXF&c3hCTW`pEX(DbXip{Z{9&FX`kI1BI+qMrtOnRADjl2 zqWR90bgR+Y^AVJavJJ>$DSw9@&8D+q4F3vKFLpr2FaWhwK7HKrH8@Hm)={8tEav@# zNLjp`R1YV6jrvaWC9V)fNZ>8b21l8v*CzOFOu0U^v&TV_Ddkp{^NodEySIBauf$-h z^`|zea@O;+wa1e=xU#MGI=*lLN!Clge~b=ZtC*av)jl%!6NvR)aUY6!c+rrtHuCZ} z0?i=~uMnr>ojDN?fmuP(^PkHcQ&ORgf%;U){rymP0EKc4)AZ@`ua8#`)G3<}opXv) z91Q&FMW&JO{uIDX1{MP&6&kZ_*oJe!1$aX&)oOe-L>Cx$LHy$dDeq2_rbx#0iC_SU zxoJK5cdj|F)e&f57F61t7}WAU<=l%{(yPXm8&^c_l#IkWDHA813W4b-0jzf-<`N=DAg+08V zN8A{Fe^rl)R(9^*3;O}y+^775Zb4XGH-2`=1&sNt9hOU;j6B4D=x#;Q$~LISecqA! zf&tKxscc{KN*y`>IoL4qY7l4PO6B#<1t$i>f$oCYOyCjDmQltZ%FggsM4w`Z)Jz<7 zg)Z(H*7KcSnBb5}^kP1Q=3;RU1$Nx4v$kfhwzUz6WsQ^8dlbi&GY$r#%8TA-%7>b9;Oz!9(^mEzmXlR_ttq_t0LjOgENvEU3CQwI<0?OW_TtGQ1Fdm<4L|sS;ScKQ z>}60OlLl0iqW0fbJb!&s1=6=g#k$YOcnGqf=Yw9btU2ve=+wbUu>^Pd0P6*eU2V>u z)Osjn9_~7e>N8v=4}v)Xnchbq-(Zr|UCYfa*OT>UB!EKODxhZidd|-sf@(8{OadIQ zEpbkt9Kp;+D!?nhJzz^{jrXtOP%&GU360SYYxIzc8yyy;Uw%P>%jGkCoKmakiAzn0 z!Tp);b=RAfF>giE9**3Z&K9`Q6ZIDqsjrLN{|K46;q~bH{wd0W?O7!Lg{44%s)5oW-4ed=Jx(xvJ4k-`V5Q!vT-ZY37*a0(4?pw z$m#PSQ?q>M4|Y(zlvKHHK-gR$_ zU7%ZCBm#cEdX=`s3m>IDbbN9>vqiBiDmYk>qTF%r9EFrSON?APR^F-WjE~Fl$O)e? zMdN^-c{ua=9w#Wz0E6?*p z0m;S?k%a@>_n6D*eAI#>7sAg2Ew+3T`?tPFhSG=GMm_qvu_p*$M^$EzUEBtfmR_3E zB&N0`FQi#mu(`P<*`DyUe^^t?GgYp|3q(2hOV-@833+)9mpaWiuqzLl+BdSIm$P3F z$?lZD9OvuRQDJ6+Y%U_%t`^jtXi;+HztQ$jzh4tE!Uv>w*6XK5McDJcNQ7A#eb_CQ zYWKihmqKYDC2%CAM*nH~3A_XIU}?cnD0rsB9qKQbaKQ}1ik<>=5XPGpXC34CPt@g^ znngHzTsxICUc5U5yl;Z)7C#+$C}V#bNehra9dXf9-)r=XJntJbc7OjY$0ALqGKIpx zdnTE>p3wH>x{m`wKL;>_b_H|cM ztZ_4*sVxc3pS?G@p9TCta*sMvRi-6_LNz$uG~f>fQtf8S@R%bJzd`HF9I0RPGK9o` zvsHBucZ&nD5(d?uBrG8rL`-1`iH|e!W}DVdXK6j8R~wi7uur5x_#A85*J*ZLI5 zOG0h%3kw8+xNOIF^TYShbT`^HP{1HP;gi-+shaDkyYD`MOTM0NR|{?n55YJHjn*p| ztq9#1#}&L2Tz%AUWbc9T`8dR?2VrR-^UEDcIO5-r5X5+)tX*z4J%#mwf*%A>hY$c4 z_{&t@rPQ!V7-l3RD{uI6V>WPr2d`rn`t~9Lmxu96|B453bXv}XNK-KKZ}0Y)Wr|}T z;{Bkb<5%MB$8*)_JGckqW3Hk&Yn27xk+&Wcz{STMoD#vbsByx2C=eKR zsOG{QM}Diry4SpEP3za8oCO>p<7-@CfiAoCM#$!^^1!8YN%Arr;C-7pBlZ&|?cFjn zfzY~KAhm|!&G~w^B}E{1Dwz+=;*9rJN&qcSs(l~)6w2J2_d7Y5sbl@f+_nfgg z(iqE79|@{Ewk~@?DU`=N6ucgsXLwyoWiv@+WHthXWjdbF&Mf#hs8W%E#jg5)!K)PB zrLM1Smflf#gKNcJ5xJ(tf?27Mh&GS_aEsSeWqCh;flUg7}E-G?ho{-BdjesCJRsDb(i$Y75hEFkU7xpszd zMilYkPhy_UezeNO{;In*BVmff{(OubM3V?--R1_@Px_U{{achWj-B>hbxG^zqnr{Jls#izsmlIR_Y!uy&$zj7k8S*H zixx4)SnyVfSQHn%EqQ=O|FVe*Vlmjfh-nVG+#Xrq#DJ$MP2M#LZaj`m-z)12=i+HN z4@J{>JVm!@y}-o2BgvM2^Tl1thCWhb2>9`w;J~QDVotA>2_g8_g#}g(wJG>?)UzN% zQOq~~qN4HXt?hH8a~-kd+#=p=P=AC&6%&n5`cnrg9cOySt9!3v_bnR|!4&N2QJm<} zb@KvfxSSii^d;QzwUQ6!)*+A*5E_D<>x@D$1?4Jz^p=jeW8Zzb%;kLf-1feO(K7Oh zgl?!HT8v-rTmuBWJL41VKYrVOcpgIU!Ol{PvOx3d`< zR$D8jt$pfiJ^PW95;ODjk6*YSO!l8%9nII>^DO-4uP+C(PdUb1%bdqtSMOh6eFgUq zUZaL>L3?p!!}iArKI|{*L=m)^TD37xhcD})9Ns4(>|@f)0lLqaCcFibDW1`(vkS#V zCcmf5(o^c>nVGC+ag5om?&Ngg7^owc;9pbZ=a~Ye0%F>ZDcZ*s`lGMHgzAhoHK1Wv zRX`>}%A!6v76TQ9T89KB=yBFP^@H6?6TYKQMyZ0YuQu^#bmWS{Z%6a?{gzil)wBwa zXtSlKg}fY6bbCYXTAaJiud(zzJaooLf1eEl0DRlIT0?;4vi~@yr#n@d^q z%cVBRcvk`mxlIw-93v4OR~Le!ku7-%F`w4&TV9V(F_L=)t{i9<-tFLEbceiH*4STX3$G4AfdUM67Cb{cQdzz6`(IoK)@ie`>H8b*vLQ0{K z@%s$=k58WNov2MKE%|1ttwqp6FY@;FhjC5;2$Ff5S@rpE841ahH~R3d;NZv;1j@o* z51Ty{HK)iGnj5(|eex~K1+MbSPP9zgZaoiZ#-#`rV}**Uu6u>}mAz%+6|bpno1fYA zc?2m%9^SXx9sR6JKl)Nq$dKjm3qD17QijQgkBIbG|L_2&d(73~O8peWU zzF#QWj-*=puxN?AkATl<{$q{S#K2qlMZz7Kkna;R`d$55Ny7xx(^ky7%UUc#ew#u|_VQhUV>_B>tK!tY z+D#G`{?nq_>4WR{)MB@3uJbx6&SsEnDIu5K@VM<{A5gnkB5vdr31y{Lc2^5!CU##y z>BT{?@qx{!u2bIHr>s!zxkeq#>w)g(nm4sn;!{qUZelv3_S#A)aG_7P+>lGV zq-j=0yp&h!8K#p3WDGEGZb1z4#xjx0QxqP*E3vC>ck#04aAh`0G+f#?_SzfMD#h=E zZR%sA9jI=i%$UinsptKglj_3^G?Xr=H2gjN^IJ1lvzyuyt;4sa4O+?|~d$K7lZj}M|HtxBtZa;)4V_d;{LqNbO$#5)kdOZqJ3BhqD% zuReMEk2|o=Pg)Hl#Ubk-74o_rLI>&0?rz{pMmrlGQ+%_zk5m-)Zzsqra*Ot`O={5w z7R5M5E0#3ph1>ty^$O>1kOhiq_Sp=pA(!59+3!+HBD6cG<#(0#OR7CFNc?uaj&-xC z9y!skypFL_C!M96aZsdDWZfDMxE z93H`I8jpId&nt_hQYUSx%D9#Hj4CXu^hMfvB^#&oK=Jv;4(qy^`x>z;Y?vI^A^>pl zjSZ@1dxB#Tt1N%+H+*{3nAKWVQx56rMJ0%s$mwglpG=`hN}1#!%;ibQ%rwSmh;~{` zs&V7o(JZrRbn15Z?T+S*Tr}nN7mxpo1z2*GCi)tj&VbyrFo$`b-UC zFHU<#Sy7bN>%=8cEOCbaS0kyOa! zVT^E6ne@#f)Kx1n6<0a7QzU9eJ)MF&g8&hhk8k^3K#mTF+#XHo1DygZv0A#X-XR5n z#+mbNW=a*^$`_{lDq_Sz=<}tLn8`e_LMw%sKuNL^4j(@zXbp%NEHj+b`FuWUIONIl)~o&U_B zu2+p*orYp!{%Cye2qs#kB;=MBKy$V)u2FX!O~laT@+&(hQChmzq@D81;n9()76um8 zw1e_|erb%RQizI$cbD+uP??(7c@8iYEUa?{IXi%9hv|Vwa#ixxcW}$m%nJ*8rN`>Z@#`y{w4Dn)| zB~X<_?>&p|Z@6vw6K3C4D=1cMh7ijh?j# z;B$JgcR#7Plv7JKx$XszVNAmSP-6#-`D*SxQ>A7tGp+{P5_snA%e3SI zMUe0@4T^CbH!RXmw?1_r>Q#T$_;e6ppp8Pnw*ND4E z+sUOtreZ^yVVT+a2u-uIGiImqDgt!$IA_%nwyJ5hdVeNb?%DM?zR2pv@?HBWSth{~ z>TaazAxbX_u|psomvnT<98hxH#H{Y}L6cEb)Gp6UWA1rBPmWkB*>Q&1|K`4O7;l~m zs*?__pxUxRhdZw-n^n zlEE1fcw&TVHMt}m?IDGzu4M+{d$YK&T#B-pqviAQu&40tuzpg$uRP;@sk7kqY_+9C zYtw~Iot0&xp_(x*_k)yC^l&S~v8@}|a`#(oJH=q`6gh3&s}2jGL%?D_&p#v%)59*b zErl0+CS4E%LS@319pUtEU<_<3EFCF@T68r6X2ol!p?;G}lkmRW*rW3m_LK?tUcxm| zyrFtV@){n;r&C(KgVb?WSzJ&iOhjT4mKP&+Yc1;3wgzkVk01+O-b!g9AfMuStB?rP zI$@T&9!Zw^S|W`QK{2vPfA6(Ag=Byfrqp#}G$jIEsVb#Y3978V?Si>v9e<^nTnG!d zt#k$+Yh)GHEPP%Gc#MZPy`|H`dS9!1BKeqBCpaDkHy!>!8YwlaG@g~lwewk#*>y4UF?fs2WFZ*Arc$F~sS6p~c&Wl`s+t6G(7tlGfk{iUMMfwF4i z#Aor}JhiLi*CpR{miQI@6QI9D>*z{8RTi}Ji=uZ?RVCoceIF}j!Y9{+-tw}e&Op9>v2HOEOk6mN-9~>2cJikp4sSM+e>Dtkkh!zAHKKove(+)oxh?` z`lvlv-A}UjfsY^Ob6<_7z;a-qpwhfI?z6pHuM47~TGW$(0XPVSH2WxM`!Ez*&yNw$ zcDDN{zv#koQ3hBp_W_lD{#Qi-sOU($z*@l*-%L zR0TVEuD!UTJQR!DaI+)Z^a@rXDrxnb1Acq8)$4g&n)w~bps|B^~ZX`acGNmG#a|)A*b9HH+!T(!g9Dsx11yKp_ z7I#7=+GItqT==|ndQ|51?N;)8N4>vjtS5SJhpzT+dZ7jiRou0wTBt8U!B(J2&*Nc5 zc+dBmSlbm=!Hw(GJtjf3+PA4d*CjmTA$Faafnuk;;ZaTZ_EO@aZ5l4os>sEn+~cx6 zn_H6i;H^=DdY>ADDO%eQPORezrPg$Z;h9IQBGp(5T|OUioYB~{)K$<=#MQFQa;8~^ zY4nzs<$Xj~20Nza1%J=$-bJLZ-Ia% zGlABH#F*Ey@#Qb-(K|~8g~YAW-$7%p+68GbySJ@QXX$F^0|P)#i(9eb)JA0O*{1Gd zF&Z+mQ{PrhT-rf5Ke6M4^yrii;5WUL9ER4>4#Zx?0j0)g$1MU-sAdlyzR$_~h(x=x ziav!D`>tL^=VaJg*D|=0fX@hWd37q7J;H+@&j8PD4wb;hcT897zIack;>LIs1)1#& zyHxQgDCLgZ;~&TzuQr|!*YD8#v-Se zhBhC*a1;(vEOdOTW|3Z13Xhna=h=rm5mD#oXK=0C-`9q40xSkf4%pn6M_TbnM~{_! zmFLhxo(#ikc6m~&VAMsKT+HUH{rZ$}wC4DEs$@Q}Ik}daRI+J{O)MKHZ6+K}*{nyF zNS94b-n*fDuU77bQ`}x&yWALJJ_h=S_~H4eV3UD9d(%E1%UeR1-7+&*&ZgTB{epGaqDAU1>sdR_-DHlvZq5p^H#8S`8 z%E;Qzb1kFv6f`c^y8|;>Vs_ae)>bPK&ZK( zTKqh6*KVm&lXVPFuVogJ;*(?ebNNOgS=Cc!?yUmRr9Bs4R;3o{pa2f2O=SYlkQCd7 z9M%U$&+oHal4of?Cgs;GQqdSRi!^RUmmNPS9>+CM9QviVSGBp#wdVXfaz8Kbr{$*R zy{Lh#POM4!z1=@1O;&$x&M? zmA`0c^cUmFb)`@Gpi1%S2O61Y_eDK;hM{x&R{~R7{YP5b^aq~>)m`Z&X|rHR#zn2h z5q*jA^>uluzqJe;^_>sLz{9fAS`7FtdX|2tbl3$4u}=;LK#sC`agL)pHK_A>c7qv0 zTfyJn;v!VHgjYr{N090q=d1ZDjZ(6WYL`mIzKAZxPs*NkZ85XCBLi&7e4fEtoR(!( zrUI%}CHYeErTP8+rwJ6QzD5;IDqj$OIoPep>4s{9yw1ZCR0~t{b&9_h?*AbFd3(U> zR;5>ZNYUL=1Wh7TY&CdqE7Hj| z+u~78xlw3Wq;vh4mNb3dQ+BSe7T#1^3OaI4OWD&hAg~ zq;lizJF9Jr0Yv$NX43dyGuF+99I)l%ZuB5|w< zuFPEDlBpX>*(3)OoG&~hlGY}|B0ea#7xLr)5!3r@Yvsnl(DN}#UV%)$;eV7iE7*E% zC|Z&X#LMeFcT-%f`c139s@)y0-IuQ$<(6ETQNDsi!)j3LS#KA$uwSOyGSlJpOT3&n zuQ}!{c14xwdEO~*fxvv1B-xt~M=8=VejGuP7iiG7b~MW%wyej&V9V+8$X)C^B9*dw zdKWARR5W;Xk#>{wrZXjN1C?S+olo@3buEsolT`mU%Qaw?fp z2#Qh~GulNL^tL8dyWhk)vR-n`8B$B9Bhza_&AQb@(_>e9i>~@ z*F-Rabe~1GcjmgZf4jMZn(t@&EIrR(FOz{3G>*FuPo)T~L_52y3$%@7QHpwz^`+EF z=Cy{_-hTC)Whk|f1yow&0)3X`<6@vs_lrS+b0xUhV;nlW zxb35D4$!sdLW<9G5tG-WCFXi=K%qgsqk@VH1q8cT||EI6MS=$wUe`mDE>dp<@VnRKgP z6Q>*1^yItGS(^4zg|AK%T|yy&MYCJ@f7tu(s3wis+tb5ivYu$hDz3aRy z3*L8T-kHghXXYvMn`injsjXpy>Z`k3*}HqCJKuU|Pv?&G0EFhn54)8L6}83ZtW-}` zag(3hZYC-CXJSuFcXcgSt;x|M3!_quzInfC-{ntSKX{B2+oSXKsz|)C0*|NcOMr&F zHz?Y`7Qa8ee)t`9{sVEPadW#yA=~2YJL!njOk-e(RC+`- zB0wRJPoM^J*g-80HrZnU<*p&CT})c&Pn@JddiWepm*IptqRFcT|1jqKxb|N5lCi1L z1f_Y)Im&1`sjzZ4QQ?6(2&P3u zb09X#ezi335?>%aOLiHRnTlEx__=5NFMxEhp1Rin0!zf^Q^f`?>n2>GhDw$}@{|T= z*kKVz(-hEJ6`-(VBm*=+a}1QIAS5*oN=@Ys9RPkJ>8|S*IiFY5bP_hZ4ufV}N%aGe z%$dHupV_r~r=A93`%c&yE`Oyd3W~FAW!C-sS~Q5c0`rEBiB#8u6l1dI?9}6g{U&Qm zS&0?SRL8L{x0!jbq&clY59)rZJlvdJ>_3}Z_y&SrO0lS)kP*a+{R4yZhBlo1GZDTs~2l>CZNo4n`>6l2FC3vmi@iH*NhcL%Q)dDBEVn^F>tqzg70hRX^JkJG9b; z?wv)T8uMx#)_omkq*$aE^`I#ehHs#XNb`A3VmC!xe&if}+kTTI@0bvmLmr zB}+W6wx5nvWWpLUQrouZ@@W>4Z>=XtAsL*xQKp_V^xp%!$;m{ z)8*k+PR_?2twiF+7l=Nl*h`BhM)cn!`_rqApZoh#?Ck6g9v-;|PEJm|a&mIa5eWyn zz_(|={hWKyT8jjsFHF+AAx<-Qs`nPn&199f$Kw&33Mx!gx_#4fpc%K{Ze8#<94W~) zLJ|GRt|i5}qo-cAkC}5{2S)~~UqUn$w@KNpSyR-hfiaByQndzViXPkF{g?35dR#55 z+4K)`M*$&@PgmFTy91}*mQyUsN^3;buk(K!NAZAt3l8uxIpO% zh6S5%xv+KP$kFBdZj15f;HOap#?K_TgO$l!2Ea`n_NM@3*q8d)qtLuDR+*w;9j$M& z)T~7KU8E9nbFQ-DOWGRp>LsVO5cDkH-W0;xwG$|0-l%b;^V^zvor7>l>t{2bX+*K| zJ_qi*nV|8!6xwB$s&C3u$3`^8Zi>j6zk-u>v_u8u@k-(0bE7?*LvC#vUcH+LbN1lk zIlK7PPw||qE8bQtO65q)L}Dg0`+KFZEEGdC)8YUhN|Cd%jL~6T{ONwCY@J^M<8k2Q z&+{onSk|>v{i=S2ktSn?`T`b~wbbO1y>L11InKOnrMR(}SM!L89R+GO@uY0$K=8-qpVH`Pr{3OTy-!88Nw=;@qXB@p)>KNN7t9!t_Dl(Qht0 z3q0mkD_RSovdbcfZC{SDOc6<=3j2L#Rvg^8MR2%bk%{5PFPq=Iye228JURnZkuCoR ztJlL}=&^F7h?VgZt;Y)H_`_y)qxDbwq^I-7L^gnBd@}GrA@wvMwLr*F@f+LRHOW1= z!uge;kKwN`-KLe>nZiR3KGU>KI7r#t)<8!14fkB{?`m49ofNAt+ja=K`Oa=MbVz@o zkH*OI^TuRANDOZL_lPe|_=Db5Y{*wDhF!J~U>7TW=4M{9uZ$OS^_)MEf+FC-_>$jc z3T~#tH|MP{Wtb7V!zD=G0!b%bvhyYZXEd!7rm4Dy4;_@T0Dsc>a;y16toZCG()%J0 zkbM>!ZvW~?%jc7AlNbc0B}W@7N#KD||9i;%x~rqD_;TT0YFh9J+zVRvHcE5)hh9Tf zid)ug)Q2CGcQ&JGOiS-+tMw>3|Bh5YxieX}z+n7C{5Oi{@{tTQ=c{_haX0OSd>b%) z+w5f}St3#ghZbIvQ{9R$3gc!y|04N*`jzSYUr8K#rQ}e0 z|Gu8@K5&!$_v1hBK0f|(PNe@onkfHVYd9%CU)ddW&W50%2)y+VPWVY7My34g^s>0P zE&}2_32w*V{TH$J_GqGFdH(VAuOc-G|DYi4eew)A)5x4Mh5c97um2A@RQ^Fc`S^QD!Go}E2$%J^SL6a6ajkYoPc z6vMAOiXXzfyu1@rQv!GIJ{A=fCHG!bw4xp?^jGFT|NIcU`466{tgQvTxOm6|EOPFC z5Mx>X@3X$hCA~7i?x4Tkcvt(59MtFB_4f7Oi1k;_pO^kVcK%BIbnSl<&(V#1GTQ%R z1bI%cHQY=18(ZF{eb!01_Sd)avUYVXCBwn#Sy{PSAJEg$W&S6=6z2Np7OtNY;x_*=f(f8>vko65+_{+Ic;hb0_t`FTCN{a=jg+kbuC z#Q!{~RsTPj5ziBh;(tHKds%a{z4l-(gpnO0A42^5_T&2qxF7oZlX5$ufYK=oE=en` z3a6#-j{Ih$hD+uHBPzqag`}lW+90{DteMQ--<7mC=D_GiwWlkEXU%gLC82rCzH(&E zi!17Q0Og*5tzh*IOtr#~1Iw(_3lryQXRE^YEl0lk5r6q#a8%Q2Q^^w*`XydhX!b6l`hvrEh9fZ||1nEmgqKDSIHH_P$l zDv)uFN7sHijf!~#H_{x#tp->h)N`QXI&xTgp8P6P)G&;Lj{T!4u}6I8;H166{5o35 zO=P(EeZO|kSqDfYpHTs!0h6Ds)nBp<+q5^~LHQw`^2#LP-b(`3z0txl+ozNi-`zz+ z0XCm7K}*CtB=?eWwk^?oO+msSMq|11Y9T5KC{=AT>$TyRTQ-h@(6Y&5^p z48y*NxMYO7EkiihCyM<<`Q&GRN;4TauRP|fVeqT@tu#&bYBImELE&ZsbESBjd?5fY zJaZ_zpVkSj!J$5yt|{WWgRPTlP?MQc$rSIVLl4MQn9gO}krR+TPI4UB)hE_wbjj2T z{Oc^ZU(G#d^XAl1VlFXsQ3CBWSpDKao}N)-G>vlgpL1A=fjWlo`CT4+#%*3Xf8})p z^rPV&&WrUw1;K|VpDt+UKH#1}4+{$%e7ZQuqd;V#J? zfM=76GZKcJb!y}dL>ibz`=dnMAJ$Tvd}P19YF6$Qsj}<Y+Li{^EQO_tbyYi$+~ku%k2BIu53~Lz>p3T+I}@U zsKCoW$)D{3C=%6CXqNjfA4v>DmGjd<_4tKE&XfD@Pl9-%Qa8{|2C^TfNWfyS)F;~+(!FDLx_rR%#fAaSGulrgVu25Fmc_kFL}-Nv-DWJrOtQ5N6|&=9GSwYVSvdBJcd4PfvdRV;&Vs7tid8@pkFAnFklXg`&sU|`MZWZzl|W=J@U0Aa@?~>I3r~%=|O~M zlFJ82RIkQPV0Sl0Qtl?s(Iv~lm(47Cs05ujQg4j^swk{q{#M>%4|_B$iPs7VcG^4f zu$f^hH|7`{-t5)Prxus;yJ^2PldPA^-V$b;uf%Tr6`;E$bCJU9jYT3awkD?OOI-QT z@hd5B%-?k5&PV&kKXRSxR#8{MfB4oAwp{lh~! zw?_H|_qXXX_hecOBhg+HXKTrY7t$4ZWm0dd5g+Y%5S{c4o|lpNE?Tvv0F8`%x)=pA z+R`yedvG=wzc^a>6ki>$07vBpsV?ppP?G{3A%~GPsaRCEeMv0#6j2{FmC`4?^*}G8kW5YW|!6~&7dBp>zi3XVGrG^qa zjI0@ugZhb>nZQuxxa`3VZLSe~cws|wx@S&zbKlO$J^_VZh8W!TcP&PRtx9@cAMs$#HOh_r`ukx@376i>#*i7yOGsJ!)013P>$Dpy)qz_9ZlqAp3_?PB zMIzCEOuLM2TA)o%AWvyZO74TOZz)|k1;u{zyPiFk*#V2lj*}9CHzQIdJ9Q~1e2)6Y zBVM$7AH+?@M}O>#P?ulaVKgEnn})njT*RMJTAcRYmqik%Ym8Gczl66U!!~!S*S`Ax z&9l&HCWVGhSoTeM$u?_IG6;dJQB)f|10QO3HaxDZkH#ha$+wk$^UQ;;VVPF& z2)_D}Rb;FhtpN8o&}aA=JP*Cy^+UouCU|KL=Y=4IU^+Ik2=5r^k>Cx1ha)W(r2%-o5mT>#9>! zW%q@cJ%st#pICu`>+MLA3-M06>SZj-!pN_JlDJYn^%ky@t5jU}DCHqsa@Myrih2UA z8CL#nXS-&#d}AGVNyeq5@n!{dqAyJz$rY8*%U1M$_rt(&Y$JdV_5*H?d!66QS8 z&yJen6ZT1s2yK)wJAoCiI+xte^#Yq;9yUX2F!z zn|~5!(s^ix`(e-gbg3aMbDVeVm=~D`?)FT<446r#tw@kDL9l`aZ6z(&vv;2^$yPWt zoTB!FgNVRXHu5}PvKEAxGYBtvnZtRQzTA7Ps-(MSODrvN80bY+EeR$KnidXM#7$Rj!$wPMRACqQ7kRED^Bk=2e@uMgdc%#PDxDgm}WVO=CD z)U6J4KhznD&or>|-}(9C?S+jT1vLo1Tw6BiSyh~Cdj1xwsZ1)k!GScnC(0_ZyyG3T zfiEQO@7}nayEjoqL zn|*WFh^HR-^n>pwz0GHdq%ZnqBq&@#ZJ+O;I(|>^^a*toi`c^Pu1>9P^-&E0`}+{9 z+(e*17z|Jpo%mF!I`_3A#I|QYsIv23*>o1M;16@+sq-ixT6yq~ctG(y(Eaie~q z&#QkDtWWcsNujx6tN?REDNBPjL_EUXP1jgpr2xO;?=n<8A?sjAEV-^Y3~*h)co@NG zqOi#kbXdPfRs*a~75~~qLS<5V-YHNAodI2?B)h5xe(MYC(=6|g;3k7uSc>&Sg&ytH z_OlHh+I!yRO+7Bk7A;y>mj|q+<{=oAh70E{AGI#W=xGNlFQXkYn#BYS$Al*#?~B6L z%OHh2yzbs*N)MGA7!&N%PmbNMAkq?S_{WGA>@#A(6AT)(qC+q$^I67>OHA)}iP&Lh z^V7D0-PQ$U(BF}z!gVvp)457}OyBzhHm8ljB+e6VGtv%uKZHs10k}{uZgiJP=;W~D z$J~!x_h8wQL%Nh75#JRueeX}-eC86tIi!(073E!AB1Mu)<|dfdN^O;9M$)X>XVH^^ zG=xmkfotw$bW<>iHmD>$a~mj@rCHocxye&AOx_4#z}B)CX-&q5dtS!4jPB+H-EZO1 z8!uP)*3KOT#lgxCw1ywI+`_vQ4#Nj8xJWqXJGlCB95u~C-aS}sPQ+1V6%591_dGyB zHfW)IV%a9$anm9FmBLyVUZm9cdJ2_1?!Wr^OoxAdqp+5@xqzh$#=lX}OrG~wkJ+my z{n5>VWzn+!5I9Xvp*VQhG%|&>mAXGt{8)cUe7nT-ki>G-qmHeXvQGn{ZMz<2uBfO) zl+1L_`98(+;&x2sd^bi+leeA17-yyBbhXVCg(s>u^Tt}(3o`an#B_45X~~aL&6RJi zn8P5JQ!&E`pn`EzBT^%kzeH?Z z-{(KH)Q}Mf+h}yDl8keGd$l?5`@xgsyAGQ7%1vyfnTA>c4Ns4Yd5!K~Pvqs@yk4tA zC*k44YAlQsY^{ICFBNJcz}P~@IfNYe&ZiIKmm!0QDl1l5%f%d2 zd77rhE;t2t|Gdqz!MP9q@`!RX!eolyC`=tj{&{@XydHn-Hg>ayYQc;?Y6xI88PYs9 z%|Yz)g5uFf9Gc7zbBqs9^AEaz{l@Fa(YKFE%^Vni8VL9wC9%fJ1~q!$0UG?w$tLY9 zrA>%0e3v|7a9D$1mqhu&$S4znjN?`FxbZ4uIXkU- zfCv93iP{*eBU@`@xDZ2}8Z&cL^LHCD_uaNoy6Z_(_Jfejf8+Cgq5aAfH!_9|c2oS9 zIoHJVpy~0EBO;OiwhWX`1npg!Xme$4wc;7lrEm=X0#nRX8uOr$TT{OEv>2j>CV$t`Jp||uEONVtsc2KDHzK&#ioHxsKq!OyB?KB;^akj zdO}1T{Fc^QJ8L~1hk1Uql0v`Y4Z3{?Z0#%uGo`LtXdg$H~tz7I`U@B*I5xF_ikPxA1Dug+1h3J|47N2+uSE&KY) zA8G?iA&2Y8nR+C@Orc=4&Qy?Bg3nTSEd5kGYOeV9u*&QJ8dPCKypR2&$>A3v%sC0C zFp)XWN3^%`Yg3yxWGRg>uF&;vv58o7w6%9Cc>GGJ%6(Q5pq7mj*7o&DDyOudp^@Q) zmEh-^Lkyyw`bRzhB7I0+A0N9vaoD2S(E6-FG*-A?l>s;To)>96-M+?wRp2IQU*q=I z#Kd~P4BRRDuy_`_hsj27=Nlbyq10jP3&J?Bk9>tO;u@bTEWy6dyuZaw(Z@j062lKbf} zDxggRv-4H0Yo;<9SU(*tU!Sy>i-`g+g(KDZleW#*cAcLT7v_)ws$4;eMFWO}c#Nk$ zjGn>k(HI>f@sih(Oph$D!q$>t>{SBl1{C~_FpLMRhZBS5o*71lZQ}8?O>|D~EyJV? zKMsgh?ZX-u^H1o4SWyreOnX?+dZQt9zO+2UAl;}V$$9!Ahw7eOooTWLe`5dP4Jnw3 zw|ao0cK%C5{mR4s41HBvjCty!-h?s(f%{CFk6Zf5kn-CjuN81+vS(6?7)zxOLfD73 zREF0BfBfPw2)!7>+|Pj%x2~an=*+dIG2smUEE}-UzzqtgB#iB8mh8{Lz;~2ArONq7 zlDex*Y0vRez^7@lSf6l6v$;k?({u32=KyuACq!93Dl{x+=bzr4gPW~r+y;{T#~_5O zozqk^f$7fl2B%-n++J(1$3|c4KloTpc2fNSn~OVAc6;<#T@FpNb{Pf3oa;(rL4jS* z)Tdjzcpsvcl!_Hua-e=u%a;|3&(XZXq=#p7+pM^$@`IWza(Na2m9UdyNgYP1R z9O|oNKAL=BSBw*M|G?}LHk8O$-Wm$vQpZlddEBu|7D9_hpv~QS(WtrO7F#`Cq%_G1d9tht(bl6 zS@B7QT%xFB8iCf-LJoAs2GQQT@Uh6CQY}($yyLD4!Lmukg61^8XI{U-m+LWe=m*xg z!=)^`WPmcg51)>~JIT|^+u7HbzqXwtDaD2Y?XxeB6d62y-^HnQqx+=UNoB}whbnII z5X@{ao_0ozhiO0x?R?0JND}6NO>SSqjKlhFb(04WqPR%*i{X$GAE4oe{X3K64=~6NrDSt@Q zE1A3KwIS0JQ&0i1$m6#<8<-7^RMSU?vYqw0v)tLWUDeP>h^T0+HmO&sJo-cB^F_u# z9%axMn*E{juuy}J<6*(Iiw1?D%P%EF-=;lWy?Vz%YUi|K4fF8k#kbohmY{O^^(-0h zf%GaD*h=$&er{J-kWtHnf}5kvX|E>||N`nDav-oDIWY zx59rrH~3b(OWYGLu8jhk%j4Mkk?bbjn7Tw+ze(XjT*uxD@Nzr!^^bl+z_p2`s=d9P zRX=&7Y6H2@hPrIk9HsXjM@^_fR%Lp+YCW!Hzd>45!zBABvoB5#rOX9(@Pz`e5|*?v z2EV?9aCn}>f{}es;L4)^9~UT&Yt0%3R+pTRPe1v$xJ>M7 zBgCr@wWq8UD)l%+&=xnm3Iamz$Id;oTO+ z=U}`P@FXDb5nAeT8iQ6(1Z~lzd5azGf8#dsf0%TX1WG@c@|fn z_;8as+O4IAO+B3oqDmOuCeFhO9;0yxAKNdG5HUnS=f~>}X%J6B6{hCiz3cE)r|?O{ zrhDfDWwe*W!**FnmR_@J*a#m_lL&nKoqlp?Tf%O+` z^{yBr<8Tc!wx*)c*e~KX8Yt`9u{E?CzD6CkP>MA|eaOFc2NOCv8^TeT?LUvh$*s5$ z@8j;5%7(6LWegAzqYwM!$+2bpiGm;E-M%6I=x_?^Q(Y7E>+W<))i()4d#S@-j-8dx zB=D_xO=Dk~SBPUa+b&Xc3LYNIA`O$-qE3R*%Wn1etmnS;$Mza#5D6SAouC=j*x}+Z zFwuT-5@B6ibIhNr$FUjw(>q>Yulcf|n2++<-Obs!N9TwAnaRHA=NG$BR7+lidqinX zSx`mapKj8DW`kQDy~WQ?e0{2#1H2J5Z8Nf4Uw`iEe?IuJJCj)}AlMzV$)&DIB98o2 zkh08Kv1&|0G{|v$&NQ0uC^DU=9Bh}tyEZEk>-3AwU@p^-9|qSFJ=5( z&?}35#vQ9TTNrzd`^Pc2rfO52H%wJnHqS-Bh}E5#DtC8$0*y{E*dn7BJ zlHOgm{mA}V+9HvSh~12h0vkL5dYQ{%Me{wU8dIT5#RwYme)Znl zq2hKe+$B~$8E-pgu7QkuDmg00{UGyE-Z~wdF_Fhd&G)U9qpoJ;!*j9=n^s`Uub3Ii z?c~C~y?-PylwG{8zZXdDx~%SFb>Ju!`f<6SoF~pOM))%4*tYX4fUnv*K~7ww*gUYK zn+Qc&d|-H#uoZfoY`ZRgw`$hOz#t*qMs;=SGu=Xmm}=^)ef*Bj30iu3BLo(x{wkL> zf3r4MLsHS;$Ki~5@TY`h%a04nZ{HrLGkXM?EyS(%@kU6OJFDUsN`!(4Z|7xQ$@3(pj zWA@c&g}3DAR1IjrqH0z@FgC}%d=(Qm>KNtI&jqr5m5KzR%*;8@m@{w7|Cw47A$#po zw~_WF!}prpGgTpKc5`LeqL~j%wLX+w8GU|>zp$R#S=TiH&oCxDsCr*}h1%&yl|V}l zZee`>^BYSPhe%lJf`aUi`qN1pt^_)Y4Nfb__I6@W=L4T-U6zD+FX126*++(tDvG>} z5UBR>EPw55q$4YOEaMOtZJ@@o^<+XHV9t&kho&uKEA`<;%F#28kYTGybrMF-Kz12y>tMdea&kv0ix>!WeLf3+M z^8+rl+@|asNpE1m0i}@i{fJT{W1x> z7K16+oD0>MYsvJH02RVVCR~yk*Zr+Lr;&c*zP)EkLM`@VvuiWNZ$2IPHaVS zyAKxY%E5`zi~j9Z3wZMf^RFj~VE8-sT%PfN_U%Yhye(%Wjzqf@Na((0gr6X4UC% zMJ2Gw*FhPGVW`f6=x`^>si9^tD$pgVa{adIqhLk|u4)d$W;bl0b8;lvD6mxodaD|n zY?q05k>r##YvSmq;hf-rNI|M|#!Uuf=N)orNs7~K z!C3%tyGo8o_CYv*786-ntl#0wrMi5Dl5e~ed9y35wm#^XQb@_m!%qY;T9a^X1DyXV zx@8o1bFiSv1Tiz{oHI)J2M zby<`Fp(ANbT{p9Lu%<&@X!^7%qK1!m|6r^%kRKl|T7`B9>L{3@UI;V^0lTC^i))gv z@t_C527SRXW6ilrMyWxxT@0d+CDv$_nXfK&vSDz<0kr&i_OQh6TO9xQ z^xcN}bZds=Ntcn;np#Wd6Gy>7g!6Ws8|g550|CCLTgkQ2ZCF=1xyO>1gB?yOusThC zYc5&o8znI3ymnzQ%9O9pZJ%Wav8jp_C_1rigq zTC7yfwns**2`&H+d&*>yETcE}0m~q4y9ll?j%Ro}HSei{sMp(+czm(iw)8Ap(R@A& z`xWQby{+w@%;ToC!GTGwcP|2yGJ@Yal6(TXMHAU_oqv%vFEkh4FjpONx&j(=7C^f! z3-BpkqC&wS>q@4-x>n2ClRH19bLIrPK|I}Z5@MZ@Z3~u|4-ETRXB}Zj*0AIlTqe!5 zqfLDmRg;EAqx~5GNL+rMOR$7vCwHGUM$=+Uco5DR`z<*4>`n_K!zM7sy;%rQ+>yUs z9gd6CRn%*VZyp61I<6x5#CO-!I7>jA7g(AW))n5KM}XYMh+e#ON!#Dw->hu(t4MU) zUGk^(!Oa#;jbj?Ja&U)bt~9&-^hUOAYW!IPtA%Ru*BwnU2PQJm?wx0Qv7@kU`0JT~{)>X8@JbT1MgGl zo0pd;It}RA^vJ-NhoklR{wEgYMm5hyzjY{*f zx7Li&D&$Xu4R=^-(!pN6z@@67)dC8s0FI6w@> z!X)zi7kus-^AF0`(K1Km)zwM2wNF;co}VHq><#JJe$nVtXg9<+aYpCwzky}`_rD0Z zVQ6K=ag8><^FI?*{~ySweLf_XUqnO%+#CWxDxdGdL&+!qsB*ePUVeIM*>Ui2hslRL z)NJkC%-C=KRr^2xR9+>k34h(cL(9v{+oR1H7#Mgm`|h#aNx z8}8d=C@&2_=3HY$mM+9P-Tx{fp4V|Un{|E>@mIf||Cp|neLf|&U+l8RVa`g&JNy%? z#yW-=Yn@Q~Yfd;2k@1t&;C*H5yAY$@aTaB4AH$aptA*!9a{3q^Mot^oBw_fI_PTL; z2|ALQ+J3=V>wXyW=O(0@TA3_@wyYWJ>$fm}ft~+Ji2Y30me$XO#!3)3tt{>?vNyyB z_>fV}2PJLtZ2*Lb-)nbhk2*f^x8*2cwM^|^E;?CGmtN%!hyM($0S%4~;q$g9h>lkvQ_y+fs!V18$e`JvGobJgRYl1YFNpJza3H>F$ogL765 z(Kqhqms`gt^*I_ghXlHtyMB+tU@+TDJ^5+3GRYZ@(KpVq&hz!V7EElvp)86{Bn>@B zWg*yt6xoBoo(Ejj0jD)u&E#XkL^x12)cBG=E4ukjODnG>2U-s79$K|nzttQR!+i>1 z;4?A195psL9$LW{*LFq3B=%<94rlS!Tb&HP#9S#_XWwBvps+Krr5~|NBFFl{);x04 zFapN7d{Z40sEcGbE!K&JEkHl|NyUQcidQo&+hVQ_POiN&M%l(5cq7&lB5DUsewq-WHTh9rJN6%jcVJy`is5q-O7esO zZeWbgiTtDZv69RH-K9ml&g?1Qmm{%4T<$V8S39mJ1sGhvNN{FLFE~iFEh&W=%av@d zpVZc^{1}p=EvMWZVQRvxB@89gZ8klQo+Syg4~YA&cXc#B+>#BdZo`n=gP+Fn^K?}Duczbt)Wo$sI zH8f;s4%B>k27qIYA|I-aALDYUFijGN?-N+(UdPAR3NpU>a9(lUxHM7s{q_@0Cqg1O zgUhUWy!o|aGYkS&@CmEAtNEi3);~-R9JHcaV}w+!sy^Dq7Nq9CBqOA50ZO*3mvgly z^*0QMEcqSA1@H zy8fXx$~SOCHL|@h_wou{9Vm&#_&bvbPp-NFl2`{M?RWIvq|rj{E@<_l`^#~psc@1QeqKoAE1 zqY3XsBk=vl*~rIsR`Z}A8r`oPpOXMj^T&!dzUA7?14Y!VhbpoK06v`t;j@lm7s(t_ zlUt+O$>Fq0)VaJ_hq4-AGBS$ELr;}EJ+^mdYVdmhOWXuq0v|Ug^e*2a7=1K#Aeu3T z_4u7J3=YQGPP550Zq%XJWV|{h3e#?lsciXMJWlY?Z?Rz5)g+4`ymGuOgUUIkdS2aC zbD2^UZt`^0Q|mluzkzfdOPBmsT&RuE5%a9p;>56blJ-sNfvQ z00WTU$xCmnw;e~c#hFZ2X7n|lht7M{x0Q!&yl|K>o>sC!B6Zmg9@H{ zq^0f-M_C(porx1<8g!ZZIljFW;zT+tcI1PlNO&WG(n$PK?c89c9!5)3hT5VT(7btR z@<9Q4?x_uYCE*M;*W}=i4oz)N-^Sqfa}aZXbzaE)XUZZ+Y+WMDq<7=RX!P)xzA2x* z^&2P2g3Zq_S7k-14V`Flw`Gw`z!7rSj06K&A??d)Ub}PiXlBI>e+tA>vOy7VW*I05KPvV}x)%;$2 ziE|JxxiCr(=*z6AQ{@y=VwN~r^2X+V{*F+jH4}C4kTo5X&~PrCeV^Sgs7W!bF^zj| zAlcg4_?-gS&R1$VtRd|Y=@d_fsvY}M;`R+A=}^#+9*NLzYYN2mchz)i(^%^f@zV*C z5w0j!4I0lGnLDznugmQCt~tQ%Wn8-queRAbW~7XGpIvGPIVkW75Zs<>{_(qz0z{O) zJ}hDR*e=oe0I~U@?Cl~w+eaNG=peX>viZG%6yF=NTssR*(D!6fAmD`jB|lCS=EFZ! zKP4EG9dIg?akF~%BYoGuC=oW1^VZfTTI)@kdwXtU$_gAlV-=gc5aVKecDL)w*wgjK zhk;}#=Du9R>{#x2_kJ`YpDd)uCzak5%oAmbnRT?0XCO);Eocsjbu@& zR47Y+aBWqJ$cB(L8KF};x|^K0RSGhOU+wlk4QBT@slx;iTP7zD) zUi^o+BMEA2>U439zMiE-ICpNP8?kS^ChlMz%6H&u5W*aMZz#@8lK~=I4se}+;wzY{ zn-c-wPA(>crNj8oEJt^#A*$)Y5^I@>u!2ZT9QNx92if16M`<2AQq9DEbqCp!=063d z8Cv*R$~@^I&c1)rqDypLy4g)|xUZID5af95Px?^LGnn$tmz(a+jS+m&V<(KV!jm1n6$N40Ytic6zKL*T`CjIk5)BajG=0>H9 zsu?xgjDF7EE0&Ws;Z$wOu*2}ZiJg*trmXXlc(i=Dr~@=;M(JygP@8@YUA#^X6uyIyq|6;kK~k1 z+K4Y%w3M5V7MDZ{8GMV-ehZv!DWBpeV~&s&h~>^{8)zw5fk8c)bJ60iqVqV_ptTL~ z>WP!Thw-0T_AETuYIod|566hH4_VxN>)$r7X{bFu&X0xggSKzQzz~*$`fLk(4>i&E zQ^n?$)Z9CsvO2zt;}v+*IWB&6@bpp~H)OL?7a6)_)OK0bSYcKYl(D&_^Mrl6$l8`| zfB2)mHhhuDDs%0T`|(by&P?6#%U7C{&aW25o7O+{k)6T%H&1?Fs zPsdWtF;Y+*Y)X?&xWPe#CR{)Aq+_xGxFdoqq&?MNSUqGK~@vgLWDPX>80%masI+1M8>Dz&Ye zu+Q-H@*g-3_VxEqbLF1v=?&+AhK+(8hLA|Xz$zBz*&h=4C z+yvhsg({w}BEY$(DHDM!g|Zxk`!OHChOdUC@g+ATB31B^G_Df(!!|X`*;+#zwfdHVq-n#5+^}%cyI)vc*+;G!R)YDQN=iYZxy`y)e>x64X zDoCuSLg@p8nyxf{v^t@-Mh6tOC~}S)sCaW*N~}$&=46zOVpEE60;-@dY+XT2r+!Ta z&-!GSz|9+0U#yk-6v%31TKT6s%}KG)*DP9`c_9oItN9h2#fA(0WYP3J%v}gW6n7=Zo;~dd|X$)X2Wl$ z>EAIYZ9R)Unp4cKXW{A^JUu&}#FyPr7^$#q#)QFZ?P@!^AWgxTX0tNJ34*5=rUPp8 z@$2Po6TjEZL0*woR@Rmi@irfQb(1 zj^sHmJX4wQihMXI{-a;bIB*NQy>({f;rZ3VfUgj~Et)}_x+9es| zQ)ty;I_?w5Z*__0n2jv0R*?3w1~-RPub$f^b7|TzB{__b!digj4Q9pBBdv zoXk=S;ysHCsxek^XwN7$1ME|yU^swNcE4+OQJ$_548u(ZA4II37@<{l%YOHo4gd0h zE6bJ|(|R$6l4XCeIniQwhiS&R>LV9n!|PK}(?ms{In`WnBAAKnl7r5?6_-pFS+u13 zgP8&Th^~LGX8iVNc$F}p^w&dpa+HI-?{RN-N=Tt6#d&8t_;@587k zSJ5TGOJIU?Z02#eV;rFbj!*g4B~(Rhja#osOqy|T>A6g4GC}aKxn$G6WPs6E9+~X; zz;j8}xz%BXUDEyD2JR8DeCi=PrSMq&ODwjlC13W?-w1%RBW=&8wjnz9T+I9dz{iz>dl~*0RdPqe1=8 zZuy*U!%l4ympRj={`=n~vNw*}0cyB9=cExX9{2rH_BIyPX(0Qxk4Wzlxm+aK@QZ9_ zD{zjqvu8QP+D*ojBXYg?YFF_&8XbJ1ez`~?ay8DjiwuYNQ1I|d-ZK0z(OgDdxo&y) z@_nCLsX6S)eu@BH_@zbwPCeE(vz3bdH!CK?gmow#;|7OPQ|-HVerXoMzkGhkEA`n{ zbI{$0mjhEn(*v=$3|*kqAlZS1nhUKyc$Ry^R+3A zbydw~a?*By37N)G9fKzxCfzJ#Tc z&;&P7tjVR=G2MdqT`(4r-{2m1xCS9(c(`_i4mSS)!gxG1eO;2pfPH)Z?@zlPRyYGn2{Z9`I4P^@wmIkGT zk}6h{)v?akM;NS*9Y?yAM20>&xJ4gfgCVJ*-ps*qONXMFK>5`2RhDc^V5w?ZQ^3?- z%}&eH?I`c=o$-gEq{o9sY6?cgSlW^N;>^7eIm6(^@uhQ2@a(MH@iJvE(yN;-+*d)tjr^5HDQ8#;EZ}{y+N3}<%t@6V6Jn#seR}EQR5X!Z*D1( zkg7~YQ*VQ@n~7nzK70ptDY~qsC32NdeY>d?6B}l7z3B7EII`dY>cNP_)Wr@#J#i~S z*&4LIIrkUen4iwy7t-~cg@q{qLUc*(Q=R(OC$rDwF`WrWIC<>3G;!uQ95u{7+pfZX`Q|UEI4_zQ&D2a}PjM9|e zBhq^>AwW<>Y7!(s3>_hf)BpiO2uaS34vx=t-t*u0UDtcgdGCvmc4xP>_S$Rz)^G0} zU=#ljozJ6LhZBoq-VrYXe?KFDYG_~icv|u~3y_gF%^1Kr0P0WNWPvIWSr`Y&*Z8r9 z|5`F@|B|D8&;kGSW|1g&S~*;5Sh2_ik|N#cJ1L4^O?n7Pv8ZHS8n%3VJxs*F?k{Yl z8tgEwWa8#Inr(f^Eio;vu;;N^sM;xlpV<0h{_~3)shiENZS?0sdXvrWDqEj?mK)PT z>Yzqv{5DJD?^=}GYX26+`YT8nV@%`wNByoH6qGRRavk;!E0_zg^puLaND z-%TKJL#L@JnT!6d7F5B4lFf17!L5;Aw7dgoX`xJ8Cu?{G>03H7p4epsAWfjvCmtG| zzo46U8(NQXaox?VPahpxGd}6`BM+<5qJT6T^60%o)?ZNrpM%H1Yp7U)zzI;XutWG| zUHZaH1DwgOjmB6Yf%Egz4M?2WW_^@}7A3anspoiFwC1U}nhB*XBxwO)oqc>;I#j$? za(WrGU}IlPQKLSax%}^Xl+PRBdumS3P_k4xI{XagO3%hZ! zF~WVgJKIKS5NVV@X+ z$X%;?)?Avae(}p^x>@MMg{IH~@fDGIgfGlKJCVAie=J6$_@{CY&#N^-`5G;y*>0lX z(Fc?yXJ1ZsPYaUzmHVh*5)NxF`ztqKs9-1az0)2@7U-ROhBk89#pYi0A6rsGLvCoo zn9Po%G-(L!+wmT5`vXPK6f^(7f*Q#sDr*fh1ue!Kd>CQmEt-A5fxg59Te@CSe=n|2 zzvyeC`%~eYO)F9&x>3_YT(6l~V&BOKM&yd+CgCMLgTex2XDX{F3KkhuYzcXhHH;+; z<225zpZxcwj+Qsbr%aEEDBk#ciOT{G^-9YGM#-)#C?;F``iX+LJ8dtd72WR$L%=o? zV@rPbe|_eqj2fSyVi5;`7soGp2GbHm8sB+ukg9H!=y=sn@{QlNZF3L7yZ!r-#2sLH zlV3%~7R9!?=y*USwqSDj_z!x>ywxx|^PBsG$=}?}!Tc@hG41UQE|1Rud--DBeX?wi z#e#9=?t;2^eh?Uo)BjBt_&`$yRu=ui(>XD#ixuPn6_d| zq!%P|j=vjTvwaBEo75LsV%?LM+QMaSFYhDqm-uOp6Yt%UY_jNuU`A8ybBg|o#GQiX9V1Ys z`D}B^*1>thHs#wTUGIiRwcvk^T1e#0=%WbGMjk2!;(6kuThH8J=H9z+CYP+_z0c); zQ3$7D0AAy0-DlnU^29yvT6S;9gMKfTJjn&(^||@c1!<=wXn;;iv$1W3FQ~jUa{bXQ z|Nh1|XKX#zYg~3*e-{`IG*J2i@X|Rw1|{|l_g|_AX=Sd|+B&`F32KNs~6UXBAYARGOwsSdLI${B+>4 z)N1$Bm7UpWnlCV?gIsC#FynM`H@kKDBv0dxUotqGBw}7^%1&MeW}@Ns zvnl}4{hmbVoE9ENnhjF_m8_XG9J~^8=$u{2ns39M6`c{!b}n!85*tuCfc#i|XtXJ> z8KXK#1)=OMJhv{}NORV2wc1XailsykP?$bwt*&}cK91)Pal`}kgBPz{83+VmgJBP& z-5M(?;7|Ve#Whr(SGD8$J&pX0Rz7~Z;%S!`{{(?B|0$6w>#_bu61-4&cT+H3zN`qp zc(5z7#NteFz4u%|SGDVVVTI;Wc2(VuzY9vs#sp z!-hyo$~@rwLboxh-;dk4tWuN9gT6(@onvY)O>END2$Jv6lf{qu2~FWOA@grmcA5|Y zZ~qWE6#3!H%suPIj%zlWqeacf6@W8n5077yMVg_z{KD_(6v~_%Ez~hmz<=($Tsr)w zsi_Gyf_930xCdz>U%7_s=hiSy@*tS+4UWFOs2%s&8!6sz-n==*X=E+jh`52gZNX#S zKJN}aEmhJ&yq|kjMMXvbnWK~a*~IbZsi{`hQpww%&ccwxVR>#`R`r{+chf^eN9UVf z<+gP9a=!v$Bk0%s5RTrF zlx@{>wKjPUSzJZtt#;}#(c2VR;u%kc&8t6^-sWAqGki?VXOucNiv?3!9D@}$3?Doi z9wF#(f2s<+>0vHjDbf=(BkMi7mf>HQU8HN8emmZgJ3N2gex$@JtJwoz zQ|yskw}7+HsPkgju!1H_#B``7{x`R7SMpBmTuFzH&q zP<^{{mug3Y^3uu1+rKBAT^@S(7&yTS;K_0*^f!|Ww$jz*p%L8tWZ^QXj_*ib)}jb- z99`}U$f(C)9eZKJiY1g2Op)mZ8WBAT)h^&32U1^w@Djr;c5=NWN|Rm74e?QoY-7^C4W4srPaQife3o_ zN<~C}a#CfA_=Aod*kxMReB0mU>X!Um{qC_7QRW;IU4`*3)a>=k%H7ZW$s5Vw55VyW z@*UwKnFiHAKny_8=A2BGkUy7b|#H=lmX=uN}h z3JLi%hcQZk?alCE4u*zhGN3jI9v+n!KkgOTWb*5iCr=6h;zgN-=jW78$5+7LgI}Ld zUAhGO%Do#Gc62n_&nxaUFuUy-1{cC(0l5m-a?su`R8 zC5p=szt;TVGI8pdlz%`#-{{pJ+N@nm?>{M&U*+xR*t77D;P+o$-O~N9?)`5;DBUmP zx8nb|F4C?}Xt2-O`(Iy~wEHc0>3@AAsD69@_?Mr5(k_NCF<*y#7`e9E-v=| z62E_!`~9z#k3yy?l*$K?`|I34UPwwhQ(UxKw12?c$nwAVrpQXF;Lc@(8xjAAfF`yl=c->NzE%YMMSedc_xJyA6zY8$)AdhEVg+M1 z_IM8x7F_R7siW4|vUmCmr@&|Mk%)8)$zbgIa!~(?Tn{wfQ+DzLd0cvdvy9pZt;&h| zK{MU&#K`;kQ65aV%5EcQwYw4m`Lu#i%9p-pBprMd*KTu%@wnEQaIhX*2})jaG8MBZ zn3cfrZr8VY4pS%NE0!0ivuivS;SY2k{MZ}fZ}O{dUx@fT6dk&Vw1bT1F!T#C{;NhD z2R|`c?Icg1U$aEO9~mz-wbx08ztZd`VdQsS!v$e)?J2f9QmWG@b^+bcEfEU0+#2=o z+Fg&MI<|D;IJVcu~Fhgp4nKpp)mR3WIq z%Ld0fpCd_h4HrTmyZ&m0Icu`0<&J%d$b9&!1LNZ_5h6x4UW+b+flurny#19n*TH8_ z82E7)&(&~3(ZM772~vb+bBoMPFy3d=3*K%G-AR(Hf%NSR3aidGjbAAVdg1_?&lfO# zf8W>~8rY3LVgKVUfKg9w3aO@|Yh0B3&!}t~WL&>j6skZ0t-lWoG3u#p%*+6JZPeD; zAOmd5$JLfmOUV~2Vald25OfLbuUP^(ZTSp{PWTq~rxdz1d@FTUxGa6RR>D_DTUBg} zC|O!L3Jqeu@MK>=W%+|95e}J@9jAa5-ml7G?Lw23Z`kf!w%^g(P70`CtiBTbRH_&I z=)On%T&o651@(-iF8Hc&k*vk}!!lD&`KgJ<6`kdpwI$EWs)YjLoMjiK_lTY=Ic#T2 z_wMNBRZBykCvEc5?NMl6S1{Fi<}Bryvxk%kO<&t7z)D{?C4&*0V=M9 z7*zP%@Cpw1#$??XWix2^1`P6k6FNW3an1OvlAiU0Z?mnvXM5PTMubsqW(5q2g*mxS zwsERkpj)`X;yXpYQn6U5#&UXXcDg(v6+8>-Q4(89U{cl9f~Q&x)PcUu$8lx{uCZ!6 z4ukTxIznqWK80k`DAF>S0FzheIj$}tp!3jKs4W;BxLx+_kk{Nx$$&9QVcEn0xO6AM ze@HZRPMAvQ4}U~{-=gh!%b35`uHn({7b2}PW7nB`>EV4JVHL{CsbR*Ka*Dst)Fcv( zoAU1>PSgx(HkRI@yE;5tUT%R8tf(>b`9N0KKMCvvF=2Hz^h$uOcGi?5M|PY0v|BW` z$`;$J`_#9G!7~}Jr4f$d9BO+T4A{o)5Ye_rCfL^P5lsbu$AU}x5;a~ZVOP8ZYVPrb za(4}F7peuGTeaIQgwM@bvod6m_h94UDS~6ZwRJw~dX&$fc3Y`4NN5BrfT`BH{?W;j z932%&COuRz9eJZy(ZU)C+-TJJ+w`?t+K2?J77>)QMm&;5iqlt(Z{n&u+E2kX<=wQD zE_Gh-TY5NY&!<360y^kzhgN@zl=ZC-TCfmo3)CwU26q z{=rCUZK$Gtd}8CIsNOOsN>JrXK?{4NuXa?=dG*2KC4KF1k}Pr~XCXp)Olb=(acUAJ zZ>v%)>z}lYL)g#e-91=)jrh)9N?{q;i9e3+c~7dY=aq_%CUcb9rmRRmF|HCRNN|ho z+%olNQMqx;vmT~Wi-`%;?J`aPbozaTe*D==E$y?~8XP7Bb3WXE%Rr%~cL(J*{TfYP zkgVu_B4CLfcH8OhtHrY$T|7qJaHiOvVar`5OZz78QEbVBPx>s^h=UTf)>B;TL!~(9 zUE7Q6L(*bou|D3t{;Id+=a`+jwHc(oEjk5^Rnw(0e4{$(9hM7pDL0wu+&DGYpTOPs z7QL%KY95ERSJ94tNL%`a&aToaz+F2Sz|oVgC9xytqMf#|%AS^U3=}(E3l>ZZ3raF@ zgP9u)2#S0v!nm6ve5p|@tERb{;TI-1 z|1xjeOr~W6v$NHT#R6&G2dImoS;>8L=!MYTaKja$N8UGCJ70WPZ|;Z^w-SFM230s2 zxYRoF^p3zaROuGOq^XNtB3iJf`=W&IuG8nn z1(20Vj;hkIfmaeLTSG-aRwLM_K$Z2;E^wkqL_eb(hutiMARsZW)|+l9O02DDp(l<@ zVPzJj;NCq$^dls-g{^ZfYXH!9ROwOZG#q5;9c8rMm=V{{k2q9>qIV1FyIPp%&kN=( zj6UZf)v-`A(#@5TID{{6P>1D5U0ht#kMx*jO-YxjJ?idQ8K(UMbg-84L-HjjT5O; zb|lMShL9Ds!w8=vB|g-emfKA4#ukpJ6LeCwr`nvd!&Gw@;vI9sLw3tHHOr;(-lfL+ z@oTazi63cDE-*BsHGuq+&Q5Q7&^$au|I=^!u0WVfsJueQmkQdvd{j}qB4%hnCbXpOoi@8r)~IUMo%OJ+--GT#*(azUFfW6#dOv}Huo+}_?9I{}Y3 z22~qetu8Z#wK>ojjhG$o(|zjseKw^0bH@x^Bl7za=$`U3^>Tc+QU%K?cD^&=g$EAY zmos3glB8Cjp z6MJadpwpv;ZuBiK@b^V(Q}8IC>DQ|AaXM?@_`FUYOPmDFTGoNt^C=qi+u4j%Po7U& zdb?ApBKkStzOw4OxZOudm*S%_Rkn!Urq18Osy>tT=F(J{bI9{>oW7eqqEII@O}}yi zq1%YovD|2t2+nG_*5mUt{zDw5?r^cP{zF$+3+Yer)I)pY-s8?Oo?!J$goYN0uH#KA za5WO~c$uBHz{U=Qo9Nb8HtHXn)&F8vetkJTZ`-0`9zJ;%;it`{pW*Vx`*hw2anku) zX&)c1?>@|}Ed=wffT2b8Yb%x zl5ZkwYe|t{yX)B%he;h}wBA62ldW@L4|eM4Q$6pY&4zHt-`NZ!-D6YNJC9}6OiFBS zYQl%j`Lv5SMj;8pm~cVh*$@@d1}wqHRd zJINEYE%mxJOugdXtLqPKwC&q9Quo_umBbI7el3xpo%xc-HGC2Zu{tbNCYz9HS|mj?j=2^wkZ$LGYl(wTw)5+)3!- z(>2C)ha8kW$yMt_harPK>|aDA6RC6dln@#RU7@8F2?~Ncgwkh;G?S9`&s8VWtPEec zWYzd|t&8X<3~zNmv>lqN72uiBfHzSvVe+W962mY$2syic%AYvP1&)k-XA&@|Z=WDC zE37VuI>)&`$$oS*zNAIv^D{4W-wi%X!xxyw+f$$h#sXgY&plO@S~zB;;r3KXQh~KO z110Cma+}66&_~t-z2!W;$JP2^o#g+88S_d!6}yr}PRk~M;Jzafqpr)46yq1Nl(!EM zQtjWvsjKD^{LPPLO#vm@`Z5~c=G}RnDM*X+^!JJb&KOh%PP9>@FjxWO7o7qK;3IPt z_}g8+LA_WIDt60u`6a^qc;Bp&X~6J#TT+Rxwy$js?Ufps*%v@QXKL_)wf*|yAS?bU z?G8jP&LQyrNXr*mLyb%0ZNzdmPAS-UdlVw#jb~ae&Ml>68yDzgvXt52_?=GnS?v(d zAnF}Q9bLN`yK3E71 znWA5_Aj{L&u&je(-y_cM8pu0lga_b@J|gp|u}EiaC+;TlP-Xfm+&hMa!?cS9;ZAZ? zL`@uMsNIcp)pTv&eM%6N1H%SyW zGvsp=f!q}3U}zn6qIL?albV|^fiRSEoliDWsO%Ar#?*scvTGfD2IoPN=-4xbFz8#wf0z<0f0UkIH-cj4SAINFQ3{)>jzMPAq6N zm`n*!u?d8%)Jf0Em%VD~>6HWLGpPP%v14r=gf<_dyzN{=p)9s-LLIAZnPbiLBGSh- zgQ;v{Xa*zlLT@qy>hq`sHXa{=qYOY$v$S?63YiD}Y1@;qnx?d+11|Al9ysvZ0sY^v zndvkl8X%*}rJPnP_g6^-JF#==;aML6|82ISM?e?X1LWb#P#f7wl$}tvZ`6=zjC-U> z5NZnP=^lnbt&B$>u?oxDwm@{6Q5UBW%#2kDq+ z=Tg#U4U?=3Ae4=jU=MC9_ye-Njca9Jhwl8uINvJsOeeUnwMBdG7+_hGZSE;E6K}n9o1aPQOXw`;cQ3- zcCG!+?&ZdF6JoYL!Hhk0XFSAvP&?Rart;ziV!oqrI$cdJ!?wNAQb zsO}Y?-@qhsd4N5yGrhYZ><2SeU#jwI-K%CzYkpvxES|E43qPl%A>VZ3Ac0q6M?B!OvyF+ZaCDfaldPB$TiQUOidz=DLyX(X?|<@85g6mzv93k7sfX5>S9Qk_Se+~l_h1p;WNd`Yv`1aR}* zZR^G{GBKE%RbxD6jjA})MW%-H;9h@Rq{K60G3qYaF8d~!E$}zKb?D4@#BrKgT$b}A z-}nH(@c&CO#r;0?H-akl>_w-egrp>Y^Y?%~zuaEc9(Uf!xpT|j-oB*NlfM}-rr$1p z@o!(6L7_K1JP& z4Kpm$Pv|u>OC)vhh&k_U@D*27fPcU=MF8WwR{(yC1W}`VKtcfcm{(9B8gc!+l2ZK% zdw`by?K)vN4ZL`qn37TmrCo{_>2#EfxSsPwav#cgos*;#xF>2wnRnlDOOgM8i`&Eg z|9~xjYcAmb|86AxG4ga&=QEl8?)3QP>o;G!&g+@skrCGq(IrD8BYAf&1JY~AG59W) zCr9`2d?~Ukwyd{5O#%PrMwFR_Mc$itxfk|J`mI~mFDxtoDY!(Ou~GT~l$LinVZV3d ziCh4C#uwtc{rjZx1Nr;E9r)L`^b1`3Q`2~*Z4?8)5A2Hf{_gLiqoY8U|HU^sj@7Bx zbEM9k`A1Fq5#O}7=xap^a{Bf&dVTWLcdN1Y+5hg=-OuO$V4ULj+~b1dP^-p0$kT$j z`yyJJ7yX*>DHC;ru=i2(M(C0ip%%pPfq;sNJRT)Y+?R5rWM#ub@TEsWIG0 z3Cj)Ej9^TXbpwPEY!4{J)u+(4c$gaa-3s4&q|p!N>4M*CmW^YYg|#F0U}rwQ?#``y zhIote8plP86J~(Ouj*!eorabT4M6sray6~ynaur}qTX&MJAN|5JG((L*tj%F!;N9C ze47GbsUK5L^uY_x8r(E|v{@m@T3mLcgB}bU;TNYD*9W^Gm%^!o%lJjk$ za~nF=g-)!dELkS*kBpl@Ra!p8?F9qon^^UXqPitR;WY|TN!Sn1-0XVxH6UOd>0s&X z_0aX^q{?p-Bfu6}+JR%#UIuniVQS6+D5%uGAf{8@_=|uk{%)tqtF7ZR_qXRYTqx*P z1w!@phaMkVH|;7kS*%?@8lrG2P8+ckWhs~{Z43*mV0WgSqAg{)x%JKPkZLq!Fx*+U zeTOqHf_k$!%*dtSF%*}Jka%Fv6J}7aGzI-iA2*Q{sq;xoqd^=|+IKN{0|jD2HMdDmhzw#TL=u{DP{X!YrLz zO?|Mh7Grv);cbeRT5A^C<;KU74CW&3gSwCEaU@D*Io9k}37nmOm~qP{Kp2XDKygWU zKp9p!GfHlfl(|LaM(7+d;#bo=%b6F3KAL-PXfPPqle9j&f|~mT14e!PJ4(dqZ=*U! zatSepn@@@pLdmcYWb6vBMY2zULIjmU$HMX_SajkWN5;Mm$db30M}v= zH6^F^y6ZOho;*H|wo~;0x%KQkG-&93m`#?*8S5OU6hXi32SnH9{Il;S0Kn_(we1tm z2~xeRo!nQ+pCw}5h?`nR&>edIl&k!TPxcQ4tdF%tx)IcP`*C5*gG zn{Am#og8{1EA7+EZIknT)=#OC{~RNuQ0=P$+!$ZqP!)`ZPf~yke`;yvwkLMHt>fn` zY%_DKN1YUrINTcVNfp$>*@3z_+(JOOWPoW&e8U*$WRjG4<~DxHt?hy~l9n4Cu-lC{ z=W?F3);gaTFAcp^h*7BY4Uh$jPTu%{Cs6)ujm0E!WSnPLCTbzL6=EI!7btUHz<(MB z@8>erp1S6Ztk57e!6pVvUP@JymDOl@Qv|s2QihDTHXI9ue-g%1UOz!{0D#q>qwD`c zF4QffUUGfc9*z-0qtu+D@_8f`bW#%w4Z zQe3@8`=aHp33m&-XMAVi&p=`YBwloW8}9?2a=lm4G*>-T*5sq@<5I7*a11 zI0cRSe3RFA8I#L?cRn^7gj86dGfA%kf{ar@TR2YJ`ZZTEkf*A};kfN;SbXi)uUhwK>o9Dfj!*IUnsFJQcC_ zF2&$;Ubbw1Mz?)rI3VYfTPz6jOu@E^rK-1XHoi!6n1w@kcTR_VNVYxqf_7GNY0-i_6WFy%fYft6?EN1BwttTeiwg0!9JoX%C)S+pxT91I1;XKaV-BS5M6BE8vZB z`l`~Vcfg$YSqkeMci%84JDCnp(vNI3pO0|Osv-1Kw0ztWN-4Ic ztp!lj2t(18B_K2Tm5!tO$?2t#9^oL2je*oq-L-h<=P?ca+y?duwgu6B^#rXHT^s}a z0xyhF($&_FFQfI9yHP`~q+B1{y&o}XsNY$VHJBsCXP#pCtIqkJ+l&S}FcjZ6HVC$t zElo+%E;MVfRg(lzD~3Rp_jQLy;OqC?5hhdTUd>Q3W7=viKuARad{6XjLO+yvow>0z z$(F>T4V6E=o(QvrRgFsY=$fMM*6ZKX*ufln!m$Y$1G z8`bd(7Alb`s3;5I9`#-3>@ZM$?<9Xz0ww5gS{a}$_LXa z*=}(LC=FmsUK{T^Q)T<=ur{Y-5MT0UqelXFKqH}r<$812*WzV^FWV|SKNpR3`P8hZkwU%EVNloXX^QE2@Xt=&# zwL_mJ9cZ7fj7+$*MD(GU4&>?!70MW;v$O&`tJEo?PtUe*+X%zhRw6EP9_sH@m?0`3 zEkx+j0_fMA*3d(<>Z#@M17FnT0Tlmm)H{cPp5bKDCmm){Cs2VLHe81BL5uLCe$w4RjuG6TFH2n+jjl4-Yl)s?*(K zyoK;>V28}atiub-@%c+pjVeWwi<#2Od9$GC@`lB zL!14Lc#~sP6q>hbb+Y}eGQ3Nd{osS{d?fWV+q!Xfp4fo@g_fBkp-?J;uj@(i`l<1; z)RaFlPgS|HRr``gpjA+8@=+vh@GYOYVY<|Y#NVPmz}t2c*>Nr2tZwpxidF!qLdzRf z_A#WG*cBDQ3&uZW3Bo30pfuu7#79JA;T@t+)b4yDvP(ptc1GQ~uZ=>EaKlRS)na8R zr23O7l)Q5zxb=Xtc3DO5G$j?b3wCKLH2aS3LGiNWsinqi@p)G63EE8WZPJ8-f<|VL z=ZdNuv#iY!Z#`?1w;0q#dD4ZIM)LGr2;A$0)THZpL;>Znk*R{ut=R45_VJJ@oq&mU z_#7i{0oc=PIn-quZ0lSMzNj$$y0vyJhlPi?Gxh+n%)n0%h#`yi0ZZl7FtPfI;ZSDa zWfA)B{9n7Uc4_Ez&XE9CyFx8N`3QN$bW_L4=rw|;a6tGm$ zNz}4|Xeg?HPk5s@V+^U2M-d?y5beO8` zG)1ugXdQTBz-3>F25#*^JYh%xA`&g`)w>u;Y1GJ!Pw|Wrmm1TETpBFMG1$kZfS*i< zmI3(0bl(ZBX1y(x_xjRQR7CQ8@LM@z6|!ufFt?X9SDg7Gu;4b|wtuIxx6UTCaD06` zT&=Zh{e;b_{j7oKDR{))+?!`4B_)AvJhhpo78c1hH8rP?MG$oo`q@VTWBA4wK)}HG z0*G$PexqEy=o0xunGXDSqA1>%Gn3*qwYL8FLks`)4NZA=EaEx<$K12G{}F1r^*7Yg z+b4O?R`NTEvwipP&(oDWZ9|W_^8K(Q`x!!1#Q=+}m$d_dmb#0C}B^(#;Cq zypa-ysh$TAo?8%zk#5R9k?ZQkyB`Pkrey5AZZAff(Lxr<6l-}#X>-;?{skIZXn z(ZpoPz7i4VjRLgqgx$&g8%~se!+KvoJo$Zb|8FP%1JxnxPVe8n_x#_9Gy1(;|EH0s zRnF2xa4PR`j?O9-rO1{1o5Wv#-MzxA=&{6acKSwju#-yq8+}-Vr<6)VsI+*&sAJ{x zLwDXD`|H-}m}CAIFZ?w08~^DVK8*Ke74fuh`Rm!`!(!z5jCW`SQi@8oKv3@jnIqKiTdz z%Gc}h|1|P`Qyh5xKPvUTE&itieQ$~b{~t6Lt7nvF(+mb1bP0oK-$3W! zd?4)TzXZdM8X;5_Igs~Hh|ZrNfHvUvkm04;s<7PWGs5bkC}7NP+pq`gtx(!K{FgT}7TSby@xOPxWpTQ0=Jm zm;5nh{|>89na_EgBeP^MfA+3>7fvc&unh7={=UiGj4mircfNpS#Bil-8PI zj?g2M!)+>+C;5j|$t^S+hfD`r*i;xp#Cg) zTAh~wO-Y%uiN^5=NUaVkIPn)N{Zs9Mx-jt1M--lEo9&dqA!ld~JuH(pv~v=#9=S^Z zuHmf_h*43`dX*v}pzIEBj|eUFj;sKW<#=L+HA8zw2d+wwEGHVJ6I#5zRaj(8X6cpz z6p{YsXxtXo6frEn`PR`eeD1BL9BPJn7eyBEN;c+dJ)|Hi1iNI(Fj<-pBL@F9>Y3Tt;g_ST}vn z{F61Xh2M+zx8pq~q>7*LxBDc6w6%3c!#fApqu1b=r?dRpzlG1WKS-r~0XFyY_ z{NdrZm5p?qg4b>-V|wB)pUyP87PA0)G1l}xnXIjJNwQ*0d%48ucex@?K-%zQR+K_E zhBci1bXa-ZoqZLWJT5^bB~CdnY2>cIMODsq+Q!~0tX%gx|4)$y4uD>~S~zt?GjS&1 zZ2$e$^43st;?tnZ(q~^#NmyGw#i|i~s82gOxyi^^i$gc`-p)Iw_-SyWupn>QBGd(K zEPcC=%Ds@{rc+u*XP*)ZztTb0InsH3QLvew%rFz)cT#~IlM`gGP2az_Gr8ptF1B*d z(%KpoIfq(K!(>Qr|HAmx#!{%MVdqv-48xS+d}A-EeFQIjE}YTz%Zh=n)I_+4O#%Fq zI5Vs61{g^k&zaY_AEHIiPS>MCbL!0OiuJfBz$=!Hf>MI*3lNC@spzc|Ygf(a^Rb>X>uJo$edJ(0z zc!^F-G^w3*XdRp%oJqTaW*%>$tc5+AK56ZAH$|!^^SKFWB*iT;xlwCv)$8uZ;OC=q zv$IE`Ia9hw+Dzg4yKV6_c@loG;d-eu7(GK)+i7wNcsHZroOR|bzUp(7TF_I|_4i99 zrxwD-%b_zR%O%Q~-7C66O`>Qd_$r(Iq04;nSUDc{G^PeuEk@~|4f6Ki6zeGtj_FRS zZ_#tr4A57HRR#lWexe1E);U%SLY25NYkQn%?a~BF0Ta}n+Ji_QU58Gob2fBq))qE# z!O}&(zfY#_J`lIM=RPdzS&4!LjW;`G;V43dcIi)1$_&f>6$XGNf_^rFnJrX}?T}kN z4q`Qyhzho5r{n8P=&fyOl3mf_-ivVDwB2B?g{R?F8 zk>b|ZQQ04kUPOL6&>rvc@nKwM3kC=(M41Eh(X%_QUzm~P=^zX*a;gYDZn+@Pc^xJA z=u<&Y-m^p81<_wJ0KIw)?7oK3^Y#Moi>_dGGF;9J? zi)x>lb2q6TQCSN7#}d7^0PVW3Kf4^;A09qgTJ3>j1kcc=B zzG@B>h(@4KKmAll%HnaAZnHXgT0)EjGJOGscb_4WR!2JyOP1HdMx{F5QZM>yw~kc3 zedijDR$;D$1!Z%JRu+*hfHf(ZXPr-R&N#?!9I3j7RO4f`s}Y+i(rI_>Zl1V|7i9`H zL%_vv{LO^I)>${G_XH8loz}ZHcGa|xYE1^UKx`rBnqD@WjE_1lAXRoJGaUu(K{xu6fUDG(lxa) za^bcSW};BY-t*J_e5EnBm`)?L_!8?gHjOsM;O|@wfMOq%zHxkS^h`XWon>j0O=z** zn(`zK`uClncf+!Lx-p#e1Q9SWGOawCZe4o#PQ8AF;Fv%q#oD%Ih(J*sDlICK_c*(} z>`OXlhgM8<%=y>NT62O)#`W|1luSqmH6XA$6`FwPRXe*;Dt8%1Fs;D$Xvl=A*}CED z7qEe+fgz!skc}mtowB7IU^Zj~-D1A0;k&BoG+xhOUozJ@%T-=GT!C_%RVp2&Qwh(U zzkG@FOsw2>zi-Ue=d?T`Jh3Km33jvu(!o!NvsB#Mu1)NQ2cf~rJw-?ikvSVQdSwxk znF5>)o>5qdKHrFLxj(?!xQp(4PzYCeTDjb2hzs38e;{W$)@(X3U1?m;NW)O`6QLE< z>99w;)evmSmBr0#^BNC~!APb)GcP>nWt^w1L*XV53&zc%=H$DTY&P4vO&z4`SC$iQ z#{)g$HpkY-2r-jjzyxA4G>R}wTQ7FcDoe2)6*Fk=+>@-2gZ_(9RbJgd@w98Pz}S?QS1lR;`+Ki>T-horsG6Fk9js&RWE82z(=9W6WPw+m z(tS|59|IROwW%+9JBA^QUTzKXNfhCutxV|GKUwO05k#zYqkGv>UN0yUL#QkI@oJ|E z$%EH1?Qd_QRl#+x9v0a_=e zxVKzKOHQX!xvI@^QWCjKmvu&$2KmTus{Fo)i8VnpaXq}HgySde=xarGkLK2p^TWh^ z2!_m!d3~1b8dnqCnYV$2S;Z&`oC|gF;k=Di8Y!bGE*ahJkN|Pq~>w{cQy}j5hP5FZ#Wd9|4nrqp=Uv7*58+ezjHj{@{vN*xF zYS$sKA1nYmMAS#;gGV?E0ib6X`zu!;IncBMx_w9>E8mX~Q^I_656S&`eXVt4S!;(2 zJX=#kUP+O{|jB7u|eWqL_Z1 z(^fHLE7qlCH70PSYED5zYRl%VI%S*|GGYY`pb^LU@1kE1tXH7VH>l0$E$zfKgL0)u zCbT1c%oId7-)aaaCP`w`lX*%GU3hV3xt5&{nfekWP+?k&{YZ5kOj+XFr{Wwq@Os|! z&6B74^PyvXN+W>_kgE;lMcxN|m>WBjyhx~&DALPT3uDtpaHDju>jmpi zC1b&T!6k=ej&*{ev>0)tH|!k=UK_W@R%PqJoOdDf&EO640QJ5|_x& zhVR`~J3lLC;W}pAH_NW;Z;M>cRye$Aa!*O2tD{wqQpd&nr`rn!hyIR(g-OX8OVF!9 z*5G-C>z!%BWKK3*J)GGZf48zVlOSfPrHTl@B92eF*6x^#J;!TXz)1IW#=N*5f9Oc& z&O??u5s-V^i!=5$jOISkT66bdb#KXIX;*YEo6GrnIlyz}L%keASx$O!<<%{N>7{ut zZI6e(FAxJfSV<#!zbkKWk6RiC+9{#fg`~)ZaVMJsGv)z!j;b`gb+b6LHUQTNJK9=Z z-on0VO;DY2DNzlu(PsS8@3$7C73xCgjhmZSGxt76q&$z-fYSoS%^-hqj)&CMl>?Kr zT$4$sV&MFO=ehx8@w0i!hQs0#$!sMsG#PN02=ODEzy~V-xar%+Dp1U-% ztdY@F=;4%xGnNal95iI0+V0oUw3_+Y!eKsT_XZDU8InxljCA`W1oBkH`XGbRBzulL zLAxvSWA2A^xnM-rDc>+{Q&*WUeM!P`y}offa3rS#nh&9+2lvJCP&Xp#zf->tJg$rr zRq1#eefBUZ$Alu?HVt?O8j8W1s}5VL53*baN-ATCF%yqJzi(M5XOcqx;#~~tJ&ci* z58C>pz2_A{8{x@g~VeD9=Mi^O19P=W5?BNJ`ap<=M4%!I1t(-HvR}C0Og* z$P^5P^0ofSx(_8xS&c5kANZVGg{vW{?}0^vs!DNoAs#|VMQbo-%X%$ApW&BdySIut z&WDLuV#E}rockvNH{DnHJmy|jmUiP-PYu85uHDpIM%6t03!BRn(9935)!SFPbU*^O zPRN=!;UhKyJ%>@UUMq<_3NA>T_JHVOLpiaYqqb8{3hTdA>)05MuOt;qPwI0g#H3gx{Ua zHLn%nE9D=WWx7~u!Yvvl4xA9gr<@OMe-Ee38`;+rEH1ZYz3mW{Ef^ZoRPnQmQIa03 zKx|srg-zf8>T7m7AJt|s2aY39nFo(VV2R+!B+oMb3C?rF%gS#z^dF!EtEc`*J9`Xq zqTi|GCS}W3FL|VXp~-TKI_h#~XsSyz!21XMr-1e7XWMLD1%BC%KUQ>CmPCeCw!Ics{7+OT(LmKxjQ_Eda0DG$)u~c3KQD z0IM-ikXj3ClJYpmg2(Xfb{=jNT#`WrS9N-<8{J^PT>8lp%hk)_ozwk%mGj&-vyZq# zR6p3Tm8%DD8OO8*jLod#6uq}}ZLv3I>jQ%D->Xv@-b~I@2ilEPlC=4v#Fv4`NM*S+ z(2255D>RQ97kDKdIIB50lch*UF5SzD3B#mvhf6%kj$c?iqyQwwtZGK0CxfdfZ$y&) zXi<*7l$>CLMn=%%!ixzJs-4oo;clmV47xL62o2+kdF}cuJ=RG@&8T9OwzL{2$PjYStg{BhZ$|pIGgM3}| zS{BD|HXf@Y;L*I@@|tu7e%E!m-nIzE&9ql$7PtPOt0H3h0}1RPrtow=X3|aA1YMBCjBU`gtd~^6mU#r0EU4etb0J*;WwLWwMr8En!-%C5Nh7D*x(htq^Z^ zzsQE%%a9-JU_~!P1ihDSZb{!_P%V6E8s`K4b~Mm-jWJ{Ruy=BEhkc3irll0KEzwjr zcvZ+fK{S+Z<*Ykj^#Zy^j;x#+hnR-`G;wmnWI(*=Df~G-NNaPfHR(&X)H&Io0&w6maFc z+Vt{^X^hx(H3b#!fFLHX^d5>;dB=DPy>d}GAMVxyjz+FkZ`N3kE2qmrO*~q$^fNrP zokJtB_=2}QCLxFS2NXU5>4E*_llEw~(Lw`1)f=UAqA6L!HCp4CKUSLQ+EF1YA4$sO z=`Gc6UyvDi>HU8eog<%`rPDrtaScA6+_I4^ki-EZ@#8) zik1;|DoNhHTNbuM9)z0xF8#CE)P$|zrVcve67A6z5Are8n!x5FubpvuKaYi=I!G^A zaXTW_X@3|0jLn0&N$qO@KodIAoKg8U2W2Kq1g^lti*+2jKw1*yIV z8%dAQES|q^voD(YZ05x`wJ43Xwwez!htzMtqXSBozoBX6+aNO;2eC?I zDqrEW15c$_&7usjCRldz8G~tiUF5iU-<{1lO-#Ru-}bmw5}z+d(jDM#F~t-_^qSb} z2DCUC;zb^_(%0ise;`{kxzKo7`Tas6DTmLd^3JPlRT?$V4u2rv%N{~Yg+e(!u1xRT zi^Rhx0Yxn0y{et6$xRZdqPfQwUzYKNjt--Ai$)2>J;d5fPJrsrWVTa#VF3K1W` z#3JHXT!ZE0RLE{~AqAf0bS;D%ron+H2VFH#*t9Y+D$&P3*qllV&&lW)N%nGi5q85Z z{k-0Wm96QY2utr8lMBdgCWVJ7X9NPHEqZN&aF3yMpegF^VeySfZ~WA*xe5ACpd_(+`z zxmfLfhY(Y<=0}yh$DQT(^bv`uN6=^Hb2oXjWnQ=a=lABvMYx)d9sxTJ&OY@Pc8eA0 zWULnkyk?8HOWLFm_zE0#5PvyDF?WjC`Av^<_2-`noqsiA#H9LKj7vcPUfHvU73ybQ zQ9V3@&W+5t%LI{P;IMg zSZ%A=kB0+}i{<8{Kzyx0VSgJ>`_46!=N%^I5{}9fa*V1$3fo)_QwMX8IndQO+bYZo ziR1f^fc|(=@;=9hI1V#&3Dp*IT;?sP+wuLtJAN~&H}Zt^x>jWVYsT5bX-+0 z)4c^hhw1kKdd8XpZb%!!|HkcLqK{H<&~(|!cP z`}sL=fje#ft-FsL(T(|E%c7sX^G`Dn^Js@4CT5az_{>4ZS1tVnI?tI&*n6V>V29Pb zZa%x+PATrDt6(U&pUxu9i}(Cl((^(luazecK93xIHag4P{!(-#wBZNC+jk}L>v|; zBaIY)Y@nYMrBG6(c3uP(+2Tm<`v-xQx+y$WKdP85Z|!nrt1s%s{Lm`>v`Lg9ZVYTS zq{^GYzW->o%(u5N!y~~MPbGP|FQX?vQU+6jdLpw;5WgnDgb3Y|jQf{be%ba^e;h}&N~vq7dZ4WI8VcjkGuSrpk#>(+_0eYOlt;GHC- zf>$L5qZlJW>Qp|7GZHkV<#rpWckWR;KDLHy(>#HoADf2-5GH{0=<@V6cR9EHH#LOF z%6jZ@DvaF(KKS_i4{L|HELntMNbl(J&=+FXzABgHubmfxhm;@so6v7pR6gUbzImZ@ zmE0O?WEr%cb~|b!6;X?@V;tp*A^GL4kw&vpXc(!}#~#2LK<`%`ZIN*5avyJKsPB4!37y))xr^#N-D0JRPtdv~zZ8AA`Sz99XAXwbw~HuDG)7S+ z17ZGHny<_=d@}f(+8r|IX-YOoPP5DZ5S@dzVd9sG{PJ$7P25aGPOt-ufl- znm1(N>vlIL+~HuR@O-K{mn-ScHP#y7Rjo+3di3z5JMubF+g$REuJ^*AuXd!s8;-`M z`h+^qM2F_>UbWWkTiVEIi_1BL+F7r(zTZYJPzT58tD(ZJ7wD$TAwyS){-NkPeVGo$ zREqFGdOA7>pW_{aP1b~Q57h4#$J zEX?Pi7vB?6P9E;gka@z7McA+M@9rJ&Z%inN^694mEjJ)!WCP(fq$M>>CSDyJQ@E;% zP)b|Hs47rvfc~}bCZVOI(WsHa<=iJVIB&vsinq6|oZThrJ_*sAkC%JG60t}yz{{mC z-F8H(+z1xx2e~y+oC0X8aAHshxq(l5<|76}+%%5bIqMLYUN)uTZYfx@?-v~Z9{T;I zRR!aN)g%(aUt2Ca2mVQA+YKFz%fz56Yrb?%)l#lsflOr!qeQcs`$PT~A|~j1!W>Ur z=$U#EN3f6Hz8Lorx}ZsBDqt?t*m85I!ku3>Y~xg!Ws!P(1QfBf!>J-VZT%h1M-%&gEx2aJ@yIqo8W38nz@{NoSk7yAg#SM2B+m#Oc_BuR{6B_t#x)O1Jwt85v zWq-I?g@LE|X<}lt-C=aje1pv7&cN1*t}@Zp{|v)vrZ#YIIgzCO>anP(f_>G1sM++C zB-X7KEUpB}sD{=0GMPaBzinpDB6rFJj7O=P=SQ4pVGvi(0F!}cTYr@@+o!l6sNVdu z&J`fHPZoI4jBHl7=*>I^KoTD9dy%;Va$XJ`3#y%}@Y$3>&0YoW-4U%jYyAoHgXrDC zesw^}67!opgv?h1gXgPsjOCY@_7CN-qQx&{BA#;-?SNd|?FuAZboufxZes7Ngl|wl ztUo_Z5>J|*Z%%*J0INeVTPaV=)rY%hWi{zf0t6JZq2iB=J4ByjP2K`ep9NLTB_qAY+L2O)$qEVi>JE;F39Y5RsZ`U`qvc9AGJ?fv_hd1jV2A14TN$GsLGn2Rus|Ou(KaM+ z^b)kB61Lfe)iWPzRpiZV)hnK3FIrj2tCesES79Y~E$xFfK82>wvs-0Z&-z+_!XKZl zT)o{o@V(A)%$8x-^ES|XDOxe5ymLPslwE`Y?@1XEJ#KjRdi#MaQOW8cOnykP&yQRO z=g=!ia>`Oxc&Hgx#(F6!z}DZRaksCM^a!mmr%zN|DT3~=FjDv#(uLKSReUycp>SaG zz!X#{y;;1TWIVb$!e^HU;oKX{-=Z65^u&OB@%r+2aH}ccQ0kBIPw43pD<9av$8Wf2 zt2}cG`81dY4bU?sr!9ss{hMc-qgAYk&3nj=QZBSVPItfGkW)1+bnu31%v29Rd9Y|T zg%s11n8v2_Oj^QZwl2>XG{g!o*TS`iMo6jliR#k@Rh15(yR=p{I^c8z5=qkwU5EaQ zo)Wt}Dz1BM1=PvHMMLPP4t%;`pb88aPp#O-qiWwmo@zv*g87Y+6<-z`vieRl!w3W2KFKmnSX0n8^QsB4pel^rMz--#h zgutWfxWGcz>pT|xG{KgyeAuyQU$wQ`J@3y2HlGsMFgj-%%F>s0Sa*n?r{3HvMbqfz zo;faSiU*O0${@bTV1W2u5E=!B)m0smJ?aI?)F*}_X48VI^0hk7+Q zEWfxCLTR48`ulTIs*QgBg@YK+Ip#`h;U4PZPkv@cPc57U8CKJBLkv~ZrdFZJG z**+*&DFFD&mj&fadMc#{w^RY5k@et?N7lFQwlY~sXbf*GW{yC4GEE*s3=HBVTEVOP zXQ|n-v%m}SCc*ZMc}JJzEUBHzLwh&VSCMZ}lb#IRMk%%_5NA#ym%UJvESFAo^|j`; ztSV~*7uQ-{P7?|<3!ZH?9~PYTGjA&0GDT%%Vb5+P@y#kW`_PyW!KFDo^B`@)B(&uo zOQ}l#^V95u9f4UX)7gP}K8*OKD&g~z+sWLL{$9}F_OAg<-ATwXJOK~$Rb8>`S$iQ* z`|!$({+*qBC`=^jjmP?=dx1cAU}&HMqxkl%XTH2xW(fL`ARMx?JAL_80X%0^3c!=X z+(f?-9EP+|C>o^p=$~ZMf+2#9ue5sCqEUJUqjHPRP@7sGk`(!F>R>b5?ZVFi>x@*3p6tTP3F*Zj?&x zex7FI9s;Ifa#*9le^NW*GPqX;8u}eEy0|1d;y95p9^xoSP)ReH^E?e)=~A0c>QNe{ zPL2?$4FC%JP2w9*Hzc^R3?vgc6tB#8+T!bi^bldB4hA zcaXvW4Go1>`hgW55;syO)KMQdK}%6FO6j| z@Q&>&tH@L-NwM|1k{;+9T~yI!w*+jTRZym1kWk^!^AxnP(L{=38h$wzq%3$mDyRK4T;GNvD34?Y9(b>5H#h9NnWK76~++fK~jWYS+u+fy^MKhK=B%8m6() zHW|~!78EM8Hv5+{2sYBa{&c94phDgm5KT$WLGI_fRTFm_c6XjZ24oFpHTfwkbB67u z4eRCd8{1oxPVL87V&*pe?$Pg*PW_hmj(sV1luwvVoXUKozzI`?!Ff z@rK1@)un-qf!=5yzy6ZWQsb%G?YqNr$Cb>u*3huUtMa}@Dk~vrS@tEFe@D_&Rs-uKPAFYqs=BlLs#mD^`g>;L0`Sn)ZHap||{w#t(V6H{}cycB7}m(i>4V@>A#QJ1L= zyd`)A>o*(wrP46*)?pqjwAMj^UK&AP6y<-i0-To zWwH|!q@E9t4&EH!n7lyEKDnqm+NlrFuf4O#*QC$q@kp8_!tnlbWC4EUnFs9}&G$A! zM8+ARGRtMT`dmOPgh8`&@X`|Ee;^SmrH!98{u0owSe&I1MeW-FaWW|sR3W6L%Fce*gi zu*5>rG4~qBhpDngm>*m*@!+QA9y2sTfU@%^ucs;DKHzf_m*}}0duwnmIl5FZO%HHP z5j*k;kNz~TQ;M}8J*r$r8gNgAL*6<5a@)`OD~YwV2*m2+cl?dx=Hb(Xxy7ArSJcj} zs3Ud0Pf|5yKH^WWdk7hJnmN<;ENHq75Bm3qGX10jycg)#X}D|l>zE?1EUI~TSO>8^ zy-IMWX8xtaBcJ}2;qP&Qrqh?Kg5l`&@itcH&r5k))}ofB#dc%0@%S@@YWf_94KgRz z;PJt+F3tF7!Bw(6KD^xCDIwn0Lc09sW#>UD=l$Eo40BL;*T81@HA3>uoP6-pMVkz5 zeZI_Dw6nhd6ad9FgxTnwor-KQWXAoZxS`2ex6|mf`$kJI-UUFbMbq*gWTlJ5b=2Hm zT<${5NzA~5!c6Kdb(E?5Pj&xbRLpHIX;0PH+U9EvMEiK$QKkVX)W5`?A7anN8D52DHSY=R}wv3|i4c5ZOH%-U&QGKhhhw**$q3da3 z?5;gz|4R<}4v#=(a_Mih;*&$A22M>$peQV2moXqRo0dzSZ*B{0g38*iZK?DuZNRTp zU;WH_2P{Ws>n;DCVd-Cp2QgAIH%s3VC(+jix~*@PeReIeBPNSjh{aro(jFh1Huada z%xViNv)5)@EBSsByjCro1yogo59}GmJeJTZk`5h_b!|uoDZ;Eoj#_GDPi>$C5UBE& z>%c=ZS}nb?aV7zyedAN$`0ytidty&-6$CeA>8?ts?>QE@j%ar+d%k-LXDKZGX0UjO z<}F5*>@)ORF$|ul4Of|6JW-<142c=Ys8KrMrC9JT&x(I%1-=t+CU!a1srAW)XOr0r zzHV=(ocGhuxfpewJ0zk3>~I`whM<%n=HJJQ%bc}UjEDPBFx@Y|N;E!u|6^{7df_<8OT zeXxq68c4GfEke&d2j_S%SNgwW)aRyZk?r9 z3(u7@s6=+&m1+?L3u9~2?{LPIK9lf{oU9qSWC0<&ZyRU?DEK0Js%Kyl5 z!6Y=BPo9!ReII^BG#}L#`OXJ-D)6j!8$B^(YrBfg(~DMNMxlS_G7^yb6&Iam6_Ork z0y=K`&{nkMq{-}Ao1VZ!A!n40R=nRAE|<~UePVBk9gXiO-zN3j1M7xfV>F7(s&pY+ zzlnG{^5j^^=!y>d7^XayPzOaG9Rx zLRgNJq0JiJ6Tbg>oq3#lB<5pO)53UR$j1}VymXCH>$13Grv(&Lr;0q7rRaTU^%aj2iccpKYx56QJ5}9zN7lhzXZ^ zJ0bm2#t!9%G{PA2Qn%Rxipf{Rnjfc#g}_@5Jc=3x_6m5l50Rf$_Slujww=Y^SNAf< za%vDx44~Zt$d62l8^y;3OYTYo80E*RgF5VgP_X_q42@MRXM1*zTN*M8aSfae1bBxS zIas+qvFEavar(yCvkLz$NyN_BBr!%nt-nb&Hu+|X0PVJ4!bhr43i#vemmZ!pz_1!- z_-ksOWtHIlnAgcBdt0WKTh3dMHgg{orsQ_R(R;&a70H zOs{_YHOPLc=+&>%FNs5+8!ar)G8zY+rw1HOK7DA#wns-TC9L_Efm?x%MY$uRp<3F0 zn7`z?A8haN{BruGvjW{_pW-^oEs8z25NUSRs}paD0S$qt->_LHEOdSKMJNR9&HaXL zmK6(ovDFk_*P)|OAQKsFj;;0pD^7}K zXnf)gfxU6fiK^TnKNtONk1`35Fr3PpW8#CZ%P;=Gl35VMR^fMF0r%dqeDg4ZV~&VU z-i?R(;hsc2aZinFOn-6J9{G~11PJPM+{&sjP{c*k%$54j`FO0j7kNO82gYxE9u{Eg z1m1te=1oB&EO6LI-{i?Ar4CU+fk8B1&8B83w;USr%Xpy<8fAn&n3(A=lFQ%_?^9`F~W#@``! ziQ~o+kc#YV^Gbv1&F;F4A?x5WI~J`*@6T?;D%#>6L_=XtoB zM9{v!BDo#%=`&t46^ObC4XF+}t;!d92JIY1J>y&ARs-2P@w&ibx*U}odHLeP%>>VM zsfK!YeosZ^u`kS%9>QkeDPMmnWeT^v1DRg~zT-`?rB@bTn!3VF`k(;rJ3vb!mqK&_ zlgvt-DUCZmXgO!jjYaF87@r~jLDjVjo)`=FARgTG zEq=&y1Qi-9q;(gr_B8Ex6vJW96jYa;WH5NN{PhR>gk+1V=cPF07sKh4@w{l0;Mh%&|7S0>CxNB9U zl35nzQr}w74lCO7=II!O<>RQiY=7CPz6R8FhNInwj;(ekx=$;#yFSPsa+LPlfH#U( z#~uny9*$1KXVN!Y^a8EKW2oBT+1aurEb-Fmvi*^R=J zR}7Rjg9?g7i?SI(*yU~Abhj&7r%cjD%3n7Xi^la7?-Bcd(B;q1XH|Xi^!d+Uwk2}s z_(Kd4?9nb1Zp3;+_jK83WNT=MI$tgLqs_aQh~HB+&T+77bGe%|SlVkv4^JX^CW{se zO}^HDSX|viN%n@Te%NRm6$gCV8AUPF;ieBm5=Z-HoJ@*4+)=j^SK~q*iEkUkvG*7$QnB+G=2I+z8 za!;#WZAA4;_#*RIZ1=^bjJLD!u#J34uZp6Dfh_b%$Jk8g)23zG>(dTM1yj$4Gh3JM zz4G*&5m=-sh+!@vHe_m@dXzL{t(LPvrn3%C`lnol=7faJ7WrI@cGhp+3)n!vj~;6< z*%+!bD&E?z6;|rVp4ljox-adsc|IK-QmrQxkx@$d{?cc=vs>TlB4UEvST}bl z-5Uybm*y|$wJO4E#EgF9(1fgP3WIdOeJ+JPz!Ico_{@~bs+fiK3$5rTgm#MfjqY>b zp*tV=w-t4$rbXX^p-a&c5WuX&sFjd@g3un0)+_yZ*HA0oCL0z14DZxk&u&uE=FLT2 z=ZBfz2)>6jmZrU7B$@M$15(RLLbuKmW9p&ODs>Is0`}*)0dG>6fpdae z!2P`|-Md~^F%v~4i>;^$VMWOPu2$CIw;<&Ez5hWFy5;HfS8lhpmIlNesCU+e6n^?z zZkWT_KbhK*E)Mtz%1h#EY3a%6scg_CThqp;I?q8?PFzqfCnwZe;4!m^1P-56u2x0M zV%_Kbw?y|heR1+t`l7Nku>vwq7N(LtFz3aO@%hHUI_wYyVu`)1C4W$U)+M{AtG-3J zB_Y_&Li&bRdvX+q+nrw`9s6esxUm3d=l7t(b05k@^ZbM^`=!#(`iLTMhzogMCglix0 zKj4|>^h;j-p{3=zi`G4ikC1VLMTF(TqOjdeZOt~kmT$Ur84j|?O{st*a?-N*b266K ztpBJX9vta>&vO#DJkoQ_a_vmxp!+K6Lr(45%sU zjp0fF8WO1Nw|%;@T~7Z)3K?CRdj0CxxqI%?OY2-H!a?d%iq0RGlq*JA^(`4q8c}Q} z>mSQ!Lwqttk8G@Twr?A{JobJ-Gqb|sMec#iUYK37mS!DE9DM4 z5q5CGycz2;iViwm1F~G4I~jE9mID@AM$d62eR(Y@j>4K&QQk94?o`(3i~-kXbCfTw zm)^du@Co}(EJ?7q8qSuuMc0bxWH5(`>teEWX1)1rcKW9^cAi;E-rNaM8>B~TwRv7) z7{;iOc78yTH)BjONhWyQ^|6FtpL%7;9G_*QQYuCK96Pa08vhi@*7%4#EX8gw^zxthMH{6Y?tL{Wc>7LoP?A}FXsG&dm6@_1eU?nF7D;OlQF@4p&Mg z-7sDo{?isEpytDejh;gcfaQFAT6+^MC zron)Xr2CmU%t;~aeb#&sm%zy|PmD<3zp!$-0uX;ahN3m!Ex?{?xXSTt zlA}5Cw?qjoxwDUkR(mA`EL7;bA+$SzI+jgo;$_G8Og>4OZQ|v7s|PJIMU)kp6i>KP zxq<^e^m_lCimom=Rj1>NPls7|-zMDq%p+qmuyTTV4zFXlKzH>Uk77wXb1nj_!9 z^kP$pK_i-Sd@+CUnBUe6z1+X@;PnH3Ma%@FVD4ZiQDAUmuFDw6vq4d$%f)Q;#=(7L z(he_3Z8VoZm4)6GHeup}<^~!FrL_qv0GV~NTm!S1g677o>P>K+zdYq<}I01nc~@c(VIsj;gMXc%$zU9xr5WUlllRSmk2f zU7lk8MI);0dmolHWLQovtMg>Jx>YSD_kH#7x1*iIfC0h4!vtFm&5g|2icd^6@h-+p4Fc{`AhRc@>;lj`693PW0;1xcmLhd5BB2^bea^P zz{9g;Gry-S1jy-JzQq@~oG30}%<5O`^yJugz6?c;^Q6uOiTppZ-aS1=wvM^;vFhEx zc=J67aYR3o2w?|&ayj@?C7g^k12rs6t&ZSW*S>JQDYN^8RAd)wjb|>Ne%S28=>0$s z+L_?my;y;64|pywPyGH4Q%E&h?A|G!EiZv6d0akFPml%I%~gTtJ`Af0dGnBBnG=TZ z`qrarEu!Op7GJT`ogs0~VK5F=J`__G|rEwLACC0%P>w<+w&JoaJ_Q5wFSk{pdw;Lb30i^G@-LTEJc>%w^6B zb#OBwG=PrNno1s+{F^BnGs<3OEX4pfxzQ*)cqy0HTcb<*mkTD+t&8K{MWu0Cy8H%6 zzGl&Ou~ObSo#oJScr653AIXbY_VP8zqY--_iWGXvbkKb!X@72AFe`nSgJ#;8p(~ z8+bRep)w2HUWja$TY8?J&AC;M`WDoY(8qZ`?w#khmGv_gAC-YfMFPV0P~&m0;{#MP zSY8;p`9cV!Rn`+yy2vy3fY|GxrV?@Pqh@w#-ZM}4_@z6%M72U}xo?f>_RQI`S+9qy zPt;^6F#{Ih7?%hAgO}3svH23M{I8_PuT=s zuPannKIGY(?7WG@ zptYUT8W~FgI(OG6Zy3z#09VA&E!+b~0{IPCtg&$mwap7=CHnn^u+hqzQx8hDE5YjA z5YvPOXLKHbSws;254O~xF@+d(b->*iRdc|bsMAy1R2MN?aMagV*{H&0mNJ2Yz1rdL z+Jb_(B!Mgty?kq<*1BJ`-5Cqh3GiJZmGBZ?KUQZhs(4jJs~vs0WX#SuWd(kTqA0oi z`9X}z=n0dDf~xEJ{HXywqRNmUsCQDt8FZtljpd!d$H`GkG^`Y^db79C<dXAXW=4l;-5X;Y z`HkcK@HQZ-WKOY{=#h%pm0m9bxay)lxf@DuQi(y>Te|DYcUcsYll=CC%dG1koxbRv z2nZi!;*>V=`FY;qu*vBrj*4Ky(cE+jnRjwivD!XmaXB8xH$3}AYuYAkAjZVsOX(1M zb|}zKcli4_`f_Jeptr8eh-FkHXk_65`dJfz2T6W{^g(4-lY3cBLVUe2r+*no`ti6n zyswT-WGWcPV2-V~*sPTSVY3k3ebG^4c3C7@6o>-5zE`RlFVnIv0|o1@qC8RZT03)M zW0e(EH#IC|+^tM2%ta({Rq87;!`ZYmT5IVx=K!7OlDB(nTE?1=G34SDXXx(T2n*Dm9X1xskWGNv?U` zJi=y zm#(^?Zp0LdKO2X>@h!WMuKuD^4zBRDIIItw$1Z1`B#>sP$z)Q7=wIZe*~3G#n#MZ( zUS90D^RjsnISq4!FHK|mPt|aJlvj%>?gzRGYN6T7N8VnA$BWyY?y0Usk?}s zM>6ts2QxQPpYdbNZR!KI4R&af!XrMm^GPEXx>WJtJkriWVDL zgGA1#$bq9$_Ev%gjS#PaL*-!hWhyZcB*l|gp?^ui+&B|&y18GuHAQ%HeN#uCBd>!c z*u-ORNC1MWb(KQPe2%Xm@C#=1#N1`OOlUwU#)MyhZ$lz4WIHJqo-1|?{Ua$q%m3rk ztYnzCT}`qe0r}xco!_1t@*7RJV@iG3!#(Ghrac2q3|Wh^`RC4wBzmc|6(xX^5)cNz z34kScnkHLDVYO8=KV@e?Gm0U^(vw4^Qe7yD&w;7ho@c7I=a-y=VtB<>4Hu*9DbJS% z@$b7g@tl*EXY+C?Br*8p09I?SqMhsTy{(xblNB=Rw#GL|p?%v#fwo}p_pXhv*F*sv z{Kmgu`pf+E2Mu*0y>28#p*;Ok@y?hJ=>>EaAxeTyAd)J@{WjbdFbL3 z`QS>2__?N{u;1^WK%PPkB`mJEPIld@`wU+w3v(h3q*3e)&YRv$#stht|6+2pIE;c+ zwj7k%c?NXEHdX`>vKvJ#Kg(%d!a@So^H}A&*S3moe9~cuki2;cYxPx9-G*$qfQAI$ z@lr>oc1wYr57(u@H1Z;}=Jb_zy_2PSHkQ*O_o&53T`m}zlv|Pvf!R3(7c5Y+5^5p_<2e&OZ(n8Cy`fboh=W*%z*XDnd*BY=4v$6 z%nv(*Y$Iyy`9gnCVAquyVJHO_nW+0&#C2e~VSTU~#rd1sa@p!AgOI+G6;1lUgp%n^ zn&ZVr_t3o|FBJ=b}Mlx%H(w^VaL$Gr-{ONC$R&Iqcra;HsEkL~F*1ssPSC+aWHTnO}Eg zVa|ISp2P=L+Nj%-QAd(WQPyH=R-K(cP>|W)l$92zn-=a4M{RAgj6k@+xTraolC-RgEzSQ}l?Ntu&`Iz+(`t7UOgJ zVaWXZOg>?))t!d{eLOh;#5C5jp6rL@HWR=NHfd2i!(4aMwF0V)o#OGwevFSjI82zK z+Y~$J8 zQ${B*dkw)VQWTp$e-GGej_}MJtzkUUA?`% z0TXVrlWww?!fa?scC>ymkJ2Dbd*0OR-M1-+AKUmxIew$-{}$*5H8LYK1K0$98cI>2&`$m&KWWtroTe-u==~JM6WLaE{lVyJIb# zOaJ4y@PmG{`Ms0@O&=-{A*D~77A;C@XU8(_Sgt@;)U)d2JKi&cj~||XP)apdb5Mw9 zd&F<990<^{{adss4TkSWm3B=c5}^~>VSv)$4h@q>7mwL&Ly*2KpKY_tU;1-lQU zgzt{?{%GaT&)t=4BEsl*h6f$(mVemRS>KMjOFUfSSHAz-rPzf*d7Y%}A zc}qH>EJqGVxANFshpTn9tO=r{YM77-YjV_Ok-vEcGWCT}F`ypj5jlcsh^l6FDpRpB zN@z)M-1lQHdh+4D$Cf;x+8m$ga)-SzoGpK~2kLIpt+y?|9ytvBBZOSaV6rj;2D^~c zU?a(-^*1o~zq;2>gDzdYICUSW`1v- z!6F2(o@VI{(nfh9jUPqPx|fdU5ggBUKI>hTKvEvwgLv}9wk`kHnEWVl$+y9!o;n!P zSPbR_0ZiVPxOKVLN8R~du3TMUA2&VDzij<~{w_9hIsNsk+r|>2yJ5;jk+%Y*(F_3vMq?usXi{(kn+XrkSU&utIUus8$!U%&o& zQQymPk~Pd`txr8rk8`osYuBpzOk3Cblb_H3O1(;~;{Gdg@xPvUasK{~{y*}Z`~Sx` zGp29MU&*;nGr6beXgWe+aF`m1=**FQKKTy7@=fuq4#4%lI`!v8m##=T`xc0wcHhEPjh{%C7fm56g^ z;wej6Npn)7pQ+>1(Q6c22SFOm{p7fG{6M}zz2%4G{?cM*zBPFHoSgft4!?>-&ey=d z>iKzL7sG7)-S{W9;1M+TqX1NRlYV8qN%-m&8TJ-)BL=s@L;J%=JQKVnZ?NUg4E3f6 zKvxlIPNKy6UbK6bHFrT?oG+A>TkY@2ZDe34jd zJ7yvKzgEm2wa4DBv;X=+pr03F9hw=P;%8vZ#&h}mu!11)!f=8Zp$j|0#s-zOnq}bM zTa(wS1C*Xw;StEIz~?!1g3AZ*b=N7Vl68C?tXfAY@@2|b5lYYdccUc_jo)Zf;RXFk zu?FP{IT76ko83-Pky29bq5t3>4`Zff=kG?KhO_{X;Y1PXQ)5Go*3RX(KNzcU$UbsU zKc6dq?p?ys1sOsUR>33v)QucK3{>&=6Aqj2;_Qlzk`7Vvbaet;<5I@LwU0H2=9$f> z$gn^uw2hN>C*Ww9&)U#<-_(C;s(*I+NWWsy>DUClas|XQu|r}Gg}x#EDYejDIS=Qc zU3F^7lsIA?zqu>SSFCUC1^)Uz?u@G1i-E%zZG=3Z!|Y~}`ONmm1+!yW%7>;?w|ovB zTXz)U{|Z+IKYZ0)nISi2%76 zHEZo+(GF;dkLGJkcc%WAyXTLJ?rOw7y`mL?_5)juWIGv?MOV?MO_A{yE9qw+Ob9~Z z4y(<)o>07mp@L1ih{+U~1lUPHEYt);^NDmm=3sV6n^w5kjEioG37bt{{D#@({l^r2 zD*Euw(+CAW(>6{kz$c#IZJp^C#2_J zCXW-0J1e^ZItMSS0$N|D%(vG1-4!tyu^T4`Uo-d0m6qu~BZR4mT zt$MyS$|ulhK!p9&+&?Bltf7X#fBpL6BEN)$1lFc%(vJE4Ba8@$C(4PA;k=c4YonIj z$u&NDod4+hSe@H#|G0VNsoK~7z4`Zk{(tU}gg=EFlXusw3!6VGJ6C;#JygSNmVExfJdQM&ls~)^o1dN(?A3UpE~(M9%Z)(ZyR zR~-K9XpcWj&%X(HLn1k4fMq4rat@zbpg*3`DkQuBE~d&~L*(RsVL4r_1Al&5oc(88 zex_IIq`tPb>GJXML7`9!_Kg1P%x~MR($@IWRtwz0`ki3KbqlWnZW{gIzUcYX}7xhP(qjeC7^(=4q`oh0o^s{>mwf0CX{nQyVJ;r2ym*pz{X(EmrOWX*BB8?uG)JvR zdYnR>Z-+ZP!6RAYfi7L~30iY$L=%=}2`<=^{+4m!(Z1Z>e-lg^|GXyrRd}>HLS3_S zjak*s;hwc(u+VURW|f=ZKaC_!Zekt#?p5fP9sgdzlp4H-p6dM6@HdI>E+h=PFBAfYBe z6i7lS2_%G&Lh=GLcU|xM=l$_rZ@u5|t(OJ)sd!K#w*?XV8n>eL-31F*#<|(_N znyYw!8^P2emtiVMQLX~DVI@4j`1=QVEb!M155ixPJwJA)`M{&f2%MaxtVR0i7(v|q zzj6dfE^RRi%%+KyAdaKK#dER$B~npXUX?#$OlNv=dk=x1vQx|FXWWj&)M;nTywh&> z{XB9&C)BI0r$e7A!&>;8OTJD2uyns!rs~(vJw3DqTTw)~S4{_m{>yl^-Q-&AN)BET z^IZY}F$iHnA!Qf^^+r3 zdTMN>_xo@dpz;Ov)mISW`xF6-7YcEA-GkpF++k+GPrpNEnhps~_X!*<@Aj%8`47b6 zLb-OvYU_nxSkst>-?5aLxeMkyVcz8f^4u#nYa8b-D5qTN98o&w^4sawHdhl9pl@i< z*|bZqUIi(fxYrN-8#mfn08aBgXv58aN=Q`P0=??%_<3igdx?4oeX+<$47omZO6paM zFEZr;iUHS#jTFiR4Is{BOKk2GJutE6IiXk39-L6djD-|l%Sh_U)7y;}wX$VVHEp)I zbU4#IX{@sJRFNL7-3GeI%iv-X>tvthPl_z~8AsPFg1KDNJIgPY{-v%USlK~`&<1oozn zZ9w{;<%_DatnvrJAQNjQI(=!`8(`NCt&~Gsj#*mXegK(WN7uX?{KtLm2wxu6{@j7$ zmK%knlI3M^A1Y&q`3}S9Tygm z$~)T^&wt2#DHdTDv=PX5Hy3B!Uash~7l@3dEFH#|-xIy}|EUXiFi=j|-I0NVSo(As zs`xM%aoNpVuHylel)+P~PO1=(WeH8DAMd?78CNqy!MFSko-ZeTC(Em`jpe4vu~}-S z2^rO?vMd(McfA5ly!VwCb~n*t!XrqB5`;Y*HuA*4z#e|Bx-Tk0j9TP7q(dgCgp@y{ z92VIeAfMs-ZHpG}$jWw(lK2(8P|}J|11uSXwcExp~a0?v)udVC)u2 zn03x1BVwnjun&DVx6%V;IazYqCcLI(d8{NUN@GZ&>($tzjD4$;M1)t|!G^#Rk|?0$ zHv=t!@?B+lD*hQc<*b(F?Zj+-P2$5!SsxZZtTz3^#Hw?inpB)=<|!R__V+)BPK?9d zc8Uf7rCt{8E+MP8j5W4QnC$i_u)ZwTZN6TX89R@rhr%SQeKCuPW7UEBep&P5QOgJ_ zKUC#!G3Jp!qjyOa>z83x`0V-cZ&|X_A5VBUqrWETQ<^B(4+@x-&MavBv$@!eSomDf z(eo1)__YL^nXHp06G~R)byz)ZkbGcEpk%h7@(mtO0gUv$Xj4^uQ7&q1S^ZPw@$g;VmrT>2`hyz5VOu3Pd+CpVw3TxmFIQD5 zyGb6om!Vl`;rl6*|KV!!DZ8wT8k7nqQRY@?y{1%Q3@Rpf3FxP3>#P5VX=hEv9p0mc z<6~7{J_egk@%yWc$xkkbZ^cBF^Q0z%O^jx6g}~1y~Ve128H0f65xqTMqqhFLims z?^}~gNLZMpE1!903?vd}*txoP@=UPmVc-dD^&R zsGs{u=)0v2a?d#!acO;##P{dz);Jo2Xw=$3;yF80E>d9{@G&Ar`~ zj<$K6{rvp0)Sqts^N(AqKO6biF{KqmM?R;2P<_!O>uaVu2YKytDo7(6boT{PKK+lg zTC1np>IhCJemYq@a zrLfQNbYHR;@O&(e_|}xKj}MQVuhn}vONGzM^`gg{F2_XYqgZ49iU=gFt6@>Lzlkw^u z_v-VYge{!WIg<%2X=xRMjQ%9%`i1wH{mXH}Y7WR`$2+(FT+Bbf*|aT%$e4BW>A;i) zv2s_sl8DY?0h~GTMt*jVi@PWyPcmTUWk|6lvn7NwL{BPK#vw`pe51iAi*E7)eO}7j zQ_#o(DbwHg%rlQpzJBub*D%C}kUU{7G5c4BE-b{Hx3lHPTHMK?uO2h@?9XEo%Ghz# zr2Dzs4=F7upYS}*CY&77x#i}y*%93k1}Z0c9U{|iTAosgL_eNxXn#w4-W!68u_5Zj zcAelQn|SbZcPet+*0Av|*(M9m?~S&c&eB;<_II|s!8ZkcF;;=4<*Va)6mR{J=)tK{ z%NxwjnL2ZcXdmIrTR~Z=`2b?&kr2$Wj74;Y^zD$DQgP1UPGn0xC=g1FdnKVQ>oFI5 z31#rkIQd>@0%|}dh*x`^#8Om3mU^QB=e&35DI!Pmz?*T$y=DeI4&t}R$3&8k!*swe zKJUqEitW!;pVDa`N`6B51vNV+fZv)}b4C%<)K{e`vK4_W#teP%h`9C^<0zCxXfNSSu|wl+@dM+`c&5Gc1!e(u1-j@?$j;K{G0O z8D_|<(z={y(e$9RqaBk#0H2ls-UUSS{;1&@-3!{$Ob(0lMf^fKqp#-R4w#5+Pm+(V z3rk+)2MPjUM+a|R+G;%w?RWRqIQC3sr2!K7kjNr>?lW0aHm8!& zpRp_w!I?d0J*CwgyKa|n;GH9DQdeoI9J7HRqOMg_W525}INcF$t+ecb(!x!W52@^E zGLOL^-`EY_GGEqU8dbgz)>R?Jtq0I|-8n*DJ6b_p-%{DWS1*zD^~_J;9WCe4_)Der z;^@UM`mtGj5nXTQiP-#{z!ur&*;wC>u}i{O4ejFrU6pOw?$%d=bO2`;ciQ!q z5&?I5PlQkxdv=LtdqZi(>_+k=FA8cTnj(I(jr46Nd*b?sr6yBhe7V4v@392cb-9mv zEjVNuM@bQSuJ_io17amS1EsFQ$)}V8L5iVhl|Z02gh@_amJP6XROtnAIFeuMd=8dE zxr{!~l#ePrb?7$6*(4d*%TWGz_W4MgeqcCbQnw=-81&Rf7z>t359 z5Yk9H(4XmH2*!Jq7j4jGc|0OF%as#)GpsHU@s63y#%mEww(a19fSg*#c zs`7ePpBO|NW_>daI`HML4TWhBMak}GSL*b_d4^z0#4SC@_sLPe zLaCcTZv#z!BqyT};#ZIl+A-RyyjV1H`SRqIfi6eyWPLv zKf*L90qG2?n^-2!ZVewi^3Yc>-Ei;nUA@Aet>(KXA}(9L@inu~(zoom#7BCY4?MZh zku*>pn0=_6Q_bYGWoQL3U!|}PHx7S^SrFPqS|3LTY z$mJI$({m8%hYz-VwJnw5Bf9Zh)U=`tGAv>=ElEmyPDQs`HKOfhwO@(xb(`evodS=H zYv1VFF>HC$&1m(D;b<0gs!$f6Co7}JNj&Oj_A)Mi+OIc|zPgs1$6QMhq)n-@S9|YZ z_VO&f6V-Fh1k2$0vV*JzTT%fbsDVxr8F>;*Nj`y^YiR8pfVOEHdhHCqx&Wt@4mg;HloD5 zE35UIMMhkV6bfj@pN80G6kADVO@d%en+toZMu#_wPR}34*<}=!fjtZ7iubQ7OuDJ8 z*ryY!vi46pzi(g2o(`?pp~2yneRDC`#+KOzZ)%|1-N@b;?SW@s;krh?TG%tQN6_B) z7FH1M-`1l&e;UwNd2`nhw%YEAyB>(I?v0|mvfI!`$P_);wcu!@#6YuF6?Ub)(%0?2 zqQUI_E6XX&eyP$SB+3CdW@0z7ebp$@$Bd4h+C|DowOb!3Z^s7?i%&S@0<7ALBhh`V zdr_Eg6gOx8%lNZ8Rdc6JtS1BkjEx7s4C|9D5^Jz4N62p5n~%RWrpPs3N=I8QNxF|s>$gK!_gD2TI_34!=$XC{vG9)v*@VbBb5H=fMm5d$JP4r zV{9Ua#>*ra%`@zIAJ+6lnmCjcAg+N_?Y_o5dO5mKG>=3dHFztFqg>+iOPz{py`rk! z*n+Uy)RcVBzS^F9tC@8s6Hc3c4PRDKznneDQv^L^w%x)H+ znEADyDbCM{-H%Fw7(`tX+L~5#UhVL<6Q@7qZLpuo_C1g1>){3y)m)H(I6=a$)-80^DES(a19OW_inhww#9ymA2N3A6)rQg7EC9O zi5*!2DQb|Z9yy3ia8=whvMN65G$J=!Vg~0=xUu~x5_2P+&o#*ov#B1@Bt`@g^7&bv zx%#YjI%BYPMR9iA&cJl~B97D#fo7Qx9JwHn89|A2So&9k=pCZBc$y7LHXj09e zNPJV#(Eh+P9M##Gy`z1XZWG8E!?TKl4Mlz9_AHu@(jE)A@omPenzOyexjdN``intb zv58D?ev;U!^w>|IjE~Rc882s7gI5VEXl=4SZ(61Va{7XZF%hfa=CrJ;R9^pFjGmZ5 zr2M960a1>a!H@NghPCBk{3cdSrqcC^)WmHto23>F22MtV#FHvzKIfmia;HI{x z;{<6zHP?r(>+CJrYD3pJYc)kBBN|q$Qhd7x)xz&8F#OH6IQIyAmJl#sKHfnx87Cxc zKAM`iihBwFBvz`QL6uprXtze%Q%us?G7&joFI4^osVIHOyUj7xg_|KIGJ5of z^p9)T>xiN`yR8p;sMtKq{Q5*fq}6+6s7<3=eUqoB8J+)$(tR4itoxcEJ#zRR$sU!Y zUvcTuw(q{( zPi8M=yr!liV^_POgzrLP!Jbd9QCAyGIkJ5c5yJg%St9+rMsRgkM6I4!b*---rQI7fak~_rIZN_f}fu!3m-(vL^i{ zGwHB=eG;7y7QRfxMq}9rkF=Iv!?}jAnW#+JNZxzu;)*(cO%Ws4kz-uV4;XIQnLWqZ z>!btawY0kOerkux?tc(Uy)qJFXlO{^5_5|xX8i2(xM7+GL2N3R13FD=+%l`0bS@g8 zw(8ndqs@#GrE`)D-M)NWiG|fL4OF30T98@@iq8v_hvA5>AoA&BVl=JDu4KF@Hton?@9S>2n> zeh0b-lQBRzY}{r5b@*_58w;+AymS`7m04xxKb$i`DEx)rCzX+xK9HZCmo>YwU88j@ zJV-Lv<~TtAxPbTXc32@%_jCrT?S93WoXOf$u(*Ddf1mf@XKZ)N!1Tl#@@jI)R81R= zV0KZi8*3u2cX#k-T$4tP+x<3E3obi*cPRBM@RDR%^OJ9e-PW8&&%s-E_V*pkVVWeT z4n35!pA`(`HrDTk#+EsepPz94nORecy;~xXJmrxP zP5yR7ec@f#XpI*c*!29XK{%dJ=5PZ zOO%co4JbTIUy;vFA9IV~(`glkI)hQ9(f!2edu=BkW6 zfna%1UG8`P4wj!C-rebheGw$A~AGGf$UH?2~*C=#a;tXMN08Gr6B0|PJi`T-1?p-0# zL`r~}U0Tx(0E6jGa!x)jMt-v666xlC^Zmt;^mB3Z+cOXQACpzpy<2xwwLSZLKtq$w z7hS~)2s(?IrZt1N^cAen3lE&@m3}Kd6p49VPZ1R&W(tzU;J`=!s9D}w<5E6^rO0B8 zXVMJ4fh)Tmml5{O2$F^q&KT2I<3Of0ufxx?{2TbkOz-{v5Vy89{Ak#G{|rBpHCazw zMq=uEMaj^uiX(yT|BPhlzcHxvdBEB1yCCX23jG+a^fIW9Bb2;}Wq$Oxn$Wn4OPn@|iXcV=rofOQ>pEL-GiDHewUhH7RIqrVY?^EsP}4#|`Rj%*U}jQBnqkn@TOE*U-_VEg?D$ z1WkIXMb@$J{iCgV#WV4&1zLRngzK-(yR-Gj!}pl35rUka-lPK@nFgxbOE1q6K(8Cq zVJ>p@Nwgnnj;z=F=c0fC&O!pxg80jet5a3c)pq(qxvMO5T3W9rn~CExRRSkhY_=x6xg*A48jnMQO6SkCH%2W`NlBdHEQM0XxjOGH-mnaP zxsbG&nTM)%P))0<_f&>%u=Jufn&B}uw!|r$EQ?vKzQ^)>Ir%_a)!wagNpA1eNODim zy{1Cr)w)(T=}ye(u-JHl-~l6bCoB)rW<5CVnOFPE3yoEEW~RnA?$2A`1PyJMl3xgoyDn@gM@478kTe1$*7ulN%jcjozF}0T1tZl$hl?)l>iM5+0s|P?}bs-W7yf z^g!Ljckyyf$XO@&+nn5b(kbu|1xR7!fct~RNUXB%O}+Wi_VA4iXC*sP%V6vY@mgLp z{f4WmGc3eedWYpzCAFKc?c-sSIng_0_+M@`SB`{&3jHkjeI`Em>RA`uaj6l@(vwP; zfY7$>H)hIm&biUC!v?-7m6!lVXwCxsYkukCvmISI6R)wxkQT*scW9e(;@C-yK&R0W z!R@J%+V#8qc-VBe3Y)*&jYh8NPb}wSpdr@SrhpV#z|tcmCI|!{!Tc&^Z9AKqEW=Ke zr%@W_^*AePiya{1AWmM+WNXSB=P4t_|&ki^P zv;I+@e1^l{YoH(>O`y83!G0)a3DtFNz5O-n1bIX*xQ9I0U~kb|%S|Tixwky>yfZ$_*9~e9jfst1N+*xjy*=as9GnuY zUI52@I!N^YPODQet=m5rDJI!DmtCAWeIfaGU?%r5lE^qLg zR2DEJ)766T?uJvX%|!krjuPRR#~YScddY>YeHv^TDiI+$AgvE2vbs~$;94PA9e zq0wI6zO9J(L|3SP{#-muweU17S`8qj(_opS6(GvVU7$eE7gi%woMQ{z~%pmC5Jmws{(a=fpM<(;=S4_!xNp-byMdfH+qoHH9dFCb6@$qpVT=>@n z;W^YYJ35-b-^6wH*H^EKtE_CZEI5=LX*{q=@a(<+q}O%U=*Y-h0nE;8IsB{>=5#Ja z-qOU-u&^YyDf7fHfL+x3bM1u74kkyKz)%{aBUAo{RIx{t5?{b2d?4upVs%j!v4pflA8B53%Y*P5>{^w2 zTBgZ0iD;lfPHufzIe1b=jOwCLuQ}WyR}q8_211tAJZNKP5Ds5$tKU>T^7AWCX^AS+ zPoF~Gzwhl~SzkYWf*pIhf@Qd;rmB2*IDozQktb2?1?1?gjs#@&(x-JwnMSkL(e-Cy zAdXf7=QM#3aBHo_&(;ox-g;@PV3XD@q3v8}=gGD^N!xHb=@^!;+M)td*DHNp)ql1$ z0#xZ&dE*q2{X4_PtLC4#COT}&?N(B=hr&&Vx}Ci{_3a5=3i*SivekE$)H2q5kT$wE zBQG=QX-Q-FWd+FtLIW>e2JX<7KEzf@?TIoUt!InWj4QvdYa0sxO6NFGHKRS40)r++Si>t>U*pat08{<3Ep0xyJ3TZP_v<|ug5U~ z&0(YDN7NE4O{KHSv30idIWR3qWgcxp`0fF({&Rcf?tR@U9=#kHl`n1Qvi?{$Qe`2Q zU)UbQ;uovhI(pW4z_HI^8Ie?7??#3}kb-QDgWdd-ryG&qR&DC1*%HNu8FOWhF?9c0 zoC#~-h)kL!fKdl4_F}lw;_X)iSn&V^GOI8Jrqs}-QQcW>12ykijvxqxfGh)dKHVZC z?5IRACAPCFG6Kux{WeZmE9GYkg5KeyqvMrh;B(<{w00@`m*#sZ)kqBUS$xLk)4u@1 z6R2QjT(yST@%SWiw@KtYO~&h~GG;|o~@5Xz|{_OIkK*SA^u;XR)} zAr|T}^+QI^8Z!9csx_hxKKEd3#L8IcT86=KKZo+>y$y|5Qp9B}2N|TJ=q6C4t^@?J(1TM~z-jY}Orgk4JV>H>b+(GxU!CJ%(Wk|8Agg}&528Jh?L0CL4Ass@` z+W`$KXybF}9W#;DS^}MJJ8x-xdJU>_lTghed^p>0oeNYuel%K{6ua=&taZ~~Jgnz< zNKiKsaR1|@+vix{iaGRcJT!f_SA;$)Wn4s;R6vRdRJ$@zhBwO?_Zm*EwmJ++zdh8k>z;*-MA2(Hh z@Fs1a{FP-aR>BGNlM6ec z#!9od)-DdfR^!zJCh@0Ncuh9XVYC4=>B-EV3uo0gvPv<57%5D6Bik%$gEeLzsAIga zG?|08Z~E@;$RDgJF*iRQR``4|h5yPTvN;SBxFb#0`vxhy56byP4At@(Hu3UqvEt?J zUbJO@aZPnPOjt4#Ms0Ay^u$6)x}`Dd22-qB7cPT8>_&A-M`DL|gcj2AE*aEW?q`?o ze_)^wOthwVjw3cdr;LW7;c9}^8KVV=8uF$~@KQeO>j`N8>l&$S8|}Q=U|WGcw0dXq zh+`w}B3z}GKgS~8n)Du!8Xh(m!>7nl0TD@iv&_erf$Vi%dP+*XS1hJ(HKr2)2*n^U zSetn6Ik6^vB^6|Bbd;9Z&$(GEZ?Ky32HS0tTTaYez!EFBV`x=5#LJa)L>rKI*yv$jIsVd-xMfbaNm|!yfg}#pJJg_azjb&e+-5sRY9G zB`7l&K!PyWgHZDUkP2H?#q0v{PaAu5R$G`qkdjk2Bv?gWobz8qjZ7^Ccr?=w&orewURMt==7;F^xWlcpTxy>iFnVU9SbxW{_>dD#fIt2 zc>P#@KYj!&6XXa#DA?t>fM>t~~#;@hNyxDPpmN6`e1Eafpg8ki+jV zg25sZvL^A852x}?k^>>!OQnJ85v*%DO2U1U6Xk>Q)WjiU`l9=QJy}gqcqLtG1e&pH zJq-Plc`i6-Z|DwwC-<(XJpjVw=d$$oMfddDfSKO}D5@Dg)E1seIvP-q{$=gG{~fZQ zB>whYtBKh0+k-btGh#F=0#wy|$JI+Ri2bHlokXGb3C9RG8GEuHsfrP-wGLxvi=A7QV0UYKtx$Md#M9>;9F zGj|H@Nc(!Tx${#4DSz08(Y;wF4HFX5cc@2gAxo%99zAkdoW!qUO@iEYc9I|ZmZb(p zFZ-tWqk_o`{%tqI`kK&odF9uvb9p8=P5+7wVCNs8by=wf7#7{yTwD0AE_%fubv?3g z%MmgCIvl51?1(LC4@{T{$S<>+6+s)HC~a>4%L`t~DoKLhVbOG+v)cY(_AR^JPSGo6 zr~(rJ1T2;_%Ih5+Pg|-~U1Hr%gKU|2+Ma$ba}u*5NJY^bxs@?4;w5?^)nWpe(HZE2 zFEmenQMTQA$dPVLmmX2>ZoPXrZOz8+#^@8oEN-Qav0y^@>vz zxHX(c8QMdx;>-R}MaQH&Ur+k=61pElhh>6de@6>vy-nJgCm=~^SH+dIm)X~n zEyxWx3s~@-0ra%{YYUU)@sxH|-zP22vTxdaz&*xkjg>jVe1A zKyAd=p>t&KNb(yGOyqE1v%nSQ^Uvwe_5gOrL;|*AVW7^>ol-K8x_rq1@6(9bvWTfP zSLoi`*MB8>bLm!Ak+Mf`H1^kn>T0VCcSqeFjT(~$nOKK&s$sHaF{HA=Oay{An>d;o zX7j-pCZN^kKf`{Gn_t&3Q!aU5awbjUwk+R`tNEw=>+HAHIn~Ma<;n>$)oJ55?dNUA zBRKx9x4!I|P3My{m*Y~<_e9S>M1kXUxYD{FY3a2UYIyG zWUSpj+K%LPM5v!N={~hmvQUzi5c{|%UM(QhLoi^!zZ(+Mos%ttM233FmN}t-Rvl z{Qk5=Te-VpZ*6Pk+gOQ=ij+gqo#wJHMa;LjZz5S=r&SuPUG`{O*2FV$3s7%)`b7K$ zG1*&w2p$n7jSLH!bN#dLi$ZI<_v>qF?l-!wH9Cu@Rl#j0bU3ulDZg0}wQ~zKh)b|n zIUeoc1@o-+WqA`j%SoC1Ea8<@G)WR<7Ix$yH!*g5TtlvGdgECr74HW$uFPwa2+#8~ z-AN@2L_>B0ND$Y-N}qY!$q20(Cw(V?ser8Lt$=tNhW%fx!ehR{aF2E9S?Qg4P?#sT%A z$}UTJK`}ve7oI^P;X__WdZDF`8YGl+IdPWFbm1>8Nir%O!W6ByGRUW5rZ&ge4#SfXlP0OR-SdElesSlp=yY3ha-ksyyyCSK{My2 z!gV!QA|!IjHrSH8>;ds`3O;4tS$rcwVsxc*0pqo!QaY)LE8RjSdiU66l?S@oxB)Jn zJ(!#P;`L#H6nswc@(t^yEEsUpEF49!1S}kf4(v1wTO^Ad(InS>)dDPd%a;bZlXs`! zg0*l2@x?$r_63RX+_+}gB+)JJT2B7-$`qZ(p5}NDrX?y|-XmMPo88z?h?VqD^x5X{ z**VjiZ@>3Fmv>3$l%xBPL-o(w!&rB#Ej(KT+l`e^g$8sqjlY!y52t0-j#cj|V{2(q z?2T4dV9+G;Emg|dY*eGVx!yQqCeqxq8nM3M!f=XFhBg8{PsXjbIOAscJCsNsvy1j| zB;Bp?q7ctM!whjJI+l-S=YoS{unh|6nuC=yPX)OxofS@24DllBs+Ac6NxM%4m|E9- zw0{#|ua#-D@%kvA2Q8)d^%f6oNfZrX^|K>}GWAZUfFe)B^bC;KRn1zKdb4;iY7vCL zHX67#y&%;_gkMA$wsAUKvj+jv~;Fx zGkXx-`?@ml`jn=eU**@v#x92f#bx!FwRbg&arYf2v=A#z6Tg9jSCsEGaLq7XaYMGSpT7@a57I6r4VJGNH-$kDOy{#qR=$V>j1u*wcz?|M>#8IVi&|V*QSoi<=)!l^aHW;7`RBu;HONrrbJR2Ju zD{60#PQo@j!Xd3O^r@ouyN8T>tnD4MG~e*;%G<*H)^3Pqfqt+lSiKLx2~uy=dGwZ+ zl*H_o>FBc^Y&tfnT_os&KwoQNZf;J8yWFmzHb)%xB#4JG8ZS&tC>NY}%sxCGP~WqG zznOuI2wJleHFe)!|K2Si$kdDsZRjpx+S#RFD;VMC6|o>bADRY#097Er4&WgyhMtx)1cMY*nf|+R z`}TP`2mUPN98l-uoblu3K|BAIJ*~mt7atM+r|k0omxJs72yxsgNF5+FDZ3+@E31*}@mn(q|NK z>PD!ny5^ar9%x6V$Pu5cOYSciL-Pt@YuTv-Wh*#s{o}gl!~7WjE6JkH?u%cN2+PaM zf*E0mC6ds+`*%1FfHxsVs~l@=Y&5M3`ga??rR1mI@)dQTrTr#gO!CE~;>wxJXFX!U zVW*5yNp5(+`>FxQd)-aS|1NT$Lr1%TE|fH!hiy$g=_WXij$9J7Pbpz6wr5FOo%Ja` z?wH*l=H^-4Z(TmoerC@0^uo=9mSNG3+!bcK^^*p9&yu_ zGwEp|3$I=w$y9)n*x`H&A-5ptf_)^hf@2=gqZ(w?tz4Zo4ou zGr89a)?e(}*&58U8&WUcb@Y)o;GMv82ys7F^1o(or>iwg_U-%27vKjl?)(21qjS(q z?OlA5r)|#BA{a$HwIzat#tl@>nasvK-@R1Dt4Q!%^V( zJQuB~PYa!EkO^W3-%(fpZ~~B`LytSens+>Qq1rhIqT<-zVdv$S4>4~I>cB>CX?WUo zZ4N$U1c@_q1~8X=C)8?QH=X-y4*D2UXvNHmM)2jzVCarFx|P-4j6ETu=CfvP2b1?-U)4Md#U|+>~(PHcgRSNuE!i8|FRfx3~d)h8bV|(hA zxLToLu#x|s{%U7FxKb4m>-B}BU_h38xyuL3(l;2j`D!?Ap~fGUutmmBoZFjZEAQO| zY(bFq3~ML-CSQg!g7-$5KCP~AX@JkJMBKJ$>&(`QzGHMOTL(Q6HoBIYf+@telG~}l z7sdt!OTaE%Q3tCG7m#l30hP5qjmF29 zg^liB(lWPr+k%8MItwbmb2V-o%?%}Td0UsyxN5n%5s}nvh}5Ln6l-4yDk6zLY-!8dmX4@{1KX;mp+=}nXOYG3EK|73e)kV;mxZ$0V?QndwFXySi z1@EjH{RHpKE?GTl((oHib>U-@rYRro;U;{0`1Io%!qim{wQwT0*Ek3N8!UziRcZrW z^4dx-(F-2>;2$ydSj35C%98>%(sUK-6G zi>bd}+6Pj9|ZW z2P_Se>dAo+(p$8s_vAVh!1)$4s>M_?29Bek`ceHzIDW&R|1{2yw9!UI zD+y}Ii`P#(-K8Sfif50MJhY2}kE0EQTOG;pXzDF2DXZl~ydN z_U&oi!jTTvcsqn;skSvpCGbY=1Zn1vzt-hbDp%PS0Q8LJ@2;d%<@s+{P?2}ups24a z>C-zQ-=`rZm=oet4@1^T~TQ$$n49lQp-LJrk{+A4HKR% z(_#c^lD?vbzt~&&4Tm4eEb?-jZSv2cx2A{i8r9XnJK4EA1ne~A<#cU4^MRQEwVq@A z2ptAF2OHL8Y5qOYCyJje7H&pWK;^vA_r<7f44JVeS4?8i4V=wVOc_4H8XgtkCiBoz zRBreyBh?fG$2*x|7B%#kF4-lGrfonZrW!5mNcGNBr+t!C8qx^`C~g zWBv~w^0=KzzX4@H({X`6|3ji8n5g ztqB#ck9EDI{-+Vc7YuadGS;^4TTDGji@CSg#D=o;qaBN{Lt*Ir*Ze}TFs@`_)nMq0 zREGJGfT+YDSTm2VHe+)aI?{T$JZ>Fep)Ul>((*D`lQq0F%RBUkFzr9BHep zdloy;A4D|tz(iT$MOJX7I&m5Vex$tQ2y#V9|@t>kr39Qwd`XWkut=#bXFUpPqC^#S_)V7?!2_sJ!Y# zy^KRDS}Iuy4atthXD=J)#tgc+Kb0*b!@Y%ZAGD}kJdA!bl9Fm;TN((CJ2r<=r zaUq6ok*vIz;M5}w0A=;8fr!?_nxPC-2PC-W0!}m+O)`{92MxcY^HZ}K9cgeuvcKyA z@lr_3!vs~<+8W>C3x03eT)U{xbFiW0qe+%EG3!5XSDIkxoQ!@SJY36Ike)nWdYRV! z)7n|B+Ra9bhbniiR%@efQWI^&Q0e2^)a($9LL_O%V6gG!)kv<5IG_2|#CLRqE)?s} z_gjTKmXD^IM1VGTTW0p;NiuL`RL z!?%{-g|t~vtFG3Xpp=O4Q&(eJYwQNw{ho6@r#vo*MU`A)Y;a?5c-q}Fi!YjDd(Fj` zYLbyRy#+$~u8a3=#76N91jiM+Z@&T!6n5xg4EjwTiOqUS1^h19b?Y0*?$-xYGT#fs zQQB&H0W)LMaD$9TZ$I5o zrk_q-mATCjaK1_geA=#&tP0B*@&nqY zD7}o+>uBh|_qaTQZ&vPi*eB0n*jFB^QZWQaIe;>ytd};wN}XgE8`iYS+F1V&_TB@k z>1_KKcYa>=+Tb^%!XN_I5k&e(m6BveM;W9kNN*}lKtKot6G)#gXYYOX*=K)t5p2Bk zU}Qn%Z=j={&68H-v=lN1gU_O&W6TzZstjWjtSvUvv1-z<3TiOwn;_|;B9fPdAVY0rH7OfWN}W9j1K96lkB5k%_VY#7;4r?XRJL0x$rDuV})!F6A6!csVb314H(yXT)BE^B&UWGE_A6{j z1(A5(ctpk8ewY|%p~PC%yZNY2Z0f$y zN$BP}R~e`;7ZSw~!LK_NJ4tC_5QmJ>n#RD^y2ie;+F@5&3slXKjR6*?tixf*IkUQ9 zHm!|bP{GX9i$CmK<73Hi>@b}<7E3a$Eb$iE?FKcUX$<j-5>)~|4S#dp(MdJ)vJjoC zRg3D}CWpcZ^d4 zUrn%6RopO>0QTYp%0|g+Q+QLR-Eh1$q<$vnv#Ep%a(wG_Q{^$rdZ>yFinogk(S}TG zC`v=|SDFtHkVQaaR*nw3Sj0>xm43qQR5*NG*KV79YkV=%6stdWG_w>|G}HixyYyI@ z8Y2svHb~pf$LCF1qw$d)0=Iam+3U!W35r%2I{rM2S?{|q zFK6$BcYftO$heOJvpp$=hst#Q{KDPk7ZGC#g2_|O``2GfXXK@TTAP(PD+_=S145q| zw`ohA$PKgQH09Y?ltM~UwbLS?ABydiDY<8d1Rk8hl933Y$(6|VsEcY|Q&og!k8hI> zvYD)iY#qcI-Q?An8*(7Y-0HZ$(|wAhO$NZum@jBr2b0q=?t;Lk8K4_QO6Ak#Km+G@ zwvbE;)^ZHOr?qT`*+d3(VI5y42BPR_H^jBdiEV%F+Z)Dhix z2jDDSnTKvYKF*hgCW2qzaikAh=0J}4fEQ#@P1!RC2Jsc;*WbVky5#%sqYexX^{y3M z?&{2Btx}9iq;WSQS|zWVR%1QWC?7JsCtfs#*_i@iw<1Jg(qobtbZ}#ATJ z&{+ttiE>FT%}Ov)-cGK|5}Tc(-@Tt?8TPdN+~!R5#p2s7TGsH$m^3m*-^eeNSiTcR z1N*pA%qf;P!4Bh6?w+qws>UXMwujrx&bh|=^AWA5{FB>V-bJjweCTAkw8ta7sB;;x z)MK26&}8wPJmINVCd`6GbN)s_eb$&umLzW8j z^|>JlYd!6TAB)Yyd!($e<%V}BmnT`J8_VlXK@MT4;lW^|55G_~7LmcDNa`c50YEzz z-uZ}&;U^rmcFgzjiVcO;Jg!=)S8A62mN%?@+YnT&s#}_xu3GrCnZB^ln7puZw+kFw z)!0+sw%Bldg7!AtmuQ9%6bxEgj}2dHl)Qqn7fCdMpU7CY1)|98v(6c%mu5`7*0z|1 z2`j;18JK}Nns(@uPT*Q`>!D*Y` z4Sd3lV)3*Jf887vyhMqs;CJjB2^Z_JiyG5OsBzAVZ9RL#G95H-Ol30T71)#$12+3? zGFE&k(Ik^G9BtSJw<0_7tn+AxZIf0fF+P%yXaHxl`vm)?&i?rE`~-eVL>}bbJ#SF} z7-8|uJeFC_&J?>bQAAsxafeF69;CjRNf}h;!1`8lsfS{!Zq#dVl|Rb{8L~mhM|GOV z@*>dG?_(Jo`Hf+&U7t>ZG3CJKTMVW{=PKTiV6a z6V_?EZfO8@5w3GEb$P+3_S!7y~SFfkd^LJ`o< z>}787%CL#DD_;{X%KmjsV4)Phob}6Nviy?T+FF@&Jw%2P932|c3keUme|l-_C#Ecu z)UY~M%cZ+v!-gehpPk#5z0ZGgZDV6&gND920?>FK1cH(m90tTG~KuUl7x>jXB^ z3-$bea{SAhCIDp?O6@2Ay|J-zseiAW41=aWPA2Xh3b`fg21%g}g7l z?BAn4<1cx}As4++4X+D~L!wt03}+XY=AW62@s&JPs>OGe+IsH?+*hiq8)=uR4&mvl z;XeJ}aj;+DhtJ;1fRBs-@{7Hd7}g`%BUeH(Y6dAXpMO(R(_nIkZnnJ7(CXSQ|ofe*Q{ROG|lcs|A;s^zPs zTOGFGtBZ8)iFf)pfbq_eu7OR%PYCoM$k%UQ()NFiV0^*z|6-`c=aJp{3l;wF52F8{ z>%9L9nfwbC{;!1!_ok^#x29xY=uP9wka)p&%_{L66)iKO`|Bh1HCf6P!Grc#Y^>5l zySXoPQm(D7E%;*D$~K;??NWxrK_5>OZ?AVB&bbB9wM`n7{kKK``u_waYbjJaX}dJb z?1WU=MsPjqYhQ{!%K2yWMGe1i2$xRV4Cv5&4u2V$LK~I^J&kMB#N_8ITuVwkdt5K` zq#pmedwIU5-Ou}UXckAl+*Eh`7l}>z-&|Ji`__OFGozS#$B3ivhR4hPB=bw{tDd{j zA7L$kwbXVWedLXJ+moF@jgnwftViIWbyWJzTLc-(1VEKJ*S{Sf`}p<6aG%e2mx==9 zR=BAL@}~07)!qKi?bzG!yUCrm7oYOU^5}tjtoQ_e>+F!B?xzA0JML%%e|n9BzA~lt z<%wxt%@ADL2!S0|5GQTq8QAqHl0tuuqD+(H`#*4-4ZS$zuwgi7jMiA8)p)c#xThLP zctQ0pzJIwf2O8d__fL2~N5>2;qAER~37m?JeYmlGn5)?bA(x$`&>K6NV6mYMx4*hO zJUzDT<=j`=Z0i9pe*UU)B4sdSK9t?J3{Yeo)5*;FEwUUsy+`M#!@FO zJ>doYJfCcAod}#$G5KRX%VugR*eh^&`_z-tq90s#;$J{>L~~vGcRr{7hy@5K6kK&U z1HV!H;yOCU_}z9u_{)oRS^oG59WO-`@y@NW6`yFaiVv+Z7*>qvH1Pme7DAFt!naOcdpmVleedO6<1IBO zBte+>MF0VR&7f4v;2^*NJrlr~qAwQ!#c8A=M@MgM{B{h^)$_b*P&IgX5hO#L_bSDZ zq0pz?Ou(uPVYNb`xkERn;uyFdr2HB1&nE|GT%dOPlhBb3^QF2$U3>w^Co0->mFrs| zSn~>;D2eC;XL@C-v#h{ixh;_?Sg?v4d&TE>9a3<&Cd_n!d(1X%NNX$={Pgq;X-sWf zNFN4`mulf86(<@gcQHYk5=>CzPCr6@qO8>6AU|Ex41XFZT$6f2@K*;{_3WV^@-I)V zJ^u|_?oFK3EDx4lPn5LhP*d|wsED7BvhY^Uenr`bVX{s#mM*fo-s%A2i!*SRDBQG- zN4yDP6)ndTTs(ML9c-KVy~B3ARlEc_C1tWEI!l4-Ivd6|It5 zn!k{`R;q~Y)|3Sm2XNvE=+&2BPelxMOT(NU>?P65*UV`>>r+gfw&3d4vjaxG3wPVp z`cB8olfc+nG#dGo@y*uxZQ|&l^11TF$lVg4rF4N%9`>be*D^1kaGtEbCOIvx<54W);S{r}*(GH+CT$8>JB{L!35VuF6b zT1%W9|7O&tJ4?E_n#i*mc?6=@gjds7B3C$gVnmx%TdK_?B6_8#l5cty^|CraSaPfb zM0NAZ{R4PoONg%qedo5wyX*chaZ>Z&?6GSO@SzzPJa#(Qj!*3! zL2y(?>TJQYDv~StK?cQS!RCIjKqo@P-B8+U9vxF0Hr`yc6Hm-kuGITZ^Om#ggh;b8 zxl|>S8(ZJtJ#`+s=->Lt24EK|Jyh7@Hc6oxb3=0O3BYJ>QmwQ(Dkz^(1!@q#)^6#1 z>jV?}YI`JNbEca8GOtZm;1KL+VI*EG0Ee`V zum|^Bm&Lso-`@$Q9B*5=w+Hzc1EL!3Ot#7%0l9%H?C0wh7o6jLvcnA84Js&|(mluT zvq8}-cTs^qVRjm=zT-47SJ&Ued8&_$()fWb6b3SS;kR=f(Lv#rzkOb`uJ(FL3H{2; zpOPP?*7Rd7_PtZc{KuC11^E>f*+z4vYf6)m&E~yuom9S1PaZWaMFuA9k`=nEA9P1dnFJvJ8x5Txb@{YZ#&3T&}V@gos zTk}`HoW+vLc>IcT#KXjf3({mm+S;<(6fy+GlBwe6VT*NKiWRrrPFX4$c;z#~O;HQ3 zm8Cw`j&$au9PmbZ>69F-s_nRtD;F|RW^R=1_xSX=purLUiJI6AL}hg(aY3k0T+#vk zUE%P!r7;@!3~9mSGh^TjIJ?{R(0=dI>=Y~oRO;^5_LJJjRX9yvJE-!LTbqt<_OJ51 zzesEA)qSGziH|R}>z@BeR7v>BBFGK_Tb)ZeWk9aE;!*@WW_lZsnVsS>lq=o}SR!%i z_yg0$v+y)aVc#~e>E9{hQZm&65KD7S_^F$Z)MLGnCdqX^MU{~$gg5eIrtgax(TsZ@ zQglbWd}EdV21qhx)R;VTXFz4wyT7sWC(_D`-x@pHmNh+ZGBn`onCMy3E*sUN1IwU{ z%lqH4i_7x@Lln=QOFb}>p^N$T!S8?n`zgckg`%(0KEz%6>Hd#2F02^3X%to~_Mvuc z4vOl7J0=F69g<*8OmBCGdZi8=SB~vJge51T}k3rBtV?i~@*ntCXDlm^JEqzahV z<4!*Vm;p%?Gjkh%SOlJ0kVZvfhMdsQJjp{N-$SxA$|fu1J9r+tG^!(fxREVD?ry4$ zm`@xI>!{05BM=KZXx4=J8+FsEdcgSVK9X?Zjszl=oLB_kaoyIvzu_(#S@R zg|LJ)=^)VqJ2NbP*>R+K;E8BrJX|{E39hakX^W1RKzi{Rjy26>-Zn_|TzjdN8-@EY z2MS=FrY{f_*RmNvXR=k_jXlk(s}Asvx6jn5>O_jKDC>kkJ9B({6SO*fv7L354X2#k znW=lKQhrW<<&!yR*VQIR%J)NvcT=1T+-%FHPsC=c+eX#?Ue|WO2A%;Oq73tLOCE9$ zrtUAv5tJXdIoZy?Q*^0fzg$&V`T%-O_0fq7Dn&Yu0`EGj%KWF6304&eoM#C!9FrVs znl@kr>o$YjT7hwGFc%xH&a!8=GYwu=-FTx_5wvg+-5=`*GDN{Y-aqz&sEn-fDG<6N zIGNSa5*M@J4@O2tu`4xYleQ)ut@_FPM@GvRsE7P6mYD)j3EV#KhEitCHrlZxaw?Og zYjrxI8DT3Ze35@}qAGwaI$~Bqe1=FYzmm~3m{-hy=&*%}cpLxTn%a?ELHhMQ!3t6v z;eIq<+s2i&asrZ&co2mcEZ*rRtN1TB^&R}aE@#xD*+KD`y3NS6B|XD(Z3riyN=PS3 zE)zRf8WMs~gy;=Z^bn@bLZ9VJLB?7#k z^sws|nGRy*3Gk#GpN#|c`)BqBZD^ViQ`&kL<|6gQsaMJ!;1T^gVUCOS!84NMkc%fMc{%{wy(BE1M?uWgF_WU2| z_PnW^ZB;iP0ShoF^*mu8y7B6}4>W7Eqix1T|8(QdRONkcp_ztAh+d^}Y3nOC?is13 zB3RvK<)}~}wQf=3pmMDJ_u<%~1X0b1VU-*FB$bP?^SCl|K&3MxV}U9Ud`II*Bo%l) z=-~8f3O+u%fT4<;PqXr~oo(YFJBISM{n0VI0gcjS&EVcp4U`%<8UgAM1v_yTkPCHF z`we4Qi4D{zg6m>Di%)uxd!yys`dIB|E&igx$+}14?McNb91JrJpj_0Dr-IDFV|NWX z4iaRx&=xfIWVKqNC@L(6ROZIdsDoy@EyYOs!8{{q zgm!9|;m3PjBekjKSInkQ5$K40)#VOxH&xpNwo{w;ewzxV^MbJe$WYGCpoKIlIY${I z@lmbi_S^I#PWdQ=d-=r6N-5Ljqu*eN{o@6*kJAwenAKrqG=kSV1LoF}=!dKm)C~&b zWGc$z?Q<}&UI=Owe*AhWkm}Pou_u{cUl2KPWP+LVCti1V~AWS;di~jR|tLS!5`8g;XK^-vTZjSB<%_Y zJw}Argt(WSwnoB!7=Na2gH2fNE5@<=6r&g8DuQ0qMvSgk>xaOq%#rQEzN)L^j~;i0 z;h>wt%;w?A6Y-I!jp7_~QC*$J=6hHa69Z|5c|qFIEZ)XiJAG?&l2)L!+2yt~MPMSR zsINS2<5a-AS=_OjVg(;@?&cH&ms4WQSz8-N8=}U|S;K=xRwkH~;pZ2mR|@huYDT?tvGWZ`(e`N_VVJSjNNDq~hT zBBS_38WFZrl8K_n*me;Pu_u=&G@6n0^-N^`HTtofItDZUntuz4+&`i?RGZ)PmDt%2 zZjqjDrETPOPcwWu=GCjYB2czLr}TGkxbPrede-A2VJYYS zY*^WQlM3?*+K?@W;~2C_!4n$YC|M}94)BRz(|d8=M)&*(y)SVjPIz!Qwr_6SWq%N< zZ#7<;uh?TiQMnUbD9mmby`&r7pfZQyebt=Gp@K|kCX19(Kd(50m^C2wXYNcRzNDDi z@lsptccXC$(9q^- zFPKBEtL-^7kZF9vHS0bQKFf~BH~i<9**mq`*%xI%;V{_>UsBO9a3i7^os*MuMLQe2 z(SETkL-$5Vg-88&9b-I1;PEd>qu^ZY+IaQu+*N2E2#Gj)G>2LDwU3!Q(wubvNG+pB zIZj6Fyt!?reE#DutISO?3L7s>EAG+u-&~zqo@(qh1jN04wWoZzj1XP?wa&$|`qN>E z&?_?DR{@k|d;0sE$P%UaUJ?GB%`x6`!Npn)iYdi7QBJUBDIo5~ z{2L2x%Ur9Q8Rp&9zZ{88X;;)iyQ~8$8B5!N^#7bZ>p=B%|0wg?d6g5a?tx&J1joO9 zxd?vv@k{V>$Kk)e-0^=ygrgR)|G>PU&mv_C=TGU|ap$~i{@m61gUPbB@oyim$gcn5 zgO>x=f3ai7Uot5ZiNA>O7ZE;dhQB1?FG=`I5H z=f9{PQuJfsaH&mmXmh?mAQ;EAwziJSN^Lk*HUUqDz;8MZWn%heO+Pgd22uC>0K@pJ2L%7gin?0Gig+4(x2XX`w%>%HPb=`TK=4T%E5E!;sOB(u+WtbK1F+1xb|O;0gvvph?$mnbj{ zHsQ4qw@v*pa7?G4ij}dliLRuY5;q@fbYmC!X~22L|K~ww%{@IV!ZR^1L@Z$0k6*+i z05fEW#0XEUkZ&^`aqW1xY>>(22`@U3{fpFXY7M_fizLhDS8rIN|I-iZ=+HKo>4Bel z{qic;{zBkJ$cgDVv`Xo@G=o2h5cADJ6~I@nhyoV!Cebp1avd7J)9>|@KpZ=J_k2ZJevM zE%$=|9OjPa4Pi@5duyy{fgjLyL)|5j0~iVaRxupn%Ejtz@`?+ z{fsI*3U*z?@q4_#7gULsBhv$>2@lh;y?4<=igGZ&ai%MD{+gjiaJ%#ze{<*lJ>Np! z=90NZyr#M$BYsQ5yiV{!aGX`4`9tEm8scpdj$>)5%dJMn!-A73_ciBPVLpZ|T!mpt zPCz|sTovQr&+_6S&NU8gTFR;qs%8ODTg3phS{fOknU1WC?GK$v(3?j_T@|!X&15XR zBLGq1>BLep`S1Ab^k&0SGYPguOfip)(Z|PLSM_K@Pe>w;f!_)nXa%B(_U!qY zSunI#u|lFb;T?lOh#L1k>`2bm?=ZUh(P9cwecaXx!2)e$rI1I_L4UHyqPWpB(~48k z*g*fW#Hg~2$<3Z#wGw~4=Pi`|S_*`fF1u+@I2Y(O@ClC(x#`pd*acNsNP&N+;cRz> zU0<$qJpF_p$S7E~#U7@=$R8wuMDFEdvzfqb4?aaJdEt(ly>3foS!+z9o~BQmuFo&) zo{_xR_IIZpG8EB8Su+TzO@we!qjFQqD&#b>f~D^%epnaQv5!+eVD^@>7iuu~BZti1 z`bxGw#0BlYXi0l#;np556!A_8Sqb*?KZbvL^&d7@G8E$vnqE2-|4Q}u3-+To&f3ks zVK<&ng&wju+WaQ9=l(9^3-!P3O8w=+*N473a{2NPx=)6K)>!GU?h;h4?tZ1jg^ss| zSqTdpNxao~{V?3Pq_AkF4$)c~$Ssm1#I@=&+gn}m(f~x~#5#^vmaYJPLv9DfUcYdl zDEI4g(qg|-==juP$^qQ<^ccNSq@n18E_&U&{dKQDn_Rk5L*=J>Cu}@6XWlgVT9miqM#KUBTNMZ#yPcr+2iv8ggy`DEIPRNwvl6ZabhiD{Gd#npaU+C-S4 zbvStAo7cNz^9o!heB#aT9n4|f)^~Uc^Db5qM(a<;qb)SIP%3^2dQ!7ntisK?L6~1j zR9IdyBhBI&@%fJhX+9%QRpl?#zcmf_LI^&7(c4E?-f!)QoUB9mtd^|ocG5|K;{Nc) z_bo!&^K)hcRUEpwlRx;J3|x3D3LD;Ili^|t)ZMdD6~8o#*h*QAf-QTo_SeD|=ll{t zmOM{Qif3n$jWe}xNKte;E?xR!GuQ2Y;iD5ma(+RYWZH>PY{VQ&Y2{)0{izte&D`QJ zh*v0xU>}vR2EBdJ#<|ztjA&t-_jh~^Z+&Ghvyp{HYlUIFE8|;cTO3^@UHaNXFtn$= z(xNzpg|D1WIgtE1;{rN2=k&}2p0Y4+VFkxx`&OV!n8?u<0Fn;KyFF|+?7x@y@pUb4 zu{H@^WGZfCget)*L{_QxVjD`U0q;^5wI}023dqxSE-e;rHt0)tVZY{+{VY)Qo zH)?l-`)qT&#ny&sVQm-bQvF+C8+x-q1esGJdh7ya zL>?d>^VmTL>siP9f<5RSl*O&@BUfHnaRlwt%{A>aHM{UTl4B*!_D`v_#@|3*hTu;gj*fETt{!~ z+w*)J2tJB(eJi!Lq&&05yT{tQo>*(h+@DEu!GO`=3co1c&u0sAzps{IoxAgTNt0VEuNC>aw`NF zjZ`UK+*1l4XW-b^(+!$diha_o%ru$9bwn{nu2Y*g=>5GpZn7My-@ZDR^m_OHFjP1) z3YO*__UfKs0D2;Nz9@1GFFDH-ZAEr*R*NbEShHb7q$TWO&2UI_&1fjU^I)gGn!Qrd z!}MuO%VO8o-_N-;cA5wMkPhRGJQ8m4G!*IU(C#E+IJyLb`#r6H-DdbZKb4QwDKBng zGsev^J_Yy#c^<>#(H)4Xir!yXzh6qwneYL@>P?WMHx!(I&o4*z0x6+88#$6usD>V3 z+$;X^^H;Au1H?=@qDJsqVGiMTw`0w-b?=Pvjx++(Ez9wvV@6OBWH3;1Ei=jgq>Qi7 zjlA>~3i6yT#*=0bHSOvlRZ{d7S{ELjGsOshPXh91-vey(RaG}94adGfB6Nmja{V?T zb*$01ao4#^r#f>Qk+2_&<1w(k!Ft36GDQ3=Bj=zz$ZDpp_1 z5CG=(T+#$h%6xlmc@N^^38K(s zURgj;q~&Yjozg-E3?+NzxS`P#_p zFiS_no|W2ZI>VdQwp0Vhswz#~!B#2y5sjpI&cmZ&lri>ZR*0>rru70Z102*2)Ei-( zUVqU*cqs}X9Z@s=Ipf3Xa-KzObU(ez!uDn{Gri5i?HCTyA&lsQ9|j>#clDyuqR>8A zhvYIn+NGsDAIOUL@W!-Qelh9%>%WCDg_N7rgdc;G($@%}3psUGmz?|X(M+l)${0?6 z6lu_rrZE{s@6?z%GUgvWUJM_pmOk<3&TYYxFCD#pK0Vl{O2^C&uQ#n*CXH=)Z!v^Q z7>s`YU6_`_bQ$;JL$$ta&zA68=s$Pej~>G4J#xd}?UAm@PgUD47cB4Z&Qmhk5UqAl zf|lDQclqmq^7QO(OYj^KOL7{$a!CFu*ikAFD0Z# zhG+QN-Zl~j*Fq~gaaa3x;uaU|N9w)`G+6-B?Bg{fbqy=U)qu7!2D#Z(6xt7o+DvK3 z_MJ`|F9;+__MiMk@qrPz%SArReiMzDVB&&_zpz>bI`Q=9GOh79_GTNpuv&iAcU-bI zDP-fR6rE~J{rRqQ-`m#z-rMLNMjCvXHVySuA;V0iGCFD)}t#m?NEK>YO#0p+{6mmk1H#ChNPu8gpg7jx=v5X zl7d%?fAR**7Y#nMzI3(n0XH5c_GC;TkK8@-^lbyYwWjUzCTJ~-Y$AHsE*Lzo^uk8C z`;(4%mM`#}^}ez7FiC%TydIH$i=I|ied@{;$HA~n1+l(Y0QJP?&}&vBa$fQjx>1sp zUXaJe1{xyY(D#i)YtsoukYn6 z@`Pqit?6_1Bv+qCDj!Q@)??{$*5SBZn?5jy{MIj6I6Jf0w1=uS;{}L?l^dkL{P9o| zb2%<(TG{_1(AiJ*@#zzFL+3Tsvh-ke89Avw3(>={haK#WW`&>RwCSmR;a$KQO0jG! z5QR?;e%e57cdORFi*AKI+#vH6l}thc*2G=!r<$B8C4zVNgzOT4Fo^M^ygvHTe!`Cv z$Jm(?4LvDt?aeXBRG(c@^PFuJ0%@mz=3_68UsN^SQWXRT58hEldwh`#bIH$M|JJ1& zQ>N8=?3S$%=L(Z&>8-BHH+*?dHMHHY#=t{d)Fw3UgIdFK1;R_B=p5L)<^g|tTK_P0K-rn0sGD~N zalIcBdp&z_?yWD@%Z+74bVt=MV1XU6I?8X)J*>e~Ug3f!OJw6XKh@^O$mmG=;DuX|=LK)Rj>U{0 zrzq^(clbf%V)tG(vu6=GHTaz)4WQQoIAM!M?EvwfiG=cMxMN`h+ z-$@8@oXvY2>86oa+!m?g6TPaR%*vC~`Ce@}f}+RC#FMkkG|5G_aw5+u3DO5 zQVrEzZ9GacNQX?#lg#KCYm8qDy`(aeLtGthS$QyPE>5##GgK@RE^xQw@3trULzgk` z<&XOSja=+>ma)C4caAKL0BE`>_R@zRN?nFWYesUWN`(!S(6(41jh(DE*c~6I6@o;* z)`3>P_{Z3#8y&ta%&FfOa^J@RbI#Mg<%Ap_CqN2N_d&(tUjOE5d0khTWvsLbv2o@h zW`YyDYt%1KEzj^J#PBezPE~RLqxX@)vss!(F&j10n=(<91r+#&OagRE&Q`BYu|!^+ z*Dk`G8px%~+|ZL9^*8S(l0vQU-k#;cR?09!a_R8?a87p8{j%t?I*&*Kg;SstIq+s8 zVsLLkQ)HpxpA&ten(sUJ4_So)K#NXDWue)3RM5v2J6-+olN*Ir@#~oA?rN~Dr*O5+ z7Ip+U6tD!D3V&%@=9Yi@1o)z7YtTd@-ecI1KMMx;B(f47Fr2F35OS@f4I#cnpTJV} zWPgi?G1S1_1v2SxnF$%uD17&wP_-3oLvZerW`;P*k)A>K7r(-&#rzDp$(fSevtTua zL2lN6G@%F3YPwZB52MF!BRmHCi!|4=RS;2r<%*dPTmfvI!dN*KUx0 zKoZ-DC+rT+LZJ)c8e7)-=G{*3;EDxVFi0IpsY@h26C} z40-iPL3S{hddZ@>$vgO7mv(y?$?R4<{n?L5(n8sN?N0JIaG`e!e=d*-d3pwbg0uQQ z*%qp9>57~ zO^(jw2=7`i)Pz~nWLu_4j0dc$L9Y^jIdbs95uZla-as@?;*m;6y=vEzUwHj0GZc&G z&L3)ER@t-B+W}*rm+v!FP^!-llvdi7E%LD!7NldKm+Mu8b1v>9ZL&~kjgXQ0u+9wi zyi8tsXC^Lo!%3zB-l2-~hfp6C1izI;_U#o?AI)*@LwDIH~&1zf$T<~*B;(`U}O(IA^b$%tvJdD(79xS`DUfLSs z_w$2B&EPlBk%8>*BBcfj)AT-YnvdXtViM3?@X;5y=qRpOTc$>!rG1qd!*0Lz^ zZu)DhyQ>lNRQ`yK^`fJuM!3Z$aePMawri*zX@0^7WviBdDS9@vfK{w#iF{xItd?oY zT;T^J4V|kgstIt_DT(z|&4hLc?%wC{xNV9)sSN%7ZerIJZxK+vBUc=wYD_aHC(~sd7%dEh?)`c_7V zs>6!Yr}pbPzhfmQm-p_=50Jha6##U)ANZP!$?$<+3=VQ-vZ3fxJtPPc(##f~;!G0H z%qJ-~@*rmVn_IGjr$wx{P5~3^=U@?mPJkb&KK`e+f7@idtW>9B20WRbhC5xcdWp9n z>GlXrgd5%-J!dYQvE8rS)OYbyAJWEuXLN{zCXJa-eL%V=S1xhG6Re8zppY9c$$p4fH>E7M(d zOjau<%jrNR(Z<}d;V^!{eVJ7v`dz1K_9PN_?P}{NN7MThad1@2pPl}Y*f-vRC0sV^ zXu7`tZ~q$po!y}gI>!=zzrHxDw1E|}6SWK$JD;A59vb4&lhz{_ijrnc{ccPFeI~>g zHm8u7W6yg{JuqOt`g*IeADCpdHEarnY<1w)(}bM2eS7naxkZCMOSyr}w)qQtXtZ~G zf_m;f<};`f1NP^N`|oL$!LiGeCIA@XgyouuxtnXBnx?Fhd%T3#Utn;6;74pbjRk;? zJ68~M@mQ$q+6$N@m>}cnd}je`Lv|)R*m+iXEaoSCp#)=T>)FPgIWg1ZQS4DvXTG-C z+rZm@0?g2p_5tL@mh+m~zMrMD zPr8^akCzkK-TH^imWN^sKnk$ zsCZ{rd0OikAq#%F7^6Mja>TQR6sn`ApL1H1rT0z5#f(j_qMXNOEVP`Ya@W5e`eg47 zw$8B~#(`i>N(O)@u=TB~o2si@Dl&?|pZerK&=zA0hRI%CqX~X)(FM_W${zbf@t!wU? zsO$Am4o%iTxJLYm@W225ovbJGW@N@Re#f9&f*u_ij1~!S9t86F?g6ibhU2IJjPFnm z;`={`m2jcv){c)Mhg<0tSZa1+p~kvZ|&?m z06&+!kYB(eP1-mcF%!)-ggS03`DrR`K?TgXzBq`)wPof;QO)Q8zWUGmjqU$E%RTQw zkN%(E${J$8zO41W zz`tJm2kn0NZ$spd8ZNpD%5DEr)cMb4hRLUCpo^-iss{5-G+kUcvab$Hi>|H@>dS1vt#5KI<051a8>ycUP4(IL z2aV8&j(mQTj;o7{3s7>~)zv3fV>oovxY+cNEU zOLk|-Y`cd)>JMY{C4F0U~SH`#{JPrQQs20-+#HF7HnUMNy_(K0kla;@T$_fe# zkg?7ZqrmGCXM_V*ZXLQL4tvR;|1FYUh6^8LD1lkKaIgjPh0o3IK96i`BmdUi)eCDD zfj^9|#a|(I`p1;RzpsEeMs04ipNV!yST4OR1d|3y?F~Jl#;aG{q_jV- zu9*qyoqZJ2Yl=`KoFj1Mho0FaoBk<_vb5pox9U6humB?ZF=V{`(bt{ zk>ML=A)k8I;v+l5N!hc(k7%`wGlXO_szFJ$E>k1k{TE1{jC zK@n|>j|&^Pa;e^5m>e(Z*5~~dFGaw1`x&aMDTK{>A{SGWQTGliRBvI9wQia+@6>#Az7?OM$63D z_`7SVdc$q3mm*O^GUuWS?+i1k?c&PX3kT|I!XOvA*0Ivy4^l;3=#Mjx-AFaRN~rxb zGY|hZ9V6U}je^?MCJzW>>^mFwW+P^_nA7i$9457Er7tWMVf#ZVu;4LOP`~q7864>p zmu{j!rqhH)S<2{QUr$aSb!>LVMxI#NSgwg^WQiEZ3ibf2aIB}j25X%wpq_`Ul54!@ zH<0)(df^p3=%k{W+4p{4!LM+#9cw`Wsom`m*@VKVwP8qQitt#jv(!9F z5*dEkh&@Sl&=Tv_PJkF(kEO=tikxd7emXC)WIo zl$G`l8oc=nxR)INqaYmq;W~Q0Teg(s`!85~=V@x{ZUI60vYPJ4aACW1#tcuKOQ(Y3 zCDA|2be${gCeC?tMuHp;?OCuZ^5o58$d+zW3bK&4;9gN~lTW z?`D)uhK>lPMu`L0!NI-{lJu2gIKSG(``eXwoIaV^BS+{!p0Vl`v)fE`bPt;nVlh@I zYtpo_jgt%z1c4;1>G?omTWM6*@m$TyC7YUOpjACE+9l*0+#%QUJ zu_&mW@-JG6X7Ai&$eXP`On>HB+?0rOpMHN{s9x#e@_w|0NO~jF89m8r{mPLk{ncH_ zOch$PVbAQXSf&@p?b!!^oM>etL!ByGD}yd_^H1kmTni{xh4>NcOiLhwAA)MVBZFfeJ`U@LrZ1uy+c!dsYOJE&YsOYik7hIb;pg39A%H?(_$ z7uCSrq_(m!fNMvt(fh|_fzyyKe@z(yP*E^1`+eoN1LVb35q1(dgODz4U)^=EmtJth zWDoHu9I=_}$J16;$(m6^7)Q1PwdadpoYagQF|mo3dRWU`+`;29?n{{^@~mui=qGP{ z%wyK|aUx^nL>({ARQ8vCcQ+!m;f@2^dwS435k>>^pX%lNa4Qd zHzTv|pZn*oyVhMdE3g*feNRr=@7`xW&pvyznp04^Q8F6akz;(ZfTRi{#_pHfXxb9*WIdrA{`5=Uv?YGbNOPP@0|*Q-jADnB3%aw z^Qf2#1f;{xD5{ugymzs$qTjM^vBC*tC?j#1T&=1uoQ2l?WYG6N&La$F<3 zI6(+bI zG2sULaoF(CIQB-F>D~%Gp9ZXL=RLlP?$xOE)WRdz{TSAQ>+~fR3zYdXycDjrKiMM; zn(hu?UnPdN3G^T=xjs%UZYMOa*Wr`4}TlF1%S3+v-i~IT>DY_}U3f zyBz6R8L_3u+Au{hBX zQ06;ZPCGC7#L>aL^Pn7GLPETQ&X~5o+VR9QcWua_S|Re*xsKp#w=A?rLgs6$e@@q8 zNx~kbaOMUc8n!xM!C=2#L0=vwiL}bj-3RwBju!HTTWIa@(Y?(ej+W%~QnRe{Aw3|( zWkrS5(V#tgv2jzX>#40R%(xDB$0wBkbXXXt{!Y{kxb0HM9Eznq~pG_D_4DV-{PDy13h*S3)L z(87$|5rf!FkJT1BFJ; z<0=h5@`JaOMNXYw(oNsGtRv^omMSspM)S;p@=P5^El>^S`$-6h!zl|RxjW{enb!gB zZ?#UXGWgex%9GxNOWiS2`{2G6Ren!T`6w7==_!QuRgZ`nWFAm%y9d6~@<1F@-fWVk zRPrk3$GBzp6#nGxigo69m*$NUP~h7wCsj`4eLs&nnN=F^cjF-HBg?^6N*YZOElE5vQx zzOB7T-L&Jm8{%)#eUjXzI@XE%fZm@rd)S<-h=Z&k{vAa%Q1{YQHqG}*I>qqfk%|VP ziTXI0co-m{8Ofqr(AE^Y)l8~$R7Q9yiL6rO%yJKFt7(+MU;Q%N4b#Aw`*AjiT01f@ z&*`DEIZDQ7k@K6i8Jf4;KsgN?P1~wr>MJEChWw-l8)w@&lpFNWZ_RQ#*L)amCKryMO!d3(y$!yd54_sz42%dP>1S$f8BU;8$7zsZ=@sbiXOIPqt$ zqsm}irRn4Hrj}6tqS{tZ5ZNu;F5;E5g(oRUhxw$rQEw}wK7dkt`lmkDn`X+Muje+Y zF>9mUoTJ8tyThB=UgIt4yduOi#gfXI4do*)kTgR9X4L{Pni_@) zj{nxXzvFe{UMyD+3U%NA5}3Py0)b)A_d}G(QwdtK>Y^SGxWGik1L=XVmcuw{J{wye0RJYcn|*zKk2~y6qFW<#QFI8MYuwWKLDLmk zW{vV$$mRLC)rcVshE#iq&2OvUWP>Ql~kFMtlAd_o$k9@mI&E!@+J?__nw*FQ z>|%}0>#=u@H`7ZAP)4uFP932F#DUB4wp@6)V_i4lwY5o{ht{Zjq-9>H{;VVpzKjAERl(nw4F0?~8`X?x=)sBrI zJFZXdVX|4pthN-uyeOrwJJ(p!-NO5C&5mY3o@)RRwX_vvbVPzl^vXCcI&_Aw>p#Qy zP0*Sr1cef2S1t$UrYJ2N80$zW8yi`ib)3au7U}sBc*dr2&w*y7GXB8vw9X`tXAsC; zlM&sDm;+tkVm6D?s+d6sJ3^4ssZH&)RA~)rMq>lMW+4M2D`4di5M%6=eeI58sNS!I{%1ITf}Z|jxmu)uBaUQ z;pdIC`K@!j{kkgn&=2P^grsI@;nHm6G(UQihJ|(vF(AJ#;{>Zf*u>M?QA@SJu}AUs zv$acCbXOlCr+XhqoXPBP16WOU#K+$k`eCV~^>;=#8pfQ@9aXy& z%AoN{cUY{E;w@CJp2k1UUrgJMth2VIXU~(U`2{4~rLFd3)Qmg%u_zyI}fO^u_K;qQPQlls}9ZdAiO{tgROcKyZIg2|m_~>OijD^vA31WQ5f4=}Hv72wf)MUlkAxJvBe{Kh4 zQSJ8M8PDkE40Y8Juq;66L;$_k&x0!o#EJ+nA8@I}MLwj4`Dr^}j@>Kad54DJiSEw! zmDF_q*{hFX0FU8c`v`lQMVlArV7J)U0O$Nl2#jIr&KW$Q-8s=7Yn-s~K~qhp=8D8U z@~$tONZO~`vhR-NeBnj9U%sr_anMLYB1`Ve^}tvDuW~4#k!}EcKaT&4i!)021bR2U z18N79mX&EnE)jO(>YvC709Wto@+&F*?k`Fw@7CwLKDyKeCQEDj?Z71Aq)${2yv4!M zvB;s!F`75dlfnOmXBe4(zVjQG*Zycf;@JznU9aK7)$*QP{i+(PKUGBDZ`%kfFkdSp z{=F|R1Ck6R2r2K$*3kfpA8?osS`p5FuHVJ$pYi=40Xj6GzbG74@Tum+Md;ZAQjFogkz~Mq! zd~acW{i8>(KCqWe4qrXqYw|47YjR(}?+Pccoi4E~r15BPIp*=trjJ_A{FvI#!a7!z zhLdOlA!!6W=)uD4ygT~7mrBadHA@WmzhxW);0HXuMMAVpZWtEV9n-AJSH1K>5=6v}h`Jp)2x>OCm9> zx!`y|uD91Ru&xGBKd@4(5tUR+YoLh>k)c*GFr7k>ZC19@Rx8``y}?pI1Y8GY+Qk^3 z`&^Fka~G-~A1Qu&uN_FRv|maJ-1cPF&b`YBDC1ta|G}=H+3#*W@gMgw%XoT zoc2g2oED9L8NS52D&G2|XH=A;tgNh^dz(=q7OSA3ke{Mg6iwAPIJCUe5Q0ZSzLo@9 zV?YB+yN8Q`it6@dgBG&=21~N&-~Ki(?84FeaWRc((-#>xIuqvbH*jv2FRoo}1Yw@9 z_Ds>dYw0^Dk&Jcy=HTA=2ZIB}zW^)n;#$V@8sIA53;*@19X-D{{`miZn0qE&c!o3p zhohU-)t$r>1vA%7y47yOwssPIXbzz3RVXfuW|;C?$CeL?IQ_aOYXu= zK3IbLFm667oc`B)qVpvM>8OGb|3S0WBC9wmS1g*8JZGckz2iV>ZjC%vl<$tcA$M^uh!qx$DEvdCk#g zO@>3y%bM!XB^;JXACPzE-URVm#69{&3R`Siv}=+R9>!TEuQ5j*>eif6yp(m>{~97} zjbp=x%bD)ClVIrH!E8>vM^a%(td)5Esb*v;q@q}(L47PogL)1{4=yc6DWUm%))K}{ z|MA#sxejA=f36Cv&WA6_>vq=(?l|Rikd?lRtJoRKvC{A^;MK_L{XurTLT#z>*$xdZ%-LIi(lm$&rQ3l$X^$C}|T zV#*kgELN-c{~~1)5sj0}klM&g3oB66^xHB@akF?}^GW4WH_WIPgOoYL+&DA_osG_o zUcSTFZ)o2sNkXbp4D84HY7LP>lviooAe8|1d5~O+^B%djCne{$@KD(*uWE_Z*F2n| z;`o#?^XY!sXijpWP%v&5-9Iu9->Uu7WiurtW@`{wMMjjN0q4_6}Cs7ZZmvCM2%?{!XLyEg0jvGg0R zPQ-ZmInw1VNSGPsfQmdZh+c1$PIa)RV6B{Eg2U3}TuEQm#SE?c;Hz7*#^gIKSX^e& z)A$@=@gi<5XI&KmI%)hi{9Lh^J6fKZclyg5-2;yrVOv|UAWem398MoY@cu!GAb8=n zg3fe?`h#OBa$gf4zl9F^YF+>{wJQ>>ZFB?OL6NJTP4L!-1R%@4g=I9qGb9rq92Ux_ z73JWgMh_|+m}cVJE`&sc*+jQYB@r}^xqrZf3sTv2%^uI*yE+beK!e#!9>!^QGzx|% z9?!>dk@740K~&xordW%s7*AMRNz7eB{4vj(Ue|Qd49a%jm3G1ym9GIx=h1ah5OH}{ z*s=76dCfPKsP4X;?8>MJbe(l`R~A=yF{g=o*V;oYxSpGdW7s2J>&T0TJ%@^(?Gux~ z(&gavo1|=Caf3TN5MGzKamBtPblErIPfoQvaS|Eh(cD5aezpdrgF@Ga6)%6TbN6Yk zJ{o&rMkam;AnO}xDuQ7$A3u&S zN9Li>YVO&`>U=v1rjAJDC6%^%dB{xV3+k{3`DB$p@uivyo2R}^ek$VTY%rZ&TlXZ* z8x$yj4azbO7|RfITO)LbL8s=C`eJyuegn<~RWRIJ?>_A5W|ek=j#7-iP5k()$Oh59 zu=x8PiyNR1St&;k*UmNtIzq7fTCy0s_%=wx$F{j*eV~{plw2orcCKQP>AH|0pb2FT zXfVzDal8=9{}?f~!*nm~74#eg@B{y)jxqJQj!Z)YZX&ypPpu8C#Jx18xbYJm9s81CaIUDA3gz5JdC}lqJr#&$xAS^p zbMjB2jTNg3ymprqAJyi?N~L|6p~YIew&wL^`B&DrE0x=us(l|!Ejr)5b}~9jkl%dM z!2+eK8`HLoV|vCCpsE(CRZvA1cvnlx%h?^P7M(#c-(qck|TDXQs;O9@ujls(UlOs1yl&62jp2xk^Hw zmXg|Vj;*2F_8Qs$A}6+iYVZEWhI~$mCj88GEslCBPopsMgU?=Xh2_X zf6esmuSX6f$bxK8@JMI!G_A`hkFip(n(Ne2BzVY~)dyA<)XJZL%mrlAQ96XY#)*Y2 ztyGIL2t0HiC+3ktU`LIcGYZm{sYd4lC_BKWjQxUNK6+l{(dp^E-;y0_=h$d?eleQW zM9@k&+}^)C%A2lCq7pxkN0`Q254-PhlnF5#Lq=tADaL(Uj!{;^FU`K9Se9Z>yAC)*DZg3npn zKTE@KxTT%@yUOdGkz285M%)!31fVe^{e-h633hzaTGCCiYJ12IAT7LB$(_RAsoGJ=E2G_Os_j-6g` zi;S&Zo4oJFoqft5VresVB~!yT?oZuMPKdSZtdc8XbzuFNoMN(NU#6x9JsSeQbCHD> zU9-`Tb^#fw;HK6ms4M+0Ai>a(>gL?f^1@|;DUdKl*p#f=81(~EkRBAqZ(*Fc^D*ik zgNAX$u2ut7A;B|39fs7h(va)e5_Z?|`-bW}-zn5lYu={4FE) z%s;S2EJzxOBxSt%Q)MG$vaId|4PD6D!{)Zn>8?41INP7OI$R0#r*i8?SQD2>bBlm! zQO32KP>7o6Csu{b9IjHo(&D!Z2+K@PpNJ#s-h>hlAaH>r{;^>mr+6WmDV4MF!ih;{ z4!<_Q6?Ov7rn))OpIKF&Af-C(pYBq`9!ulgf6VfkeUU0m>Q2B;#U8b# Date: Thu, 13 Feb 2025 13:36:38 +0530 Subject: [PATCH 06/11] Feedback comments --- .../platform-supported-content/modules/oidc.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md index 81f7f2aff07..0607f218efa 100644 --- a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md +++ b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md @@ -486,12 +486,12 @@ When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module cons Initially, your app will not have any end-users. You can onboard end-users into your app using one of the following mechanisms: -1. Manual user creation: an admin user can manually create users in your app. The Administration helps you implement this mechanism. +1. Manual user creation: an admin user can manually create users in your app. The [Administration](/appstore/modules/administration/) module helps you implement this mechanism. 2. SCIM Protocol: use the SCIM protocol to let your IdP create and/or deactivate end-users. The SCIM module helps you implement the mechanism. For more information, see [SCIM](/appstore/modules/scim/). 3. Just-in-Time (JIT) User Provisioning: in the JIT user provisioning, users will be created when they successfully log in via SSO. Both SAML and OIDC SSO support this mechanism. If you do not want JIT user provisioning, it is possible to disable it as described in the section [Runtime Configuration of End-user Onboarding](#custom-provisioning-rt) below. 4. Proprietary user provisioning: The Mendix Low-Code platform offers the flexibility to develop a customized user provisioning mechanism. -The OIDC SSO module supports two methods for configuration of user provisioning: +The OIDC SSO module supports two methods for configuration of JIT user provisioning: 1. Deploy-time configuration: this approach allows fully automated configurations in your CI/CD pipeline. Mendix recommends this approach for customers with an ever-growing portfolio of Mendix applications. 2. Runtime configuration: this approach may be preferable if you are not yet familiar with configuring various settings correctly. Additionally, this method is essential when connecting multiple IdPs to a single application. @@ -541,15 +541,15 @@ Optionally, you can change the default **IdP Attribute** or the **Configured Ent If you want to use your custom user entity which is a specialization of the `System.User` entity to store user information, select it in the **Custom user Entity (extension of System.User)** field by replacing the `Administration.Account` entity. -You can set up custom user provisioning as follows: +You can set up custom JIT user provisioning as follows: 1. Set up the following fields: * **Custom user Entity (extension of System.User)** – the Mendix entity where you will store and look up the user account. If you are using the [Administration module](https://marketplace.mendix.com/link/component/23513), this would be `Administration.Account`. * **The attribute where the user principal is stored** – unique identifier associated with an authenticated user. - * **Allow the module to create users** – this enables the module to create users based on configurations of user provisioning and attribute mapping. When disabled, it will still update existing users. However, for new users, it will display an exception message stating that the login action was successful but no user has been configured. + * **Allow the module to create users** – this enables the module to create users based on configurations of JIT user provisioning and attribute mapping. When disabled, it will still update existing users. However, for new users, it will display an exception message stating that the login action was successful but no user has been configured. * By default, the value is set to ***Yes***. - * **User role** (optional) – the role which will be assigned to newly created users. This is optional and will be applied to all IdPs. You can select any default user role or keep the field empty. If you need additional user roles, use Access Token Parsing microflow to assign multiple roles. + * **User role** (optional) – the role which will be assigned to newly created users. This is optional and will be applied to all IdPs. You can select any user role as a default or keep the field empty. If you need additional user roles, use Access Token Parsing microflow to assign multiple roles. * By default, the value is set to ***User***. * **User Type** – this allows you to configure end-users of your application as internal or external. It is created upon the creation of the user and updated each time the user logs in. * By default, the value is set to ***Internal***. From 159cafb84366618bf0f8719d671f19d92d73472f Mon Sep 17 00:00:00 2001 From: Karuna-Mendix Date: Thu, 13 Feb 2025 17:24:17 +0530 Subject: [PATCH 07/11] Moving the common User Provisioning fields under 'Runtime Configuration of End-user Onboarding' section. --- .../modules/oidc.md | 34 ++++++++++++++++--- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md index 0607f218efa..821c305d276 100644 --- a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md +++ b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md @@ -521,15 +521,43 @@ You can set up custom user provisioning by setting the following constants. You #### Runtime Configuration of End-user Onboarding{#custom-provisioning-rt} +By default, users are provisioned by [Default User Provisioning Configuration](#default). Optionally, you can customize user provisioning by [Modifying Default Attribute Mapping](#modify-default), [User Provisioning Using Your Custom User Entity](#custom_user_entity), or [User Provisioning Using a Microflow at Runtime](#microflow-at-runtime). + You can set up just-in-time user provisioning as follows: 1. Sign in to the running app with an administrator account. 2. Navigate to the `OIDC.OIDC_Client_Overview` page which is set up in the app navigation. 3. In the **IdPs for SSO and API security** tab, click **New** and access the **UserProvisioning** tab. +Below fields are available in the **UserProvisioning** tab for the User Provisioning configuration. + +* **Custom user Entity (extension of System.User)** – the Mendix entity where you will store and look up the user account. If you are using the [Administration module](https://marketplace.mendix.com/link/component/23513), this would be `Administration.Account`. +* **The attribute where the user principal is stored** – unique identifier associated with an authenticated user. +* **Allow the module to create users** – this enables the module to create users based on configurations of JIT user provisioning and attribute mapping. When disabled, it will still update existing users. However, for new users, it will display an exception message in the log. + * By default, the value is set to ***Yes***. +* **User role** (optional) – the role which will be assigned to newly created users. This is optional and will be applied to all IdPs. You can select any user role as a default or keep the field empty. If you need additional user roles, use Access Token Parsing microflow to assign multiple roles. + * By default, the value is set to ***User***. +* **User Type** – this allows you to configure end-users of your application as internal or external. It is created upon the creation of the user and updated each time the user logs in. + * By default, the value is set to ***Internal***. + +Under **Attribute Mapping**, for each piece of information you want to add to your custom user entity, select an **IdP Attribute** (claim) and specify the **Configured Entity Attribute** where you want to store the information. + +Note the following: + +* You cannot use the IdP claim which is the primary attribute identifying the user and you cannot use the attribute you set in **The attribute where the user principal is stored**. +* You can map only one IdP claim to a Custom user Entity attribute. +* The **IdP Attribute** is one of the fixed claims supported by the OIDC SSO module. +* IdP Attributes(Claims) cannot be of type enum, autonumber, or an association. + +Optionally, you can select the microflow in the **Custom UserProvisioning** field to use custom logic for user provisioning. For more information, see the [User Provisioning Using a Microflow at Runtime](#microflow-at-runtime) section below. + +{{% alert color="info" %}} +If you are using module version 3.2.0 and below, you will need to refresh the module containing your microflow as described in the [Installing Mx Model Reflection](/appstore/modules/oidc/#mxmodelreflection) and select the microflow in the **Custom UserProvisioning** field. +{{% /alert %}} + ##### Default User Provisioning Configuration{#default} -The User Provisioning configuration fields are available in the **UserProvisioning** tab. In default configuration, the custom user entity is set as `Administration.Account`, the principal attribute is set as `Name`, and the default attribute mapping is provided. +In default configuration, the custom user entity is set as `Administration.Account`, the principal attribute is set as `Name`, and the default attribute mapping is provided. {{< figure src="/attachments/appstore/platform-supported-content/modules/oidc/default_provisioning.png" >}} @@ -547,7 +575,7 @@ You can set up custom JIT user provisioning as follows: * **Custom user Entity (extension of System.User)** – the Mendix entity where you will store and look up the user account. If you are using the [Administration module](https://marketplace.mendix.com/link/component/23513), this would be `Administration.Account`. * **The attribute where the user principal is stored** – unique identifier associated with an authenticated user. - * **Allow the module to create users** – this enables the module to create users based on configurations of JIT user provisioning and attribute mapping. When disabled, it will still update existing users. However, for new users, it will display an exception message stating that the login action was successful but no user has been configured. + * **Allow the module to create users** – this enables the module to create users based on configurations of JIT user provisioning and attribute mapping. When disabled, it will still update existing users. However, for new users, it will display an exception message in the log. * By default, the value is set to ***Yes***. * **User role** (optional) – the role which will be assigned to newly created users. This is optional and will be applied to all IdPs. You can select any user role as a default or keep the field empty. If you need additional user roles, use Access Token Parsing microflow to assign multiple roles. * By default, the value is set to ***User***. @@ -571,8 +599,6 @@ If you are using module version 3.2.0 and below, you will need to refresh the mo 4. Click **Save** to save the configuration. -By default, users are provisioned by [Default User Provisioning Configuration](#default). Optionally, you can customize user provisioning by [Modifying Default Attribute Mapping](#modify-default), [User Provisioning Using Your Custom User Entity](#custom_user_entity), or [User Provisioning Using a Microflow at Runtime](#microflow-at-runtime). - {{% alert color="info" %}} If you connect multiple IdPs to your Mendix app, you can use separate custom user entities for each IdP, each with its own attribute mapping. {{% /alert %}} From 007883a36ea41ddb1b3db2b92d06014d7f2556e0 Mon Sep 17 00:00:00 2001 From: Karuna-Mendix Date: Thu, 13 Feb 2025 17:37:26 +0530 Subject: [PATCH 08/11] Access Token Parsing --- .../platform-supported-content/modules/oidc.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md index 821c305d276..1303fe6daab 100644 --- a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md +++ b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md @@ -349,7 +349,7 @@ In this case, the OIDC client is the app you are making. {{% alert color="info" %}}Starting from UserCommons version 2.0.0, If the IdP does not specify the timezone and language for newly created users, these settings will be set according to default **App Settings** of your app. If no default is available, they remain unset. Existing users retain their previously set values.{{% /alert %}} -11. Optionally, you can select the `CustomAccessTokenParsing` microflow if you want to use additional information from the OIDC IdP. This can be used, for example, to assign end-user roles based on information from the IdP – see [Access Token Parsing](#access-token-parsing) for more information. +11. Optionally, you can select the `CustomAccessTokenParsing` microflow if you want to use additional information from the OIDC IdP. This can be used, for example, to assign end-user roles based on information from the IdP – see [Dynamic Assignment of Userroles (Access Token Parsing)](#access-token-parsing) for more information. {{% alert color="info" %}}Starting from version 4.0.0 of the OIDC SSO, the default user roles in the UserProvisioning will be assigned alongside the roles parsed from the access token.{{% /alert %}} @@ -365,7 +365,7 @@ See the section [Optional Features](#optional) information on additional optiona {{% alert color="info" %}}If the endpoint URL does not already end with `/.well-known/openid-configuration`, include it at the end. According to the specifications, the URL you need to enter typically ends with `/.well-known/openid-configuration`.{{% /alert %}} * If you do not have an automatic configuration URL, you can fill in the other endpoints manually. -3. Optionally, you can select the `CustomAccessTokenParsing` microflow if you want to use additional information from the OIDC IdP. This can be used, for example, to assign end-user roles based on information from the IdP – see [Access Token Parsing](#access-token-parsing) for more information. +3. Optionally, you can select the `CustomAccessTokenParsing` microflow if you want to use additional information from the OIDC IdP. This can be used, for example, to assign end-user roles based on information from the IdP – see [Dynamic Assignment of Userroles (Access Token Parsing)](#access-token-parsing) for more information. 4. Click Save. Once you have completed these steps, the Client Credential Configuration is ready for testing. #### Microsoft Entra ID Client Configuration for APIs {#azure} @@ -535,7 +535,7 @@ Below fields are available in the **UserProvisioning** tab for the User Provisio * **The attribute where the user principal is stored** – unique identifier associated with an authenticated user. * **Allow the module to create users** – this enables the module to create users based on configurations of JIT user provisioning and attribute mapping. When disabled, it will still update existing users. However, for new users, it will display an exception message in the log. * By default, the value is set to ***Yes***. -* **User role** (optional) – the role which will be assigned to newly created users. This is optional and will be applied to all IdPs. You can select any user role as a default or keep the field empty. If you need additional user roles, use Access Token Parsing microflow to assign multiple roles. +* **User role** (optional) – the role which will be assigned to newly created users. This is optional and will be applied to all IdPs. You can select any user role as a default or keep the field empty. User Provisioning does not allow you to assign user roles dynamically. It can only set a default role. If you need additional user roles, use Access Token Parsing microflow to assign multiple roles. For more information, see the [Dynamic Assignment of Userroles (Access Token Parsing)](#access-token-parsing) section below. * By default, the value is set to ***User***. * **User Type** – this allows you to configure end-users of your application as internal or external. It is created upon the creation of the user and updated each time the user logs in. * By default, the value is set to ***Internal***. @@ -785,7 +785,7 @@ Takes as input: The microflow returns an object of type `System.HttpResponse`. This could indicate an error. -### Access Token Parsing{#access-token-parsing} +### Dynamic Assignment of Userroles (Access Token Parsing){#access-token-parsing} With the OAuth/OIDC protocol, access tokens can be opaque or can be a JSON Web Token (JWT). If you are just delegating authentication for your app to the IdP you will not need to know the contents of the access token. @@ -1046,7 +1046,7 @@ Content - {"error":"invalid_client","error_description":"client authentication f ### Custom Microflow Implementation Should Be Required to Process Access_Token Roles -If you get the error message “Custom microflow implementation should be required to process Access_token roles” in the Mendix Studio Pro console logs, this indicates you have not completely implemented your custom microflow for parsing access tokens (`CustomATP_…`). See the section on [Access Token Parsing](#access-token-parsing). +If you get the error message “Custom microflow implementation should be required to process Access_token roles” in the Mendix Studio Pro console logs, this indicates you have not completely implemented your custom microflow for parsing access tokens (`CustomATP_…`). See the section on [Dynamic Assignment of Userroles (Access Token Parsing)](#access-token-parsing). ### End-Users of App Deployed On Premises Do Not Return to the App After Sign In From c2c514771420217518fbb3d2689a2a97e91a31a7 Mon Sep 17 00:00:00 2001 From: Karuna-Mendix Date: Fri, 14 Feb 2025 09:50:25 +0530 Subject: [PATCH 09/11] moving User Provisioning fields --- .../modules/oidc.md | 45 ++++++------------- 1 file changed, 13 insertions(+), 32 deletions(-) diff --git a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md index 1303fe6daab..56ddfb0e85c 100644 --- a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md +++ b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md @@ -551,53 +551,34 @@ Note the following: Optionally, you can select the microflow in the **Custom UserProvisioning** field to use custom logic for user provisioning. For more information, see the [User Provisioning Using a Microflow at Runtime](#microflow-at-runtime) section below. +{{< figure src="/attachments/appstore/platform-supported-content/modules/oidc/default_provisioning.png" >}} + {{% alert color="info" %}} If you are using module version 3.2.0 and below, you will need to refresh the module containing your microflow as described in the [Installing Mx Model Reflection](/appstore/modules/oidc/#mxmodelreflection) and select the microflow in the **Custom UserProvisioning** field. {{% /alert %}} ##### Default User Provisioning Configuration{#default} +If the standard configuration meets your needs and your application does not have special user management requirements, you can use the default User Provisioning. + In default configuration, the custom user entity is set as `Administration.Account`, the principal attribute is set as `Name`, and the default attribute mapping is provided. -{{< figure src="/attachments/appstore/platform-supported-content/modules/oidc/default_provisioning.png" >}} +| IdP Attribute | Configured Entity Attribute | +| -------------------- | --------------------------- | +| email | Email | +| name | FullName | +| sub | Name | -###### Modifying Default Attribute Mapping{#modify-default} +##### Modifying Default Attribute Mapping{#modify-default} -Optionally, you can change the default **IdP Attribute** or the **Configured Entity Attribute**, by editing the mapping in the **Attribute Mapping** section within the **UserProvisioning** tab. +You may need a different or custom attribute mapping, for example, if you are configuring OIDC SSO and SCIM together and need a common identifier. In this case, you can modify the default attribute mapping. +To do so, change the default **IdP Attribute** or the **Configured Entity Attribute**, by editing the mapping in the **Attribute Mapping** section within the **UserProvisioning** tab. ##### User Provisioning Using Your Custom User Entity{#custom_user_entity} If you want to use your custom user entity which is a specialization of the `System.User` entity to store user information, select it in the **Custom user Entity (extension of System.User)** field by replacing the `Administration.Account` entity. -You can set up custom JIT user provisioning as follows: - -1. Set up the following fields: - - * **Custom user Entity (extension of System.User)** – the Mendix entity where you will store and look up the user account. If you are using the [Administration module](https://marketplace.mendix.com/link/component/23513), this would be `Administration.Account`. - * **The attribute where the user principal is stored** – unique identifier associated with an authenticated user. - * **Allow the module to create users** – this enables the module to create users based on configurations of JIT user provisioning and attribute mapping. When disabled, it will still update existing users. However, for new users, it will display an exception message in the log. - * By default, the value is set to ***Yes***. - * **User role** (optional) – the role which will be assigned to newly created users. This is optional and will be applied to all IdPs. You can select any user role as a default or keep the field empty. If you need additional user roles, use Access Token Parsing microflow to assign multiple roles. - * By default, the value is set to ***User***. - * **User Type** – this allows you to configure end-users of your application as internal or external. It is created upon the creation of the user and updated each time the user logs in. - * By default, the value is set to ***Internal***. - -2. Under **Attribute Mapping**, for each piece of information you want to add to your custom user entity, select an **IdP Attribute** (claim) and specify the **Configured Entity Attribute** where you want to store the information. - - Note the following: - - * You cannot use the IdP claim which is the primary attribute identifying the user and you cannot use the attribute you set in **The attribute where the user principal is stored**. - * You can map only one IdP claim to a Custom user Entity attribute. - * The **IdP Attribute** is one of the fixed claims supported by the OIDC SSO module. - * IdP Attributes(Claims) cannot be of type enum, autonumber, or an association. - -3. Optionally, you can select the microflow in the **Custom UserProvisioning** field to use custom logic for user provisioning. For more information, see the [User Provisioning Using a Microflow at Runtime](#microflow-at-runtime) section below. - - {{% alert color="info" %}} -If you are using module version 3.2.0 and below, you will need to refresh the module containing your microflow as described in the [Installing Mx Model Reflection](/appstore/modules/oidc/#mxmodelreflection) and select the microflow in the **Custom UserProvisioning** field. - {{% /alert %}} - -4. Click **Save** to save the configuration. +To configure custom JIT user provisioning, set up the fields listed in the [Runtime Configuration of End-user Onboarding](#custom-provisioning-rt) section above and save the configuration. {{% alert color="info" %}} If you connect multiple IdPs to your Mendix app, you can use separate custom user entities for each IdP, each with its own attribute mapping. From 6c689418c2badbc247db3808c7bce8231e3a5a2b Mon Sep 17 00:00:00 2001 From: Karuna-Mendix Date: Wed, 19 Feb 2025 11:52:50 +0530 Subject: [PATCH 10/11] cross-reference --- .../use-content/platform-supported-content/modules/oidc.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md index 56ddfb0e85c..d93175e23b4 100644 --- a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md +++ b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md @@ -345,7 +345,7 @@ In this case, the OIDC client is the app you are making. In version below 3.0.0 of the OIDC SSO module, you can configure the timezone and language using the `OIDC_CustomUserParsing_Standard` and `OIDC_CustomUserParsing_UserInfo` microflow. However, in version 3.0.0 and above of the OIDC SSO module, you can set the timezone and language using any standard microflow. - You can also use your own custom user entity to manage users of the app. See the section on [Custom User Provisioning](#custom-provisioning) for more information on what you can do to implement provisioning logic which fits your business needs. The module includes a Salesforce-specific example. + You can also use your own custom user entity to manage users of the app. See the section on [User Provisioning Using Your Custom User Entity](#custom_user_entity) for more information on what you can do to implement provisioning logic which fits your business needs. The module includes a Salesforce-specific example. {{% alert color="info" %}}Starting from UserCommons version 2.0.0, If the IdP does not specify the timezone and language for newly created users, these settings will be set according to default **App Settings** of your app. If no default is available, they remain unset. Existing users retain their previously set values.{{% /alert %}} From d78e914a0ffba407dbe376b93a274d178fbc7724 Mon Sep 17 00:00:00 2001 From: Karuna-Mendix Date: Wed, 19 Feb 2025 14:48:02 +0530 Subject: [PATCH 11/11] Add/correct the cross-references. --- .../use-content/platform-supported-content/modules/oidc.md | 6 ++++-- .../platform-supported-content/services/oidc-provider.md | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md index d93175e23b4..8fc5226921a 100644 --- a/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md +++ b/content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md @@ -571,7 +571,9 @@ In default configuration, the custom user entity is set as `Administration.Accou ##### Modifying Default Attribute Mapping{#modify-default} -You may need a different or custom attribute mapping, for example, if you are configuring OIDC SSO and SCIM together and need a common identifier. In this case, you can modify the default attribute mapping. +You may need a different or custom attribute mapping, for example, if you are configuring OIDC SSO and SCIM together and need a common identifier. For more information, see the [User Identifiers in the OIDC and SCIM Protocols](#user-identifiers-in-the-oidc-and-scim-protocols) section below. + +In this case, you can modify the default attribute mapping. To do so, change the default **IdP Attribute** or the **Configured Entity Attribute**, by editing the mapping in the **Attribute Mapping** section within the **UserProvisioning** tab. ##### User Provisioning Using Your Custom User Entity{#custom_user_entity} @@ -979,7 +981,7 @@ Your IdP may have different ways of handling requests to use a specific authenti * Your IdP may honor what is requested on a ‘best effort’ basis and indicate the actual authentication method used in the ID-token that is sent to your app. * Your IdP may send an error response to your app if the requested authentication method was not possible for the user that was asked to login, for whatever reason. -When a user successfully signs in at your IdP, your IdP may or may not return an ACR claim in the ID-token. If your IdP returns the actual authentication method that was used in the ACR claim in the ID-token (and/or Access Token), you can create a [custom User Provisioning microflow](#custom-provisioning) (or [custom access token parsing microflow](#custom-parsing)) to grant or restrict access to specific resources or functionalities based on the level of authentication assurance. +When a user successfully signs in at your IdP, your IdP may or may not return an ACR claim in the ID-token. If your IdP returns the actual authentication method that was used in the ACR claim in the ID-token (and/or Access Token), you can create a [custom User Provisioning microflow](#microflow-at-runtime) (or [custom access token parsing microflow](#custom-parsing)) to grant or restrict access to specific resources or functionalities based on the level of authentication assurance. ## Testing and Troubleshooting{#testing} diff --git a/content/en/docs/appstore/use-content/platform-supported-content/services/oidc-provider.md b/content/en/docs/appstore/use-content/platform-supported-content/services/oidc-provider.md index f71d0920db4..4664bcc5a25 100644 --- a/content/en/docs/appstore/use-content/platform-supported-content/services/oidc-provider.md +++ b/content/en/docs/appstore/use-content/platform-supported-content/services/oidc-provider.md @@ -312,7 +312,7 @@ This section applies only when your client is using the authorization code grant Choose one of the two options, below. -Whichever option you choose, you will need to use [Custom User Provisioning](/appstore/modules/oidc/#custom-provisioning) in the OIDC SSO module of your client app to assign the correct user roles to the end-user. +Whichever option you choose, you will need to use Custom User Provisioning in the OIDC SSO module of your client app to assign the correct user roles to the end-user. For more information, see the [Runtime Configuration of End-user Onboarding](/appstore/modules/oidc/#custom-provisioning-rt) section of *OIDC SSO*. ##### Configuration of the OIDC Provider for Centralized Authorization with Scopes{#configure-scopes}