From 13aaae37d15bdd672c26565bd0e0ebfc2e8b9459 Mon Sep 17 00:00:00 2001 From: ramsesfv Date: Thu, 29 Aug 2024 12:00:33 +0200 Subject: [PATCH] Update eth-secpm.md (#84) Included preliminary notes related to the onchain component. --------- Co-authored-by: kaiserd <1684595+kaiserd@users.noreply.github.com> --- vac/raw/eth-secpm.md | 1148 ++++++++++++----- .../images/eth-secpm_onchain-register-1.png | Bin 0 -> 55307 bytes .../images/eth-secpm_onchain-register-2.png | Bin 0 -> 55125 bytes vac/raw/images/eth-secpm_onchain-update.png | Bin 0 -> 33010 bytes 4 files changed, 834 insertions(+), 314 deletions(-) create mode 100644 vac/raw/images/eth-secpm_onchain-register-1.png create mode 100644 vac/raw/images/eth-secpm_onchain-register-2.png create mode 100644 vac/raw/images/eth-secpm_onchain-update.png diff --git a/vac/raw/eth-secpm.md b/vac/raw/eth-secpm.md index 0732e3a..5c3a7ad 100644 --- a/vac/raw/eth-secpm.md +++ b/vac/raw/eth-secpm.md @@ -9,46 +9,76 @@ contributors: --- ## Motivation -The need for secure communications has become paramount. -Traditional centralized messaging protocols are susceptible to various security threats, -including unauthorized access, data breaches, and single points of failure. -Therefore a decentralized approach to secure communication becomes increasingly relevant, + +The need for secure communications has become paramount. +Traditional centralized messaging protocols are susceptible to various security threats, +including unauthorized access, data breaches, and single points of failure. +Therefore a decentralized approach to secure communication becomes increasingly relevant, offering a robust solution to address these challenges. -This specification outlines a private messaging service using the Ethereum blockchain as authentication service. -Rooted in the existing [model](../../waku/standards/application/20/toy-eth-pm.md), -this proposal addresses the deficiencies related to forward privacy and authentication inherent in the current framework. +This specification outlines a private messaging service using the +Ethereum blockchain as authentication service. +Rooted in the existing [model](../../waku/standards/application/20/toy-eth-pm.md), +this proposal addresses the deficiencies related +to forward privacy and authentication inherent +in the current framework. The specification is divided into 3 sections: -- Private 1-to-1 communications protocol, based on [Signal's double ratchet](https://signal.org/docs/specifications/doubleratchet/). -- Private group messaging protocol, based on the [MLS protocol](https://datatracker.ietf.org/doc/rfc9420/). -- Description of an Ethereum-based authentication protocol, based on [SIWE](https://eips.ethereum.org/EIPS/eip-4361). - +- Private 1-to-1 communications protocol, based on [Signal's double +ratchet](https://signal.org/docs/specifications/doubleratchet/). +- Private group messaging protocol, based on the +[MLS protocol](https://datatracker.ietf.org/doc/rfc9420/). +- Description of an Ethereum-based authentication protocol, based on +[SIWE](https://eips.ethereum.org/EIPS/eip-4361). ## Private 1-to-1 communications protocol ### Theory + The specification is based on the noise protocol framework. -It corresponds to the double ratchet scheme combined with the X3DH algorithm, which will be used to initialize the former. -We chose to express the protocol in noise to be be able to use the noise streamlined implementation and proving features. -The X3DH algorithm provides both authentication and forward secrecy, as stated in the [X3DH specification](https://signal.org/docs/specifications/x3dh/). +It corresponds to the double ratchet scheme combined with +the X3DH algorithm, which will be used to initialize the former. +We chose to express the protocol in noise to be be able to use +the noise streamlined implementation and proving features. +The X3DH algorithm provides both authentication and forward +secrecy, as stated in the +[X3DH specification](https://signal.org/docs/specifications/x3dh/). This protocol will consist of several stages: -1. Key setting for X3DH: this step will produce prekey bundles for Bob which will be fed into X3DH. It will also allow Alice to generate the keys required to run the X3DH algorithm correctly. -2. Execution of X3DH: This step will output a common secret key `SK` together with an additional data vector `AD`. Both will be used in the double ratchet algorithm initialization. -3. Execution of the double ratchet algorithm for forward secure, authenticated communications, using the common secret key `SK`, obtained from X3DH, as a root key. +1. Key setting for X3DH: this step will produce +prekey bundles for Bob which will be fed into X3DH. +It will also allow Alice to generate the keys required +to run the X3DH algorithm correctly. +2. Execution of X3DH: This step will output +a common secret key `SK` together with an additional +data vector `AD`. Both will be used in the double +ratchet algorithm initialization. +3. Execution of the double ratchet algorithm +for forward secure, authenticated communications, +using the common secret key `SK`, obtained from X3DH, as a root key. The protocol assumes the following requirements: -- Alice knows Bob’s Ethereum address. -- Bob is willing to participate in the protocol, and publishes his public key. -- Bob’s ownership of his public key is verifiable, -- Alice wants to send message M to Bob. -- An eavesdropper cannot read M’s content even if she is storing it or relaying it. + +- Alice knows Bob’s Ethereum address. +- Bob is willing to participate in the protocol, +and publishes his public key. +- Bob’s ownership of his public key is verifiable, +- Alice wants to send message M to Bob. +- An eavesdropper cannot read M’s content +even if she is storing it or relaying it. + +> The inclusion of this first section devoted to secure 1-to-1 +communications between users is motivated by the fact certain +interactions between existing group members and prospective new +members require secure communication channels. ### Syntax + #### Cryptographic suite + The following cryptographic functions MUST be used: + - `X488` as Diffie-Hellman function `DH`. - `SHA256` as KDF. - `AES256-GCM` as AEAD algorithm. @@ -56,38 +86,54 @@ The following cryptographic functions MUST be used: - `XEd448` for digital signatures. #### X3DH initialization + This scheme MUST work on the curve curve448. The X3DH algorithm corresponds to the IX pattern in Noise. -Bob and Alice MUST define personal key pairs `(ik_B, IK_B)` and `(ik_A, IK_A)` respectively where: -- The key `ik` must be kept secret, -- and the key `IK` is public. +Bob and Alice MUST define personal key pairs +`(ik_B, IK_B)` and `(ik_A, IK_A)` respectively where: -Bob MUST generate new keys using `(ik_B, IK_B) = GENERATE_KEYPAIR(curve = curve448)`. +- The key `ik` must be kept secret, +- and the key `IK` is public. -Bob MUST also generate a public key pair `(spk_B, SPK_B) = GENERATE_KEYPAIR(curve = curve448)`. +Bob MUST generate new keys using +`(ik_B, IK_B) = GENERATE_KEYPAIR(curve = curve448)`. -`SPK` is a public key generated and stored at medium-term. -Both signed prekey and the certificate MUST undergo periodic replacement. -After replacing the key, -Bob keeps the old private key of `SPK` for some interval, dependant on the implementation. -This allows Bob to decrypt delayed messages. +Bob MUST also generate a public key pair +`(spk_B, SPK_B) = GENERATE_KEYPAIR(curve = curve448)`. -Bob MUST sign `SPK` for authentication: `SigSPK = XEd448(ik, Encode(SPK))` +`SPK` is a public key generated and stored at medium-term. +Both signed prekey and the certificate MUST +undergo periodic replacement. +After replacing the key, +Bob keeps the old private key of `SPK` +for some interval, dependant on the implementation. +This allows Bob to decrypt delayed messages. -A final step requires the definition of `prekey_bundle = (IK, SPK, SigSPK, OPK_i)` +Bob MUST sign `SPK` for authentication: +`SigSPK = XEd448(ik, Encode(SPK))` -One-time keys `OPK` MUST be generated as `(opk_B, OPK_B) = GENERATE_KEYPAIR(curve = curve448)`. +A final step requires the definition of +`prekey_bundle = (IK, SPK, SigSPK, OPK_i)` -Before sending an initial message to Bob, Alice MUST generate an AD: `AD = Encode(IK_A) || Encode(IK_B)`. +One-time keys `OPK` MUST be generated as +`(opk_B, OPK_B) = GENERATE_KEYPAIR(curve = curve448)`. -Alice MUST generate ephemeral key pairs `(ek, EK) = GENERATE_KEYPAIR(curve = curve448)`. +Before sending an initial message to Bob, +Alice MUST generate an AD: `AD = Encode(IK_A) || Encode(IK_B)`. -The function `Encode()` transforms an curve448 public key into a byte sequence. -This is specified in the [RFC 7748](http://www.ietf.org/rfc/rfc7748.txt) on elliptic curves for security. +Alice MUST generate ephemeral key pairs +`(ek, EK) = GENERATE_KEYPAIR(curve = curve448)`. -One MUST consider `q = 2^446 - 13818066809895115352007386748515426880336692474882178609894547503885` for digital signatures with `(XEd448_sign, XEd448_verify)`: -``` +The function `Encode()` transforms a +curve448 public key into a byte sequence. +This is specified in the [RFC 7748](http://www.ietf.org/rfc/rfc7748.txt) +on elliptic curves for security. + +One MUST consider `q = 2^446 - 13818066809895115352007386748515426880336692474882178609894547503885` +for digital signatures with `(XEd448_sign, XEd448_verify)`: + +```text XEd448_sign((ik, IK), message): Z = randbytes(64) r = SHA512(2^456 - 2 || ik || message || Z ) @@ -96,7 +142,8 @@ XEd448_sign((ik, IK), message): s = (r + h * ik) % q return (R || s) ``` -``` + +```text XEd448_verify(u, message, (R || s)): if (R.y >= 2^448) or (s >= 2^446): return FALSE h = (SHA512(R || 156326 || message)) % q @@ -104,7 +151,8 @@ XEd448_verify(u, message, (R || s)): if R == R_check: return TRUE return FALSE ``` -``` + +```text convert_mont(u): u_masked = u % mod 2^448 inv = ((1 - u_masked)^(2^448 - 2^224 - 3)) % (2^448 - 2^224 - 1) @@ -114,42 +162,59 @@ convert_mont(u): ``` #### Use of X3DH -This specification combines the double ratchet with X3DH using the following data as initialization for the former: -- The `SK` output from X3DH becomes the `SK` input of the double ratchet. See section 3.3 of [Signal Specification](https://signal.org/docs/specifications/doubleratchet/) for a detailed description. -- The `AD` output from X3DH becomes the `AD` input of the double ratchet. See sections 3.4 and 3.5 of [Signal Specification](https://signal.org/docs/specifications/doubleratchet/) for a detailed description. -- Bob’s signed prekey `SigSPKB` from X3DH is used as Bob’s initial ratchet public key of the double ratchet. +This specification combines the double ratchet +with X3DH using the following data as initialization for the former: + +- The `SK` output from X3DH becomes the `SK` +input of the double ratchet. See section 3.3 of +[Signal Specification](https://signal.org/docs/specifications/doubleratchet/) +for a detailed description. +- The `AD` output from X3DH becomes the `AD` +input of the double ratchet. See sections 3.4 and 3.5 of +[Signal Specification](https://signal.org/docs/specifications/doubleratchet/) +for a detailed description. +- Bob’s signed prekey `SigSPKB` from X3DH is used as Bob’s +initial ratchet public key of the double ratchet. X3DH has three phases: -1. Bob publishes his identity key and prekeys to a server, a network, or dedicated smart contract. -2. Alice fetches a prekey bundle from the server, and uses it to send an initial message to Bob. -3. Bob receives and processes Alice's initial message. +1. Bob publishes his identity key and prekeys to a server, +a network, or dedicated smart contract. +2. Alice fetches a prekey bundle from the server, +and uses it to send an initial message to Bob. +3. Bob receives and processes Alice's initial message. Alice MUST perform the following computations: -``` + +```text dh1 = DH(IK_A, SPK_B, curve = curve448) dh2 = DH(EK_A, IK_B, curve = curve448) dh3 = DH(EK_A, SPK_B) SK = KDF(dh1 || dh2 || dh3) ``` -Alice MUST send to Bob a message containing: -- `IK_A, EK_A`. -- An identifier to Bob's prekeys used. -- A message encrypted with AES256-GCM using `AD` and `SK`. +Alice MUST send to Bob a message containing: + +- `IK_A, EK_A`. +- An identifier to Bob's prekeys used. +- A message encrypted with AES256-GCM using `AD` and `SK`. Upon reception of the initial message, Bob MUST: + 1. Perform the same computations above with the `DH()` function. 2. Derive `SK` and construct `AD`. 3. Decrypt the initial message encrypted with `AES256-GCM`. 4. If decryption fails, abort the protocol. #### Initialization of the double datchet -In this stage Bob and Alice have generated key pairs and agreed a shared secret `SK` using X3DH. + +In this stage Bob and Alice have generated key pairs +and agreed a shared secret `SK` using X3DH. Alice calls `RatchetInitAlice()` defined below: -``` + +```text RatchetInitAlice(SK, IK_B): state.DHs = GENERATE_KEYPAIR(curve = curve448) state.DHr = IK_B @@ -158,11 +223,15 @@ RatchetInitAlice(SK, IK_B): state.Ns, state.Nr, state.PN = 0 state.MKSKIPPED = {} ``` -The HKDF function MUST be the proposal by [Krawczyk and Eronen](http://www.ietf.org/rfc/rfc5869.txt). -In this proposal `chaining_key` and `input_key_material` MUST be replaced with `SK` and the output of `DH` respectively. + +The HKDF function MUST be the proposal by +[Krawczyk and Eronen](http://www.ietf.org/rfc/rfc5869.txt). +In this proposal `chaining_key` and `input_key_material` +MUST be replaced with `SK` and the output of `DH` respectively. Similarly, Bob calls the function `RatchetInitBob()` defined below: -``` + +```text RatchetInitBob(SK, (ik_B,IK_B)): state.DHs = (ik_B, IK_B) state.Dhr = None @@ -171,23 +240,31 @@ RatchetInitBob(SK, (ik_B,IK_B)): state.Ns, state.Nr, state.PN = 0 state.MKSKIPPED = {} ``` + #### Encryption + This function performs the symmetric key ratchet. -``` +```text RatchetEncrypt(state, plaintext, AD): - state.CKs, mk = HMAC-SHA256(state.CKs) - header = HEADER(state.DHs, state.PN, state.Ns) - state.Ns = state.Ns + 1 - return header, AES256-GCM_Enc(mk, plaintext, AD || header) + state.CKs, mk = HMAC-SHA256(state.CKs) + header = HEADER(state.DHs, state.PN, state.Ns) + state.Ns = state.Ns + 1 + return header, AES256-GCM_Enc(mk, plaintext, AD || header) ``` -The `HEADER` function creates a new message header containing the public key from the key pair output of the `DH`function. -It outputs the previous chain length `pn`, and the message number `n`. -The returned header object contains ratchet public key `dh` and integers `pn` and `n`. + +The `HEADER` function creates a new message header +containing the public key from the key pair output of the `DH`function. +It outputs the previous chain length `pn`, +and the message number `n`. +The returned header object contains ratchet public key +`dh` and integers `pn` and `n`. #### Decryption + The function `RatchetDecrypt()` decrypts incoming messages: -``` + +```text RatchetDecrypt(state, header, ciphertext, AD): plaintext = TrySkippedMessageKeys(state, header, ciphertext, AD) if plaintext != None: @@ -200,9 +277,10 @@ RatchetDecrypt(state, header, ciphertext, AD): state.Nr = state.Nr + 1 return AES256-GCM_Dec(mk, ciphertext, AD || header) ``` + Auxiliary functions follow: -``` +```text DHRatchet(state, header): state.PN = state.Ns state.Ns = state.Nr = 0 @@ -211,7 +289,8 @@ DHRatchet(state, header): state.DHs = GENERATE_KEYPAIR(curve = curve448) state.RK, state.CKs = HKDF(state.RK, DH(state.DHs, state.DHr)) ``` -``` + +```text SkipMessageKeys(state, until): if state.NR + MAX_SKIP < until: raise Error @@ -221,7 +300,8 @@ SkipMessageKeys(state, until): state.MKSKIPPED[state.DHr, state.Nr] = mk state.Nr = state.Nr + 1 ``` -``` + +```text TrySkippedMessageKey(state, header, ciphertext, AD): if (header.dh, header.n) in state.MKSKIPPED: mk = state.MKSKIPPED[header.dh, header.n] @@ -233,152 +313,269 @@ TrySkippedMessageKey(state, header, ciphertext, AD): ## Information retrieval ### Static data -Some data, such as the key pairs `(ik, IK)` for Alice and Bob, MAY NOT be regenerated after a period of time. -Therefore the prekey bundle MAY be stored in long-term storage solutions, such as a dedicated smart contract which outputs such a key pair when receiving an Ethereum wallet address. -Storing static data is done using a dedicated smart contract `PublicKeyStorage` which associates the Ethereum wallet address of a user with his public key. -This mapping is done by `PublicKeyStorage` using a `publicKeys` function, or a `setPublicKey` function. +Some data, such as the key pairs `(ik, IK)` for Alice and Bob, +MAY NOT be regenerated after a period of time. +Therefore the prekey bundle MAY be stored in long-term +storage solutions, such as a dedicated smart contract +which outputs such a key pair when receiving an Ethereum wallet +address. + +Storing static data is done using a dedicated +smart contract `PublicKeyStorage` which associates +the Ethereum wallet address of a user with his public key. +This mapping is done by `PublicKeyStorage` +using a `publicKeys` function, or a `setPublicKey` function. This mapping is done if the user passed an authorization process. -A user who wants to retrieve a public key associated with a specific wallet address calls a function `getPublicKey`. -The user provides the wallet address as the only input parameter for `getPublicKey`. -The function outputs the associated public key from the smart contract. +A user who wants to retrieve a public key associated +with a specific wallet address calls a function `getPublicKey`. +The user provides the wallet address as the only +input parameter for `getPublicKey`. +The function outputs the associated public key +from the smart contract. ### Ephemeral data -Storing ephemeral data on Ethereum MAY be done using a combination of on-chain and off-chain solutions. -This approach provides an efficient solution to the problem of storing updatable data in Ethereum. -1. Ethereum stores a reference or a hash that points to the off-chain data. -2. Off-chain solutions can include systems like IPFS, traditional cloud storage solutions, or decentralized storage networks such as a [Swarm](https://www.ethswarm.org). -In any case, the user stores the associated IPFS hash, URL or reference in Ethereum. -The fact of a user not updating the ephemeral information can be understood as Bob not willing to participate in any communication. +Storing ephemeral data on Ethereum MAY be done using +a combination of on-chain and off-chain solutions. +This approach provides an efficient solution to +the problem of storing updatable data in Ethereum. -This applies to `KeyPackage`, which in the MLS specification are meant to be stored in a directory provided by the delivery service. -If such an element does not exist, `KeyPackage` MUST be stored according to one of the two options outlined above. +1. Ethereum stores a reference or a hash +that points to the off-chain data. +2. Off-chain solutions can include systems like IPFS, +traditional cloud storage solutions, or +decentralized storage networks such as a +[Swarm](https://www.ethswarm.org). + +In any case, the user stores the associated +IPFS hash, URL or reference in Ethereum. + +The fact of a user not updating the ephemeral information +can be understood as Bob not willing to participate in any +communication. + +This applies to `KeyPackage`, +which in the MLS specification are meant +o be stored in a directory provided by the delivery service. +If such an element does not exist, +`KeyPackage` MUST be stored according +to one of the two options outlined above. ## Private group messaging protocol -### Theory -The [Messaging Layer Security](https://datatracker.ietf.org/doc/rfc9420/)(MLS) protocol aims at providing a group of users with end-to-end encryption in an authenticated and asynchronous way. -The main security characteristics of the protocol are: Message confidentiality and authentication, sender authentication, -membership agreement, post-remove and post-update security, and forward secrecy and post-compromise security. -The MLS protocol achieves: low-complexity, group integrity, synchronization and extensibility. -The extension to group chat described in forthcoming sections is built upon the [MLS](https://datatracker.ietf.org/doc/rfc9420/) protocol. +### Theoretical content + +The [Messaging Layer Security](https://datatracker.ietf.org/doc/rfc9420/)(MLS) +protocol aims at providing a group of users with +end-to-end encryption in an authenticated and asynchronous way. +The main security characteristics of the protocol are: +Message confidentiality and authentication, sender authentication, +membership agreement, post-remove +and post-update security, and forward secrecy and +post-compromise security. +The MLS protocol achieves: low-complexity, group integrity, +synchronization and extensibility. + +The extension to group chat described in forthcoming sections is built upon the +[MLS](https://datatracker.ietf.org/doc/rfc9420/) protocol. + +### Structure + +Each MLS session uses a single cipher suite that specifies the +primitives to be used in group key computations. The cipher suite MUST +use: -### Syntax -Each MLS session uses a single cipher suite that specifies the primitives to be used in group key computations. The cipher suite MUST use: - `X488` as Diffie-Hellman function. - `SHA256` as KDF. - `AES256-GCM` as AEAD algorithm. - `SHA512` as hash function. - `XEd448` for digital signatures. -Formats for public keys, signatures and public-key encryption MUST follow Section 5.1 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +Formats for public keys, signatures and public-key encryption MUST +follow Section 5.1 of +[RFC9420](https://datatracker.ietf.org/doc/rfc9420/). ### Hash-based identifiers + Some MLS messages refer to other MLS objects by hash. -These identifiers MUST be computed according to Section 5.2 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +These identifiers MUST be computed according to Section 5.2 of +[RFC9420](https://datatracker.ietf.org/doc/rfc9420/). ### Credentials -Each member of a group presents a credential that provides one or more identities for the member and associates them with the member's signing key. -The identities and signing key are verified by the Authentication Service in use for a group. -Credentials MUST follow the specifications of section 5.3 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +Each member of a group presents a credential that provides one or more +identities for the +member and associates them with the member's signing key. +The identities and signing key are verified by the Authentication +Service in use for a +group. -Below follows the flow diagram for the generation of credentials. +Credentials MUST follow the specifications of section 5.3 of +[RFC9420](https://datatracker.ietf.org/doc/rfc9420/). + +Below follows the flow diagram for the generation of credentials. Users MUST generate key pairs by themselves. ![figure1](./images/eth-secpm_credential.png) ### Message framing -Handshake and application messages use a common framing structure providing encryption to ensure confidentiality within the group, and signing to authenticate the sender. + +Handshake and application messages use a common framing structure +providing encryption to +ensure confidentiality within the group, and signing to authenticate +the sender. The structure is: -- `PublicMessage`: represents a message that is only signed, and not encrypted. -The definition and the encoding/decoding of a `PublicMessage` MUST follow the specification in section 6.2 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). -- `PrivateMessage`: represents a signed and encrypted message, with protections for both the content of the message and related metadata. -The definition, and the encoding/decoding of a `PrivateMessage` MUST follow the specification in section 6.3 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). -Applications MUST use `PrivateMessage` to encrypt application messages. +- `PublicMessage`: represents a message that is only signed, and not +encrypted. +The definition and the encoding/decoding of a `PublicMessage` MUST +follow the specification +in section 6.2 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +- `PrivateMessage`: represents a signed and encrypted message, with +protections for both the content of the message and related metadata. + +The definition, and the encoding/decoding of a `PrivateMessage` MUST +follow the specification in section 6.3 of +[RFC9420](https://datatracker.ietf.org/doc/rfc9420/). + +Applications MUST use `PrivateMessage` to encrypt application messages. Applications SHOULD use `PrivateMessage` to encode handshake messages. -Each encrypted MLS message carries a "generation" number which is a per-sender incrementing counter. -If a group member observes a gap in the generation sequence for a sender, -then they know that they have missed a message from that sender. +Each encrypted MLS message carries a "generation" number which is a +per-sender incrementing counter. +If a group member observes a gap in the generation sequence for a +sender, then they know that they have missed a message from that +sender. ### Nodes contents + The nodes of a ratchet tree contain several types of data: - Leaf nodes describe individual members. - Parent nodes describe subgroups. -Contents of each kind of node, and its structure MUST follow the indications described in sections 7.1 and 7.2 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +Contents of each kind of node, and its structure MUST follow the +indications described in +sections 7.1 and 7.2 of +[RFC9420](https://datatracker.ietf.org/docrfc9420/). ### Leaf node validation -`KeyPackage` objects describe the client's capabilities and provides keys that can be used to add the client to a group. -The validity of a leaf node needs to be verified at the following stages: -- When a leaf node is downloaded in a `KeyPackage`, before it is used to add the client to the group. -- When a leaf node is received by a group member in an Add, Update, or Commit message. +`KeyPackage` objects describe the client's capabilities and provides +keys that can be used to add the client to a group. + +The validity of a leaf node needs to be verified at the following +stages: + +- When a leaf node is downloaded in a `KeyPackage`, before it is used +to add the client to the group. +- When a leaf node is received by a group member in an Add, Update, or +Commit message. - When a client validates a ratchet tree. -A client MUST verify the validity of a leaf node following the instructions of section 7.3 in [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +A client MUST verify the validity of a leaf node following the +instructions of section 7.3 in +[RFC9420](https://datatracker.ietf.org/doc/rfc9420/). ### Ratchet tree evolution -Whenever a member initiates an epoch change, they MAY need to refresh the key pairs of their leaf and of the nodes on their direct path. This is done to keep forward secrecy and post-compromise security. -The member initiating the epoch change MUST follow this procedure procedure. + +Whenever a member initiates an epoch change, they MAY need to refresh +the key pairs of their leaf and of the nodes on their direct path. This +is done to keep forward secrecy and post-compromise security. +The member initiating the epoch change MUST follow this procedure +procedure. A member updates the nodes along its direct path as follows: + - Blank all the nodes on the direct path from the leaf to the root. - Generate a fresh HPKE key pair for the leaf. -- Generate a sequence of path secrets, one for each node on the leaf's filtered direct path. -It MUST follow the procedure described in section 7.4 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). -- Compute the sequence of HPKE key pairs `(node_priv,node_pub)`, one for each node on the leaf's direct path. -It MUST follow the procedure described in section 7.4 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +- Generate a sequence of path secrets, one for each node on the leaf's +filtered direct path. + +It MUST follow the procedure described in section 7.4 of [RFC9420 +(https://datatracker.ietf.org/doc/rfc9420/). + +- Compute the sequence of HPKE key pairs `(node_priv,node_pub)`, one +for each node on the leaf's direct path. + +It MUST follow the procedure described in section 7.4 of [RFC9420 +(https://datatracker.ietf.org/doc/rfc9420/). ### Views of the tree synchronization -After generating fresh key material and applying it to update their local tree state, the generator broadcasts this update to other members of the group. -This operation MUST be done according to section 7.5 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). + +After generating fresh key material and applying it to update their +local tree state, the generator broadcasts this update to other members +of the group. +This operation MUST be done according to section 7.5 of [RFC9420 +(https://datatracker.ietf.org/doc/rfc9420/). ### Leaf synchronization -Changes to group memberships MUST be represented by adding and removing leaves of the tree. -This corresponds to increasing or decreasing the depth of the tree, resulting in the number of leaves being doubled or halved. -These operations MUST be done as described in section 7.7 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). + +Changes to group memberships MUST be represented by adding and removing +leaves of the tree. +This corresponds to increasing or decreasing the depth of the tree, +resulting in the number of leaves being doubled or halved. +These operations MUST be done as described in section 7.7 of [RFC9420 +(https://datatracker.ietf.org/doc/rfc9420/). ### Tree and parent hashing -Group members can agree on the cryptographic state of the group by generating a hash value that represents the contents of the group ratchet tree and the member’s credentials. -The hash of the tree is the hash of its root node, defined recursively from the leaves. -Tree hashes summarize the state of a tree at point in time. -The hash of a leaf is the hash of the `LeafNodeHashInput` object. -At the same time, the hash of a parent node including the root, is the hash of a `ParentNodeHashInput` object. -Parent hashes capture information about how keys in the tree were populated. -Tree and parent hashing MUST follow the directions in Sections 7.8 and 7.9 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +Group members can agree on the cryptographic state of the group by +generating a hash value that represents the contents of the group +ratchet tree and the member’s credentials. +The hash of the tree is the hash of its root node, defined recursively +from the leaves. +Tree hashes summarize the state of a tree at point in time. +The hash of a leaf is the hash of the `LeafNodeHashInput` object. +At the same time, the hash of a parent node including the root, is the +hash of a `ParentNodeHashInput` object. +Parent hashes capture information about how keys in the tree were +populated. + +Tree and parent hashing MUST follow the directions in Sections 7.8 and +7.9 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). ### Key schedule -Group keys are derived using the `Extract` and `Expand` functions from the KDF for the group's cipher suite, as well as the functions defined below: + +Group keys are derived using the `Extract` and `Expand` functions from +the KDF for the group's cipher suite, as well as the functions defined +below: + +```text +ExpandWithLabel(Secret, Label, Context, Length) = KDF.Expand(Secret, +KDFLabel, Length) +DeriveSecret(Secret, Label) = ExpandWithLabel(Secret, Label, "", +KDF.Nh) ``` -ExpandWithLabel(Secret, Label, Context, Length) = KDF.Expand(Secret, KDFLabel, Length) -DeriveSecret(Secret, Label) = ExpandWithLabel(Secret, Label, "", KDF.Nh) -``` + `KDFLabel` MUST be specified as: -``` + +```text struct { uint16 length; opaque label; opaque context; } KDFLabel; + ``` + The fields of `KDFLabel` MUST be: -``` + +```text length = Length; label = "MLS 1.0 " + Label; context = Context; + ``` -Each member of the group MUST maintaint a `GroupContext` object summarizing the state of the group. +Each member of the group MUST maintaint a `GroupContext` object +summarizing the state of the group. + The sturcture of such object MUST be: -``` +```text struct { ProtocolVersion version = mls10; CipherSuite cipher_suite; @@ -388,50 +585,74 @@ opaque tree_hash; opaque confirmed_trasncript_hash; Extension extension; } GroupContext; + ``` -The use of key scheduling MUST follow the indications in sections 8.1 - 8.7 in [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +The use of key scheduling MUST follow the indications in sections 8.1 - +8.7 in [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). ### Secret trees -For the generation of encryption keys and nonces, the key schedule begins with the `encryption_secret` at the root and derives a tree of secrets with the same structure as the group's ratchet tree. -Each leaf in the secret tree is associated with the same group member as the corresponding leaf in the ratchet tree. -If `N` is a parent node in the secret tree, the secrets of the children of `N` MUST be defined following section 9 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +For the generation of encryption keys and nonces, the key schedule +begins with the `encryption_secret` at the root and derives a tree of +secrets with the same structure as the group's ratchet tree. +Each leaf in the secret tree is associated with the same group member +as the corresponding leaf in the ratchet tree. + +If `N` is a parent node in the secret tree, the secrets of the children +of `N` MUST be defined following section 9 of +[RFC9420](https://datatracker.ietf.org/doc/rfc9420/). #### Encryption keys MLS encrypts three different types of information: + - Metadata (sender information). - Handshake messages (Proposal and Commit). - Application messages. -For handshake and application messages, a sequence of keys is derived via a sender ratchet. -Each sender has their own sender ratchet, and each step along the ratchet is called a generation. These procedures MUST follow section 9.1 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +For handshake and application messages, a sequence of keys is derived +via a sender ratchet. +Each sender has their own sender ratchet, and each step along the +ratchet is called a generation. These procedures MUST follow section +9.1 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). #### Deletion schedule -All security-sensitive values MUST be deleted as soon as they are consumed. +All security-sensitive values MUST be deleted as soon as they are +consumed. + A sensitive value S is consumed if: -- S was used to encrypt or (successfully) decrypt a message. +- S was used to encrypt or (successfully) decrypt a message. - A key, nonce, or secret derived from S has been consumed. -The deletion procedure MUST follow the instruction described in section 9.2 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +The deletion procedure MUST follow the instruction described in section +9.2 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). ### Key packages -KeyPackage objects are used to ease the addition of clients to a group asynchronously. + +KeyPackage objects are used to ease the addition of clients to a group +asynchronously. A KeyPackage object specifies: - Protocol version and cipher suite supported by the client. -- Public keys that can be used to encrypt Welcome messages. Welcome messages provide new members with the information to initialize their state for the epoch in which they were added or in which they want to add themselves to the group -- The content of the leaf node that should be added to the tree to represent this client. +- Public keys that can be used to encrypt Welcome messages. +Welcome messages provide new members with the information +to initialize their +state for the epoch in which they were added or in which they want to +add themselves to the group +- The content of the leaf node that should be added to the tree to +represent this client. -KeyPackages are intended to be used only once and SHOULD NOT be reused. +KeyPackages are intended to be used only once and SHOULD NOT be reused. -Clients MAY generate and publish multiple KeyPackages to support multiple cipher suites. +Clients MAY generate and publish multiple KeyPackages to support +multiple cipher suites. The structure of the object MUST be: -``` + +```text struct { ProtocolVersion version; CipherSuite cipher_suite; @@ -441,8 +662,10 @@ Extension extensions; /* SignWithLabel(., "KeyPackageTBS", KeyPackageTBS) */ opaque signature; } + ``` -``` + +```text struct { ProtocolVersion version; CipheSuite cipher_suite; @@ -450,37 +673,59 @@ HPKEPublicKey init_key; LeafNode leaf_node; Extension extensions; } + ``` + `KeyPackage` object MUST be verified when: -- A `KeyPackage` is downloaded by a group member, before it is used to add the client to the group. -- When a `KeyPackage` is received by a group member in an `Add` message. + +- A `KeyPackage` is downloaded by a group member, before it is used to +add the client to the group. +- When a `KeyPackage` is received by a group member in an `Add` +message. Verification MUST be done as follows: -- Verify that the cipher suite and protocol version of the `KeyPackage` match those in the `GroupContext`. -- Verify that the `leaf_node` of the `KeyPackage` is valid for a `KeyPackage`. + +- Verify that the cipher suite and protocol version of the `KeyPackage` +match those in the `GroupContext`. +- Verify that the `leaf_node` of the `KeyPackage` is valid for a +`KeyPackage`. - Verify that the signature on the `KeyPackage` is valid. -- Verify that the value of `leaf_node.encryption_key` is different from the value of the `init_key field`. +- Verify that the value of `leaf_node.encryption_key` is different from +the value of the `init_key field`. -HPKE public keys are opaque values in a format defined by Section 4 of [RFC9180](https://datatracker.ietf.org/doc/rfc9180/). +HPKE public keys are opaque values in a format defined by Section 4 of +[RFC9180](https://datatracker.ietf.org/doc/rfc9180/). -Signature public keys are represented as opaque values in a format defined by the cipher suite's signature scheme. +Signature public keys are represented as opaque values in a format +defined by the cipher suite's signature scheme. ### Group creation -A group is always created with a single member. -Other members are then added to the group using the usual Add/Commit mechanism. + +A group is always created with a single member. +Other members are then added to the group using the usual Add/Commit +mechanism. The creator of a group MUST set: -- the group ID. + +- the group ID. - cipher suite. -- initial extensions for the group. +- initial extensions for the group. -If the creator intends to add other members at the time of creation, then it SHOULD fetch `KeyPackages` for those members, and select a cipher suite and extensions according to their capabilities. +If the creator intends to add other members at the time of creation, +then it SHOULD fetch `KeyPackages` for those members, and select a +cipher suite and extensions according to their capabilities. -The creator MUST use the capabilities information in these `KeyPackages` to verify that the chosen version and cipher suite is the best option supported by all members. +The creator MUST use the capabilities information in these +`KeyPackages` to verify that the chosen version and cipher suite is the +best option supported by all members. -Group IDs SHOULD be constructed so they are unique with high probability. +Group IDs SHOULD be constructed so they are unique with high +probability. -To initialize a group, the creator of the group MUST initialize a one-member group with the following initial values: -- Ratchet tree: A tree with a single node, a leaf node containing an HPKE public key and credential for the creator. +To initialize a group, the creator of the group MUST initialize a one +member group with the following initial values: + +- Ratchet tree: A tree with a single node, a leaf node containing an +HPKE public key and credential for the creator. - Group ID: A value set by the creator. - Epoch: `0`. - Tree hash: The root hash of the above ratchet tree. @@ -489,137 +734,218 @@ To initialize a group, the creator of the group MUST initialize a one-member gro - Extensions: Any values of the creator's choosing. The creator MUST also calculate the interim transcript hash: -- Derive the `confirmation_key` for the epoch according to Section 8 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). -- Compute a `confirmation_tag` over the empty `confirmed_transcript_hash` using the `confirmation_key` as described in Section 8.1 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). -- Compute the updated `interim_transcript_hash` from the `confirmed_transcript_hash` and the `confirmation_tag` as described in Section 8.2 [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). -All members of a group MUST support the cipher suite and protocol version in use. Additional requirements MAY be imposed by including a `required_capabilities` extension in the `GroupContext`. +- Derive the `confirmation_key` for the epoch according to Section 8 of +[RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +- Compute a `confirmation_tag` over the empty +`confirmed_transcript_hash` using the `confirmation_key` as described +in Section 8.1 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +- Compute the updated `interim_transcript_hash` from the +`confirmed_transcript_hash` and the `confirmation_tag` as described in +Section 8.2 [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). -``` +All members of a group MUST support the cipher suite and protocol +version in use. Additional requirements MAY be imposed by including a +`required_capabilities` extension in the `GroupContext`. + +```text struct { ExtensionType extension_types; ProposalType proposal_types; CredentialType credential_types; } + ``` -The flow diagram shows the procedure to fetch key material from other users: + +The flow diagram shows the procedure to fetch key material from other +users: ![figure2](./images/eth-secpm_fetching.png) Below follows the flow diagram for the creation of a group: ![figure3](./images/eth-secpm_creation.png) ### Group evolution -Group membership can change, and existing members can change their keys in order to achieve post-compromise security. + +Group membership can change, and existing members can change their keys +in order to achieve post-compromise security. In MLS, each such change is accomplished by a two-step process: -- A proposal to make the change is broadcast to the group in a Proposal message. -- A member of the group or a new member broadcasts a Commit message that causes one or more proposed changes to enter into effect. -The group evolves from one cryptographic state to another each time a Commit message is sent and processed. -These states are called epochs and are uniquely identified among states of the group by eight-octet epoch values. +- A proposal to make the change is broadcast to the group in a Proposal +message. +- A member of the group or a new member broadcasts a Commit message +that causes one or more proposed changes to enter into effect. -Proposals are included in a `FramedContent` by way of a `Proposal` structure that indicates their type: +The group evolves from one cryptographic state to another each time a +Commit message is sent and processed. +These states are called epochs and are uniquely identified among states +of the group by eight-octet epoch values. -``` +Proposals are included in a `FramedContent` by way of a `Proposal` +structure that indicates their type: + +```text struct { ProposalType proposal_type; select (Proposal.proposal_type) { -case add: Add: -case update: Update; -case remove: Remove; -case psk: PreSharedKey; -case reinit: ReInit; -case external_init: ExternalInit; -case group_context_extensions: GroupContextExtensions; +case add: Add: +case update: Update; +case remove: Remove; +case psk: PreSharedKey; +case reinit: ReInit; +case external_init: ExternalInit; +case group_context_extensions: GroupContextExtensions; } + ``` -On receiving a `FramedContent` containing a `Proposal`, a client MUST verify the signature inside `FramedContentAuthData` and that the epoch field of the enclosing FramedContent is equal to the epoch field of the current GroupContext object. -If the verification is successful, then the Proposal SHOULD be cached in such a way that it can be retrieved by hash in a later Commit message. + +On receiving a `FramedContent` containing a `Proposal`, a client MUST +verify the signature inside `FramedContentAuthData` and that the epoch +field of the enclosing FramedContent is equal to the epoch field of the +current GroupContext object. +If the verification is successful, then the Proposal SHOULD be cached +in such a way that it can be retrieved by hash in a later Commit +message. Proposals are organized as follows: -- `Add`: requests that a client with a specified KeyPackage be added to the group. -- `Update`: similar to Add, it replaces the sender's LeafNode in the tree instead of adding a new leaf to the tree. -- `Remove`: requests that the member with the leaf index removed be removed from the group. -- `ReInit`: requests to reinitialize the group with different parameters. -- `ExternalInit`: used by new members that want to join a group by using an external commit. -- `GroupContentExtensions`: it is used to update the list of extensions in the GroupContext for the group. -Proposals structure and semantics MUST follow sections 12.1.1 - 12.1.7 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +- `Add`: requests that a client with a specified KeyPackage be added to +the group. +- `Update`: similar to Add, it replaces the sender's LeafNode in the +tree instead of adding a new leaf to the tree. +- `Remove`: requests that the member with the leaf index removed be +removed from the group. +- `ReInit`: requests to reinitialize the group with different +parameters. +- `ExternalInit`: used by new members that want to join a group by +using an external commit. +- `GroupContentExtensions`: it is used to update the list of extensions +in the GroupContext for the group. -Any list of commited proposals MUST be validated either by a the group member who created the commit, or any group member processing such commit. -The validation MUST be done according to one of the procedures described in Section 12.2 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +Proposals structure and semantics MUST follow sections 12.1.1 - 12.1.7 +of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). -When creating or processing a Commit, a client applies a list of proposals to the ratchet tree and `GroupContext`. -The client MUST apply the proposals in the list in the order described in Section 12.3 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +Any list of commited proposals MUST be validated either by a the group +member who created the commit, or any group member processing such +commit. +The validation MUST be done according to one of the procedures +described in Section 12.2 of +[RFC9420](https://datatracker.ietf.orgdoc/rfc9420/). + +When creating or processing a Commit, a client applies a list of +proposals to the ratchet tree and `GroupContext`. +The client MUST apply the proposals in the list in the order described +in Section 12.3 of [RFC9420](https://datatracker.ietf.org/docrfc9420/). Below follows the flow diagram for the addition of a member to a group: ![figure4](./images/eth-secpm_add.png) The diagram below shows the procedure to remove a group member: -
+ ![figure5](./images/eth-secpm_remove.png) The flow diagram below shows an update procedure: -
+ ![figure6](./images/eth-secpm_update.png) - ### Commit messages -Commit messages initiate new group epochs. -It informs group members to update their representation of the state of the group by applying the proposals and advancing the key schedule. -Each proposal covered by the Commit is included by a `ProposalOrRef` value. -`ProposalOrRef` identify the proposal to be applied by value or by reference. -Commits that refer to new Proposals from the committer can be included by value. -Commits for previously sent proposals from anyone can be sent by reference. -Proposals sent by reference are specified by including the hash of the `AuthenticatedContent`. +Commit messages initiate new group epochs. +It informs group members to update their representation of the state of +the group by applying the proposals and advancing the key schedule. -Group members that have observed one or more valid proposals within an epoch MUST send a Commit message before sending application data. -A sender and a receiver of a Commit MUST verify that the committed list of proposals is valid. -The sender of a Commit SHOULD include all valid proposals received during the current epoch. +Each proposal covered by the Commit is included by a `ProposalOrRef` +value. +`ProposalOrRef` identify the proposal to be applied by value or by +reference. +Commits that refer to new Proposals from the committer can be included +by value. +Commits for previously sent proposals from anyone can be sent by +reference. +Proposals sent by reference are specified by including the hash of the +`AuthenticatedContent`. -Functioning of commits MUST follow the instructions of Section 12.4 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +Group members that have observed one or more valid proposals within an +epoch MUST send a Commit message before sending application data. +A sender and a receiver of a Commit MUST verify that the committed list +of proposals is valid. +The sender of a Commit SHOULD include all valid proposals received +during the current epoch. + +Functioning of commits MUST follow the instructions of Section 12.4 of +[RFC9420](https://datatracker.ietf.org/doc/rfc9420/). ### Application messages -Handshake messages provide an authenticated group key exchange to clients. -To protect application messages sent among the members of a group, the `encryption_secret` provided by the key schedule is used to derive a sequence of nonces and keys for message encryption. -Each client MUST maintain their local copy of the key schedule for each epoch during which they are a group member. -They derive new keys, nonces, and secrets as needed. This data MUST be deleted as soon as they have been used. +Handshake messages provide an authenticated group key exchange to +clients. +To protect application messages sent among the members of a group, the +`encryption_secret` provided by the key schedule is used to derive a +sequence of nonces and keys for message encryption. -Group members MUST use the AEAD algorithm associated with the negotiated MLS ciphersuite to encrypt and decrypt Application messages according to the Message Framing section. -The group identifier and epoch allow a device to know which group secrets should be used and from which Epoch secret to start computing other secrets and keys. -Application messages SHOULD be padded to provide resistance against traffic analysis techniques. -This avoids additional information to be provided to an attacker in order to guess the length of the encrypted message. -Padding SHOULD be used on messages with zero-valued bytes before AEAD encryption. +Each client MUST maintain their local copy of the key schedule for each +epoch during which they are a group member. +They derive new keys, nonces, and secrets as needed. This data MUST be +deleted as soon as they have been used. -Functioning of application messages MUST follow the instructions of Section 15 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). +Group members MUST use the AEAD algorithm associated with the +negotiated MLS ciphersuite to encrypt and decrypt Application messages +according to the Message Framing section. +The group identifier and epoch allow a device to know which group +secrets should be used and from which Epoch secret to start computing +other secrets and keys. +Application messages SHOULD be padded to provide resistance against +traffic analysis techniques. +This avoids additional information to be provided to an attacker in +order to guess the length of the encrypted message. +Padding SHOULD be used on messages with zero-valued bytes before AEAD +encryption. + +Functioning of application messages MUST follow the instructions of +Section 15 of [RFC9420](https://datatracker.ietf.org/doc/rfc9420/). ### Considerations with respect to decentralization -The MLS protocol assumes the existence on a (central, untrusted) *delivery service*, whose responsabilites include: -- Acting as a directory service providing the initial keying material for clients to use. +The MLS protocol assumes the existence on a (central, untrusted) +*delivery service*, whose responsabilites include: + +- Acting as a directory service providing the initial +keying material for clients to use. - Routing MLS messages among clients. -The central delivery service can be avoided in protocols using the publish/gossip approach, such as [gossipsub](https://github.com/libp2p/specs/tree/master/pubsub/gossipsub). +The central delivery service can be avoided in protocols using the +publish/gossip approach, such as +[gossipsub](https://github.com/libp2p/specs/tree/master/pubsub/gossipsub). -Concerning keys, each node can generate and disseminate their encryption key among the other nodes, so they can create a local version of the tree that allows for the generation of the group key. +Concerning keys, each node can generate and disseminate their +encryption key among the other nodes, so they can create a local +version of the tree that allows for the generation of the group key. -Another important component is the *authentication service*, which is replaced with SIWE in this specification. +Another important component is the *authentication service*, which is +replaced with SIWE in this specification. ## Ethereum-based authentication protocol -### Theory -Sign-in with Ethereum describes how Ethereum accounts authenticate with off-chain services by signing a standard message format + +### Introduction + +Sign-in with Ethereum describes how Ethereum accounts authenticate with +off-chain services by signing a standard message format parameterized by scope, session details, and security mechanisms. -Sign-in with Ethereum (SIWE), which is described in the [EIP 4361](https://eips.ethereum.org/EIPS/eip-4361), MUST be the authentication method required. +Sign-in with Ethereum (SIWE), which is described in the [EIP 4361 +(https://eips.ethereum.org/EIPS/eip-4361), MUST be the authentication +method required. + +### Pattern -### Syntax #### Message format (ABNF) -A SIWE Message MUST conform with the following Augmented Backus–Naur Form ([RFC 5234](https://datatracker.ietf.org/doc/html/rfc5234)) expression. -``` +A SIWE Message MUST conform with the following Augmented Backus–Naur +Form ([RFC 5234](https://datatracker.ietf.org/doc/html/rfc5234)) +expression. + +```text sign-in-with-ethereum = - [ scheme "://" ] domain %s" wants you to sign in with your Ethereum account:" LF - address LF + [ scheme "://" ] domain %s" wants you to sign in with your + Ethereum account:" LF address LF LF [ statement LF ] LF @@ -678,156 +1004,350 @@ request-id = *pchar resources = *( LF resource ) resource = "- " URI + ``` -This specification defines the following SIWE Message fields that can be parsed from a SIWE Message by following the rules in ABNF Message Format: +This specification defines the following SIWE Message fields that can +be parsed from a SIWE Message by following the rules in ABNF Message +Format: -- `scheme` OPTIONAL. The URI scheme of the origin of the request. -Its value MUST be a [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986) URI scheme. +- `scheme` OPTIONAL. The URI scheme of the origin of the request. +Its value MUST be a +[RFC 3986](https://datatracker.ietf.org/doc/htmlrfc3986) +URI scheme. -- `domain` REQUIRED. The domain that is requesting the signing. -Its value MUST be a [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986) authority. The authority includes an OPTIONAL port. -If the port is not specified, the default port for the provided scheme is assumed. +- `domain` REQUIRED. +The domain that is requesting the signing. +Its value MUST be a [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986) +authority. The authority includes an OPTIONAL port. +If the port is not specified, the default +port for the provided scheme is assumed. If scheme is not specified, HTTPS is assumed by default. -- `address` REQUIRED. The Ethereum address performing the signing. -Its value SHOULD be conformant to mixed-case checksum address encoding specified in ERC-55 where applicable. -- `statement` OPTIONAL. A human-readable ASCII assertion that the user will sign which MUST NOT include '\n' (the byte 0x0a). -- `uri` REQUIRED. An [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986) URI referring to the resource that is the subject of the signing. +- `address` REQUIRED. The Ethereum address performing the signing. +Its value SHOULD be conformant to mixed-case checksum address encoding +specified in ERC-55 where applicable. -- `version` REQUIRED. The current version of the SIWE Message, which MUST be 1 for this specification. +- `statement` OPTIONAL. A human-readable ASCII assertion that the user +will sign which MUST NOT include '\n' (the byte 0x0a). +- `uri` REQUIRED. An +[RFC 3986](https://datatracker.ietf.org/doc/htmlrfc3986) +URI referring to the resource that is the subject of the +signing. -- `chain-id` REQUIRED. The EIP-155 Chain ID to which the session is bound, and the network where Contract Accounts MUST be resolved. +- `version` REQUIRED. The current version of the SIWE Message, which +MUST be 1 for this specification. -- `nonce` REQUIRED. A random string (minimum 8 alphanumeric characters) chosen by the relying party and used to prevent replay attacks. +- `chain-id` REQUIRED. The EIP-155 Chain ID to which the session is +bound, and the network where Contract Accounts MUST be resolved. + +- `nonce` REQUIRED. A random string (minimum 8 alphanumeric characters) +chosen by the relying party and used to prevent replay attacks. + +- `issued-at` REQUIRED. The time when the message was generated, +typically the current time. -- `issued-at` REQUIRED. The time when the message was generated, typically the current time. Its value MUST be an ISO 8601 datetime string. -- `expiration-time` OPTIONAL. The time when the signed authentication message is no longer valid. +- `expiration-time` OPTIONAL. The time when the signed authentication +message is no longer valid. + Its value MUST be an ISO 8601 datetime string. -- `not-before` OPTIONAL. The time when the signed authentication message will become valid. +- `not-before` OPTIONAL. The time when the signed authentication +message will become valid. + Its value MUST be an ISO 8601 datetime string. -- `request-id` OPTIONAL. An system-specific identifier that MAY be used to uniquely refer to the sign-in request. +- `request-id` OPTIONAL. An system-specific identifier that MAY be used +to uniquely refer to the sign-in request. -- `resources` OPTIONAL. A list of information or references to information the user wishes to have resolved as part of authentication by the relying party. -Every resource MUST be a RFC 3986 URI separated by "\n- " where \n is the byte 0x0a. +- `resources` OPTIONAL. A list of information or references to +information the user wishes to have resolved as part of authentication +by the relying party. + +Every resource MUST be a RFC 3986 URI separated by "\n- " where \n is +the byte 0x0a. #### Signing and Verifying Messages with Ethereum Accounts -- For Externally Owned Accounts, the verification method specified in [ERC-191](https://eips.ethereum.org/EIPS/eip-191) MUST be used. + +- For Externally Owned Accounts, the verification method specified in +[ERC-191](https://eips.ethereum.org/EIPS/eip-191) +MUST be used. - For Contract Accounts, - - The verification method specified in [ERC-1271](https://eips.ethereum.org/EIPS/eip-1271) SHOULD be used. -Otherwise, the implementer MUST clearly define the verification method to attain security and interoperability for both wallets and relying parties. + - The verification method specified in +[ERC-1271](https://eips.ethereum.org/EIPS/eip-1271) +SHOULD be used. +Otherwise, the implementer MUST clearly define the +verification method +to attain security and interoperability for both +wallets and relying parties. - - When performing [ERC-1271](https://eips.ethereum.org/EIPS/eip-1271) signature verification, the contract performing the verification MUST be resolved from the specified `chain-id`. + - When performing [ERC-1271](https://eips.ethereum.org/EIPS/eip-1271) +signature verification, the contract performing the verification MUST +be resolved from the specified `chain-id`. - - Implementers SHOULD take into consideration that [ERC-1271](https://eips.ethereum.org/EIPS/eip-1271) implementations are not required to be pure functions. -They can return different results for the same inputs depending on blockchain state. + - Implementers SHOULD take into consideration that [ERC-1271 +(https://eips.ethereum.org/EIPS/eip-1271) implementations are not +required to be pure functions. +They can return different results for the same inputs depending on +blockchain state. This can affect the security model and session validation rules. #### Resolving Ethereum Name Service (ENS) Data -- The relying party or wallet MAY additionally perform resolution of ENS data, as this can improve the user experience by displaying human-friendly information that is related to the `address`. -Resolvable ENS data include: - - The primary ENS name. - - The ENS avatar. - - Any other resolvable resources specified in the ENS documentation. -- If resolution of ENS data is performed, implementers SHOULD take precautions to preserve user privacy and consent. -Their `address` could be forwarded to third party services as part of the resolution process. +- The relying party or wallet MAY additionally perform resolution of +ENS data, as this can improve the user experience by displaying human +friendly information that is related to the `address`. +Resolvable ENS data include: + + - The primary ENS name. + - The ENS avatar. + - Any other resolvable resources specified in the ENS documentation. + +- If resolution of ENS data is performed, implementers SHOULD take +precautions to preserve user privacy and consent. +Their `address` could be forwarded to third party services as part of +the resolution process. #### Implementer steps: specifying the request origin -The `domain` and, if present, the `scheme`, in the SIWE Message MUST correspond to the origin from where the signing request was made. + +The `domain` and, if present, the `scheme`, in the SIWE Message MUST +correspond to the origin from where the signing request was made. #### Implementer steps: verifying a signed message -The SIWE Message MUST be checked for conformance to the ABNF Message Format and its signature MUST be checked as defined in Signing and Verifying Messages with Ethereum Accounts. + +The SIWE Message MUST be checked for conformance to the ABNF Message +Format and its signature MUST be checked as defined in Signing and +Verifying Messages with Ethereum Accounts. #### Implementer steps: creating sessions -Sessions MUST be bound to the address and not to further resolved resources that can change. + +Sessions MUST be bound to the address and not to further resolved +resources that can change. #### Implementer steps: interpreting and resolving resources -Implementers SHOULD ensure that that URIs in the listed resources are human-friendly when expressed in plaintext form. + +Implementers SHOULD ensure that that URIs in the listed resources are +human-friendly when expressed in plaintext form. #### Wallet implementer steps: verifying the message format -The full SIWE message MUST be checked for conformance to the ABNF defined in ABNF Message Format. -Wallet implementers SHOULD warn users if the substring `"wants you to sign in with your Ethereum account"` appears anywhere in an [ERC-191](https://eips.ethereum.org/EIPS/eip-191) message signing request unless the message fully conforms to the format defined ABNF Message Format. +The full SIWE message MUST be checked for conformance to the ABNF +defined in ABNF Message Format. + +Wallet implementers SHOULD warn users if the substring `"wants you to +sign in with your Ethereum account"` appears anywhere in an [ERC-191 +(https://eips.ethereum.org/EIPS/eip-191) message signing request unless +the message fully conforms to the format defined ABNF Message Format. #### Wallet implementer steps: verifying the request origin -Wallet implementers MUST prevent phishing attacks by verifying the origin of the request against the `scheme` and `domain` fields in the SIWE Message. -The origin SHOULD be read from a trusted data source such as the browser window or over WalletConnect [ERC-1328](https://eips.ethereum.org/EIPS/eip-1328) sessions for comparison against the signing message contents. +Wallet implementers MUST prevent phishing attacks by verifying the +origin of the request against the `scheme` and `domain` fields in the +SIWE Message. -Wallet implementers MAY warn instead of rejecting the verification if the origin is pointing to localhost. +The origin SHOULD be read from a trusted data source such as the +browser window or over WalletConnect +[ERC-1328](https://eips.ethereum.org/EIPS/eip-1328) sessions for +comparison against the +signing message contents. -The following is a RECOMMENDED algorithm for Wallets to conform with the requirements on request origin verification defined by this specification. +Wallet implementers MAY warn instead of rejecting the verification if +the origin is pointing to localhost. + +The following is a RECOMMENDED algorithm for Wallets to conform with +the requirements on request origin verification defined by this +specification. The algorithm takes the following input variables: - fields from the SIWE message. -- `origin` of the signing request: the origin of the page which requested the signin via the provider. +- `origin` of the signing request: the origin of the page which +requested the signin via the provider. - `allowedSchemes`: a list of schemes allowed by the Wallet. -- `defaultScheme`: a scheme to assume when none was provided. Wallet implementers in the browser SHOULD use https. -- developer mode indication: a setting deciding if certain risks should be a warning instead of rejection. Can be manually configured or derived from `origin` being localhost. +- `defaultScheme`: a scheme to assume when none was provided. Wallet +implementers in the browser SHOULD use https. +- developer mode indication: a setting deciding if certain risks should +be a warning instead of rejection. Can be manually configured or +derived from `origin` being localhost. The algorithm is described as follows: - If `scheme` was not provided, then assign `defaultScheme` as scheme. -- If `scheme` is not contained in `allowedSchemes`, then the `scheme` is not expected and the Wallet MUST reject the request. -Wallet implementers in the browser SHOULD limit the list of allowedSchemes to just 'https' unless a developer mode is activated. -- If `scheme` does not match the scheme of origin, the Wallet SHOULD reject the request. -Wallet implementers MAY show a warning instead of rejecting the request if a developer mode is activated. +- If `scheme` is not contained in `allowedSchemes`, then the `scheme` +is not expected and the Wallet MUST reject the request. +Wallet implementers in the browser SHOULD limit the list of +allowedSchemes to just 'https' unless a developer mode is activated. +- If `scheme` does not match the scheme of origin, the Wallet SHOULD +reject the request. +Wallet implementers MAY show a warning instead of rejecting the request +if a developer mode is activated. In that case the Wallet continues processing the request. -- If the `host` part of the `domain` and `origin` do not match, the Wallet MUST reject the request unless the Wallet is in developer mode. -In developer mode the Wallet MAY show a warning instead and continues procesing the request. -- If `domain` and `origin` have mismatching subdomains, the Wallet SHOULD reject the request unless the Wallet is in developer mode. -In developer mode the Wallet MAY show a warning instead and continues procesing the request. -- Let `port` be the port component of `domain`, and if no port is contained in domain, assign port the default port specified for the scheme. -- If `port` is not empty, then the Wallet SHOULD show a warning if the `port` does not match the port of `origin`. -- If `port` is empty, then the Wallet MAY show a warning if `origin` contains a specific port. +- If the `host` part of the `domain` and `origin` do not match, the +Wallet MUST reject the request unless the Wallet is in developer mode. +In developer mode the Wallet MAY show a warning instead and continues +procesing the request. +- If `domain` and `origin` have mismatching subdomains, the Wallet +SHOULD reject the request unless the Wallet is in developer mode. +In developer mode the Wallet MAY show a warning instead and continues +procesing the request. +- Let `port` be the port component of `domain`, and if no port is +contained in domain, assign port the default port specified for the +scheme. +- If `port` is not empty, then the Wallet SHOULD show a warning if the +`port` does not match the port of `origin`. +- If `port` is empty, then the Wallet MAY show a warning if `origin` +contains a specific port. - Return request origin verification completed. #### Wallet implementer steps: creating SIWE interfaces -Wallet implementers MUST display to the user the following fields from the SIWE Message request by default and prior to signing, if they are present: `scheme`, `domain`, `address`, `statement`, and `resources`. -Other present fields MUST also be made available to the user prior to signing either by default or through an extended interface. -Wallet implementers displaying a plaintext SIWE Message to the user SHOULD require the user to scroll to the bottom of the text area prior to signing. +Wallet implementers MUST display to the user the following fields from +the SIWE Message request by default and prior to signing, if they are +present: `scheme`, `domain`, `address`, `statement`, and `resources`. +Other present fields MUST also be made available to the user prior to +signing either by default or through an extended interface. -Wallet implementers MAY construct a custom SIWE user interface by parsing the ABNF terms into data elements for use in the interface. +Wallet implementers displaying a plaintext SIWE Message to the user +SHOULD require the user to scroll to the bottom of the text area prior +to signing. + +Wallet implementers MAY construct a custom SIWE user interface by +parsing the ABNF terms into data elements for use in the interface. The display rules above still apply to custom interfaces. #### Wallet implementer steps: supporting internationalization (i18n) -After successfully parsing the message into ABNF terms, translation MAY happen at the UX level per human language. + +After successfully parsing the message into ABNF terms, translation MAY +happen at the UX level per human language. ## Privacy and Security Considerations -- The double ratchet "recommends" using AES in CBC mode. Since encryption must be with an AEAD encryption scheme, we will use AES in GCM mode instead (supported by Noise). -- For the information retrieval, the algorithm MUST include a access control mechanisms to restrict who can call the set and get functions. + +- The double ratchet "recommends" using AES in CBC mode. Since +encryption must be with an AEAD encryption scheme, we will use AES in +GCM mode instead (supported by Noise). +- For the information retrieval, the algorithm MUST include a access +control mechanisms to restrict who can call the set and get functions. - One SHOULD include event logs to track changes in public keys. -- The curve vurve448 MUST be chosen due to its higher security level: 224-bit security instead of the 128-bit security provided by X25519. +- The curve vurve448 MUST be chosen due to its higher security level: +224-bit security instead of the 128-bit security provided by X25519. - It is important that Bob MUST NOT reuse `SPK`. ## Considerations related to the use of Ethereum addresses + ### With respect to the Authentication Service -- If users used their Ethereum addresses as identifiers, they MUST generate their own credentials. -These credentials MUST use the digital signature key pair associated to the Ethereum address. + +- If users used their Ethereum addresses as identifiers, they MUST +generate their own credentials. +These credentials MUST use the digital signature key pair associated to +the Ethereum address. - Other users can verify credentials. -- With this approach, there is no need to have a dedicated Authentication Service responsible for the issuance and verification of credentials. -- The interaction diagram showing the generation of credentials becomes obsolete. +- With this approach, there is no need to have a dedicated +Authentication Service responsible for the issuance and verification of +credentials. +- The interaction diagram showing the generation of credentials becomes +obsolete. ### With respect to the Delivery Service + - Users MUST generate their own KeyPackage. - Other users can verify KeyPackages when required. -- A Delivery Service storage system MUST verify KeyPackages before storing them. +- A Delivery Service storage system MUST verify KeyPackages before +storing them. - Interaction diagrams involving the DS do not change. +## Consideration related to the onchain component of the protocol + +### Assumptions + +- Users have set a secure 1-1 communication channel. +- Each group is managed by a separate smart contract. + +### Addition of members to a group + +#### Alice knows Bob’s Ethereum address + +1. Off-chain - Alice and Bob set a secure communication channel. +2. Alice creates the smart contract associated to the group. This smart +contract MUST include an ACL. +3. Alice adds Bob’s Ethereum address to the ACL. +4. Off-chain - Alice sends a request to join the group to Bob. The +request MUST include the contract’s address: `RequestMLSPayload {"You +are joining the group with smart contract: 0xabcd"}` +5. Off-chain - Bob responds the request with a digitally signed +response. This response includes Bob’s credentials and key package: +`ResponseMLSPayload {sig: signature(ethereum_sk, message_to_sign), +address: ethereum_address, credentials, keypackage}` +6. Off-chain - Alice verifies the signature, using Bob’s `ethereum_pk` +and checks that it corresponds to an address contained in the ACL. +7. Off-chain - Alice sends a welcome message to Bob. +8. Off-chain - Alice SHOULD broadcasts a message announcing the +addition of Bob to other users of the group. +![figure7](./images/eth-secpm_onchain-register-1.png) + +#### Alice does not know Bob’s Ethereum address + +1. Off-chain - Alice and Bob set a secure communication channel. +2. Alice creates the smart contract associated to the group. +This smart contract MUST include an ACL. +3. Off-chain - Alice sends a request to join the group to Bob. The +request MUST include the contract’s address: +`RequestMLSPayload{"You are joining the group +with smart contract: 0xabcd"}` +4. Off-chain - Bob responds the request with a digitally signed +response. This response includes Bob’s credentials, his Ethereum +address and key package: `ResponseMLSPayload {sig: +signature(ethereum_sk, message_to_sign), address: ethereum_address, +credentials, keypackage}` +5. Off-chain - Alice verifies the signature using Bob’s `ethereum_pk`. +6. Upon reception of Bob’s data, Alice registers data with the smart +contract. +7. Off-chain - Alice sends a welcome message to Bob. +8. Off-chain - Alice SHOULD broadcasts a message announcing the +addition of Bob to other users of the group. + +![figure8](./images/eth-secpm_onchain-register-2.png) + +### Considerations regarding smart contracts + +The role of the smart contract includes: + +- Register user information and key packages: +As described in the previous section. +- Updates of key material. + - Users MUST send any update in their key material to the other +users of the group via off-chain messages. + - Upon reception of the new key material, the creator of the +contract MUST update the state of the smart contract. +- Deletion of users. + - Any user can submit a proposal for the removal of a user via +off-chain message. + - This proposal MUST be sent to the creator of the contract. + - The creator of the contract MUST update the ACL, and send +messages to the group for key update. + +![figure9](./images/eth-secpm_onchain-update.png) + +> It is important to note that both +user removal and updates of any kind +have a similar interaction flow. + +- Queries of existing users. + - Any user can query the smart contract to know the state of the +group, including existing users and removed ones. + - This aspect MUST be used when adding new members to verify that +the prospective key package has not been already used. + ## Copyright + Copyright and related rights waived via [CC0](https://creativecommons.org/publicdomain/zero/1.0/). -# References +## References + - [Augmented BNF for Syntax Specifications](https://datatracker.ietf.org/doc/html/rfc5234) - [Gossipsub](https://github.com/libp2p/specs/tree/master/pubsub/gossipsub) - [HMAC-based Extract-and-Expand Key Derivation Function](https://www.ietf.org/rfc/rfc5869.txt) diff --git a/vac/raw/images/eth-secpm_onchain-register-1.png b/vac/raw/images/eth-secpm_onchain-register-1.png new file mode 100644 index 0000000000000000000000000000000000000000..0fb8b2de0e18df8ac11dc04c215d93d4288fe97f GIT binary patch literal 55307 zcmeFZby(C}-|w%8f>JUlAxI9Of*{>J#L$A22TuOIaFdr@&cavJJUm2TKKMnj@3Us+X>OMAkX7>1-yS{0efeJ4Mj2H#nn*KU*41;;CQeW^*d2F6y$G_ioj1X^=u8M_jU!4EA z5afqwOb32K1V2O`@2xZQ(?Uz{he zSDBOgP~%3tnG+mBrT1qjtM=-fu;|mld-`fKc*-C>Va~9ax36D`MhlTK!4b=2c}w%4 z#exkDo^%(w`az3x?qyk4#yrn1Pz#V&6i1I$&&flC+BJE|WW~|iR43_Atv|DH!qfM= z7HJT%Ddq|+O+Af#dBv94YmAQ@Gd5*Ep1TaZhd!|0Y*#YbSA6HCe-aJrT}L2INI!Hy zQINRPEBfA%WDBPh?awlnRJ;a^Q=e}Jqzy08i#5P-Z)Zhs8eK`N*D!&tK zNRKW_W^Ga&e?u4?_X@OHQw(&eU5&?23iJs{aL`6}2c|~;JGB<>XvR1n0_o}duQ1Pj z`7cylZYW9^ovc%Yhi>J5{L57__W8?=?1UT9nDl%i|H_wKnbl(t+U=C~1RWRf_~eFs zEv7EDR%>;xzpJe9?-h|}L^Zr39aoNhPC9N=e)rnt-qh21T6j-*midhUFrJdM57*$B zjvmm8R;!3&jJu!sq= zCXTzzdIrpUeDfnqAT#h7pz=Q5Uiub5!}~tjIYD4K$)RT@BYca6I)0)P(xXVQ{{0^A zEdlQtj~yk4FA_KepY1XuWjMKdxueESGeUb{Buddi+k2x1HrCaPqz+A2$ub2S)NwT6 z5V4aDE{DT!0f{F+8fQ;`wh$q!7h}1)*=h^UxVr9TINq?E+-o@5s$I&-2;&SF*^m3y zXp&?nQ@WI3k&x^%GyZ7#HLG4*oc`y70(11?w9BlHf$PsEoL-?Hb%smHF8ZaQPKmv| zlRb+3-`;%2X_X=Z6Pf&dl+b2bRE$_x<*b)Q8ZLoS zpGkG&4rbi@Lqzt+s3jxoQLIfpGd1S-gna0i`x(N85n>)Ed+R1l$&P9}2eaOZ;Qv`K z9ZJwpy(}N<5N#ADNwC)TyDmur-y@_73U2A-(W7ir9Qp({uR0c%e=RX+NPW3>-(g6J zPe%tf7I4>Dn>}rg%YCzal-Iy>Ph+V1*AMTD$%49HT@_-9mL({WFj3K+9xmj7G+BAN z(3EY9@s>?OgOQbyKLzqpeo;-H!0}2(sbs@D^~djMg@ka?;|{OK$%vr)JyJv> zMsZReGTXDKx*LpOx^zSzf~qE5XNvoz$TRZ9KZJhVUx{zJEDg$wcWU5$W(<-gS0`e7 zg90---L8S>y;$+cop$*AU6-jBT&hJ=9y`6r7!6I1xB4%0$DjKW_+#xZr+S|+yw+z& zbucx4Xi(6AZU?axJp$P@RG;ln7T&5Une{pu$Hz}CE$tJuU^>;))5{gL`B3*uzI5j0 zdOUmM>0pS^R@H^6Lq`N1vSu~A^rG)=cqeme-AP;vp->N%>zvQh=}v#8PWr^4X$m93 zyOzDJq{&>$0 zNH3`)wx3o$wm&WNC~^#ij{~OhXl2NU`u(RTRtG5Nlt(N@Rq63=OYyz$Bz*74&jZ7< zA{0G*-Xa}rxqw6C@w{T%S@-0^i1(|G$=%v#o3TxY*J>`#PbT3!qt6`14J$!T_-STm z!>mn~^*qVMl)z?GxZvLptd17n@;!4rO3p}fnQ>bRWC;5>&f-OOvG>87LKC;+k^mg0 zrYyV-+xbjp5ErBQw6lnMSYG12q1J7<@cx)#?~MBotG5dst<{pGhdo^VW#fVs_&?o* zW<7Ss`v>wrG)(kxcC%jl_T0T6&YW!2aB=RQSoke{oztx~q>8~2kM-lL7*$b+02(h> zhgr{qcu=qDzAF{?6~TDmZIP-wdIkn$X)k>+E9aBA{i2W%C6|R2a zow#1U*(us+j}#&*{x7G83*o#{U668;7bPP!-lxS@2L+{lC5W#6xWs2d6_eJrX~)f{ zOq6~0jLU-ojIr9yecedIOmACbYlg{PpLMdG#IsSycV zqS^`Qj{-w)fyUDAN^E-khXT10tddcEcM7V7M4N_UyOZxxDn0v?Ha4Ye(Z;blZPY5) z;v`Qyu}KWNKuKOK3+!0$jc8SFlGq$eB44iMzOOJaGAGfkzE%%62D^%^D41x@*a_@T zyaD&%E-Q0wwB4pXSED1PbyeEg;xbtz(Uq>W0BUp5vt9L*hi==S$@o0-$%S1%u1;2d zIE$FF?|#_p&@W=buIh34`27bkNE(iFoSPX{zn|KnI|4Xq!aN+7T%w2!y=JRucide; z0=nB{R+ZB|Y6=gH8y9!nH$;1m5{WFn+kvtFk!J3c+TO<)J}^3Hq5+L$|BT00^_f!^+J=1=?PqGiPLiez=(|H+XCWLO6kLs7c zCK$4+7|(W372bQqYxE+`kF;boZi3aCS?mRv>O4AW**-KJ=S`PRsJ{@cK1223G;nix z2TuQJys+k~HzGOW^wplHfu?AWeCKcQP(4I&{_0?uWWVF_*edCr{M0bcvH!S|zyv>nmJG1&e)tXOq z#|ArvcdGLFew#3u6_;9w#5Nr9YuEcBiZ;nlq?#c2?9ch(me>J!_i2(qL&Zw)PR-D| zur^wphLwo*!RZZ#k*S`}?zob#pZq%M;B%tMdVt1N_-+c^9A5RM8=M`V(IR@c=G$hr zKoP#O)mFz<;mzALo*`}Se3J|c{K5J((F84WB$fe`-8ofc9_Hw@uu`?zdgUG31=$&bbN5iLz^RW?xb;iwYKrmCUn+snbs z=#Hdihrpvvv|@SRr?*(5QHK!USJ{!UeY2>TOl2q#P+;Pg>`MA=|wKN53UANf9?8vt((xH0Rh=XSc?UKm&s(o}hchEd^> z=dOy?8>M$0M+?wMBE8rb_rM}jUY~;&Kpc^;&QbD19=kJ_kq|ZvM41&d+ASU}r}8=U za0I-#n5tPXT4%)7K*Mluy`UeGsklOsQDtn39ZV^6h){YFe&3)@$7{*t7F&YRw<&5N zg!ibPOFUS)Cui_m_OTkijLOeb+SCoy_dkL|blMEv66#k&w-7S0&gTvL`J;=+0J75y15(9*9`FwxFTQ^PNRC8@`iWd-|=o5ym>~K z-_gamdHet~y+p#iw&4_|mW!ehmwNPUPt|rVw^n`vw#s=`fzFb;$e_snK4QPA;A8U* zsm}ye9+WZA!Bq-LKl(P(ITRv@)}TL3Fel7pChD|YEsw8Ru>%J^4DbXFrz$(ZB@c^Vqp8$b{vdR zSlyzY$7Aexd-1T$;GKJL^h(8pkIc#SKIMLjORfu{CS0jT+2f^$g9_~9J)ta99iPaE z8ysm-MuJBRHh$SHL z0S)r8>yl>Bfz8C+#>99L6;`6EcRW$BK8E0?fGcE_H{2E3YF6lLw-fNl6vkOis+-w) z74+rO|HH&<#)R_VFeD=Pc92-gzRK3ddQ>gxACO3D{x;F#;7+MaNU)$g#NvnAh7lCZ zP+=m8dloczTW;K-Aa%hp%|~}!jTVa3Bkdj0N`+fWLpotK8mSw~o zd;hQ?-j5`>q8($SPjn9-JwJM7Q^qP*YvW$dSM*W1>CHFYhuycSx|iH|@f?chnMh+> zT;H+A--u<2kZ%wuz4)Zn2~jlgd?NJikIC-4vLv(p7NL%4NVU(aS;K}jhi#M?6>Y)Sl;y+*;A7IBuCWT8CB$Lx~b^vX`J+R=9Qi(CE%_ zp8diNhqgl1kCM3F5Qz;fzsvFV@?3Dolc(_+8`9E0S+Sy;uI_jq;m#!;gE2%}aGpw#sPV%arUD(=}AZ>%ouK&Wm ze`-FxRnN@QDC_6!2Fsl8U4_13iA#Df5ZiISGxhE+oL*8R$&7I`g1P>$G3&dT^TLhp z*B(_Rs8mT!zbvJO>Dp%LTXxSIA9eE^9T6*ey}!R9wB(ZL+0uX+nkmn|kNGZ&QXcU& zsQ##02%B~nPlO{j$qptKk#7Ro$1QQvKc2Ro3pY5{CdO$`)c5M5qFZ(+ql1K?rm$=&U?p~^8>gwhB-XV&^ z!O}5A@VNJU!&PhNZwLOV#WAm$d4}cb8)c`;Rlbo|JpY*7W`bEI{GdzMqu?!kI1S}I z6Nf#bmzfA=g*`>1dP6xB9_@V3tm%TkQ``x#yzTC)jkerpB27`3Aq_IFPT4|k!picX zsGq)Esi7N9^GsShuA8r5V144iF+R<)=E>> zi$?UHfHkcaB1MLCwpmml{#-;KYa)Hz~%NJVVi z>h_+(@T&Wljm4lu)zXAdIg~=m=9=bM=$7BO|$l6OgG7v@#U>Z><U~w z?>-e^-L{Bt`OKgv?#93jE+NbTH8q@nS6n75zVlwhI=%VFr)oG0ZjFQW8V-L1KXD|A)i|2c6Qaaio~wRF9s&(y=W5 z>=9ZD*|dF;_Yja!&a>ma{MIp^jt%TJG5lSj2~l;n?2Ge*##)wFi%mE*Q(k^beVL&$ zjR)0ynKz_Ak?(xELPWk)!t%_Zs?RZfWhaN^iEd$O_wJ8I*Gc_II7D~TJa56B!tl{J zAt{m4_pk17g!Mg^$B)kf>>00Znnj2*4h%(LS!64w_V}cAf4Q5Aj!R1viiH-dUok(kd$;O7 zzx93XJGq<(mrFMRii+A7eOJnrPzbkMV_1KU)B#BZQW zkHWGwz~&aN$<+E8QFPJ_GYxW(g-|dP%#WFyE;7=> zS#35X*Q%i$nWn9iWN<`XaST+3N|&JUITpo!zB~jkOb^ir<@unOLiUK`@ zV8@a{lW#*KK>E)J3d=wxvk3H5@2aq%B%Gcm-@gmWxhfgk(1LE=EpW`lJ){Sr5^2FL zXDG_9oiBO-4v|8^aE|HV8<(DF+{dE0E(hVl8eWZk1$|7?gaaCosOxGu=vmylgxeqz z2BLw2B3P4C%y8CK;RiaEj3Dl(%`*Kk3wmu|V(Ny?T^1}e@X(OzAjco=y}Kg}e&2aV zZhAK>x>Z~!PnSM|43tS9ny(iQEuPpu;CTs8XCJ&;#sFu%RFiPa2OC5=l_LLmE6)3F z@k4(wT2mRChVQ}gnQpBG;yPk_oAbK_FjpMukw_T$gypn~T>zHb1DKHM%Y!W|WV~@K zBpjyqLD(m-A>{%f*`>v|1{HLAwoO-AXr5j+4S$s=n|$OEzCu&ebgTJDYO^}GPYm^CrLQL=w{;E3(f5#-tfQ^i?2_!TB8Mmax!WcfL zFO>ccnN9$UuzZ`;NAhH%Eqb2oEFFId` zv7-X0U*>%4#{@sOs+Uuo1y+SYFqrDP@Zp>aT&&BfG4IuRB2;yarfTG&nt|NKP?HCOjC50}b*JZO*oP{X$v9x_Uw{dNI%s14H0aNk6Q%(1y&+qc90`@7 zd};_qrD1FRxJ$qYq1%;0lS|&}n#F-5jtsT^iRB>OH?w$8?!hfdl9Wk&2tm!AZ(951 zu|0w8)mL(IDWS>jau|PCo#i307BeZbC+&DKt?%S=xRRl?@D1qn>-AVDDb*z&b}Ry5 zU_1|hf#7wIZ~B@XFmT2HMzN=-sq9QaXczQiEWhhzCp|Q|>LdECAW+@82T|m9wmfBn zm`Q`zQNrmNI!l>o@J}rO`4j&1%@8QZ#23tS|LbY|_ukWj<8LU5*4Nb3tf-YqqsgsI zc|QJI;lV>88BmUouX2RwRj-2HdH}25F^q;frxZVZgqc5BRhdBj%uTZ}bC=c1>$NH< zM~*FQk^+t>OB)Gg5tX7G)4Y)?rKS52W2Lx?0eqkvhFgDvQMlr3FJV=;KVh*nqGiCd z5GGWl<2WFVx8|2{`!aD3<4^Eye3LKEr1w*+@)2xV>#S_YLKdL{*)V$ zzlR;;u?R}zMt0kSzlVeyST~lW2S+k^M(a>{qJK&se6T>5_Jd>-n{5vG-RGy!bQ!dG=#54rZkaNeXau>Ew^cAAkQ+3hYNGeZhW(+%v_H)? zv0nn~AKnFn7s^2tl*fPqpD0z7HyfPQ?&t8HDW-k|g`+-jNd0_~r6IaCP>TKcRQA*i z{7Heb=A9rL9RC5;fHN=#E7MRgfd9j4@)mmSc9^LU13ZMcY!Tgxp@mdlhu{1gW$&0l zO9$myz;vtAw!1#sUj@Hom-Cc*0#JN&060lXTOkUWqLs-G<}4TU!R$R4FpG&naDnJs zw)N<;kJ#x?-*IH3RS#S324rL54ycz2tj-D!)>A7vhA622tEdSPP*BkEjRtC|t)5eC?Uq1FJZErDnOr%@i@p~94rfJqM_ ziHSQv;-VV7kuRx%LG1kMW@nbUZFUD4_W}}b;rIy?nd;w5{&ot;e=mmhZq@B5?|@ZG zR}_vO>l3iDaswUJ?8cF;z${0myf4nKU8k@pD6YBxlP>Tk0r{g(Y!VE2LD13vY^RImLtIwu z(=IBC!bJA9Pxj+Mgr{BpYrIK{84|=S z-KT1QG*~!KTJcSi899aWe0>x^Wglpj*gVOBi6%LKP~lj?vfz4w;r_IX0oMSGWZc-G zO@cQ{GB*7E5NMQh-VCQ6j`lIpeh}TP=mSxiDb|L=d8PIt(+5@iN8^|f-%^VE77T8= zOa)7{qh0y<%%ZTor}2D`eP_F!W>S&#91eGS1&4WfMRgu-~$5 zKt_`lSS_c+q*Y}+Xum1>@yj?=&!smqqm(%i75* zoUI|kzdAI%cxOEvYGt>g)s>6Iq!Mzj=veWl94#e&XpbLn^!7g4$y7vGF`D(cfiP^3 zB3G}`)r5M_jybdU$;gw2UtKJ^@XSZq0!wi%B{EeMKS21-)Ops^#R2Rk62K(ZeS>L1 zmK=q*SMuI&?voD^1f6(ss9oRb)ii*BH7n8l+ufZ^emI2TTzu$@KUi*u-~6=aM20mr=%WLF`YIrG-r_Hol|u052jsGZ%f^f?D)klmTH8CtHI~55D7m& z-rr0#7Zy=UKwdSuCC9wnY|de+7v3wvJ3WTsx-a~0*Dyv{&Vy;*GMtW~O8|uGtmgYWVf(k3 zTZPS35E6}H)4d>Av4Yz=&;aEKq}#aTskFvcjuH(ckntU8Vq7y2V=&1 z`{X6JLMoSga~Y;4H4O(b^u zWy*0#X$izh%e^BcW7TCTjHA6_j7m(A9G?5*CeAdeQSVdQhVq~wAl&ABee8B@LgWjr zK{suXlhslyTR8E?NFaLUmSN|Sn2S!o_Pj7x;&#EqEvbn1_=rLT9PMdg zgst~2`+A8h>(v7&3QSbBz4U{G-HEsMo9XTuUH?!uf1|eN7$eT0%d%a#rZBnjxNdh) zVY2~VS_-85whv*YMdfK1!Fmh#iJKebj)xPI)057v4P7{@6G zP-}%ho)lsAg>v${sN?iY0SN8F-v|n!*%xuyh=BOn%hjyHOuG!c?sPJJ*R*Mcz_~&& z!A$ch(Fz#hf8VceO>HBQYN>CeI-?Jgs9dm4YVeuZn zI;|?A>fJEGuW_R&B}-%!rK`l_5!M<`Mn!C)!j?6_N5WSdf(5hpuZ#TW6@ zQhNW+SJFPiS!$Psn%6(K$ti>ZsEI3LK$PPzy=e3r$rE;~w2$bMxX zN)2`nNHCl?wgz+Gr~r^(%57NSx^dfc5-ge zbC6~ES`1W^Wkxzw6RmyAjcC(Z9&%(mAFiv`V{wnw4(*9hqo*!ES$#$+hmV$R3#8N> z^VQVtxMe@;u(?BO;obL(7t%Zp8Evp$zoN4G^~hbdFF=s(W9*;Xj(nB?#RTMW@Ly*`DF{Z@0`oVOyAfAMoBi34DL zT8_e_3tZDl2vc z;bw*!K@lRIY0zTJp=W2klJA(|(X2>1-MQ*yxZo{* zS{^;@%SsvaIVV=?Xzg~PP%3%InX+2BCaVuO`koFeuZ+1KCLuxKx*Qth6?TAxNYo!Y z`OCk%4HELdBfY19`TJ95RX4b$EFsuyscV%9gjNRUfbYs=XxAM`buE-+gMY(-GAY`Za4LS=ci)IU zq`M!lzMp(Cyh{Z~6!B~5_~G`598CFZk^Kt$!JOinF3B*ex&!@m@&)Wnbz3~_iG=$~ zy+#TfJBt;rI zh}lV0rYsxO3&e~D?mca&lgmpWmQ=2Eh?n_PO7)Oq&G zbgzKQ#~@8+c!BAh2$3#&g`%o|DFL3oE=8&n4LuIYoOlo1;zqZsGDJx=qM;nYtnv^C+=x8f6mcQ+m?G$brhwWfcLCFV@GNVy09ss@rm*Gu z6m$+KLFZ{y_`MxT%U>%9{`A{$MYI$gfzL&sgqbZ-(mf&=S7v$`t-bufEH({OU@C&b zMDaUtMV0`-nF@q~|Fe^sTay4hO&MW6H3bC8HIdGA;O(O_(z4L4nv1{+Q8CQGZ%pCV zcnjT5#eQ&ro8;_Ga0fh9td}78K@t0oF=R3Z<<7L2z`qqBWpBgX#sauI5bQVm- z4HHj6-DQOBxXb+GTMO*(0mr#33b<%033&?fFk^_r$wP5c8rQkYT&7>%O|3nVroTyl z`9NNQ`t@dtLtJ_4OKfG$*Mc+{&+iHiP(ANT0LuBR4@%07&%=WC7*q7yea+VZLBsdV zx)Td(Yz;@`H;piuJ!Q;Z&}9bnDLKCH5L6-^=|_asB%dD8U2gqso1Q`I-48~g@B;hYvrs+sN_hD}EEF{p znJ+;s2T+0{Ec1#QC_(nCOes#lUXU{6)>lD9#V{j91Dp;ht|{(!_>Kl!u)HE9C@yh7 z!T$u(o}@DW+R==@|2}CDvwtTJeLC-jO>7zf7~rvoO+ZQ? zT;Wxv(qmiPrKd6SyWyX5)gJMHk^CpE>j(yY#g1+o&ImwZliYBE{e$eu14X~~{9Nw( z-;m(TeK3zIM{3mn{go<)mqTz=^vM29@1~D3Xi(>%f;9k0{*jB%KbXy0&EIg*F$h## z-ALmDt`Xh4#NpB}L)CvID{wPVAA;GCw4~~oB#&TRaRFL&Oi$@t$LvXvz=U@VM;DK!AxV~Ek7;3Igt)>Mp@A^>?SjHqNn z>k37i_wHIT$K9k?;Rp>R(xm-9e1p|sr0X^?nl!+i<~xl}7^xuWPJ-`E5nG{}U_9Ut9{5%1?`l z`vjDFX3B!AP@&f#$XVaY@OU&Bm@F&W3ueU(T>_KJ=NhkjU4K&FcY`457{bQNCIv`+ z+Wu?=bU@6Z{2qoai2|zRsj5i{YP<|=3R7e7Z44Mz1&)XH1p4R|g7OQ0DC#^u|1&P` z%F;OQYx0Ym=OQb!*%$L?N{wD;JwVDiPxDbm8y7S*-PjrT1Nd%>4rUz*d}V{x1wCfc z@7;%@1lsEBv0?5eS*sOL4g$uz44B*(89<>8db-98;RuS1*phy9YxFzEIE=wXhX7ME zy3Atc!icKATI4{{_3>b&qpw>Tf$UW>!YA;kj`rhe-Z9~t?L(zZ-tRZ|8~xS z@Ug`kXE^=0NsG(k0%wJC35YF6m)&Jo^3-IXCt6h$U!bJsAQ}%a1XG(qllZR@0si4* zjfn;LU%LLLvXVz!ZVmm9vEdjEN}J)T;r7r62)swBfUt0>xSg8o^dN+*&-Cjv2c=RV zf=-N-xdZ<=K}VaaEWHU10`amcQQLR?R^*r28q@wVPlNMkyc+3E&xijaosu-y0Cjs9#!%$@yXV$iQte#wwg|+=v8-6Bown z(=jLtLqB@~a+2g_PxR*Y)f4N!z0U`%>)2PSbZu9dFk z$7d-tyVyS10oi z>eUwkcaiK<7>8@zvb2|z}04enCl)z_&LfkV%z0Bw`mp z8y_$qXA-g|)DcPm)Uxkm#2W6=hL&?oVZ`-WZ}ovsUN_Tw+m*dy4B?+@0J;O++S;*x z3E06H7&nH&rmq(4uxvqrbanC{0zWFa{#8E^^CEY8`S<{DtkE$|^XmcG*Z=~^-NHEs zP61egZoxkZuU{ME-DKr#=}W--u|16EtM;_v7!YXoxGg7} z09-@ujzeSk3}E#hpmwvm2;Cv4q`LEY6$nMkmZ!WuGDcqm-q&^j6Fn8}@!|GkUBS>IMlvR&@<_2Rj6^&eP%28wB^l2b z!a$xK8j9jXnVGJWgFcDFjh2Cw@8#7E5lYY-9s(s~BB)JcyN|7e?CwnnXRwhEh9LTW ziWrc%6nV>N1N@Z_bXDrO=fQL@2wPczkO4c(<3Pe@f4PsN+dxxP`WgkJWBO6I6NZr| z>n+XvDNn|T$yuD_6g(w9l0LJQNR&==9E2Bs{~|h%I#d)`jNZQmbx21st?Bo{L@8Q; zoYCa-_l0mVUZ6g;3qO-auC#!?0Ad~Hth40wT9IbFT>x`RV?>FwSl6=HFGdf0r5TT% z8;qB?ZpXRrdvh{E%@4fk6XhroZ-$G2w$Wb}M)%zs|1^o5_Pwada1@l}YX!+JQpbc#=^WND38}sHQAm5hy-0_fzFM+i~ zu=bT}^W6D_))f4HS!Kz;tsy1%#c5D+$3KAuvST49dZ| z6>}#n>Pjs6`rFs*68uMpTeUwduZ3;s{FtdPWTgv;7CS#|*?MS{N@pL)jX4mZd3bMQ zl7R~)M=QCf5RW^LITw=EyXl)*BunEt96^xJE=-9h@f}HN6ePNRv1|5*SmxseM)B^% z{<-7;0`~-_QJ^T$38j>Eewf>+48iPDSxTcb7m?OwuP!ftBKHCgMSlGN)^%#&o*V&| zUBeY2w@fIs@m$|yTbji&yascUGz%iov6;wV9`CB0)fW?=PepAXo0#p48hBf|l5q{Ti}Jh)=8rsjL8M*yla3l3 zUNJeiq}{g2HUi?P9mo$Ix9rlqPc|#9z7j@)_`YGdNX2xx|3_9Z#Z2$nu_+WAU5i9b zG!O1V6j)zepcJ9;%&}~p4{BJc&U65p-r(qXa5A}qw+Pn063==tnOJH*%59XRN1OoL za8htmK_7wm}>OC@E(>ZIFyok8sCZ#6?Q%2GGAAES8# zb`_BYcG19KX{}*`*N7+rWrf>u4$ga68aq#zy)U1My^Vioml!!Ydtw?+I_!A!Tm2xYPMr_2g80B>+^K`W)0};A2dsg?Y zl8q48FHG))x{<9q$au!$#zJ}ec((m}gJQ7Q*TbLuDWyAZqV0^YPZYZ-G#Q?iZF|D(F2;p8rJRMJGC>5=xrjB;tJZec%N5dNKs+Qp=Pone8FvS=Q7nFH)U z@+vSIk6-B4N3Rtsf)nW@iYJ<{zV&vYpfY+BT&Qckq|J6H+~sG&S|jO?znWIHJXf7c zr(jg!s>(Max7G2d7U1>kXgd-dG7qCS^(Jz+`5da62f4ymzA?ogH_wQ_3BXg^+-4ma ztkmR01*)of_Y1DGPWDeME=_nwPCa}!tMVN$cEdfB)`)e0zH{o)8*KsoQ!0*S?bzHQ zIr`-ioQO>gVF=p+K~D?=#vP>lN%i>Hsg*5`lt zK{?LJ10G4j5x9?6RB527yI7OR@(l?i8lX$xUL+jizIy$|ctQZ30|{>Tn{q!9yWwtq zsV(iLv{CC1)CvU{ey*nm^<9m9reh6NXf-r5r};TuAco7#*`hC3qNF3Q=1n=$JKc#( zI5=7G^ONnGb9h;L7zq{Q_Vj_TO&tV5wt-F`u)_h>J zy{yyOq|Ker_wW`p`<)#8-3Cm<%Acl&(Ii}wTy8MsnfN+D$PPyc4GTIc*Ae9b7Hi&z zt@;7V@rpJF594t$&%GhMxy2!;WBeGcePp(H6?8t{65>uIl(a>!@b`}Sq0dve<3)-F zU`z>ye>iSzIeQ>qEU&tn1S{=mJYO72l*IHZu^O0Edk1r{`@OZmL_Dnav;TD z2Yoidx*+>*2mg2S0D8~tvVcx@En59%PcAYiI2*mItQ zW4j~1!kuL^+aOh+Uo$RHXE0Weg68VasA7&uG2cZtoF7~409^nRb^GNy{g3<( zeP&cd_MYSknk1Mpop^0#HeYGBn9Uv<+OFdg>hv!1-X^F0?JP@Yx1Sh=YF=Y!F_XcNdbHf(* zqV^bx;Eql;{q_^z2;@&i0EBzuIV3^<!MoA^cp}?YW2P&^^?3x^>y@N zTG@=ZXG|YokOm=_e+qKVC?sanYRFlsVZ;phAKoaa-<+KoZQ~IN7@gkkD&_VY-QK2N z%zWM9@Ipy_u1_c_>c*5?qCx_e%S>caHtnF<8^WzRQZ^+CrXe|kDK{d3hedV+p1MNq-mg3oL?Izir+i9mMVL8 zszdaq>q?W|nBa;e5_gB#K=o_C%iE?v2gXKo;1Kte0yL}3!%JSf-%m|*Id=H+>j6*>!ld4iKv|G%l|T5 z#EF1&I+95Jn<2}pptbAWp0oxsqNG(1hO?mqB&IwJSPuakthmI2mMWD))B~c=5Pyr2 z0;pf0KIZQewe;Pxs^^1PHj@3#YJ!sHoBYthcv&GdL3*eGa>;^Au2g z1ebv0%_-r*Wp}gp()R@$x*p_@dClK6OMR*uxT*C`M;I_MRXb8d51 zUz-vL4k)5qs^Dgh^fw7Fv!K2?%8L8}D*__{PL8H(BX15&X6&!N5yjT95c)|JMFy`utuSPYDMc^{M5A3yql(A3Xs8vgYKy(%HrfWkb$ zMfl#?3FZ$MSNe zQ5s1F>l$&S8_tjJ*Lo_4mZqw6haL6(S&yDU15D31WR>?ra#F9pW zaLXh?;ONG~yORKQaST=ykG%y-;LM$n7eLAIpNbg&E?gXst54R`62kYrJB%o+*F$Cx zF;M(X{xckwDD5KG+{zIk!77kR5)zSzBi>(sTYm1*2!lhq1&P#lb{h-`f)liBx14h%WO6Z^F&C(A?ggFEBx`FRoD1i~c+;LGn@s%h2xL?Bpw+v70yOSV3jLzwA zex6+m<%m=LK1&QooGWT%;2HsqV2`}&vJ|a3{7IlMMnuna>&OL$juTTKxd#w5P|iVy zk3g{EvH{4bL5}Q87_|7(in$s#1oR<~^e@_XiU{gk8nO^D!9da=7pGGW{XAE22)P}4 zdEN?u>j4ymAx?VO^K?JK>F_v!Rr&~506hpdd430_g=I~>x--qP-^IfVh|?s;!p)xY z2Qm6UCS@6}@q0uXmg(r1{-F$pvAhtNaZsBg8SefKu$~;C{B!B7Nm>q zRQ|`Hitu~IiPBkFefB4y2QE0Ej-cPnwf{~HJO$;z6G;Z^@}C1S66hmk?r0PIjv-=} zVsY#e46X-I58jdrX958rAobDF{zu9_uW*59#f*{u3@^KjgZ()RMx}N4YhHelIa7-3 zJbA#Fqau(B>UV499u+i!y~UG2Ako!Idrrpx1c(L250kB*qQ}gd^9(R~1z}_x{_Z1B zW1ugCT#5UGqM$Et6eav_mp{x;t4sh`wa?rCZCt(G*z^!lC^qkwl?FtXw^RTI^}x^j z0^Ew$$C#MYZ^`q&0^z^l_ZI=Ir?(Dibipl2OY!FCK$L-KEd_=Lz&_aX&_!P}!dCjV1zd-)D>piy-_0kYJ2Z(2!7MR~4fT z%g!6Ri|q^aULRHk0HXLT=CzNxwg5Qu6I32Qn~;41%a*zIV}zJH7<$013zkI<$L3t% z=87{zS8&Be%s2*85zA7&08Dmi%>TpoDexp7tN#b_yoX*XhWZMC>^2$!m#ahqF0@f> z2!vzFZUAWZ0*X5Jvns{w95`2TfHsd|w3Ld1tC>qcGRKP%D!KtFSufb?*yy`0-p0^o z=xc$ks)d5gb3n2P!adguD|>)u$mHf62nq3knBx_USaJsdq6EO&YQMQ*PM=^dH`u(u z_`;e`%@~FJF%dEhC&b)WVu7h7Mjh7sa=p+5e96ZJ1mmZMt~6eUX&6Na0aZNC13QfN z`B4$$6gxN+@J(1@(io0-s+KIY1z-ygiQ*%lc=Np60@cX)Nl+LeHk8YhT>u7=)=o-P zxOyL8FfZ@ebKkUy3!t;Sh>Xm83o~+vd*Qz-8m_qfhD6!an8?jx@k8S|Cs2`DhA&7# ze(U63^#+mLol#O~TxTo>ccoPkedv?!x9K%&|E>;MU(i>9t}c6B*USe8)XL}ehE2iV zA@bl$5p>|n_cu&M;6jYjuTL%FF%YhxYCg#MC>&qK>f6;dpku8#+9>U}{2H=x_hOS1 z1sD5J*li41XNTbv^h3B7dIUbkSQjutM5(V)jEc-C(2=PEKoU&Q zUB4R|a!)4@y!1H)$S0QoXXC|iq_YEX3rr8@(hKJh*}G2BA`Oq>Xjp9eTOB0D4jA)e zmh)hPYG%L|9)g~Rvb@9`3I_&0vp-b60~%;@@f6&N(nY&$M5O{GS6txggE8xZhT}CP z=AMFPxVHc`$NFj#=1PhR0-8m&A(N_S0qLJc_v@ptQ~d*m?rk@Ae_D<(^>f$mxU9 z5C6Vg28@%<*lWk-K>X!s0-2=Xi?@s|i)Rm;#@y6VI%m`ZuD8+dj<1$V?GxTnlraxIuyY5G6xWk&C6x77ky$E9+)uF78{MO2ffu9b0C;wCoe%7&ON za2re~+p;>5(@o|#sm=CW@xrlZV#g~ClY|D3fTgmYI8;tetyN(t92aJB%(7g%*IHdyyHfiucof&wfFv zbn*XV?meKQTC;9ZMO08!CHr&~!bsQIFGopuwt$CS=^6ZsIaQWPF#ki; zaAniRfkPDBwmH$Y#p8fi*IBPQ!K4-(L4VcclTO-p&64F7yD)QKkF*4FS|T0-qB~WcL0p%@ z{jVvX@R>h#hHV00+IY3VYWitw$s9U#+m}pfJBXu^_RO`#>nwrO%}_ZU8>Q*0|IWTe z*7S&<9dP7Ul%uzdL%UXSkO9DO6qxIW*DQx_sRO< zZXt8@GWbpLL8Yja{z&RI7)~eZ{6#a}#qW^6R$=UJD*G8v7kD+wjuBtf${VQHXIlA~ z!;0!oIUQEAl~RG#>)exP-!U&VP&)L2?}MIl(->mwBaMxDeMdTj8-Ey^0PXt~s4heX=#@2(}l3iMHWCdc<1 zCmCDc#U^-~=6^yUiI7I$au27H29^cv#6TL|?W^e;sJq@2gzcL|ixxx`rJ;HEAP1f- zs6~?ZO`5|jrqdX*{W9>v8fZPs+mNJ<&1suoMdP6aX7tS1{>`~>2OkTYC%tsH`DEv_ z9Wnn<5~USqVxAZuGIC6!M3=JCxqch!io^5hAO6p{9B9Z{CFUg~t}n-+qrNo_blEJl zDb{VT;a*F3_4J|8-L z$CYEKv?>vB^(nUp=Z@i<95-R`Jb4jp&G0A9&UbU9@-a^q4 zEdrW(wzku_TlY}@c^oS`Ow^ULk|}FmG40j7qHmO)U5#8dXF(G0%sJAe`OFqK`*8Bu zt}3)0EODhRpE;v{y!7q@`PW0WV|Gk*&twZ(d$1P-yKKXc5@bu`a+tLAC4(N50=+&@ z!Wd=w^{V;EH74?9v^+Mc>|Vl#Tl2*XO)Vn>rUK^>?h0Uo&+C3U>ffS&dOiMjLKFty zi+2iRjzrU7-_}^eucs*Un=N-GDafq;Sy>Y%6Lnte(4-0JTJ5N9&9SvZ2QO_J{TxY@ z3Ye01e4s*8onD?t>e7D6#MlPOg%{jwn+;)*P~5hNPPIck6J z7>P>d3U+IxN6Z&55K1~h&EpV~Z;r+{vVT!A_$kITj?b(R$!oe}_u78j0cFW&qI9k4 zW8t}$w$r~9(*uolc}rIb{tv=b7G}<|w$~CWE3^t(9ipPq6;><{DFzRNEl4B34vLn6 zxACJ=@VNAuw8R0`P)XjrYpu^QcX_*>7ePv*9h0;8t$7Mhl_VqOLNtQw|l#w3MQE>8!h#L%6tgeWOHo zq|M_%!L8Y{7=bVCdU^9|=(#$@)Ujr*e~ZeHZ0`aIi4tm5868MPij(k9 zg!FKe($Wjb4wbKYy8*wHhT-I@7%2e~;c&8LAF;R05 z4|+!>3rJDwWB}PyaEztZSBP6-8;d8Eqribz|{HBF*Y7g4RAQp~>tABT13Q!V`xm*uc zQLbHg*Z!EUBJe7HUf@N9eQ^>91#8Dn7l>NylRut2Z>}%h-<@0#W@q|9jwtw8GY_d| z09ZWwncA$Xlrsxlpio3f?NUMJCb*!QjQuG#Cx~0T!JM}&;{au2~epc$T@JLy;Pl%`}L#QXf@ob97 zTx(IQ^YHy>qLLABP|rILV5P|6So0+(4CB>5Eq?S%aO50ub<%tB{$ZA@i=a4 zr#IkV_)@6Ho`Kg$_DexkP5ioQ#>JIL!2=lTG9Y=h?SakJYfiy!N{=faI^9*Rt7`uS z1QSK!R(qFxTLs}50O0dxue|IGtoj~RJM;)3U`eTl-&*K$)N}9x3VJizcj7ZpI^xVKf>h_F0jD9Hm#%1Z_nrI6QgPTeY`_uD4*u&R5w?cX3 zBTr(wE)pt&vPAJ3#GMR^T4ijpRAJAB3`fvyq7`hK~kK_pGQYJq_E#a0g!O4K2S?E>L1>|my zV#ge^p8!j()Ci?%#6eXK2+$N43td+*84WBGosox}z|VnH;Hd>zDM*TYPb85#Jwzt5DrK3JBGIvVq9Bw!u?wOVLphDhUWsTFvDyd=cXf_*Cb4yaabYQQghS$!S?s9O?+a zA=14+E8vmypMg*8nUbBdo{JIBBDg2nW7xm^xie4x-llfZ$(PT^Q8Ou{;f;r_^!}5t zJEx(WtAi<6P1hn{(MbyhDxNT~7dH0@Mf1Y3#1V{7h z3v2&%v=}M7IEWq)p4KtXdfIywd_aIyXUaUAM)p+c6J*=md*$rOn@71$xw-Vd6(cWm zP3u?}J8%m78d3j>5Wprb28^#{c!`cR0KkHR!SSTH4BqP&tkg-jhL%es7falSj+|Vg z_{PUu9o2DS>ZUf-e;?}w1&D>fdyTu`N-4{VcP&m6CMqQVAkZ$JK4Xl^zV?IPnTpLH zZui2sFn$o=awdBp&wziPeiy{^o3S1l5N%bS_ZJsHtZa-_q87$H5Bt}-aCCt?568U_ z4Bq&ecJp=1av=;GJqyWsc>bdAgUc==WA2z4h;qChhq>Ga=aQ2+52nxrcn=~Hy>}Ft zvFb_&e9ZS@URL1`sVAX%lJ8`4Fnu#Xh_XJ{5SsmAsWGRBTjSskKIPv4RN(V>v$IZ- zHm~oGHB{zeV8U9RiB&Qa6C-4rfBtuMxVZEGd(>{kp5pJige7KqNBoJx<&Ns^Nve)_ zM=g{Hnv@S1+T`|V&rBcA!pO0#a&){0RAmd3|8>U}{F9748APaSZB~6;fiO+&VoVnf zQ_1arn4^~9#qi}5jldP_+Z_S=gqX9E;`lT&^B09%bkz;cm^WL6d6jD6I0= z421bgsQo0-vvFJ>l%kV})D2{<0kJ@cY6VARGbG7ICZ%KXGB~K#bCypKOu!O))=Y$W z?dX1wGtD<|P3;Apu`sw>&Q+h=d<5FncrcIcYXwZs1YyvQ%s)cRxi7!@`F_v51Z<(( zQX=bdKtsJ^0<3JF!}N~I4MX3wmj7ARzh$Li{in|Zu*zZgcwBNVQVCEh6Ci=|-U70y zO9qhlr8;tTV%Kmc#zApSazB}N#_Qn@E8F! z>HB61{OnTRwC^`a{Ev6IYa`TfAY}@kiUUBf;}@LfJ5T!+DyRaG&*vjdwRs2DXdN3N z2e59AL5e)?Aky0N96&JQ&sB&!umXrL_Z+~1OB^TaiI_ttd93kpT8Hp9vzb7CE?}DA z6g6m(oqN^<6@qx+{t^W)Y@Eb#p;{!YC{5ba@7Hu7Naw>vus7}+b$R3r{-yCiL~h!H zg%P@`mda)c0KoA8)pj6!<PM=T495cc63V&t&( z17VYgdQ{J($F~B7*@9A{zK#dcl>IADnV7C~lBCt|*7c3r9Y;`y)38#R1^(9398FS^ z!+rt)us{YlyS1bJk0Uaoc3y$T)jd=w%>vxhuNeKDZ9#a;=O51V6am~H z6KfLJgos%t!DE0ASkqCT#b2l?3B43Om}O+Z-1YQ1W1KtqM|Mh2!fE^nr+#$q0g%(R zQkbp>Ma8=e8lQFmgknG#CY6T+0Fv6`Qj%Fmu~KUY%!_2R@lY%3(1q9Oyx|6(6+Ck} zMZw#i9~<8hgw9;Ajo>s`u;+e^PqXDTU_qGAzxDazsZ{ki4XwHna2M6Mwh^icsNTYx zHlWM(FMgGzZ8&3k&f(qu!|Wb zXR!9sB$q%@aTJ=Lnm88b20(5bkmpV68~}BHWiQL<(4@$LCHw@>u$VUV64@E)ual8p#?wCqC!PxdRL(B_nMbeo^;!Qhk2*)3>U_gkwg4$~eN>H&7pbL=PnKRhsl{xQfwBFGa z!4zoDi$}0t80$JY=PJL0&;O7Dqn3otqWIOO(5@5p@7u2D-2fXbzBf9khiAH1U3%^x zQam9gQwr3B0bbsOKLgoj`+%tUc$rx!RTXLpMfqz<=W-eCZ#u*zY1ADm&TFx{HBX~s z#nYW}i-7|V!B(Z-p}c5G$-tNT=pJ(FCEc$H)kZw=T!LdjYMq2`0k2mX8ztXQi=D=J|B8` z&a*oh&9j~HnD<|vKO!XBDy*L|Yd70TxHnKA19uS#|UG^6(g}l{@`&v(pe#MG4GLM>P7_0$rjrwM~t&>ed ztHmR_V22#|Rd0F4y@LUs` zxv6jk5eYm;Gr65>*$r1TVqm)2NFQ;(YT371+_%71;@CsfU`LaF+cANGcOPe}5!ALi ztf%IYV&o*~FMH758QA3&Swm%=xf8K zqElm_5IB!1FnIgOIfUuH-3Dy>^BcbeTR!v*nw6iy8gC472|65~VtN855VkG`uD>Wk zhEgtAj||+L41fQfZ=01vmL=@XkAZWWH}58)r)*{TVkHsHJO8^E?vz+`^t01~i`+K1 z%lP7sQg_5p6bQ+47ChbVgtiX%*JX)U_5_^&?&hOtC2#gaY35$M(D?G@k=)@-TZa|| zPvd($-*GRtB=Y7Y!6S4e>>8MszqYqnFYrIxk#lpg>~0;_%Gy|#!^0>xmXqP01WHd_ zsma%V%K626-Yer1^=EA~>=-B)H4~5GtL#sn$gyB>s!`;9R-`p*eXQbB_=r!8M;4S| z8ea+$YIV6a-k`9CUo*T;?;}WFjuE}mb)l0LyYf!-6U#uh=4JeT7s1B7-Xrw%t%&wm z+_%Cpfq;&>Wb|_W6}lkeu6(~a)=*ff;5-J~dVUZ*n)$)r25Y!hmg&1Yy00#ZX6;tC zzZfeLFo^Sqf{BhdX=<{KZ8v#`qtT4!OHq=x-`eBhKp$Yg0RJP7>R-v5R#!*~=mL5~ z%*!Wwgx()rp!_S+9IOKov$Fk%1>eNi9q=7})ZZm%$WaLLxf|z&e|RG6<+1;E9qq{4 zD{#m&6Sq^slvu-*pB&v_xz(WT7j+J7LTPnzI4sG6oZ&4vCTBvu`QK)yRg{hF_#h({ z!ZgOQQxH$Tz(knBs+Lboby>;%uAg_R)CHeA^S>9s0{@N;((K9I7t>=>2f}=v=UfV|^tfTkj3R5bg&ZYz zz`2j&A^krnx-t8wdqa~Z}PQ_*)1cnRhr2lm3ajYSJDy8BQC_#I!2eyk&eUPcN zkl2g3lQj{(9@6yTClaH^LCRjBIRst>a!Ibl19%|q75`)z0gM}Fe))R0TBblv05>d$!Y9t-Q{SQ`h zs}a~|)3LHtw+#@q0JOHoGRRQ6PpqYB7WC&-B(gD@FRPqm)ISHn^J~Tl1 z^S56HyE+<%C&86^*H`Rln%ylB>5&%$%m1QIOMmDWTx4rqPoEoo47!tJu~`7&{I4L4Lxi{bZxX(~?$I`?AKf1$lTRWym8@M2t4D93 zD-|pq4{%oN-=y5`}h?S*@?f(St6hS)0o`ak=lG(z6tuNI%x#zT4r zFTkq;Ea2E^sa(KB(9SmUf3k;jh55gbR8W7mr4_izf640+F&gmouH6$s!qw=E@mX_a z(mkH7@?Cr$A8bKy>AQ6u+KiE2Mbq{D-Clc8)B`o@zd<9Ianr~iWd#4{AOHJ_BL|f=b*)wHz{|2bwPdh5ITd46b*`0fe=)F_KE+RkhjDXWW zVN1e@Z>QE9;+_-8Zy-z#S`%tEzcQXLUh^;^&FmJrDfXj~S@U;;#A12CqOKtxb73;) z&1tlZs1Vbyk`^rD);S^j33{yXa^$>voVyHxZbyL$4u=8w&1wFJo`Ej$N)c#(}ja0IGpPvA)_Q(lwj4&vXq|TWj^N4HVgHZ(-Ybt&G zS9iY3*4^zfMiZo0A%qboACkp8gVhh5^yUT7H|nDH=QSLG)&>+_Fyhk9`huilVO-OF z{y-$a43fU;dXyISuzl0iR;uuxp{3n_p5uUK{l^)h0Vn_eZ*e)mR)#D06ZnGH`<{YD z$)A5GR&g0ifu;;|0RvGxum5nf5#lJ3$jwg64W@*?Yhu43=4P;P1jSudEZ`EYXDxH? z0s)%X75obf0R^G1Q;zhqk`wVIy66%#SI>lY`~-(_TXinclWb4W&g{O3g9BHYzW&V} zgno#L)-9}LMVNkPpon$GW2LhV>6-<-DmB~7!&;{c3_#gm<1KW-tsL*w9wv6y9q7YHTP_vdNJ2VEsmRb9Biup6MR36F>KZ}*5|8^G#LI6FAOg;Og5)bkB6^y3h!n#m#XfU@8N1qdBF^sD`CM5FD1KtmnZw^~cL;LQ!} z+C*ThAc<^+HN^%oZ$lcg4UT7Vm_O?&ft!mJ9CPnBF$kLvyj0PM@LMK9w8{s9{a)6xr6*V(N|+1WV!N!ALOJ!1<{xYJKdgz+e7Gjf%o z|J&yp4_!hBg7O*c0{FG{AR7y+%#lwWy2Kg2=C{OXy*3q7L8MpNYv|bK_J?{2PBnWC zP|7lBLH54o8*7sL7a+q4>`u+z{!T0kv)JBRUw0USn(HX|8jK^}8oL{Sh4i)oF!(4B zaoI3M>;xVv5#|uD#RQNiy~zh$;)A?3QG>5iyTDjf5`6UQ!P{e7fVFIm$+Kg0oBCnKoblX-&V!#j)cXkFDR`}u9u(m_ zaoP^*nEL~-?y5Z}SNBol)eS+jc&cFUgddrQWO^z)o%kvbIz{OJf=R(}dBy^1-189j z+)+qzKW7J83DWH_*7m5fhW->L#0YB(=iJ7{S7g*1B*g@H4U)xLr?{t zdaZ^STa4wGs)rN9uD`h92?PEYO%B=?>b5Qte#fof>W_ss$4^*;qd~&Wo2!gTc!$jHmbRQvxypLPBw>0SymX;8pNgHNNCuQm)m>s}I z9)4}E{x~*{_&CxAxV_R4l*X!1e@P5N=@od`{HOacgxbco7x=Jwj%nMVksv z6eqxu#1Z@ar8-9CJ6l2DVADiZ^5jdoOfVf-Y7QV?wLGeiQxokosr9F_fiOcq8Pg@a zl{uT$&LwxQrF4`Ni)iB9m7E;C4|$uAq31HKZj8m>t>bSySq6~!ueypX6;Fn!tXNMa z!&rirP=7mG<#8&P60XVdNi#4^N8TiGQ1y)dA#={|Y5wAj^pVj!DHhQ?287(%gjyM< zEIKGdZ>E<6WV_v$Cn?)2jbm`~<;l7*tL23tMsInf1k0xlwm17dZxh(?k-8RvzW~s7 zMB=cwO%h#Na|(v4*i+%!4n0Bqgqt{0aI!VMA%o-Th0DtLvcDA0&N`BjrbNgo3L{7+ zyy#IBs@RZn!OcliZ{HT2p0201i-WDBns)A4MqYQ@RbstdJ?`!Z*mYEqWp5Ja%qhM0 zkzUy6ol1TI&t)Vwbr&tnSUSPOe&YJiPwJnu2$?KlU2RN<&)JG?jaF?sScl9SC~ZE! z{(?PvGVY3po@!=8jV#LPo^LxnF{?Qwq=rj|)(>c4HoQM(3n-1eANF=DJe|
hoc#b541;`dwDVmhv`p_#2wSS+|M^aY;{=aSGVf(yCr` zPTZ5yscil_R;9T7^G{wBg+?m&%jG!PsJM8^qr=lJOICB}41}*+Rq89bA1B#+&Y>*( z(FObC@aI@?C4~%8c@eddxAn{S6Fz&Y>x|H2cz$K#DgQhYq;dtvqv*eKmy=?D0WpAx zX2LshqOX(eCllL8Lh0`hzf!7DI9vj~%t}&0E`8swbIttrl2!2ZR*I;)sGo{X+lVCU z-kSfJy$g0-@Iq^(Xv!ZCtGyC+-UGP=^5Q9Z;cJ*gR+||KwBHFV0(;knf9Se!2a3(d z?}*xejeh&)Qq-vP{{GCrD%s&qo|R%N$mVn47%qWNJ%yIf=+@ z%$>0Ylx+0y!yPZ)vVJdXXu&pP7|g_jR%6$GQ~B$!%E*o?<)hG|L(u zQl7DACy`D4EY;aN+LqhQL@;~snY%;*rdsS5F2yNXLvvNVY00qKo6Dvm51`ffvymK5 zCj8)J@W%!CqJ>F;j#x&#YuBYEO}NNNKQq4V_cbC6EiNWl**vBu43J*A6dSOQ(3slz z1lD7aZ`YeiqUa*)k}(BkZ+DM2U#Y2=+=qR3QRj1g0NOX6PCkqgA5}Pb_fi{3Pzz~` z(P!H)ss$$PBhY#tmx$R99S&&b8@%9CI}U=TJWZHn%~8KBW4V2@;fXzeaRIQcr|z2z z%b?`LXK%6wplJeb4FAy`TH9_!g>4mZS+Ri$XeRjDwVeXn8t&}ca1(WG>bfF!o-Gi5 zg-=ZnFUAXP67c#;0yF+4)+yzr6iVdNYsU@=c+a1@PO#ybj*(EBJ%iy*d-=Lv0{ph- zfBd#aRn*ZqRL#u`Zt!+jE>al6UzFzD45S3Jt95Yo3EmPjc)FeGmondhxUlQ404=)H z$|Av2rs!kl`;9+L!mVb$i5F3nU9yHVha_7D83+SnA2(D!?#sD&BLFQBbm`a8u-b19 zl25-fd!eH)PieK%Vp|`xdpM)vq3E9sx%S<^J0H+v&H(L2x1foIB z1C(B3`$$<7Vm=)Q6EB9QGP`jSe}76tbZ8Fqqc;sP)ej68Av`*v@z-Q`6Knt!w)lzWdxWV@^L>SGJ??Q6cLL=_|IdP zDbSs^_OaTUlk((x6^Br>Qca(;t%LM4l` zq)^8)qOznEV2)gM-R~2OJ`_PwlX3x$m&g3a>#6_aB#Mi!%O4k?p?!;k=j$J%huXMI zVYEkO)ycyJ1zi}Wg3-Pa$0`dh;GG=;VODXe1;Xs0y}x)f;2iMB=$!9~!#t6u{j8h`Yxv^W?v6`_0fhBs!;mN(>xjq_zi^%eAcP7! z0jro3Ka0DS0$IQLGjT~oGHc2Fat|@PD@{8KNb=_wAEB6oBttZxDdJ8Hx?>7lujrEh z-Vk9ZH^W2cyuTPL1Od(O52qtw`S{}H#ZO{9U|Jl-H+cX)zaR!r(+kUp{(I_Nfz4o= zg8TYEP9zJ3w{%C9j2xiOJAuM36BJ~~nT~Mg^ckk>f1kMz&fGU0t!s~ma{tx{Y&8p$ zAUeOu^kC*?^a$uYMp@#mz942)zNzuoTnmRGDI0-h;){lXhf~Jb+=kLg76n_xMokBl zVP|JUPDuPY%a!#>CNXv^)19FC%5y;au!{f_Yw_KZVFVUw2B=l|v8XcMEWfJNuJ8cYY*|0)*MC>{;NU=?V>M zb4QVuLyz*rC(?bmW<7t6Gbr7cP^|>`=Sj?Q@miS+S~85=?ja#eRQ*h^KC-c5c4!4)hpz0_I6tCExT6~`8o1#0IFu*K7xM9B}q;ZugqI5hKqpI^(0!g1WMHXfpd@oPCeS5GuRqig1NAh zGY;Crsx*3NBCj-c@o&h*9f&y3+YN{wkex3AJhXQe>$lt<$7* zVH(Q@ym$|HAAoR7R|sW0n{$;Uy?GP?k%0)F|I3P;a1tg{nnWfE_Ops*C8 z5&~Z&P}UO#vz#|0B@bp>e}rM(r}+G8=Y0mtY%M|wWV@S{@qn>t7%Z$yhd)%5vt%XCc9_6Qb+JCw%VGqU={{ry{Syb_ z^GC@i=t!c*H>9Oe<4w56FeW^sX@ioLY-)n8GzNb}z_k@P>LK~q(#KAd_kVu-toD4Y zJBS4_b&0-YeOZtlfA-dJ3#xm0ykYBy=g|ASK7yPf6MnN5(D`{9Z8OHV)z7aac=ilR zVpEB3LqmO0j$P!S*;j!U7K8+D4-Z~0upyEz828==lyC(JGjVC8Mpv5)dA zeM_oyto1xJhTrK~3(8Ngu${rJ6Vl_asn>PKUdP`q{3&v2KY4aLyM_h|levd%(6>}b z>%6PD=LWmy>J$y8cxY2G&PXv53Yx?ug0Lt`Mp3X+mJAo9koc8Ns86pqE-9`oGnM@! zt~+7qtORxa#2i2~=beJuoo3%6W&xh=$GH?BR)}%M1C+~C`mFBEWdg0~$Jqd3M{Ev1 zc~fZniP`eU!Y2k|dwOSCH!5tjI~`Er4ShWi^}bFy2CGE2Asx16vv(Zds3vuecB5{N z`ZHsDURd^^>nl2?bozVa+UYIYfrwN6wy1JE7OR&%b!m1awN{HM_KIG1uBoU(Wv^eD zV2!WkEF?004ftD5iu{mpu?QK_`TXocymLFX6%J4a3eS)0Eqzv$#TIi_xK>p_PR@6*C6$5O(m1HVm+4oSQjKpnb@K zXV^n+awwtovo<#Bt1B36oWK@8zcYCV8jrGw9V`-Hz8=N_Kk)VlMc)}PTPoSV7YH++ zWP4G=jAzVmMAiACqu2%&sQ0dv3aF5D7|WJ86MoI1m4Xoon=f2~fvda0OUFfsak6MB zQz7uHZTbOLbSED2dXcxCt;ey?Sa76A_O6U!gfto5nR4qSvh~y+-uuv)Sy>0gJod5z zN<^bEJoiSxbM!NKSnU>m6^z>e1TKv|QVfcbI2W-0-FyR~%yae4wD9j#vVBxH##*Ac zu9+g{4V#}QD77t(ElMyv_GclHT%kE3ni)$27#dG&l@T>{{@0cOtMbjZA0_T#{qoHv z+^UIO(C+b!nd~Sdp3(Tl56#fptKTCuB4iD<(JiC55(%0%U0)MLA*b4vH9XfOg~0OK zDu8N*ak|`)H7x&;)IT3qTP1s%`#3>!-wKPbBr4vEW*Ji;%cS${?qyyy&-^b<{BdkC zp^5#67;0Sh60+@f1@O{f6)fMZgdc-Dqsv=b}Ux=x(%Il*$@v7|pyU zz)O1|YRkeCJi&ywo4A0pf2vvT8iW@ z<8ioy`q(;mDe(Dy;yKvxe7*Rd462(&&a)SOqHn)c)NtG8{$9{-*Q|VxKMU=e=P0Gw zgV4VFhHWVTuxt8iAPj%aB(`rW;v~^L2@}lt8QW(sPosIF6nyAe3AE0SawPrG+D%50 zu4#;T09DT%!YbVVd;vdG@GOND%~Qh}Y34$SZMCKEbQ1A)$MEFbzhk32^Mx*jPe>Bg zy*uNLPVcxfaXzdzvsVZw2>E1(-0CKC;vww3CEKQU1z5aV7{ml|+ zGFXn(1zT?QbNI;`ZXSi(NHT8}1uLJTMP!>~L~N58{e~p1?pmMb=kYeXgzZxiy)pJ8 z_LTP_nPkXEuBSsmz9ttOVE(9!HWr)Yz^}fuR0mksEmL6a47z|v-~H^~+`bUX?+u+m z5a>1iEoWHmN^BSN@BB8IngrU|YJ8={S{XOt-ooHbx+r?{ciO4Vs0^^C{PB~YsvoX9 zOZZZl``qZ?@$)*5OZzol9$r=FYy5jjp=3)$%$&2-U*fBv-na-^sX|dp*E$T{N96l{ zUyOuN`7HL-67m6vHl~El~c|utxlUVqhc}kneqvfeEa#!+23E zko|>V8Qn~dAjCugE*hJI74|`j704pB50c|$kc&BjySx{YI*&jUqD<{t6e$G;nQ*=e z>gUvr-5G>ez_10&?U}FV$SNL?GzrhnPCZ;!L5a_kDqY_&x^YnGX`gm%oGZ3RuZZx@ z?P;EhR!&9-FBi+?5pOs0Z`yC%u*>CnWZ$%}_dyqCNJSA)`2`hL;bzWlny}i(gyvVB zuvxyib(a$UdLsK|;{xm(7j2|bb8su2-`?M~hy{F#uTCefJ*>7Xt>Oco3Gefz!}*&A zx&ZlE{|WBRV8kah{m+nb9AQ8O?!n4IX2}^Qg0n;XRBI@-7m0S^1OR8TD72O|`jOaj z;@z4+0C9gWA6dfEDEY|6_bh>E8sF<%-bE3$^Dj(E$p+Ar#pqI@sfxh~8*2^O)RJeu zLJY`4n}(t$#2k?p_7)?OK8~tYHZu+)|-aB0JiQk->^-4^<>I>sD3guN244LA7TVWcC-@qn)VhwCAb-2cTV z&5ZysJnfka)q`zF!0DJDgFkwpiDq3ecu1?GfAZ&x@M;*MWC_Y)Al_?1-@a2 zQ}@te?>sWwpP{S!y+_DnqHD=dvXnszQwbH=O5jd#ySzhyF$G1$jM3p<{j+6*0icSA zk$R^?CDlJ^N%8Y|sxUbs;MobcC;JTo7e9}+3L{0JOKL5VVsSF>Lu+-_Or5zAfd5GxEfURj z!O&8OW~~;#a12J=e+|+uKu2}c0UEM2ts+atXB3yEP<&5yQuD%UQJBhiSxoqY?>pSg z&^(s!S5A1>!*mMb8xP2WzjFev!QSPne94RgkxNn>^}YoE%^7k9{`?J4A$tfH>y0oORG_x^*R!V~fW7~}i_HGNm{Mj}BK(i{ zG2w$)1XDZIu;2;yRQoJEP;=FU8K_n%EO%{qBD;As$$y^SrSbotaP|KR#v_S}$hI~} zOGd%vind1qQI#OkV+Dd%+GM?qvVXg~y)-IKXFY*5!EOD52oFa=F*UjKJ^F1K3`&6_ zJJ@{qUIYG70Z8cw1mKGel4!6)JpeC)QDF8=KH2SmyF)#N_OGyojpE4i)WgrVWEc2J zAdJmlnnQrVx0}8Bs&j(A!4)MXB{R~F+U=y!dywfhbl7xN83t)pLKnCFgzWC=NdPLB z`alh&z~qL2u~2^gQXfn|hjjXEqMcoVe|AA=Od#^A9tK34m(DMEFZ_ln*ys!B)Up1! zYQ$W~2J}%bA>hBYWqRZ1rvn+D1r$(u3OdVAG+}6SPd39wQ0xNKVgs)5xo39(s9S>j ztT0KZndgsN0vACw{x^vCof=JrSQQ~R_ztV=oxQE~4g`jp{JDeIzp5Etpwb3BXawf4 zh!km!-w79lC^!rvkL{$lz$aP+d6hFTcaji!)CfG@83b<@1ma#9&%OFG@h6AMfx2FY zu!0tW`n5JZJ1a5VZ$Y?ez3~x&mO#a_f~y9_cd-R#869w%y@2D#M9m5dwPP1^vIu5M?#5z8I{yt+BYVPft57N9r%2>#1Flo>{e zn?;NgzGXm7>Rf=}Y0>Mz@oyf#wwFBD9n_oz28VWl$C zXAf}rC-pN)SIh}pqf3vb5Q>rum=9I}JU`ly@c_aUtIP96Z36KkKsMTAEagX6=>ht> z6CHds2W|pf3xgdH;oa^gG|in45i)ac!{UY!b{ALmO4rUD03nH$0Qrsr%siXj)SObU zt~L*cR)u^8IB%^0A!pe@qu~{Ue)otagki>2{Nd(K2V&X5Py-<8+>IBj_Mo`g+PSS| zOl?qtM23nxl=oEkUSH_%T!a51J@*~2=p=}~MgoVmEpxxpK=+r6dEsVIIH+ma19H*P zgd(sG?nw#?HIk(S)Rg8j8-vG6mP;{Q2^I+Y5Z+UL?Ripvt(k;7uKwS0e`&3Z7-~4WrA$^boyTOZa zahF4=d#wUJ@3}MO`D+9%i~#5viEcy@@Y1XLpwa##RN}ZD7^In0S_Syzg&A#sIsMia z(ZVMg?Cxw=UqDI~HlS@>PTc~I%}*i!+r|&!Hgr1@MYkESY3iRN&t+p@)r!B*k@yak zhhUvM-UqKuLHn6zaHmw#|8nZZ#CP!A`0<4!rFy=wWdt(J@$$L1DE$JQZu9Fj9D&uY zuf#A#*D@Hu=PVIeEIiJmKcJ+WGA9YIB4mkj7sIxpt}qJSh9~n~Ar~Eint-LJk@(at zR;Y%4)lLdm@BXvOvrzAjP ziobu|poCC{2o7x!78Cd@u0~!W*S%fPc6I#Of+-46M&s85hJivsxd0G7Ms*<)*s*sP z&S)IuGv6G7ddbW|jxb4lK^pg99?fNZdZ|4|Hm=gJo8}Q%!Hj^B;)uQ|sC%cXY_aO$ z0lK^zOn8DiK7I(PUDYYzA690NTbEk}uIK@Azr>D!3{xAsk;!js=2e~-jIY>uC*ZxYgJrCK&~^950_ z&

&zYYvY<1ycq-+{v0+HeE-4Ik0;omR78M&S#9(PiV6C%>f)*g6^CD1pm=aG z!j*PX!!L&jxR(m44xmSU(AiZ+;BLw=!h~hE8|r{ec^ISeo(-?kI+T}ZHG3;k3ZG3( z!K(GjccllU)hhf@AU@c9*6wIAtaCG)#hLgs>ny8Xcgc`j zdt8V6T!My}_;$mq3071ZdLEbAoeGcPl=nmZ4&5cZpEM}6Sc8xj}`>fngPoI>= z2oBsiaQQ8foj9XAIo;-YZ3%thPoDvwq8>d?nN-uH5*Rl?}Md-?&FYy^D!1}|QkReANL1rF^ zBa{J5zBQYa#$2vq^y}yHqoXB!*q+kd_AfK7&+8+_uK`8R!CvbBeFR^&yci+zG%zTiY0Q`h^umkaCQmi z>9Ogw`OvX%heslk3s{u=7<&tXBsQ|tua_O3ckYk0%^ah$LhP$>F1;o|UYiDQ;&|%} zQrCf|{nL64YC$ay>hfsKNZhuBSnpkYGJ6DZUJiwEB_6Rjh6$0AW6vf?=3e|NPu&pw z1Ev_t2tbJY78Oqs@CpjLnqsQq3liiBl6i#~omL{sVpwIWlO6L7N;|8Mv-kptvQ8L0 zifuLQIZw}3VY&=UC?QBPVH_Y6UK`J5dKr+IrXIN|4{Cxo%F zAO@Rr=#sp&cwQ?b=!#a1l=DcpuPi4>0H<$Rb!;=gorRb+lTy9O-M1P_jJZ9ofOOxv@oLY%b!bn|SzWK100;aTr(GzvJn=H2Kt*#OHDCGv@K?hKzXmQeVtt;w+ZMF;P)4Z91pvva5(7Y}-MaG@rJCy(EJ()B zjwh~QuVcoDIkVE#I9{isHgG#wcwJsn{R`HnpL7=L)~6)44}3yuz6g@~>x?AsTFFAr zl%bqH#-8XndyQx_(HZsjOJpd=Sj8VwBwD5jL~8zA?zIXv?cGdeYE`Cuht#G4!hDK^-zGDO zutl<`-v87~<7TH7DODHWE6h`(n zSqDjF7w(!;mPiO$$}Uls5{38tl79DZxu55K-uM0I?T_a3F>_sW&2@d3^E}SuI8F~M z72B<9c9qfM*F~ti)&q4%IZ(3U3bYXl&k#7X*$@{wHo7C;O2;x%@!kCa;Kd8ehf9p* zncihK*1KoCL3HBs1{qvJvZxSGvuk2xi3OA_5O2k zyTzM@jNlCCrPovId)ktucd|Bjwa9qa>pc{m4=L@^RnGsGGk$T*;Nc%-On(LCuZxj3 zoIc$_peO9}Skgb5lke=5G47ZyoI`Gt9xUgJucM??MF)r+C5F1w(6P&sIZRadG6}wW zYwpgaNRD-}4Ee+b?J$a6=kkEaQpI-{P9;M()jg3Qyu|8R@V^AvG>RR!B+BEk`(rq-Lc#v zooJOAz1!cLzmOG9Dy3`suY5c}h2~o-d}(iLSsr*0gzq{jcd-Eg&TD(mAQ%=fVT8+U zrES!*G={f_$qF;qxJknXJE)ilDtAk`E(^g@)_kl;5d#`u2lzy^?V^>u0bWwOd^QQ< z9mawiTEx~e^=%mLW)7O3L-`{TnQgP9JAB0j!ajXC-DMvkdJ+)zdDj!v&Ryktyk+%61JI;EdmAP7$v5#V?gAgvEt1w%Z|d3YmW z)fOs_3xvh-Lf&r!%(5@rR#7fE#S!8sEr46ij~c}v4F4;j2k6%Es#)h0mB(b0FyP8U z?3OI04vm>DdJ6&4C~Gppm7Qz((sJ5inFk*5_6Rk6gmo0EX6VMxwn4R~Fu8~|huIns z-75o9EI|n>w&adbIFU=ijpj5>oLYTQ%)%lB!3nzWXC0E)DfcyI?F*tu2J1>p^6I>y2QkrVEInNh{K!sBk*BbL zrS7MVYKtF~5A3|D(X^6Wuxx^hx~;>q5kt$*O*}Sm^N_zl(0vqKSgF6SCUcC%Jq;~w z7X1w>3CRE%F+)!|5|xQoLy$K5L2=SC5z~-099IRLc%Zk>7XlU-&e*VZ%jKKJ1=TS$ zSQEi3c(W#nnO|`pU{Ja&z(qu1Tms~02_V?AC^+#rUWLjJgQp8q^}U~AB_eQ!uy^QD zMOHPLWd%;tCV#n_DG&M;XsTiQdfR~)zT*LxQTUtf28!8$IMGhU-DH#L2{Ee+vm;t;p7HnEO{@>}F z-KCcMigZK~*_Zl~LC76s+EyG)8&EkHs=a?h?96~Au82R`?5CFzH;Mm5)o#6=L>*QE z3lA+MGunrki2u3H++Kz_72xS&I|&7ZvINMB)~d~@dFT(ANWL|IADmM3X9I08*@N0N zm)c?}77MJj+9u)(6Sh4+KVSEf@&6-+Z@M=3l3+)A{k7he$;C~88xd~LBeaIsa_a-; zSZJ~o%Jdt;y^06^el^UL3qVj4rT0NLa`?Sma$#0IjM zuUe`+{A9Q8QU@(Sz4!30ar@U3MX-ubRZ|(@ul0PtFyFiEa5LEN1XbSx>ZzitoHjQd z@h2(;Edi)hwub!4xVb=3U5ey-Nzl?%M!9}t3zV`mpB8?4+^W!c4G76RYd|cOn>0`x z=7m}TLk=?D4R-d1kwsS1(CyO|n2V9oF;>ifhM7YV`v$IB^S1V6vR7A3w7P49z_&(KYxT z*w^@S%`S^qez{r!G^~~KI+zdrOj(29R%m_Om3&H%JLF_ghMoGUB!rBehnAgTeZ5PF zYXFwvdsj;DB`wHl7JnuO2qKz;CBJKxeKD5Be-n*_1(YS{#Hccln8Z%N-}=Z~vhs zQBXF#O*|3kJ(?9i11h0US@^>f+H`Q-x>T2EY^uXR>*=UIrDD60O5EG0`R_E&K&nJnuabmu24A6(Z&_+^h3Qk zYVT6|5jS~ci?`Y@3K~^p+GIR=TI6|Niy%3c%`U)SWj#jqwmNYINGk5}Jgyvx>Sm~x zwv?Cbe5@0o{BGd;e%|9m9Pg{Hz65IT#c$_jh^_6P5jRxX56sv~0U|A-;6FCJKe@c{ zb~h!o+`zl2%_uP?Zrbbc=qH8e8;f5_1>m0-$8QhXN_1Su zzUzjH9{d1mQ9JmI0oi!MmJY~H&X@HL+cJ5K6jUiWc1WPogSQs0Hf8aX?FnH(P(McF zkEnu#GjKjQ9S{QksM@-TVJ)KK;_REnPO6rRE_FIBL~MG>ZodyW>wUXQiEhX_it~^? zV*5v=d?UGQ@Q7*$VDCDAc~0C{TkXOv3_(jP6&I56-H^LaXsnDH5M;{m2M&7Fx-Ik zC4goAh-!|*BXRLkA}X+q1u*UWm|-ZX2*~LqOjlRLJAC6=YNCzX3ceC0fC*NBC(gxS zt+eOigCCtIP&e|v$N5rZP^qeY*~3cQtaM0#Rvo9CUbui?8=+9Nhb>n3vgU(HeZ4MV zlMj`|wILPy^1e7!C|Ml$R=oL&lali!d!v2sHlZ={U|U5`-uO8%#;d-Or}?1)c(qI3 z#CO-}*?#h!ch7RQ=0Eaw)McOdb=?+sxuVHZq*htJ3w>W2#%#8d?p0;h4vpHx)@h|V zn-hognno1|=mis5o^`3>?h*`Uffn^T>;4Q{(pRDkmNdM8#Me)Mf~{4vC^$t{T{Y=E zmT%DZ85*~{LZ3eOAB=qY0{w_*PHqL1zqjwSi0K=P25-7ELpOJ~JwGCXNY-K20IbA* z{?LesBP&sNBS5c<4t$B zIH1j4;|rjub6$M5ZL={ahoUbU4Oq2_lVi7-F66HWotVA#;)=r_`QDx2gA`9+k%koR zoT~rk8pU3jwb_m7Yw>Le%WIeG%6&nE;HP~ceNJC)?+6k-J!WS<{K<*} zeC88_YEkOFrIxn&Hx$`=OL4BAW}%EkM^^3_HSYBg!qDkUjpB$6>x3;dG=VN5X8m;| z1lCQ#hgG@7;q4RY$G2}JI^Nu6{0@@at`}$8OxK3q6`=4c;3aPu6af!RDuMa7q$##{+OOZ;^+e=vM-@TF~%^@*C(OlttjXRK(S>LpD`+ne6AWJ8=Ddge4YaMnmd50PZB zzNEPqX(grh!3_uk3!PUpqA`e_7qs^{ zd}*-{!^BRa$REnr)UIe*QqR_e;@Qnf!58RR%H5bCAK1LM1f{|;9~(L0UBOKu2q zXFWi3iEOew&j7<x?RH-1eE^U4H%L>iD!IODo_y zxZpSc^OIbHz^4?}(oPh^JHvk>((H7QX#4R>T%5L=1ILYp}Ftk@IyZqkljA>}MlaupqQ$rzbFd#jh^{Urt_<=(LWQCg@=8i?_?>13y=p z?W_sT6xSYunYpH-h!Gx=AZ;V+h+jqnWQ?9x5@%>Pcm2 zVyUYdRq7^xGTSIZS7x_vB*!Wlc;_9wGEtWrjYaGZEFCQk4*NdP^S}zF%`<$J(q@T< z=WS8T8!9ic(!7XO7qWhp(Z(%+NMfNs%}Pkol~>mbIi!O7jGuZv*BJ!N?p{n z8xY_E|A-IUK-?_GFR)$}r?hXt7kec*yMD^cW4S56{GhT9uP_QO(fvbXG30Dd?) z;ZJV;t^VH7#o08SY+}4g#|KN4j(GlF@Ccx8u3^|FFjBvWD3vFmBAd7ELi+!F%t8sW$$$>v)Dk%TeI8P@3O_Wa5i7a&J= zhj3?sHP@l8%KI1t6UoK@Q=%**1JQAt#rLheqz@xO*m_NFM&c(OAkIza2?EYnCgz$+ z04sPYuI^cZeZgn-zC`w`R^xOPG*!IJOMcM;4qPdMxr z5xM6`yp2l0`0=}?77H4BRrbBXG{gq1NRKMmsF`Y6GMsj?w}SQR1&-Ywj!h@!3OeEo zxwL%fXy<|8G&AJnA&r0SU=x!3_I61Zu+>NSo=!zjH-Bi6!NkK>EK7f@J`*;B2i(8$ zPRl52$1YBN{c=uO9IQ}y(k4Y6yyO=QCw+l6G4#8*J6EQY6{{5E+N}Dm{4Nq9u|5T8 z4JETscYc%raemJgn)SSTTkfdUF!>WB1CJ}hn`Io}z`)japMMVtm zths~~_VMUcY!Z~aaE$N~H7AEDKN@v5S!_KF(#nyhm z8csW5!Cdeb%%lB%e}+?iE=p~~e1tfsU5(V#3d>$QFZJyk7#x`gC7YGPsVZ!0CK;f( zg>@oFmy4*w$iLGADhtw;{{^GYbs+fv3X^1h_dR9Zx~;xM^@GR$he)WWybM>@PS4>8 z>irouZBSK+#0BpM_ngU}9-IfFesKU}0Rl!UN#CE4#Tx zbJ&@VLZG3YwA3vSh93@4SoRO6{*062g>m7(O5Otyzwn+6%gAnVcpaSPK|}2|sLJnZ zo8G43BOS@iuS$)eF6^7yjovAQch1zCBu)YNKAe9qJAzs+F$Kq@N@M!Fw@{+F@P*PL z#lM-n8@Vpj^Z;Gzo@N*q;`B6lN_el%iEeBq2w;(v@%_jpXKKBCGg2%HiUo#i-_G$s zT507yzbsf*u{%3J!yj<`4tCdJGT}Kt5c!qwY7MGg>(e?*dDV=a1j9~WUHxHO$IrzQ+MW-C*Lnoq8&FY{A<1X`K{JTHOdnSOIG%0?0KIAx%I=5H#PH#X$&kFdJJpjMh zT#Ro(5jU!~bNd7YsMujZ_i-7Z(UJN4O5n^Z2NYN@&VD3UJpnS-Wsw$#3D5w$fDvKR z4y#DKK9;v--;A2(#bR}P+r3heJkn9bV6 z4K)Bdc|?0eN*eP-;0t1U0U^rA8TpYzAy~Bt2z-1b|IGZmcqB_idSrU(F2^S=3J3aw z_+SZOJmI~_?BBOI>9w>x$l^*u%H}ni>K=>+v@}?Owl4p4nfuYV+WAb7 zUr~l+hEAXct_sdrJ}gY?I-!I}V~~UT3?24O1axsCii$9jb7xKhfl=>h`G1&< zFA9cgejJ8Oz+qSM0=4J&UC*J(&<*6|wI7^nU-kVQmaB@-5uM<)O?;hGE)P~C-|l~| z_^jjwys!$*UB0dP;9Khq4N+ZzFI7>2fn=EyDRGNa>iJxf zqudfrs*s&L(rHCv{UvY`z`@S_J@RF8kWPYeXpB zGBVctd@_!o2N6yeJD^Q&LDGr(oMmB+XJQwl^ojk&T@HJ8<-RhU1VF=i@I{0(0x-dY zFm|h&jG+;*<%};2JUElPXnOvC}6%XFE(xu?#m4`4eh+pM`=g44_6xxOCqWz`F^AN- z!ky4Axj)y*ft&{T(VGL%R(5F)D1$c;tl9;P4S|TCK=8+UIO9O*8-J@=x7XHzfJM9VT`tQN9@xtDeSHPVKwnzM-T*I{VzT9{L7c#e&w@h_< zd_!(NJqkZt{Uk3Q6Z8 zMJN>hm*np`mKphtgVuBLS;gMfKPLB|B({2vLpP7XlHAD5O^L1V&bbZ_e4&5rucSbYZml&cvCI8_TOcqh=T!snS|OFD7Fl@IUzGxSy20bqtY-;y6bk4!oW zjuCChnNrsl5&^7y1TCn`kSD<6I0gF3CjljhNQ^D^j#F zLA0d1rEf4*ATDxqjw?S1!H*bx&w95Z4{Wt$E$7 z!`fXkJYGdf%&|1-#D|d?4Qt(>UVp{b3uN;px-Cv#AD@Q~KHuWxf)M*9F^i;^1{?Ie z1agTukLLvtk5oD2)OCTQ@u%fn;bh?p4#-L$wKeyBcGOU*hm_}FBNYXjbFR(FjuGRp zoSa4|PqH_?M?#j`*5z>~+n&_4ieN+ewnlk}m-98!_(CI*My-DE3>kT5bbPM-jvY9~ zP9I+)f4z4hM48M{Bgf5yfeH`6yNw%z@Ul&}_DryaSEBY8OGl*JiVZzL5xkqSkTpRh zMRN_LWzM)RNI4ngl7)yzthEgvrsr%D`k+1O+|H?H$j9&JP(F1?&O7^L(cp)7FTa-C zYmCq(M5*^w-uZ5LT06ctng2#tv=O3NFDAV%zo@aCpC=}8y!s}=GQ&~O7WXXONTmFs z$<;2G3R7JE{-!pdQ~{A$XSur=eAhZhG<9tW9-3vYciXp|8&a7n>~UQFk;qvLLMg|a zC!38yc#;+Po|i9mCWNvuX2WENiF6vOvmXth@6pYBcts)bZQ)oKVxQN?a$S2fCDnDc z{cX|C_{52`TOx}iJf5HP-@tBnIp9>Tuk0mX_QLG`ob4`Dk$DDDQUUvCn-SJ09*M-w zJPfCwrG71V*c8>I!E+ISuoTD4MlMu=-6P$O9Se_6k? zoRgTx5BYoQOT9Hz4c_Kfgtsrq?^Z|yNt_g<-65|W0tSq=Ec>c_rFM|+t;&)QgBSW@ zOOvNx)d*3kyRgM4$kSC$8eF2Qj^6@#WAy&C^=k!jE$!5YZ?BorwdCu5?%dlw%VqGm z#8ABQb6alAhd8hZ!@B=iKI|p4XkmO(05~LDmJe2mj}JV{qOhIXS-4l2KKntUje!i} zU{`5B-dN?RT+pCx86R?^YAp=M#;9zw#mQ9I?5f-;7B|eRh6Am(;TpD$(Ey&2I#ZU8 z5SgQcR&WQpEZ&-m`=%RN>=IQTl7n^_+1|vvmTaMDS^5wg@KO zM(oJ%^Czmhy<`VK414=2qAD^A1~!}RF#s4m>a%nE9uGUX+9}Me(RHXQ&Z~r0&*og{ z2;d{MNA$jHX!3eWaz5qY?d2B#`CNN*Wks1khWhOY@g5r@W(?$4yCe^%|;}~=!Xu8ibdKCbi>9qzc=krxh|^f&emcI{?oxFJ-V)HMH^AE&H|3 z2{F<(uF|>^?$pYB#c}LApSqm=tD*$3Ug{5=9lTg)zJ8LX`CJlSS~cvOaWD}2IJ;{-?_B~x(Qrs za~h`bfA7dQ6GcTm(#GBbAz~PEz_2d$?-;l+d4H&0_Mq&=FA%3a^hmt0d>k8YA`>8tgtL!9_w(KHmg#ZKJ$~F39_efkLW`j z1WWc~V{Ejm#(1@D%J54~>3=^lg5|;Yob0r#KjCj}--gKQ1D9Mj+&fx*t9^WA;oI0a zDAbOh!f$qpLj=)^HI(bNHV82dzWCc36V*RmJM4Fh2DqG0UR}y|AipTN+-rJD5vv0h zEmnup4|4A(>hLKn+=r>LVv>-$27~{*0C?n+7VlU6r}gbWTf^07cE7T|N&pg-wlZ*M zF3@)X{zE+DFbq#+*dVbUNU7UmbNJIAKxyEZL_jAI(sM84SWbRn2AE(4&g#RB-dx7i{Ql2GQthr{^VKUe)!Y_X@tFIs>(M=`4B9HUuOKzFuFgc-ma(Y z=OM8c+%>zy2hMv_9@s$$ks4CUp0P%#hnO;+(?k0oQ504>ncMCd|5jMGa_)$DXc8=Q z-lV)6jG%Vwk0`T{W0l=BuB(W`ZYiqj^Oy@>58VE)v%1#N`5Yi~oCkas86dV~Dz%aL zNICuK5B1<&0Wr@3n;F&!<@jI(QXx6_QT?Y<)($K|fi>T!26|{V?s&i64@6G=^ofLP zyer<08>86W{>+2W*H3Q+^DT0Aa&jsU4EjG5C9lpZuqfd#1dEbi4gxS2%>-GR6RbYQ zZ6=#A^DF&h=4wFJv(GGOyB5g zAWgEyDeZPJ64_(=gdtuGUa>x0PgjY+SZNd+hHg!{rw8NR`d`<6cR*XME~dl(I@fr8 zR}orx`Vruis5xo_W7)EPCKev;YWEzpt2i&=|4`0E?^dEbi0(0dR;Vopl z^E)@}8S0;i_x;2c&dhF8)2m|Hh)QylE2{^}i}iaNYmvzY|s? z`OiOT#d&1K3up}p{&z9>(SN-U|N95E>!n`F;wT|hXX2mBWw4XZUzCEMYm@Dwdlys3 zM>1G`KhfUao~bPJE*secv4zB{=n_LOIA2fR1y`@!Zq1dWNZ#iW-KgEaVj6g0&b$P1 z)gbk)ZWvE2Q-cmnFXu97%YoH(l@y}V&s)?6crW42)8i4j7vleLzB+nS}t zI$C>JbKdY0m4EL!H7rnB(%&1m>Gv!kgg|70p3m=XDggUa+3CS;t1VoqH`c*F;vqft Jd#b0d{x9{D!9f53 literal 0 HcmV?d00001 diff --git a/vac/raw/images/eth-secpm_onchain-register-2.png b/vac/raw/images/eth-secpm_onchain-register-2.png new file mode 100644 index 0000000000000000000000000000000000000000..a93c403f09f96f89e48508b3789de1781e31ecbe GIT binary patch literal 55125 zcmeFZ2UJx{yRNB-N)UvFB9g--CjrS(@**Qh4g!lDl#C=rBrKA!$RMJCh~%6F36i7a zBvCRb5=4?+)BW$g|8wp+r~B`F?(H5u+QAs$Tx+JPufD2!-nR;^p{789M~-*y+&KcI zqU_ys=djS{&Ruwga|s;Lys&8xew}x{s~~-@u#a->+&S8FNZC8uUM8Dq7vm`9epGQ& z->z1Eh@UWr!S;MwchNKChPuSly33w8+fI*S=eU~E=E%iX{a08&fBv zBZbMiL-+St^t8xfGNSXufBl3qzfv(5W1#w{@4R84MRFK-jF|oNw`h?O)>#a)QrQ3a zdF6%;q2J)wh;aOU@f~nzC&KO7-%k`5^#m$$qtgwM`|Cv7mro#`moZU)Jpoa`C*o)* zfoo~K`0o>2!K<|KeIf>L{D{bgr>x|Aj-vY?ZwArPB2}c3?SH?gR42|bg#PvQ*J&eW z-qzpK=f}3A-_f3}zs&GcX`+FzHjB-}9kX&D3!I&Y;umrEzRpUXy%LEUs4l!a1_Zokl78O)4ghkp{7jj^w z5z*o{`DGK!r7J|fN;ylZ@Ct%>#J>icyiT|;P)=9tMTfI0Q{!xgfdrxo3a7=eCX^R` zadM5WXzngd>i5E5AM7WqtjtZg@BR5YKlf##u~s;f zFH$$F3sSmYdev)R)gm;anTo?2<;iajglY*_+z3v_4o4OlBMkjOxhYQ;uUV zrW*5<bqPq##cMB#`hugM9Fac2`KnIX3|F$P_N$|Op^#Z9VJBBLrgc+qUFnP{8ag5guQ$LfH_#$`*p+ZMz}24JTP=QqYjc9SVT3gI z;BaSrjH8G+Ma!9RB3(_Rq2=pup6zGhS~at|>3zVy?O%#t2=Ry})M6w-Or5pT7bRrX za4RBq!|pbFf5PT7yDq|UAB$Xa;-W4liAveHlLiYT``A22SNYTQ4G8^6j@3-u_Gxl4 z9u?`W^O5PBPuY<@QEv*DuAWDlf6_adm1&B7Iltj-yN!>L?axSIN_y!o*K3OffAy6z zqRiqQ`%f7u%&I!acRS?oGAUwV%x6};MWXY%1&awTlZTA|TA6&4L9`@y?K78BRsAl$ zRsCl}*h6K7Il`*6;CfVUf0oK29s2AWi_9M{@-i~|cGF%yyPX;d4k)|J#{cTuW=NKF z_K%B5a}!M^J@u6P zO!?9w7geMdnd|11{!a=-nr@))(w%=>%Ktm=`+u(@{$CrMaf|^T)X@elUl`H+AMln2 z;M&Nr4y0ARCB6}sGK39>`<=x9`6?65r=QuBZBE#@MT2u2b#gdR!c=|-GmgEQTRIOK z8-c>6@x?zHMsxCi(lCUqIHdbCf49ifpEK^9ND`I)+KlDf0dQCi{EIE)e^rHCyNfV= z^yRwf{4)}V`Jfw>Erg=^1S{-?)y*b;`}ah*%7-?0+G(m>`^Cq&YFFt~-990A!xVDi z^m6Z`h%gRTFQw$y`rRlhzr8_6A&<3BAD7b~`%hV=Iywa3v{Gz695sAUQMX;&&DD7F zUAA3t{S_~A;fATNSv!^I3-P1X%!9?}l9MU+g|_zjCBeshgR&(2c+N9pr*nZ6 z%iq5A?mGPXb2+tN;Io&-ly$ma1kc+~JOQQ1g&fVy7u;7U1bRL{{^e(Aj%IYI`I1oP ze|j{rH>7SF_8O#C4MpU%&)4^9Cz=hv&U{jRzjqp5c>lHGc=Ghe?1KmI_Y-E^hEyvT zqeLe|X#8!o)PybRF3F_aC(Q`7L&@OYc0Cc>X(icisZvju5ZLYEo09x>VnO4#7js-H z0E%XEqo~nIOO^kg!!LF5eQnX@B#RgMx69(>5cBop=HWFIt4yg53k|-KKc-zhzzYlM z%Z|6-w0>bE-DG``o$6#a>$|HOV)5m7uUYlkyHI?}u_{e8N}%CeGk#?=9=p&WmFKjx zR+S*q@RJTNDCfzejiLw4X>NBXl^G=(RWPBK^Gmzf4mz3BtGRQ_dIeI&55_Ip$QJm* zel5>RbAt#Cifx_sKkfy06G`_Tl$y|b0jb}&p5ft7P5Pj-N!?JM~ zJv#96)k@B)=}+75f0!@_X$qfwYcakQ+&>XSYQS>+EFmF5Hoa=h^znPgl8>YZ`(vh4 z!&>U%@@bh0&ns(IUQV5gno3xuxsQ%oM2R2hiLU2lZkBd)x$0+heflgEzM)}cnA`t+ z!@|cg$+b^-=4;#9+jQ!&7d`$aOh_ZgiV>sAN2>#`x5G8Gof=O)rtSw47%l(IFY61l z?6xLi>|N2AJ`8n~4Z8rkJv?T#;H+=iapiFjU;ntsM!p3;NAVMao4i@ZNZ)TwmkS>M zI%`u6cUWwvdF)WPRhfGHn3p2eu`)TeFePU)WH6xpt1i7OQMPQJF3SgJ6t{=zb?EEp|CT!5IPSzqZTrxNxcSM-QhB9$DEgVkZ9zB z{2}bU7%4dU6ralm=W@4CpV+R-@q7r4QDtzdQ(Py5RV&qNL+`aWY0thVi+=W6oM3n^ zW`3FS;S-9>99l{Cg*8UOAzr&R{-B{xe(&aCTm(A8(jCNS^M+c1QEdQK4^5tgB0&4v+XWUA!U0^Tj$sb(^a0YlBZ}<*kO! zU_Rr{nsT!*@wy(1rI`|+B&vBUV;mu4jAf z`D~)cyiKi%-&fKf*E;uAPd#iQFg|Tft&C27X%QtneIvQ6RVP!jz1lzJSb83cxym*w z5hK5RBl5QRP^V^BwM%WXX>CE(=gHIWyWt%n=Pl)8FS@(f; zkORH_aE#FQ)#2{)+o#5M@7_2h8hbcn-JGfJ%=+Z9eHB%IGo+9+@RBe(a|`6y$~;UD zdpn&!DobR2G4(;i8a72X$l~@JB997XW}|~F6OBh_EZEAbBTt^OhC|;O1FP$I+9;fQ z?W}`#t`(@G#J;^j@5pSP9WGu?Tw_e_NW9sK_(i+Zn$Og}^ChtPMl3G#ivhpExp1Yu zM=CFVrpeSYLL&-Y7y?j6GsY0qR5bGq**`6$YXRkBKx#$>^t(<1M}$mRdYWd|bdk#Sf1 zShJIwqa$q`HQYEF?N6dgCAcuM4LO{p9rW8o&#>Pu{fK$6{wS_gk)9(a^ZbQN)hhbh z(RZ8@^4Btm1V=p@4;R9nCON~9ZZapJ|Cq@pcFGFHG5wVO`0VHCJMB`Ad>V+a#rgq+ z?ih_xpk7-KO>8Gmqe_| zJ3c-BlfxR9*f|1k>n$h9GAXgLlQ(8Wg@UiJ49)D-h$EL~$8k-5`i$z+Ak8Br&kni5 zCrx4?foRUz8|r#;P1a|S5sszJpcqr%yKO3lax{wPtZq;?4*Q^_A z6EbhbNvuKRQQSPFZ%!nHVpNzPXEZ-5f6IW3c=>{uie^j!idL0Wd9RG<-J+q5O;td* zAvPp39lR{x56Zt)Le_stFq}4!#M>dQe9CFz076gN!hAj!YEJ2 z-V=I0OXVMu(R_m#ig8ZT1@l>!2uOazD%X>*Y#F^4z+wZ&8|gD(B)2_f_9aEOk0HD% zcM6POQ5fOOa=r!_EGijYwJ`N~Qd zr!J$@Bj!$59vIAKRs{HxmSR7lpb^xQV4hedR-FI^l|QxUnqW^G>N~-t)zTZ!YEK>6 z+7_<_!kz+cu1YI7Wy7g&*^{}`)SFz=n(1=*v}uK3{SEEw4`1)Z-9f!)v?uI5iV+Vh z)py3|&5&l-=JBDO{g%j4QAy^qm7Uo`eTpWw7Poto$99jpN}YpvNP0DH$>2Oj+{xDs zI-l&Kq<|qSu(ymTCB5Ec(eq8XeTAGF;n&ox`VF7=3rBiRob39XGHxep>4ERO<5%bV zktasVAm*MyrL^8Dw%NAVYweO&Ubse4oXhu{cc$RLVT>gc|HbaTOe)Ce@unm?zWH%k z;gbjMD#ES=SY+2PkvnRPJH%U zE?R{Wsg*w0oHx0X&cfk&Kl!f0Q16H%o$|FA!;FoO`!Q)n`3m6z{SS-i%AVz8Cc>cL z*_ir|s-Kzx?R^ z5@gPM4wHfx`m6mMS6yg~pXc*VG)9@Ex7Tu0^ELCNiPtABo!|QMz$3i!$B~r8*IBf&R3(Hj0) zF*ln6W-XJ7=F_nnpS0ry<1$8>+vFl&&}@wYm`M0P!bAY7|8+R^|1n4e6U_ggt^Hf@ z+e*qu(VhNeY2XilNq9c@P1x&@uE72Hiq7+vmOn!TDGJW6)qJN^3j*Od2py@Ri_jc52C51HJ{fB2+7 zlB<1%lQc2#S|+lD^7=OSv^BXV&OWq($b(>(x9jI@911jCAlx ze+yYnxfrWri!epMh1dxFiE=)&Lumij{1%;Igi3#1#_|^_S|j9A%yqHaj7M^qaj}Ek z8fSn4BP}*I;_Y|vkQqgqC#H3FxY;Yln!7HvM1|1uIqqycr1`GJD^irY6edYrYqm%) zTvrhx{@jYQX|JB$&V&%YLLdjyfzr^p<`MW$uf=SBiv3Pl3RI#`rKI(sJT@<;5yy7& zt*hLt2y8Y%`||SJp5!$VCo*fUx1;ucQY*=xZYu13sUxlVUdCKerG(KF5FGIP|1fTt)W0rz*hvyYdlmiN$lI7beND=g!VA4PXhA_uO|SxtN8V9?mR}e zsF~Qo!Y-yY!;wA$KgC0^o%mBfzASCIX+PHMqLO!*R`P(gZyvac2>x5&X*I&3<-wO? z8$bv_)|GPoR4MDoGr0;B5^)^qbE?tMC8Aa=w>ucUC$u9|vZ{h(%4#cUsYUQPMSG=+ zZUU6RI@!CC2bDb9q%bLiO6EiF1>g*;NMZE&c+&<5LCOf0qlQaF!|5&+rj;o`w}O5E z7e1^&3J&XQ4D&C5i!I_@KU~4IVqI2Oy$arhXMA9Jk_TyCSgmXb`kc7|WyA%-!de|Y zP#(>}eR;vki1&C3#gQ@4B?<#Rr1^)Ydt-RY;HKjPk47FMGj!*1DtR!i_hr~Y36-xK z1b~;trxbgh!iC&pArls4?0?&VM7R<GeE6cAF#`}6d7?A|9-je7INlM%;8@zpRCe)(QSk?H%^^8j zN-QuL$^>&0`$Cy+jxrS?DlK&vMxsatzlN2t_ipjx05=r&3t?Lns4yOmeUE2NTF?7i zfkerHyIe>17sjq+nDo~cF8`%BqNKnl=Vgth|I|XIu%&@ydWAD%{rNwg|KIkl4`kST z!_Ox#%YDNLJ)DzTRR8+<{T3i@xoOdTKt=6%@uAqP#UcKlj`P?lK+e344P1JJSc5{J zR(ymPX7WvT-_8RMdYBm z*(jR?Rn{ z&ioIhI}1+fOi7wy0*?1fg-m}3zYKOMINFn7tzX21+e;f>J z%(?7gQU>4=%dy=hz-7oUKLQPJ`A!YeT@jIrZ88!j#S9;&)(3~J?r4tv@xa=1>5V|m zIB27IFb*KNBYS?abbwDrcDR%fcEitQ3JM9|>WzU*6b?jc?ZdG~xU!3i>0fKix$jwW ztkj%VP8p>;7E+$Ni8QyBDT)gJ z%W)yqj{P*Tm9I~z<*=-Ww|ksGaQamVuxQMk4}i5Dff+ZgG0bzxv++REcerv8QDkPH z#BBT^yE*FAZWloOb#gbDd4E#o-qKwppHBIsRer16P2Hd(p<2R5X2ou9u zt?>Qt%iqgETv`0ynAYV;hF^A0(;W%W(T%Mh0|?o37siH!x6w$VrX6 z2_}hR{e&F@E%zJohe=U_;-#cJ6$4#}IYLQUX0>9+y3+> zya15Z%A@r>!*mHh4)QGO%)a-w59)V zVxWBu0ow;AhhqPQmf!qyiKC8M_YJEbpM8o7YL-*b>%GUXxEoJCWvBal*TGas?|VsB zd}~{Q#P^tl$zc#}8Ex`^b+B?Vt$^^)a8=J?F=+Ak-X0P%czn8_*iBC#EqU@yCc}Y# z?52Q265KJBw8mtYv{Q>7R38u?0=hm^^T=AL5$JiMKoQ$KJN{Y)#G2_HbZo14ANok; zN*fT(bg)M- zPg6!ZJIOq3^z#l~C=me|gR0(PpaL)7aJ&mtx2fE`LOTT-zj981)Sd9+s=7~r%2){s zuP$N%2$j>p*P7kBSl?Dx_1FJ8J60>bL_m((?G;QH-447eQ4DzTY{fEc7=}Wv+dko7>5u>2%-khv& zMJQL>n}9m2{G`NQvDMF(H#vCvYfIgSF*iLOR`Ev5to!wl`74yNss6O9#nY%*)y)B! zs}-%y94 z7t<>ZK1l?se#RF0eudf7Z00pJr3tXrUa%O7F!o4?TadWwrkp7`XAXcTPjdL z$|5P@>lYh>C0+^;`jby&+<;*0BD#@Z7Exh;qME%4o>Tza1r(F3OEtjFHz%Z@l{}bj z@HpP8n)=%KYr8d=7j*l_C%gT|K1AaFeb)TSf_9K z2j6xkKviU(anvkf(k}UZysqme`Mev_F@ZXTA2j^T?ggQ)_DX*$>S?4PBcsoiSA_V{rA@;GCnk@;mB-(nJ#qvy8}HwwE`+QPXT#(@w_2& z1ftgZy3krytkES7%*{ge1n1}C2M=$`^Lloy0U>aqHTo$L?`e0xHNao87$LV+jg65! z-HbCg0UQjD>Hbe---PYkv=`%a7P0CQHFd49I0{6E3XowwBNu=avxuGQ0>ZV9gFYkj z8b&w`mXkL$^k`~gERYT~n{gA1h!0cEq+q9fF$uUBxE^4OI(Cha3G&s9HFb0!+X zTE%&Iz(dn4?FPap^w!8&M~0&LuxNJdL_l{qkkik+eO6zGOqX-nUr7#=7wF*C+0Os+ zW)b)gs$#2!kdWcWy}hhhwe@Vw#K|3b#7{_BzRe!+e!C!XmnFqIpyY4D9Q|>$bhZ|A zicJO&76yt{Ob4PSepM7V=561RRvrY}U8NJA5St1=LyIPo9*w#M5{PemS*@%+V(qfl z)-{jJ*z-)8$b%U7hz{zB8Ia=ot7GU6<1wKujr*g91&PcX-H8{nYdRs1gWYN&_phIg zF?zG@L49mwAjvmj=?p9@A@Iqop*O8t`4;frU;jsh7vyI^F4ehsA^!GByUw4&+n!<07{jF9gXU;dilsI zaemsloyz!F&-7*|@!jiV=?08DKrZLY4rg`953v8z77Jk%E92k!let6a_`1|Q#u)eH z(0wqbn9F*p!o4BH&PaTxa5_MZiR=+zk7enxL0cSZ!2IwA;^_X%QSBNk2Vz%paW@sIX$xKrJiTDGEil!;smn?Xu7Ckd2X8-Eo$KzrG2fi6STTQ2Zmh1L~_55ffr9w-o2_A2cx)>p-LroHHJTA z^C2~l`LkF))H!__Y+XY~er8(-H#391F!sWS_PE6LAZ+X1hp;g+!Ns+=-h+f9S!Zie z8nYQ}6-jaRjg_5S&~=@Mbq|5u(HE`C=+JRLk*mE2G#0L@&dK@*ji;lPQ%<6Z6Q~P# zL$7>o7|@heyM3Z{yCN9bNz$=&D@A(gzCG@ZJNiDMQVi`V&H1rps5B;MyeUXk95_=7 z4O4M0qsU{d`BYL==u1Gw0Fy{0RI;spB~1?k!%cd*ylTgIh*Z#{gp)fAIs<*vcEH4D zMga$ExkE8VE(@4knAI*#I8$8j3-`FTyPC2}0ErpKR0PKd?dnyvJ5A@%`iiv$BOJBS z{_;9kY{RmvI)mv-@=G$m&4x1R3yjX~C{p{kr6>s0(-y}-rCKSrlU)^F&Zlb}A2cN= z6l2RF;Sl%ND7(%}cULJylap(+-;ZEI%NarjQ(A#!-b*O5`f8LZ4Olgt6ogZQlJKl? zn_vUcyc-{4Vghs_t&{Q%8qZE{ZDs9@I-7whN-&kFsW&rnj}bv&qmT(iMdmYEtuTH5 zG*-1z^(#t1J`gw7zKjT5is3PD!LuJ=!%vp>5Z9G>Q1X368%scb<#hO7>zxKb_g_dkNn3KH zQC%&~y%wN?tBq&;#i09kydq*~V5sKzI7j-gaSp2IrQd=64>1vHJmUxN;#yY8F|FRV z>-F@+IoE1)W^65E_6s)8y)B+llEYr71Eb&a^soEF1+HB(Pb~GWQPO)?I_i5%>fpQj zu~8vx)Cn2U2dYoZ; zH0EP{Mus>1`KujlC2sV7$7`r$=Ykghq0B34WE{s4iDZQ=Jh@+I)G$D*Fob~j3Q6r_ zrw_P|VbSL>Zym8BCJL}3zR$d)*PC0P=B><()(6)Z%p}gwzWqXq6nx9UD@i*5rU59m zSGO@qZz$z8=k^`yjb-J)T?Mdg)64V>9YqX&BZODfSWU_cup{MU{+=6bcMy*d5mUe< zv8oy8%VK*UY}(e>Mtk~70-qM+dQEK#%QhDH3aZ(jko$fSwpJ{y$_etDe4hD+*1JD)ix) zR_)h=ofqi_lA%$ykYuF!o$+_ckzh9Mz+q~9Y6>FeiGs8Na#MvA(2A>+?gjBuKA0pG zLQ%CJwu@nx^!^8ArjIoD0T0XZ?SsY;2?+>(lndEoTO@3&CkA6lvVKK{EM{O@?;n_A zM{%O#OW_d;1urVJ%1^gNmKGmtke%}pj>q1Mmh!Q9D4Q{77fk$zg*pPk#P({JYHlW6 zV%s?e#5hmEk(Q#$&+E?0m_O=@`K8 zhxcl5$^o6r3Ha{-n=nrqRl$%wd^l3k3;+?SfSU=w5oYzC(4;_i345o@RyD+6*N z<2y;c`}HKm-nJHS4%HlrNlm1=%+C74FBrLbv3#RzHq?YCYhYZCU;TDH1?O7G2iWnL zXzE{Mf6H`9TNX60-!M#k&rR(vR=s1`Q<+<%UD|DSwzhQbS^subMFGq;uKZ0BXt6B7 zlh|qe1^>Vw0NGxWeN~QK{^(u#Yu$Fa59+|Y|DBKP*BF~6!tZ(XB=g@(B2;NXSYf%{ zWBvP31LzfwsOc)y|Hg+YfEB_9+`E4t@?|EfhX|>~#t+K|r12-fsA$DUY*>PrP@KCX3AYr{3;H{uK+q8H{fWU8& zJpmGUSz<>NU;qZn_Kew!Q=kfmtN#jf8O%8JEmsFy1djf19dNAUhtD0VB`-We}JkbpA+$mH=p9@wx(dCBW%SSo9ipAm{uC91w=Pf8>B% z@B-h+;MQ*Bt_nJkVGyQo2p>D8B|^)=BEP~Q^iMwBNH}c&A!ghQ0m+*Ov=BgI|Dy*+ zB6h6{$>CKwv{%8+#aQwPK{;8>ZP$IRggwp6$=1}O-#%Qpu>B5xLRzdZ^xuF#X$nlE z5*AnLs2>^@5+6Kx0A}pEKLiN_l;hq-jC}gkoTK{}wgV4O6rcmc$4h@xIHCX^xcRWS zFaRec%{ZF*r46tb$L-9*IKdJ4>?->uj`b3`j9u(Q*w|2XSsI^P3&Bmk)XxDtB-N`cb(nJRE|ZXaHiJQ*Mq-MlpgW=^nYnw>^=zxp=z z?RO?A8toq17_xB1%cwg~E-u3p-@0L7VY3D<=XgW*qh@^WaXj|?`vCsrM2c=#>udA3 z@jKP7F--xSv;~ZU&ikY#o9};oJ^)B$91NXj2M_E!g6 zE?uQ|05^LiBea?U*XJAwfJ^FwIOUwcQS8+F`Qa`w6YCrLcyE@p*HZidZbdlrDXTtV ztQ=G;Up4>tR^+tYD8Q4Z+JHA(dn`w+=KVpXCu~5S2_~Sh0<%j4hZz8;bVHhFCi+F{ zzP)hmv-LYZs2Eb06t6t1me|<^4#2kr?Hm@`Gg1Nqlx_oe)Xokwp4`@HdkDP4CBS*x zW=VX!w>IQ0QV*}YIynI}2?Mpsn_LF*{!AWpe+IJRo9fWHF=NlP*ov<2U@BZo0p``* zPNJK|fsWPl!Ii)gJqZ953K-N1c?g7nV}BAby02%^Tl(%J_qJ9upI3s4|7;v)k)#Ik zb;d0K!}c1lwBdvI6*Jx&1;O|IKnbfMxaz-2dr~JWXCso2m_*CL0BHgknWyQ*CtbEG z#%dR92(@B23hN5}&VH^`wvpS9Q~PYruQ$TBxJEF;+wlNVKN%_b*#9#LFgc7>T;r4w)m>ZJX%4#2&JUxto^tHiAP( zAPn-mqkw-~XL}qtGczi#f-b4r7#Nrj0JW;2^4)U|BoHVb(J|~jrC1ph6e_>*Hiki= z))jV{k5%5&(f`=-gzNp@r|nOi>9{BkYu`!O?CQT3k8{aOTwl8GI&D-bK{ z4nTSS%r&>@@*+<(CC&~lK+Q}TIgn9|1fBT;tii?91u?xYumB@kX|MqB3Tw*CgNt|Q zE#THPSw5sTWy@akn!y_fH(9P!>g@}cFuGePHzFzM;!U5UwYQF)jEUtJ2!%dy)hr=I z59b2YWa&h3DCnCE+JV!31eXaBlmv4@*jX&t`~Dx!VwCj@=ipe8tT(l^dZ3v`bZ7Je zI;ZB6L$f363;OG2wL84lNoK*LYbr~z64Nf-oN6i(r+Zqdz%DB4$jvK5(I;{2;HipA zwEe6YZOgDB)DG~OKrciBlMs;!xhI9y3wSZR=m{%5d(UU=oj5R?4i-b0_ji#2a&0RDB^3|*O2=B$XLOF-dvLL_g)xoSJoj=^#c z5iZ|ksZddNOsn3s2%J-IVSR~{E$HfXCsT0waLr<0`=PrG{ZBG}ySVNTG2*E(^WvZj ziG#Uw0VgVr&L#AA55Q1rhb*DQ$w*l&;@p>AvP84q8=TCJgCdHB`yh*uPZX~=mz5C7 z3QW;zm7{;XRR#E};kXL$*G6}?go;GPbr2G3C^n2rsWWP9VUhy50IULOJ$C_6o3J^5 zp)Y{v1W-%5szEGVK#jt;K-f6-O3|kQ68QE#p!901t1TeBS5V1Mv5U(3MATY|zOJt= zuM5TW%4z&0aa@_EOcSBNBsIzBYXm+Zmz3YX| zwll^(iZmO;L|hB9%OU*tWH2#P4ItlSx5r(lH zZlV;5EGPkDQ|u(^dZOudX^x3x6^|Q_-iUqgU{FI$u*k>@bU}#4>$*nH5%xsvXVEb_ zOeMnUG-)GU`4{*u9{K*@2D3931GZKUG<7!BT~sfasoDEW5leX7=G$)nn@YU%2In~ksm4q_bIoMvW?@P>zUugDt!#bwj#-CpnsVz zy_CSIePh&wzH;w8)8x$bNq=k?DNw`wKQauDg5R&@bug=PDE$j$mKj7%Ku)QvFy3Ud zET9`|%YT=bAp26a{q{O=t=nF>Oz0r~e6tC3=qmzpwD|G*<*RLjgKm6UWvKI=PI5si z*C*Z`@H&HAzcf_7X^EHYAupB_%O6sqxBwQWkWGCyV2n|@VSmk*hFK+TCI*_ZIl>%h#&q)gkNxg4 z4L+ZvcX!~R3zX4`Ai(zhK;zOu$0gcQD=z!i0AVX$XWx0PWH2C-&7o`Vk)K#mlmn@# zTc`F*pbhyRkY%jyr$Ybv~*Q=f6c{feiC78 zo$aXa8L9^s#bxj#=~I~(CcB4i-I;hMUj%NJ$QRcZyC(Y&GLOzQQIyafU&kdAb)P5? z@ZvL$@*PUF>8j_YFi1nnW+l~H241NP5bZiF#eczSZ%(m=QXuLa9dycWn_%tX*W>Q! zvpUo8w2bID1miMA`mv>Msr^L!!kel*3eDsNH@|dWqR2m#ZW$KnnW!fzkc)(3RK*7S zz~F2z#GzWL0gQlue&^Z{QA3(HEOLxZLg<=>?PA_iV}~%QHa2`gqcicYIa-Ekhs-sr zs4v0&nMPi1=Gq<6bmDQV!d`>@(Tu!?VmTCd?sSc}HWAR=G~2p)_oG!*&aM3(2Jdl5 z%UF*h^xH$3T(Ot$3?_AynTUzQ?7sqY$=swq?6~H_%ruW|$u`{YtX061Zo9^b=?SK5 zWn1{zPwX0HnIeLQT)6Dd>2rN3jd0ue_NNyhU|pyr+YPK{bG1KZL7BuH*c8xiWlDDN zW2w*ch@(RErxYF7EUu}}R0+NUWpcNldb6x zt@R~F@$X9dR!gKRL>mY^*9c{}+ZDCGUNu{OBlC8Iy|^GbUqtvpn_j`#(2gT6t=r&@ zf`bJ2;TC0#-c|lIEp{+-D`>@YtA|RYn(k_Wxyn;UB3vq}2Nu)l1q9b+J8Vh2`nU3 zqN5)Njo!ddyGH?@*0CPXy_^>vgqKLpjzv$z5?}!FyaU&`K*jOWT^X~gFIDOg1#HDB zwF&TKa99D*#)wz|ulz~|^ecemKH8S2p`eVwzs|*9X@YfD=u=pwfbM5^9wXuVKL6o1 zW;_O5%`ep9&=H;rE-E1-sH+C_J#XlvV$^7KDAT$x1f~P&N_J^E^?}3>rLyW~L!{T1 z0j8OK#Ot~qh8IXLKOU}CH_N=&VOFAm>MX>Q@8{zuj5^AX04m z)(=SI$q15s4tzfVP(EdC$|0@av7J&$0+l9->PoD(9AxYJv6aX&nMa$*k5z0 zh;qr1&p9Y0eD~WX^aZSdtOVELJkX$?{QTbM$M~Yq6VKq?S3kgs9XgX^Kuq`lMi37(r|MlEaF>yUyj7P8#LS&50(**crhAb zo*wEn2oz?zdd*N3i7DUpqN4e#8O0tdCO8UR+^%mCF8q*IRRgg;T%qbj;?bwcuFmz@ z&ttBkc+tZj(mXAhS?dp;r#c!19Gi!8lEUvWT?LjQB7 z*L#X01CCb*GcB$L9fOGwjSuDJ4{1LF+pkye_I(3)i!busT&1ku&FzGO#&}@isU)O1 ztqO;cwLYQb`$$w;T1%>Xu5to~%sADvlCKZEFMW>1I&33KG&6cRt|2v@Yelp-w@w*)Q8YQz=01NyysW$HmoFGWXGci=fAC=+?JF zBs(p~`y0fPofPk61Y%^ln+KBQfnlrVp6>O4+u&T=)$6;{91sttB@~doB#YNJ1ql!- zr#XMQE=KP{{wM0((~?Iaz*i!;vpkk4kI4I?ff+yXN_ck>;MYvQ)BUljxu(DwwU(?@ z0<5;zh3F?Yu;nAj%;2fMeK)W{%*&+?hqfVd6cD1AmYg@g37>_9?m^yMS;Hk6*3adiV`~@Xxa^NHvmK>M~aojB*)`95+3rhfmVG-uAc{s9p zAF!Q3f&!7>*yHTC+z@isisU2?Py#d~^73z*5fDsbqmEzN;|A`^J6hu_5PYJnhfAA9=RZ$8b$GdGuO9|S^>!(p}F z&dZFE=S6RkNo0sTzdUA~rIgx87qfbYXc(I~2i~J5y5p%7_)2)+26+ugjQXc9gnBVIP@;|ch@leEmUtXF$CA>0RJjK!6@#z4!0qb^178dS_D9y7XJjb-Dw2_C%@>+`E^D^4_lT{f5DL+~U| zFBg|Bk1?aqU(g(r{cr(9>D8x1QY4_NuuIMvgGOjgR&Njfb1=q@uTz_dBH-!%3gp8=mVnTy*<)m>tZ zg-q>v9cvhizWQS?jC{N<1*zHuw&mtTymU2E0Ay379!bUl+aFj;JbK7Cq{62Ub`U6| z7Os5>xG)tqn8owe0ngD)vd?CT0+sFnEB$>^*m7)t`!?nSOtrYc9s?Uw5qy2)9l7;& z9^WuIfW-?g57QFg0!G|GAP4=cMqEziF)SlO1|&!KoTGyzBRcX+UfwS_6u&9{fs6}^ zL7@c^r0EhQLf+S-A}AL7t1OV_ZLhcXT!h=frZUzK?a`P+9eWKu-<17H`L^G~%OkT9ZmmYm-2>xcq7&?d05RXtis z8ynTPrZNP}%N&8y86heBkr?3WyaKRQL}e#aYF2fa8YexdV&cqY(^N+E*+;0A6p4_D zSpRhdAveXUZn`K(`39poc z@AXAV9IXbA#H<7Xqs(9C!Tz#I=}|_cgVlI*r;#!uRXD0k3%GCR^pp{zSGPIJdd&HH zZUu@1wYK20Kj_Ke4K-@7%mT7FUOcFYLY{!hy5kGyHrp21Bj;&;3QS}C5&A4Q5};s2 z=kfs%LX6HV-x-7Kk;RCnx_o2sCfF;(@lCu=DQqa~4S@GvI0fzqd5;KyR~mu4j><}K z`e7i5y9braDfW|~tvT`a-j4l?bOOD|>BSE)R2^13i}qPKuJ&aLN9^g!s*Bd&6rROHXvvNW=xSWHIwo_8vn}m+`L*>pt1cN zt=uhxtr7lbKds>%3mkz*!&6^#(jEBw#$h3D%*4lWV+VLMV@VcZ!`0~&u$A2hMbHRu zk|F^7k>m0dj!WxbfnW6aCjgw*DATWiQlvgwPA1^VGNp6{@Om5={ZRPa^~K#RYGC7% z^S`X#Y@|RuRFY|@+;I2$w<`hD+SgPB`)Ying|qCEEfaWneMc+-i7kUYxd+p(>Zt%} z!xq&tVBeVlYs~Gzin}z>L-wXU)h;b0ww3N9>V?jPxit)gIpq{T*bal{KY_#t<MjPHLe#20(4fp{#d#=^^kc@eZ!a>1B*6yYrtWyF`*M(Cm6}E#h!tJ5kyT zx|d)#4|HB&ZB8r#IRnYUED-r-jbMeW`M_!o(Zu2d! zLtvb!wl&Sl1p_2C1TZ^V35qM<$syH85yM)0w-Dx?FTlkwR5X)HttM;ukg{#CckYLa zd+B4~Y^(-V=>kAwc!ft8e=O|E>kg)m38D7RNdp9>K$2N2jDx8YDg>L^cmOFw7&LmY ziw~BhXzge}7=Jg=vl2i6Y}^ zw)~PrZ$(~F8hsI>2qlV9mATZJbFZjuW2UYO*zIPJ3qWMr$PUP3Bpx)+y@4C~Y#o>f zOIhE(_+-f=n&Jeu`#IhMj!2g=83Fy+j{SEqgpCALew(kh;gVi>_*pv~mWuIa|FB-56lzf52 z$1?VbkVk}ISKqzx>(;VbMX2xNq0J&6x>RU~8uOK*_w%UQe!h>^G&}OHUCS=xtQ>DHI1k}>T)P#-A5Hmoh5eY$gj`m#(&M!^iJM?R;kH4~nqQS=nqT7!6fX$P zf5N1Uuz&JKMihFrW9RWyVo68lRz{~bKM_3 z-4WC(b1=GtB?>lKurNKA*a26?z~ zOQ2)mhQM$!Q_TJgu<=m*e3)QH7ZmabZp{LfaxuH_x*e96Qhc6}d z)j8@#m=`q^5%0sCDkJY)8CMCoQX;DJhV#5^sO{a-XPRbWp<+K)r}Q}cS+9ee zzPvl}`F!!C&z-AkNDal5yKvylZl6xIwCl`g1-LFA4t8K&{L;i8Aj@}R_bS~H)|=%9 zd13~U&2331Ua@Vg!vyJ_BF?`3%x!9eI?ePIcts`A*5hh)Q zCC|moUW0K0pRbD%0bTRi8ne&UHZ?`?_%$U|_RVzSLAwQ?z*~+ETODo3B#V?^b7kB3 z3!^`G^0FJ@&Mbv#iLF&;JC6=8@@5{fb2dtnwS01ew^nudw}fL3QFt*q4i6roD8>~h zlJidIJV`JpJ)XltY^B(zr^SRsmB*l7jl6D=kaZ-Vu?PGcuTznHucUM*`aFYhIat}M zg(P-MW_;9C%ZtV>aleQ|t1~Xo7FO;s%=jVnQX$-(I6JBU-qUKQ$N1_=+=a>vc=>weL0dd^`l>IHA`-;(Z(GFCG9Q(Y@>GOU3DK>|(YU?P}67I;z`> zpx26PaUj)yPKB}2rv6F+@*%B9>Fbc^MK?mY1^Hw>E#@R4;R>^a5iwcg-OVy(BJ7qXz}>yi62Pcgbe5 z_tmLEm$*ax#sH%C(kqdwiqC6Br%(kUHX0hk)M}5_8(ji8MD$JhpL`o(N?FjmAp}FS z^9HE^=jQJB){}#DOyF0Wf$$C?P2noVFfmybb}}84Bp=9+?T+{HUnT#!&*U0w1qwc)a~X(4yzSiIG|k_7&!@C+R5d$3N2x&W7N({r$AuhYKwlUbB14eC z{X6mMKf?5X<#_$coB?F>|4JA4msZpcmBwJw)S6>F7pYT*E@$@m+>}66e$9PE^*fqi zMJ}H*=a2t4%(6d^n#u;5l_V%4fa9N}u=YY}_g8&9eeet|Gl*&scdF8-z<3DsI98e% zpu%xXjq`f5vq9dblH1MwyqBY%a56jF3D{IuRf+7yAp`X9pZkEl=!Bg6r%xu+IM%9=pK!ie{A=_%>MWY-oD< z>7H4_JJ>NmP2a$%(3KocS9%Zl9yQbJg*QchtLLoRMw84Hz{s!k#8jhiEfR_)*}ol# z-cgcu*|8R)=n4oo%)1Qfh1p*2MueV9+=r3;lKuY`x%2q z0!y5oXhw-EPQL9h4RWeUJ#GfJk_~=76#xx23z%{K6X)>HH^Zqx=6?-9)ghn{B?9_9 ze1HRR>VFGd{r_n@2~Z%tewhh520~OCxDiMyB`A7O{eV;)@wRN(djSgXt&VjjOAI>; z{#4OJ%F$$C`uDCoB2sK9FG|(@@*a6mZUX-KqTgjafbkY#VFlye_)ea zf1?-5Gw^Q*Y8Wtj4~qtL>0)^j1YRx`!+OTO|J@(eab87bLNEo^ETMM3xx+HM2^396 z^u=mP&nGu_Zy>guGEuElNVe!&)vqcEPHUq9Sodhe&GS8^%T-7&nV%0bZh#@7SICq`chD>P^;XkRddF%J2 zNS8|WO3!+=heUnu|B^Ey7ycY)`{~;aE{z$)lG7$e!G}fuUs+xF_D^}LzbBYbH4Z=Q z50DB*ou${7e$XS*LNl%MFoYe}Rsfocv>;pFaRCKA*GzBFTEE&#ICu0zBo{{1Y={r! z%A+s6C5C6f$#VsO2=B8N2ty4qC`Ak$&9DFT_GODkiaJsICWXt%C?CK^#&k7=-u50> z2&ih@Ku|x#Nil78{)fb<+2GHsz)&ksFf<>x+Y5p>RVF@k?BeHwbjZ4W5PL?jNS$7K zyBYAqH!y_^cn0~9^qXCBV5f)hynLQ}meifOQi6yIU->VvC0)Dq8g}IfX?6M(BxNIy zuV3eTNw0M}&Ur+I32%$Ib8;$$)opJ>o{9+JD#3T|sX|ixuZ*CrMM;3?>N5u)1DB8#B8>q%@MNk)-QEZI0^NYD?Ha)A?H|yap1Ziy_`S!4*onZd>(+W#)*t>6o_M zitVYUHDU&knY1l8rhF~gEgWY$lKE8 z0YzDm{JA!0`Z(z4d*JAcD0}V*1L0Bl)-Q7r)4w2I2Z&%3A-~ZV0-p6W>=4`1gg4|% z4L+Qih@q$4HjG=J71s+W@PRd`ohLpMC1<|3yL8QVWggIkO8`v8&}&wdV1(X&eSN(a z;qY~Qgb1zJd9-x(b-nQC&IwGXQ&GwMRuxq4Cg62-M?7uie!+`hjbH)m-oP&QeXn+h zd0Lut6u}ZQ0+tF_O(4C$qRT?CYtK{$#X)<2PnkRX9aP+97LOp^Yh8i_DAM_*32Lpm zIsoOS&N@Gok zoD+VY_t3a3_=%<$$MJB*tMNvEhLlEH^!;FdOjpCF*N;4Ak<4-Mq3yNJ>p7_Dh@f8p zlQkk##!Iz%V%n&EhgcmDBu$R5G{*Kb0A4pGohdplbG2a6q76En4|Vo#01V=7tS45C zIA_v7MlcJk>|0>R`lM9hea2hun7SmV1hF*Vl%$@Qf{8^aeujjUMjm$)zxAsfuXnN3 zPtH=YrEP*aWN`jopc`LA_)8OK1i3+_!yRr$03}od**PQFcyYDR9fNunTst*Xx&MfV#aqAi&55%XCRGYIU zZVhSp(8{P17tczaHflL694=<8jm*793 zeN;Iwg^oGzrg2w`NgdGc8hiNPBvI5)FWBxgJ{3+Qrl7_71(QdIRpuY3QF^drP-#a; zr!HozS%%#4l2JAOlsq1}aI_ne7-v}P`<U^%(ky|0rsIzIm`e;F zV?<0yKtrVZi^|Pm6zr{Aiz2sUkQn>{)Ik~>Qv|tCdzmDCI2>*Fob){hh36GFS1w}v z8vpnsgen$=%F6%^nTkuVA}V`5>PNbxjpXB4ybT-s^3jyeDHxYio9{2r`$ySMjeY9} zy&GMq_f@I|P};o=I5XG}6hQ|r>|74GT@G_s8gH6)I0*5iD9_QA+ppMGna2jj?N>o@ ze=6-Rc$RX)uOd%=WFGX6m0&76wEr|$&xBeL~bpM!4IGKh4QY&c;Tmv~`G-!pfu_+R=O^=$(o)N-5^@#4nz}CnU6} z(4~w_sIZCd&%Mb$h{4YNLEZnUTscO^AF!V`2lf47O3-97HPaoal_HBR(eFq2XdgOtART z3wd!T!a3wBxev)tgvqvxsGe1$P6=3GrA&SdVAiXV=YMQUmsU9Gl@gP?r7D(EOXImA zvWR}DVU~cTt5WAto0c;TKtJ+VQENYTE|1u;(St~ly>3SdV`v6Tis^HdSq%Mb4+7gz zMeO$Q;UW8olsm^*tYVAa8HZp~KE=BAUcw(=@ZC`S&|7+R^f@BQEJ?_@PQ_`giH%c=A2>vKMEh`z_c*T1?tIpVfy;EHjSpj>f3o@=OV^pVe4zsfoWLFyK+IZXNfe zphN=UorG%a8wII@5nmlwdSWhG^$N4ya64BR7h#=Tp^IWNbtw-Jo?emB^f1)Os*Mt| zY(W$D(4^kh0>%vU-Cb#DER9HkPEtiI*-7S3sSx(ZS2}516cj$UQ4;r^iR8VCLeo4v z1Rk0I`Uc4LDb^m5G=FQqK3Pz>+?*B?*39(T=$(ILonfaSe><*lUd)B7gJ?S7j77y0 z2Rt(19G$NIts>KjLAQZ!tQ`APzxpX66r%6U^HC;_>Ho+rG=u!0z&Vbb19~wUzb6F% z5kUF)rpz};uAkl>i#()`YNArIITojka!yeCfYyom=Ft77AIAbr^)ZpE+=hqfa{XyH zlS@1VEv47rBILk&;q41Ktc$$rFb72nlEp_;!nb|>htzfnU3)exAR{0IIMuvHM%dSJFn;w@kL>tHotY_28{Xz`$`W$&&N04pyU*F_7Q_Ege1;` zgH@n;qw#xF;CzthBar%QgolkFay({|B+M=h`9Ss8O?J1k*}%M0dY|q%$;?33;Cs80 z>;iQr(%YeD$K?zn87YmM5aHa9Z-)CI5kJq%VM;C2uw;r@hcU!DCjd3-5Vt<=?|Sg* zTZ+uY5>Eyn{Jp1Jz&|MFHbbaZ%Qy1%{ssuB&mn;}EU8gv!3Q8( z3ycy{_TJi8&lQ1?IjZTt0l&#*?Op$BPKAPRv81kSgE;8UoX87};9#SCW5GkW!E4bP ziRTNSP@W>JG$CytK%~mSvN)hGsancD5{CUX zJY<+fW35GJatsn9;d8T3Zu;&}Z|9nF2PO08_`|;A4MD2mg~@nJ_|+ z8Cv_zGjc6ui$~8#G**Fo=^ux#Wuwc(Pkg!2Qe4V#2M%Dl`%6_lqL8FFszeil_f%EL zMZx996*_ahK$st4+`=kAn9>ccU(C3RmQI?$-~o+3%qL zoNHkBpQG~)6@Pp|@L$9a$b82@HG&CVCM(q2B6hZ z-f0H{<}kG&dQhVSw7os!N%9vuL|0G(jy$D2P|r|W71F(BMH}80cjk3Vcz#*ayNT)| z=VOPS8lBVwD%QG5v)I8)>(%_=%+#Ev-1)(03CQTr`ROS+f_yUZJmw$1Ef<<`BA5QbT0KE!m8&U@^d>+;Y>#Mp7_i(gmU|vHO72*k| zsc~@uR*M3Uf9qg4);%4E_8sWn;3+dDCZ{Jv7iYp75#;kK^Tc12J`gc7ukH0RCXVeY zXqZEoHM$Y^0Xvhp61wq5RcUUuJ7BG%|4h z7*2)K2?VRf87aL5uo#s4*t4ZizfMnyNg;#IuLUWXHbM#91!(_nEuVo%R}SUs$&b@5 z&OveC5L-cDnpA<|$0VR5t}w|ruRzBGsGv5EgVw+qX_8_exAE!xUm(y1#Qv184Ucb* z4)EHcoFC-c$RUijvA=b$EoxX+Ku!?5DzG)W0L5txix{FfMJOE`kUfr%*~DZ-On}AT zk}@E_*EPM_j$il%M{axL33QUi_sf6>xq|qrI;O`U?H6KV`5^XRb@}x%M54lAcm?2cHz&k8x*XB9w4X+L-5^b6z?n3L z4NAv8kg8AmzP@$|Dooi3Z^Q>Fiz2xzVzz{6?`ixc<3TprA>PcZR}5bx z&RoE4i0Tpp>PUlY){l1Xm^#O0gauN4D^vWSwrRBV3{~J#VSce%47;#~amqn90P&r_ zfS$;vsJJ4cE6m*gZ32)s`o=;3Ia`qfMa>+o)BVb&XDSM9&u|<6`e)b&ayKbcAj7U8 zZZs+OsU2+F@W{rEFJ;(KaoV*Ul=2$fsB%UqH$U+R#sw0-Vi|hVH&*6#;01VqN$eDh zAa+em@Tr74k=YEhU8dBmJ_8Crt1hA1^n=Gvw-Xq7Qk{a}Zs7Ag{`PAchXUowToE`n zX>T+`Pl_}Eo~HZ}g_LPv9jFYAkVXW3#>?SDI)|T~2GpV<(*ks}CC+Sgl1nb`0SI8} zt*dTqb&DarE*jp*ofaM22w}!_*$=oc(pco?N3GvQM6zH(Ew3#CeHr|1e)9Yc-}t=r zP-B7V+k0hV_@~?`&m{Ibf4d+>!-6>i-}L+oe3NM6bbI5MfM@(C-^QOW>nPk9m-_(V)3$AI)=73!oo}yFd4`09lMobr2#WpzIU2ig z3!>hX#hM|yO@PjP^~yAL)QI7lVpH9+@HPhaCErt#9e;6im+m}xJek_YshDg(zQPQy zO;FK6h%Hkww93jKkqYrMjMYJo6*~oV%A*6qb@!vZN&&|c4oOxb)h_Q9=v+~j+KXnNrMBA(Gx#<3{RJZ!iAZ1jS zTBc@ul%wF_BY&&A>ft1!w>sdNsp5L^2G5$sNom1ql?pOc0x&lH1}XKVcL$ zc;5w1yU#YFF|7KP{+`|VF<2U@5?vO7qVuXDFE*g#5OEzX-Y^q!@|e`#iD0Th#=NOG z1FW@2P#o}B2?>2d2~cy+xI6(qn|z5jYvfBm~N9aqdT_`;=>P?7&*67hk{J4AUmU>o|LG{S7P()@kZ(^z?ggDbJv^e&ol zfytO?ly0>7QWu-m*S|mC6^gdjGO8Dnq3d2&CCFC;NA)CqF2*XcThMFmshs}+Obyq{ zpqMCLAc&R33+E*{Cnzsj1soN<1{Q)-TW9kgPM*}^6(uT11BuJn1+=+7gIzjSKe?Uh z0#Z8~^V{%qW5n62v%av^wZ7q6JYRY=ep@38AV zagi)kLuGffdwXpNwr!w4h0<$Zc2%5^9Ji&n*>{@7zGlMdBwt!Phb~6-GN4($&O(l7 z_h6Mr03Y|Ljs65|tt+}}8_<=E&zsnOS8kbi{4Y>taMc#ScuMYRO7t1H#3}#w)6Qr* zoY?*Iw=2QQ-%x(ti9<_$2CGZmF>k#EQHzyV&tcVKmdzrlK*m1obK%o~`RX z2gRGZtAw9_Ua7BKv=5C|>xi9-q)wA>pDE8f{3&AK-7qt)!H9r?J&JB<2X=Wbwji>n zyS5l9HI|qvJEUwyQCFzi(_+!z2}7SStkh`^wBS_VU&$J0vRtH&`ZunS>c>Y#mDFBZx-)+k6A+DySrUY zrez5IHqOL*hW@O}%pERJF1fSPycDyZz}m9v7#bTTjp2$ZeZbKMW>-rMP0t#Xwtm10 zS)VaA?93~Zv>;sJM(3f5&VE*}sqjT)rRp$u+3l!ay5Q~CuZ$I)amCx$$*TtXg752m zp1-|6y847nc6%R|dsgmZ`GLkKtF|ZhGFqA+QPDs0epPyV+jlj?)8fzvf6wRL@B4~d z&-;G`BHov7nFY^#H(zODynt_^I zw|7x;?1Jy!_ou*Ef1wFkJcq;Jy^2;W@oLE`N~p^F-ORK%knaS~?LTr671`KVvP{QA zSUoq^aVnn>_yZQu_Xgrpakl5uL^)y)2G0aB^@N?uR(!%lvFEO`#S8l9+f*O9Zx18K z*hNA6F=`j_ovCX0K8oLa-A(1E$Ps`Yn$+C-`oZ16*pA`*FNc^Yeuel{#W>LPBo%tS^Wwcn#77Wgu-M=DP&pSiqAOO3zS$$Q-#G#vkBA3!n==d_{ zeu_tlr}jsz=|t@+dt0Q+|E4dFd?Q}%T|Ww-Q!Up#dL@*2D}L;0EIC}yLVy6wTe`l} z(S-=}GB#iOim@Xj#`=d$uXR|ny7ex@tG03X9NJ(@>{~Lu2a);Hk?hn7pkl?53&c!< z!1Ho9G5zV0YYAkUyk6R)a0v0xjP;ATM9eJ#=dJ3PeD@6}jP*+Q`7y&88mgt;uu_MM(1V)0N~ef2-e*j!2u~n=kQrmG{bre! z5nD`e^yW4ZuhaZE6T zwpR_M)UJC)l#9?&E_mev#yYMtbLwRr^kThq21QJk`5d-a8O8F9@jVt}{jl(hz-6d> zdnvQf5Sd+_qR#z~7h(V4lBWt>h0DEXvd6JBCoP&)Bhg!_DRndFQL~*3l$HPUF8=*} z$ezAfF<#;%EpG$YL8H*ur-D+r@Zx$4G)isP(}gF3jT7`ai?J^MV)6PtOOg({Kh7=P z>RNs0N4O12V_Gz~(2~1PJ<*FJ?~0$dYR6>V#u7x(Xwhdm4JVK^R`ojKFgXae8R3_X zZ4AYdAAT`(U$c20EdgZe+X^cmTMn0f^@_fIgXhf%-RsxJw2mlgD9yTlMLHEOf*vbX z>F8@G@A#^k8Ufy8lvj9eK%SoYl=JtXqDS79Bj)g~G-3WYhm0~9uoF}q1i`(h;7{|M zV2+(3zKa6G<^1Fn1t!a4ljGRVaOB?`tUh{97c1Cy>|;mX9Up5q{{MQ+<`wwqu*wUnp~1CW7<4c^8usqg=95CDBOxP#k%ViH4Xgua_C9jJnpV zEnUt@n4S}u!^DweD-C%zRC&sYtnd<_Vn&Pl=biZ)j^0YoxNHrtLkF%sj*Gx~>68_= zSmnRpPZEIH+_y2-pAYQCYThgCQ{W<;xx|+~7E8W-h2csL#=3pnSr^3;r-T;W+!KQ4 z?HgKPk5kU9q}O)ASWDMa%jlv-=iW;|ACz`ZV)Boh=TPyNmONuHS$*UC`6SVz>1MZB zPk>xxW9cp#J@?{Z;R4V4^5`k+fN?D?Ddt6%W_ImTwFCV#yf@Ho8Lx}&Z^K;BFgD9U zpj&u7HT4Ko2g#x~ZD`rS(_5OSpX`!TLj9p>@&_k3;h^H|T>|p@L++diTz10^807|NG3!sSu`4y;jrY-Z=8J z9NAF<7l?W;_t5KEj2^rE@d zGNcQGBQK&>B!io93+r7_PX3 zppS4+!sh7FliFz>=@FdFbmvvgzg-WS(R4hhabSUJ9sy zwshD#e$yh=`k=EboDtGoz*t-9W-KemkGM6vVbMEI*AM9^C4N=r(Ok z(_5+v9ru-nFYInKwX!9EyYo;;t`&!3YvqB{o_VS0-L=ugU%&3z-dSTf6Abv+gtj%p z;s*nngV)b{cUuxiMhx)n=R^Kn@R4akk!3eJuJzBQ8Cm5;=->mD-?78a0(}ErvG>o( z1Nk?J{yxztgHG+wNd}^VXLR98sK~E09pS}P1{TZ_N zSpMB;QJr+Jy?=i+!$I4GJ_PA34XgAE#3(oqoV`43ql^_fE>l2BsiuE2b_l8PJ-MXx z&7bb_a`=Z2{&x47XOYi*vaV2-RC86o;}KmP{mkI#A!10CqjF>PbFNB_(a+B&&DL+_ z%EsaEN9~tHgrQG@ZP*RP49ZxtY_Nx)F-(RBKs<-BX1wcp>6sKU393+~U63dlo>7ZHCKNxIP-Z*cDvLuPpe?L-AQ4_mm!(J4tRN(3 z>)#s!M>7$CgMbhf#tx0NKl`m{bimy^;Y!E`Zs`finXlKFKUrHl5nu(NS2BJV9ZNo+ zf3~uN8@&B{gYHZ7hz3UAp$bOB8;BhcbhE%%dw6EP?T#Z0I$n~8^<4CFScu|5%Ge)U zTFZZN0m#QVJTN%8Ae=I5>@K(yyThA(`X8bzvX`CJ2`4GwHd>0s&8h#kcZ0z~xIe1`Gb;|=ILPVp7p$n(+ zXi>h8#x#*2>`M{lxOf~EoHORE_rN~N5J|MfdBxDz0yu~jLsi2g) zm_IQF!#_g>^UtcGMX$Bpv4oK0lYruXecx?Xo4>n#zXWn45hzldk;UztXsK>LL1FCdxq@ZF4IO-Ii)Rzvu4(k;-ucLWvl?KbK4xqQ&sS8i{v3f^9HV4-Yb8 zxl;C0-sHZ4-kT&w5%%|BUZht<4PNS|`YWtfX^a zQmAr@@F=ki)0I+xeiw+CpEz$u++F!G-|4*h*(P(V9bsF4+sN?=;MnE{Plq zqvv;Fi*M=Pe;&$77&E-z75R{J7t~KUAgDa`;sv}-9fy?Qu{^n+zX7*64e4kADmJls z5J?ruPJ@(*d=C|RxZP5nk zcblp6w9Dr}>{V3{AzTmWyseD7Z%v51(b?;Om)S$VSQ7IXoQ?Y{a8m;2Q{P>M(t!og3OzCgs8CBo zBNAf0$W73rAsQ<2P#-H0^%Uv$GE5IP%1Fc1(5W6#q*`CO%+CCGUmqirgo1&uAVcYacCFU4kAVl-4b8&s7ak(3J_w20U4V_~9mO>H6omh2 zh^1o>%(nK3Ge05kD*(M|NH6g4?2+9<+VC2s`>(qiV6xngVnx`Y)}6fnedso{7z5JRl z`it*h)>kGdbfh^WJqc0(UO3r%frtdYrn}!4$n*oW9q96Mg{Qo_dbrNrT+4nuZO}PG zFOfKQ=EI5=?)yuYI=a0#(W=S%hx0?x0m*lB&YwrcbB+6*1@e~|sDDKe;@ddlnYWQC zAfLMeFpmWI8r?d2Ht11FYGFYBwod}tDKlx~tpEYeYx^xt-Wo7Oi4+0hk`nOy)cp9kjQ!#iEoV1eJw{~T#6krCg9 z^k44*WZU)d=*DL-5VS??4NitEeFy1_QxRIdU_ChkgqqKO*reEXOTu{oRvumh5!Dw1 z9#hi^lT*=CU`JzF^oA6c35L{(l_SyC4dA5L4b$JNZ%oveMzmnmvmE6+tq8NgE))KI z7$29^tqYbZc~C@=pO;71{YW`7I)m#rh$=9l7XBRQ>_>_mJUU#4i(fXxy@>q&Ce9_* z#gvZn_%128m(q<CA7bU_nJ+yqDZ(wC1LOSN%KxE5rstLzjgGMav&b=(Ol3^8zg{bK_PK~<<( zbos;r8`iqM9f1!|NO|?9= zbWfb~GVMduT0gH7qAByP>0Kv1OmH@-Z1|Lyy<$&D%28ech37+@a`|^y1hl|Aw!~J$ zeh8YaA3Rx&RDKr6D=(#?)meE8S8u!IdO9VLk?tF>j-ai~9di?k$JEKgRV!tW5-WT> zlP(wO7M%rBY}(HqDqQEIt$|Zio#TLQ_HWeBS#Swphk8yP>%un{e)+z!;!G}YLXXIP z0B6hR1{Q~*x|f}n!|L3lqx%TVZ;wvVtq#=e7vAAE! zaKO6g@6j7pt0*AF3q)=`E$d9F@xrZN(VC2!7=e<2+{qyG)iy>$>|ObS;}W=h{a~WJ zqaZH5%Jp4nchoZa;wX#y<%!pITu1fxT<|?!6!C5Xu{M-U%+Z=GYKXo#Ty{l^$S*p= z==_~mM|Zs(7ztCt$3cjS6m5!Wu=YF;Bf2^g{hVoVIy~B>g2MCjb3Hw^12PFb9*2>a zJQeBSjhH0*2%z4U;v2P}U`FpRF;TisCpwe7oXodOr5G2DdNhc2L%JH{uGjFTZ&HQn zUij3ab*y=xdQlYEptHAlvh`8R8MUFNsH}SaBvPG|sWF4nRKIZC=qYie%9dd1y3z;q z@6Dj63@%;>lF;YafPh$)%#7IXn^!hPt9pu{$zE#_DZ@EHo={_jh;U8&^>C^cGv?QF zX1xxkL_?i!Ss=(9i<-2EF9`B(i6}LV4=so&aK*aDHRMs}m-Y>gO=!EEB9w~p?H=|{ z%+)eo+VaJpl!i`*-{VMDs|^hUHbwaO0-K_#x-1)Y9vwk+2q_3lQa6PSLZ3OsxZW&@ZRGc$u%A8UBN-Y7c-Apm~J)% zKbOE?C|qXeAxxx>j68BXb47|K;Y!??gxCitz)czORY&WW52q%C7M*{utS`DKik*07 z*lIAF`0C}|*M=6Ns;a2SxP?cT2}^=p7-pV&la+UTgH%yyollL+?OTphUN3SY{z|;634xF5WLLxH6A4$(rF|C`eLNS} z;~O@#b#q+X1}-r;Y3MTO@I{xV&I|ah=;U$|8h9^EmJ;>xX$5(%?l=dDQ&SHI%oDv7 z?5aJ{-$>C7qO({5r?=UB#wZiWx-zAb?h0JknL>eF>jAc9lQJf}S6qS$KB>U0QH}W^ zWO=1LKPhHNqnp>>GF-AnmrK|8dgfuQ@2%;vvtTukUcR;J{Uwx~wRZcloZ07s5;fO9 zmhCC=^uACkon$$(rewiz##bv#;99~N_v1Gw-A24`YR`E|m93shz!XyFj_C&vNRv?5 z`{?k64D>Ub&qty*~*jLh; zISXe_=y>~@72V8jOqe{&S6*d3Pu3eYb$z}xf8b|{dQy!CuH5w$0d)$ee==j1Y+OHt zpPHyJd@FbY>ou&2w<%cOQs*%LQ6F)w&0|_uR*WS^|G23dp5n5bY!M|^|OSOvo+{blQV|RLYpTYs(S5~ zn7-8OQ>{MPgE~bhAXPdA&^F9-1RDf-bp)@9_)I>MRmGj({~$2ACeSU*rYtS%NcQYN z`=fOXZ&Z=LTq4QmBp(Vc#rsmdGwQR+E8e?(hPLV1V9!54Tx-lpXtqN?^@}A_TIG!; zlv?OlYm5dLl7`KTN!MO!I*^pH`d&;|)ZDG(sut_RNo}}*8|%QYD7jzAl?R@+skK{! zT9VbTBu<7!C?%-lU*|s`)^{H6)v=iHG2|(K$)ZhKx9D1Eh{Jvvk_dNd5Z0F>)YX2$ zkQ4Y6xXWLrqdik=>z1$FGBK(4Ke>Ri#LpI5(4sp^3oDBI$f`CCb<81m9t6+&uQne>m(%_0=F6MT zTiK1+b!PfwJEbAp3-=AM#cGV}P8v;52_HU;FH~Z<8y0$(${kjXi&av#(IpMnh&$(V zkLC!yEPBzy&}9f1q|D`D^gn z{?jK3?bcf|)|4Pry~vCeyhg8@Yj@w-^yPP(lWh54JD09iRG(I0H7VO9jjUZXZ~B>) znCE+Z+1shQ3M4mUzI_JHh)u#Z%gaJqWx0bPVMP)O=_X|pMY)SBoB;>atMf*C7NZ1V zA7;jftx8AM*e^9LW+&!-6htmO_D}aO&?yTi*L{W=UzSr0=PGs_ zI;08RPEAZqBt&bdqwvqM@|VivQfuC)1%I9f?={}2jr!4(FV-e1oV1uUHTaz! zA-jE8##1!1MEC;!6A}=rTUQIOED!~-u5jf=i}<$c(}c2Du{tG-!(IVWSA?`)uK${I zfp~vKi#z1eY>gaXZmNd79!U?Oy#=u)P)gkMh=bDNd5)D>$zvl4tw@#Zk z8EKfY0)7bYgd)TO-=`x3USD;E9+xcFF2OQAJdoQTXbWC5Eu`m5)z$&GU4>jhn^pCp zx+Hh;XGisqheL-Yn@-gx<{kePkb$p;D77dB@PzCMtBo(*(bBM}-VE52`ijL&WAL!V z*H>@VpCcj5hC&xSyaV-#$Db@MgH>zcqIUo)0+<%VVvm|kA8RBD<6^FXc+81WpoyuT zaWkG{1;`}0=Oep`)V_w6x%2?n${}spMuzfVH8w%SH|q5sxiO-xkAoy2Jg8devdz#M`S3<<>_iZ;l7vU>;qi4_P=MSGxZG!qtFIc^u`6^8Zt zizyzA&61(S-r-Hqqy*^q#$!q+BAI%+*2`V=ns(lmckW@cQN`^htWD@8Robb#2a!|G zQ+W}-h2r8=-_9vYDZT``mL#*Q#^4MejA8>4YlAoW>(_6i7w(CBC24kWIyHF+_xZ)M z$^~HOs;^>&nYL~|38g&t^I)Ssv){ezq6WAoqET0kSlQc?Z4(`ViBO>ZK$9bVhM3G{ z))1x`0x;L!r+coNln{*~S!HQ3)=v&_-G2dPTO!WA0At-mmS(5;4RXDoq=I>iT?R@w zU2ZQwAq5Slf5u^*r9T48ln#E+qWuS-SJ%HUNL_36>Ly2Qu z&phtrBBY>`&T(91f(cUCj1?r&=(t?yhXS1@I%T4Qe;3X!0&Lm-8FN$7iI{vri+ewM zEe;@R(LDvtUIg?OasSK>Fj3$j6o;Xya(D??O10ztaLzk*>i-5*UUiF>uGSQ?1Z3w) z#}|GtFvqi1W~C-Fdt50*tEQXfF$%&##)kYEq@j(9Y}UcO*gKNd`T)xb=^a4oHkUuk zQ?o(mp|KIXg{N7-F0yf3rdtD^^pazS-M* z+%DFf z{H_4NecM}qS5$UWX(|IFf)%=_9fh=R5iqiG=x1q!lxs{Vm&Sgw0D9#Q%pO-XV(Vr? z*Y7^}n;9`j==BdkmIAtV&Z?1!p{yk3S5sy=Z@bNuI02hI-*NY~$7ho>kH64sc){pP z)J#m-hdlEXlZP<)M05?+JfxHMa}w$;PrbYkNbCu<{{|ob$Lqg0O}30e4b`NsR`ryF z(4PmP>HqiME;1bfc?$NjL>Tfn_RBCc>G;+h!J{lB=ZWM$c_*Oh!xo-U<_(d9Bh z=9y9GfDHDVC!qjVexGo`ZvtceOmVRk8D=xLg8%C=XBN-w;gn+X1fI{0_ywJJm@Ku9 zaOoqk)f{p@|3&Eu8N?=ej3Ti2H*@|+WQp%|#JCRaK{fzAV|0HeqK$qD%tZ5^HDJSv zL91ISq}XQcQr_B~m*(b#5W^}V{m*4w0ADpn=ni|z6Lhg@Alw$K_CWZ!m4IWWBBg+0 zSXK+8l%89m{6H_<1I$Cm5CrONNvG6V(0)?Fef;s`g+sS@p}0i=${uT8tzTfT1S%?e z#GQ&wYhYr6^!>HtQTjUI7IKc)kj~nD?yW*FL{U!Di@oyZ=RmmynIQY$`(djH_@lV2!XCr zKwaFeajI!(qYS+DZ}qziA{a3+Fw_L%-U<uK4s2Ys{h1k!3M(w{ZmZ-!t$ z_Rz}56o1X(yNQ-=fzWFNeMRaZH6&j!v%6b@-oY9HBoje2y9`XY-4cnv@TSvFNK=uY z?ydSKYBmy-dlrF0E{Z7jSJZ~}TB`xc8{0PQo}fVF@(gx88Z_jN9=+|6GK;g~Aa<^V zyOf6Dog1H^`aD@*D7#!!bA4-(&l6f}m`K``lwi}VN zBTRTtaN|#d3x3g-?}wQ8oqUf3Tr!|1M|w)w^d&voX*?1m%wz<5@NN*0yFjA^q3@eW zVeORXi*Kp%q?#nWPl_=#Z(dn|%(1*4DiJ-jO5Gu{1JaSq*Jd0=qpFf{PtuD_eU6Sz%KVZ$h`U?9}q z{0#5HPH~EwP!o@It*LD1icBuId7g^Ex9?=1g1N)XXdSmk|2I#9?ZMhW92(rDCX^!T zZMR?z5wtW?SzEc_Q3ftC3^vZE2#9xNJrp2Hq``(zbHlwOrDl|8#}pwWO?d%a6eTZZ zcqht$HA2aY#NID}4@udy-EoZ9Dt{qEEOyLGX+zLOpCAann;CMD2B?DIkYL~ig>qB5 zeV+tep$)_XV}xsd7Mr6#oxoazeMmm{tT=M+?B*Q3IPBN77jff)l@(u1KB3z27M$oD zS`E+30b9ot0$!8VEz@TwYa%o@6RXreqkCly1@Aide1dx>iO`mNLMTn1@gE&FW7Qz! zknW3h9F+=IU^3%s6_qq5q%T7NPThJIHBsh_{wON0)(6gE%QQ@D1m#V-wO4wg<|y5UgnOxRFb#sJjBP9Gr$vp>1cwa z5AA{^0t7G0V1K|_b%T?keP0qY6sgi{oOnF^;oa;3akz89`jXvAJgQE;TuWhn$aNGA zO^`q5f#HCv%`&S5;eO~E$Q>%AL@;5vr(Rl_3Q!+4cnC1j9iCfmjV6!KsS}+E9FD6I zTBhH?=|&1^>|wh89xOET|o_psgb6c0C-9+b}4_-D++Ew$@@U=k(f;S>I~uT^oaIl9Pr(f*7F}XNb2`(U?_#hR!51@aeF%BI=7;Y*wfa zDm%FvkDnOI6o^C_;*{`u!x{s55jkYdFJ3r#wrpqF>J^~}IC?qU5B;e4xcVaJLu<5r4b~#If#ZS9MFO8B8FAL6Hz!W5h#1yhBTVVP#)Nae+Nct!V)pHmkVw4NeaO zWIe-wRKL}G0*n+aAGu96j6bJIkmMtfoYd!r&;+7@>*1mV^{i0S(fB2!j?0emmW@LA zjx18<>cn}RSgS>rl+zG@W6v+JGck#F(!Pl^9zI1uI;25~d!TP;NaXL(!(DW4R}kpH z8SoHH^g5FSqE{9QSuD{|yr;Gp^4bq56UTYT6Aod$CvT%<31*I-rrjiz)1=O5c7pmF zm~7nk=#BD|xNuk$&&8z{KtVmcT+@43FsKY=^?3*fWaOF!bV={9>bP;;1a%bdgd`z0 zkTP1?X!K2C=LruzJ#S6ZX%s(h7Ja6nqeTKI;H?Qb_KDl-ME*~@ueVG`c}ay6dCRC_ z_wNg4!zT$dSu2)P@>vlNoM%de0y>IF;UsnFzZ9`yKuHjtVV zgw7%K`tnnMgaBB-HR@CAHsB%E@1P|JUj43g#!#~a!a-P!U^!Jbo(~s0*P~;;V zv%sC+pGm?u{JO|+YU*P4*#-^c1gJz(YWrT*c=(dBs*$(c06XOEcMJl`A^}-2;23|* zlVfst#hsR9h{7$#UsZ30=NctIvR$%I1MdH@o2PT&CQ_r58Y-CJ58K-F2KXrwh%0Z? zULA%Du5!!u$wWg!x56EyI7Z%VOVQp1>t zRvmfoSt8|-Yv008@B3-RReMV3NwxmZ$={}dk=366;ls2Jdd7*;YpOQ&FG}Xx`cx0< z42}-Baz$&H2e$&v&mPs>dgrF^@f|2|CH=hYe{Ej%{YD%!dTb0 zI=+HQY563()Fd*d#H-PGSQ1-YvkcLem+Sq|mv~R3EtOZ{XmvN9kOu#PyCt*P*GKW~ z0Y9RgQ8?EJMe4<4I8HAu)0PSA5xd=;j~h>@WG)-Rww5jX0c<>rFjKums4 z(Y?ssyTx;UJC8MSqfBG3*GksmsL{`xv9~_jys5rAy&w{L^rJ~LZN-q~oo4l{wCGZ$ z_&cD*tvon+0cV;^{9}K7sYKD&>CV-wxEI7B*|7@!m#(9m7=r;4O7$a zowWkl0YBotIV}GIOV$csmE}^$pE|9&Qrqu7|1mYZf>iM)24n)dw6lADatQklUZ}jb zbk%%oh+n1mfC`G`TCC{N4PZ^ZQ)Aa9JoCkB+6{Oe6WYB$zx3=~eWxN*)5Qi!-30v( zC)AZGc5}z!3z1knL(0oqc$STe@N4cShRAteV~~y3Qzy~)Ez-!RofTTUE?IQ_FPL8R|7t0#wR0;b=#Ap!r~MGU+&a6 zRj-?U;GtTl9FGHtCK6+cMg?(p`3|c8R*hVvgbGmi|ms)C6JWZ*)jUfS`}^RHta!tEKp1 z?{QIUWoyqDqtlG0E>;21U+cRvumMf$fDQO8S3YS!H)QmE_7_XB-C^R{WDSl&XXqB; zR+Qq5n#G?o?xjI8B#-CNSh-i>clygqnTnM1ymkYRFh_XnTrByW-uqU{ka)6zO*gvZ zep=4@hmnySSqbvW|2lWceV`f{-<39XlC&DWT9PyQHEd zV>k9CTI^fN(n7RMDGgZ@LLpg7B{`+=+;0w@bDnd4uix+We4p3v{L{$(9ABm#ljz9^;0iSmn@oVkDsrLcqBs4L<|$Hj9wv16s%^BcXd=-8KhYvltBC~4c> zI-^Ue3k2(*V43==^oT*DOITE|Di2FU#NOU_=ECOD4ZhKLA@9>$l&}t^+okCXw>% zMDX!$2r$A!yvvN41f#tb?KR8rH!uJZiD{)vL|fQ?VrXgv&EzHANk9)a;l%RwYZjuE ze>n`W`Jy)N>W$bS->457V5eBkbx)~V4gu?sj~y8|Hh{C%`&>v(l+y*8*nu$oZMK(P z)vzG;9!QKo#4gflW93WMIxEO@7&FGJUb11+$k`2*rfTe$N5O+^BA}W(zWG;dM zium{g))2V!X_V~+K!)X1FP^&tARL=T$}Hj)A}#WUPhj`YIZv6LA9&*=>nm%9z)q&r zld68Cm@9uC3^GuMqGJpX!_?co>Uwqa!yo>_q-4vzm>JG6T`Ha(3VDL&$v2oqlOmk7 zUtD!%p+I0qGw%sn;>6Yf7Jlj}-u)N08V$P#zsNb`rI{AE4IiUnC%v0@X{Oy1#x?8p z1KM;0a}zZ5&CDC*=tV&A z1d3;g6!IPEtd8VUdcg}#42Pf(^!4s;1jel2ejpI2&$Xu{5HnX{H18_?((ZF~I3pQk zmg~O&B$JAI(Y}H#y7D=4zO(gvbDn&t2>xfp?c6aB{QZQHbp4boKhoq{0e?|HnqP$u zwd%tXIiSpt6}#v~?Sv5aoTZJ9J-hR2RUJ&~+gcxG1PsrwB*B{~0P|nC4O}QXvbP+9 z&SjoZ=SYRjvyU0<4T=Cj0-yV-(iXD8$fZVVe9mC*=#FFhM~%>`U_x$<}# zII#`L2>~^fmH`mCYXB>BA@t7)$9V&aT?vM4=9d1>N4 zA1ft9wy^;I&4YZPpTuiyg(g3h1aXteyFd^*yeSIw13M=yeL(HGbZNQ3A2@(19FZoOdrZlfY;LFAQpv$a|A36K&ggi)Ea9}k07LckZG3g@< zQC~^D_;E6^g`f6gHdf=~-ZsBL9s7azJ2`RA9G^@GBJN;5P}m7<*7xOzHis1L-L7A~ zuGWKP!x7|QZ{zGqhAWYWVUg0qzf}xUU*!M!;SK86q5wkeXS!EP)>lK7Oe{}&)Nmxh z+}asOMEK!{ieQ&{OhYu$T$I$4?olt^fEu=-{EdQrh9@iq7^@VtsHuS7dr8GdTnfRC zpqK2~a`6>aqv6@_A=q@r<(>VYY91VbVxBE1_22QNgwboYI z3wOR)WCGLvtrL*PD_)62A$PHadNfzWiSbQ*z>=;M%6H{#w|!eW&zE|x@Q(K+**^c4 zVrey042~*yvGxJXS9Gc1wgTWFB?fJ>VQz*1vV`~4)Bstx+RhG%8pDLtFsZN|iJADt zzkX&1o}_XOMMX&wm191 zB7%-c$;VW`1GAZqyj8z+$70AHbV~6lbh>_w>=(?fxgLTy*D+PF??DLW2J(gQ3e3Ic z`;ZKx@}7XvES874FcVA0U(^7+_r9n5j+O^lzD%8lY^XPPQ`oXt+NPFJ*jBZ2)~#pQ zDB?~}mYRxk=(+s93*kvOQ`!*~_Q%c?=$Ui#R7qXyu%fywiTkSnnY3JFAGO;0W}5db zK)?rX#(dqBj(WRfY;)cK6~$BdsByEc#n>pX3afVXb$0{by<<^h2v<7e4^{_}Za%TY zqcSR6wdEhin-jbT!qUp3n!iRsBW_)G305Mrkiq>`6l`VYgD5dIsL{@^P~SFDSaUK| zPzUc+NRivj+4a&2ybGphpbF#!2R&AGFsoAo*aPxf)H}$WMJYnW^-j3e^8=E1rLte` z409ZO5-XPo-MRd(TnLbG`dX}O|6_yGNR7xnobX^KC zRrT!ojVn};n(^hTV})H}&cMEvzg!LH$v;1cHLDy|st7V2S`i;dM$BY*{oxg@-Ihu*5^&p<(xVB0qSHD}k ztEPF11F*s;nSmNQ^2T{1yW7j>*qc0AzgETrnWtx#STzI16Cb^v+~18mWDcVkdq10O zRB=*Z2G1qY3r*G%rfFHE=RTK~v_Oc-6%6r~2NLN(XoJF)Y;<)Ky$3>_i}e2riA<6HSGG zGw!ec{3j-au(ysq_X(kTFLyK*^WHO%!Q&b&=-&n@bf`eN4@C1-=i7t~mw>5^w zEFcs7I|P@1UA{r2C6sowR>%H^^2io_xXt7fh2o>SRGpC;(O_PD5DhMwB5aTii7!`? z7Z0egrLG6Jb8bzb`5$qY#NU7r%IV?lP9U5+F?pP3hKI&|c4Rygjyn%h%R3p#QjXH>65C1&m61u5Z(o%UB< zA^EazN$Nsj(aREO+daa-BtYznK4@o?xAxhdykdB=@V%#7OttyjS0AORQMB`-gAk+a*YlC&g`K{%Wf9crP(+oZiZh= zwLfiDzzZCR(OAa-{7aS~=n#^cn|Zp6*=bBFHeHB9IgrK4h+kmz;8__McjBn(`_2@- zXlXf%iI(qxQJ~hsg2w?VXl3fo2cXW25KmCA1Ff{1BSg)mSz?UAIxw20TxrZfXE`?^ zuw)_}2U2Qrl|2F&JV~8SA#=vH>1ratUW&8hg|GETIBQ&j=P&g*e4M{+eHmYn z^&mS@|8yrDR3=-SF<1i*DsDqt9dwo>Pa9B`!QWOPdAonGnhpTjG>A7lhM)7e76B)I ztR%)my@)+D@gCZvDtrB1m1;i^)EVt~t~Gzm+uycQ-1t7vsC<9bIxxrRHU6q|HhK}( z1!k9~bt7GNEspPQ)$R4@BA?fMqz=E}@GTe1Jn8>)BLfKSKf5fZHfmrpvWJx~0%>MI zHMPxBPIX1e$ISYKiPl`BjhTDON(Csr*;svG3~f{EbS4orwev)xOJ;<)3>t2Y*Ks`o*!o;N_tJN*>wUYGd$e|l2VW<(d>Nv-7O*%V6701)3383x&9ampvsyfrmH26^N;vf45jjO3SQX_1zURr#%M9>_mpAQESV3eK*-Nv+a9@Gg2B%ziSOj3ur`{Pd4d#TIg6|XC zKPX%9A5y<`3C|Ntvv%YlN;Y2E147mcJDi!s-J>F`WQ)6i^H@I`K zknay=K0<$T&=nl5dp=f(C(`Afr$jyW@g&^(GTovt_kW!_cP0?Qwx>maqg~pLpw9jyxObKp__VFSz3;z#Y>GY*!H6Va$v(c~#E$2n#FiO?FgA zQy%dThM$8KnL`Pzj3EN<1i)1!gP>Ub=sgs{D_fzNJJzjmmn&rc7Pslwd!`Hn!Srxl z!u$$}w7pfgk+wHv4@m0IQ^jisVD_JWCzd$ux5Z8}MN$T4+dsc1&it=4Va!-5WzYjj zv%!x6UwNQMh_XV@&#-k%2$pzLp)$?W+KYKjkPyh0!_#L5hsLw9>HP{s)-wnFH^VQC z!~j-wY}62Z%@(AL#X?*)xGP_$I-Zs#s=cchaGkqE&55AvJ?Zm{Tp4}>HpD|i0f-Da z`xbi~3j1Q&bf3cFdIHPiUnrPY4T_}}NAX|jhYvsz`dg>jk5}9!#0VcN87anZu-s3| z%L{6TU?K6v#}Bbs5Yi4uVRFx7_yNFBgbmvpH}DDK7mamV>tMu5ZhE(4Wp{%@&|ynP zGl&OnC{s~Xusc?@fa3^smp(RZzCooAu(Y9PnazU6I^Vr@Gvl**O?XqZ=RI#ZFCD@ze^2@$*MvAp)3a zC=NixR=Bl2oH4l;HOrQ*t0QXcHd7<4xj0J~1xKL}#UDX2wD&18LI~?#D8)EIC8l4N zJrSFz4hl^Y+6&wc0&qS>nd8Unf#4~;pBwDHq`>e$A_dSMgi#1*h@)Q#7)#<1Gvzio zZ9=46RDM{s8};yv5?_#*&!sQTG@ZC*C;3oahVdIzW+u0ZY2cS2bPrgFhca-uUlH>x z?3pvqm^hZg?4Vchs&3~7E?bJ31JA%qoAcPCu{1daeBlv|i+_??Hf}#Dv&~ui>wg!a zzXBGVJ+PT%JOS#ASD8Z89MsG8_CS;p-677vyrOn$RR9Pvoq+Nq4bj6LE03olW2(D` zIAQnQI!}>eSiX{`Y%m0|_aMXrbPiQ@^?UL-1Q^{0y*SyjFW^gL3UGQhLpzb#A8823 zQVlP+1yHSeFIwF3XfUfebg0BW3FyzVp(K63)sJJde6Fr}*{1BA7a1!({*k=OhHa7r3s zgX~o0}ii$4;A%Lv?A4 zRpLQSG3ht9Yj3~E%D6vzOl2s7GlI$ctU5Ewpxn}M8Fc85tx}!1^zwdcSA-2 z#w_hvRRTQ_oxr^h5t6bI$k2eGinslsM&B{_t!|fo($;-+=xX7BMX>Gqd7b4YSst2s zPMg0#I%x#=ao-&uMe1e5OiKY<L8YWLvY#LV}=xaaj8jMYvBifgC&(?)1UVnf~=x3)q0ndA^`k!5pp zAofp%>0M($5IIPAifk(Ba@|L#lEFmtSy&YI8HT1jYIf$4ubYut;6_aaGGX&U(8TQ}p&WWX*{lTqTkgd#h%$=cU8M^yr8|i~0qt!- zvCMt|+sj&XC9FgX_zRr7^1Pi*YB5Zn3+3PNs?BC&}E zi8VM`qJ6rz+(RGFbrKO$0RCA%=wf#E*r{&`5^Lcv7-4Up8!bZy1d z3vlLC4KkY@aymFPy5UaNd~2un9i*oag$-0b2Uf18#QlP-eCvV_Zjs_rdwHqP5TB*~ z3he{x4n%77pxy$AyIVIawd7P{lk*R&J;gb?g8)t*JzruiSs)6`+c+|bj>xu;ODt*n z1|6ZBeaP36s@yekwJ_T|J-ybeiS%|QCSgbiU>>6m;B=_fnr+b0O{&_teXSJLl2erR ztXef5v;pKtN1>ua_PE+P`dQ{q;|J*eB!yJ&$d&16wyyL*YRURGcd7AniHIER>Ppa0tVH122NKgW@X2*PuWP`yXP>quaHS58c2}%-O1{6kq|(Sc z@=D1_H*6iE+(vzqq-?V}U@GUFijOEr>Y7Sab}qT2WmNp?Yv{Bu<-o{GLqaX2x;71x z(00?K!jeX6SD!KQq*_{A6^nuty3iGyoB4RgVz78~HfGYk_pKBS0+-~9Pxg?bKeKA! zDC@D6*~}`riD94crrWM(u!(HC6m5)8(dU0RJ-txOp*L$WTCrLIn1?l&Jnl=spfwwyCZA_QmC{P9N7dkHbcJYGKOunQtLkf%0tR zeP2O;{@L70kmjbL&cNo9q_?dXpA-eS@dt2)v=$lI~Kvs z4=HJNdOI(SFZA#Q7@l@RRm^Rp=3X}&l5g{9qcv%+Tt&RO<&bTg*WL74gYLEhOxM(` z)3lu~OJWcS7$0{6Zk|~uYvB-o&44lImVVd-_a6kjppQ-)dlW)vp4$)h&HQ@6>m z!dEv$r!=}Wi26?}H{;#W<-fKA7&sI_mJ?x=X4{alwUw+Ab= zI?JCKjrphZ&KsCDfkjs-lV5Cx^|YR;DP+)EcPw{ona@XL0k>>|czI85?fb!Qix%(s zq+YAK@lSE>d@P$P(#-b~5Cb~3LK>D8Ws9&d_mcN^@cVCGYKthlJI>UHv724od3+a6^ zTwF*Me}Pt`k0&^4A$V5+h5Rwjda}b>SZOL;Kz@#7Ut=sS;Jb_>im1yWymyXex!LE0 zl?q#F5FYMhBMEOypn)i~pw1IQW;jSNv@poqHQmcU{rm64*}1FMUfs)z6>vmVjqaY; zXQ6X8=e6fP)M4)!{Hi}<K94#aO*O(h*~apcPkcP`qCirt)64)7s*fi5vjsHQ*g*;tbi(syn())k#khJ<_mUM+gH=r5t`w8%$bR;k#3b;U#Nobh zFJAgUtR`2MDBxrNRdt`?YrK^l^)swzUX{LJ_%GfKuV!ziA#T zhnQbk%-8@r^iC5(u@`mWSCKMfP(9Gq=gXVMyxknbI`G}&mQYOYab($I^#3UWz$p#Z zG(F=>8!Z^1q-@I&rWH}_)wFx zc)=!Y+-K)v$=`B%-080A1r*jBsU6cC1~{B0t0F=E#ZYGKcH!e=Iv>eHKTakq=qtM1 ztx|aUyS#*IZ%?`xc!{tfHC-?+XbzGktJOp>yUaVO7k&Z?R|K7rtIV)^^gI4tCzSAu zU9td+{Id}qAYA_g1s*0!Q9hvfn$#39jQoK|E-S*!Q@na08c^D!qm0V-I11687Ljc2 z4TIWSi?})pS8Nv7;U=3+jDTOo9orUr@q zKPWa^?B*#p`=7m=r`U8%Jo*QU%`0D`!x_=Sx74l9m{g(i&~{d8@^Y_`U^OmqgVe*A za5Z}N1kbGKpMVs6e>#5m1&=+NMv>u~J`Zcqnk;#9@Qn zi?g{7<+igT%DI3JD+E2aw?yRD2!^0(xT3G0`-dmsxtjli)Tqh-!7EBWE>ilvO6$s* zByatO`xx#_ti@9`NnB=M%vTFJmq+uP2xe(?&TKh-)UMLd=dJ zN~|nfAg;lFsHrRJdH#=`YZ;CRw-+Zw+_kv~;_!(nHuB2{T?1-3 z;OU~jVrf!gny~Dk@v#gSOE@wsMTk9n&>H3=4u9htYwIvLf8&^P;1&M?LbC%$SgJBY zdLDyDCsGz`Izqmd;VipLYm&MXN@FnXfV%wtLf-RFz~U| zz1l>6zn~?4pVH`i`ZwF-K`d&lmn+N>%mYTMLR$_G@vKHA9^IUuQE|X~znE!xWzFvu z0S$*?P-Y0Kz{PmOXdlBre&Yy}NHSt+vTTNT{11qz8ljM5^*2wXRORq5hhcMMZ`ueg zhNkcSo6mOG_1gYaJO00faM3Zsp+xjA5?G{T|9^H{g#zrN-2d--=R{yE=R3MEa6Z{f zNIR3}eDAgJ8a`r#o5Cs^htehwH)%fyCc z`dUn4X+J$qVEr*jPqfEueu(1!9`);NP;Fpp=U1_@nFvuleuV{D0C3 z>jKAxk+ysT?S+7;vgx0ruAK8xpgW)BkY@;)jf*cH% z){$y}Gjjl}aRM5lEa02R4NbO70_dxI@6^80KFGmDU#ndb#DPSgaf4Vp@zUYv8B@#( z!M0a)woJdn)`_Qpr~l%lS(*<5YB(0#hkUOknbyyL$pck!xjm7di~Ccc+8_+1C!F-j dU!Mr$XE$D^_&BI#QR0`ue?(0~4Pb1Z{V$lWDB}PC literal 0 HcmV?d00001 diff --git a/vac/raw/images/eth-secpm_onchain-update.png b/vac/raw/images/eth-secpm_onchain-update.png new file mode 100644 index 0000000000000000000000000000000000000000..fe79f21967fca892afa1c9b299cac19341c938f3 GIT binary patch literal 33010 zcmeFZWn7fq-uF#O2qK`A44qQaj3A+Oi*!hL4ieJk08)c=gMx%~gQO0~NQrbw3@Fl~ zl#=%v&)ECA?!EW*c|Q03Jg=S?=RVIp$H8%|`meSA-`{T?(f2i#u3Wxx84C;Rii)!Q z11u~Y1o+375Fh-q`OfMy_!qY41EqUdRUaVhSXfM0D)M)Aea*HyE;Z0A9Cki@J5P`E zme~--`3o)7viW9dhre%$|4Cc-lGqyo<@3Avbf2VJNOyd?zEx&+dOmuzvprVQR#sk~ zZ@gLczOrieU@NF~p}xGVP0PT*ApM0b77ke`79JB8HlZw2ge)W6dcsOxqDyNcuGft4 z&x;=p$+l9kKuoo z6btA7&3l-VVW)ff7p9T%jq9GfOK%%#o$2xWzrO2Aw>~C0>$*6)7_71EK9zf^L`Y+e zPYQ9szj8wtO1#_(dl?}*y>lj<4BHwj(XzxJ{rD7bADdpni_4IO`FZxr#o6M8f>725 zNnyEKf)ApQEBLz7b;6XpvU`cd=+ax`a*-rAt(Es@h{Jeq;Gt=hxoka*nK(+awO6Ku znIL1`-3nLWg~VkIMoKt@D1SexSp2(CdM>?GzXZTJkC_>XFq` zvkN)UZq>@~3+_H5QlfU;(tKE?u+Po+K=jsK@aU4bmJf_!`bfc-!?7|HZUIi`5K4B) zyz#u*<`6RRr(*(LqXg^6Q==a@A<^3(0@J>h-MPV*4)dZk^s~_YGP@eYK!_^yt&);7 zAwp%yYXn^XG#QiYQ4bsMtnm@AZe!Ql6r^yF?p|^Vw%;LU_5bk`8*P|$bq`v}mb@;8 z8#b+=fq(r&S?>oL^ct_1L(3&l{thHd0;p8lbsoPQ{iHsx>@eA_0uJ2E_IlR#aWF3` z36VHhMG(p75hg-Z5|T4vOjRh;O_=QI!*Lr~bcNGa9692{y{O1?ZipPTkxFI%j~m08 z{`VVWDG-B=AMOd1MH-bM`g31B=_|ZThIr*Wuls&QM4W2GDG|?#T2!HKqoHz|mYN+R z`DMWSfCUW9^sYSzGPt!$Z4%0nJyX4zmavE4N$5FDU(~0UP|5y-n)ka*Qml!9xAyQg%m>ijLa#?9s`-$J_eJ%7f z`Kr~e{*?wRz89j@m@ebbuyqv%p@OO)zk7BEEE0Zedf#S$56Psi|2R2hTav$tvCU39 zH0HyE0u?%pboTv918M6D#W3c{c^*w${Fo<`6;w!zF+nz0oa06Qhv`JU_kSGgxfC}@ zLxPgytcfhOt@`TA&%6?$O(L@dXFB zwrw%b@9(Ia^%nJt?r3`2UfZTpVq(+w91@+%0Qb(gw14llix-`wv3z#2-JE|$;@UW& zzk0eiEMDDp-gFl(BOqL)ZA}@n*GM zvWA%8)WgTQxvXgqeT)iio^%QX?G1^qR<-R2@l>@~F&`GsBsE`)w|sI%Odvn#(8$Eo zc;P&0bCV5n_0F!W=TL&uKDTd2kzD z>Q0okmh@<|vN=n1%5==s;~k~ln1(q0Tb0(#II&p=)>HF(SPB-sZHjigqLVMcw}wK-KJxRE&lRS_c|4%x0vf=cw> zDYw_2KWW_zJpc8z*t{#)4pd2u5i~mC(Xr-=#88?d?pSZ>qBH3Y?{V$6TPK_57fuEQ zJ^pol90Tv51Mj@a5yw^)x1{FW+A44F4GIsf6(+a|-emBq4*b!_Idt-^%e^?$E=xBs zxA%S;jf!YN_hk?VUm^zVuSc=TvF(pt=7#deR&R~ zws^XZ=IwXE-5;CRg+D;M)n(51>06mjY{9zNAzrns!E{}_u%&B%RLzyjqx08l{mh}< zRjGy|*tqyEwVCf*)8JoU4v+e|*Zqk!iL|0G1*PrZKHh2j7T4M6OnVx|7+j-vCu_VU z*T>ksRL*kC>CHBwl7Zyc;FE3fO?%s&osOdg^2pMY&7;K-cWb#L^LOxIFPWfUU(&a! zf6n{N4cXOv>pXFzlk7L+Ua9=i&r?0^GED#YljTLn>5qZArliH{`VSIz(d=n8JgTj? z1|m;(+J@s~&VL@71${|1K)_9{G!MChvy(6NOPp`Jhtzw9uRc*?@avf^`Qp-eGvJ^N zM9FlF8as!Gj6+UcNYjj6{b5zd;jEbRs|)9bq8YOwv4xL~v#f21s7 zfnvB@|IHE+6Svnz9e4R!mcmyDZgn-B&?KuA2(Gk%o|vg*%nD@3YBNpFT zpB_hW{QA6FKKyLs=2&vWe4sFY2WtnO;~eTh`TTJ81KugVgu|8|R4N zl8)xqMfZ+_Nqu!y({(jf>%{wG!M#$4)7_fK9h5TyD2Qi9s=jew?{~>>?bbfCj+|}o zI?E5N^k`Kn&&-;X1(e^bY(+;&YsEK-%mskCapsm|N4!TYUsH|wM@=XiPk2QB+Kh~7 z!p*jFsUrJa@3h+|TlJOC_YZ6b5pn{^gl94KK7IsHy}Lw@@VtP_W^G0P9aC#Nnu{GOhsH;SLrWp~nV&=sZ`*kxEo zk{>!ccD-M`IDgz$El7^gk~wQQgOw{oRUJ0y?)|8o`f}wq(Mx8zNUz6*M8=DXTpnbE zcgNWRioAqJDdL2}kAJX{mqu$9aiU9YWrB+L->F{9jv-ZCQ!I5~p%6W$s_ZJibM(pc za3GySj);hn9j})kWz+;4XON6;lP7elI7W61@V8Af&bwbjm-5EKt?IVQ{QE|0>csl1 zRF>9>yACxrlmaH{zICZou-~ijSl)K^Gn~7XLaCmF+wn`@9N|T{1qOlW3PQ4~vW)1V zdFb_SigF4>Jj?#!oO^Ta#h~!;G>v-`h@bfSW$rj~poWb`1lyU#<@8<(u~q*&W&xkuoplk`LSnY^4LA1Q;9i~X7Bn{2;rPyY@l&Z8 z=JM%UakSn&HCkcHhlPVL>U@&5q+g#2vAlgXcu42oZkZmecO#;ZLusr$gO(gkQB!s$2@@mkCq&oJ0~g*Kzw#Mcitp7I-LK z+ZjCv1p@}5PLFcHTDbLUe6?UW0k0tKXHtd61Eqw9k9GM855%meta){y(if+D`kx%b zT^Am+YnSroz@PUN3Ju23+$B=l7B|4JF@idc>NjazYY}qs9F}UHzgimIrVZubJewm& zloj&PQbc4mWXCocIzWtVN0Zv*3l3K~*!`@c7*<%rxX`78=5=ff2$)NQ0WAu&*TgN` z>+FW?y4l3Yk!?=3Be8kv?0kV2W(Sw#j@~JvxkA|Ic(0dB5RYW{-iL@1E6wwGhc#)y;zGZ zXQyi%X&EnYA2vSL&h8WPl@4DwNFRdEBLhYIuOn2bG>vTNCmneEs0nN>_amfYVJS6Z zFDr1xCH4!F8q$@ZPFDJnIstg>Ovx-^WfN>fb62H*zS(irG2LA3Gpl2JQbkhQN%(~l z(N|}!Wj%gwxlKJ0Z8lR`U^r>78m{M4qnrD!er#@{??=7R+7LlP!22;*|oIwoZ#uhfB%?P5#G1=y1h9Hegc5(Jf<&cJsWSnS#p4r77n> z@4L#1b7@!{?{ddx@LID4K)lCBKXXr1yQ5~0KK`60qDDBm2!lQ8oZ`tZqLiCX4GHRW zm7JM2Nr|0$&W|Q9I1_Z%RiF#7?kjd+@~b+IHu2)8bVe}27qpo$R+WELb zq0H8!jo`{6i(mIyR20HhzfW(FYfIc0p3v2y-DXtl+!e2TV9LXgdP#3?*6BqTW?1`Z zRj0jZq?Ybmb)-}^$w`s@xG+d-pEJU5&KYIxKL8b*8+EB}*%wokB2^1uXJ=`+&{@$| z)ZNPn9&he^>G;|-$~WoDV49%8Qtfdo1fgB=^mXUfMr@*$f_1u`@?p*)8|2Fqk@&>G z_0gaQ0q{oEGM~nfCT(bcbAN-{{SAxErUzX0GpD*(21i+UZoGVitfejJe8_E5I&{i? z`Erow*aOuEBEQz>a??~A7S$N_qqS_+bsK7pKWL11@hCAvf}UL|Ob}9tZ*p0)n{LlZ zdN%U%Wn7^&kHqumU;tt-9T!)+#JSl}GiI6kC%5|R?8E2VLom80jSlk#S_ zaY8OAt#4W>CG{pmRC+slf-UnC=Rrseu5F<=;{-L?Hu03>m>rr+u=J!tb%jC6HTxsA zH~lBo+2ocn%j=XH6%=+V>Kr-A+lsA=NBft|J$M3ARa9fP^e+19>M1Ts>_0zDD)_RT z?bh1If47MhlI`l)WRRcRAgId3C0R|dSMD%eD(ybY^J+MyDSB;K5qnc&b%O=+?t4+X zS>24;yj+sdyjRc=NDtiJWjFm;7g9>TtO}m34#kt_D2fxVPVrTKLQJ86*WH;GR<20f) z>FY2!vZTMWwmnfRL0(>=UQOF_A;bDo?pZ&ZlY8;uucp@Ka=vIWKK4W1l4e6UR2rzV zg=*=Bn!z5VXgIB>1>RJRsvlQ@a&)H3jwjVNadH*r7QJ*NdG~bL`1^!mlAhKt^L#$r zqhuvn+jSZDc`!hPXi@FY?zKrLjNPLnK8#Zbkmy?Yu(drT21fFBYI-S8mOi2|pp5nC zBNt>~O=eyAcQ*d{^}mBkZh-Tyaq^NOlg8WOTP)$(R4D zfXwu*+rZoaMO!HmGmX{X1Te~aW5qeGjAz3cZmmE+RXhV=oR}cAk_tn$#&%zP=fJSu z2ziDp_j+qz8va}Ol~(ru1tIf@8<3Qrpo9De;O0@lAy*>$o61=a;k156KY|w95cuv$ zC*XTV%NB0^~&?+YH=Wu?53 zi^{tD1pgO<`}H$0999U zJgzT;t$aopF2Q81&)q_LF_(-l>DRX@C-SsaA$Z2oH%?6|+_PomoI1+OJ*a(Z&wja8 z8bLQ01bufc7VSQoYY=iR+=wj~CaJ_D_Slwr|HI*#DRSiE{>nBvnkL;H5dIcLnpFoY zDug8ks?3n+Ck3MRNBL|^9fkliEetI;$g20onGrHU28gZ#9pclvs5BV3KLcmyp8j!9 zZQ?t}u#7lbLe!EK7MdnUO`x;@&_7CV(k8x+cQ$0KAG z$oSsWMg~F;Q_iDJa#Mfy=*4i@{=l4{JE79or|V1)aMW88C7SHISrE>vyA+YJFkbA| z0e*4>|N5xUAYKN{`p_+?R}nIWnzD_*jy9z7Q#xaT(1#VxtPu&I6~8STlRSe~MP#ed zvmtABPv1R8zkuG``xYq^pdbi_fCy!U)_R@f0M`_9UR_n?uV<8fR77{yBDa8d~+ zYEE-YaQo=!Vfq2rw4mE`6Pp>r>M4U16p9jpxZ{m-n7T)PB*%M1#)R;EvohKQ`fd)X zo2yEQ+W2`{t()ZyoGwkKrdSxK$HV?pOIZ-;&O;-;0uE#?g&Xoc77<(+U6(;);j7#G z61LnT^j<)O6(~507B38xppiSwTg0iLZl!r|t9bFAuJAUL&JlsjoZ~p1_-L9MPXRs$ zQ2x7Z1S_*_vXEw?7$_bphY+IP2O?l`gD*%>bl9MJrR(pRv6rWrO|zQ7 zNK3qgoH7q_HSwd%vglJau3J-$mgm#)e7Qj(;s{;7r15?z;} zW`zj1hHm^VtUj*-ulGKKl|Th-U#g))=-*Qv2NKDC@0O^uMDybs#DJXj%TwTGiRfymmWAzHI`Sx!AR5S$9t zmY%|((aqHbR$lJOL5qdUbmM=*t&4W8T_Qjb=}-G*ENFy6IcQA5NNMHRdL0BWv|sX~ zz5*WaU~04(Muuwi=}Ldg3hA&ooFYPwFgp9k#DYO+dS0>V@N}hTk5{7Yn1l)PFp=-o zLm=TTtvCGuq095_9==5!GlB?r3bbSuQGgpGdW{x3uOJsnB!0tS(x0ivqjLV6?Jl9x zt&B5oFfX98@|H32kuI|-abvlqD(^_#4O3M!|9ha`>YU^hU_SZyN)$rjVJcS=z#xPi z5r$38GeaI;L%a$SOAz-@CK4~6uKH&9bmjPXVd_0OqEk6wg8;ooBr-3r1YRqVKKV$t z$AfQv$NM9pQZ)s;=as*_04?*6BVk^{84Syy)#yshH^sP@Tih6qWX#}&A*-4J^3c}q z0c4eA6LZ5LoGzTYhWQp~)mwL~v{*x7>a4o8i>wfyRe`}Pk)UY=s@^<e;b>|P+xtk49Kp3| z{mVCjg(FBN3+-J}=>02nvGDGYJ$(R`{_&pG4u}plKNtMI(qE-n$HDO+n+D0|Q1?|C z7Yt85kqeWhBqBrU?Hf0`NPkJui3_GO5A?u@M7je%b0!sULj1m1d?+nF{^EjIpMKI_ zR%z{JN<#)Zl*wM+>2ftBZm3MK?SvdB>lEV4#SOkm3A>i(`6 zN;F01B=JZ&6zW5mUQCV<>@2^5e$PpVlMDWAJC4pELLn4NI>0DsEY~Y2RL$})|Ev$1 z_heAsI^0S8z-4nFq<7OlBqV?UkQ^*kuBdW9}4yaA7T}gOp6~Nuwdq zXReHlB7nx&Gw@K;c&=vJXC=s-PeXu2vGg7+RpOko{8z)VJRoqo0x=vkO=f@`B|_$O z_lc4BgkJoXiDOafU_mUuQ(nN%Z9r;{GTb|V^?vf6dT95K(tu=^4!p9>$hop{&;vzJ z9hWP)(^BXMWUfIl2j)AC{njtC-6T9Q+RcQ4xm08DJhuRPa%jZ^kq$+SRWrw5M$;sT zU#?--Mf>iLC}jg#YT7jL`#ZY)!s|CAWFOf1vYBZd+aY z*JrzV@2SQqAUPVY#@^}_c!GaL2uK;#ug{M+hrZ^AxC#4Q{6xtN8rkRCy1o8F#bc9h z;&$8fJ#$osV{vA$og79b5kCL9GUqa%YGCFFN+jvI6h<)1`IV=Tn~seeC@`~WHWPV5 zX>B{LmAk8RPqZ=XDe zMKK7mab>f*t0_cF2q6`Z28C+MTmX{AgdP3Sj6GvLD6T!jlagmQi|9B$J*XLTd<&+o z@UYQO%6Lw!5R;z_=(Tm+7e(W*zvj*5gq;7f1M-;4_CXi{g8*owxcQ6HV+;ll>KFmi ziPO6eK69@2b6KEvgD;{OoD{x-0cC$F4W0*oQI|mx7qC?uHL{=@t!z7!;yRZ1=2dZ4 z|LhAfK%ZsW;;LLeUFNBk{oAME?BywK>g4L zR7-ro3P_;MC#v-b<_SN_DzLsu#`7R^o4OkF@8Wntb|Ss+azn)RVNN@tN=Bv=EBXiOcSd1 zj6L)I_Ds&>1-~KCE^cCTF7=3r6%a>O3f28!=vdC_P}O1d%p?^K!Qnf5acA?*i^0y9 zoLC@Zy&v0k=lf{xMAc92WWYL>i-nc&o?0teI5uU2WTDQ2P#a1LJPEvQTXp*5j(vs- zC1oHY6i<#Y>kt2JbDtSojC|WT(Aba1jhmi=QN-_n(XBYJ(EsxaotO(;DiO>Vd5KF8 zRyD%4th|8`w%%!0prZCsBCc?&1YRfv>&N0y$h^mwy{Q$gc~D~eLm#O-Af!*7d=JJBw@5;ZJ$IRG9@CzP1bRur1qEQu>hYio?EeXR_?>CB1t?Y<&D-4Ve} z5si@}C@YLd^@|^LO`Z1vA6TCgckHXP?05xh$EJr}?q+40nzzkiZ!g(_c4)e1M5~|c zuNlM8%!mPOTsiW5m&s@6eOKaLi?xv20pE@fx1F!TMC=wC#I*zH z*&&U(^FYOrmfa>85AG)7%=vg&bQUfFE09Vs&T^wd^d;4h_Ol(Tgl=G|^PqjfLSSe@ z$H@8;b@?V;X7PBrN ztc*#kW)CMIp|Oato}~fQj?gk?+&gLZP6YjP z>B-gEppaSn(u%@E(K0D|#Su#i+cogUq@d(n3CbYgZK zS^+mfqy(IN)exVziD=P$;T$b9vyvf(A8nCqJY`A8SDzq#yq1Yt60~W5{0_cJf16%{ zNfsg*s+!CSHZ!e+Pbu~qnECZMpR&iW9Rn@8!);?$t`s%k&}YCI%zntWyZ<;hM>8fZ zm|cK|Kz#icEos{$I64ow0QO{uQ&1voY|@KbHF;| zVy9i8U-IJMCw;C{Ft94b;gxNaN>S45Y8UHRHS3K?YtX;fwtL_$YA2=Mt_|I||BN9w zS>S=maYt{ZOX+zf$;%k|pZAFQY@|`D5pBa)J5jZjO=D-^2PVB_hFBl!bt zJoi4X%=%yw+ZVboB$$bnEXV5_)6^RowNGeFq?$P1R(>(ECH8(~Oxs$afU^zepr)C7 z2NN4F7KU6^TQo#QWlMZa5 zPndP&on0xt&{5QO<>r}fuc#&n;3<3+oVq=Jw}99B;{iqM4Xqz8?<=g|Z$y=i+as?m z>aYiMUS<3c!pDZ-St;wk5d*8J*fgeNXoba*Jbuxw0xwJ}y?GAuo@0B>gm++%9c!-| z%Ss^&Riq+k4BQP1+KP)|V9|I*icO@{F~i}fuIf+i zpN_O7g@IHQGax9){?2Bxa9qh{p-mCds{iy8p_0|#`6!|6^FLAvZKA)o)3R7-WfDwU z3%eV-C&*tq%7MppUntB0NUw5l)a=xcZsJ9f&{{1+dxg{!t03kM*{Y` zzO6Y^;eI%|FX#f3u&MN(u**USHnSW^R#KmgwEU34y$jXve(~v3_ue&WqG3+M6by98 zr8TetDbrvt&rh&hTX=ZA-|ULp4mv1hSH)NQZNV03-L1hE7CMkRh?%{eQiS4vV{v8@ zKiWNoYa#cDsBAf9A@=sYlrvxe)_=d;DTWmErDlfUdXrysdyaTpp$;CP-ctJMkKE&4 zC$Rk1JwCUm`|AlRr&N?(evwdwj8i`YGqTp@>h(`D$Xbi%h^&>>9YPm`-FFpIU(*{T zU{6V7An!~F(9RSKq#S)8l=2r*KK$!7-hRzc=!Xw+JawSU>{ciPUE$Wd{B`(`Jg*LG z{bak7Z=vl2rZ*ou)5LhNYSL9NIkQ5ZJSIm9-lrBs<8Ndb4sr)eTB`~5c<^Fh+kuiH z(8tBB17rw#%e`Q7@yFlZ>qz!+zIs}E9~(U8QjV_2H9%w^Th#v|L^(klE{i|bB1*D= z=wHgm!zGpr|EtyIpo%N~7bL)idL`e$A4c`A=Vl~2ArL@faR|3so)sL~0Fu1x z8lf*$M&uoD@dGY!J%l4%@Kq#?cLz5V#*1L*yZcAD2ZH7~lznX^zygWAsssnn){*>o z(BESt)8e2*PhU5eB2omuGs^#UktqWNzbp%RDAfg87D_doLiH#9 z;wO^72?6o!=lSt2fsq?XW1Oo`XDQid@1W9|(P0qdT- zJF-^i?Nb=9v~tU9>R}Q0*q>|wo?HzB*=acSauYVlPD20>Zx1I&8wNgudEUx%T%h`{ zVis=7hyx-K?^cg1E{MbnvCF8pPYC7+9#iY>-}5|c;RVRw+c&J`^d*b-Eg4FED9((a zD#s_ph=-*tmW8|04m(EM$bW&$X82E|7K;{UhyW zf^;8h*==T}m&FlfTUxGw zz7%89d!?!sWgSEIto>1qYGP=m5m;vI*cH#n0E%GtXXno*LwNiedntwBObC?+3l1-d zJs!Y0c=9CRF*NNohcsje%M;FeZ%3q{W6d?}XxQKuDSs&$0CAUZ6YB&3qI(Te1rX=M zYlokL+mN-_u#Ik^Grsyh%5#xZqwe+qA1y&slKN#SK)DynJpE-LzpK=f?g!=LSN}^m(7lLv3VjDyWv74*|9AQ^3F?aw1+y0ct`- z`WOG}azIaWF-2XWvx_99-|&<7BEXgbt@J*9`L-^cg`zAAI*7WMxMHO@YQ*4jPG$LRNt2h)jxf0wAZ^jx@om zrN`qX;);VIAu2RS8-BC8^SJEx`paY&9blk!Bi9(k$8)+Xn@<-MtZyFVy%!~O`hv>Z z?%8*8Cd9y@<7u11#bI+-CRjj+20_wg2X?9abS+cog?At;sZ6z#fPJO3Hk z^k56)Lx>poo7>6GgY|K9)uWgAZ*C{ScK?Ga9ZYestx2x&Tax{SYyKQM^hiNrA^y-% z_BU`frXE?QG$=o3I+Yw=3nMOaM9R8aiU|S|(fX%^Jwj;3&lHiP*x1W0;BiSnsS~_b zwadc_k^1?x8p*(P@-3WbO2*Tl7YqW^J37XYL`>596zuL+??J_51!1y-$74GPpA|6in*QZk&%E(r=$#G9f-j1I_340OPM z@zMq`fZ}+`zRoDF(lz?V}weisNI{PvTyM2xG&ovuRy5;DqTS* z&6So;Gh+)O=);K*goF?nu6z%p4*}3zO%JY1rj#cCUi~_-suiI4YuDAw@W5oG+Cs#t zL#Qi^kh*n?OyM;sl_#3`n-$y|vww3UD_w<~Txl{~2g&MIg7?FKd!Y6G{!^jzFbmS| zTY@?5`9}kMiSY=u>>GM)%$9owq_IPabgrMPScm!Q3D;K(SjFo#5kyoNby9 z0q*F!3WC!UFtCXjjeHs{y{Y~uBvgOLi!V4`w2znN_K(1r05fR$&fTr3KNfT_(DOhQ zq{52n{tk-!-e7E$1(2Qmj;`mzI5}AxfaXqQf!Sno$9@+a&D$no%5!4G!3ve70`~$T z?jLdHqz*v1^;co9zn}LkLN*2If!U`3+*$_#-u_+QJ2_Jw-+SqX)=To;%mTkF2!qXa zw#+H|svS77APiV_`dB9>*{lb4>1=QiV9`-VWu-gviZB3zS+5UgorfF><5!EcB>J?L z!0ty3_-xZgvc>oRnSC=zc$JO}#|eLMXqp9E9oqb{S*{4{(rO6CV>*Q4oySMt+%c2c z*u;b_|Le~bdwrbw86e|b>Biz|mzfcn295719v(0dc$m6hoX|*BL-y~^STnx3jOq+J$pVaU_Rit7 z^}LAm*}jhOyX!jB>d)&ut5ms=+E%Z%@}*g?=p0spJbm?ZvX)Q8^KqXLU^y2CTMmSU z+*4~iB%i4IT00XMo_CoXi!o>R-iNcwqq)$}+2?H2A5MM(Sv4zJ7XW!f7;C!Eytl#0 zg)uikp;AM@4{px^c=B&&Ci_us?~Q@LpXew%U^o{ep!a$<;{A9rs5#TMX=bn%#o#7RhJk{-^r@P%(#XS9c$dxjH6f<`Cs%Raf72Y}9AG7=T{H|De*_LIJ z$0g~^Dz<)cIL1|z*g0Kd5^yW;%gYWZ?7c+6M-uVbbQ_-d_ zJ$<8hG5wAuxlOhW{U6xV43X_;hjXi-(`%*@fY-W7>&(IV4Th?sy2c-h!1}Z7 z^MfWKz|FlHic5;Im&f^mvl|#G!MYeI74^V6ZAkvgqf8kZ3>wo8fc<8qM!^Pfb2ra8 zqUeWu0d7`E#oI|UadV7V1cxEq6bj&}J(C|Kzqx=u*F2&41@QZ5J7D|z7Gl&MzTha% z_BWBVWKD^_92k;F-y$|@R@WSaZJQquJcd|ed95}b%R_q>La}iNF~;8C%tw>r)2;U1 zaLiGi*0$ue91JQ4L)VVMcL}?GP-tM951%51VyGnNQOxawah+|bO;;fATOP4=GyhlH z=AEOBL)N5d>)wAYLq>5!WKOn(fp&9Zh@E)dwwkSJU-)~^H4}0uaHV83CtEzgp`u$0miW$i?o5oQcV?2Qv&@YRpwR^xhGT0l}l+WVOjL2-woftx}P7&BiF z-P>4-moHA6=gf8yItd`Ez!1C3NRgw*0Bf(73;=V@ za3`G zG}p*a%)t>4HiFRcLyWoyPINq+YmzTK<;d^jI5QC&lGv=6)Ox`;ER5FQvWt4n2bN&G zNM{^Er75^nGh-P{UEma$`d7iM)?mbG+n!{r%lB3FJ~$QOs;|tUz#^~K4oa7hX`5zL zL5PuTwkeuoghB!2&zC~8qhH3YK72fHTkpedyfKmF&44adFU8Y-VACw*1I~OQ9!fAi z{^X%F-S(=;ln>3JHqn25<4xT8xGy+R;L+BQZL@bnAw|fizs?Qd{`q@*U_NSA`#>=P zP9!_tgit^9(#|H*)ovr^Yj~!e<^@LTx2kGeN8lz*<{|b&(LbJ+(PIk-1bx2=Uf5gx zCBT+3RYfzVr=+)dtJ>F5#Y|yfjHj|8i87{Nx(uvfi!^IhVj%fz^ze4XRe+{NE@+^b zFDu#3H|UmqvEANu=Iy8AP|KirLXk2XFlEX%&W6Pfp}VA22upddTda;0Ay=o6PgWO- z9`b3b*R3SU>KVF3ZEDd3vP7P^6z#TyNs~4W36KC*wxp7cQ`D!~G^XTT-`*ZGWQU{@ zO^nvar@@njUWtE#JsG;+M1fG5)HBj28toN=EyjA^TeBikwC1#<1CwpLK4u@43#}!S}6~NSmEc&w?^DV4Z;G>}RZ0fy?4>i(E z^|Y213v>p?`t=VvAndyhUp0{$C%AfSEYzm3w+udv6z+d{0fZ3}+m&${E;`z)Iy1EZ z0vB1?QYT*ig4dJRfTg{beHzxM#0QzP8tDrZ!12tTK5WO*0c8g~kI%(P`p% z3Pb_r%5;{yj_6adjfN7*5phz|vyIeMz;osMf$HiIk>3+thoGR7SbC8>DslRvo34XM ziEoIzyO_67K9O|Fp*pwjp%kBTv!)0yYebz)9XM-OUkysRH6rC$DSc*c6Ki~Wc&aY zyuY)zubCG+OX#J z7=6Jz$XCQdXDF6hbzKFA5NJ7V=~7kHVuT(TU!J^a!N*z7 z7G;?vL19S2O9AhDwUL)r1|}$5uEs#_#8(Af&O{~yOOV{(kISj;OEKUVvMY8_XG{?2ben(RP&4CNp(YW&tyU1&8darW@ZS ziEp*n%=6sDu9T2?R>;!E))L^q7cZYdip8!r(W=ZXX`2kyS^4JPRWxp6Wv6p=~ z)t}QZ9u3o7TxQARo|P=a)uiz2hpG;KYnpTOnUT0@6*Qq|V8q|g7$tf%ey3<2vnj8U=BI3%+<5%>c9BU0IjZFF6 z`})NddWla1!0|m-G0l@TV=0j~aRaXIS3#)~3KhIo#@dk&2HMKzPK&9DOwJZD@`vjK zI{~9dZY~D*RIHOb`jv8F}}GMLXM!ucWPk&@(y_$c!- zu}Gh7S9Zu;$K>MPOZRVjE4uH=X)~4t;F{D~VDlQ9lc%G57ugcF_vC1BkLzF^6A=MQvr&M3$!irV(Oj z;K0)87o&5QFk(o|Cn*f%S0iK7DX9Q;r_vnMgS_01oyzyj2hK{1c$53o?-kxCFznGP zb9~a>(k;aTPP(Gx3@HU_^qNqwszVz++A!S6izw_KQ3DSEH{iB=59O`d0b)?YF)wrj z2MRl>$C=oZQ2PMFE) z!laHqjbXON5hQBi+O$e%Du3R$FVEzJemciYCLG3c2xXzMMv(R51HSRx7c2wInWHRt z?PTv+A>?sprt+K^9i;#$4RIfeNJ{zfB*+njy{+;DE11unEJcEEq+BsDjtKR{F@m#( zkGz&#dtQLIafs8=8sA)CN!u_(h30JFm2jDE?ZLDPiz#mN^LMBnL!MHeLCJO-nCwgxCW_?uZDNaUbCz47J11gu8V^RFK%+nY%96tuSB4Ff9i zXW?3&0BL(_knu4?p1^Pwb)NxJcquosj};7XqRW4g!vAxp;Ll;W{(ek#Q_cT|xd5VFR%GsagE@f`cPjRDrwP_1mUcVM3rm(p2(0V_86C zC?xs#|Bei?AA~4%uKSspFumGG^QMDvlXqP2R_%a;QxG^fkt3p(!`t9wVjfE2F&Rt) zn8ZXaXOHfNLJ#l0UI+pVXYX&jFtAv>C}xcU^fLw?HI%OOfs(gP-*ew(=7o1?LgwlwaCO9 zDoX&+H0g5>6%L$|JpZ!Wz*{qj`Sd^)$j{ZM^gABqS5@&B<#GL!W=Xb|iiJ$X`ZHoN z;-o_?z$Sd^y5WBV7mW0Y`%i!K|6KaKg{SH_2)mi<|JKNhlMq!9J!%HSYoW*cNRib2=ieGZy_hb`nyfb3J9Lf zYy>Ze5O{nnlLgQi!vD7R{i!jKAu|-s~U${1Sc2b#)^>JvkE-KjFFpvS<3&@ z82K;e#C22P7a{R?cz;`uK1->F0EZnIX8FjaA5trZLitJ9uN=q%Van#kUEoFhZC3v; zPnIy~6~qs;fmrXdScl5q1z?^SM@6^@3>>w0=CL380L8N_p+(V%amlZ`N9sTT2wXNC zec%TM$dBo%B73+sa~`RZ_H9Z;L`?xXAza1cGm&`Cuy;mJ4Yxd)hR8Z7(lrQCEvJtE z8d9cVP_690MzySvw$|1LDoQ;fC1~9swVuU#vVONvvnJ(S0;T+f>%qGukw zGuR4`8Nn$4f13sZ>}F7j`5#5zG9bQWayCB^gC_mP`lkt#se$MSB+0@UR~^RkgZVy& z;xY{5Q^b58;kVH($D_BeM`a3=@2|G3AnK zj=arc0kdQ5bDH~f82upZW-1HWGF)=X)RUIzJ?2bjoWw@y{GG0|LlcbOFZ(Z8m3bRj z0C!d~+B>-G`7hwE9Fo7LVN;yv?}WjcnIP}FO;)NkI54d^-15#S?&0o#q~wBWD`_#}pHtCaWI!PIYpXo_)Xf!ucZ%Ud9A^j}5+ zQU8q#IHLJ__VV{-FcG-ojquT7zJ*Z_K7f)1&OzUnPxhR-ZUy;zgN&L$35*^Xf1f=W zEh_M|rL`09UJh(AoSEBl1>WVAO+sLf%P<0;8>!sBF#uG-A>h88nV$l}jdgK`)n!T2)P>%P z#Q~~^w>ZvDj>J(60TuLZ$1UIquD$vfZdJFf#Plk8)QVCi=V-oaA&j~pvy@yqCvi++9}g$IA2C@+ z$kG!kPrHIIqu8x|e1RdJ97e^RpkgkE>f+xF%>3SQ{jbu#JRYk4f7>!N6O|=GW8Wip z_Q}>DQe?@#R2W+cGi52MjFeJF6d`LW3T0oDB^i|^*|*FPl`RStspoxk>%Q;bbAO-L z^L(FwdR1r6IiK@6pXL3&-q&>^fb~f4W9a4~usB)T&EZ!z6ljCnmke3b zglA@yT498TM@oRr33yybMOodRGQZ)Ob6+H|fWI0mgQY_fLSpvNbw3f?vJBLtW_b9c z)3G~}T`uxB1N!D;3RSLwWYidJW8I}hldVPl@m?W7#WMjMGI#${*|FEXu7@5xeCipd zsFyAe3s+%N#~;9XS0hV2E$=YZOawr@!zV*|+8C2<6Jmt8LfM z??YWB@_9cb55;TuQN6W8-0!RsAPmqtO1ts4rb| z4nbPMD?)4WOTVQo=itDBl7`gyn+q}-#fp<(9#tO#2{v8A)lV9pw1lZexv0+SRB3TQKMRNHPbK~L!wNB={>ovwi^FuHG5>u74 zGI7kB;*Bd_bbla56kh4Sm2iVV+1V(xyIq-2@`it;Lzo|sTveeD0{7Hg_)PAMK;rvp z!+APmYt z8H;s5``RP&bTSXITUs{aPjToT4FDDP1fZKO3Un!hm)!_&@}TPzaGSa+l-Q9#8iZJH z`o}Yy2tuq{tUk`6FrH!ZzESvgm^(wDwa#KzePKSqV0r*4cX-#lSVeQ9U_RYjDO(gd zx_2ihg{$dB{?VO|?$aebrJM9_Hd!_*`T*1UxZdNK%i;NpdtPjub2>@CF#Y`adMIF% zf3XC20~aox3#IepE1^mvM?2&>!T%Fqs(kch{*}}Xi6vgcx5G0~Y4KSl>O}=IR~|5H z22(PR#WxK>|4!YXyyF!;26aGBgxMNDlobUS#ov$`=PevCdxTeBBj%apK+FvV?0~9@aWz3W|1I-tKg=jK&&9M%6_UL2bkuf?(g(t{v`3!c15>6hMdtapd9TNB4=#(EH>o_%XxWCR0S z>TXi5%CA{BMrC^J|o+=U&qN zuP^Zb+kn5FzwO@gt(>9W2GUoOQvirTt-m;5UqM78-@xo``ll)E6@OOV$;bu@>*ODZ z-&yId8?)#J3GBgkNy@>PyF=l%n|6J7o>zt<;VszgYHXaB`~w0$7z?wkR@}G2z_nwP zb`e8~NdfZGTcNn2r7PCPpC(G zh8&P2S@lHJnA~hWo!m@Mh!E=0V_-T32cXIrjFi)naj9K@PY#WDmVhcx7!%wUk4E*I zG>BpKiM(p~^e2GOEG%e?LwSE2qDa%ta#2EwiE-Q|Ldj3K1%YUWR60zQ4c;nTWP%g{ zVLLA$D@5GHewf!IV!kh!Kc%q{?`$#L75rwp)6y*EQ9Iuyt>41%q0W0bQ~ zd#32$hu`C!Qo=Q~hvSU`AjEFsC#$J9mh{!+U~JR&#(~_umvZDs|_6V+8`e-MzJ}9-FAVjT-cFB*qedQ4DUH2Ji z?5Xjn(Rrb4iy)XxO=6*N*HsFOzXp9#iVrSS84VX|GabcMyC22Vb|H;3U{de?g-JAN z&`ZVt`c*C|`Hh&W$PO`tB*s}6rTQzc>`x&Up@E)QFf;lizO`rwXX)AY)zs+jaa1-vVufGD#`2i z?WCLl&C7=?EAJ%Bwm>Ty!hd0J_FvoN z;f$s_J6T*6h4$fI?^{8un3i)%R_^4rzVU3T=h0z{mUfDw2grGdUO<{PvMYy);ji0k zcD&&37<$i^jdxo#IJ{Kp8~K&)a4v9$B0WJ!=mLi(HAO!M7I6bch!f)B) z#jw>C1&e~BVBN~p$|!T$U}LAzZh99C;LbAsR4uh@_Lcot}4fGgF%tii#Th?nN} zt%9o=HGC6$wHLcw7igH)GY>Z zv?R9-P6`+%mYHcFJ?v@T@swS1Q>)*XGnFU9au1KpvjTqBf?0AC6(CZ2dG_|#lDGJ;JnkpmJ*vaPLByxumKBq7T37ID z(9MAGlsU1!QiQ^$zgOQ4yGN|{7U8QMyxJjX2j=2$>@MF*5JAkT2Le3YoER7(_PU9` z^sn`oRdvR0q(U1dcU};51a>|C9(?r$%Dzr40QtF!umVcYeu(`vJDQrma=lL@oUnRH zB}xNc1tw8@xl%6~_QZhwo);nb9Bs4)cLqt;|4H!G$9WhwvT%ru8nOR}n~@JlIi-3V z(RfVKZ{QS8va4)SgWf?{yF41oGt@r-8OptTN=)BDH#US@pZ~tzo~TQo8c@Ai6fBx{HYY* zZ3;bHah_l3_pFtP1iIZ^-8x|vz%?Q-;cnQ`OD=|t zWIdpa@`lA2?t{ZOr$Pn%4}-dS$~2s?fhk#3Fa01)+3DEZhnk>q*Q&WAe9%SS1%|HY!i5EmE_aAf#zL{?GLa!5OqcR~cW=k^YG)3-o9`5F*2je9`8 zyI`&XsZa~h)_f_T_txvrj5&@D=cA5YOSiQ}HQ_4791m21OMGpI4+a%^hE?wp_Y73) z2sU;uEOJ~~0Gz%23PN1fRelpdjjJTXRs>=R^VaLf6L*D&3eXN z^9ZpODES_D6gE~KP9Bk0vG_~ezG7H7(HCJs1`VtLGw~J-!L~t=E{#JY)kdRtJyCx2 z1Hddq1udAd0$F!o?izcr+s|u*?FIcyBy7?j1=7NBd7ZO$2cwAWzXE&c3T@0D(fz(} zUTDFBeRUiRI*RqDrT9t7ohJ=k z#tF!7Semm0XSAYY+8}e5}+KLF=gY zG-6Yknv^@>83lalNMWvHtc=psvR06u$gIjbSIp>2)iwu(6;G`AVY8%+ZMljX`_0VATt;C zsGR^`=Y8!5Gw$Y9G%~Z_9)SjDZ!|pyXmC2`8Gtq1h|y*O*k-?8ue;sPIQ`y2p5zcB zI`0=H1p(J95xUJMT;_?m>iu1QFei=Uu`HOqLx+x@_Z^!SA<|-f?!c&rsUT< z?^TZ=kZ{FR;mawzczX~2mj}W=0eMypp~<;t7PyZ&FUth3GZ;5JaEX+Bio=OR1>X0o zndiRPdPPm;hoPb9a2y?cllcpQcH5>g0czP2CQ}1FPoP>TKYxc9`A)XRe{gO=81T<- zFBleiGMbvO6Pu zDxBN2SBaK1d8b6KP90nh`1*o@?bojcfSW~8uj`eP?bxnHAcnfW0o2%6v}z6bT>nWP ztM_g51wLvBn|{R6BR)IcGY(_PYHs|1>&lC3 z(@?n!e0~Z*)}n_b{V;4#723tzR<`7&Gp_#2zH_%YrCa(_Qj(!WQ7>h4jD8^R5 z-Y3_m9R(aRmG#u(Cx~q6Lgq2^_(xf2wp>Vw(izO5w4 zGR)yvtk|5aDS~(MT$?`Lw0UM@QLJbqNlMLXV=AoMC%3pObI=o_wv>oo<3N+@r;prU zLd+fY5Qw}af`C|@%W(vOwp|%)87Q<)fCd~m@0cVls@2LhT}u--f>iD8@ZA?p86h*GfU4 zod!RSer5?oNS>D?>Fqu)VJev|0Nk=;9gf3XM^fMk0wp<0Hhl&|?;`1D>%W7Rj#yxB zulx+ZT$t;i)5CRk_{kX`UhBkXcLqZ~w*<0$B!fv>PYmcA_N|Cl9z=f~k?(S>(DWkVjDs74~Pa#_uprhCkwrn@*x z1?!651GouM8t|#W0_FZ9QZ;3=y1mc1`-Ow4YM0e2bN%H|^}_a;zRSe#z&H=~vCVpR zed>NgX5o2(>!u-KrWrdnBTm89D|i}v4MQCW5d5F<3^!}zjh;YBp#}C)PqiU`OU*@j zY=cNR*MC}{zJxEo6ZM#NIe(r{R}8!0S=ghXI0d|kVrg=~`jb$$$=@_{C}=34YE$cb zRMCWl{Zk;uKA*YV`TR&6f_*|A>RdrIwSDgtxa+?u&9H1jVD5vg-76BZ4z1OY`%OK; z16fJR6UlVy~J|V7l@l!W0Shm*$yl{}d1C(Wx<;;%0;KhuM^ z4+NSeK5hK;?OocfRjG7wkl7heY`sxeM}JrEe710u!SWxHU;U3eMUU={G&PcA(*(9} znaUn}$L-WfsFI|ey`y1|bL02pI`N!0RK91?O5GTn`7ToAP>mYo+TXCN>=01E*n_#3 zAx~#aL)@bBzV9Dmw74vS`N~as<(Sn$1jXBF`K_gxi!$ce)gLA?9y`n{Dng))ny=WY zS0Mm~Qy=4Y@B8l)y*C5ctIgCue6RWXB9l~>|3FotK#9N6ZsURHg%9HkOXdeHOA7=t z1^QlWW21_p+@?rQUFBDw`{o^bzvuMbTV<~rR9bBaKpXN@H%G$9&P$Xg4IIK-)7!=ytnVm6Qt`m7H4Xf9kq=u~=1gqg4kT)?quSQ5wmOfe z1ik63eDwHJBvOw)FnK>LRj#i!Q+u99sus;kxm`v-26e+}s}jG`Z!o$KOipZ94i*lC zs};60H=o{yxceZ~^MNA|@-&j`ec8C>_2TNx_274> zQ$ST8W4p0iHk{u(2GPRBs2s@=WHOi{nV>R%Scy^wM9osPP$$Qng@PFmT_Li+l1;F} zK%^f>w6roD=cKfRDKhF~_wb16Ze*qN-Eq`VUr+DdsrfKh9k>?3%QaWqgT%0>xc~^` z73yp~|MkrSd&6wXE9w6sbVO5^zE*yTS+d*;NIaqf=BhE^dOvLmn?$TXgAYjMiA+*f zu>fqu`sNh3PeU<@MZCV?b%wbt0EuzOZ7ae13V^dvyc{5`BlYU!H{k>uK!~lI zY}Ck%hQTDnyfN`9GvC9R9s`V_5`__0EF}fCiW4epH3krI|0U$}K|D1@A0GJhLKkS9 zp?K&@r!djqiT9Im!lliiK@VoRC1TD6-HaqQ8IX19kzU)eAvtV)*xiX=5Bm?U&5=jO zU7{mWqkOk*^D#`4(5meits&lhK(yH`9Th{uk^zZ|MnO#q_+K}jFOfrsaU18p>aC{x z^41Xuudcu<1z4K+TCQ15I+GxiFO*(<%U@6Yghv*?0@}#`UFJ7_R3mjtzFyH*Bs>WG zPZ6U5Rmdc5o|@V9X@Ut6`nLn;@ad1*Cy=>u=u5x%A8pkgf~W_^G>9}-Jr|L1eR>lM zlQjqgZ4qAFH+qDy+7iryNA~b-lwWzh7WVpe%+0?H5z)nf{^k1EH5B#SDOGTz{h5Ea zL0%6L7$w?<|={L+~)kNvX!E zpaQt;A3sw;T$Uc&4;OGy7Z$1?#fW3i#4L7hs&D7^s=Q2re)Lz!8wQFf}na)W$ zM5_A8PJf@OsNI10)tT1xTXcDqkZ}|o<-as$Z6Nt8Z1BayQsWfcmJa3MsQB`%8hX)khke_2Aa?$|(F!J{>>Dsb7JttJ7-j3HsENJkNI1HlI z%&f{BM247BL9W6hezvbyIZvLzI8z5s&7r&0u(<^=>*(qE^2G2g!b3wOFZ1B4#V(}P zYg?u}&%Nq}s@uSeaDl-K6~0h;N`k5Vnd0TEwA;zH8(H7QhOml)NA2ju64xc)`n*SS z-rC1U%DZR2D4j%hjUO7ixFy1VGZL)9Q7_X11UHbJY}>vl&4d+|!usvXz82p8UEs}g zEV${KX!pe1HnEGaFNV3|eV|j0v);3cgfV(|@Irw$kf1S9hD=;npOftc-DLHk${~J5 z@!wWuoBR)k^n`>oq&OqThptY%`X>}ec9tFt`yzdcdEcJ99B4I)afWVIUO3?pI6GXG zfA|=)N2;hvEQ0>G1%yO+zaO?za9ViwP5M&&V+>Wq@Cqk~3^H>_@<;A#!QeeLr9V|6 zNKdea+v(5yZv(V>D75|K~|Fwa#BpKFx5pA<7u$U)>Sp-kPXmO4|ufs3B4~VqSztjdl5K{ z1h;Q;Cc%m$TY;?8$Tv13(}$U#>}g{c*3nwNQ0=7X^-4rMFJo84MnMO!feiI-@c)&o zwA+olC=}Sc1=&cz>R18da7!kIaKdYFNw$213IxM|9TCo^?r0T-xeZuczEU7T1|@*; z;B)g~Iu zJEg<~Fq;dgikw%MEH7w-E`)C_miRkER<74yh~6vDcbyJSuYZ5d5K{a$MIKzQHguUd zwHKUQqAq_TBADPYiq4YP!`wT9giNKc}_?vBT z>v-t}f-r$~!}m6!Mz_6{(mB4BAEYu@om{aeY2=x!oASp%$Q_!jxaI{#=0X>XV>^_t zN+t*%y9sd7!SgN@p-$6E{8(mb~<+NsC14ryJ`S;R5+@dKVLeE|oSa#z5-KPpi z1NiF;Y-T+2S62>BJX(XvxQGJ{+;2tsbIyO-DARs=fBZqZV-zN{u}3jKf3~g`CEOZ{ zV_+5HOJ-zqadr`HWvFN2Ce$|8kMI^v@EYX|@mEfo85$U#6^}A-_h|T7EhW^oe+v^@ zMJoUM;ovX=;mEOQ1`sEN!XH+m#Ir;vA=9V!D_`db!7ED(bAz^z4qZt5h(`rW5>F0c z5AE6{tdlIHb@G+>)(N3x2H{PDks98=ui7Hs`fX zO`xcKP4eJ;ut!KnA5WAQckeeuQHx*8%b5_J8e6u(J%s-K9zobs>FkVk1?yxrmnb!I z#Pt;IlgA9B!baKc6bxvG;l#lI~SwRVG)2s4>=&)CvdL9$Tk4 z3U`f3I@89x4Bg*x(?&nrR~+Yuqx@yXImi>q$nRuiR4fgBo5k)ydg zZNqt38SK~Q*g-sPzBeihJv%3>_wMI6ou4Zs-d|~ptwlp)q z>~0C|IvetR;XFPX#?79tr3c@Js)9P`UlykaI$qxVV|m+I_Y%o8Y*Fmxv0oz?8OF9S zUiz3AQ5<*%U^{5h|q7SE6Jg5{7!Ss0gk#W6WXgSI*AxtJ)E7K}M8@ zIL(9T878}h9E?IygOeuEYuED9!xN8%b=_OL7hanwjG(zwJw;hJ6hzKlG(GQxFq6L}hqJ)|Dd(+2r-*6A-ZK4k?d9B6p;bROw6alId>4Bnrmi@GV1uEd%D9$$HvC!QEw0I z3M0twROL3Rt=$klo$Ub~%kQxDrxcAsP?SScp0jND(d>O(;Qk9`qUH09gbS#zCq;2D zTct#BsZkH2*;uGL{s-K3m{@&v_FJi>)f(w6ew_XGqu2EUt(@iA?$c<>IczOlzl<-MKnNzVgu*Fo<6o?erH9(JKBf+VYN#BI+Z&i4!|&r->oYqu2-M zxnyVAnLl$@RVc2m|4Y$VtDdWDeU7K8Xx;0$sNsC z?tTYb$*Cjc@Z;Jz3zegp6oICYa#O6Xz=Sexv#6qvTEs<9IufrE1dqqk_`>=`SulL% zECz!4k~%`>^R##tsxvJwnj7oLU3$(MI?~#mI&meM`ucRVFAG&WTV2bN=)|f%Myg`Ymz^QZ#` z5#?a@ndMTupnlzSLGshd@!6#c7<2P)pI;AL*T+x32rpgK$x#^d{W-t*kAwD~*lNEC ztPOI!^J$n0izd^TR<{Mb5|hreRFiAIFFCPQai;X&V_%-JPBFf$fK=#F;Df{n! z?#5d_R@<{W^BBnHFh68`BSewS1(}*F(8}d5)8CU7F9R3ZT=w+$Mb2U**eL@c3bP|4 zBiS!fG=r9`vqHuOytMZ_PFo6nea?DrWl2@=tlwZc=^x8NG_|sopKXt4J+1tWme9`f z)C|E!37UluVd7Apx6Z?RUQfCD7BgC6|0%;yi|5zJq!SsY{AZJ48rQ+-rjX{pFVw>ePVE5xUS$vauPIA9C zrr9dEy3x^K2D^u^ZKxdB6O+nS8nA^Zu^EcZ-fWxWD;MX_@O>2GWIG_Af}z;o=*`|( zM-snQ%1;R;YbL*y+&VrQTX^s2KB9>vb;%V)U0|QyA;riXWHOW!&_eCn+|mguCt-it%%MbqzS=zpnFrTD153gbKDg#Uc&1 zqukgn_#zZz`Vw;)0|P_I-rc%ZKXa1SMZ)TQ1)W&Fp-!;?XS@$~bMqor#>3R7%&M@9 zsrok$UZ5q|r?8Y@C~WEWVWFB7E%WeDn%(ZE1|L{lp4lHrqLqgysiMnAoBl6Oxr)X9 aWc*o1U+KvG90%=S*lS?A`=Oq5*#82_+>QbO literal 0 HcmV?d00001