From 41eae6d3f94dd46dff1c9cac50a56e723410bd4f Mon Sep 17 00:00:00 2001 From: Bogdan Gavril Date: Mon, 17 Jun 2024 12:00:59 +0100 Subject: [PATCH 1/3] Update proof-of-possession-tokens.md --- .../advanced/proof-of-possession-tokens.md | 60 +++++++++++-------- 1 file changed, 36 insertions(+), 24 deletions(-) diff --git a/msal-dotnet-articles/advanced/proof-of-possession-tokens.md b/msal-dotnet-articles/advanced/proof-of-possession-tokens.md index 3962915a..9e539ea7 100644 --- a/msal-dotnet-articles/advanced/proof-of-possession-tokens.md +++ b/msal-dotnet-articles/advanced/proof-of-possession-tokens.md @@ -5,28 +5,44 @@ description: Learn how to acquire Proof-of-Possession tokens for public and conf # Proof-of-Possession (PoP) tokens -Bearer tokens are the norm in modern identity flows, however they are vulnerable to being stolen and used to access a protected resource. +Bearer tokens are the norm in modern identity flows, however they are vulnerable to being stolen from token caches and via man in the middle attacks. -Proof-of-Possession (PoP) tokens mitigate this threat via 2 mechanisms: +Proof-of-Possession (PoP) tokens - as described by [RFC 7800](https://tools.ietf.org/html/rfc7800) - mitigate this threat. PoP tokens are bound to the client machine, via a public/private PoP key. The PoP public key is injected into the token by the token issuer (Entra ID), and the client +also signs the token using the private PoP key. A fully formed PoP token has 2 digital signatures - one from the token issuer and one from the client. So the PoP protocol has 2 protections: -- They are bound to the user/machine that wants to access a protected resource, via a public/private key pair -- They are bound to the protected resource itself, i.e. a token that is used to access `GET https://contoso.com/transactions` cannot be used to access `GET https://contoso.com/tranfer/100` +- Protection against token cache compromise - MSAL will not store fully formed PoP tokens in the cache. Instead, it will sign tokens on demand, when the app needs them. An attacker who is able to compromise the token cache will not be able to digitally sign with the PoP private key. +- Protection against man-in-the-middle attacks - A server nonce is added to the protocol. -For more details, see [RFC 7800](https://tools.ietf.org/html/rfc7800). +> [!WARNING] +> The strength of the PoP protocol depends in the strength of the PoP keys. Microsoft recommends using hardware keys - [TPM](https://support.microsoft.com/topic/what-is-tpm-705f241d-025d-4470-80c5-4feeb24fa1ee) where possible. -## Does the protected resource accept PoP tokens? +## PoP Variants -If you make an unauthenticated request to a protected API, it should reply with HTTP 401 Unauthorized response, and with some [WWW-Authenticate](https://developer.mozilla.org/docs/Web/HTTP/Headers/WWW-Authenticate) headers. These headers inform the clients of the available authentication schemes, such as Basic, NTLM, Bearer, and POP. The MSAL family of libraries can help with Bearer and PoP. +There are several PoP protocols and variations, and Microsoft has decided to focus on 2 of them: -Programatically, MSAL.NET offers [a helper API](extract-authentication-parameters.md) for parsing these headers. +- PoP via Signed Http Request (SHR) - see [PoP key distribution](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-pop-key-distribution-07) and [SHR](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-signed-http-request-03) +- PoP via MTLS - see [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705) -## Can my own web api validate PoP tokens? +MTLS is faster and has the advantage of including man-in-the-middle protection at the TLS layer, but it can be difficult to establish MTLS tunnels between the client and the Identity Provider and between the client and the resource. PoP via Signed Http Request (SHR) does not rely on transport protocol changes, however the server nonce must be handled explicitly by the app developer. -Microsoft does not currently offer an out-of-the-box PoP token validation experience, in the same way that it offers a Bearer token validation experience for web apis. A validator exists for Microsoft's own web apis. +All client SDKs - MSAL libraries - support PoP via SHR for public client (desktop apps). For confidential client (web apps, web apis, managed identity), Microsoft is exploring PoP via MTLS. + +## Support for PoP + +Microsoft has enabled PoP via Signed Http Request (SHR) in some of its Web APIs. Microsoft Graph supports PoP tokens - for example if you make an unauthenticated request to https://graph.microsoft.com/v1.0/me/messages, you will get a 401 response with two WWW-Authenticate headers, indicating Bearer and PoP support. + +![image](https://github.com/MicrosoftDocs/microsoft-authentication-library-dotnet/assets/12273384/2b4ec2d4-7d57-411e-ae27-f3c764d5909d) + +### Token validation - could my own web api validate PoP tokens? + +Microsoft does not currently offer an SDK for PoP token validation. A validator exists for Microsoft's own web apis, with plans to open source it. ## Proof-of-Possession for public clients -Proof-of-Possession on public client flows can be achieved with the use of the updated [Windows broker](../acquiring-tokens/desktop-mobile/wam.md) in MSAL 4.52.0 and above. MSAL will use the best available keys which exist on the machine, typically hardware keys (see [TPM](/windows/security/hardware-security/tpm/tpm-fundamentals)). +Proof-of-Possession on public client flows can be achieved with the use of the updated [Windows broker](../acquiring-tokens/desktop-mobile/wam.md) in MSAL 4.52.0 and above. +MSAL Java, MSAL Python and MSAL NodeJS also support it in conjuction with the broker. + +MSAL will use the best available keys which exist on the machine, typically hardware keys (see [TPM](/windows/security/hardware-security/tpm/tpm-fundamentals)). There is no option to "bring your own key". It is possible that a client does not support creating PoP tokens. This is due to the fact that brokers (WAM, Company Portal) are not always present on the device or that the SDK does not implement the protocol on a specific operating system. Currently, PoP tokens are available on Windows 10+ and Windows Server 2019+. Use the API `publicClientApp.IsProofOfPossessionSupportedByClient()` to understand if POP is supported by the client. @@ -75,8 +91,9 @@ var result = await pca.AcquireTokenSilent(new[] { "scope" }, accounts.FirstOrDef ## Proof-of-Possession for confidential clients + > [!NOTE] -> Proof-of-Possession is experimental for confidential clients. +> Proof-of-Possession via Signed Http Request is experimental for confidential clients and will likely be renamed or removed in a future version. Proof-of-Posession via MTLS is being explored. > Example implementation: @@ -112,26 +129,21 @@ result = await cca var authHeader = new AuthenticationHeaderValue(result.TokenType, result.AccessToken); ``` -## How does MSAL manage the keys +### No hardware keys by default + +MSAL.NET experimental API uses in-memory / software keys. An RSA key pair of length 2048 is generated by MSAL and stored in memory which will be cycled every 8 hours. For details, see the implementation in [PoPProviderFactory](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/300fba16bd8096dceba3684311550b4b52a56177/src/client/Microsoft.Identity.Client/AuthScheme/PoP/PoPProviderFactory.cs#L18) and [InMemoryCryptoProvider](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/main/src/client/Microsoft.Identity.Client/AuthScheme/PoP/InMemoryCryptoProvider.cs). -## Bring your own key +### Bring your own key -The PoP feature in MSAL allows users to provide their own key management for additional control over cryptographic operations. The interface is an abstraction over the asymmetric key operations needed by PoP that encapsulates a pair of public and private keys and some typical crypto operations. All symmetric operations use SHA256. +To use a better key, the API allows app developers to provide their own key management. The interface is an abstraction over the asymmetric key operations needed by PoP that encapsulates a pair of public and private keys and some typical crypto operations. All symmetric operations use SHA256. > [!IMPORTANT] > Two properties and the sign method on this interface will be called at different times but MUST return details of the same private / public key pair, i.e. do not change to a different key pair mid way. It is best to make this class immutable. Ideally there should be a single public and private key pair associated with a machine, so that implementers of this interface should consider exposing a singleton. See [IPoPCryptoProvider interface](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/master/src/client/Microsoft.Identity.Client/AuthScheme/PoP/IPoPCryptoProvider.cs), [example RSA key implementation](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/9895855ac4fcf52893fbc2b06ee20ea3eda1549a/tests/Microsoft.Identity.Test.Integration.netfx/HeadlessTests/PoPTests.cs#L503), and [example ECD key implementation](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/9895855ac4fcf52893fbc2b06ee20ea3eda1549a/tests/Microsoft.Identity.Test.Common/Core/Helpers/ECDCertificatePopCryptoProvider.cs#L11). -## How to add more claims / How do I create the Signed HTTP Request (SHR) part of the PoP token myself? +### How to add more claims / How do I create the Signed HTTP Request (SHR) part of the PoP token myself? -If you want to do key management and to create the SHR yourself, see [this example implementation](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/300fba16bd8096dceba3684311550b4b52a56177/tests/Microsoft.Identity.Test.Integration.netfx/HeadlessTests/PoPTests.cs#L286). +To create the SHR yourself, see [this example implementation](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/300fba16bd8096dceba3684311550b4b52a56177/tests/Microsoft.Identity.Test.Integration.netfx/HeadlessTests/PoPTests.cs#L286). -An end to end implementation would need to: -1. [Enable the use of broker](../acquiring-tokens/desktop-mobile/wam.md) -1. Check if the client is capable of creating PoP tokens using `publicClientApp.IsProofOfPossessionSupportedByClient()` -2. Make an unauthenticated call to the service -3. [Parse the WWW-Authenticate headers](extract-authentication-parameters.md) and if PoP is supported, extract the nonce -4. Request PoP tokens using the `AcquireTokenSilent` / `AcquireTokenInteractive` pattern, by adding the `.WithProofOfPossession(nonce, method, requestUri)` modifier -5. Make the request to the protected resource. If the request results in 200 OK, [parse the Authenticate-Info](extract-authentication-parameters.md) header and extract the new `nonce` - it needs to be used at step 4 when requesting a new token. If the request results in a 401 Unauthenticated, observe the error - it may be because of an expired nonce. In that case, repeat steps 3-5. From 170524ae01de51719ed443c2901ee024b23777c8 Mon Sep 17 00:00:00 2001 From: Den <53200638+localden@users.noreply.github.com> Date: Mon, 17 Jun 2024 12:48:41 -0700 Subject: [PATCH 2/3] Doc cleanup --- .../advanced/proof-of-possession-tokens.md | 72 +++++++++--------- .../example-www-authenticate-headers.png | Bin 0 -> 46141 bytes 2 files changed, 34 insertions(+), 38 deletions(-) create mode 100644 msal-dotnet-articles/media/proof-of-possession-tokens/example-www-authenticate-headers.png diff --git a/msal-dotnet-articles/advanced/proof-of-possession-tokens.md b/msal-dotnet-articles/advanced/proof-of-possession-tokens.md index 9e539ea7..55314675 100644 --- a/msal-dotnet-articles/advanced/proof-of-possession-tokens.md +++ b/msal-dotnet-articles/advanced/proof-of-possession-tokens.md @@ -5,48 +5,51 @@ description: Learn how to acquire Proof-of-Possession tokens for public and conf # Proof-of-Possession (PoP) tokens -Bearer tokens are the norm in modern identity flows, however they are vulnerable to being stolen from token caches and via man in the middle attacks. +Bearer tokens are the norm in modern identity flows; however they are vulnerable to being stolen from token caches and via man-in-the-middle (MITM) attacks. -Proof-of-Possession (PoP) tokens - as described by [RFC 7800](https://tools.ietf.org/html/rfc7800) - mitigate this threat. PoP tokens are bound to the client machine, via a public/private PoP key. The PoP public key is injected into the token by the token issuer (Entra ID), and the client -also signs the token using the private PoP key. A fully formed PoP token has 2 digital signatures - one from the token issuer and one from the client. So the PoP protocol has 2 protections: +Proof-of-Possession (PoP) tokens, as described by [RFC 7800](https://tools.ietf.org/html/rfc7800), mitigate this threat. PoP tokens are bound to the client machine, via a public/private PoP key. The PoP public key is injected into the token by the token issuer (Entra ID) and the client +also signs the token using the private PoP key. A fully formed PoP token has two digital signatures - one from the token issuer and one from the client. The PoP protocol has two protections in place: -- Protection against token cache compromise - MSAL will not store fully formed PoP tokens in the cache. Instead, it will sign tokens on demand, when the app needs them. An attacker who is able to compromise the token cache will not be able to digitally sign with the PoP private key. -- Protection against man-in-the-middle attacks - A server nonce is added to the protocol. +- **Protection against token cache compromise**. MSAL will not store fully-formed PoP tokens in the cache. Instead, it will sign tokens on-demand when the app needs them. An attacker who is able to compromise the token cache will not be able to digitally sign with the PoP private key. +- **Protection against man-in-the-middle attacks**. A server nonce is added to the protocol. > [!WARNING] -> The strength of the PoP protocol depends in the strength of the PoP keys. Microsoft recommends using hardware keys - [TPM](https://support.microsoft.com/topic/what-is-tpm-705f241d-025d-4470-80c5-4feeb24fa1ee) where possible. +> The strength of the PoP protocol depends in the strength of the PoP keys. Microsoft recommends using hardware keys via the [Trusted Platform Module (TPM)](https://support.microsoft.com/topic/what-is-tpm-705f241d-025d-4470-80c5-4feeb24fa1ee) where possible. ## PoP Variants -There are several PoP protocols and variations, and Microsoft has decided to focus on 2 of them: +There are several PoP protocols and variations. The Microsoft Entra ID infrastructure currently supports two types: -- PoP via Signed Http Request (SHR) - see [PoP key distribution](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-pop-key-distribution-07) and [SHR](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-signed-http-request-03) -- PoP via MTLS - see [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705) +- **PoP via Signed HTTP Request (SHR)** . See [PoP key distribution](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-pop-key-distribution-07) and [SHR](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-signed-http-request-03) for the detailed specifications. +- **PoP via mutual TLS (mTLS)**. See [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705) for details. -MTLS is faster and has the advantage of including man-in-the-middle protection at the TLS layer, but it can be difficult to establish MTLS tunnels between the client and the Identity Provider and between the client and the resource. PoP via Signed Http Request (SHR) does not rely on transport protocol changes, however the server nonce must be handled explicitly by the app developer. +mTLS is faster and has the advantage of including man-in-the-middle protections at the TLS layer; however, it can be difficult to establish mTLS tunnels between the client and the identity provider and between the client and the resource. -All client SDKs - MSAL libraries - support PoP via SHR for public client (desktop apps). For confidential client (web apps, web apis, managed identity), Microsoft is exploring PoP via MTLS. +PoP via Signed HTTP Request (SHR) does not rely on transport protocol changes; however the server nonce must be handled explicitly by the app developer. All MSAL releases support PoP via SHR for public client (desktop) and confidential client applications. + +For confidential client (web apps, web APIs, and Managed Identity), support for mTLS is currently not available. ## Support for PoP -Microsoft has enabled PoP via Signed Http Request (SHR) in some of its Web APIs. Microsoft Graph supports PoP tokens - for example if you make an unauthenticated request to https://graph.microsoft.com/v1.0/me/messages, you will get a 401 response with two WWW-Authenticate headers, indicating Bearer and PoP support. +Microsoft has enabled PoP via Signed HTTP Request (SHR) in some of its web APIs. Microsoft Graph supports PoP tokens. For example, if you make an unauthenticated request to `https://graph.microsoft.com/v1.0/me/messages` you will get a `HTTP 401` response with two `WWW-Authenticate` headers, indicating bearer and PoP token support. + +:::image type="content" source="../media/proof-of-possession-tokens/example-www-authenticate-headers.png" alt-text="Example of WWW-Authenticate headers in response"::: -![image](https://github.com/MicrosoftDocs/microsoft-authentication-library-dotnet/assets/12273384/2b4ec2d4-7d57-411e-ae27-f3c764d5909d) +## Token validation -### Token validation - could my own web api validate PoP tokens? +Microsoft does not currently offer a public SDK for PoP token validation. -Microsoft does not currently offer an SDK for PoP token validation. A validator exists for Microsoft's own web apis, with plans to open source it. +## Usage -## Proof-of-Possession for public clients +### Public client applications -Proof-of-Possession on public client flows can be achieved with the use of the updated [Windows broker](../acquiring-tokens/desktop-mobile/wam.md) in MSAL 4.52.0 and above. -MSAL Java, MSAL Python and MSAL NodeJS also support it in conjuction with the broker. +PoP on public client flows can be achieved with the use of the [Windows broker](../acquiring-tokens/desktop-mobile/wam.md) (WAM). Other MSAL libraries also support PoP through WAM. -MSAL will use the best available keys which exist on the machine, typically hardware keys (see [TPM](/windows/security/hardware-security/tpm/tpm-fundamentals)). There is no option to "bring your own key". +MSAL will use the best available keys which exist on the machine, typically hardware keys (e.g., [TPM](/windows/security/hardware-security/tpm/tpm-fundamentals)). There is no option to bring your own key. -It is possible that a client does not support creating PoP tokens. This is due to the fact that brokers (WAM, Company Portal) are not always present on the device or that the SDK does not implement the protocol on a specific operating system. Currently, PoP tokens are available on Windows 10+ and Windows Server 2019+. Use the API `publicClientApp.IsProofOfPossessionSupportedByClient()` to understand if POP is supported by the client. +It is possible that a client does not support creating PoP tokens. This is caused by the fact that brokers (such as WAM or Company Portal) are not always present on the device or the SDK does not implement the protocol on a specific operating system. Currently, PoP tokens are available on Windows 10 and above, as well as Windows Server 2019 and above. Use [`IsProofOfPossessionSupportedByClient()`](xref:Microsoft.Identity.Client.PublicClientApplication.IsProofOfPossessionSupportedByClient) to check if PoP is supported by the client. -Example implementation: +#### Example ```csharp // Required for the use of the broker @@ -86,17 +89,14 @@ var result = await pca.AcquireTokenSilent(new[] { "scope" }, accounts.FirstOrDef .WithProofOfPossession(nonce, method, requestUri) .ExecuteAsync() .ConfigureAwait(false); - ``` -## Proof-of-Possession for confidential clients - +### Confidential client applications > [!NOTE] -> Proof-of-Possession via Signed Http Request is experimental for confidential clients and will likely be renamed or removed in a future version. Proof-of-Posession via MTLS is being explored. -> +> Proof-of-Possession via Signed HTTP Request is experimental for confidential clients and will likely be renamed or removed in a future version. Future APIs will rely on PoP via mTLS. -Example implementation: +#### Example ```csharp // The PoP token will be bound to this user / machine and to `GET https://www.contoso.com/tranfers` (the query params are not bound). @@ -129,21 +129,17 @@ result = await cca var authHeader = new AuthenticationHeaderValue(result.TokenType, result.AccessToken); ``` -### No hardware keys by default +#### No hardware keys by default -MSAL.NET experimental API uses in-memory / software keys. +MSAL.NET experimental API uses in-memory/software keys. An RSA key pair of length 2048 is generated by MSAL and stored in memory, cycled every eight hours. For details, see the implementation in [`PoPProviderFactory`](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/300fba16bd8096dceba3684311550b4b52a56177/src/client/Microsoft.Identity.Client/AuthScheme/PoP/PoPProviderFactory.cs#L18) and [`InMemoryCryptoProvider`](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/main/src/client/Microsoft.Identity.Client/AuthScheme/PoP/InMemoryCryptoProvider.cs). -An RSA key pair of length 2048 is generated by MSAL and stored in memory which will be cycled every 8 hours. For details, see the implementation in [PoPProviderFactory](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/300fba16bd8096dceba3684311550b4b52a56177/src/client/Microsoft.Identity.Client/AuthScheme/PoP/PoPProviderFactory.cs#L18) and [InMemoryCryptoProvider](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/main/src/client/Microsoft.Identity.Client/AuthScheme/PoP/InMemoryCryptoProvider.cs). +#### Bring your own key -### Bring your own key - -To use a better key, the API allows app developers to provide their own key management. The interface is an abstraction over the asymmetric key operations needed by PoP that encapsulates a pair of public and private keys and some typical crypto operations. All symmetric operations use SHA256. +To use a better key, the API allows app developers to provide their own managed keys. The interface is an abstraction over the asymmetric key operations needed by PoP that encapsulates a pair of public and private keys and related crypto operations. All symmetric operations use SHA256. > [!IMPORTANT] -> Two properties and the sign method on this interface will be called at different times but MUST return details of the same private / public key pair, i.e. do not change to a different key pair mid way. It is best to make this class immutable. Ideally there should be a single public and private key pair associated with a machine, so that implementers of this interface should consider exposing a singleton. See [IPoPCryptoProvider interface](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/master/src/client/Microsoft.Identity.Client/AuthScheme/PoP/IPoPCryptoProvider.cs), [example RSA key implementation](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/9895855ac4fcf52893fbc2b06ee20ea3eda1549a/tests/Microsoft.Identity.Test.Integration.netfx/HeadlessTests/PoPTests.cs#L503), and [example ECD key implementation](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/9895855ac4fcf52893fbc2b06ee20ea3eda1549a/tests/Microsoft.Identity.Test.Common/Core/Helpers/ECDCertificatePopCryptoProvider.cs#L11). - -### How to add more claims / How do I create the Signed HTTP Request (SHR) part of the PoP token myself? - -To create the SHR yourself, see [this example implementation](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/300fba16bd8096dceba3684311550b4b52a56177/tests/Microsoft.Identity.Test.Integration.netfx/HeadlessTests/PoPTests.cs#L286). +> Two properties and the sign method on this interface will be called at different times but **must** return details of the same private/public key pair. Do not change to a different key pair through the process. It is best to make this class immutable. Ideally there should be a single public and private key pair associated with a machine. Implementers of this interface should consider exposing a singleton. See [`IPoPCryptoProvider`](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/master/src/client/Microsoft.Identity.Client/AuthScheme/PoP/IPoPCryptoProvider.cs), [example RSA key implementation](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/9895855ac4fcf52893fbc2b06ee20ea3eda1549a/tests/Microsoft.Identity.Test.Integration.netfx/HeadlessTests/PoPTests.cs#L503), and [an example ECD key implementation](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/9895855ac4fcf52893fbc2b06ee20ea3eda1549a/tests/Microsoft.Identity.Test.Common/Core/Helpers/ECDCertificatePopCryptoProvider.cs#L11) for reference. +#### Adding more claims or creating the SHR request part of the PoP token +To create the SHR yourself, refer to [the example implementation](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/300fba16bd8096dceba3684311550b4b52a56177/tests/Microsoft.Identity.Test.Integration.netfx/HeadlessTests/PoPTests.cs#L286). diff --git a/msal-dotnet-articles/media/proof-of-possession-tokens/example-www-authenticate-headers.png b/msal-dotnet-articles/media/proof-of-possession-tokens/example-www-authenticate-headers.png new file mode 100644 index 0000000000000000000000000000000000000000..815083b42a81a442e9f69805ccdf07bc867465b6 GIT binary patch literal 46141 zcmdqIbySq!+y6@=Dxsi&v`9%wcL_+BC`f~p#Lyuzq>4&+cMA;CU5a!!L&MN9IK;rf zz`4=S_xpUGXPtG{de-`#^T+u^T=$@J-+SNJwfD8(ulMyuQ(b}Z_M_Vv7#M^~igGV8 zFmQ=5Ffbq7!UI0Z_ImFR{DtZIQsFrUWQckjxWKWNQIo;IsEE9CX@(126F4dAxnf`t z{k-{u+3i?lfq_vqrX(lx>b>!Pi`@X{FZaTw%QglqBE_F4?N2(|13(U=PMKlhVP(?l zpSGepUv>p|ykS+WFtcajF_k1~zfFtNdhee7Gvf8dDDicPPMN;Zq)#1&x4_ea&N)A8_sT=RXz4*BO-H~%P!jar!hKdx0*+Oz-lUxD9S-Nq*h z|Bq{JVW)Th{%Z5Eb!i5%R(%!FrDccvSa{m2`ye?$+6&#W2IwUe^;MgJ{Vm`%J zO}bxW*`JVKM}=Pb{*%b=pb6gEOKC31a;AQ!nW{9sKYm;_>ubHubE2=o!Q^xnOm~?j zg6LsPmAa^sN=@^^#~WHgFD!wA%^SL|jtixXE*&JK&;7O&{cI8m_KG=adicBYI=^U% zi#IF?KkK+036Y$LXb@f;y|;^U(6vnNpt5M8rRik|)51TPd}7O|UexGjn~cKSWm>Kt z#Wty)ZrIG2iwK#kb96kYUyHDclsHZDZSoZi=A;a@L>3RWTaD2{rBEeccj%tXnfwX< zn0#%X3MzCe{RFDsUoF&=bQy4c;`zaK3=I1?|MH0nL{EA7P}gr=HzhYxvhn=DvrUYN zRkH1DHFS{5v3ax^wNnyXCAK1lHxsKN*)Z$51ZJ_GCZ-rF%<%puvK)Y&(sq5(mYJ4L z6BI?g`_VGdx@B^Sf{*I%*BOV1Zd#wxn%}A^2|Su9M)+wtgQ6?!B3@SF%Dl!ZEkDYA z&sIWG?{GIeJ^em$lCHNTetmf~NU9+|n&v*G7t1F$J0NJ!xGX6^wZ)s&WY^ogmUj@} z=Dk~1Cpc~Bs%EXZ8;DQ)E<$7@$wO;=h9qnDwa$Pe-o|8G&8Ny-curvqT!hR zTrDX6>bKD57O7!XTsuS885-{IFXp9+uWnBB^WS{(AQvuNSWspYu;b zAr8<933z){feysgxRukJ9NukJ^z-rPhqNy?%F~{qK_OSe5=cYWE=p_Fp;E%#eCkwO z>^p zPa?&XEV0Cdq4Tc??3QMM__c=#1`ak-*#6@hPrCD4)}ojqaBi`^`w;JK4_-e@^gmDR zolSp-yJ}OIK6TZW(f)qk_h=9#O}0j0v+y?wx3Sw01*s0U=}5Qdizn$kR>B9`RoMYQ z&o?urM5>&7apQ@kE)Vyfvt%v$)=jZ7I)sXBp7f!KI&kS3Z(MvzW1oI%KiF@Te`fL^QaWgU?ctPhJ`mT@5YB>ic#_PpNd; z36CL_5y_3$TMAOPMGRZ<(`RM6Udibecn z&N>sEf<`X+yI8RZXL&o~DLC{$>|Z;PP(Tq8p`_r@6$xgJrp=Uk_bhH=&;#?!l}3K_ zty`5E5^ry~fqRJ1(qf1<$=(fG5+cft+Y90Q_gIx51gSrLMY<2SAy_`HT z;so#aA}55P{#nM2I-tIU90gjhJdxGUjFtNZyK%ZuTKe-Y-u!9zZHns>&aunYd+wDg zc(xiDimr!suxyvOKJszZat1Ic@T+%TwO!OzSL0_^d`&+a6ShgSTct5$Pw!ntvcGto z@10;Vuooiri-J^wXvVsBPw8TP3l556Zt-;y^S& zcS8Co=NMV|w05)wEI)fWIf1{C$AvIX>8&drDO!rZpb6=TxmGfmUf*GK!Ne~boi=P+ znKxh>?; z9PNcn2<`i$;+?VGog zQHq1NI&V1gw~)<=5q<+=OTUJ6%dk1Y)&DoS|LE0V4G(CNO-(E@^O!zfz+ID4d7IKa z;SSghSm?wgPl`3vhW2KD9|c->H!YzLXl^1CHlTjyJ0gQ$mNwl&y|a4^8XL1-J{qQ3 zcyRIS+V^T1UrJb;*5m>@?QywzeVOT*=6`iwg6Neos!wP>6N^buIbjCNh^$)2OZ0`p zT~9(!G@)^fWp_5sXIIhrjPY|hSsdW~T0>I>l2JcS?>+`#%=%Z92Umo8u?-HNt;Z8kK%bL-KKKSm^~Tsp$Lj^~Ac&k7GNrq}v7Se{#YiVJg+l zu8(+v0Yuf4A6-&D^oy63yOq@D>YHP8fgtCkSo~}KTC#k)@-O@O{4VPepnO;A?Ut>V z%?WMer}uox%Rj#K+i8=9rn$x`*=!rT#mG)S9X4#SE?d*ob18!|O}9Sx&b7m}>8gAV zX*m~5P}=^*`x^`ytQQ&#zF2L^;vYx38gVUr-pME+fKkm6Du&wSrj7Z!tm8?#O7^iN z;zu!`d;$Fc7yHIrakRni!6!xB*cOTBQ|)}BH`tR;;z7nPD6)NpZ$cvH1?zqBM(41x zuPB_Jr+tl|UbQyx7J*q62DI0geGit!dUNlrCr{zmn}~i+%b_;4VJBLd_D4_8DRP&b z1Qb4O+OIXB>V?htz+2|x*|LySF2p1YQs=N(U3B~HrM6uoxUFs$y7}e4NKT7*_DZYX zL2+QUVl1fd>qO=KU_>F@hB`D;$m!?;s0m^<)Q&15!KG*!${p-doaW68pA`1;W|wuP zTX4op7>m^Gyx+xsNzO7*VEHtOOBr{MhtEe&A9tKIw}oAlHytzrJC@DWA{=defgC0r z|5h0bSCB%DdeqpM_*LI=zie2mdu%r*ORK-4wx_6P=XpgtE4=&-Iu<5wwa&g7mqTK19AAKD*lp5<$Z-X(^pfDXdSyF zT*0p_qchKEU$<_`|Eyc^nEQ&(r~b{xK3%Eyt?OZzca$J6`gf#%^A7rn;m^JyVWMb! zcI@60cjZYj?kC`)%==<98kbhnpt>h$RP<1rQ88iLAoNyzxw)0Z^6YpoXt zcH?HHF~(tR!FoIGH5F2axfsVG^3DGI)4DE)60IicLLz4n?(jJINm826mCVG5mr{jl zGkp*1PBlGzX*K;PV*MGU_!n6kTSK>u}dXrgk~hBW60x zQ5xh`&YYc;XV#_=9?l_-dJ$In(1MJIiqdQsP(q>rC{XwXQ{%d-aKt z=R%DO5u_EhQ;d`&l-d7Dl=g-k7H+?FFPvJkh?bY3EYd>L`Xf##p7+2m?R-Jcg9=-`aKIhl8 zo9oof{N(r3SA3_R39XMS>7Q^;Nk|m#BAf{W>sc|dd~WH6cj;Kw3e&kyXt5h)HAE7XG+Q;WEFART ztLu82^dPaWaGfrdzbF|`pXXiAS6;a{E-6njrYq25h?_DoKFwAMyVG@wU^#wk5f;x2PV zO<7#`_P8VXBMhH#okw!?E*nwXM;`Y&%b$HIz z*h*^DA!wiL@GeGlQ4Jtb{rM>GbT-6n(^F8MlF}^Sk7V`V~w4W*J;gkbFJ#B1PFe=K~kPl zICGqkr+RSQu0j?E+jeiY)ZGwPA60U#3I3?(o0XlnKVzBuj;}W5WgEq_`*Gn}TH6X* zQ^6X1owZ*WBniEqL9+dEe184=&4#9kV4jCrYG1IoLU> z+(^tq3fNl8gs?K3b65R!abbpSI1RG*O@9E}Gr@j|(ug&Jcj9l>nOUjePiGt5cfTz^ z)-ZSYmtt|-rM=7kJ=s9OpiVsRdmzZ?PIc+j2AjZiLTaoN$*== zyI}8B4NEp5GQK5|!>hg?%0(YZ8wtB;)C#f7LS09*=)_-9Js-3nrf7Q85HzHKPt_II z!QuXf*=T6f3RmpMS3BmHl@iAnTqEQ<&tZOf*}F}*WK@C@1x(97%`~4Vf@q@ro2@>l zy@`LmWbsx(^f!$TLW3OB-JrZ^(OEZ;2uqp?1+`1AEu8?8FwTDJ@tm*fLnf6jE**vZ zz(fXABQ2PI$9<=`uoiU=j7I~vUApAQdsbRK4aq^0Ic8h%Bh%LsGRyUqPC7o%;&{3^ zQ1bg}rh26{YP}~56MlK2bP11y^Ezf1RZPRT#BoFMQrbkiJq=0gu(17eg>eqHN`3Zg zrj?(??01*?snn4SyJ(OL6UK$N>)z#X@x8uS%0yu%F{HcDz6lJ`J{rEh9M)d<1`bz+ zI(y-`pwrN{v(Q+L@$Vl|{U%o~M8crpB@gteh#}UD&+L+vqlb>QxfJSydk1c=2?S4ozU26S?l0)AiQ^c&PVr9l-<30|>$S?U5+@uL{)B~qx-S)-}c|ZR_0`70~umtj=stOA|4k^OT|GE^$AMYAyImEV4flVDF{6X z>fXj~_>Q)We#W)Z%y2z+Z;7(X-eo^oa^-_t=wP$kHal)I-_5)m+@b)>Ae@3tUkW{?UFi5H-yTl<*tS;OkIc{e`-o)qc zOotDDFA}7SmG6l`A*91R=?Xj?Xu+K4(*1{+JqGaR-P;zt1)Dnh2|eMP4Z_j~jb2HU zwI_jT%3`dh4}n0}+Xv?r_?P1{oog+*F~O2rUk(u~?!R#ey%@s|dG)zROzX-mp3dJj z0{+fWUX+nSEQ74V;>{-wy?=3W&h{ON&BkQ|+5@+x8^BpCXyK#OuWiCr4Tf^lW z(5>cqeFU~e5mMbnLLCFH$=_8f^A z)A4PIuv44{S9Ma`G1Mw~oACK5jY68oH1e3VOd7^#*`v1A*s8(+(y4!IvbytPteq?R z6D4=*G@bXRuE2#3p;1A_TYQS@}0TlCP=VXkb$iI90~C1<-#Slf_xMi zcWjk2(M5rNJf~@#TSYtCp+O4JPfQ0-(onx6g4%i?~V&r&}1xqf;AU$46n z=4{382>y9?mGDv@aftEyf?}M-e7>#;dPmnF^M$*@L5~zlZ}duuSeaeFkr`&RwBFt- zdA1z9FZbeHTZmbO$A9ku>4%~aKrXbuIE>fjvL`Ddl_7yDouHfAE}9l6-`BW!9}NoW z=BxRCZKF1*ya@Be32m~^X5H3@I8;-vN33n>OSe=jb3jE9*)5iVZEy3WYx_BGR zjebB_;FW1%wC8HoEzcFpQd+&1`f3b|fuY60Z(UjmvmTx7#DLEDd*$rr9 zug~Ybn>|%K`QtLR@=%&BJ{G2yY+Zr>9Mh0<@9C(ul&v(fJB@Up#6RHjb2iEM*vt3N zWYRvHj2V+nBud`yOB~+j?lM=&8St3v$XE`%bh;Q$K|1Jp4~*VO*t>Vr?5M}RXkSrQ zWtcq=;2T!XsBkkxe^Rm$O@^Z!v`XbOx;XCaBJD{AHbMjmEK1!+yk|*-&DV7wsq(A^ zh7s`IuTEilZ=DdD>whD+CsSrnROPg7Y*+GFu`~;Xz7}YRe`vJCc^k#!wc&wHSv9H` zDp^ChoF3Is)|g6zHHcG<@_3naZYof0d}1~wW$gS%hp!6#S<70>v~Joz0BPQNdyk!H z`u5Iqv8qA!Sb@n%B?N~7^hQxPqBK_eS#sCq@KMy@_itnW676r>7qn;B+80PEw>Nb) ze;mIVsL2210b7~>q5uEC%>({VqX^1)Ko75&t+ed#b6x@?)mrrif03Isy9}Cz&`gN~ zhvZnt#T8&3wo@1X-5I|-B(j;dQC7E@;(I}47tMl<`2=Cyr#4Rj&3eT|AeOIR`u#;E zNrPYhP?Q(J(&M1Ig(>mV8S}x@{kc?tNYseHn~w^xbaArIu9B@YY_8j2F)Asbx!SVZ zhWFa%8r|(&4;nThhIf1;0-I}kVtwipn;RmU>HN-Cirb+{mIk5X{}7iZ!9O^K5;w>J zrxen-^UVqv0%$nhxr=iDYfGv_qYcyH3)3Ay%C&{muYSG33h##RC5de$nWq>yG~}c2 zdd@p5xZWHnmN2JXhHq5*MPguFPQ!ZE>606{Fg3~p;8+{qJ~#7!ds{o{L$>GNL*W^K zuylHaO)Ne_{f~AG^}`F&EzI=uZVHN6CdY&Ts&|`2Vf#ZT;%!onU|>{s4I$!>4S{0% zqS~wDKL^$IC-`!uO~WU>dA9HXq0Z#ux}?0d@qXG`y7#twvpM`^+QiY=Ydv1DT|O(+ z_1?jXaqU#hls>FiU_MtIXId)(kb`T{;#RX$k2UJIazaz69O|>tsn;iUe zqVK%eZ@a$Q|5o3#5<(|=zDsk~q2h-i5+^sW^v|V#f#6(}GWEaPrKFsE?5DAWs{7J4ZimG$x8zwgJ4yM!kyH$KKm3&m}{Bfy^ zc}*&7nXd}mC{%pS2LsnKizAw+zxJWmKRC?;^d~L(Za4FB*QM(Q3hPu$V5W1X*e-OEy%#< zP{?=R&cwi-&WRX_pxKf{dxaC66JmP* z4x8Px7o-dD^8prLe#e%RDOi}&tbHpVNG%n9yLIm+R*2MD2XP8xq0R~y}jzWi`j=%X**VFQZ>~8ZA%yMFv|zC#Fo7u5dHl~tYr|7_w0t* zikjJw6znz`JxFV`6glqk=Tp7fjHeV0p?yruOpsaz_vp2r?f7w$<63?GB9m+kaszBL zfb;0a4I4aN@LcK@vir#kn)bGu1>07A*EMSlG(fw>_PNs^F}2h5?&72fL~w1S*)!?=$~|Zo6WB4Ii3i0 z4d7uvs5QVByqwV17$kBL2ushhxdx;492wPsY9$l}?pO6`7&Mdz1+gy(^Ei{5swg96jl+X(=e zXMtY#dfJm^{f>wY?|6Y6AMroV2+_Or?`2Bl2Y`lw0Bv@xL7f8#ln23;?DlpgMm{Em z`0Q15>r+MJ5uabx&N1G-zFO$fgTp`=q2uTVEU#yt;ov&{I=*9t{kb%GyT<*4A z*iKqB|7f$VN0 z5cSjhtGPVwQ{^EKMvp3u(fKEjO;**2C5|;+e?8DG4a3C2-X5=;cTu^Zq+lch>gZFk zW&MK=Jg2s0T2yS;yB*KT*Sa<6kIex|4`pPBO0Epssy(SIsbes*Z$Eic+&!fm0pMW& zXH|GRk3_WJRaU%6nr?o?LdW4T#q8? zPMh8%k>l$ch`g9^LhVhwc#Nc9J^V>L%%zNlYcM2reR<=RVCIMshDFJy0EF7j#mZVU z>h*8^`WJNcpEDqFo3vPAIJkkpp5AWu!EQAu3^-Tk;}Y>4|3iyk#pFk}ou{_V(r$l~ zfUHZ_iXN#;1cf%6YdA^46=0uV1lv&>9yA{fbs#4ok1Pc8GJI|BtI+cl5HwHoBs!E5 z`yXY<_4RiwHTWoo!iC4Yzq}_@Kp87ZY9r~;TM8iBMlOeY2TwJ&X+nI-$JaC$W4tc8 z`q~Pv;51zFq^VKPx4X=BDE=(;L&qG+Ihj?VJ+`M z#Sh}bJwh!SmSg8$yZtk+@D^n4+LLZ%+ci2~>GiZ{O{eJA=Q)=%F&5I^1o-5Tb%vMK z#bMO763c>dT&)61Vq!~Gx9O-2Dw3E$bTEB3o{#;MZ!Vt}*kLw4Ge*2QH(poV<*6p( zxlZyVoTu7-Jm#_HUu(J=Tx|c;Gj5h6%XNzZ)zevid~6K*b+6wrhG$z75@Q@q8*-ov zZD^FE?6#ZGY4B;(kEK6#(GbRQ+SVS zL^Qd_qOZ2~57dq{XMa(+mli7wu+&;ZBy%hZQBa*uU*WN4RuwLPN!JYciKjza*j6J1 zahHMIUTH3fu{H!2vr%@cm3r8=*XgyHK3$+~%e@}!$NiELSQ%c_C(5o*3(QlMZ>A(A zM7&zG$*=+I*%VHuU()G%1C^gtV&q88HnLbf4;%@<*vlH*8gHX6_LYCyRu0~`i*>Xr zgt2RxUI}zIuU`4=AOs@Lo1& z9jP3oVHeVr!tHyx&tX&pbq68_mP z!n>WN0~4Nck%Fe@9B%6hKKCr-$gj>buN%+@yC&D(?2-KMZNl_2O$)zci__rQuLF8^ z6K|6977bOgc@(2s`5oqIRly$FA>tu&!MKjhqXuL^6h3y*BFhgMQ9xm0DMBZ%j9Hc6nvh>ExV_WMo@+WU;$`pe@eX7^hKQzQ%iM=x&Q;;KM}>B#moI215<@~R zHT0cTZZDYtCHml6q|~Bcp(nX~h+okV3@VZ1!p2F2zy%F%jbmQkueErb7^^N?+!8UI zkFh@@`ivpaa4|H1CpoxT+2B);So+;O1^YV5!;7s@TXu`jRmxXAxlhddMhbP$?wO#* z5_OJm>#g~8`l(-s!Vek1%#XotWqvt^6M=A*C@B!_(MEfu^3qZYl$}WD!Sd3i=6IWn z(^9Di$48VV_aL?#9GF{?h8&ws>@&|eZFG^2`j(|{9cc)vs@)@pZtMZkBI!qaraP@H znZZP&MUx_sl~yjJHRGULJdTitE7We`o_l61ake05AIW-QrF)H@iO=BM{#WW_W(aR! zi>WJFVHMhJ>Pj@s%o*Iq&*Go($SD}amH7y~Ylr+yP2vM|JHF(|P+gp)Agr>VD|P;a zsA>uTXh9IB;j#LtD(xDSvUe3qIy#0h(lX`O3kGtmr(5qtrSg5Ze0|Fqrz2O!F(f~_ zg;&Pt9P^FjNBY7T_YITaQI57OY#RF%7-7~+7mG-!oigzK{H{32_Atv+N?n!3$Qhwkyt63NT+Xj*4NsCW=j#5Vi-h8WKEXIFwNb?l(1#s0n@ zHx?U&4a+fUAK6M3D)No~GRfHTqmCP(T2_|#RKpx=+KCg1L4$)ECiVRX67D_S1by%h zI;ARWX5ZkL;A2bAIrfBtIWQ-{Cdx(iRuTFNC{}K&fvj2ruPbkorir%hmt=u z{1CCAXFQL*!fs*fHAko?Ui?mxtj|z-h~!(oJ@!PH00+-}wilU8hkiG=fbG*6!{XTx^U6Qp@gUeJP=L%ph~!pIO$p zyy4O1d}?0F)i5{hZjuJsxCYc6cNhUmeA&cr<&Mc4o3^ylWQy)DEYnvjbXR5mC)}pOH^EJ!<4=5~-t|i!Y5jPrrcU#iK-c6EeBF zCXlVwfLh;)e5ECbMWE`pHZMI)!D4FWY-QxT2K5eKNCDS=dg_m;Tj z*`Br3+?7Q2U^3M&gsEfTRZeBBq#r(7Dt-argcCP$EPEW!t69K$qARof$D^*(_7wla1!hcj?+n7AAWVaE(!w+y@<9Zcl zQwv4_IPnpdGiwU{cXIZjr!xP=hKX|v05%*F@9Av7p8i!J znuaymjitAS%DUxGE1>cS6@ub9Q^;;*w5~|^72M9a_0-Y+9_i*g4cAU-9Mf{=C*zzr zRG52W>jhWPl-Ry^#xK1_AutwvtB2{udf`udu)7<{!ZPIXUs@H*dV`b{y5DjhlS(l! zyhucSt%})skjE>h@tsNdss_fK|NNAxO#3z{ot>^xBLK%p##%A*(gmblvIa(%biVOW zb?@2s`{1FZD>Kpe+_FmrYUOgE)3RqMx=$k{sh55j|djd|JI-V3iT6Iq3Mpw?@NxjGeN82XH?=ouwP$jKK6FbD{oIfv-K<8dH0ENvdvDJBcx&>^Q9?0d5yIyN+NK8JxgDeg% z)_OpZx=yRp{X348w$z0*F5D#0%0TWe7vfdu7VkC}RnT|X;M34I%phlDvYj|1ZcOzk^GtlfnKlTdbcLzT($)?*&06K2U1qM50L zSY6PEAvEn%Zn)!T5%DBANv^Rkb-p}fi-jl4wyF^dNKSbd))EyDOUbEM1F%pA6Yadv#=_38)sI_bs$zZb zuk02##@HJCF8UqSn_dxo3#E3OQI40^hj-q$Y53xkgq302Wg|lmrTEYLwhJOCzU!6C z&3-rf+&cUuCS=6`MelN5>P_J{HL+FuV0ZljPWGF^mgC!Cw}n5YLvs}Zq_i#Uih5vAB%(e7LLvF`L$nJ1&)^KcAxYCQWxnOI5eee zLrjb8WC(259^Lv}04RL+hTmI+t+r38D9l4;>Fz>gK?%#WI;q_Eb+mbn<0BYKIJ-a9 zDrKH-bk$X?SF@&@alCcuoJvnYTK*_?H(+lWme3oD&whAG%^V}LFu~L1V&8q^5CPYmCc$P)f=KTgyH#!lFpFL9Rr(-tQ+8K?rOIl_oFlBOO=lP zGUNE^aSa(t*1^t<(8xU&GC9QkP)4^!1z2f#L3+g+?(s7JHS=C4@fTyi9VsO-&_)34 zMFf5)-J@To@$9K3-bpj)NPvvIGzjZ0tt}(Q%8T+ruHD#7j%Iv#UOWoTdeWBW7q-oA zhCSx1EwQrfIP^PRbJjxPyVp$X#D=p5N z^`VeePUf}9Lig|+Qmya~#iaENYJMDb%SVS{QIap>=xK{uImmTn5v_6wN`(LemeuRI zV@~aVGlv)#eIM8Ui(9!*r4Be-N=^&bdKBItqh7Xo8H`2&F+zqi;ESdJ+B zcSIt!dFnZN4+91tD}Hc&ka=oma>itQRTvg_XOz~)5^5FDc-UX@sL*A3;)MdP$RU~7 zWBdJNob0kyQZJRAGo~@n>zb4#7DXG?hnFKy(RDk3mO@4zjEpW zD%9k1RrvyIJBoJuF(30cXzPIcRxtJ9t);c^o-MANL4=P@+u0r8UTymnE1%w8Q1k!g ztTW~vLFnF&UqJNRD5km_kYgmz;|g`uZS-x~_b5i{-U<0CLmtG1NG4ZdvWXb&exqtk zfLIs{o^{Ox9xp^{8K+rWhV8us;C_FC`$;i`ccjqlAIghN*n3sh`Vx}z+wn8;GmVk2 zJ}&TP6$WsYDw}{L;mM073PwxEQQ58$ev-Z#aK|o}EohE}zjeH;+FcpIz1R}rjVZj5 zE#!Hln}x)de`qfgnu2tl3M}Fq@JeHgZXy~kZ5ir;)54@f=57dPh|s+p23I(`q5;K% z6z=k7gv^G;wEMnAEoJvI4Q7-7MV-H$?!CuxJse2b2ytK@=J2g;MtiIu2BGMcPaLJkk|Wb#wM_e~YhOo`iW6BvMGg^uGBTwi zUhVv7C=pPp9Ddav^?L}rdz(BA<|dX9{3%A1e6~@GkRvl46|-`3psZWH2#AWO{wXP9 z*1vws#mJ4-j>5p2LYMW20gzH;@Ns*=K<`WUugjThllgWnpsH6UZIi9`%ufYX3cWwGcR_byh)X+QprbxHa

XJD-;t&;euFHyn>FpVe|S?U7CF*bSZub>bJ%u&8`z zWvMk6e}&g2hN4;hLVfru7i^qy+QNpb|{4Z|K!G9SmN> zw!}Do_qf+AJ|ud6UH4unV1t7?ISf zonWHj4!p>L9HJe>W@34w=p3%~jutspB1LYHi

Q6G2g)dJs=4uG(tX?YD>Y6x}J4 ztPOsA9)1GP^sItTx1R4WUG2Xvc~?Yd(4{>0?FJ^shCH}v_IQjxH!V@S@drQw4`csGP<#2AP{#^b zc`?Tx_#nyhe>Q(9Tmv8fL1H&Q{!cf5{qNAj|GMvNplJU6TKHfBr-4qy4VOR++H$p? zt;X9CiS2#g0F?DK-y@>(mQ(#3E&(z0{5OA?^8~0+!zUK9hVm8fi9;(K;060Q2!X?*Z=5cdcFJ=V{xj?AQb>o zp6mL{u6JPosRL>S*q}QM4XCjixKsa)C)WJsgsdcPjHd2@I4p281fPR2zM*%zdkb#k zYV3hRSla(mnE8R6Qt*jrpTFUG^Dh0I`_@3CnOI6Nv1C1(s6N3b0}$;`{eW==`V5Kg zmI`vyJN7vt7d*>x7Q49q17rUCwuab28ux;Xe36$&!*!W-fF8dQB}-&OByl`)%16>H z3Xp=i2W~iRx11LIuhIJ=xU~U3ikYUA0KYTrmw??{NdZ*&!ofTLIVhfgcs7<@=~SqU z&kRb~mEwTNy}$W~ zjs5`8+{C=oPs07B%ks8=L36ynHwiaF`H zU3eQKvcw>%OrUpfU*Pg<1%1FTZghq(qIVD=sdKcKgAEk(W88GHc))ATQ-T7o^-VD`p5w|{LkVSKX@QkV;p|Lqm# zLjWC{0(7X65U6P%FBba^%=eLF{rQC@V+Mf4`4a!-$uS5STV9680SjTd+C>+YV;a!8 z3rVcnl^v6&UQS=LMM0)}Q-VocvhJC|)%!rsq5%ImjpWP9TFl22Z7L&_$0LwO-~&mXSBplLWD}f;%t+1F zmwqv?Fa2m+Nas^`9qm3^B-I*-yYN0;D714$ggQwslFvP3VT5pRMTGLf7-j}MqS=bENrV(c;UnXA2(`GL8l+f@k6p$q6sOzL5AxGR@RzeL9kWhqt*b;D zda0~yLV2zk_V3uFZuFI0s#LzZ%7?3Xle(7_5Ix`ibs_(a-Dp2^yu>gis!4DXyJ(Vf zGVth|4;%dbK1q)1T6C*xL7Wn2zD&Y+5M*Rm27yJYhx^}NJDOu zz;u3*s!jSUT_B$uHIvOR*o^-8Ly`z@54HcZQPs`1f_;Ey!r|)8^HR*VPe5|jHJopx zrcRsqx7;w*8-`4qXyWI!%Wvp5Dj!<~zu8lSfUZf4BVbP>c4>7AijcZGi?7^Wz68ur zv)jkRSe6%^ERv(tt^+)SH{K}#3eyhW5Y-z@b<;`A(_kxb!(%TNwhJ>Cjk#eT@+-eC zi_{cZ@Mv+|mK<{>J3F6($UneuB3#nC!HKsns?^ixr0ei_mm|9%*I6~rdX2S+Z*~-Rujp$Te46UMg1qx#QRe)-^Q=3- zbb_ZmO3-V8Mn5FinJ>5Kx3~2X+07#98vPwIbdl!w@7kC^s8+=W-fAm@zcw!ds=r`) zGolaH=UKm9kScm1zHU08o=psNO_#+BcqwKy)UHxXeu7Lo15TH^b+z3u#7@AJK@7Vo zoB)PzG3Wky2m|yUK-1N&x~2c;+)~Nv{)aS$l;~;Gdw}xckC% z-S@Y(Oy+>CU$zXy`TKOvQ3zn!{V;9X*3Cxhzj;g*H&Gl%`W5>tHV+OpHI|Jq%kM8w zyp|^lNI~rlK0wbxiqz##DSN3+Y7@29T-OidAJ@WTtxxf-d}cS4Rn$G!)ewpE7?ECx`~#QXUKGB^#f zo}vwgcrikxJkX3vxuRX6*5BbfmFsS|Xx3fTyYjA=gNX&XThHFQ&RQm_4Q-6G1ukN5 zE4<50x#-3-GKjQ5Z%t(>75ow+vdvn%lIW4x+obq2HF$wK1)_vZ+G`cu=w+y z$0>+D1gQ{iajy3+1n-Ni$7!cTg7?e^0d$g?&N0@CQ%4XK$Lx)jj35u4($@z* z!_4=i?A=xsC2}UT)W9|}j8tnl{BfsbzmH>W)%z`nm_Q`g2~ViME;dNvkjhB0`(sLN zuKJcHIhgpB@Gz38;qMM+FAY1(D_OZI^#tj4ZhvwQWUK~^e5K;iozZ44iGY+jG-&Lz zKdJ6SaDNiUwu#p*=05*14V1P4{h~}RtS@XR?4qS3oEj&#si@T2b3b{9dixor#q-V& zPvuX3Vse$;r^xl2@0Np12-*>xJXg0F0jZ8?K?|O&jdfQ1G54jvnO2{9NVuLo{2di= z-DH}RY#`Cho_iH@sxm9=#+2?mCEYj^$q;)XsTeESi4zm@FrVNVd#%Ub%&7V+kvHjY zg0lEdGHRs41{EX`(XY)1-wg0F69!I7%Vtq;8LEi@5!^N;xc64^VrW(DZUtM_X)&?| z4jyC(p?*0*fRz%)ew&NnLn^d?cot`+ z)!pYIwtC0)_3yeWwX1es(uE$wS=mwgh*T6*z4545!>*3)k@)kkF|i$^ zcLzVC%f|h#!gl(jM&oJcJdG{DX-)`Js(`Gu&IhP2^0e?fUTvhcT4O~pK4ZTN0~&%I zcUhhObm6!t=5h$Xr76~i+>KFt8hMLUiF$B?&GNCdBo4*fMgjLk^Pr;uj;1utgYa15 zw9_=%*eUsS_4G?J<^ku6h`yyd7sijiY~%(NuCWxQMj5j8jTFN#yX5*Y#t-h?vDbazS`6+ru^SI}y=PWR!zakoaSS(&DEOTX#4>XNW z`sGFMD4V3d9p7>+{q|Kf*nz&BA@=Aqioxb?zQwh93XZEX>GD{Tc95h}3eeiU{wjm5 zr>Z=h(a1YaC6r!|+O8`=^dwyADNALf=8J7T^3ow1gmmC8tH!~~t3JR~3f%*YMuS%u za48YKFz6}Gju^)F6f{onf~*{ewf8H6EzIBpa_I?ZN5q@}rL}R@1@Sg*B zlGf-&-LV5v8p9$dIld#_@-f<@G^w3UEj{$cc)IXaUevJLN6P8POb!XYB=s$Xl|a&% zMGR{XU+Z+iu{s@M+JfIRZ+$n&j`H(~BAWs^q2Wis_b$nV+Vo zXsVxM>Aj2?Q-0JppiCjMQZvLF%h(ey_5=3i*s0Naoen^fPz;AEOUMno?A7DXI$K6pfTi|Y7ZzR{S!j{Zsge5+4-GHBqhhp?%4H+Gtw*>THc288w72 zc^EhaaUz=Q=_3ZUg46~EzG;19?! zG?I)=8a~>s*Y$-ARm&U|SHc{ng>7Ra_H=D5DQ>TbId{wa+tQA?Y;C)T79aEI)t1s- zR%NNiE`lt&EbDxp3LNjimcEv84NW}M3w8CHyEaSuOAIf~wKw*)E7=i&AE1KBKC-Oz z@c{O7ZK4ig>GPW4EIAXOY?kBhlm{oWZl4-$+<8vAA)U*+z-eb8K}u4N9t2ryvJ4BY zdR9G5IJ(C5Y3DvV0)GHjg8ylTX^#{X-l8ApUs!7%wv#jAv4v^=Vpy}q;?@?BunJ=4wLF2mgDm)a;@8bAAA2d- z&0rt2r^aFjY63j{{x9m@GAhdNjo+091x7@=K}sa0ySovP7(nTUVE~CCRYV$w9=at| zN28Kph6aJ5WT^jxet$2{d3D~Ma~AJdtXaUG{mkC?=f18RcGhq05eWkGFqL~s z3Nlrah~9(2hzSMILk;ERN6(IwdDt~an4a6P*W9y#s968RJMzAFFgqOLr?aYO-CgRm zN_R|e^l4n9H=|Ql)-&-$C3us zyFL4~XSK-P8;CZCw01LI0%bkCcIwbG#EHV9Z9k6gWNPzhtL>3-7boKsmwR8tmGW0g zX9@BBRLHBb(I;LXdt!wq8h zD0gM5@=#hg_=N`f>}cyB&(W?LQj*4TomPdQ*L-#9oc zt}Y$FTGO84_7LeNs9K5?cZdO!9+{E=5++qh`IZb^9fDmt!DJB%bwAiDNUbT+ z@V_`VYAthzto(eG|Jb~PXHN0VrxUW#gGc>CdiM^R0W#oXqz*bWI2k(+SCM2)0l7b^ zbKxhzYBBpA(@D@bktgf}0(3w$7s6XQbSTCbeT~5fG1hLfhnd6mAhaf|G9h4hU*82| zX=f$#+6+n*^zuUPv}ssm>0(W6+Si6MJDQhTvbDtTqp+U(zY3Zm%iWH?62YHDUg>pO zx%_Px=y#kK^su&gDUf;eH_eiavPMYE#77NN9cVbct&LizJF(LC(95ve;LB}m&zzWf zQK8oLMd&e+uPwVudQtiv^;PCu?J?Kqjl%vN%4w-I;(H|&w28U{=h&m*@)mD2qR7v} zAUext!CXL?TJJ2=u0XC~D8QYuI4;&9)%)cwR&qsZTVFV4wvdxO3o&TquvKFWtvC9e zW4KM$_Xd#}wr0}E?7tOxH8`H|fxP0YN!ZunAr&s1%9Sx=tyq>=_Cx$>T=IdBOZSHhE%<8Cvks;vd>t%MQl zKUmE1e@2{nyMC|`@A`-Y&UZg*emPH*-UghSbnqOgR+lPvQITo-a|Qhuaf8JnO$XI? zwi0xb!Kl!oW4r=}n~HVa6Y3XcO~M>7J>A~Jb{vr9aeU2-&azW)EzRHM3n8kRNAWen za`aLpBM>()YA@Uj=qf_Bb;Zg6a?h8+o;{Amx0}cT{f*qc@5i_rf(cPgXwN%IqL$hF zyw{)xEMr6`ud|w5s6ms0Fx<(LK6m*+G1fXQ#!duud!DUs z{-pihd}Ix2fhefARJBWl+yQN0NO}B)CyXbc?1X#QF~%;omr7sPEp9P10Jy!x-$PN8 zV~h|x_ss>_*QQLE(J$Nz-gQK1uN=B=2Bz3_0X}{Tl=E~l zKk0>!+3@g5jx0zXi&)+qyh$^cg;jzw*U#5!AnVCEkGpN@I`XzqbmhP=BCl zzdpUbTBbhtLpr`H9_j#hzy9ay!A@YV&fg1fhq6-{rYxAx%jBkL^X zEQGUy53CgX9)l*bZ%L;V3gYN0^~gY%E#0Uv5~8L2;+3gXbv1rG4RV)u8~iAUo^x%* z)uPxlh6s~*l7)yxJaSjYKl|UGRG}*xyuGWqX9w@q#cIUjZS>!uzbC+xK8X%=F5g%p zC=(IeMYyk~xofd41s%1&IW*)8A1SGW(L6G-#eDT&cHU#|+NwHN{gnExL4xK91`LibG)zI*NgWBF59WHIP(r+U2&DMHTnofy4GN%1SLvjfTckU zqsqH`Tnw&qcAjweR5cc9Z&1Jla`L>G`Q0=3vfitc_TZf{m&yK3CF-7_m{){5DQt)v zabI9K0wt*BX|z89tV>^X^X19h+%T$_SvPl-yPL*lgx-~vGN~^4s!({fz>=&c(i1TC z{NP-Ga6oyBby<(wdle{qa9y@_X~mVCKaj3t6BrDUuf7?2q1hXqpf8G`YfLJsyv5Bn z_ihwtvLFUw30ZckW5r{Lkz{@15u*R<+7(fLPvp2L?w8B3S-!6La+!lk=)oD#FZ<`= zLQSeM)uu9@qil}TXlR9)WO~rAoEoTt9MI}sZDD#$vA6=y?vXcTgo83i(p~HZaKj{( zb2tW}*u#$K7}!flId73Aml%vm=Ix0#`M7*ijd!ET96rg(?7u;-;Io>$)j=EjVM2RzgKE?ySBbV>Uo;iSh zCO}z4?zYZ=gNmkiP7rolBtU-?C7Cop(+Y8nmR{&EDdXR?6|}97yqNhUlz3vNC5HtE z+&7h)pbr!qZWp5w0UIt$v`YmE$vT_cM#!#NJm-y=*FO=oDx zb+;P%EhtGM5_UUaO2L!nIh$l2CdX6S;7eGk+2HD9h2Gg8Fo<>0?Ui_y6&04ER=!R)X@b0Wy)i zk!vFzCi`|IYJ9EzdwW;E_e^q=lld&#sdtWL_TnW00{I>OKtUo${G)iyU~7twmp4_5 zluEyQ1YY!{1-%5PKR*|f-=!xBi8g^uoZlZWi-q~7`@A{K(53AGalXy}H7K?;Ut?%< zk1|hIO&!FETPEN;zy^=zES%7?|J6Rb9-Pj2)XPq=s@UeWJeoA|%($swDtfE%i5&8l zi|I_sp419+d4wA`o22U3!bP9`Gt_$H^@t&sLRW7=!maDv0g}7Q06_ zn-DZ}bkjdcsDH12T2q^bUdF-(TFRWIAPP%Oxs95kqcqP$M}23i>l09JpyT}bkHlM! z+96{n=0`y|No=AHls7d(<5k{XSM3bwbH^T23|}i|@_l0mMJmBL)f^sJ(f@>LAxKoM`bHWRLdq&ALvd)45Z~#k!Aog7{yh;~^&?2A-UW4!Q?POZR z-WJ6S7RMi@d?pZ0%GJg2b&LBr_0i8zoue;ZkM!ldr5%C9zf8v}_o zceQd{gQNJG-84<}3PYLqCgMv+O4S&AC*DOFva9o8#8DcH&P+SBk0n4G(fV^LQbP5i z=}-s44GHJFovcpm_ix2l9yriYakE_#J_oNRtRmlH)-N zR^?R<#3ub_zRvi;gNU#BN`Pw!eaQC=P<&VvZ;wj&iY!1tmmdF*fcE|iK-1izH=q}z zCzG&r@QG0B-IBz{Ygf+qyZ3yc<}HQ9%X<$8aBo9dZ^( z22!7w>#~)>491}M?n|$AVBg)bIGOqRmn*L8T6S9g6Z>&&uqw2kHnOabo|Klh&b8w~ zVr$-&*H9qK=?Z>>(<)_UaO|x5-JbE!^r4*|+7LO>=MJ`vQVm>`t4juIZk1!;7y{jY zbx7A(4)caNyqlcX60$dG$^XGVVK)mrSE{waLd|2FAx~#(^1TxOwa1Fs_<(KMz<;St z6`5PzvNJb%b-Lm*4j9iq0Ky0;?~CFlS=Jad7h=W$&0zw1zr zIM$RwR{MI*WRh-fQy!GC=Wd2ZrpVJG=s7xStbx9t(6IBuXEjEh(ZH&?4fWX{HY_pO z;2@+c)!AaqSW;lSqoK^r6d!;c&;)gjyoa*rvldFI&7x{B&Wk@Ho3ree7K&BREjhxp zT64Ix1+1DyK=}cS=h{sQaFfa-09rc5)35Mi+?K4C`#28~l6+kiXkk%?AcZ`7$E#W1 zqICE})`k<}J~@3_ah`!r{ra%?NfbJEMJLcJcTWqzY&I|xCWfzDh1bIUSeFpK zV3;H&-?+w-iIXOD$uSdak)ecRg_>q{l`UB7#CVk(CWl*Mymbe~LZj(%xaH%{#J!q+ z5@k3$zTI5I@b+JHtP~lFxV3GwFL@)SjJyI&x3a!6c^Yc*cz<&g3RBC`7Jyv%Yh=xh znfLBy80;WmnnwivZc2H4sn6J_at1j|M{o>vZ%aJs4q%8i_h{ZM)r}$zxQSm<^bW&U z6d3XV=JDiOi?6A876@wLKIY#`(yf|VAESbSbSGhLM)|p{q|>-rzD@#=?U;Oe9*B?w zQlg-KesJ?{jEBMD;Ans+aeimj zB%4+D$=S;{X`l$Fp4(lEuJj~p_@=@yRr(d($Me^IyA?ejHS>xu=d4FfcFf8L2o0(b zHwA$V?5OE;1QU>h854&+_*=EXWVYOa7EDWz90Us=+0<7USY)3mXo zVm!V3xXZMMc3vLT_B%jw_k32iGOmW73dlZgTE}~lg(~%79wV(%On`4@6a{nIC$K!gbyf6$bn|71) z_l+`~>F1~2{}~S2Z$&@OlI=*Cz|CeQ4#CByA+`;BBt~PSKcs`(oKFugLvf`ccKCXj z)}w+bdx6-nb*g};*KjC-{$oJ9^Mm)FY2P+J6KcuD39${s(MhD`6p~yclkgVz1J{oD z8sq_YiTs4{KCQWO{!StV-YUByITZq^>C2M~K$&~S7t zo@AFxDIbGUo|%Z?gBPNrwi~y2bO}j|VPqCw69#GxYR!R1H+>=3a=Z28$ZOZ9jYFs| zsYwI!y$0OuY+0vb87&Zvh*fC^E{j~`fq+ou_4kM43{rl=e~qpKFZA`g9JiPXhy}}q zU4aFFYT8aex-#M|*2%;~v@~?cV@Nvcgg1nM|NGIME}IC?u`l#>Gn89H@04cm$gY4? z?J8YOid|KNc_My{1jgd6V7WIC=4d35sl=f z=K*B@wa<7d($ss&YYOa>kcgJ(@)f6GjcIaXKlwA$E$mYM!x%-|-&1uOz+s0)jLUO+;MuK3k>M)q=9yw+`= z{a+@B_nMd~Aj|nf$(eSkeL|ddvg&I5Z`MLeevqwJ8Ov>=cwY6wFcY!_q}-CetEr}q z?&-QSJyMevoA?BwcWQK2wF1ndH3QTE3uTH!NotDOKsH7e(4ALC97<3w=(3O1yB-lk zPJe`Ce0!OkubU3mI*vM0|Ky4HFp)EWJW+npji?wF0yHpu!U)>o`I5l7(~f~A4c;xK z+s)tYlF@JL6Vfrky6?L=rW-5V$3)B!W*@SxdJwNR>_l>7}~KQ1s< z@UENx9>>Y95263K@F#>!a$LourD%R8r!`v4UeDd!T!7U}nG9#cPj%pyA_zTgcw*2+(oVW1jp~o^N#rA`51B=5>V($g-ZqB3WbvhwubBo$Oi2{ zi-scKpOi?2w2tcgZkif7mK}ET7QQ~@;Wr`^hQt+eNOjk;6uJ!9fH8(w;9}p-CiSIL z_!HWUw)!Kg=w#qzJ2=xNIuYMVw(@!Kt%P15A z?Vn4zF4GgyxCk)93~~AyEh>2$asF#de~WT&d+hNTTj+0lUv|u^M-WnfJDT153ZIgG z-UvjKIbrZq=~a4bgK-es#x2OhYRZvLW&7pO#u3#W^Ixy*DFiq(r~>#G@-l{3j|= zhgYzeL?h;OJ}Ii^N6k%Mk!yKC8aVQ%%4uoLMaclUSk*ZCnJ#nk`dM%QpbMUBR@Xfm zH)D2s_fh-3fXyQfQ)UBIG+7-Sd_{idtB@seO$6o;=-hVV+I#f=#U`!KDElIl+8Lxn zKD^bCbgZ|5$31+Z=)J};p}?4xv)L%G+bg@m)Zh(pyqS9pdei(>oVx!;+bz4TmrF>gQjHgc9D`Z^t10n*~>+8q94_S8q+k zhwexUJ&|zSaGb(rb6!EhcHGvZVr%{}{4HI&$Gw=DZrMhN%r)EG{OzO+kQ!}9{!TH) zC+2b0dL_#eG11$7A4Rw))$pjF!@TmBj%)ly+AjLrT3ELynh0vvTg!RG)0~-wNDRZq zVlLJ91Y&r8LWF3(D6?_Q&hlo@|Rmva_oP-7F>XD%Jqddct> z_Qy5sPn*l#2WM)ziVU-hd#-*kEho)8wb6eB-}Ka&m?pj7k^})jjkYRuM0E2dq88oC z2`(Zc#VVaikE-Wo{`7*kqtG&MV?3NiUv|v&Zk}w@oX3|2tVChL)v9vU#tt9@C^hmD3tByQ-L?pr`~OkEC}Jda28x!UYH z3v9gH+u~c+W%kV26J&clofvJy2c!K`PSiiO4Bz%O6!mW8UuR~J1@3|*)F3P@>Og{bo*7Jqkl8Lm4*@|4Z#t`tW~esvKo z2X~0BRHgFRj*E`k>2nO55(UwH4S1{RgTJnmNi@ugNlz78Q7M>&4Sdm;ABnFkc*3Z6 zIh~h3{W#FLA^|y-6#czvnMsO6H;wkqM*70Wl;wxIsoMVhSbLmzHtRfUu`V4ToKY=;8(y+82;VqhM@b+Ld-mJ~;BHaIWWm=L_qZ+*8c*ZlBOv>aQKyA_m9f- zNV&oGOo}dI+ytvMO6gxB!pX1=F~)P2O#HLj>c^2nMRU$yA)w9AesA2PK>-0_Wg&U4 zQo(nyRcD}nQ>Ztfm!H#GD=6M6Z5eElSMcUgAYVc4*0qYS!qD$`K@;RO%tlvxW0^gy zzMpY7S*ehT%g;Pyzf0J?zx5oGNCIi~l$2e)_-CYwRdoOG3X7zybm|$q%-Em~7m68W zvO+|U74j@CvQ4Ghr|7~pl36|r;!qDRIJuf&;l<-rrp5hs#*JsV&O(*g(P48uEj{8P zE-ybjO;_>Qn3bxhzXLZj6~CUQ?WMZKy}+VILWc6& zkG`d8;)~Hx?KRJ#RHUCe-MbK2qbT0OFNK#ou2ivkmSy>P*FJn=22p~Sd1g5L5_7M$ zliXhl6-qr%tF4UPaHhKHR2CGa^|8J6GDKyG7Y~Q6p4*q}_<%(;#ryvGo16q&ep^9X z2yq6efpGR@zUmg;qad z#KDk)q{eNK(yS8LLE?;t_~d%gT6B7Hk4fU|re=EUaLcU<)p79B)J#z*tS*7h?MgPR57 zNl&gRB@Sp8qRh&VQ>iBPV(6$up0%0LzBQdG+#*8*&9>smPAPT`>r#i44E?_o$@~(*{5Gmh*2hTI495~k~ImY zAEaJjx`dGMuqV^E>wvYW&2Nis*!)CGnjqi$uU+O8 zs2%1)2qSE9bpvLacL-Pyg&dfk{b1%H_?UO}J$a~f#B`juN5so|sO>*u!s&VMEo<5b z-Wgs`R~|<5Q9tsQeeK5d#);>)h3E^~>{fmiiyUrKQsC118a3RXZp-k6!>7q7>%%gA z@L~3n8^f#C$;jKHXb7}C)sy$OwraN$d324jOM??@o!e91=puT9uU=VBcOxs|eyCyP+^)A?zJ1dK`2~%7x1IzE}?n>L*lT1+xdbClWkr~JR01b z{4ff|{BO15g+}a+-Bn4}d9jC>mORtqeckVox(60?}#?+-T zTt`DkKG7GeWC4VPZA6G|)US-ngNCCay8=kb+@_JHD0yN9#xrk0(P3=5ps@u10@U~Y ztB6IO7I6i^-JNxYYG*lmx;Uv#P_`Q`aHFb{#M!0CJc7}pgiiCSFo~D*uI~2Z1nY9Tx?*8vmdEs@QMDLd zkD;t!cIt9FN|?7-U9}@awj(9}0(Lw(7_W;}o4#0jAFLYsF=LL33K$it;{ki4o^BUB z+<#aV0!s+?05mndWi4NyD$h+7E)%=+H5oeWXp;6u0VNy1E0gP~gi^w4#+Vc+<~eQt z?=c#?)0@EtGk!|>HBASkBV;>9!~&14irwjG#$JypjjabMFt#K=djtoqxD1L*$6QBx zbi1C>T{5!GP})C~=#?$$XfW%uT9Hd~*aQdFDOzp#6T>U4U>)-LEwQgQL0ZL$qPrh} z{LomaU}#2uVOSS*6z}T8{P;pB0#X}o8=S*ef z;pG4!ED;3Y_ne&)iDbIWJZATWw{W_Xn1;D@27tP)y&-;}gjn74Y#g6ZBHR|indb)SW?Y*&eT!me6qZV~+PL*9@z$C*L??8 zooxgnw2x$!dy5~eOuT*`8Ng|TJnhk%hVT5CaksbwnY7b^l(Z~iramDll)2$F;8*io zPjj@GZv7xC-|EJdJN-~n{J7`$()Hz%>1>Mm>sbG>2Jup~grg~&5;9Tpq5L~nmiSZK zu&?%()dA%yU!yQ`oTzQrSmF{mwmQsH*z}ax?czvV$t2sb$FL4Os(OXon%=6} z3+VB8Gn+AuTY_Q=)}9+IcTyta+*}9NUR`O({Zg>XtF{`p9jbZlb|;*J`Hu^o?SPb9 zz3i`lk(BEG%XA9)OyB(27FzCok3W@%4)QFJNlSvj#>JtaXy>xee3V`pJC2;{knh_+8gu-Q@o` zAs0Ci&H8xIp!mO<9n=E=_#FDvczFmSU%VVX2x8b~`J+Yyv1b$4NEBkPt|T3bF@*WT z$E-NssXhACe)f&XNP?nj5G?f)QKdDMTT|_gKi<6Tbk8mRtTR&hdhhzOt#T`)P;%)8 zJoGJraP1-ZDoLC6x|k>HW@ImNDlPIJ>oUk)9VF<%-Up_|Q_m;Be^+u>E}zrNJl&f> z;%#ZbjHDjAwDC6(J!%f+)>+7A1l!Z4a2>Wvv!@(!^)@BY(xmvswLr^BOKP|DGwr)4 z{J1f)$a0lNGwxl(GZ&gKyDpo_{Oip~tJA5YjyJzomiO-W7JBYrmr$(2Pxkm|lKD2b z%^3{x{3srr)-)H9H-*5*mkI*O4CvO54BbtDX@g&mz_&NcR@d}f*)K-~U+eU;d>vY) zu}|I#bpLuT|GHRARW6bE%S}1v1i@Dl)tCB3G;Q`@^ZK`20dwx3L~f{?I@tNiN&7RM zXUpTKk~btr?v)L#|c$ic+q@P!HKnMW9gW2%!0d z0q}JMH7*R#L952gVm8(QO2>jdh!lF1A4%%M*Rua@P3|JQww+kH%7cDh4wtj*fs-#OVYW+qDKvILtr{)|Fp1 z0CIHg8V{t8ckr@Jp%3u4HwMPaCg{{8B(4L&TB#d}uicn0P_NQUCBF;-gpTVE*@SfM zpB6Ue3HqhgNbR@dWFHR8g(m-Ui(PQ&|3I)Qu6uTqVZ7R$X%Xo9m)ITKuu*5zd{JkM z;4A8$pjoPN-N9}xBHp05E1Vza>}pru*oOydIsx>APLU+Z5(K*eK&irhZ+1XnXx#Hg z|J<87nIE|!H_ZTOfO*!PD$Rn6_|)@)d-x||e@9AIUjd}izeEjvGgqpzyYO!Yr`J#Q zj9y-C#b2`Ae@iS@hu+$^+^y#r7|r5z<9a-i_HADWbl2N(J!#zEFrbIdT*`9n6$>%V zFbe}+q7PCvD@X?D{;u4SMi=fqe6jHtavg1N>J)4P1Zq>#cN^8ca0!{gkY4s`^81`W z+L;k|(o|6+kHg5tEkOcJodGRtS*{$8erYKh9?%UZiwIiC=htCunlSGtOhBWEv2Gzk z6Rp@@DCCLV6aPVtXo{ib@#zh7gT~Yc@2Y8eT*Y%H&ZJem))vI zs2}stelh&2*m`7&7cb(MicNY1ivZ(hjxcp8LSsd-kZ%dxj>OfO7B?FUixDHJEtQh4kj{W z;5^Kh@dVh)YkxtOw)Xk8^+|koVc8^oL@!Ym60*<^MR9LKJ)WwTwg+M@u%M3 zachb>`|hYoyecdC7)%C@i5|LvcN_rwTsC4b^6)izdd=%^-akfTDr>mZh{JYn%-+S| zA^5T^65cMqm47IANHK~qUb>`sGd@>#-wqoxdmZ&P+OgpM( z#)!U8^8Vew=eB8f?kF@_E^DBT1pKX*%0Wm$Q%biL12u+8#!XFY8G2)y^W_i|1nDu* z=Ue->W6b`rA1Jf#k|n)QpHnc5#NdbIU34S(CKQ)wgmQ=P?5YR-8_XLU!NJ`?s!Bqf zeDL+bMUF>FPx$xPlw$v2E{0qebf?9pH!%!b*IbFSlN%0F4OyCQ^b~ko8yl=OEGtV`VoL|B~v|1NyXn4-rAzb#s+)Bhw}BP1p`y{`Qj^WMf8pIaAiYKVB8EvoQIgD3ce(?#yR?#}szp+8i>pttCr! zR+P2G82VY1)++0ZS2`-HaBsqrkhDm@(yt995Cb^!QMZ0j*u|LayH=AeTku^%mJJ>G zTU>gQX$rdUp?r-#=8b0gvNz4-F<6Vp;L+J~(|Wl}e*D8kiQ2O2u`rx1uaMVKik- zmhe&Vrk1tKQi>uYvP+fDkd$&4CIp7D*b+)myU&KF&;T@e%;ZO%q$4qZ&k0!w5J<=)QJIz zu3;#I+D!F&i}lmDNYOVZF^%~;A7EhL!j>$X)E$ihHLSas(Ys^lgWp`(dov^Va4$#L ztV|7DV(5W)O=0gJA?y<+lU3pdf(;9#+JVT72~8wt&s~OP%)OqMyuo!F>?44Y5San^ zBaqy1rn!#B?_-f!EN2h(UtNCZTSex{CLxvHT;gf&KAhurF)djg3tEX2%ep?0yHfjd z7}5Mpid*b5vb}gq`%53e!{dMwEg9TEawey;kd#G+H@eDmBaWx8=fM?KwIXAtXpS7S zV78+yedl~wQ7p!;Q3yQ{Cx_8@a8j~rVq2lq5 zXC*iow3Gp8Bo|6$H|KGi))rr>GsS>BAt%J2K{8lhgAzp_jL<23ii%x7WTjIAcloxb{FMP&@@}(ev3_;rqN)@{MxS zZd{AAS6kDIZ}q}!naeMH{NDQnQj3=@n8qS6&qtgoof8Es73}s2mAaofB|o(nM~bR1 zNd+8FntmEG|Lt7D(a@6M+GFAp(PjPT8D(MKassD^y0G zra<`jXnRGqph@jkVX}6EHFM~#%hGD`4AhkN?bqK>w_(k{o3~A{O||_JRq}@7@tXB4 zig}#Al<)E@v4HVNCZmA;oDhzW+yd_fntl<{Ah&jtCzeg5grMvU<%zQ2o*RJMu@Y-5Xh+~-Z3mW4u?WAY)3C$3H!v5T1Zxppn*vZU(+RHvk{`r zTh7;mOBXtOQ^qwh3TJ=vWA;9{A4C=PfMDvJFmBp@Li{O#;=E_+ueH0Tvyx@hcOT`0 zT1bC!0`9kWSAaff%-gc#QoNBg+*@!_D~RWXK;^Dtlmhu7y%JjGl)8@QOVYC=5bkN& ziT>p)`IkExXbq-_;8h-LXKQ;wN`pLmDd)M3?Gjmiz8)1=xer{6c;1V&jk`|;&B}1b z1@jAa${U{L?0aRU2Fsy1>lbVKi|+FRBn2ZLP$`B}(>BE3NGLXsZYnlX7%x4~au zbuUO}ZgF&)ll%xk8dc(H7B?$PEklhy&G?T{HHW>uDr58yuT;RR~(i_3LMDsMp6@kXOLs(o*lvRFpO0k}g;Mo@rGrw;Q zku1(*iG+S@)*fSKCQwM_(>#%H=8}q`|MSXlk^Jn&|If3leO`RY6TebV7xD(%7r<#~ zCS!;~>v@#qb^qWrfYx2mtB)lIXX30Uuv9C(y$lko^$wdpO1{}VNpq0|cS&a=~ zB|vY~rPkVxaFhfxtV3ZIa5s+#olCuYbsEWKEEZtDF-{ z4@CXjmazT34g3zGmH$E@nu6KmEDTMbL*g2FFs_o*x?31|5AT>%XwoEix$aMgHy!Y??=GA!LPo- zT^VlSNC~Pc?GCK%ENQL}Q9i2X@Q-U1BIHm+6{3h?)UFUU;LV3`rSVu7cO>X{S+y{C zWs4CjT&6^_zZkY zqXxY)7n;Y_vRra0Z(9BEDuMHfCf5s|%O9lrR(R*oyFG6bnO2SS zbE91(1=sgJBN-MhH}yizExnDD@^ZFtz$#+rj3Y$ zSY0S`hw~t*z$rEUIxXDfD}3S2W=y4APT23Jt868FpCPKvWF#M0W4MK$@2Gl|RPWQ~ zeFzAn_gNtv@#{;+nLTV{G<>I%YC?48TN2f#l%M15iD%Q39VHJZp&N4Cid*cVEbzI( z;wC)q?XdaXQ;%u(ZY|al6n_%g_mH7Wbrkr5kOXXH@f8lzZ1Hr<8$D!N_QYHM%+cUp z!RG~)!HqK1PZ*Yv`Z{$tpHpD?`)g=N7>WUBlfKFLx`+Q$5RnBVmC?k}9XpZX7qUEo zUSVJb>;Ira+1k z;0cizkd#__C1mxshLqm=c|>YYWd7Wv<#HjiG99gyB{Pgx9`CbXFM|s`^iAnub_z^d zt7LOZ9R#Uyy#3m1&-b6H(^aVnOQ>*cDkm5}9T6F|uDnvo{N=)Ulx^%6xMw8&%Y_VW z#9Ulo%SCWJ-kBQNMiKiIe~UO?UW*68jD>P*|J+pVM9=rN z2>9{8Oh{;GM`;i))PP%i4k3oH}KVDREix z5i*3OU3Q<+bXVEe+a6uJYv!~0Vb7_Wg2zrARc=8x0-55_-=cX6{PHjVsPrMj9!)14 zzqBA-x=Fc=c|5|<1;bTtD;Ynqy18S84CSIbi8OE*dfW@NH*X6;6`G#1t6XYTTHB;u z8IE}-5<^l*pxSc=}rpXBw8>>wy>SVXOa?lGIuw!HYyj= zX4^(Um=Md^^5t9PWqdseLWX6bf1*OmZ`+Z1<+m85*N@fS@6`IaXn7_)S{Z)AJfk$C zR;jP-E=O*eK&*N4+9%j_%=M^Ll#sAVbXze{q?3_L;0NfAbBVyn5|Pd2xZI_Yapovl zSEJ>kGjl`f<%4b7&y;gTe!bQ6zibAK@)52O6goARne&X=;Qh$){mtJ1FK7M9R=pku zzWX8$ZIaz({Dk|q%M>z+R# zTXjP{Y9*`XKkIv_Cu#EV?#m^`%;#+e5rAG^z~Dzty-cyZq-pD{8lSW5k&A1YgBHXi|Q_AGj$8 zor?*K^eV&;C2~*&e!^eg@u|T*-Nab#3*-oR@vggY$|%m|&eYuP=N!`@9AeZ}-u)7b zNnBBA{wS;MH@b+HbF>X1kR*;l0YQcAlHLa$!R|+@t7! z$+r>h8GP`9s4trB)nl`jKG6l2Dw642pWN^;^uEI1z6NqjJ1eVYoiLBwHSO2; z+|r{<_Hg@dxO4^#%>2A{7^t+1q-a-aOEi!?i+fZT`ca1X(ndwaa~Z(=}oUU_?l2vRY=Na1(~wmO1t<9vYG+Jew3=Mqsdp(NA8Sg*dp4bnD;0`2na)iJY@Zw; zgMInjrI1ukLkk5W=*t=tr#J?8o-a$os&7pGu7Xh`^10vrfnCGBWVv zTY4CaUdL&P_v%dvAW1K8A+KaujX@OzsVr#1pCvhn`yAD{99(ZYpIzsf?^pK7xh;CN zDqx?QW!T9UORnyTbzdyP_DZBUe7{EewS0i)rM&*s{5)QM^c`V4lyOpB;E*q~!0EZ-nNgGTSbET@BU9EJl}k>39SmDN7|sqU zV@l(24(|5d$}8E{>`8i69(o|(HQL0PkaflSIk%N@Tusi&^GG7q7Z+?Zc`N?tW-^B% zDIRUc6V)h2&fMi0pxE8?5PUUs%nCX-PL4aWQFS|z!TTN_9F*gLU4<_2$pfN8i)^zy zn*uCx17pKSzuRjluHX!FAlgug4|_+W^Do4U2VJOLKoe>JSQqNMDt%p)cQZVxK_?wS z$4j*Ksci>no2$fe74wtrjymCHB0Y_oVh^steh>p@)9abwU8y%x+f*yxSy*dXywbU} zP2($7R8T1Uj}tl3X#U$7Hh z-8r!i0QRBv_@_d-5;pwpG4%EuSxH!I0M2353zB1btH2kL?hhw*Y*QI+;K;jQXCEY6OX0Wmvqwde-NM4o%dWOAA13#r`3~xP zw$xL_9)ESCKg`CZH;s5LUeixZ8&5)hJ6F}Gn8yHkg|9|+_A?n^ysrH}F>9oy!>?g% zb!mSCsxCMA7gQSah4`C6cLp)a7O#A|AI(k03A*CIQYWXR>&Xy2U#$m#%x?D0|9<{v z3|NIf2l~GG9%mHd=KZu@4Yr5+f!gbSwp8$>h8A8E8WBl-x4ko|F&@8R5 z*w$(m6kdx$8_|40CY-wWj3z;oPJF0&B1+K^D35Wv_Mj%kRhU zP2$;;uGKvp=oLyHzy7$I$mV`-_J5i?&u_T8fNw`9Y9gW=CF&?ah|Xm69-`MoZ_y=0 zmngSx3?j^4!K?4D1-E6HMTjOuwr}zJE_nf!F+b5=QY*(BH zkF~_Jz&AaF4W;lAGADFXhan}fNfA|qx}$bv1*qu^12zGypGR%M;#k=7GZxF_t_}dN z_6A5Li@Gx8bOGZfH32GFe|TqMwMEAEdP8bT<4|zvXj^#9 z{u;n0wQOT!?H?W06d<<`MQQL>uL+Y(>1V`%Lf=W_41U-czjFY3W#cdJKMe%2b8gW- zI4t8Ji?6otT0xBNXcc9}4m3X@!W~-;Lo)|M zDM3QlbC`LGq@uZTkmCUS5&um*md}~iK`whP5<%~SfKHnBsCJQ3c%+2(y;?w&+mdI6 z_lTt$m)+q2e#9iIF_Bzq@+gGL_3fkY)M4)^^%LY%5lJ}r9B+Pr%rGu_1M^1y^9P~P z9~2X3k;7;BbX4@aoev%F*!6d!Lni>xvfj0@_>{D;nAUTt1AUT=_=1W1H9~+*^ib}( zWy@hR9Q;YBwJBd~thJ6d1jbPVrP3y)pVzxh=Ab6*vRL?Z8UVU`g}I>Q(nUS=5)%a> z3qZH>d1d^X;0pf6;0JLJU%#zr=BHVxBZu%ByUMz4ls_W)3Q2fRu_Dow{OfQg!bU%A zuPm1fc>)}ts=bdHF5-`F12>Z@FZae2NfG)zq=yE5_qLpc)&`vvPiKb8o}E#-lLZN^ z84`k1nfJ6#4P6o#<1goHcVrlwtSW+>@0qe)YWJ6ivOks6lh0%!9Th^Uq8B7n&fkn) z=+^`WS2VNz#RgLj@8crOk`RZE-EBW1u>z}dP~mweI`18s|n zSd(=;J_+8c;HuzI9~M{7#DUsijcz2{C#?XGe}umK_bW-~jQ6fW)#@6oY7w2UkB7Y@ z0mx!c?sI=g-4?Eac>E73A|a^Z+lncH2Xy8XU(v2^G4xad;0+&PCbsyLPA}PeVSH=c z4bqpPW(Jg>;YRAh$GDqG(y-z*-GGQuyHCrm{bmLEW$o13%BNf0M?O|l_OYjCD@vdb z#GZc6wbQM2sf0J(cwYfxNb^R!!K9yX6Kfa6KZ^P5YEXuWL-aIKc#PFgR6z-0O{iq* z(P53qYhrDg7bM0Kf$wUCu!3U3m4|x59cB}lEChhEs0pOx7STlArj=x4a?WBOL%-%3 z15#rsQPeI%FMBvTROfF7D|6)8E+2R(>raWygOMy)+MgYRI*aLAv~_*jF|JG~eXU2` zs^%at8q0Lud?J|(DL;E`{z&(7{p>U4C|8t(p09V(^s>S1?0stOX%ugpG{c%1>dSSC zq;Izc#{?)@(_fbbN@ccHQ@-UrqKtrK-m|lAbiXkKktxnp;9eyYA9WiwGeBUbLbs=Q zoHh!6m9&%yqG4Dnye{dD@}kllmOhwq&bn~fjY0B3fuC051x{%%4H;W2G{VX&jmdn{ zH-x&z{Ey*4VQcETyUM$is+!QQl3tg6sbgAlL1KV;6?o9QO{d(0G+`4H&*5 z-*NqU7~#5M5ERC1u=rIV%!5Yciot7aSz_CATU{^jC2a9g)ew@I}2)1gT1 z;_HmBp1p-*4vy@jIdwdm13sEhP8SSp4dU=%KHkf#g&gFY4Gp=rBz$4_%wW z1wZ2WI+fY z$lst#6OtAisTtA&;5S!nO4Ks7eM3nCGK5B~9JB`+)DL2~nyJIxmnDMp=nlwBUVZkx zpjd^3+~{fWZ02yu9AKG=HKk6Zv(y7k_79n59Xt-z$gGHW_j=3QCYeo#5kpTY4YVm$ z`rXVIN!u`!Q6>NPOwgk;BkP^GTOG9IyC`s*rI({Je*aEplh)nXKS>Z`v%D1VrG%25 zoWAaO%05He%ii$D2lxeXJyq9oB!A z*x94LP54SbwbFHuL%oDheIKKHBxQ=SfKa>(36UxYoj~O9+)%|&s;5grBT+%Z6{2xi7?m2$?dojYY zWDSs4*^>~E` zW-F}-^5&p15|11#=k&~%kYBzq@G$%R0g?S~dqdy!vutzMD0oGUGP=z0jVN)|*g1Bp zXW?meX7bSAbfP!31lIM`0{W-}ni~cn7)eMP7l|YhsJ=;tF~nZ`6xZY0>%!iZtP}Z7 z>k*hgPfvKjZVmmbMBm;!YU^1@$+-MQpMF?XKfd8>m84*z^fx^Pb`azogds1Olm1Jf z`G=rJrLQi}9q4fizu(r&mCyS6g?@zo_G%RTZqlA&&O>Cj=&f3L*IHizI zuqygSQ|7GpI^x;d9rjwB)|US%BvXF#dRFS~K60%8Y)g|-yG(RY*QV8uYbYS)4Rk21 z3AXp-6Ayz4A8C9sI49UZARe12CY|3sG}+>WfwrvPDx%G(|4FeC{>!o^6Cye*_zONd z5J$hRDakKA2Yro-G1g`Z+k@pdMF{D{YS6YlOH{Fopddr>A^#aEe@!!STl=1b?(e@0 z0c_58_6b5frk!gsO2;dB@>txtLHChx~vDX3D|PaBNq&NA*Ln-#$^h z8|1#0q#eZq;KKN6n2$vZbn!md`27PohHm~6hkf-ML~ku-OOaN1S_1+D$m8>>{h5&6 zyrWLuO1p~W+o@I`h&40DlLq9}JMI~KTStgoh**&@k^9(D9f^N6bPS29j@?PNr%-C0 znCy$(+||(l&z9E$abz`1j6u<-H7>|}GnPaX#+`>mZFRLsVr##9EcRcndyj zvR%jU`sE68iPCRPf}BVhJB9g}G`shU6azsrdE`DS40n8CPt;k9YJw`{DBkn8O>#Hm zl<{smo7b5h)Ubv0iS?%T?q-Ph-|%}wO)BC({vI4mri(U4|O~C zme=Kzj7IScUw7~x_w;lWY@!JzBrOjYi9QxinRq-G8IlpD|_sX(IvcwUmrnV#n+X7En1d^jurx|R^K#_=FdX~*=tagevd`dE_oH~Xlp-(KnZ zi$XI>N{8AgO^^7{lrnen0~x?rF*ik}uIMv&nDx>dr05);x5DG_O)X@o2<%L{4>jie zNY;V~-8b8^eksNU!mmtkzD1!03Po&AHwnLar86MO_2XMqf$$uZ^~v2_A1=KbIP0oX zDAWY;`MSf03-Jo0YxSNIv{(Rc4z-&Nj7X^Ozs@ea`5nJqV2&~Qoy_%icjt=vclmzl zJbPTdQ@n2Dt5dN6b-r7{n3HuC>psw_uekO2dbcV?WC5t^da>u1Li#qz_txV(1~0g+ zl#>XB>%rVTcBCNzHtBu|p&YWDb*#sAgi~XcYl;Cg<7tXe<{$aCAcMamCHH=o*P`V} zQ+EolaULnp*t$7`UmgNP# z-PS`V#<8!GIu={F4#9>P90YZSn{pcm6vn8{PDBYeRNH0_)dRI^3DiNMV+#@ity+rh z?$kc0_%j#Y+1x#EAxUFuu+koge6OD;(~q{RY{Z$?xaELIb&T21T~IbZs)gOOk?&Lr zY?pA3q;4yyl%ChF*mc8}H@l(W4B_SVjDHN?g0}OC712F))Fsb4N|1xvgMM2cnO!&2 zDH-+IPFQpL9Y65|+?Y!V#%^8EAm1o4Zx1l!w2TV|+#18%vdvS^&K&im9+(@Tz_V{FYi6v8GK-4vBai%-9s+1F_A$M z0NIpy6co6uoNi3*SFo2r23Ek)wrb==e{m6?++tY%Beyh76TEeu%8#Q=a9-@=Fq`o) z%`t1kb|L1ufi8=~tb#wn>%9*w@qqNeR)PqR0Aozp`zQ<6^P;Eyw-S8=uC*wg^VFl#3 z5S>i7SqI#OSMUYDmuu9*7WDss7$?YMZ^inaa&8~O2_}(1? z?Nu%jc9I6KL!zu9?5FRXafhvtn&bZPkfeiEe4&P4?MpGSjE{ta5A`Ufeey4B2sTQ2MCpcB_z2DcO9+Ujh{WHucL0zTC<~gh?ut_ zcr#{f?$nbjEJ*WhKF9HsSp`P^12Uq~iQeZzm)pi>Xzr3dzPn>CG#IF3-_gsM3`<}s zenl{7dp_bB+NkqvEg+_5FXg_&T6SkkSKXTX{_2KZ(d;|w;bGiocJQRy3qt9k- zzor-^U_d5n>tomNZAjkfy)!5t!WloIeER*vV8ePa(-^~bF{BOxevw79#6AY;yGbW{6NTp81IEove86 zRZ47KVWfup)SY5Cha#R@Zxm>JBfHyZq={tv!JEs{ohGw4jdHOf?Xf1Wd)mssw8pX& zVxN`M?j?@%d^o&K>9)TEe!19KcaymP;Oz%n79o{ut{Q*n8Yr!>+Hb}|si3*^ak`q1 zNgPfX`A_f0i4Ih2qZ6pDAVNeIDd0+(@sEMVT9Y&c+~H?|<+p}rnpBitz}?qU#3;-h z9{rd?k2y`DTOOLYdPD<&=|Q_`e=LKCPzO&PiMh89+c95yeR0e_p1abln{Y6sRyvRBOw(QL8Ja(i=M{7@b=HX0Lp#B_YfMwWl11#|&=qKVA z6gaNq4#v(I82BGqH$R2dKNJTNnj!d%6U5C8|3Yt_6IR}p*15*k{`kleJWdLl{y&)bYq9>r?d7C72(~N(>Hur)rc45)z51}kT{6j9g z9}-d1G4u^-@HRBQe;IL&R3y*Q|KTWy& zimW8&RZgIYEucyG&~kFNs@S8cD%Gg1?$xaU8u)5~>W@nT6Wr5?_exUWdnC!HQ#ug7 zHy%U!b?l3gDuM!|GtS@H;P5B)34YE$2Gvdq+2w{R85i;jy!q+Z{dScO)2~A zJV+PXWU{M^+Eo)Mhi1;xr;B7n1WWNUmz^5C$$Zd_j1Nd&PyGJHFHt%Ne8S8$g{r@G ztZio3WniUto5{0%Lm25>E?gGMyPf>Btdh=GCcmYA3#^=9R;l*@8y>M)PgJi55cV5l z%X6-FjwTxN;0dtYB5JLvYyN{~BRclJm{7{s zT>js@5>gV4KUQ%g@dpJmm}6S^g+W>V9jeM6z4po{4|47$5N*f8z7gqi&UG4vE!Z&3 zMbp1hV}ys6JC`pUdgJy6(vlo_@a*HNZlw#}$UwlwzG9sJb;DVxSWf{hG7B13TI8<| zS7|*SC#}94N74|FmzVuaIyHvJvp7N*njSw3p{0loh}wC*_H&kuIkhG_E`>@mE3Oce z&*r@x*<~+55>ewUTc0@{Ee{x4xIwegp^@`&*5$CRoBl(I^hoH=Qn7W(;mAzLKEa8G z?l-W->si7*h$H$mzs>M{z_Z=k=i&y|aCy{XMs;{Epa0VS)8EP)tWq_^^Oy31NJ>1P6&(p)?NHxovK z#TYDNqAh^`;g2aya247HJR=dAcJ^Bjy>0#m(osYbT&f$Q_)C%y72hITM%(KYjE{XT z2*SG!pxshq6b5&5p?mK~y>-s0UXPcJ^^xXl*-Rl}{X@Bid7( z5=W=7awQ5w5s4a6bNdhR&rr<<7tQ*k^8vq?f4B@F zO2e)BMgklfnTU)|7v40^Xe=_4wmoBcz0x~O>anPi%+Z7PNSKi@OQxpy0p{}|3Gn2y z>+r~kIB-|!G@1e8GY#7pVmmV5iG~(j+nIQbI#*+lcK6RsM{2GmmABB7Z35;wcfotV z`Z)(BJ&h!pDbH9ujjSoVf7i4aT~((3%iuoWx=IQEdtK^WyH z0L$?sZna&K(x+5}Qm7rNGNtGw%UML{P*kTudYBEn$~s>UM?~hWjR(2v$$lM3xQ#<8 zOGpIE3Y|l_Z^dW7&;*$zNR^YEK^sTZK8t_6zph4)$dK~dX&`|U@?J{`D%XhKujY|( zx8nDgv_TWXkal`2zlT8LaddC4)zkB`kal0TVmluF2MWUKTOKZ%JK*ij`AXxmh)V|) zP6qY!WHmoOhn2VwCjLdPkuo-A5%@lFq3CJ5{XgM>+&J1I|7%r%wwv@5fGTDO3q-lM z0y?>2nXjV66&Yj=3P2K*J)x)AC8Q>YGd2DMR!eg&fdyPB{q4T_XN&WPR#>l>2oRpu zEVTVSBzzaUS!*NSb(Qme`gnQ9`!)i_vnD)t{Fg3wzXKvQX95dCWzszr(*51@?=hf- zP##iZTt0HzV@r3dvd{n-Z_7Oe@D!fbz+=I$H*yhrPkY zOO&%KOLB|8R!KNHkvRKXY}pa*OTeI|W-=rQuil6~t5_A|(AWAM$Ns3s%Jbd#=nA+e zGtqETRjQ}GwUsH)+8NILckQWpCJK;FXl30QiG6`Oj*Tr z+z&^M8w7lLveF&2)dGOO5WvQrTmV9+yzA}h>`N-wexw`fx)5Zx(ItoQJ=Zwls_M;_ zVBpsUY)*$^MB4^ZdLcu+gE;ivVFyZ6V$$ZsFBP^8#AAzFz;A`=eTuj?vyy4EUB+VCHt9=<%s?_wu?UFv9?5)F5P!5(vROW_2wdn@?a$nQYh;YNVl2eOLU zas}K=ZE)A(K}`)5Z$9Z%>CPWJBd2!G^y(kD8WT=dH1s-me=^xmTCHu_zv>P~rW-t8 z*(1%3-{H_F9UC)2K4`pHp8ECOC1BrLU* zpq0S370utvK(X%=u?;7o1*sQ}J7JfTD6z2H*xL@AWzolx7o&p^dew``?A|Z=iNi*I z`a5lx+&q;Fyw91vys(RtnQ%vsYdVW%;K@4{s9MOnrSFIYP_8=|2G_cqxD8y>`xTO$ z@-^9Z0&v5$a+08&=5}#rn4j;-MJ&1ByeokpGB&*R6GFJRg;)FC*)T=#D*T*$#j(H6 z@1YxlgiWS2iOU?q^3RI5%Qj57Q*LZ$kyl-gR#_uaSH-j_TLK787c6;F9Y~igm~*rU z{AM|Gi20tYu_#90G=Z$(`&@6K5qxP-S4NGWM`%b|{t<3(b24l)JNcX+y$T=?-)k<# zpW>?W?n|c*mflzJGGmgsCTQq?C++z~MgdcbPOodeLM$W@) zso}O1a_~qYm%6gs#>2Y`_l;!)e($^W9J+bX2y)Xe0ej?cxhVOsx%M?#BO`5Dz^Atu zHlh$~KtexDoSY&=GM711^Y#c0ABI=je0xIGuBzxKehWV zbLgUjN7tW&{%pK2eCSp0`AJc%fOT*UbU6(>o-bb&Pxb3w*$zMJ{*xO3w>{x{C^tk(L)}Ogwmz5!F7C1jWW&4)Qb4uP)X{q?$DP z$G@KS%n?6Y4lu4($H+$BgGN%B=c#JG(X9Duq0{{ZFX>LT5`mHoqCTHRdVh; zc+g;gx;*}Z#FvXg3I9Y2RS9UDeB^)L|E$f(;7m#NEaK*p_+0vdf}-)a-GzRXKy|m0 zRuVAag{;Vj^-}xNq{Jy+a7;Hax9a$Uz`NK;zVvuF4A`}{pKj^86lC9f4vjJzKE=&} zMta7=s%9JQ`@o0F1*tI)yn1$suw7_l_(Xu|yFIOf2xr}<+f3WYN)g_bpG)WV^*h7$ ze<}yL<+mRA)JziL2NIqy*BVCc-#ZHZ0KA>!yr#B%1x60m*~G&l)=R_i=br;t+gb{3 z$uTX;8QMM!&P6t|Dgqp_>DXK4qAzm-TP0tRd_d{Y?2-8T}yMVnOl?$6{ zW4pk(_=VW?UCdGYy7{jk^AWpKaawin)2^XYCL?cbd_HeedI&j}Zh_rrXNo%!XgBHV<>_87d5lYs)$pa3(4xFZ{B3+*(w6g45g8$sID^<(!h$$bcU zJ{BWtS3p;U9cLk-y!@~vMK15NMBgN!s5>rC1pwDTb9vurCy96FOth1Xk@u^@|8f4x zt_$|>y>O!&u(#%FoV&U=F7>)n=U)E3|J~bU?FSQQf0tq?GVjuDR9yqUG*onzYaZA} F{y(39yqW+2 literal 0 HcmV?d00001 From c384851488ad518c0bc2c22e76265c80f120dc2d Mon Sep 17 00:00:00 2001 From: Den <53200638+localden@users.noreply.github.com> Date: Mon, 17 Jun 2024 12:55:39 -0700 Subject: [PATCH 3/3] Fix broken link --- msal-dotnet-articles/how-to/token-cache-serialization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/msal-dotnet-articles/how-to/token-cache-serialization.md b/msal-dotnet-articles/how-to/token-cache-serialization.md index 36327232..ee37d169 100644 --- a/msal-dotnet-articles/how-to/token-cache-serialization.md +++ b/msal-dotnet-articles/how-to/token-cache-serialization.md @@ -37,7 +37,7 @@ The recommendation is: The [Microsoft.Identity.Web.TokenCache](https://www.nuget.org/packages/Microsoft.Identity.Web.TokenCache) NuGet package provides token cache serialization within the [Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web) library. The library provides integration with both ASP.NET Core and ASP.NET Classic, and its abstractions can be used to drive other web app or API frameworks. >[!NOTE] -> The examples below are for ASP.NET Core. For ASP.NET the code is similar, see [the `ms-identity-aspnet-wepapp-openidconnect` web app sample](https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect/blob/master/WebApp/App_Start/Startup.Auth.cs) for a reference implementation. +> The examples below are for ASP.NET Core. For ASP.NET the code is similar, see [the `ms-identity-aspnet-wepapp-openidconnect` web app sample](https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect/blob/archive/WebApp/App_Start/Startup.Auth.cs) for a reference implementation. | Extension method | Description | | ---------------- | ------------ |